@teamscala/service-boot 0.23.431 → 0.23.433

package/src/read-html-template.test.ts

@@ -11,8 +11,8 @@
  * hydration. These tests pin that a manifest change re-substitutes the HTML.
  */
 
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { readHtmlTemplate } from "./read-html-template.ts";
@@ -20,28 +20,25 @@ import { readHtmlTemplate } from "./read-html-template.ts";
 let dir: string;
 let origCwd: string;
 
-function writeManifest(hydrate: string, styles: string): void {
-	writeFileSync(
-		join(dir, "dist", "client", "asset-manifest.json"),
-		`${JSON.stringify({ stylesPath: styles, hydratePath: hydrate }, null, 2)}\n`,
-	);
+async function writeManifest(hydrate: string, styles: string): Promise<void> {
+	await Bun.file(join(dir, "dist", "client", "asset-manifest.json")).write(`${JSON.stringify({ stylesPath: styles, hydratePath: hydrate }, null, 2)}\n`);
 }
 
-beforeEach(() => {
+beforeEach(async () => {
 	origCwd = process.cwd();
-	dir = mkdtempSync(join(tmpdir(), "read-html-template-"));
-	mkdirSync(join(dir, "dist", "client"), { recursive: true });
+	dir = await mkdtemp(join(tmpdir(), "read-html-template-"));
+	await mkdir(join(dir, "dist", "client"), { recursive: true });
 	process.chdir(dir);
 });
 
-afterEach(() => {
+afterEach(async () => {
 	process.chdir(origCwd);
-	rmSync(dir, { recursive: true, force: true });
+	await rm(dir, { recursive: true, force: true });
 });
 
 describe("readHtmlTemplate manifest-keyed cache", () => {
 	test("renders the shared Puck document without a per-service HTML file", async () => {
-		writeManifest("/assets/hydrate-aaa.js", "/assets/styles-aaa.css");
+		await writeManifest("/assets/hydrate-aaa.js", "/assets/styles-aaa.css");
 		const html = await readHtmlTemplate();
 		expect(html).toContain('<div id="__page"><!--ssr-outlet--></div>');
 		expect(html).toContain("<!--head-outlet-->");
@@ -50,21 +47,21 @@ describe("readHtmlTemplate manifest-keyed cache", () => {
 	});
 
 	test("substitutes the current manifest hashes", async () => {
-		writeManifest("/assets/hydrate-aaa.js", "/assets/styles-aaa.css");
+		await writeManifest("/assets/hydrate-aaa.js", "/assets/styles-aaa.css");
 		const html = await readHtmlTemplate();
 		expect(html).toContain("/assets/hydrate-aaa.js");
 		expect(html).toContain("/assets/styles-aaa.css");
 	});
 
 	test("re-substitutes after a post-boot manifest change (the 404 regression)", async () => {
-		writeManifest("/assets/hydrate-old.js", "/assets/styles-old.css");
+		await writeManifest("/assets/hydrate-old.js", "/assets/styles-old.css");
 		const first = await readHtmlTemplate();
 		expect(first).toContain("/assets/hydrate-old.js");
 
 		// Simulate build-client-assets rebuilding: new manifest, old bundle gone.
 		// mtime must advance for the stat-keyed cache to invalidate.
 		await Bun.sleep(10);
-		writeManifest("/assets/hydrate-new.js", "/assets/styles-new.css");
+		await writeManifest("/assets/hydrate-new.js", "/assets/styles-new.css");
 
 		const second = await readHtmlTemplate();
 		expect(second).toContain("/assets/hydrate-new.js");

package/src/read-html-template.ts

@@ -101,7 +101,8 @@ async function loadManifest(): Promise<AssetManifest> {
 			if (parsed.stylesPath && parsed.hydratePath) {
 				return { stylesPath: parsed.stylesPath, hydratePath: parsed.hydratePath };
 			}
-		} catch {}
+		} catch (error) {}
+			getAppLogger().warn("asset manifest unreadable — falling back to default template wiring", error);
 	}
 	return FALLBACK;
 }

