@teamscala/service-boot 0.23.431 → 0.23.432

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.431",
+  "version": "0.23.432",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -16,11 +16,11 @@
     "src"
   ],
   "dependencies": {
+    "@orpc/server": "*",
     "@teamscala/agreement-generation": "*",
     "@teamscala/api-resend": "*",
     "@teamscala/auth": "*",
     "@teamscala/cache": "*",
-    "@teamscala/channel": "*",
     "@teamscala/chat-completion": "*",
     "@teamscala/db": "*",
     "@teamscala/db-validation": "*",
@@ -32,8 +32,10 @@
     "@teamscala/file-lock": "*",
     "@teamscala/formatters": "*",
     "@teamscala/generic-registry": "*",
+    "@teamscala/host-command-bus": "*",
     "@teamscala/http": "*",
     "@teamscala/logger": "*",
+    "@teamscala/mcp-multi-session": "*",
     "@teamscala/notify-cache": "*",
     "@teamscala/object-storage": "*",
     "@teamscala/orpc": "*",
@@ -45,7 +47,6 @@
     "@teamscala/timing": "*",
     "@teamscala/tool-executor": "*",
     "@teamscala/watchdog": "*",
-    "@orpc/server": "*",
     "hono": "*",
     "pg-boss": "*",
     "tailwindcss": "*",
@@ -653,14 +654,6 @@
       "types": "./src/handlers/messaging-send-sweep-selection.d.ts",
       "default": "./src/handlers/messaging-send-sweep-selection.ts"
     },
-    "./handlers/pane-outbox-drain": {
-      "types": "./src/handlers/pane-outbox-drain.d.ts",
-      "default": "./src/handlers/pane-outbox-drain.ts"
-    },
-    "./handlers/pane-outbox-drain.ts": {
-      "types": "./src/handlers/pane-outbox-drain.d.ts",
-      "default": "./src/handlers/pane-outbox-drain.ts"
-    },
     "./handlers/platform-fault-escalation": {
       "types": "./src/handlers/platform-fault-escalation.d.ts",
       "default": "./src/handlers/platform-fault-escalation.ts"
@@ -709,6 +702,14 @@
       "types": "./src/handlers/platform-fault-escalation/orpc-client.d.ts",
       "default": "./src/handlers/platform-fault-escalation/orpc-client.ts"
     },
+    "./handlers/platform-fault-escalation/probe": {
+      "types": "./src/handlers/platform-fault-escalation/probe.d.ts",
+      "default": "./src/handlers/platform-fault-escalation/probe.ts"
+    },
+    "./handlers/platform-fault-escalation/probe.ts": {
+      "types": "./src/handlers/platform-fault-escalation/probe.d.ts",
+      "default": "./src/handlers/platform-fault-escalation/probe.ts"
+    },
     "./handlers/projects-digest": {
       "types": "./src/handlers/projects-digest.d.ts",
       "default": "./src/handlers/projects-digest.ts"
@@ -717,14 +718,6 @@
       "types": "./src/handlers/projects-digest.d.ts",
       "default": "./src/handlers/projects-digest.ts"
     },
-    "./handlers/prune-stale-data": {
-      "types": "./src/handlers/prune-stale-data.d.ts",
-      "default": "./src/handlers/prune-stale-data.ts"
-    },
-    "./handlers/prune-stale-data.ts": {
-      "types": "./src/handlers/prune-stale-data.d.ts",
-      "default": "./src/handlers/prune-stale-data.ts"
-    },
     "./handlers/registry-stale-inactive-sweep": {
       "types": "./src/handlers/registry-stale-inactive-sweep.d.ts",
       "default": "./src/handlers/registry-stale-inactive-sweep.ts"

package/src/agreement-gate/signing-shell.ts

@@ -12,6 +12,25 @@
  * paths adjusted only.
  */
 
+/**
+ * The body content array for the agreement. The public shell composes the body
+ * region FROM resolved.page (register-registry-page-route.ts Branch 2:
+ * `bodyPuck = extractPuckData(resolved.page)`, returned un-cloned), so this IS
+ * the live array whose mutation reaches the SSR render. Header/footer are
+ * separate region sources (resolved.header / resolved.footer) — never the body.
+ *
+ * A prior version scored every region by top-level non-shell block count and
+ * picked the highest. That misroutes when the body wraps its clauses inside a
+ * Container (body's top-level count is ~2 while its nested clause count is ~40):
+ * a /header region with more top-level blocks out-scores the body, so
+ * onUnauthorized cleared the HEADER and injected the gate there, leaving the
+ * entire agreement body visible past the gate. The body is the resource page —
+ * identified, not heuristically guessed.
+ */
+
+// Why: The body content array for the agreement. The public shell c…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 import { findAgreementGate } from "./signing-session.ts";
@@ -29,21 +48,6 @@ export function stashAgreementMeta(
 	resolved[AGREEMENT_META_KEY] = { id, name };
 }
 
