@teamscala/service-boot 0.23.503 → 0.23.505

package/src/register-registry-page-route/resolve-page-data.test.ts

@@ -1,16 +1,12 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Regression test for the silent region-slot vanish (measured 2026-08-18): a
- * region the operator declared in resource_loader.region_slots whose source
- * did not resolve was skipped with no log, no error and no signal anywhere —
- * the page rendered minus a region while every other suspect checked out.
- * These tests pin the observable contract: the omission is LOGGED naming the
- * slot, once per slot per process (hot path never spams), and the resolved
- * regions still render every slot that did resolve.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, mock, test } from "bun:test";
 
 const warn = mock((_message: string) => {});

package/src/register-registry-page-route/resolve-request-graph.test.ts

@@ -1,16 +1,12 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural pins for the per-request loader-graph resolution. The load-
- * bearing cases: a bare root with a resource_type throws the 200 holding-page
- * signal (never falls through to the marketing site), a dead link (declared
- * primary source that resolves to nothing) throws the branded 404, a content
- * route with no page row throws the dead-link floor, and a content route with
- * an EMPTY page row throws the 200 empty-page floor — the three distinct
- * surfaces the page binder maps to three distinct responses.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, mock, test } from "bun:test";
 
 let loaderGraph: Record<string, unknown> = {};

package/src/resolve-from-loader-config.test.ts

@@ -1,19 +1,15 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * resolve-from-loader-config.test.ts — locks in the interpolation contract that
- * resolver_fn sources depend on: a bare `:sourceKey` ref passes the WHOLE
- * resolved source object (so a resolver_input like {response: ":response"}
- * reaches the resolver), while a URL param (e.g. :id) still resolves from params.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
-import {
-	interpolateMeta,
-	resolveFromLoaderConfig,
-} from "./resolve-from-loader-config";
+import { resolveFromLoaderConfig } from "./resolve-from-loader-config";
+import { interpolateMeta } from "./interpolate-meta.ts";
 import {
 	getServerClient,
 	isServerClientRegistered,

package/src/resolve-from-loader-config.ts

@@ -16,6 +16,11 @@ import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import type { ResolverFnKey } from "@teamscala/db/registry/generated/resolver-fn";
 import { ResolverFnConfigSchema } from "@teamscala/db-validation/registry-schemas/resolver-fn";
 import { getServerClient } from "./page-server-orpc/server-client";
+import { interpolateTemplate, resolveParamRef } from "./interpolate-meta";
+import {
+	MissingLoaderModelCapabilityError,
+	isUrlRefNotUuidError,
+} from "./loader-errors";
 
 interface SourceConfig {
 	key: string;
@@ -36,105 +41,6 @@ interface LoaderConfig {
 	merge_strategy?: Record<string, unknown>;
 }
 