package/src/readiness-gate.ts

@@ -11,6 +11,7 @@
  * the normal handler rather than producing a hard 500.
  */
 
+import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Context, Next } from "hono";
 
 let _ready = false;
@@ -33,7 +34,7 @@ export async function readinessGate(c: Context, next: Next): Promise<Response |
 		// handler — but the failure must be OBSERVABLE, not silent. Practically
 		// unreachable (the body is pure reads of module flags + c.req.path); the
 		// log surfaces a regression if it ever fires.
-		console.error("[readiness-gate] gate threw — failing open to handler", err);
+		getAppLogger().error("[readiness-gate] gate threw — failing open to handler", { error: String(err) });
 		return next();
 	}
 }

package/src/register-crash-handlers.ts

@@ -8,6 +8,8 @@
  * identification. Per constitution crash-isolation.
  */
 
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+
 export function registerCrashHandlers(opts: { serviceSlug: string }): {
 	unhandledRejection: boolean;
 	uncaughtException: boolean;
@@ -17,20 +19,14 @@ export function registerCrashHandlers(opts: { serviceSlug: string }): {
 
 	if (process.listenerCount("unhandledRejection") === 0) {
 		process.on("unhandledRejection", (reason) => {
-			console.error(
-				`[scala-install:${opts.serviceSlug}] unhandledRejection:`,
-				reason,
-			);
+			getAppLogger().error(`[scala-install:${opts.serviceSlug}] unhandledRejection:`, { error: String(reason) });
 		});
 		unhandledRejection = true;
 	}
 
 	if (process.listenerCount("uncaughtException") === 0) {
 		process.on("uncaughtException", (err) => {
-			console.error(
-				`[scala-install:${opts.serviceSlug}] uncaughtException:`,
-				err,
-			);
+			getAppLogger().error(`[scala-install:${opts.serviceSlug}] uncaughtException:`, { error: String(err) });
 		});
 		uncaughtException = true;
 	}

package/src/register-page-server-client.ts

@@ -9,6 +9,18 @@
  * any page route handler fires.
  */
 
+		// REFUSE, DO NOT SKIP. `existsSync(routerPath)` being false used to fall straight through with appRouter=null and still register a client + log
+		// success. That client carries only the three platform routers below and NO CRUD models, which is indistinguishable from a healthy one until a
+		// page asks it for a model — at which point resolve-from-loader-config throws MissingLoaderModelCapabilityError, far from the actual fault.
+		//
+		// Measured 2026-08-20: scala-quiz and scala-forms served 500s on every data-backed page while /health returned 200 and this line logged "ORPC
+		// serverClient registered". The build had produced no generated router (its railpack.json ran registry codegen against an unreachable
+		// *.railway.internal host), and nothing anywhere said so.
+		//
+		// A service whose service_schema DECLARES models and has no generated router is not degraded, it is non-functional — so this fails the boot
+		// rather than reporting a state it has not verified (`a-component-may-not-report-a-state-it-has-not-verified`). A service
+		// that declares no models (daemon/portal shells owning no DB schema) still passes through cleanly.
+
 import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 
@@ -52,25 +64,6 @@ export async function registerPageServerClient(
 				);
 			}
 		}
-		// REFUSE, DO NOT SKIP. `existsSync(routerPath)` being false used to fall
-		// straight through with appRouter=null and still register a client + log
-		// success. That client carries only the three platform routers below and
-		// NO CRUD models, which is indistinguishable from a healthy one until a
-		// page asks it for a model — at which point resolve-from-loader-config
-		// throws MissingLoaderModelCapabilityError, far from the actual fault.
-		//
-		// Measured 2026-08-20: scala-quiz and scala-forms served 500s on every
-		// data-backed page while /health returned 200 and this line logged "ORPC
-		// serverClient registered". The build had produced no generated router
-		// (its railpack.json ran registry codegen against an unreachable
-		// *.railway.internal host), and nothing anywhere said so.
-		//
-		// A service whose service_schema DECLARES models and has no generated
-		// router is not degraded, it is non-functional — so this fails the boot
-		// rather than reporting a state it has not verified
-		// (`a-component-may-not-report-a-state-it-has-not-verified`). A service
-		// that declares no models (daemon/portal shells owning no DB schema)
-		// still passes through cleanly.
 		const declaredModels = await (async () => {
 			try {
 				const { loadRegistryConfig: loadCfg } = await import(

