@teamscala/service-boot 0.23.523 → 0.23.524

package/src/register-registry-page-route/stamp-session-context.ts

@@ -1,15 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Stamps the resolved-in-progress loader graph with the request's session
- * identity: sessionVisitor, portalContext (user/orgId/pane widths from the
- * portal cookie and the user's saved preferences). Anonymous when no session.
- *
- * Split out of register-registry-page-route.ts (924 lines) — the loadData
- * closure segment moved byte-identical; only the closure variables became
- * explicit parameters.
  */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";

package/src/register-registry-page-route/warn-uncovered-blocks.ts

@@ -1,13 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Block-coverage guard (protective-layers-fail-explicitly) for registered
- * page routes.
- *
- * Split out of register-registry-page-route.ts (924 lines) — byte-for-byte
- * move; only the import paths adjusted.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/register-registry-page-route.ts

@@ -1,23 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Reads `page_route` registry rows for the current service slug and registers
- * Hono routes that resolve data via `resource_loader` graph-based sources.
- *
- * Every page_route uses pattern `/:id` and every resource_loader uses a
- * `sources[]` dependency graph. When header/footer sources are present in
- * the resolved graph, the output includes a `regions` array for shell rendering.
- * Otherwise it produces single-page puckData.
- *
- * This module is the ROUTE-REGISTRATION unit: row loading, specificity
- * ordering, handler binding. The per-request loadData pipeline segments live
- * as siblings under ./register-registry-page-route/ (graph-cache,
- * resolve-request-graph, stamp-session-context, run-content-gates,
- * apply-page-branding, resolve-panel-page, warn-uncovered-blocks,
- * resolve-page-data, meta-title, ai-chat-prefetch, captured-loader-config,
- * proposal-*) — split when the parent held them all at 924 lines.
  */
 
 import type { InferOutput } from "valibot";

package/src/register-static-assets.ts

@@ -1,13 +1,6 @@
 /**
- * @system server-handlers
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Routes every service exposes regardless of registry config: /health
- * (liveness probe), /favicon.svg (default brand mark), /api/assets/*
- * (S3 asset proxy), and /assets/* (client bundle + stylesheet produced
- * by build-client-assets.ts into dist/client/, served identically in
- * dev and prod per scala-os/ui.md `bun-build-only`).
  */
 
 import { join } from "node:path";

package/src/register-ws-routes.ts

@@ -1,26 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Registers each `service_install.websocket_routes[]` entry as a Hono WS route.
- * The ORPC WS (`/api/rpc/ws`) is mounted by the canonical primitive
- * `mountOrpcWs` (@teamscala/orpc/ws/server) over the FULLY-COMPOSED app router —
- * this runs AFTER the app router composition, so the eager RPCHandler snapshots every
- * namespace, and any `output: eventIterator(...)` procedure dispatches (rule
- * `orpc-ws-via-mount-orpc-ws`). It is NOT a server_package WsRouteHandler — it
- * is exempt from the legacy invariant below.
- *
- * The legacy `WsRouteHandler` interface (open/message/close on a Bun
- * ServerWebSocket) is preserved by an adapter for already-migrated
- * server_packages (terminal-ws); new WS handlers should use Hono's WSEvents
- * directly.
- *
- * INVARIANT (legacy paths only): every handler registered via
- * mountCtx.registerWsRoute MUST have a matching entry in config.websocket_routes
- * (minus /api/rpc/ws), and vice versa. A mismatch is fatal — the service cannot
- * boot with handlers declared but never wired (silent 404 on upgrade), or routes
- * that point at handlers no server_package registered.
  */
 
 import { getAppRouter } from "@teamscala/orpc/app-router";

