@teamscala/service-boot 0.23.516 → 0.23.518

package/src/build-client-assets.ts

@@ -17,25 +17,18 @@
  * Without this, `cache-control: immutable` on a fixed filename means
  * returning visitors keep their stale copy forever.
  *
- * Content-fingerprint cache: the CLIENT-BUNDLE DEPENDENCY CLOSURE (source
- * entrypoints + every @teamscala/* module/stylesheet the bundle reaches + the
- * resolved versions of the third-party deps the closure imports) is hashed by
- * CONTENT and stored in the manifest; the rebuild is skipped only when the
- * current closure hashes to the same fingerprint (cache-key-hashes-source-
- * inputs-only — never mtime; see input-fingerprint.ts for why mtime silently
- * served stale bundles on Railway). bun.lock is deliberately NOT hashed — it
- * encodes every @teamscala/* version including backend packages outside this
- * service's client bundle, so folding it in would rebuild on every publish
- * (the publish→rebuild storm; `no-uncontrolled-repetition-or-cascade`). A
- * restart after a real closure change pays the full build cost; unchanged
- * restarts skip. Stale hashed outputs from a prior build are removed in the
- * same pass so dist/client/ doesn't accumulate dead files.
- *
- * This module is the ORCHESTRATION unit: fingerprint check → host-wide lock
- * → parallel hydrate/CSS builds → manifest write (or failure tombstone). The
- * individual concerns live as siblings under ./build-client-assets/
- * (input-hashing, source-candidates, input-fingerprint, manifest,
- * hashed-output, hydrate-bundle, sourcemaps-upload, styles-build, build-lock)
+ * This module is the ORCHESTRATION unit: host-wide lock → parallel
+ * hydrate/CSS builds → manifest write (or failure tombstone). The
+ * build runs on EVERY boot: the content-fingerprint skip cache and its
+ * closure-walking hashers (input-fingerprint.ts, input-hashing.ts) are
+ * deleted. A skip is the only path that can serve a stale bundle, and
+ * it has done so twice (the mtime skip that baked stale bundles until
+ * the fingerprint replaced it, 2026-06-14) — no skip is the one shape
+ * that cannot skip wrongly, at the cost of a bounded per-boot build
+ * serialised by the host-wide lock below. The individual concerns live
+ * as siblings under ./build-client-assets/
+ * (source-candidates, manifest, hashed-output, hydrate-bundle,
+ * sourcemaps-upload, styles-build, build-lock)
  * — split when the parent held them all at 962 lines.
  */
 
@@ -44,9 +37,10 @@
 	// manifest entry that points at a file we don't actually serve. If a build fails, write a TOMBSTONE manifest (no-silent-reverts) and throw.
 	//
 	// The tombstone preserves the LAST-SUCCESSFUL paths so SSR can keep serving the old bundle (better than a 404 hydrate), but marks itself
-	// `buildFailed: true` + the error + `failedAt`, AND sets `inputFingerprint` to a FAILURE sentinel so the next boot's "manifest up-to-date (skip)"
-	// check CANNOT match — the next boot is forced to retry the build explicitly (no silent skip on the stale manifest). The tombstone is the
-	// on-disk failure signal; ui-service-boot adds the runtime signal (recordEvent → event-log → GlitchTip) and read-html-template stamps the
+	// `buildFailed: true` + the error + `failedAt`, AND — because every boot
+	// now rebuilds unconditionally — the failure is retried by construction;
+	// the tombstone is the on-disk failure signal; ui-service-boot adds the
+	// runtime signal (recordEvent → event-log → GlitchTip) and read-html-template stamps the
 	// served HTML with the failure status. Without the tombstone, a build failure left the OLD manifest untouched and the dashboard served stale
 	// code with NO signal that the published fix never reached the bundle (scala-agents 2026-07-18: ui-foundation@3.4.5 installed but the bundle
 	// kept serving the old bytes across restarts while node_modules was mid-install — invisible until the operator hit the white-on-white
@@ -58,15 +52,10 @@ import { withFileLock } from "@teamscala/file-lock/with-lock";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { CLIENT_BUILD_LOCK, getClientBuildLockTimeoutMs } from "./build-client-assets/build-lock.ts";
 import { buildHydrateBundle } from "./build-client-assets/hydrate-bundle.ts";
-import { computeInputFingerprint } from "./build-client-assets/input-fingerprint.ts";
 import {
 	readManifest,
 	writeManifest,
 } from "./build-client-assets/manifest.ts";
-import {
-	releaseFromHydratePath,
-	uploadCachedSourceMaps,
-} from "./build-client-assets/sourcemaps-upload.ts";
 import { buildTailwindCss } from "./build-client-assets/styles-build.ts";
 
 export async function buildClientAssets(serviceSlug: string): Promise<void> {
@@ -74,41 +63,10 @@ export async function buildClientAssets(serviceSlug: string): Promise<void> {
 	const cwd = process.cwd();
 	const outDir = join(cwd, "dist", "client");
 