-/**
- * The body content array for the agreement. The public shell composes the body
- * region FROM resolved.page (register-registry-page-route.ts Branch 2:
- * `bodyPuck = extractPuckData(resolved.page)`, returned un-cloned), so this IS
- * the live array whose mutation reaches the SSR render. Header/footer are
- * separate region sources (resolved.header / resolved.footer) — never the body.
- *
- * A prior version scored every region by top-level non-shell block count and
- * picked the highest. That misroutes when the body wraps its clauses inside a
- * Container (body's top-level count is ~2 while its nested clause count is ~40):
- * a /header region with more top-level blocks out-scores the body, so
- * onUnauthorized cleared the HEADER and injected the gate there, leaving the
- * entire agreement body visible past the gate. The body is the resource page —
- * identified, not heuristically guessed.
- */
 export function getBodyContentArray(
 	resolved: Record<string, unknown>,
 ): ContentBlock[] | null {

package/src/attach-proposal-accept.ts

@@ -57,6 +57,7 @@ export async function attachProposalAccept(
 	app.post("/api/proposal-accept", async (c) => {
 		let proposalId = "";
 		let cartSelection: unknown = null;
+		let bodyFailed = false;
 		try {
 			const form = await c.req.parseBody();
 			proposalId = String(form.proposalId ?? "").trim();
@@ -64,9 +65,11 @@ export async function attachProposalAccept(
 			if (typeof raw === "string" && raw.trim()) {
 				cartSelection = JSON.parse(raw);
 			}
-		} catch {
-			return c.redirect("/", 302);
+		} catch (error) {
+			log.warn(`[proposal-accept] body parse failed — redirecting home: ${String(error)}`);
+			bodyFailed = true;
 		}
+		if (bodyFailed) return c.redirect("/", 302);
 		const back = backToProposal(proposalId);
 		if (!proposalId) return c.redirect("/", 302);
 

package/src/auth-gate/public-paths.ts

@@ -22,22 +22,13 @@ export const SIGN_IN_PATHS = new Set([
 	"/magic-link",
 ]);
 
-/// A STATIC ASSET IS NEVER A PROTECTED RESOURCE, so it is decided by EXTENSION
-/// rather than by remembering to list it.
-///
-/// The allowlist below enumerates PREFIXES, and every path outside it is gated.
-/// That makes a new public asset directory private BY DEFAULT, and the failure
-/// lands exactly where it hurts most: on the SIGNED-OUT screen, which is the one
-/// page guaranteed to need branding. `/assets/` was listed; `/logos/` never was,
-/// so `/logos/cropped.png` answered 302 → /sign-in and the browser rendered a
-/// blank logo under a "starting up" splash. Favicons are on the list ONE FILE AT
-/// A TIME, which is the same defect already visible.
-///
-/// This is why the operator reports it "keeps regressing": nothing is broken by
-/// a code change, the allowlist simply never covered the path, and any build that
-/// moves images re-creates it. Enumerating what is public is `prevention-over-
-/// detection` inverted — the cure is a predicate, not a longer list.
-///
+/// A STATIC ASSET IS NEVER A PROTECTED RESOURCE, so it is decided by EXTENSION / rather than by remembering to list it.
+/// / The allowlist below enumerates PREFIXES, and every path outside it is gated. / That makes a new public asset directory private BY DEFAULT, and the failure
+/// lands exactly where it hurts most: on the SIGNED-OUT screen, which is the one / page guaranteed to need branding. `/assets/` was listed; `/logos/` never was,
+/// so `/logos/cropped.png` answered 302 → /sign-in and the browser rendered a / blank logo under a "starting up" splash. Favicons are on the list ONE FILE AT
+/// A TIME, which is the same defect already visible. / / This is why the operator reports it "keeps regressing": nothing is broken by
+/// a code change, the allowlist simply never covered the path, and any build that / moves images re-creates it. Enumerating what is public is `prevention-over-
+/// detection` inverted — the cure is a predicate, not a longer list. /
 /// Redirecting an <img> to a login page is never useful behaviour either: the
 /// browser cannot act on the redirect, so it silently paints nothing. Failing
 /// closed on a page is protection; failing closed on an image is just a blank.