package/src/register-registry-page-route/ai-chat-prefetch.ts

@@ -7,6 +7,19 @@
  * panel renders the real conversation on first paint. Extracted from
  * register-registry-page-route.ts (single-purpose-file split).
  */
+/**
+ * SSR-prefetch the signed-in user's AI-chat conversation so a CLICK-opened AI
+ * panel renders the real conversation on first paint — never a loading gate
+ * (ssr-then-live-handoff). The AiChat block lives on the /ai PANEL page, which
+ * isn't rendered when the panel is closed, so its block serverLoader can't run
+ * at page-load; this prefetches server-side (regardless of panel open-state) +
+ * stamps pageData.aiChatSession, which AiChat reads on mount. The agent is
+ * resolved from the /ai panel page's own AiChat block (single source of truth —
+ * no duplicate config to drift). Fired in parallel with the post-processors +
+ * bounded by their window; a failure degrades silently to the client-side
+ * createOrRestore fallback, never an error page.
+ */
+
 import { getServerClient } from "../page-server-orpc/server-client.ts";
 
 /**
@@ -33,18 +46,6 @@ function findWebsiteId(root: unknown): string | undefined {
 	return undefined;
 }
 
-/**
- * SSR-prefetch the signed-in user's AI-chat conversation so a CLICK-opened AI
- * panel renders the real conversation on first paint — never a loading gate
- * (ssr-then-live-handoff). The AiChat block lives on the /ai PANEL page, which
- * isn't rendered when the panel is closed, so its block serverLoader can't run
- * at page-load; this prefetches server-side (regardless of panel open-state) +
- * stamps pageData.aiChatSession, which AiChat reads on mount. The agent is
- * resolved from the /ai panel page's own AiChat block (single source of truth —
- * no duplicate config to drift). Fired in parallel with the post-processors +
- * bounded by their window; a failure degrades silently to the client-side
- * createOrRestore fallback, never an error page.
- */
 export async function prefetchAiChatSession(
 	resolved: Record<string, unknown>,
 	sessionUserId: string | undefined,