package/src/resolve-brand-favicon.ts

@@ -1,19 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Host-level brand favicon resolution. A single-brand UI service's host has
- * a KNOWN owner (`service_install.config.brand_org`) — serving the generic
- * platform "S" at the implicit /favicon.ico path there is a defect: browsers
- * and crawlers hit that path directly and their favicon caches are sticky
- * (operator-observed 2026-06-05 on launcha's proposal pages).
- *
- * Resolution is by convention from the org's asset store:
- * `<brand_org>/logos/favicon.png`. Existence is probed once through the
- * in-process asset proxy and cached (positive AND negative) so the favicon
- * route never adds S3 latency per request. No brand_org, or no asset at the
- * convention key → null, and the caller serves the generic fallback.
  */
 
 import { createCache } from "@teamscala/cache/create-cache";

package/src/resolve-service-port.ts

@@ -1,55 +1,6 @@
 /**
- * @system service-runtime
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Decides which port a service binds, from the two sources that can claim one:
- * the PORT environment variable and the port the registry declares for that
- * service (`service_routing.local_port` for a backend, `service_install.port`
- * for a UI service).
- *
- * This is the resolver for BOTH kinds. It lives in service-boot rather than
- * service-runtime because the UI branch boots from here and may not import
- * upward; keeping one copy is the point, since the second copy is exactly what
- * went wrong (below).
- *
- * The rule, and why it is not "env always wins":
- *
- * Railway injects PORT and healthchecks that exact port, reporting the service
- * unavailable if it listens elsewhere. So on Railway the injected PORT is
- * authoritative period — a `service_install`/`service_routing` row carries the
- * service's LOCAL dev port (e.g. portal 5200), and on Railway binding that
- * instead of PORT means Railway probes a port nothing listens on and the deploy
- * fails healthcheck. The registry-wins rule below exists to stop LOCAL port
- * collisions (one host, many services); inside a Railway container there are no
- * sibling services to collide with, so PORT must win. `isRailway` is the caller's
- * assertion that it is booting inside Railway (from `RAILWAY_ENVIRONMENT`).
- *
- * Off Railway, a `service_routing`/`service_install` row means this service has
- * a DECLARED port on this host. There, a PORT that disagrees is a polluted launcher environment, never
- * an intention, and obeying it binds someone else's port. That is not a
- * hypothetical: mcp-ai-chat-system booted onto 3021 — session-picker's port —
- * while its own MCP_SERVER_URL still pointed at 8080. Both processes bound 3021,
- * SO_REUSEPORT load-balanced between them, and every symptom appeared somewhere
- * else: a chat loopback that resolved to nothing, tool-description curation
- * failing for every tool and disabling itself via its circuit breaker, RPC calls
- * landing in the wrong service, and 59 restarts. Nothing failed loudly because
- * nothing ever compared the two numbers.
- *
- * So the registry wins wherever it has an opinion, and the disagreement is
- * REPORTED rather than silently resolved — a wrong port that boots cleanly is
- * the expensive shape, because the damage surfaces far from the cause.
- *
- * That reasoning was written for the backend branch and wired only there, so
- * the UI branch kept taking `process.env.PORT` unconditionally — and on
- * 2026-07-31 reproduced the identical incident in the other direction:
- * scala-quiz (kind:ui, declared 5203) inherited a leaked PORT=3021 from the
- * tmux server environment and bound session-picker's port. Half of every RPC
- * to the session daemon was answered by a quiz service with no /rpc routes.
- *
- * A rule enforced on one of two branches is not enforced. Both branches now
- * call this function, and `port-resolution-is-registry-authoritative` fails
- * the push if either stops.
  */
 
 export interface PortResolution {

package/src/resolve-theme-mode.ts

@@ -1,27 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The ONE theme-mode decider for every page render, across every UI app
- * (portal, proposals, sign, forms, quiz, gpt, public). Every route handler in service-boot
- * resolves light/dark through this single function — never its own inline
- * `(... === "dark" ? "dark" : "light")` chain. That inline form was duplicated
- * across every route branch, so flipping one app's theme required editing
- * every copy (the heavy lifting this removes).
- *
- * Resolution order (first match wins):
- *   1. ?theme=light|dark on the URL — the embed override. Set when a page is
- *      framed inside another shell (a form in a GPT tool panel) so the framed
- *      page matches the host's scheme. Also marks the render `embedded` so the
- *      page can drop its own brand page-surface and render the host's clean
- *      surface.
- *   2. candidates[] — page rootProps.theme, brand theme, website default, in
- *      whatever priority the caller passes them.
- *   3. "light".
- *
- * Pairs with the brand/token decider (resolveBrand → computeThemeVars,
- * `unified-brand-theme`): that owns the SURFACE, this owns the MODE.
  */
 