package/src/auth-gate.ts

@@ -24,24 +24,6 @@
  *   the local better-auth handler is used (dev-host fallback).
  */
 
-import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
-import { getPrisma } from "@teamscala/db/prisma-registry";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import { resolveAccess } from "@teamscala/auth/resolve-access";
-import * as v from "valibot";
-import { configure as configureEventLog } from "@teamscala/event-log/configure";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import type { Hono } from "hono";
-
-import {
-	isStaticAssetPath,
-	PUBLIC_INFRA_PATHS,
-	PUBLIC_INFRA_PREFIXES,
-	SIGN_IN_PATHS,
-} from "./auth-gate/public-paths.ts";
-
-export { isStaticAssetPath } from "./auth-gate/public-paths.ts";
-
 /**
  * Point the event-log primitive at the process's Prisma singleton.
  *
@@ -61,6 +43,60 @@ export { isStaticAssetPath } from "./auth-gate/public-paths.ts";
  * unrelated edit to this file. Naming the boot step honestly is the fix. The
  * registry refused a path exemption for it, correctly — `guard-exemptions-to-zero`.
  */
+
+// Why: Point the event-log primitive at the process's Prisma single…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
+	// Eager-warm the local BetterAuth runtime at boot whenever a request path
+	// will build it: the session-READ path (getSession, better-auth-cookie mode)
+	// always uses the local instance — even when /api/auth/* forwards to
+	// scala-otp — and the local /api/auth handler uses it when no otpUrl is set.
+	// Building lazily on the first such request races a node_modules rebuild
+	// window: Bun transpiles better-auth on demand, and against a half-written
+	// tree that throws ENOENT → 500 on every auth + session check while /health
+	// stays green (nothing restarts it) — the 2026-06-12 login outage. Building
+	// here resolves the better-auth module graph once while node_modules is
+	// stable, and getAuth() memoizes it for the process lifetime. Best-effort and
+	// non-fatal: getAuth() never caches a failed build, so if this warm fails
+	// (e.g. mid-install) the first successful request rebuilds and caches — the
+	// service is never left wedged, and never boot-loops on a transient.
+
+// Why: Eager-warm the local BetterAuth runtime at boot whenever a r…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
+		// NO localhost bypass: a 127.0.0.1 page request is gated EXACTLY like a
+		// tunnel request (no session → redirect to /sign-in). The old
+		// `if (isLocalhost) return next()` let any tool — and the agent's own
+		// chrome-devtools/curl — see authed pages on localhost WITHOUT a session,
+		// so verification on 127.0.0.1 diverged from what a signed-in user sees
+		// through the domain (the CSS regression that hid for three runs,
+		// 2026-06-13). The bypass is redundant: anything needing an authed view
+		// signs in (the OTP is DB-readable on the dev host) — host-side harnesses
+		// use getSuperAdminSessionCookie (scala-tools/lib). Internal
+		// service-to-service auth still flows through the cookie/secret on the
+		// request, never the source IP.
+
+// Why: NO localhost bypass: a 127.0.0.1 page request is gated EXACT…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
+import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import { getPrisma } from "@teamscala/db/prisma-registry";
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { resolveAccess } from "@teamscala/auth/resolve-access";
+import * as v from "valibot";
+import { configure as configureEventLog } from "@teamscala/event-log/configure";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import type { Hono } from "hono";
+
+import {
+	isStaticAssetPath,
+	PUBLIC_INFRA_PATHS,
+	PUBLIC_INFRA_PREFIXES,
+	SIGN_IN_PATHS,
+} from "./auth-gate/public-paths.ts";
+
+export { isStaticAssetPath } from "./auth-gate/public-paths.ts";
+
 function initGateDependencies(): { prisma: ReturnType<typeof getPrisma> } {
 	const prisma = getPrisma();
 	configureEventLog({ prisma });
@@ -104,19 +140,6 @@ export async function attachAuthGate(
 
 	const otpUrl = process.env.SCALA_OTP_URL;
 
