@teamscala/service-boot 0.23.523 → 0.23.525

package/src/proposal-authorized-emails.ts

@@ -1,38 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Resolves the set of emails authorized to view a proposal. A proposal is
- * gated (proposal-access) — only these emails can unlock it:
- *
- *   - the issuing-org team: every member of the proposal's organisation
- *     (better_auth_member → user.email). Lets the agency team open any of their
- *     own proposals AND covers existing proposals whose created_by is
- *     "system"/null.
- *   - the recipient: the proposal's CRM contact (client_database.primary_email),
- *     when contact_id is set.
- *   - the partner team: every CRM contact belonging to the proposal's partner
- *     org (client_database.company_id = proposals.partner_id → primary_email),
- *     when partner_id is set. Lets the co-delivery partner's team open a
- *     co-branded proposal. The partner is still branding-first; this is the one
- *     access edge it carries.
- *
- * The partner clause casts to ::uuid because the two sides disagree in the
- * database: client_database.company_id is `uuid` while proposals.partner_id is
- * `text`. Postgres resolves operators at PLAN time, so `uuid = text` raises
- * "operator does not exist" for EVERY proposal — including ones with no partner
- * — the catch below swallows it, and the fail-closed empty Set then denies
- * access to everyone. Measured 2026-09-10: no proposal could be unlocked by any
- * email. The cast is correct once partner_id becomes `uuid` too (a no-op then);
- * the column type is the real fix and is tracked separately.
- *
- * Uses $queryRaw (raw SQL) deliberately: the per-service Prisma client is scoped
- * to that service's own models, so the proposals service's client has no
- * `member`/`user` model methods — but $queryRaw runs against the shared DB
- * regardless of the client's model scope. Returns a lowercased Set, checked
- * server-side only (emails never sent to the client). Fail-closed: any error
- * yields an empty set (no access).
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/proposal-gate.ts