 export interface ResolvedThemeMode {

package/src/resolvers/app-header.ts

@@ -1,24 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * app-header.ts — shared application header resolver_fn.
- *
- * Shapes an app's per-row resolver_input into the canonical header-data object
- * the ONE shared header Puck page (`/shared-app-header`) binds through the
- * unified page-data surface (`dataSource:"page-data"` + `fieldPath:"headerData.<key>"`).
- * The loader row owns the mapping (title field path, label/value pairs — the
- * per-app variation); this executor owns the shape and the two coercions the
- * rows cannot express:
- *
- * - `Date` values (Prisma returns Date objects) → ISO strings, so
- *   __PAGE_DATA__ serialises them the same way the client reads them
- *   (server-serializes-client-reads-verbatim).
- * - the literal `"today"` → a noon-UTC ISO instant of the AEST calendar date.
- *   Noon keeps the calendar date stable under every timezone offset, so the
- *   header shows the same day on the server and on any visitor's client —
- *   the deterministic replacement for the old `format:"today"` clock block.
  */
 
 /** AEST calendar date (the operator timezone) as `YYYY-MM-DD`. */

package/src/resolvers/fetch-org-brand.ts

@@ -1,15 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * fetch-org-brand.ts — org brand resolver with page-org-first fallback.
- *
- * Wraps @teamscala/resolver-engine's fetchOrgBrand with the page-org-first
- * fallback (portal-branding-resolves-page-org-first): if the page (center) org
- * carried no brand row, fall back to the website owning-org so pages with no
- * tenant org render the website's brand, not a blank. Extracted from the
- * hardcoded `fetchOrgBrand` arm in resolve-from-loader-config.ts.
  */
 import { fetchOrgBrand } from "@teamscala/resolver-engine/data-resolvers/fetch-org-brand";
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/resolvers/portal-route-paths.ts

@@ -1,17 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * portal-route-paths.ts — pure path mapper for portal region routing.
- *
- * Extracted from resolve-from-loader-config.ts (the hardcoded
- * `resolvePortalRoutePaths` arm) so it can be invoked via a resolver_fn
- * registry row instead of an if-chain. Faithful extraction — no logic change.
- * The request path is the center page's builda path ("/" falls back to
- * home_path), and the per-route toolbar page follows the flat naming convention
- * `/<last-segment>-toolbar`. Pages without a matching toolbar page simply
- * resolve an empty toolbar region (the source is declared optional).
  */
 /**
  * Extract the organisation id from a portal-shaped callback/path — the single

package/src/resolvers/website-by-host-map.ts

@@ -1,12 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * website-by-host-map.ts — resolves the website + body path for a host.
- *
- * Extracted from resolve-from-loader-config.ts (the hardcoded
- * `resolveWebsiteByHostMap` arm). Faithful extraction — no logic change.
  */
 import type { ResolverArgs } from "./portal-route-paths.ts";
 

package/src/resource-chat-inject.ts

@@ -1,23 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Injects the generic ResourceChatLauncher block into an AUTHORISED resource
- * page (proposal, agreement, or any gated document) — called from a gate's
- * onAuthorized, so the floating GPT bubble lives strictly behind the email gate
- * and every resource of that type gets it with no per-page Puck edit. It builds
- * the resource's page content into a runtime-context string and passes it to the
- * launcher, which forwards it to the chat as <runtime_context> — so ONE shared
- * assistant agent answers about whichever resource is being viewed.
- *
- * RESOURCE-AGNOSTIC by design (one-ai-chat-system / chat-ui-is-one-canonical-block):
- * the launcher, the chat engine, and this injector are generic; only the
- * per-resource CONFIG differs (which agent, the copy, which resolved key holds
- * the record). The agent id is config, not code (registries-are-source-of-truth):
- * each resource type names a `config / <slug>-assistant-agent` row carrying
- * { agentId }. No row (or no agent) → no injection, page renders unchanged
- * (fail-soft).
  */
 