-	// Eager-warm the local BetterAuth runtime at boot whenever a request path
-	// will build it: the session-READ path (getSession, better-auth-cookie mode)
-	// always uses the local instance — even when /api/auth/* forwards to
-	// scala-otp — and the local /api/auth handler uses it when no otpUrl is set.
-	// Building lazily on the first such request races a node_modules rebuild
-	// window: Bun transpiles better-auth on demand, and against a half-written
-	// tree that throws ENOENT → 500 on every auth + session check while /health
-	// stays green (nothing restarts it) — the 2026-06-12 login outage. Building
-	// here resolves the better-auth module graph once while node_modules is
-	// stable, and getAuth() memoizes it for the process lifetime. Best-effort and
-	// non-fatal: getAuth() never caches a failed build, so if this warm fails
-	// (e.g. mid-install) the first successful request rebuilds and caches — the
-	// service is never left wedged, and never boot-loops on a transient.
 	if (authMode === "better-auth-cookie" || !otpUrl) {
 		try {
 			await getAuth();
@@ -225,17 +248,6 @@ export async function attachAuthGate(
 				isStaticAssetPath(url.pathname);
 		if (isInfra) return next();
 
-		// NO localhost bypass: a 127.0.0.1 page request is gated EXACTLY like a
-		// tunnel request (no session → redirect to /sign-in). The old
-		// `if (isLocalhost) return next()` let any tool — and the agent's own
-		// chrome-devtools/curl — see authed pages on localhost WITHOUT a session,
-		// so verification on 127.0.0.1 diverged from what a signed-in user sees
-		// through the domain (the CSS regression that hid for three runs,
-		// 2026-06-13). The bypass is redundant: anything needing an authed view
-		// signs in (the OTP is DB-readable on the dev host) — host-side harnesses
-		// use getSuperAdminSessionCookie (scala-tools/lib). Internal
-		// service-to-service auth still flows through the cookie/secret on the
-		// request, never the source IP.
 		const host = c.req.header("host") ?? "";
 		const cookie = c.req.header("cookie") ?? "";
 		const tokenMatch = cookie.match(/better-auth\.session_token=([^;]+)/);

package/src/bind-page-handler.ts

@@ -9,6 +9,21 @@
  * and page_slug shell variants.
  */
 
+		// Per-page root.props.maxWidth (the canonical mechanism) centers any page at the chosen width via inline styles — already hydration-safe
+		// and page-scoped. Bind-page-handler MUST NOT inject unscoped CSS selectors: a global `.puck-root-slot { max-width }` rule shrinks
+		// every portal pane that hosts a Puck root (the 2026-06-17 dashboard sliver bug — `.puck-root-slot` matches every Puck page in every
+		// region, including the dashboard center pane). The `no-bind-page-handler-css-injection` guard enforces this; this comment is the load-bearing rationale.
+		// Live dashboards must never be served from a stale cache (intermediary, browser back-forward, mobile Safari aggressive caching). Force every
+		// SSR HTML response to be revalidated. Static assets (CSS/JS bundles) keep their hash-busted caching — those are content-addressed.
+		// no-transform: intermediaries must not mutate SSR HTML — Cloudflare's Email Address Obfuscation rewrites mailto: hrefs at the edge, which
+		// breaks the server-serializes-client-reads-verbatim hydration contract (React recoverable-error on every page with a mailto link). Per CF
+		// docs, Email Obfuscation does not apply when no-transform is present. NOTE: a shared-edge-caching (CDN max-age) variant shipped briefly on 2026-06-10
+		// and was REMOVED by operator ruling the same day ("the origin should be so fast we don't care") — the origin-speed work (SWR caches,
+		// wave-parallel loader, brotli) is the sanctioned path; re-adding shared-cache headers needs a fresh operator ruling.
+
+// Why: Per-page root.props.maxWidth (the canonical mechanism) cente…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Context } from "hono";
 import { readHtmlTemplate } from "./read-html-template.ts";
@@ -93,16 +108,11 @@ export async function bindPageHandler(
 		// logo/colours, not the viewer's.
 		if (resourceOrgId) orgId = resourceOrgId;
 