@@ -1,33 +1,16 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The PROPOSAL content gate, expressed as config for the content-gate primitive
- * (content-gate/). No bespoke gate plumbing — just the proposal-specific bits:
- * which resource (resolved.proposal.id), who's authorized (issuing-org team +
- * recipient), what to seed (initialVisitor for the chat), and how to withhold
- * (replace the proposal body with an injected SignIn gate block + neutralize the
- * meta tags). The engine handles cookie/token/verify/orchestration.
- *
- * Universal: every proposal route exposes resolved.proposal, so this gates every
- * proposal (existing + new) with no per-page block or migration.
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
-import { signAccessToken, verifyAccessToken } from "./content-gate/token.ts";
+import { signAccessToken, verifyAccessToken } from "@teamscala/agreement-generation/content-gate-token";
 import { resolveProposalAuthorizedEmails } from "./proposal-authorized-emails.ts";
 import { propTtlMs } from "./gate-ttls.ts";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 
-/**
- * Proposal gate display + behaviour, DB-driven (config/content-gate-proposal),
- * never hardcoded. requireOtp is the per-gate OTP switch (proposals default
- * off — email-only; agreements opt in). A missing/invalid row falls back to the
- * proposal-appropriate defaults so the gate UI ALWAYS renders.
- */
 interface ProposalGateSettings {
 	title: string;
 	subtitle: string;
@@ -89,8 +72,6 @@ function buildGateBlock(
 			gateContextField: "proposalId",
 			gateContextValue: proposalId,
 			gateAction: "/api/proposal-access",
-			// Display + behaviour are DB-driven (config/content-gate-proposal),
-			// not hardcoded. requireOtp is the per-gate OTP switch.
 			title: settings.title,
 			subtitle: settings.subtitle,
 			gateRequireOtp: settings.requireOtp,
@@ -111,26 +92,14 @@ export const proposalGateConfig: ContentGateConfig = {
 		const email = verifyAccessToken(token, PROP_COOKIE, resourceId, nowMs);
 		return email ? { email } : null;
 	},
-	// Baked-in unified auth (engine default): a logged-in viewer whose session
-	// email is in this set (issuing-org team ∪ recipient ∪ partner) is released
-	// with no email/OTP entry. Just exposing the resolver opts this gate into the
-	// platform-wide behaviour — no per-gate session code.
 	resolveAuthorizedEmails: resolveProposalAuthorizedEmails,
 	async onAuthorized(resolved, _resourceId, { email }) {
-		// Seed the verified viewer identity (building-applications initialVisitor).
 		(resolved as { initialVisitor?: { email: string } }).initialVisitor = {
 			email,
 		};
-		// THE ASSISTANT IS NO LONGER INJECTED HERE. It is declared on the
-		// page_route row (`assistant`) and applied once, centrally, after every
-		// gate has run — so the bubble is a setting rather than a line of code
-		// inside one resource type's gate. This call was the reason a third
-		// resource type could not have an assistant without editing service-boot.
 	},
 	async onUnauthorized(resolved, resourceId) {
 		const settings = await loadProposalGateSettings();
-		// Replace the proposal BODY with the gate block — no proposal content
-		// reaches the HTML. Header/footer chrome stays branded.
 		const page = resolved.page as
 			| (PuckHolder & {
 					meta_title?: unknown;
@@ -144,18 +113,11 @@ export const proposalGateConfig: ContentGateConfig = {
 				buildGateBlock(resourceId, brandPrimaryColor(resolved), settings),
 			];
 		}
-		// Neutralize the PAGE record's meta too: page.meta_title/meta_description
-		// feed pageData.meta → the <title>/og tags AND the __PAGE_DATA__ hydration
-		// JSON. Without this the proposal topic + partner name leak via meta even
-		// though the body is withheld (the 2026-06-13 meta-leak: a gated proposal
-		// still exposed "Webinar Campaign · in partnership with <partner>").
 		if (page) {
 			page.meta_title = "Private proposal";
 			page.meta_description = "";
 			page.name = "Private proposal";
 		}
-		// Neutralize the proposal record so the meta_context resolver + any block
-		// reading it can't leak name/partner/cover/recipient.
 		const prop = resolved.proposal as Record<string, unknown> | undefined;
 		if (prop) {
 			prop.name = "Private proposal";
@@ -164,13 +126,6 @@ export const proposalGateConfig: ContentGateConfig = {
 			prop.prepared_for = "";
 			prop.cover_image_url = "";
 		}
-		// Neutralize the resolved headerData too: it carries the recipient's
-		// name (row1Value = prepared_for) and title, resolved during the loader
-		// phase BEFORE this gate ran — without this, __PAGE_DATA__ ships the
-		// recipient name to every unauthorised visitor while the body is
-		// withheld. Labels stay (generic words); values go. Measured 2026-09-03:
-		// the gate floor's hydration payload carried the recipient name to
-		// anonymous visitors on the exact page this outage was about.
 		const headerData = resolved.headerData as Record<string, unknown> | undefined;
 		if (headerData) {
 			headerData.title = "";
@@ -178,12 +133,6 @@ export const proposalGateConfig: ContentGateConfig = {
 			headerData.row2Value = "";
 			headerData.row3Value = "";
 		}
-		// Neutralize the CRM contact record too. The v8 adapter ignores select
-		// (the full record returns), so without this the gate floor's hydration
-		// payload ships the recipient's whole contact row — first/last/full
-		// name, emails, phones, CRM ids — to every unauthorised visitor. The
-		// company fields stay: the header's Organisation row shows the company,
-		// which is brand chrome, not recipient identity.
 		const contact = resolved.contact as Record<string, unknown> | undefined;
 		if (contact) {
 			const keep = new Set(["id", "company_id", "company_name", "company_website"]);

package/src/quiz-gate.ts

@@ -1,46 +1,16 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The PUBLIC QUIZ identity gate, expressed as config for the content-gate
- * primitive. Like the GPT gate this is lead capture, not access control: every
- * email is a valid visitor. Its job is to make the visitor KNOWN AT SSR so the
- * page's identity blocks hide themselves and the quiz blocks reveal themselves
- * — by block condition on `initialVisitor`, never by a component deciding which
- * screen to render.
- *
- * That is the whole point of this file existing. The quiz identity form used to
- * be a composite React component that hand-assembled a logo, a heading, three
- * inputs and a button, and then branched in TypeScript on whether a visitor was
- * known. Every one of those pieces is already a Puck block, and the branch is
- * already expressible as a block condition — what was missing was only the
- * server half: something to turn a submitted email into a visitor the next
- * render can see. This is that half, and it is 60 lines of config because the
- * engine (content-gate/gate.ts + access.ts) already does the work.
- *
- * Flow: the composed form POSTs {quizId, name, email, phone} to
- * /api/quiz-access (openCapture → any email matches); the access endpoint signs
- * a `quiz_token` cookie and redirects back. On the next request runContentGate
- * verifies it for this assessment and seeds resolved.initialVisitor.
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
-import { signAccessToken, verifyAccessTokenIdentity } from "./content-gate/token.ts";
+import { signAccessToken, verifyAccessTokenIdentity } from "@teamscala/agreement-generation/content-gate-token";
 import { quizTtlMs } from "./gate-ttls.ts";
 