package/src/register-registry-page-route/apply-page-branding.ts

@@ -12,6 +12,65 @@
  * explicit parameters.
  */
 
+/**
+ * /sign-in brand override: a shared org-scoped link 302→/sign-in for the
+ * unauthed crawler (WhatsApp), which saw the service's default website
+ * brand (the platform owner). The callbackURL carries the destination org
+ * — override resolved.brand (before the title/meta/og are built from it)
+ * so the page reflects the org the visitor is signing in to. Scoped to
+ * /sign-in; resource pages keep their own brand.
+ *
+ * The org is segment 1 of the canonical portal shape /<websiteId>/<orgId>/
+ * <path>, NOT segment 0 (the website id): reading segment 0 fed a website id
+ * into fetchOrganisationPageBranding, which resolved no org and left the
+ * default (super-admin) brand — the cross-tenant mis-branding this override
+ * exists to prevent (portal-branding-resolves-page-org-first, 2026-07-21).
+ * Shared helper so this and bind-page-handler cannot drift on the answer.
+ */
+
+/**
+ * brand-is-org-owned-full-scheme, reconciled with page-org-first
+ * (portal-branding-resolves-page-org-first): the session override now
+ * personalizes ONLY platform pages (page org === website owning-org).
+ * Tenant pages keep their resolved page-org brand — the page is
+ * authoritative, the menu switcher changes which tenant's pages you
+ * view. Anonymous/public (no session) keeps the resolved brand. Same
+ * fetchOrganisationPageBranding pattern as the /sign-in brand override.
+ *
+ * A PUBLIC PAGE IS NEVER PERSONALISED TO THE READER'S ORG. Personalising
+ * the brand is right for a portal — you are looking at your own
+ * workspace. It is wrong for a public document, which belongs to the org
+ * that PUBLISHED it and must look identical to every reader.
+ *
+ * Measured 2026-08-17: the Launcha Authority Blueprint, owned by GMG
+ * APAC, rendered correctly for an anonymous customer and in GBG Indo's
+ * navy with the scala logo for any signed-in staff member — so the two
+ * people checking it before it went to clients were the only two who
+ * could not see what a client sees. Silent, and inverted: the reviewers
+ * got the wrong page.
+ */
+
+/**
+ * BRAND FROM THE ORG THAT OWNS THE RESOURCE, not the website's owner.
+ * A public resource page (an assessment report, a shared document) is
+ * hosted on a shared website but BELONGS to a tenant. resolvePageBrand
+ * reads pageData.orgId, which is the WEBSITE's org, so every tenant's
+ * report rendered the host org's logo and palette.
+ *
+ * Measured 2026-08-17: the Launcha Authority Blueprint is owned by GMG
+ * APAC (#FF4500, launcha logo) and rendered with GBG Indo's navy and
+ * scala mark, because both pages live on the shared "Public Pages"
+ * site. The loader had already resolved the right org — nothing
+ * consumed it.
+ *
+ * `brand_org_path` names where the owning org id lives in the resolved
+ * loader data (e.g. "quiz.organisation_id"), so which resource owns the
+ * brand is a ROW, never a per-service branch
+ * (`business-logic-is-rows-plus-executors`). Absent or unresolvable,
+ * the website's org stands — this can only ever narrow the brand to a
+ * more specific owner, never blank it.
+ */
+
 import { fetchOrganisationPageBranding } from "@teamscala/db/fetch-organisation-page-branding";
 import { getPlatformOrgId } from "@teamscala/db/registry/platform";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -43,21 +102,6 @@ function spreadBranding(
 	};
 }
 
-/**
- * /sign-in brand override: a shared org-scoped link 302→/sign-in for the
- * unauthed crawler (WhatsApp), which saw the service's default website
- * brand (the platform owner). The callbackURL carries the destination org
- * — override resolved.brand (before the title/meta/og are built from it)
- * so the page reflects the org the visitor is signing in to. Scoped to
- * /sign-in; resource pages keep their own brand.
- *
- * The org is segment 1 of the canonical portal shape /<websiteId>/<orgId>/
- * <path>, NOT segment 0 (the website id): reading segment 0 fed a website id
- * into fetchOrganisationPageBranding, which resolved no org and left the
- * default (super-admin) brand — the cross-tenant mis-branding this override
- * exists to prevent (portal-branding-resolves-page-org-first, 2026-07-21).
- * Shared helper so this and bind-page-handler cannot drift on the answer.
- */
 export async function applySignInBrandOverride(
 	resolved: Record<string, unknown>,
 	request: Request,
@@ -86,27 +130,6 @@ export async function applySignInBrandOverride(
 	}
 }
 
