@teamscala/service-boot 0.23.503 → 0.23.506

package/src/resolve-service-port.test.ts

@@ -1,15 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The load-bearing case is the contradiction one: a PORT env that disagrees
- * with the service's own declared port must NOT be obeyed. Obeying it put
- * mcp-ai-chat-system on session-picker's port with a loopback pointing at a
- * port nothing was listening on, and the failure surfaced as broken tool
- * curation rather than as a port problem. It then did it again on 2026-07-31
- * to scala-quiz — see the kind:ui block below.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { resolveServicePort } from "./resolve-service-port.ts";

package/src/resolvers/app-header.test.ts

@@ -1,8 +1,12 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { resolveAppHeader } from "./app-header.ts";
 

package/src/resolvers/fetch-org-brand.ts

@@ -12,17 +12,33 @@
  * hardcoded `fetchOrgBrand` arm in resolve-from-loader-config.ts.
  */
 import { fetchOrgBrand } from "@teamscala/resolver-engine/data-resolvers/fetch-org-brand";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { ResolverArgs } from "./portal-route-paths.ts";
 
+/** A null brand renders a page with no logo, colours or name — so each failure names which of the three it was. */
 export async function fetchOrgBrandWithFallback({ input, client }: ResolverArgs): Promise<unknown> {
 	const orgId = input.orgId as string | undefined;
+	const fallbackOrgId = input.fallbackOrgId as string | undefined;
 	if (orgId) {
 		const result = await fetchOrgBrand(client as Parameters<typeof fetchOrgBrand>[0], orgId);
 		if (result) return result;
+		getAppLogger().warn(
+			`[fetch-org-brand] org "${orgId}" resolved NO brand row — the page renders with no logo, colours or company name. Either organisation_profile has no row for that id, or the server client exposes no organisation_profile.findFirst.`,
+		);
+	} else {
+		getAppLogger().warn(
+			`[fetch-org-brand] no orgId reached the resolver (input keys: ${Object.keys(input).join(", ") || "none"}) — the resource_loader's resolver_input ref did not interpolate, so the page renders unbranded.`,
+		);
 	}
-	const fallbackOrgId = input.fallbackOrgId as string | undefined;
 	if (fallbackOrgId && fallbackOrgId !== orgId) {
-		return fetchOrgBrand(client as Parameters<typeof fetchOrgBrand>[0], fallbackOrgId);
+		const fallback = await fetchOrgBrand(
+			client as Parameters<typeof fetchOrgBrand>[0],
+			fallbackOrgId,
+		);
+		if (fallback) return fallback;
+		getAppLogger().warn(
+			`[fetch-org-brand] fallback org "${fallbackOrgId}" also resolved no brand row.`,
+		);
 	}
 	return null;
 }

package/src/resolvers/portal-route-paths.test.ts

@@ -1,16 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * portal-route-paths.test.ts — locks the portal-path shape contract that both
- * the route resolver and the /sign-in brand extractor (bind-page-handler) share:
- * the canonical portal URL is /<websiteId>/<orgId>/<path>, so the ORG is segment
- * 1, never segment 0. The fixture pairs below are the regression guard for the
- * two cross-tenant defects this centralises (found 2026-07-21): reading segment 0
- * fed a website id into brand resolution and silently rendered org-less portal
- * URLs unscoped.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import {

package/src/resource-chat-inject.page-assistant.test.ts

@@ -1,31 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * resource-chat-inject.page-assistant.test.ts — the page assistant must be
- * PRESENT IN RENDERED OUTPUT on every link shape a page resolves.
- *
- * THE DEFECT THIS PINS (found 2026-09-08, quiz report page): the page_route's
- * assistant named resource_key "response" — the loader's RAW response hit.
- * On /report/<response-id> that hit exists and the chat bubble injected. On
- * anchor links (a research-record id, live or superseded) the raw hit is
- * null, injectResourceChatLauncher read no organisation_id off it, returned
- * SILENTLY, and the page rendered a complete report at 200 with the
- * assistant simply absent — 552KB of script gone, no error anywhere. The
- * page's reportData was byte-identical across all three shapes, which is
- * exactly why a data-equality check could not see it: the launcher is a
- * separate BLOCK whose presence depends on resolved[resourceKey], not on the
- * report data.
- *
- * THE FIX SHAPE: the page's resource_key names the PAIRED key ("pair"),
- * which exists on every link shape and carries organisation_id (the pair
- * resolver returns the anchor half's organisation). These tests drive the
- * injector with graphs shaped exactly like the loader produces for each of
- * the three link shapes and assert the launcher lands in the rendered
- * content tree — the thing that becomes markup — for ALL THREE. A
- * data-equality assertion cannot pass in their place.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, mock, test } from "bun:test";
 

package/src/resource-chat-inject.test.ts

@@ -1,28 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Regression test for the block NAME the chat injectors push.
- *
- * THE DEFECT THIS PINS (found 2026-08-19): the floating assistant bubble was
- * silently absent on every gated proposal and agreement. discover-blocks keys
- * the Puck component registry off `block_schema.slug` and nothing else
- * (`components[row.slug] = …`), so a pushed block `type` must EQUAL an active
- * slug. The launcher block was consolidated to the single `ResourceLauncher`
- * row, but the injectors still pushed the pre-consolidation names —
- * `ResourceChatLauncher` here, and `ChatLauncherBlock` in the bespoke proposal
- * injector that has since been deleted in favour of this one. Neither name
- * resolves, and because injection is deliberately fail-soft the page
- * rendered unchanged with no error: the classic shape of
- * `a-deleted-producer-leaves-its-consumers-executing`.
- *
- * Asserting the literal is the WEAK half of the fix — it catches a regression
- * of this exact string, not a future rename of the block. The strong half is
- * single-sourcing the name so it cannot be spelled at all
- * (`identity-is-imported-never-spelled`); until that lands, this test is what
- * stands between the bubble and another silent disappearance.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, mock, test } from "bun:test";
 