 const QUIZ_COOKIE = "quiz_token";
-/**
- * The ENTRY MARKER: proves this request is the redirect the identity submit
- * produced, not a later load. Operator ruling 2026-09-14: a refresh must return
- * to the identity gate — the visitor starts at Name/Email on every fresh load,
- * and only the submit's own redirect releases the quiz. The marker is set by
- * the access endpoint with the token and cleared by the render it authorized.
- */
 const QUIZ_ENTRY_COOKIE = "quiz_token_entered";
 const QUIZ_ACCESS_PATH = "/api/quiz-access";
 
-/** The assessment this page is for, from the quiz-with-brand loader's graph. */
 function quizId(resolved: Record<string, unknown>): string {
 	const quiz = resolved.quiz as { id?: unknown } | null | undefined;
 	return typeof quiz?.id === "string" ? quiz.id : "";

package/src/read-html-template.ts

@@ -1,54 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Builds the shared React/Puck document envelope and substitutes the current
- * content-hashed asset URLs from `dist/client/asset-manifest.json`.
- *
- * The envelope is runtime-owned. UI services are Puck compositions and must
- * not carry or generate a per-service `src/index.html`; requiring that file
- * creates a second rendering surface that can disappear independently of the
- * Hono + React/Puck runtime.
- *
- * Build-time produces hashed filenames (e.g. `styles-abc123.css`); the
- * static-asset handler serves them with `cache-control: immutable`. New
- * deployments emit new hashes → new URLs → browsers refetch without ever
- * holding a stale copy. Without the substitution, a fixed
- * `/assets/styles.css` paired with `immutable` would pin every visitor to
- * whatever version they first downloaded.
- *
- * Cached per service process, keyed on the manifest's mtime. The cache MUST
- * invalidate when `asset-manifest.json` changes: `buildClientAssets` can
- * rebuild the bundle AFTER the first request — producing a new content hash,
- * rewriting the manifest, AND deleting the old hashed bundle
- * (`removeStaleHashedFiles`). A lifetime-pinned HTML cache then keeps serving
- * the OLD hash, which now 404s → hydration never runs → the page renders SSR
- * HTML but is dead client-side (the doc-editor overlay never mounts; scala-docs
- * 2026-06-13, exposed by the ui-foundation publish-storm's repeated rebuilds).
- * Re-stat'ing the tiny manifest per request is negligible (OS-cached, no
- * network); the substituted HTML is reused while the mtime is unchanged.
- *
- * NO SERVED HTML WITHOUT A VERIFIED MANIFEST: when the manifest is absent,
- * unreadable, or names files that do not exist, this module THROWS rather
- * than emitting HTML — the fixed-name fallback (`/assets/styles.css`,
- * `/assets/hydrate.js`) it once served names files NOTHING builds, so a
- * 200 page with those URLs was a stylesheet 404 wearing a working page's
- * clothes. Measured 2026-09-01: proposals.scala.business served a
- * client-facing proposal unstyled while Railway reported the deploy
- * SUCCESS. The readiness flip now gates on `verifyClientBuildAssets`
- * (build-client-assets/manifest.ts), so this throw is defence in depth for
- * a manifest that vanishes mid-process; the page-server render catch turns
- * it into the branded error page, never a 200 with dead URLs.
- *
- * NO-SILENT-REVERTS: when the manifest is a TOMBSTONE (the last client build
- * failed), the served HTML is stamped with a `<meta name="x-client-build-status"
- * content="failed">` tag in <head> so any operator / chrome-devtools / theme
- * probe inspecting the page can see the served bundle is STALE (a published fix
- * that reached node_modules but failed to bundle is silently served from the
- * prior bundle otherwise — scala-agents 2026-07-18, the white-on-white toolbar
- * regression that looked "not fixed" while the bundle kept serving pre-fix
- * bytes across restarts).
  */
 
 import { createCache } from "@teamscala/cache/create-cache";

package/src/readiness-gate.ts

@@ -1,14 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Readiness gate — returns 503 + Retry-After: 1 until the boot pipeline
- * flips the ready flag true as its last step. Registered as the FIRST
- * middleware in both UI and backend boot paths per readiness-gated-boot.
- *
- * The gate fails open: if it ever throws, the request passes through to
- * the normal handler rather than producing a hard 500.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/register-api-routes.ts