-class MissingLoaderModelCapabilityError extends Error {
-	constructor(model: string, sourceKey: string) {
-		super(
-			`[resource_loader] source "${sourceKey}" requires model "${model}", but the generated server client does not expose findFirst for it — regenerate the service schema from its page loaders`,
-		);
-		this.name = "MissingLoaderModelCapabilityError";
-	}
-}
-
-function resolveParamRef(
-	ref: string,
-	params: Record<string, unknown>,
-	resolved: Record<string, unknown>,
-): unknown {
-	const parts = ref.split(".");
-	// A bare (no-dot) ref can name either a resolved source key (e.g. `:response`
-	// passes the whole resolved source object to a resolver_fn) or a URL param
-	// (e.g. `:id`). Prefer the resolved source key, then fall back to the param.
-	// Dotted refs (`:response.total_score`) always read from `resolved`.
-	if (parts.length === 1) {
-		if (resolved != null && typeof resolved === "object" && ref in resolved) {
-			return (resolved as Record<string, unknown>)[ref];
-		}
-		if (params != null && typeof params === "object" && ref in params) {
-			return (params as Record<string, unknown>)[ref];
-		}
-		return undefined;
-	}
-	let current: unknown = resolved;
-	for (const part of parts) {
-		if (current == null || typeof current !== "object") return undefined;
-		current = readField(current as Record<string, unknown>, part);
-	}
-	return current;
-}
-
-/**
- * A resource_loader row spells DATABASE COLUMN NAMES — `page_id`,
- * `organisation_id`, `prepared_for` — because that is what the schema calls
- * them. The ORM hands back CAMELCASE keys — `pageId`, `organisationId`,
- * `preparedFor`. Nothing reconciled the two, so a `:proposal.page_id` ref read
- * a key the object does not have and returned undefined.
- *
- * MEASURED 2026-09-03, and the consequence is far worse than a missing value.
- * `interpolateTemplate` DROPS a key whose value is undefined, so a dependent
- * source declared `where: { id: ":proposal.page_id" }` was issued as
- * `where: {}` — and findFirst with an empty filter returns AN ARBITRARY FIRST
- * ROW. A client proposal page therefore loaded an unrelated builda_page,
- * rendered a stranger's content under the correct brand chrome, and answered
- * 200 throughout. Instrumenting the live resolver showed every dependent
- * source doing it: page, website, contact, partnerOrg and clientOrg all with
- * `where={}`; only `proposal` was correct, because its ref is the URL param
- * `:id` rather than a sibling source.
- *
- * Read the spelled key first, then its camelCase equivalent. Column names stay
- * the authoring vocabulary and a row never has to know what the ORM did to its
- * keys.
- */
-function readField(source: Record<string, unknown>, key: string): unknown {
-	if (key in source) return source[key];
-	const camel = key.replace(/_([a-z0-9])/g, (_m, c: string) => c.toUpperCase());
-	return camel === key ? undefined : source[camel];
-}
-
-function interpolateTemplate(
-	template: unknown,
-	params: Record<string, unknown>,
-	resolved: Record<string, unknown>,
-): unknown {
-	if (typeof template === "string") {
-		const exactMatch = template.match(/^:([a-zA-Z0-9_.]+)$/);
-		if (exactMatch) {
-			return resolveParamRef(exactMatch[1], params, resolved);
-		}
-		if (template.includes(":")) {
-			return template.replace(
-				/:([a-zA-Z0-9_]+(?:\.[a-zA-Z0-9_]+)*)/g,
-				(_match, ref: string) => {
-					const value = resolveParamRef(ref, params, resolved);
-					return value != null ? String(value) : _match;
-				},
-			);
-		}
-		return template;
-	}
-	if (Array.isArray(template)) {
-		return template.map((v) => interpolateTemplate(v, params, resolved));
-	}
-	if (template != null && typeof template === "object") {
-		const out: Record<string, unknown> = {};
-		for (const [k, v] of Object.entries(template)) {
-			const result = interpolateTemplate(v, params, resolved);
-			if (result !== undefined) out[k] = result;
-		}
-		return out;
-	}
-	return template;
-}
-
 function toSelectMap(
 	fields: string[] | undefined,
 ): Record<string, boolean> | undefined {
@@ -370,10 +276,33 @@ export async function resolveFromLoaderConfig(
 			if (!source || !result) continue;
 			if (result.status === "fulfilled") {
 				resolved[source.key] = result.value;
+			} else if (isUrlRefNotUuidError(result.reason)) {
+				// A URL ref that cannot be a uuid names no resource: resolve the
+				// source ABSENT (null) and let the existing semantics decide —
+				// the primary-missing check upstream turns it into the branded
+				// 404 (PrimaryResourceMissingError, which the render-budget
+				// breaker already excludes), an optional source treats it like
+				// any absent row. Throwing here instead is what let dead links
+				// poison the breaker into a site-wide 503 (see the predicate).
+				getAppLogger().warn(
+					`[resource_loader] source "${source.key}" got a non-UUID URL ref — treating as MISSING for this request: ${
+						result.reason instanceof Error ? result.reason.message : String(result.reason)
+					}`,
+				);
+				resolved[source.key] = null;
 			} else if (
 				source.optional &&
 				!(result.reason instanceof MissingLoaderModelCapabilityError)
 			) {
+				// Optional means MAY BE ABSENT, never FAIL IN SILENCE: the source
+				// still resolves to null, but the reason becomes evidence.
+				getAppLogger().warn(
+					`[resource_loader] optional source "${source.key}" FAILED and is absent from this render: ${
+						result.reason instanceof Error
+							? `${result.reason.message}\n${result.reason.stack ?? ""}`
+							: String(result.reason)
+					}`,
+				);
 				resolved[source.key] = null;
 			} else {
 				throw result.reason;
@@ -385,19 +314,3 @@ export async function resolveFromLoaderConfig(
 