-	const existingManifest = await readManifest(outDir);
-	const fingerprint = await computeInputFingerprint(cwd);
-	if (existingManifest && existingManifest.inputFingerprint === fingerprint) {
-		// The bundle is fresh, but a fresh bundle with an UNVERIFIED source-map
-		// upload must not stay that way forever: retry the upload from the
-		// retained map cache on every boot until it verifies. Without this, one
-		// failed boot-time upload (GlitchTip down, token missing at that boot)
-		// permanently lost the release's maps — client stacks stayed minified
-		// until the next real input change forced a rebuild.
-		const recorded = existingManifest.sourceMaps?.status;
-		const release = existingManifest.hydratePath
-			? releaseFromHydratePath(existingManifest.hydratePath)
-			: null;
-		if (recorded !== "uploaded" && release) {
-			log.info(
-				`[build-client-assets:${serviceSlug}] manifest up-to-date (skip); source maps previously ${recorded ?? "unrecorded"} — retrying upload for release ${release}`,
-			);
-			const sourceMaps = await uploadCachedSourceMaps(cwd, release, log);
-			await writeManifest(outDir, { ...existingManifest, sourceMaps });
-		} else {
-			log.info(`[build-client-assets:${serviceSlug}] manifest up-to-date (skip)`);
-		}
-		return;
-	}
-	if (existingManifest && existingManifest.inputFingerprint !== fingerprint) {
-		log.info(
-			`[build-client-assets:${serviceSlug}] inputs changed (fingerprint ${existingManifest.inputFingerprint ?? "<none>"} → ${fingerprint}) — rebuilding client bundle`,
-		);
-	}
-
-	// A build IS needed. Serialise it across every UI service on this host
+	// Serialise the build across every UI service on this host
 	// (client-asset-builds-serialize-via-lock) so a publish-driven restart storm
 	// becomes a short queue instead of N concurrent host-saturating builds. The
-	// lock is acquired ONLY here — never on the up-to-date skip path above — and
-	// FAILS OPEN: a lock-acquisition timeout builds unlocked rather than blocking
+	// lock FAILS OPEN: a lock-acquisition timeout builds unlocked rather than blocking
 	// boot. A real build failure inside performBuild throws and propagates (the
 	// service refuses to start); only the file-lock timeout falls through.
 	const lockTimeoutMs = await getClientBuildLockTimeoutMs();
@@ -116,7 +74,7 @@ export async function buildClientAssets(serviceSlug: string): Promise<void> {
 		await withFileLock(
 			CLIENT_BUILD_LOCK,
 			{ timeoutMs: lockTimeoutMs },
-			() => performBuild(serviceSlug, cwd, outDir, log, fingerprint),
+			() => performBuild(serviceSlug, cwd, outDir, log),
 		);
 	} catch (err) {
 		const isLockTimeout =
@@ -126,7 +84,7 @@ export async function buildClientAssets(serviceSlug: string): Promise<void> {
 		log.warn(
 			`[build-client-assets:${serviceSlug}] build lock timed out after ${lockTimeoutMs}ms — building unlocked (fail-open)`,
 		);
-		await performBuild(serviceSlug, cwd, outDir, log, fingerprint);
+		await performBuild(serviceSlug, cwd, outDir, log);
 	}
 }
 
@@ -135,7 +93,6 @@ async function performBuild(
 	cwd: string,
 	outDir: string,
 	log: ReturnType<typeof getAppLogger>,
-	inputFingerprint: string,
 ): Promise<void> {
 	const t0 = Date.now();
 