 /**

package/src/resource-not-found.ts

@@ -1,30 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * One cohesive unit — the branded resource-not-found / holding page FLOOR:
- * the PrimaryResourceMissingError trigger and the HTML builder (the builder
- * consumes a logoUrl argument; the org-logo resolvers live in
- * error-page-logo.ts).
- *
- * Branded 404 for registry page routes whose PRIMARY resource is missing.
- *
- * A route that declares `resource_type` (proposal, form, quiz, agreement…)
- * is meaningless without that entity. Before this existed, a dead link
- * (wrong id, deleted row) fell through the loader with nulls and rendered
- * whatever default content the shell could scrape together — leaking
- * internal pages (the "Vision Toolbar" incident, operator-observed
- * 2026-06-05) on the org's own branded host, with a 200 status that
- * search engines and link unfurlers would happily cache.
- *
- * The replacement: loadData throws PrimaryResourceMissingError; the page
- * binder maps it to a minimal branded 404 — correct status, noindex, the
- * host's own favicon (which resolves the owning org per brand_org), and a
- * plain human sentence. Deliberately NOT a puck page: the error surface
- * must render even when data loading is the thing that failed. A
- * website-editable /404 puck page can layer on top later; this is the
- * floor that must always exist.
  */
 
 import { brandLogoImgTag } from "@teamscala/os/brand/brand-logo-img-tag";

package/src/run-boot-hook-list.ts

@@ -1,18 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Runs the service's boot hooks. A server_package registers a hook via
- * ctx.registerBootHook during the mount phase; a hook registered by an
- * INSTALLED server_package is intended to run (the package is installed
- * because the service wants it). This therefore invokes EVERY registered
- * hook — those declared in `service_install.boot_hooks[]` first (preserving
- * their declared order), then any registered-but-undeclared hooks. Requiring a
- * hook to be BOTH registered by its package AND re-declared in boot_hooks is a
- * double-declaration footgun — it left the realtime-utils pg-notify bridge
- * registered-but-never-invoked (boot_hooks was null), so the live-refresh
- * relay never started (2026-06-29).
  */
 
 import type { ServiceInstallConfig } from "./load-service-install-row";

package/src/run-boot-hooks.ts

@@ -1,24 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Runs service_install.boot_hooks in declaration order. A boot hook is a
- * registry-declared, one-shot startup function that needs to execute after
- * prisma + registry are ready but before the HTTP server starts serving.
- * Used for custom startup logic (stale-run reconciliation, cache hydration,
- * ALS seeding, long-running watcher start) that doesn't fit the pg-boss
- * recurring model and is too specific to be a generic installer step.
- *
- * Each hook is resolved by dynamic-importing its handler_slug (or slug when
- * handler_slug is absent) and awaiting its default export. The export must
- * be an async function accepting a BootHookContext. Hooks are invoked in
- * ascending order of their `order` field (default 100).
- *
- * Failures are fatal. The installer has no partial-boot concept: if a
- * declared hook cannot run, the service is broken, and booting anyway would
- * mask the regression. BootFatalError is thrown to propagate to the
- * top-level boot-error handler.
  */
 
 import type { ServiceInstallConfig } from "./load-service-install-row";

package/src/scala-tools-currency-watchdog.ts

@@ -1,12 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Polls the installed scala-tools package against GitHub Packages and repairs
- * stale daemon tooling by reinstalling and letting PM2 restart the process.
- * The fetch routes through `getGithubPackagesLatestVersion` so the URL
- * encoding and GitHub-Packages auth header live in the typed primitive.
  */
 