-		// Unauthed /sign-in (no session, no resource) would otherwise resolve no
-		// org, and the brand resolver falls back to the super-admin org (GBG Indo)
-		// — so a link shared to org A (e.g. GMG APAC) previews as org B's brand on
-		// WhatsApp/crawlers, because the link 302→/sign-in for the unauthed crawler.
-		// The callbackURL carries the org the visitor is signing in to; derive orgId
-		// from it so the sign-in page's brand/title/og reflect the destination org.
-		// The canonical portal shape is /<websiteId>/<orgId>/<path> — the org is
-		// segment 1, NOT segment 0. Reading segment 0 (the website id) fed a website
-		// id into brand resolution, which resolved no org and fell back to the
-		// super-admin org — the exact cross-tenant mis-branding this block exists to
+		// Unauthed /sign-in (no session, no resource) would otherwise resolve no org, and the brand resolver falls back to the super-admin org (GBG Indo)
+		// — so a link shared to org A (e.g. GMG APAC) previews as org B's brand on WhatsApp/crawlers, because the link 302→/sign-in for the unauthed crawler.
+		// The callbackURL carries the org the visitor is signing in to; derive orgId from it so the sign-in page's brand/title/og reflect the destination org.
+		// The canonical portal shape is /<websiteId>/<orgId>/<path> — the org is segment 1, NOT segment 0. Reading segment 0 (the website id) fed a website
+		// id into brand resolution, which resolved no org and fell back to the super-admin org — the exact cross-tenant mis-branding this block exists to
 		// fix, still live until 2026-07-21; violates portal-branding-resolves-page-org-first.
 		// scala-projects routes /<orgId>/… (single UUID) and proposal/form/quiz hosts
 		// route /<resourceId>/… (a non-org first segment) — both keep segment 0 via
@@ -124,28 +134,6 @@ export async function bindPageHandler(
 			htmlTemplate: await readHtmlTemplate(),
 			nonce,
 		});
-		// Per-page root.props.maxWidth (the canonical mechanism) centers any
-		// page at the chosen width via inline styles — already hydration-safe
-		// and page-scoped. Bind-page-handler MUST NOT inject unscoped CSS
-		// selectors: a global `.puck-root-slot { max-width }` rule shrinks
-		// every portal pane that hosts a Puck root (the 2026-06-17 dashboard
-		// sliver bug — `.puck-root-slot` matches every Puck page in every
-		// region, including the dashboard center pane). The `no-bind-page-handler-css-injection`
-		// guard enforces this; this comment is the load-bearing rationale.
-		// Live dashboards must never be served from a stale cache (intermediary,
-		// browser back-forward, mobile Safari aggressive caching). Force every
-		// SSR HTML response to be revalidated. Static assets (CSS/JS bundles)
-		// keep their hash-busted caching — those are content-addressed.
-		// no-transform: intermediaries must not mutate SSR HTML — Cloudflare's
-		// Email Address Obfuscation rewrites mailto: hrefs at the edge, which
-		// breaks the server-serializes-client-reads-verbatim hydration contract
-		// (React recoverable-error on every page with a mailto link). Per CF
-		// docs, Email Obfuscation does not apply when no-transform is present.
-		// NOTE: a shared-edge-caching (CDN max-age) variant shipped briefly on 2026-06-10
-		// and was REMOVED by operator ruling the same day ("the origin should
-		// be so fast we don't care") — the origin-speed work (SWR caches,
-		// wave-parallel loader, brotli) is the sanctioned path; re-adding
-		// shared-cache headers needs a fresh operator ruling.
 		const headers = new Headers(resp.headers as HeadersInit);
 		headers.set(
 			"Cache-Control",

package/src/build-client-assets/build-lock.ts

@@ -17,6 +17,7 @@ import { join } from "node:path";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { userHome } from "@teamscala/os/host-paths";
 import * as v from "valibot";
+import { createCache } from "@teamscala/cache/create-cache";
 