@@ -157,9 +114,6 @@ async function performBuild(
 				...(existingManifest?.stylesPath && existingManifest?.hydratePath
 					? { stylesPath: existingManifest.stylesPath, hydratePath: existingManifest.hydratePath }
 					: {}),
-				// Failure sentinel: the next boot's fingerprint check reads
-				// this and cannot match any real fingerprint → forces a retry.
-				inputFingerprint: `failed:${new Date().toISOString()}`,
 				buildFailed: true,
 				buildFailedReason: reason.slice(0, 2000),
 				buildFailedAt: new Date().toISOString(),
@@ -221,7 +175,6 @@ async function performBuild(
 	await writeManifest(outDir, {
 		stylesPath,
 		hydratePath: hydrate.hydratePath,
-		inputFingerprint,
 		sourceMaps: hydrate.sourceMaps,
 	});
 

package/src/content-gate/token.ts

@@ -16,7 +16,8 @@
  * (e.g. ag_token) can never satisfy another gate's check (e.g. prop_token).
  *
  * Secret resolver, in preference order: AUTH_SECRET → ENCRYPTION_KEY →
- * DATABASE_URL (first one ≥16 chars). A gate signs AND verifies inside one
+ * the tenant DB address via @teamscala/db's named-need resolver (first one
+ * ≥16 chars). A gate signs AND verifies inside one
  * service, so it only needs a stable per-deployment secret; the fallback keeps a
  * gate working on a service that was never given AUTH_SECRET (e.g. the former
  * public-only proposals viewer) instead of failing closed and locking out every
@@ -25,12 +26,18 @@
  */
 
 import type { GateSegmentation } from "./config-types.ts";
+import { resolveDbUrlOrNull } from "@teamscala/db/db-url";
 
 function secret(): string | null {
+	// The last resort is the tenant DB address, read through the named-need
+	// resolver (wrong-database guard, 2026-09-27) — never `process.env` here;
+	// the resolver is the only env-aware surface and it names the plane. It is
+	// used only as a stable per-deployment string (≥16 chars), never as a
+	// connection target.
 	for (const s of [
 		process.env.AUTH_SECRET,
 		process.env.ENCRYPTION_KEY,
-		process.env.DATABASE_URL,
+		resolveDbUrlOrNull("tenant"),
 	]) {
 		if (s && s.length >= 16) return s;
 	}

package/src/install-logging.ts

@@ -10,17 +10,18 @@
  * loga (dev) with full context. Application code never imports the logger
  * or wraps anything in try/catch for telemetry purposes.
  *
- * Marked: installLogging (early bootstrap, hardcoded
- * defaults) and applyLoggerConfig (late-stage, DB-driven) are the two
- * phases of the same one-call install — the service boot pipeline calls
- * them in sequence with the same serviceSlug.
+ * Two phases, two files (single-purpose-file: the guard counts them as two
+ * export groups in one file): installLogging (early bootstrap, hardcoded
+ * defaults) lives here; applyLoggerConfig (late-stage, DB-driven) lives in
+ * apply-logger-config.ts. The service boot pipeline calls them in sequence
+ * with the same serviceSlug.
  */
 
 import { ManagedCache } from "@teamscala/cache/cache";
 import { createCache } from "@teamscala/cache/create-cache";
 import { createDiskCache } from "@teamscala/cache/disk-cache";
 import { join } from "node:path";
-import { userHome } from "@teamscala/os/host-paths";
+import { stateRoot } from "@teamscala/os/host-paths";
 import { slugify } from "@teamscala/formatters/slugify";
 import { createTimer } from "@teamscala/timing/create-timer";
 import { configure as dbConfigure } from "@teamscala/db/configure";
@@ -29,8 +30,6 @@ import { getEntriesByType as dbGetEntriesByType } from "@teamscala/db/registry/g
 import { loadRegistryConfig as dbLoadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { configure as httpConfigure } from "@teamscala/http/configure";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { setMinLevel } from "@teamscala/logger/creator";
-import { configureFileSink } from "@teamscala/logger/file-sink";
 import { initSentry } from "@teamscala/logger/init-sentry";
 import { attachRequestLogger } from "@teamscala/logger/install-logging";
 import { getRequestContext } from "@teamscala/logger/request-context-async";
@@ -75,8 +74,11 @@ export function installLogging(opts: InstallLoggingOptions): void {
 	// (runtime tier) so host-path resolution stays out of the foundation-tier
 	// db package, which cannot import @teamscala/cache or resolve userHome itself.
 	// load-config serves this on a transient DB failure instead of crash-looping.
+	// The root is stateRoot(), not userHome(): a container that declares a
+	// read-only HOME (scala-sign prod: HOME=/var/empty) made this cache EACCES on
+	// every request — the tier died in exactly the outage class it exists for.
 	const registryConfigDiskCache = createDiskCache("db:registry-config", {
-		dir: join(userHome(), ".scala-db-cache", "registry-config"),
+		dir: join(stateRoot(), ".scala-db-cache", "registry-config"),
 		ttlMs: 24 * 60 * 60 * 1000,
 	});
 	dbConfigure({
@@ -110,24 +112,6 @@ export function installLogging(opts: InstallLoggingOptions): void {
 	// in service_install.server_packages and pick up the configures there.
 }
 