-/**
- * brand-is-org-owned-full-scheme, reconciled with page-org-first
- * (portal-branding-resolves-page-org-first): the session override now
- * personalizes ONLY platform pages (page org === website owning-org).
- * Tenant pages keep their resolved page-org brand — the page is
- * authoritative, the menu switcher changes which tenant's pages you
- * view. Anonymous/public (no session) keeps the resolved brand. Same
- * fetchOrganisationPageBranding pattern as the /sign-in brand override.
- *
- * A PUBLIC PAGE IS NEVER PERSONALISED TO THE READER'S ORG. Personalising
- * the brand is right for a portal — you are looking at your own
- * workspace. It is wrong for a public document, which belongs to the org
- * that PUBLISHED it and must look identical to every reader.
- *
- * Measured 2026-08-17: the Launcha Authority Blueprint, owned by GMG
- * APAC, rendered correctly for an anonymous customer and in GBG Indo's
- * navy with the scala logo for any signed-in staff member — so the two
- * people checking it before it went to clients were the only two who
- * could not see what a client sees. Silent, and inverted: the reviewers
- * got the wrong page.
- */
 export async function applySessionOrgBranding(
 	pageData: Record<string, unknown>,
 	renderMode: string | undefined,
@@ -141,26 +164,6 @@ export async function applySessionOrgBranding(
 	}
 }
 
-/**
- * BRAND FROM THE ORG THAT OWNS THE RESOURCE, not the website's owner.
- * A public resource page (an assessment report, a shared document) is
- * hosted on a shared website but BELONGS to a tenant. resolvePageBrand
- * reads pageData.orgId, which is the WEBSITE's org, so every tenant's
- * report rendered the host org's logo and palette.
- *
- * Measured 2026-08-17: the Launcha Authority Blueprint is owned by GMG
- * APAC (#FF4500, launcha logo) and rendered with GBG Indo's navy and
- * scala mark, because both pages live on the shared "Public Pages"
- * site. The loader had already resolved the right org — nothing
- * consumed it.
- *
- * `brand_org_path` names where the owning org id lives in the resolved
- * loader data (e.g. "quiz.organisation_id"), so which resource owns the
- * brand is a ROW, never a per-service branch
- * (`business-logic-is-rows-plus-executors`). Absent or unresolvable,
- * the website's org stands — this can only ever narrow the brand to a
- * more specific owner, never blank it.
- */
 export async function applyBrandOrgPath(
 	pageData: Record<string, unknown>,
 	resolved: Record<string, unknown>,

package/src/register-registry-page-route/graph-cache.ts

@@ -1,6 +1,6 @@
 /**
  * @system ui-service-boot
- * @status handwritten @indivisible-unit
+ * @status handwritten @indivisible-unit owner=unassigned reason=91 lines; pre-2026-08-27 exemption, unreviewed
  * @edit edit directly
  *
  * The two SWR loader-graph caches (static-shell + parameterised routes) for the
@@ -22,6 +22,24 @@
  * so handing a cached tree out twice would ship request A's resolved data to
  * request B (ssr-first-tick-parity). Clone-on-get stays local to the caller.
  */
+/**
+ * Stale-while-revalidate read of a cached loader graph.
+ *
+ * - Fresh hit (within ttlMs): return the cached graph, no refresh.
+ * - Stale hit (within ttlMs + staleTtlMs): return the cached graph AND fire ONE
+ *   background refresh via cache.refreshInBackground — single-flight (deduped
+ *   against the cache's in-flight map), never rejects, leaves the stale entry in
+ *   place on failure. The caller deep-clones the returned value before use.
+ * - Miss (past staleTtlMs, or never cached): return undefined — the caller
+ *   resolves synchronously and cache.set()s the clone.
+ *
+ * The refresh callback must return a graph safe to store. To SKIP caching a
+ * refresh result (e.g. a primary-missing / dead-link graph that must stay
+ * per-request so a just-created record appears immediately), the callback THROWS
+ * — refreshInBackground catches it, leaves the stale entry, and logs one line
+ * (an observable dead-link signal, not a hard error).
+ */
+
 import { createCache } from "@teamscala/cache/create-cache";
 
 // The structural surface readCachedGraph touches (getWithMeta + refreshInBackground).
@@ -61,23 +79,6 @@ export const paramRouteGraphCache = createCache<unknown>(
 	{ maxSize: 256, ttlMs: 15_000, staleTtlMs: 285_000 },
 );
 