 // Single shared host lock serialising the heavy boot-time client build across
 // ALL kind:ui services (client-asset-builds-serialize-via-lock). A publish of a
@@ -31,10 +32,14 @@ const CLIENT_BUILD_LOCK = join(userHome(), ".scala-client-build.lock");
 // correctness gate, and must never block a boot. TTL is DB-driven
 // (config/build-client-assets), promoted from the former hardcoded constant.
 const DEFAULT_CLIENT_BUILD_LOCK_TIMEOUT_MS = 600_000;
-let cachedClientBuildLockTimeoutMs: number | undefined;
+const clientBuildLockTimeoutCache = createCache<number>(
+	"service-boot:client-build-lock-timeout",
+	{ ttlMs: Number.POSITIVE_INFINITY, maxSize: 1 },
+);
 
 export async function getClientBuildLockTimeoutMs(): Promise<number> {
-	if (cachedClientBuildLockTimeoutMs !== undefined) return cachedClientBuildLockTimeoutMs;
+	const hit = clientBuildLockTimeoutCache.get("default");
+	if (hit !== undefined) return hit;
 	// Fail-soft to the hardcoded default: the deploy-build bake runs this in a
 	// standalone subprocess with NO registered Prisma client (a pre-DB build
 	// context), so loadRegistryConfig throws "Prisma client not registered". The
@@ -43,13 +48,17 @@ export async function getClientBuildLockTimeoutMs(): Promise<number> {
 	// registry-read failure must degrade to the default, never abort the bake.
 	try {
 		const row = await loadRegistryConfig("config", "build-client-assets", v.looseObject({}));
-		cachedClientBuildLockTimeoutMs =
+		clientBuildLockTimeoutCache.set(
+			"default",
 			(row?.client_build_lock_timeout_ms as number | undefined) ??
-			DEFAULT_CLIENT_BUILD_LOCK_TIMEOUT_MS;
+				DEFAULT_CLIENT_BUILD_LOCK_TIMEOUT_MS,
+		);
 	} catch {
-		cachedClientBuildLockTimeoutMs = DEFAULT_CLIENT_BUILD_LOCK_TIMEOUT_MS;
+		clientBuildLockTimeoutCache.set("default", DEFAULT_CLIENT_BUILD_LOCK_TIMEOUT_MS);
 	}
-	return cachedClientBuildLockTimeoutMs;
+	return (
+		clientBuildLockTimeoutCache.get("default") ?? DEFAULT_CLIENT_BUILD_LOCK_TIMEOUT_MS
+	);
 }
 
 export { CLIENT_BUILD_LOCK };

package/src/build-client-assets/hashed-output.ts

@@ -33,7 +33,9 @@ export async function removeStaleHashedFiles(
 		if (re.test(name) && name !== keep) {
 			try {
 				await rm(join(outDir, name));
-			} catch {}
+			} catch (error) {
+				process.stderr.write("hashed-output.ts: bare catch around upstream call — logged, continuing: " + String(error) + "");
+			}
 		}
 	}
 }