-/** Late-stage configuration — runs AFTER Registry is loaded.
- *  Injects DB-driven settings into the logger primitive. */
-export function applyLoggerConfig(config: {
-	minLevel?: "debug" | "info" | "warn" | "error";
-	logDir?: string;
-	maxFileSize?: number;
-	maxFiles?: number;
-}): void {
-	if (config.minLevel) {
-		setMinLevel(config.minLevel);
-	}
-	configureFileSink({
-		logDir: config.logDir,
-		maxFileSize: config.maxFileSize,
-		maxFiles: config.maxFiles,
-	});
-}
-
 function installConsoleShim(serviceSlug: string): void {
 	const log = getAppLogger();
 	const methodMap: Record<

package/src/mount-orpc-router.ts

@@ -12,6 +12,7 @@
 import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Db8Client } from "@teamscala/db/db8-registry";
+import { resolveDbUrlOrNull } from "@teamscala/db/db-url";
 import type { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 
@@ -131,12 +132,17 @@ export async function mountOrpcRouter(
 		// closed over by the request handler (connects lazily on first query).
 		let db8: Db8Client | undefined;
 		try {
-			if (process.env.DATABASE_URL) {
+			// Named-need address (wrong-database guard, 2026-09-27): the tenant
+			// plane by name through @teamscala/db's resolver, never an env key
+			// read at this call site. Null = the deploy wrote nothing for this
+			// plane, and db8 stays undefined on the existing absence path.
+			const databaseUrl = resolveDbUrlOrNull("tenant");
+			if (databaseUrl) {
 				const { createDbClientV8 } = await import(
 					"@teamscala/db/create-db-client-v8"
 				);
 				db8 = (await createDbClientV8({
-					connectionString: process.env.DATABASE_URL,
+					connectionString: databaseUrl,
 					serviceName: serviceSlug,
 				})) as never;
 				// Register for db-core internals (registry loaders, raw fallbacks)

package/src/mutable-app-ref.ts

@@ -36,13 +36,6 @@ export function getApp(): Hono {
 	return currentApp;
 }
 
-/**
- * Get the current app label for logging.
- */
-export function getAppLabel(): string {
-	return appLabel;
-}
-
 /**
  * Atomically swap the app to a new instance. This is called after the
  * full app is built in the background. Returns the previous label for logging.

package/src/page-server-loader-graph.test.ts

@@ -0,0 +1,31 @@
+/**
+ * @status generated — ts-api-smoke template (scala-test-suites
+ * templates/ts_api_smoke.pkl @1.3.0) over the exports map of @teamscala/service-boot.
+ * ./page-server-loader-graph declares 1 runtime export(s) and 1 declared behaviour vector(s);
+ * this suite asserts the import resolves, the runtime surface matches
+ * exactly, and every export carries its declared kind. Regenerate from
+ * inputs/bun-server-service-boot/api_smoke.json (scala-test-suites) — hand edits are
+ * overwritten.
+ */
+
+import { describe, expect, it } from "bun:test";
+
+const mod = await import("./page-server-loader-graph");
+
+const { resolveFromLoaderConfig } = mod;
+
+describe("page-server-loader-graph exports-map smoke", () => {
+	it("the runtime export set is exactly the declared surface", () => {
+		expect(Object.keys(mod).sort()).toEqual([
+			"resolveFromLoaderConfig",
+		]);
+	});
+	it("resolveFromLoaderConfig is a function", () => {
+		expect(typeof mod["resolveFromLoaderConfig"]).toBe("function");
+	});
+	it("the SSR binding is a resolver PRODUCT of the engine factory applied to the page-server client — never the factory itself", async () => {
+		const { createLoaderConfigResolver } = await import("@teamscala/resolver-engine/loader-config/resolve-from-loader-config");
+		expect(typeof createLoaderConfigResolver).toBe("function");
+		expect(resolveFromLoaderConfig).not.toBe(createLoaderConfigResolver);
+	});
+});