 	return resolved;
 }
-
-export function interpolateMeta(
-	template: Record<string, unknown>,
-	data: Record<string, unknown>,
-): Record<string, unknown> {
-	const out: Record<string, unknown> = {};
-	for (const [k, v] of Object.entries(template)) {
-		if (v != null && typeof v === "object" && !Array.isArray(v)) {
-			out[k] = interpolateMeta(v as Record<string, unknown>, data);
-		} else {
-			const result = interpolateTemplate(v, {}, data);
-			out[k] = result ?? v;
-		}
-	}
-	return out;
-}

package/src/resolve-service-port.test.ts

@@ -1,15 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The load-bearing case is the contradiction one: a PORT env that disagrees
- * with the service's own declared port must NOT be obeyed. Obeying it put
- * mcp-ai-chat-system on session-picker's port with a loopback pointing at a
- * port nothing was listening on, and the failure surfaced as broken tool
- * curation rather than as a port problem. It then did it again on 2026-07-31
- * to scala-quiz — see the kind:ui block below.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { resolveServicePort } from "./resolve-service-port.ts";

package/src/resolvers/app-header.test.ts

@@ -1,8 +1,12 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { resolveAppHeader } from "./app-header.ts";
 

package/src/resolvers/fetch-org-brand.ts

@@ -12,17 +12,33 @@
  * hardcoded `fetchOrgBrand` arm in resolve-from-loader-config.ts.
  */
 import { fetchOrgBrand } from "@teamscala/resolver-engine/data-resolvers/fetch-org-brand";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { ResolverArgs } from "./portal-route-paths.ts";
 
+/** A null brand renders a page with no logo, colours or name — so each failure names which of the three it was. */
 export async function fetchOrgBrandWithFallback({ input, client }: ResolverArgs): Promise<unknown> {
 	const orgId = input.orgId as string | undefined;
+	const fallbackOrgId = input.fallbackOrgId as string | undefined;
 	if (orgId) {
 		const result = await fetchOrgBrand(client as Parameters<typeof fetchOrgBrand>[0], orgId);
 		if (result) return result;
+		getAppLogger().warn(
+			`[fetch-org-brand] org "${orgId}" resolved NO brand row — the page renders with no logo, colours or company name. Either organisation_profile has no row for that id, or the server client exposes no organisation_profile.findFirst.`,
+		);
+	} else {
+		getAppLogger().warn(
+			`[fetch-org-brand] no orgId reached the resolver (input keys: ${Object.keys(input).join(", ") || "none"}) — the resource_loader's resolver_input ref did not interpolate, so the page renders unbranded.`,
+		);
 	}
-	const fallbackOrgId = input.fallbackOrgId as string | undefined;
 	if (fallbackOrgId && fallbackOrgId !== orgId) {
-		return fetchOrgBrand(client as Parameters<typeof fetchOrgBrand>[0], fallbackOrgId);
+		const fallback = await fetchOrgBrand(
+			client as Parameters<typeof fetchOrgBrand>[0],
+			fallbackOrgId,
+		);
+		if (fallback) return fallback;
+		getAppLogger().warn(
+			`[fetch-org-brand] fallback org "${fallbackOrgId}" also resolved no brand row.`,
+		);
 	}
 	return null;
 }