package/src/build-client-assets/hydrate-bundle.ts

@@ -13,6 +13,57 @@
  * else.
  */
 
+			// Externalize an unresolvable @teamscala/* block import (a deactivated block_schema whose manifest regen never propagated) or a broken
+			// third-party internal (@fullcalendar/core/internal.js during a version mismatch) so it degrades ONE block at runtime instead of crash-looping
+			// the service (2026-07-21 portal outage: @fullcalendar 7.x + plugins 6.x → unresolvable internal.js → 21 crash-loop restarts).
+			//
+			// The filter is deliberately NARROW — only the package prefixes where unresolvable imports actually occur — NOT every bare import. The prior
+			// broad /^(?![./])/ filter intercepted resolvable shared packages too, and onResolve pass-through (return undefined) on a shared
+			// sideEffects:false package (@tanstack/react-query, imported across many lazy block chunks) tripped Bun's code-splitter: it emitted a dead
+			// `export{...}`-with-no-`from` facade and tree-shook away the entire query-core implementation → a fatal hydration SyntaxError that froze
+			// agents.scala.business while every component reported healthy (2026-07-22; see the dead-facade gate + minifyIdentifiers:false
+			// below). Intercepts of node builtins (stream/web) likewise pulled them into the browser build. The narrow filter leaves @tanstack/* + builtins
+			// to Bun's native (correct) resolution. A future unresolvable import OUTSIDE these prefixes fails loud via the manifest guard + build
+			// tombstone (no-dead-block-imports-in-manifest) — never silent. Entry-point imports are excluded — those must fail loudly (silently
+			// externalizing a core import turns a build error into a mystery runtime crash; containment must not become a swallow).
+
+// Why: Externalize an unresolvable @teamscala/* block import (a dea…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
+			// minifyIdentifiers is DISABLED (whitespace + syntax/dead-code minify
+			// kept): under code-splitting, identifier mangling interacting with a
+			// shared sideEffects:false package (@tanstack/react-query) trips Bun's
+			// splitter to tree-shake away the entire implementation and emit a dead
+			// re-export facade — a fatal hydration SyntaxError that froze
+			// agents.scala.business while every component reported healthy
+			// (2026-07-22; reproduces in stable 1.3.14 + canary 1.4.0, so an upstream
+			// fix is not near). Whitespace + syntax minify retain the bulk of the
+			// size win; only name-mangling is dropped. The post-build dead-facade
+			// gate below fails the build LOUD if this or any future regression slips
+			// a fatal facade through on any UI service.
+
+// Why: minifyIdentifiers is DISABLED (whitespace + syntax/dead-code…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
+	// dead-facade prevention gate (agents.scala.business 2026-07-22): a Bun
+	// splitter+tree-shake bug (stable 1.3.14 + canary 1.4.0) can emit a "dead
+	// facade" chunk — `export { ... }` with NO `from` clause and NO local binding
+	// definitions — a fatal SyntaxError at module load that kills React hydration
+	// SILENTLY (the whole dashboard froze while every component reported healthy).
+	// The narrow resilientBlockPlugin filter + minifyIdentifiers:false above
+	// prevent the known trigger (@tanstack/react-query under split); this gate
+	// makes the CLASS unshippable — any dead facade from ANY package on ANY UI
+	// service fails the build LOUD here instead of freezing the page. Detection
+	// is POSITION-INDEPENDENT — a named export{} ANYWHERE in the comment-stripped
+	// body, with no `from` clause and no local declaration/import backing the
+	// names, is the facade (Bun could prefix it with a directive or statement, not
+	// only emit it at the very start — a positional assumption is a known way to
+	// be silently bypassed; a valid local-export chunk carries a
+	// class/function/const/var/let/import, a valid re-export carries `from`).
+
+// Why: dead-facade prevention gate (agents.scala.business 2026-07-2…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
 import { mkdir, readdir, rename, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -38,10 +89,8 @@ export async function buildHydrateBundle(
 
 	await mkdir(outDir, { recursive: true });
 
-	// Resilience (block-and-provider-error-isolation applied to the BUILD): a
-	// page-manifest.ts lazy import of a block whose component no longer resolves
-	// (a block_schema deactivation or a removed package export whose manifest
-	// regen never propagated) MUST NOT fail the whole bundle and crash-loop the
+	// Resilience (block-and-provider-error-isolation applied to the BUILD): a page-manifest.ts lazy import of a block whose component no longer resolves
+	// (a block_schema deactivation or a removed package export whose manifest regen never propagated) MUST NOT fail the whole bundle and crash-loop the
 	// service. Seven UI services went down at once this way on 2026-06-13. Such
 	// an import is EXTERNALIZED instead: the build succeeds, the service boots,
 	// and at runtime that one lazy import rejects into the block's
@@ -54,31 +103,6 @@ export async function buildHydrateBundle(
 	const resilientBlockPlugin: Bun.BunPlugin = {
 		name: "resilient-block-imports",
 		setup(build: { onResolve: (opts: { filter: RegExp }, cb: (args: { path: string }) => { path: string; external: boolean } | undefined) => void }) {
-			// Externalize an unresolvable @teamscala/* block import (a deactivated
-			// block_schema whose manifest regen never propagated) or a broken
-			// third-party internal (@fullcalendar/core/internal.js during a version
-			// mismatch) so it degrades ONE block at runtime instead of crash-looping
-			// the service (2026-07-21 portal outage: @fullcalendar 7.x + plugins 6.x
-			// → unresolvable internal.js → 21 crash-loop restarts).
-			//
-			// The filter is deliberately NARROW — only the package prefixes where
-			// unresolvable imports actually occur — NOT every bare import. The prior
-			// broad /^(?![./])/ filter intercepted resolvable shared packages too,
-			// and onResolve pass-through (return undefined) on a shared
-			// sideEffects:false package (@tanstack/react-query, imported across many
-			// lazy block chunks) tripped Bun's code-splitter: it emitted a dead
-			// `export{...}`-with-no-`from` facade and tree-shook away the entire
-			// query-core implementation → a fatal hydration SyntaxError that froze
-			// agents.scala.business while every component reported healthy
-			// (2026-07-22; see the dead-facade gate + minifyIdentifiers:false
-			// below). Intercepts of node builtins (stream/web) likewise pulled them
-			// into the browser build. The narrow filter leaves @tanstack/* + builtins
-			// to Bun's native (correct) resolution. A future unresolvable import
-			// OUTSIDE these prefixes fails loud via the manifest guard + build
-			// tombstone (no-dead-block-imports-in-manifest) — never silent.
-			// Entry-point imports are excluded — those must fail loudly (silently
-			// externalizing a core import turns a build error into a mystery runtime
-			// crash; containment must not become a swallow).
 			build.onResolve({ filter: /^(@teamgbg\/|@fullcalendar\/)/ }, (args) => {
 				if (args.importer === entry) return undefined;
 				try {
@@ -99,17 +123,6 @@ export async function buildHydrateBundle(
 			target: "browser",
 			outdir: outDir,
 			naming: `${HYDRATE_BASE}.js`,
-			// minifyIdentifiers is DISABLED (whitespace + syntax/dead-code minify
-			// kept): under code-splitting, identifier mangling interacting with a
-			// shared sideEffects:false package (@tanstack/react-query) trips Bun's
-			// splitter to tree-shake away the entire implementation and emit a dead
-			// re-export facade — a fatal hydration SyntaxError that froze
-			// agents.scala.business while every component reported healthy
-			// (2026-07-22; reproduces in stable 1.3.14 + canary 1.4.0, so an upstream
-			// fix is not near). Whitespace + syntax minify retain the bulk of the
-			// size win; only name-mangling is dropped. The post-build dead-facade
-			// gate below fails the build LOUD if this or any future regression slips
-			// a fatal facade through on any UI service.
 			minifyWhitespace: process.env.NODE_ENV === "production",
 			minifySyntax: process.env.NODE_ENV === "production",
 			minifyIdentifiers: false,
@@ -186,21 +199,6 @@ export async function buildHydrateBundle(
 		throw new Error(`[build-client-assets] Bun.build failed:\n${messages}`);
 	}
 