package/src/page-server-loader-graph.ts

@@ -0,0 +1,21 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * page-server-loader-graph.ts — binds the ONE loader-graph resolver
+ * (@teamscala/resolver-engine's createLoaderConfigResolver) to the page-server
+ * SSR client. The resolver used to be duplicated here with its own algorithm;
+ * the copies drifted (a non-UUID URL ref resolved absent on this surface and
+ * still threw into the render breaker on the fn-router surface), so the
+ * algorithm became one injected function and each surface binds its own
+ * client source. This module IS that binding for the SSR surface — the single
+ * place the page-server client and the loader-graph resolver meet.
+ */
+
+import { createLoaderConfigResolver } from "@teamscala/resolver-engine/loader-config/resolve-from-loader-config";
+import { getServerClient } from "./page-server-orpc/server-client.ts";
+
+export const resolveFromLoaderConfig = createLoaderConfigResolver(
+	getServerClient,
+);

package/src/pg-boss-mount.ts

@@ -21,22 +21,9 @@ import type { ScheduleOptions } from "pg-boss";
 import { PgBoss } from "pg-boss";
 import { pgBossHandlerRegistry } from "./pg-boss-handler-registry.ts";
 
-// Bundled pg-boss handlers self-register on import (package-subscriber shape).
-// External handler packages register via their own boot hook / subscriber import.
-import "./handlers/projects-digest.ts";
-import "./handlers/sweep-event-log.ts";
-// `sweep-host-cache` is Rust-native: loga (the job's service_slug) registers it
-// via scala_os::host_cache_retention with the config/cleanup-allowed-roots
-// bound. No TypeScript copy may exist beside it.
-import "./handlers/bun-stable-watch.ts";
-import "./handlers/whatsapp-liveness.ts";
-import "./handlers/messaging-send-recording-watch.ts";
-import "./handlers/upstream-issue-sync.ts";
-import "./handlers/scala-tools-currency-watch.ts";
-import "./handlers/singleton-tools-currency-watch.ts";
-import "./handlers/registry-stale-inactive-sweep.ts";
-import "./handlers/platform-fault-escalation.ts";
-import "./handlers/quiz-research.ts";
+// Handlers register via their package's own boot hook / subscriber import
+// (package-subscriber shape) — no bundled copies. The mount resolves each
+// row's handler_slug against this registry at dispatch time.
 
 
 /**

package/src/readiness-gate.ts

@@ -16,10 +16,6 @@ import type { Context, Next } from "hono";
 
 let _ready = false;
 
-export function isReady(): boolean {
-	return _ready;
-}
-
 export function setReady(): void {
 	_ready = true;
 }

package/src/register-api-routes.ts

@@ -111,23 +111,14 @@ export function registerApiRoutes(
 		count++;
 	}
 
-	// CORS preflight: any service serving cross-origin browser clients (the central
-	// chat engine on mcp-ai-chat-system) needs an OPTIONS response. The shared
-	// session cookie (Domain=.scala.business) authenticates — only credentialed
-	// CORS is needed (no token-passing). Harmless for same-origin services.
-	app.options("*", (c) => {
-		const origin = c.req.header("origin");
-		if (!origin) return new Response(null, { status: 204 });
-		return new Response(null, {
-			status: 204,
-			headers: {
-				"Access-Control-Allow-Origin": origin,
-				"Access-Control-Allow-Credentials": "true",
-				"Access-Control-Allow-Methods": "POST, OPTIONS",
-				"Access-Control-Allow-Headers": "Content-Type",
-			},
-		});
-	});
+	// NO hand-rolled OPTIONS/CORS here: two-phase-minimal-app registers the
+	// official hono/cors middleware GLOBALLY before this runs, and its OPTIONS
+	// branch answers preflights without calling next() — a hand preflight
+	// handler registered here is shadowed dead code (measured: zero
+	// invocations across trusted/no/foreign-origin preflights, bun probe
+	// 2026-09-27). The middleware also decorates ACTUAL cross-origin
+	// responses and reflects origins only inside the cookie domain — the
+	// dead copy reflected ANY origin with credentials.
 