 import { recordEvent } from "@teamscala/event-log/record-event";

package/src/security-headers.ts

@@ -1,12 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Middleware that injects security headers into every response.
- * Uses Hono's secureHeaders as the base for standard headers (X-Content-Type-Options,
- * X-Frame-Options, Referrer-Policy, etc.), then layers registry-driven CSP with
- * nonce injection on top.
  */
 
 import { getConfigObject } from "@teamscala/db/registry/config";

package/src/select-service-routes.ts

@@ -1,22 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Selecting and ordering the `page_route` rows one service serves.
- *
- * Two decisions live here, both about WHICH rows and IN WHAT ORDER — never
- * about what a route does once matched:
- *
- * 1. SELECTION joins on the CAPABILITY, never on the deployable name. A
- *    service arrives under its LANE identity (`scala-projects-bun-dev` in
- *    dev, `scala-projects` in prod), while a page_route row names the
- *    APPLICATION and there is ONE row for both lanes. Raw string equality
- *    therefore matched at most one lane, silently — see `./capability-slug.ts`
- *    for the measured incident.
- *
- * 2. ORDERING puts specific patterns before parameterised and wildcard ones,
- *    because Hono matches in REGISTRATION order.
  */
 
 import { toCapabilitySlug } from "./capability-slug.ts";

package/src/server-error-page.ts

@@ -1,24 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The branded HTML error page for a FAILED PAGE RENDER — the page-server
- * render catch's response surface (constitution `error-responses-via-error-
- * report`). When SSR resolve+render fails (render budget exhausted, DEGRADED
- * protective layer, a thrown loader), the browser is mid-navigation: serving
- * a JSON body there is the violation this closes (2026-07-24: the operator
- * saw a raw `{"error":"Request failed"}` blob where the dashboard should be).
- *
- * Classification stays in `buildErrorReport` (`@teamscala/os`) — the ONE
- * classifier; this file is ONLY the HTML shaper for the page-navigation
- * surface (API/ORPC `onError` keeps the JSON body, consumed by code). It
- * renders the report's already-decided status + Retry-After + message, so the
- * screen, the log line, and the GlitchTip event all share one `errorId`.
- *
- * Deliberately NOT a Puck page: it must render even when data loading is what
- * failed. Sibling of `resource-not-found.ts` (the missing-resource floor) —
- * same dark branded template + org-logo resolver, distinct trigger.
  */
 
 import { escapeHtml } from "@teamscala/formatters/escapeHtml";

package/src/theme-fonts-link.ts

@@ -1,21 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Derives the document head's Google Fonts link from the `css_theme` row's
- * `fonts` map — the ONE source for the families a page's variants reference
- * (`the-theme-decides-colour-not-the-component` extends to type). The old
- * envelope hard-coded Inter, so a proposal heading naming a manuscript serif
- * ("Playfair Display") never had its family loaded and fell back to Times
- * (2026-09-02). Now every family the row declares is loaded; a family a
- * variant names that the row does not declare is a row defect, caught at the
- * row's schema boundary.
- *
- * Read from the boot registry cache (captured at service boot, the same
- * semantics as the resource_loader capture) and guarded: a missing or
- * unreadable row degrades to NO fonts link — system fonts render, the page
- * still works. This module must never throw into the document builder.
  */
 
 import { getEntryConfig } from "@teamscala/db/registry/accessors";