-/**
- * Stale-while-revalidate read of a cached loader graph.
- *
- * - Fresh hit (within ttlMs): return the cached graph, no refresh.
- * - Stale hit (within ttlMs + staleTtlMs): return the cached graph AND fire ONE
- *   background refresh via cache.refreshInBackground — single-flight (deduped
- *   against the cache's in-flight map), never rejects, leaves the stale entry in
- *   place on failure. The caller deep-clones the returned value before use.
- * - Miss (past staleTtlMs, or never cached): return undefined — the caller
- *   resolves synchronously and cache.set()s the clone.
- *
- * The refresh callback must return a graph safe to store. To SKIP caching a
- * refresh result (e.g. a primary-missing / dead-link graph that must stay
- * per-request so a just-created record appears immediately), the callback THROWS
- * — refreshInBackground catches it, leaves the stale entry, and logs one line
- * (an observable dead-link signal, not a hard error).
- */
 export function readCachedGraph(
 	cache: GraphCache,
 	key: string,

package/src/register-registry-page-route/meta-title.ts

@@ -1,6 +1,6 @@
 /**
  * @system ui-service-boot
- * @status handwritten @indivisible-unit
+ * @status handwritten @indivisible-unit owner=unassigned reason=82 lines; pre-2026-08-27 exemption, unreviewed
  * @edit edit directly
  *
  * Meta/title helpers for the route registrar: interpolate the route's
@@ -13,6 +13,26 @@
  * by construction, dead on exactly the pages the type exists for (Valencia's
  * finding). composePageTitle (+ the org-prefix flag) owns titles end to end.
  */
+/**
+ * THE ONE SUBJECT DERIVATION. What a page is ABOUT — the entity whose name the
+ * browser tab should carry.
+ *
+ * This existed as THREE hand-written `||` chains, one per render branch in
+ * resolve-page-data, and they had already diverged: two ordered form before
+ * proposal, the third ordered proposal first. So which resource named the page
+ * depended on which branch happened to render it, silently.
+ *
+ * The divergence is the cheap half of the cost. The expensive half is that a
+ * correction has to be applied three times to work, and applying it twice looks
+ * exactly like applying it correctly — measured 2026-08-17, when a fix to the
+ * quiz subject was shipped, installed and verified present in the bundle while
+ * the page kept its old title, because the branch that rendered it held the
+ * second copy.
+ *
+ * One chain, one precedence, one place to change. Adding a resource type is an
+ * edit here rather than a fourth branch in three files.
+ */
+
 import { interpolateMeta } from "../resolve-from-loader-config.ts";
 
 export function buildMetaFromContext(
@@ -38,25 +58,6 @@ export function resolvePageMetaTitle(
 	);
 }
 
-/**
- * THE ONE SUBJECT DERIVATION. What a page is ABOUT — the entity whose name the
- * browser tab should carry.
- *
- * This existed as THREE hand-written `||` chains, one per render branch in
- * resolve-page-data, and they had already diverged: two ordered form before
- * proposal, the third ordered proposal first. So which resource named the page
- * depended on which branch happened to render it, silently.
- *
- * The divergence is the cheap half of the cost. The expensive half is that a
- * correction has to be applied three times to work, and applying it twice looks
- * exactly like applying it correctly — measured 2026-08-17, when a fix to the
- * quiz subject was shipped, installed and verified present in the bundle while
- * the page kept its old title, because the branch that rendered it held the
- * second copy.
- *
- * One chain, one precedence, one place to change. Adding a resource type is an
- * edit here rather than a fourth branch in three files.
- */
 export function resolveEntityTitle(resolved: Record<string, unknown>): string | undefined {
 	const pick = (key: string, ...fields: string[]): string | undefined => {
 		const row = resolved[key] as Record<string, unknown> | undefined;