 	return count;
 }

package/src/register-page-server-client.ts

@@ -7,6 +7,12 @@
  * the platform-owned routers into the service's generated `appRouter` and
  * stashes the resulting client via setServerClient. Called once at boot before
  * any page route handler fires.
+ *
+ * Handwritten because no machine-readable contract generates it: this is the
+ * EXECUTOR half of a rows+executor pair (`business-logic-is-rows-plus-executors`),
+ * whose declared half is the `service_install`/`service_schema` rows read at
+ * boot. There is no supplier spec, CLI or registry row that could emit this
+ * boot-time wiring, so it stays hand-written; the row half remains the source.
  */
 
 		// REFUSE, DO NOT SKIP. `existsSync(routerPath)` being false used to fall straight through with appRouter=null and still register a client + log

package/src/register-registry-page-route/meta-title.test.ts

@@ -0,0 +1,50 @@
+/**
+ * @status generated — ts-api-smoke template (scala-test-suites
+ * templates/ts_api_smoke.pkl @1.3.0) over the exports map of @teamscala/service-boot.
+ * ./meta-title declares 3 runtime export(s) and 4 declared behaviour vector(s);
+ * this suite asserts the import resolves, the runtime surface matches
+ * exactly, and every export carries its declared kind. Regenerate from
+ * inputs/bun-server-service-boot/api_smoke.json (scala-test-suites) — hand edits are
+ * overwritten.
+ */
+
+import { describe, expect, it } from "bun:test";
+
+const mod = await import("./meta-title");
+
+const { buildMetaFromContext, resolvePageMetaTitle, resolveEntityTitle } = mod;
+
+describe("meta-title exports-map smoke", () => {
+	it("the runtime export set is exactly the declared surface", () => {
+		expect(Object.keys(mod).sort()).toEqual([
+			"buildMetaFromContext",
+			"resolveEntityTitle",
+			"resolvePageMetaTitle",
+		]);
+	});
+	it("buildMetaFromContext is a function", () => {
+		expect(typeof mod["buildMetaFromContext"]).toBe("function");
+	});
+	it("resolvePageMetaTitle is a function", () => {
+		expect(typeof mod["resolvePageMetaTitle"]).toBe("function");
+	});
+	it("resolveEntityTitle is a function", () => {
+		expect(typeof mod["resolveEntityTitle"]).toBe("function");
+	});
+	it("an absent meta context resolves no meta at all", async () => {
+		const got = buildMetaFromContext(undefined, { page: { name: "Quiz" } });
+		expect(got).toEqual({});
+	});
+	it("the page's own meta_title wins, from loaderData first", async () => {
+		const got = resolvePageMetaTitle({ loaderData: { page: { meta_title: "Sign in" } }, page: { meta_title: "Landing" } });
+		expect(got).toBe("Sign in");
+	});
+	it("with no loaderData page, the resolved page's meta_title answers", async () => {
+		const got = resolvePageMetaTitle({ loaderData: {}, page: { meta_title: "Landing" } });
+		expect(got).toBe("Landing");
+	});
+	it("neither page carries a title, so no title resolves", async () => {
+		const got = resolvePageMetaTitle({ loaderData: {} });
+		expect(got).toBeUndefined();
+	});
+});

package/src/register-registry-page-route/meta-title.ts

@@ -33,7 +33,7 @@
  * edit here rather than a fourth branch in three files.
  */
 
-import { interpolateMeta } from "../interpolate-meta.ts";
+import { interpolateMeta } from "@teamscala/resolver-engine/loader-config/resolve-from-loader-config";
 
 export function buildMetaFromContext(
 	metaContext: Record<string, Record<string, string>> | undefined,

package/src/register-registry-page-route/page-data-shared.ts

@@ -4,7 +4,8 @@
  * @edit edit directly
  *
  * Shared Puck-page-data helpers for the resolved-graph → pageData conversion:
- * the local PuckData structural type, JSON extraction with an honest null on
+ * the PuckData alias of the canonical boundary Data, JSON extraction with an
+ * honest null on
  * malformed input, layout-default application, region root-prop picking, the
  * RegionEntry shape, and the unresolved-region-slot warn. Plus the brand-token
  * prologue shared by all three render branches.
@@ -14,19 +15,14 @@
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
+import type { Data } from "@teamscala/puck-boundary/data";
 