-	// dead-facade prevention gate (agents.scala.business 2026-07-22): a Bun
-	// splitter+tree-shake bug (stable 1.3.14 + canary 1.4.0) can emit a "dead
-	// facade" chunk — `export { ... }` with NO `from` clause and NO local binding
-	// definitions — a fatal SyntaxError at module load that kills React hydration
-	// SILENTLY (the whole dashboard froze while every component reported healthy).
-	// The narrow resilientBlockPlugin filter + minifyIdentifiers:false above
-	// prevent the known trigger (@tanstack/react-query under split); this gate
-	// makes the CLASS unshippable — any dead facade from ANY package on ANY UI
-	// service fails the build LOUD here instead of freezing the page. Detection
-	// is POSITION-INDEPENDENT — a named export{} ANYWHERE in the comment-stripped
-	// body, with no `from` clause and no local declaration/import backing the
-	// names, is the facade (Bun could prefix it with a directive or statement, not
-	// only emit it at the very start — a positional assumption is a known way to
-	// be silently bypassed; a valid local-export chunk carries a
-	// class/function/const/var/let/import, a valid re-export carries `from`).
 	const deadFacades: string[] = [];
 	for (const out of result.outputs) {
 		if (out.kind !== "chunk") continue;
@@ -258,7 +256,9 @@ export async function buildHydrateBundle(
 	for (const name of currentChunks) {
 		try {
 			chunkBytes += (await Bun.file(join(outDir, name)).stat()).size;
-		} catch {}
+		} catch (error) {
+			log.warn("lazy chunk size read failed — chunk excluded from size log", error);
+		}
 	}
 	log.info(
 		`[build-client-assets] hydrate built → ${hashedName} (entry ${(entryBytes / 1024).toFixed(0)}KB + ${currentChunks.size} lazy chunks ${(chunkBytes / 1048576).toFixed(1)}MB)`,
@@ -292,7 +292,9 @@ async function removeStaleChunks(
 		if (/^chunk-[A-Za-z0-9]+\.js$/.test(name) && !keep.has(name)) {
 			try {
 				await rm(join(outDir, name));
-			} catch {}
+			} catch (error) {
+				getAppLogger().warn("hydrate-bundle.ts: bare catch around upstream call — logged, continuing (protective-layers-fail-explicitly)", error);
+			}
 		}
 	}
 }