package/src/transfers/presigned-upload.ts

@@ -1,32 +1,6 @@
 /**
  * @system service-boot
- * @status handwritten — none derivable: searched the api_route row (fn-transfers-presigned-upload) which declares path/handler_config/input but not a body, the codegen outputs (host-bus-handler-contracts emits wiring + suites FROM rows, never procedure bodies), reference/package-catalog.md (object-storage signs a key; it carries no upload-policy primitive: no size/type/dir-scheme package to install), and the retired mount attach-transfers-upload.ts (the policy's origin, not a derivation target) — nothing generates a policy-checking procedure body.
- * @edit edit directly
- *
- * The fn.transfers.presignedUpload procedure body (api_route
- * `fn-transfers-presigned-upload`, authed: input + context). It replaces the
- * FormData POST /api/transfers/upload mount for every UI caller: the browser
- * asks for a SIGNED PUT URL for one key, uploads the bytes straight to the
- * store, and persists the SERVABLE key — so the file never crosses the
- * service and the call is one JSON request instead of a multipart body.
- *
- * The policy the mount carried lives here, and is the SAME policy: the
- * MAX_FILE_SIZE / ALLOWED_TYPES refusals (with their 413/415 statuses intact
- * through the ORPC codes below), the USER-scoped key scheme
- * (`users/<userId>/<dir>/<dir-singular>-<ts>.<ext>`), the unknown-dir
- * fallback to `uploads`, and the servable value returned as `url` with
- * `thumbUrl` mirroring it (the stored value is the servable value —
- * single-logo-pathway, so display code reads the column with no rewriting).
- * The key is derived from `context.user.id`, never from input: a caller
- * cannot mint a URL under another user's prefix.
- *
- * HONEST RESIDUAL: the size refusal reads the DECLARED fileSize, because the
- * bytes no longer pass through here — the store enforces the signature's type
- * and expiry, not a byte count. The mount's Content-Length check was equally
- * a declared-value check (an attacker sent the bytes either way); what
- * changes is that a lying client is now bounded by the URL's TTL instead of a
- * boot-level body limit. A real byte bound belongs to the bucket, not to this
- * handler.
+ * @status handwritten
  */
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { getPresignedUrl } from "@teamscala/object-storage/create/presigned-url";

package/src/two-phase-full-app.ts

@@ -1,12 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Phase 2 of the two-phase boot: the full app. Adds the expensive operations
- * deferred from phase 1 (two-phase-minimal-app.ts) — client asset building
- * (Vite build), pg-boss, the readiness/page-handler flip — and is swapped
- * in atomically once complete.
  */
 
 /**

package/src/two-phase-minimal-app.ts

@@ -1,12 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Phase 1 of the two-phase boot: the minimal tool-only app (ORPC, data
- * routes, auth gates) that serves immediately (<10s); phase 2
- * (two-phase-full-app.ts) builds the full app in the background and swaps
- * it in atomically — eliminating the ~25s boot outage window.
  */
 
 /**

package/src/two-phase-readiness.ts

@@ -1,12 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Phase-2 readiness state box for the two-phase boot: the real page handler +
- * readiness flags (private lets), the writers/flippers, the `/health` endpoint
- * that gates on them, and the phase-1 page handler that delegates to the real
- * handler once phase 2 completes. Every reader goes through these exports.
  */
 
 /**

package/src/types.ts

@@ -1,9 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Shared type definitions for service-boot boot helpers.
  */
 
 type RendererComponent = (props: Record<string, unknown>) => unknown;

package/src/ui-service.ts

@@ -1,11 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Boots a `kind: "ui"` service. Reads the service_install registry row and
- * orchestrates a fixed pipeline of single-purpose stages onto one Hono app
- * served by @teamscala/service-runtime/serve (one Bun.serve in dev and prod).
  */
 
 /**

package/src/ws-boot-self-test.ts

@@ -1,19 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Post-listen WebSocket self-test. Runs after serveStart binds the port.
- * For each declared websocket_routes path, opens a synthetic WebSocket
- * connection and asserts 101 upgrade. Non-101 → BootFatalError.
- *
- * This catches the class of bugs where:
- * - WS route registered after ORPC catch-all (order-dependent 404)
- * - fetchWithPeerPort clones the Request on WS upgrade (breaks Bun.upgrade identity)
- * - websocket_routes config row is stale / missing a handler
- *
- * Runs synchronously after serveStart so the boot aborts before the service
- * reports healthy.
  */
 
 import type { ServiceInstallConfig } from "./load-service-install-row";