 /**
- * Local structural type for Puck page data. Avoids a type-only import of
- * `@puckeditor/core`, which is NOT a runtime dependency — `deps-derived-from-source`
- * excludes whole-statement type-only imports, so the bare specifier has no
- * installed package to resolve against at publish typecheck time. The shape used
- * here (root/content/zones) is all this module reads or constructs.
+ * The canonical identity from the generated boundary (the platform's one
+ * declaration site for framework shapes) — never a hand-spelled structural
+ * duplicate of it.
  */
-export type PuckData = {
-	root: { props?: Record<string, unknown> };
-	content: unknown[];
-	zones?: Record<string, unknown>;
-};
+export type PuckData = Data;
 
 export const EMPTY_PUCK_DATA: PuckData = { root: { props: {} }, content: [] };
 

package/src/register-registry-page-route/resolve-request-graph.test.ts

@@ -20,7 +20,7 @@ mock.module("@teamscala/logger/app-loggers", () => ({
 	}),
 }));
 
-mock.module("../resolve-from-loader-config.ts", () => ({
+mock.module("../page-server-loader-graph.ts", () => ({
 	resolveFromLoaderConfig: async (_cfg: unknown, params: Record<string, string>) => {
 		resolveCalls.push({ params });
 		return structuredClone(loaderGraph);

package/src/register-registry-page-route/resolve-request-graph.ts

@@ -17,7 +17,7 @@ import type { PageRouteConfig } from "../register-registry-page-route.ts";
 import * as v from "valibot";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { ResourceLoaderConfigSchema } from "@teamscala/db-validation/registry-schemas/resource-loader";
-import { resolveFromLoaderConfig } from "../resolve-from-loader-config.ts";
+import { resolveFromLoaderConfig } from "../page-server-loader-graph.ts";
 import { decideContentPageFloor } from "../content-page-floor.ts";
 import { PrimaryResourceMissingError } from "../resource-not-found.ts";
 import {
@@ -87,7 +87,6 @@ export async function resolveRequestGraph(
 	args: ResolveRequestGraphArgs,
 ): Promise<Record<string, unknown>> {
 	const { pattern, routeSlug, routeConfig, loaderConfig, params, isStaticShell, serviceSlug, configFingerprint } = args;
-	const log = getAppLogger();
 
 	// A bare root ("/") that declares a resource_type is a UUID-driven
 	// public site (proposals/forms/quiz) with no resource selected — it

package/src/register-registry-page-route.ts

@@ -20,6 +20,7 @@
  * proposal-*) — split when the parent held them all at 924 lines.
  */
 
+import type { InferOutput } from "valibot";
 import type { RenderModeLiteral } from "./page-route-shell-types.ts";
 import { PageRouteConfigSchema } from "@teamscala/db-validation/registry-schemas/page-route";
 import { ResourceLoaderConfigSchema } from "@teamscala/db-validation/registry-schemas/resource-loader";
@@ -65,21 +66,16 @@ import {
 } from "./register-registry-page-route/live-loader-config.ts";
 import type { ResourceLoaderKey } from "@teamscala/db/registry/generated/resource-loader";
 
-export interface PageRouteConfig {
-	pattern: string;
-	service: string;
-	loader_slug: string;
-	meta_context?: Record<string, Record<string, string>>;
-	resource_type?: string;
-	/** The floating AI assistant this page offers (page_route.assistant). */
-	assistant?: {
-		agent_config_slug: string;
-		resource_key: string;
-		launch_label: string;
-		placeholder?: string;
-	};
-	providers?: string[];
-}
+/**
+ * The page_route row's config type is the SCHEMA'S output, never a hand
+ * mirror (`autosave-single-surface` rule 2: a hand-written copy of a
+ * db-validation schema drifts the first time the schema grows a field —
+ * validateRow strips undeclared keys, so the mirror cannot see what the
+ * row now carries). The runtime therefore reads what the row declares,
+ * including the optional fields the old mirror dropped (label,
+ * brand_org_path, regions, shell_type, render_mode).
+ */
+export type PageRouteConfig = InferOutput<typeof PageRouteConfigSchema>;
 
 interface RegistryRouteArgs {
 	app: Hono;
@@ -305,7 +301,9 @@ export async function registerRegistryPageRoute(
 			await applyBrandOrgPath(
 				pageData as Record<string, unknown>,
 				resolved,
-				(routeConfig as { brand_org_path?: string }).brand_org_path,
+				// brand_org_path is the row schema's own field now — the derived
+				// type sees it, so the narrowing cast the mirror needed is gone.
+				routeConfig.brand_org_path,
 				params,
 				serviceSlug,
 			);