package/src/register-registry-page-route/prefetch-org-id.ts

@@ -9,8 +9,6 @@
  * register-registry-page-route.ts.
  */
 
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
 /**
  * Prefer segment 1; fall back to segment 0 only when segment 1 is not a
  * UUID (the single-UUID shape, which is live and supported — NOT
@@ -28,6 +26,9 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
  * UUIDs: the prefetch simply warmed a session against the wrong tenant
  * (found 2026-07-21).
  */
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 export function resolveAiOrgId(pathname: string): string | undefined {
 	const pathSegments = pathname.split("/").filter(Boolean);
 	return UUID_RE.test(pathSegments[1] ?? "")

package/src/register-registry-page-route/proposal-approval-email-token.ts

@@ -12,9 +12,6 @@
  * stamping that touch no network. Sharing a file made an I/O-bound resolver
  * look like a pure formatter.
  */
-import { getServerClient } from "../page-server-orpc/server-client.ts";
-
-
 /**
  * Resolve the `{{approvalEmail}}` placeholder in a proposal page's button props
  * (e.g. the Approve CTA) in place. Routing: the organisation's registered
@@ -27,6 +24,8 @@ import { getServerClient } from "../page-server-orpc/server-client.ts";
  * pages; other registry pages are untouched.
  */
 
+import { getServerClient } from "../page-server-orpc/server-client.ts";
+
 export async function applyApprovalEmailToken(
 	pageData: Record<string, unknown>,
 	proposal: { created_by?: string } | undefined,

package/src/register-registry-page-route/run-content-gates.ts

@@ -50,10 +50,8 @@ export async function runContentGatesForPage(
 		if (withholdsContent(entry)) gateOutcomes.push(outcome);
 	}
 
-	// THE ASSISTANT IS A ROW, AND THIS IS THE ONE PLACE IT IS APPLIED.
-	// It used to be a call inside each gate's onAuthorized plus an entry
-	// in the hardcoded gate sequence above, so a third resource type
-	// meant editing this file. Now any page declaring `assistant` gets
+	// THE ASSISTANT IS A ROW, AND THIS IS THE ONE PLACE IT IS APPLIED. It used to be a call inside each gate's onAuthorized plus an entry
+	// in the hardcoded gate sequence above, so a third resource type meant editing this file. Now any page declaring `assistant` gets
 	// one and no page without the key does.
 	//
 	// GATED PAGES ONLY WHEN AUTHORIZED. The launcher's runtime context is

package/src/register-registry-page-route.ts

@@ -292,8 +292,7 @@ export async function registerRegistryPageRoute(
 				serviceSlug,
 			);
 			warnUncoveredBlocks(pageData, components, serviceSlug, params.path, log);
-			// Detached (NOT awaited into the response). prefetchAiChatSession ->
-			// createOrRestore is DB-heavy (~1.1s), per-user, and uncached, and was
+			// Detached (NOT awaited into the response). prefetchAiChatSession -> createOrRestore is DB-heavy (~1.1s), per-user, and uncached, and was
 			// awaited on EVERY loadData — the dominant board loadMs cost (confirmed
 			// aiChatPrefetch=1145ms = the full loadMs). Fire it in the background so
 			// it still warms the server-side session (users who open chat find it

package/src/register-static-assets.ts

@@ -11,6 +11,7 @@
  */
 
 import { join } from "node:path";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Hono } from "hono";
 import { etag } from "hono/etag";
 import { buildErrorReport } from "@teamscala/os/errors/error-report";
@@ -62,10 +63,8 @@ export async function registerStaticAssets(
 		}
 	});
 