package/src/resolvers/portal-route-paths.test.ts

@@ -1,16 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * portal-route-paths.test.ts — locks the portal-path shape contract that both
- * the route resolver and the /sign-in brand extractor (bind-page-handler) share:
- * the canonical portal URL is /<websiteId>/<orgId>/<path>, so the ORG is segment
- * 1, never segment 0. The fixture pairs below are the regression guard for the
- * two cross-tenant defects this centralises (found 2026-07-21): reading segment 0
- * fed a website id into brand resolution and silently rendered org-less portal
- * URLs unscoped.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import {

package/src/resource-chat-inject.page-assistant.test.ts

@@ -1,31 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * resource-chat-inject.page-assistant.test.ts — the page assistant must be
- * PRESENT IN RENDERED OUTPUT on every link shape a page resolves.
- *
- * THE DEFECT THIS PINS (found 2026-09-08, quiz report page): the page_route's
- * assistant named resource_key "response" — the loader's RAW response hit.
- * On /report/<response-id> that hit exists and the chat bubble injected. On
- * anchor links (a research-record id, live or superseded) the raw hit is
- * null, injectResourceChatLauncher read no organisation_id off it, returned
- * SILENTLY, and the page rendered a complete report at 200 with the
- * assistant simply absent — 552KB of script gone, no error anywhere. The
- * page's reportData was byte-identical across all three shapes, which is
- * exactly why a data-equality check could not see it: the launcher is a
- * separate BLOCK whose presence depends on resolved[resourceKey], not on the
- * report data.
- *
- * THE FIX SHAPE: the page's resource_key names the PAIRED key ("pair"),
- * which exists on every link shape and carries organisation_id (the pair
- * resolver returns the anchor half's organisation). These tests drive the
- * injector with graphs shaped exactly like the loader produces for each of
- * the three link shapes and assert the launcher lands in the rendered
- * content tree — the thing that becomes markup — for ALL THREE. A
- * data-equality assertion cannot pass in their place.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, mock, test } from "bun:test";
 

package/src/resource-chat-inject.test.ts

@@ -1,28 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Regression test for the block NAME the chat injectors push.
- *
- * THE DEFECT THIS PINS (found 2026-08-19): the floating assistant bubble was
- * silently absent on every gated proposal and agreement. discover-blocks keys
- * the Puck component registry off `block_schema.slug` and nothing else
- * (`components[row.slug] = …`), so a pushed block `type` must EQUAL an active
- * slug. The launcher block was consolidated to the single `ResourceLauncher`
- * row, but the injectors still pushed the pre-consolidation names —
- * `ResourceChatLauncher` here, and `ChatLauncherBlock` in the bespoke proposal
- * injector that has since been deleted in favour of this one. Neither name
- * resolves, and because injection is deliberately fail-soft the page
- * rendered unchanged with no error: the classic shape of
- * `a-deleted-producer-leaves-its-consumers-executing`.
- *
- * Asserting the literal is the WEAK half of the fix — it catches a regression
- * of this exact string, not a future rename of the block. The strong half is
- * single-sourcing the name so it cannot be spelled at all
- * (`identity-is-imported-never-spelled`); until that lands, this test is what
- * stands between the bubble and another silent disappearance.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, mock, test } from "bun:test";
 

package/src/resource-not-found.test.ts

@@ -1,11 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Co-located tests for the resource-not-found public API: the error class +
- * the response builder are pure (no S3), so the behaviour is exercised directly.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import {
 	PrimaryResourceMissingError,