package/src/resource-not-found.test.ts

@@ -1,11 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Co-located tests for the resource-not-found public API: the error class +
- * the response builder are pure (no S3), so the behaviour is exercised directly.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import {
 	PrimaryResourceMissingError,

package/src/security-headers.test.ts

@@ -1,15 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavior proof for the `security-content-type-nosniff` +
- * `security-permissions-policy` invariants: exercise injectSecurityHeaders
- * through a real Hono request and assert the headers on the RESPONSE —
- * a registry row naming a header is not evidence the header is served.
- * Covers both modes: the seeded-registry path (config row applied, CSP
- * {{nonce}} substituted) and the DB-less fallback (secureHeaders defaults).
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import { Hono } from "hono";
 import { injectSecurityHeaders } from "./security-headers.ts";

package/src/select-service-routes.test.ts

@@ -1,3 +1,12 @@
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { selectServiceRoutes } from "./select-service-routes.ts";
 

package/src/server-error-page.test.ts

@@ -1,13 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Fixture suite for the branded HTML render-error page. Asserts the
- * user-observable outcome (error-responses-via-error-report): a page render
- * failure serves a branded HTML page — never JSON — carrying the status,
- * Retry-After, and the errorId that ties the screen to GlitchTip + the log.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import type { ErrorReport } from "@teamscala/os/errors/error-report";

package/src/theme-fonts-link.test.ts

@@ -1,13 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The served <head> carries every font family the css_theme row declares —
- * derived from the row (one source), never a hard-coded family list. The old
- * envelope loaded only Inter, so the proposal heading variant's manuscript
- * serif never loaded and fell back to Times (2026-09-02).
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, mock, test } from "bun:test";
 

package/src/two-phase-full-app.test.ts

@@ -1,19 +1,11 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Phase-2 step isolation: a client-asset build failure must not prevent
- * pg-boss from mounting.
- *
- * Asserted against the SOURCE rather than by booting a service, because the
- * behaviour is an ordering/error-handling property of buildFullApp and booting
- * it here would need a database, a registry, a Vite build and a live pg-boss.
- * The property is structural: buildClientAssets must be inside a try/catch that
- * appears BEFORE the mountPgBoss call. That is exactly
- * what regressed, and a source assertion fails the moment someone re-awaits it
- * unguarded — which is the regression this locks.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 

package/src/two-phase-health-gate-client-only.test.ts

@@ -1,31 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * A CLIENT-ONLY service (`render_mode=client`) must reach ready, even though it
- * never registers an SSR page handler.
- *
- * Separate file from `two-phase-health-gate.test.ts` on purpose: `fullAppReady`
- * is module state that only transitions false -> true and has no reset hook, so
- * the two ready-paths cannot both be exercised in one module instance. A reset
- * hook would exist only for tests.
- *
- * THE REGRESSION THIS LOCKS (measured 2026-08-07 on scala-agents-ui). Readiness
- * used to be flipped INSIDE `setPageHandler`, which was honest while every
- * service was SSR. `render_mode=client` made a service that completes phase 2
- * and never calls it, so `/health` answered `{"status":"starting"}` FOREVER
- * while the process was healthy and serving — boot completed in 5023ms, "Full
- * app built: 50 block(s)" logged, `GET /` correctly 302'd to sign-in, and three
- * untouched UI services reported ok beside it.
- *
- * That is precisely what `readiness-gated-boot` forbids ("binary: fully-ready or
- * cleanly-unavailable"): a permanently-un-ready health signal makes the
- * activator's wake gate and every health-gated router treat a working service as
- * down. Exercised through a real Hono request against the REAL exported handler
- * (`proxy-is-not-behaviour`) — a source grep would prove the call exists, never
- * that the endpoint answers 200.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { beforeAll, describe, expect, test } from "bun:test";
 import { Hono } from "hono";

package/src/two-phase-health-gate.test.ts

@@ -1,31 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The wake gate for every scale-to-zero app: `/health` must not report ready
- * while the service still 503s pages.
- *
- * Exercised through a real Hono request against the REAL exported handler, not
- * asserted against source text — `proxy-is-not-behaviour`: a source grep proves
- * a line exists, never that the endpoint answers 503. This test fails if anyone
- * restores the flat `{status:"ok"}`, which is the regression it locks.
- *
- * THE MEASURED OUTAGE (2026-07-31, quiz-dev + sign-dev returning 503 to
- * customers). `scala-activator` gates a cold wake on `isHealthy(port)` — a
- * plain `GET /health` — then pipes the held client connection the moment it
- * returns ok. `/health` answered ok as soon as the MINIMAL app served, but the
- * phase-1 page handler returns 503 until the phase-2 swap, so the activator
- * piped the customer's first request into that window:
- *
- *   05:58:25.446  activator: awake scala-quiz (4227ms)
- *   05:58:25.452  scala-quiz: GET / 503 3ms      <- the customer's request
- *   05:58:26.456  scala-quiz: Swapped from minimal app to full app
- *
- * Nine such 503s on scala-quiz, two on scala-sign, zero on scala-public — the
- * gap is a race whose width is the phase-1→phase-2 build time (1420ms cold,
- * 137ms warm), which is why one app looked healthy and the others did not.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { beforeAll, describe, expect, test } from "bun:test";
 import { Hono } from "hono";