-	// Build-id: the content hash of the CURRENT client bundle, read FRESH from
-	// the asset manifest on every call (never a process-pinned copy) so a
-	// post-restart rebuild reports its new id immediately. The client self-heal
-	// (page-client/boot/build-self-heal) polls this on tab refocus; if it differs
+	// Build-id: the content hash of the CURRENT client bundle, read FRESH from the asset manifest on every call (never a process-pinned copy) so a
+	// post-restart rebuild reports its new id immediately. The client self-heal (page-client/boot/build-self-heal) polls this on tab refocus; if it differs
 	// from the build the tab booted with, a new build shipped and the open tab is
 	// stale → it reloads. no-store HTML + immutable hashed assets already prevent
 	// staleness on every FRESH load; this is what closes the one remaining hole —
@@ -81,7 +80,9 @@ export async function registerStaticAssets(
 			const raw = await Bun.file(path).text();
 			const manifest = JSON.parse(raw) as { hydratePath?: string };
 			build = /hydrate-([a-z0-9]+)\.js/.exec(manifest.hydratePath ?? "")?.[1] ?? "dev";
-		} catch {}
+		} catch (error) {
+			getAppLogger().warn("[register-static-assets] asset manifest unreadable — build label falls back to dev", error);
+		}
 		return c.json({ build }, 200, { "cache-control": "no-store" });
 	});
 

package/src/resolve-app-base-url.ts

@@ -13,16 +13,23 @@
 
 import { ServiceInstallConfigSchema } from "@teamscala/db-validation/registry-schemas/service-install";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { createCache } from "@teamscala/cache/create-cache";
 
-let cachedAppUrl: string | null = null;
+const appUrlCache = createCache<string>("service-boot:app-base-url", {
+	ttlMs: Number.POSITIVE_INFINITY,
+	maxSize: 1,
+});
 
 export async function resolveAppBaseUrl(): Promise<string> {
-	if (cachedAppUrl) return cachedAppUrl;
+	const hit = appUrlCache.get("default");
+	if (hit) return hit;
 	try {
 		const config = await loadRegistryConfig("service_install", "scala-projects", ServiceInstallConfigSchema);
-		cachedAppUrl = `https://${config.public_hostname}`;
+		const url = `https://${config.public_hostname}`;
+		appUrlCache.set("default", url);
+		return url;
 	} catch {
-		cachedAppUrl = "https://projects.scala.business";
+		appUrlCache.set("default", "https://projects.scala.business");
+		return "https://projects.scala.business";
 	}
-	return cachedAppUrl;
 }

package/src/resolvers/portal-route-paths.ts

@@ -13,17 +13,6 @@
  * `/<last-segment>-toolbar`. Pages without a matching toolbar page simply
  * resolve an empty toolbar region (the source is declared optional).
  */
-export interface ResolverArgs {
-	input: Record<string, unknown>;
-	client: unknown;
-	params: Record<string, unknown>;
-}
-
-// Canonical portal URL shape: /<websiteId>/<organisationId>/<builda path...>.
-// Segment 0 is the portal WEBSITE id; segment 1 is the ORG id. Shared by the
-// resolver below and by extractOrgIdFromCallbackPath (the /sign-in brand path).
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
 /**
  * Extract the organisation id from a portal-shaped callback/path — the single
  * authority for "which segment is the org" so the sign-in brand resolver and the
@@ -41,6 +30,18 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
  * correct-org improvement for the two-UUID portal shape). Returns undefined when
  * neither leading segment is a UUID.
  */
+
+export interface ResolverArgs {
+	input: Record<string, unknown>;
+	client: unknown;
+	params: Record<string, unknown>;
+}
+
+// Canonical portal URL shape: /<websiteId>/<organisationId>/<builda path...>.
+// Segment 0 is the portal WEBSITE id; segment 1 is the ORG id. Shared by the
+// resolver below and by extractOrgIdFromCallbackPath (the /sign-in brand path).
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 export function extractOrgIdFromCallbackPath(callbackUrl: string): string | undefined {
 	const segs = callbackUrl.split("?")[0].split("/").filter(Boolean);
 	if (UUID_RE.test(segs[1] ?? "")) return segs[1];