package/src/security-headers.test.ts

@@ -1,15 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavior proof for the `security-content-type-nosniff` +
- * `security-permissions-policy` invariants: exercise injectSecurityHeaders
- * through a real Hono request and assert the headers on the RESPONSE —
- * a registry row naming a header is not evidence the header is served.
- * Covers both modes: the seeded-registry path (config row applied, CSP
- * {{nonce}} substituted) and the DB-less fallback (secureHeaders defaults).
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import { Hono } from "hono";
 import { injectSecurityHeaders } from "./security-headers.ts";

package/src/select-service-routes.test.ts

@@ -1,3 +1,12 @@
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { selectServiceRoutes } from "./select-service-routes.ts";
 

package/src/server-error-page.test.ts

@@ -1,13 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Fixture suite for the branded HTML render-error page. Asserts the
- * user-observable outcome (error-responses-via-error-report): a page render
- * failure serves a branded HTML page — never JSON — carrying the status,
- * Retry-After, and the errorId that ties the screen to GlitchTip + the log.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import type { ErrorReport } from "@teamscala/os/errors/error-report";

package/src/theme-fonts-link.test.ts

@@ -1,13 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The served <head> carries every font family the css_theme row declares —
- * derived from the row (one source), never a hard-coded family list. The old
- * envelope loaded only Inter, so the proposal heading variant's manuscript
- * serif never loaded and fell back to Times (2026-09-02).
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, mock, test } from "bun:test";
 

package/src/two-phase-full-app.test.ts

@@ -1,19 +1,11 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Phase-2 step isolation: a client-asset build failure must not prevent
- * pg-boss from mounting.
- *
- * Asserted against the SOURCE rather than by booting a service, because the
- * behaviour is an ordering/error-handling property of buildFullApp and booting
- * it here would need a database, a registry, a Vite build and a live pg-boss.
- * The property is structural: buildClientAssets must be inside a try/catch that
- * appears BEFORE the mountPgBoss call. That is exactly
- * what regressed, and a source assertion fails the moment someone re-awaits it
- * unguarded — which is the regression this locks.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { describe, expect, test } from "bun:test";
 

package/src/two-phase-health-gate-client-only.test.ts

@@ -1,31 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * A CLIENT-ONLY service (`render_mode=client`) must reach ready, even though it
- * never registers an SSR page handler.
- *
- * Separate file from `two-phase-health-gate.test.ts` on purpose: `fullAppReady`
- * is module state that only transitions false -> true and has no reset hook, so
- * the two ready-paths cannot both be exercised in one module instance. A reset
- * hook would exist only for tests.
- *
- * THE REGRESSION THIS LOCKS (measured 2026-08-07 on scala-agents-ui). Readiness
- * used to be flipped INSIDE `setPageHandler`, which was honest while every
- * service was SSR. `render_mode=client` made a service that completes phase 2
- * and never calls it, so `/health` answered `{"status":"starting"}` FOREVER
- * while the process was healthy and serving — boot completed in 5023ms, "Full
- * app built: 50 block(s)" logged, `GET /` correctly 302'd to sign-in, and three
- * untouched UI services reported ok beside it.
- *
- * That is precisely what `readiness-gated-boot` forbids ("binary: fully-ready or
- * cleanly-unavailable"): a permanently-un-ready health signal makes the
- * activator's wake gate and every health-gated router treat a working service as
- * down. Exercised through a real Hono request against the REAL exported handler
- * (`proxy-is-not-behaviour`) — a source grep would prove the call exists, never
- * that the endpoint answers 200.
- */
+// ! @system codegen
+// ! @status generated
+// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+// !
+// ! This suite's assertions are OWNED by the codegen band: the band module
+// ! carries them verbatim, this file is the emission, and hand edits here are
+// ! overwritten on the next run. The rationale each assertion carries moved
+// ! with it into the band.
 
 import { beforeAll, describe, expect, test } from "bun:test";
 import { Hono } from "hono";