@@ -1,16 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Walks `service_install.api_routes[]` and binds each entry to its
- * registered handler (via mountRegistry.handlers, populated by server_packages
- * during their mount phase). Unresolved handler_slug values are fatal — the
- * service cannot boot with declared routes pointing at nothing.
- *
- * Injects x-remote-port header from Bun's getConnInfo so downstream
- * handlers (MCP route) can resolve caller identity via process-tree
- * walking when explicit caller headers are absent.
  */
 
 import type { ServiceInstallConfig } from "./load-service-install-row";

package/src/register-crash-handlers.ts

@@ -1,11 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Registers process-level crash handlers (unhandledRejection, uncaughtException)
- * for a given service. Each handler logs the error with the service slug for
- * identification. Per constitution crash-isolation.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/register-page-routes.ts

@@ -1,17 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit directly
- *
- * Page route registration — reads `page_route` registry rows for the
- * current service and delegates to `registerRegistryPageRoute`.
- *
- * All routes are registry-driven (Phase 1): each `page_route` row pairs
- * a URL pattern with a `resource_loader` graph that resolves data in
- * wave-parallel via `resolveFromLoaderConfig`. No deploy-time shell
- * variant routes — the old `service_install.page_routes[]` Phase 2 path
- * was removed when every active service migrated to registry-driven
- * `page_route` rows (all 9 services carry empty arrays).
  */
 
 import { BootFatalError } from "@teamscala/os/errors/boot-error";

package/src/register-page-server-client.ts

@@ -1,31 +1,8 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Registers the system server-client for page-server SSR rendering. Composes
- * the platform-owned routers into the service's generated `appRouter` and
- * stashes the resulting client via setServerClient. Called once at boot before
- * any page route handler fires.
- *
- * Handwritten because no machine-readable contract generates it: this is the
- * EXECUTOR half of a rows+executor pair (`business-logic-is-rows-plus-executors`),
- * whose declared half is the `service_install`/`service_schema` rows read at
- * boot. There is no supplier spec, CLI or registry row that could emit this
- * boot-time wiring, so it stays hand-written; the row half remains the source.
  */
 
-		// REFUSE, DO NOT SKIP. `existsSync(routerPath)` being false used to fall straight through with appRouter=null and still register a client + log
-		// success. That client carries only the three platform routers below and NO CRUD models, which is indistinguishable from a healthy one until a
-		// page asks it for a model — at which point resolve-from-loader-config throws MissingLoaderModelCapabilityError, far from the actual fault.
-		//
-		// Measured 2026-08-20: scala-quiz and scala-forms served 500s on every data-backed page while /health returned 200 and this line logged "ORPC
-		// serverClient registered". The build had produced no generated router (its railpack.json ran registry codegen against an unreachable
-		// *.railway.internal host), and nothing anywhere said so.
-		//
-		// A service whose service_schema DECLARES models and has no generated router is not degraded, it is non-functional — so this fails the boot
-		// rather than reporting a state it has not verified (`a-component-may-not-report-a-state-it-has-not-verified`). A service
-		// that declares no models (daemon/portal shells owning no DB schema) still passes through cleanly.
 
 import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -43,16 +20,6 @@ export async function registerPageServerClient(
 		};
 		const { createRouterClient } = await import("@orpc/server");
 		const { getPrisma } = await import("@teamscala/db/prisma-registry");
-		// Load the composed CRUD router via getAppRouter() — the SAME registered
-		// instance the /api/rpc mount uses (mount-orpc-router.ts). The previous code
-		// did a raw second `import(cwd + "prisma/generated/orpc/routers/index.ts")`,
-		// re-loading the generated routers under a different module specifier than
-		// the mount already used; in the full boot process that re-execution throws,
-		// and the throw was swallowed by a SILENT catch — leaving the page-server
-		// client without the CRUD models, so every data-backed page 500s
-		// ("client.<model> is undefined", the scala-sign prod outage). existsSync
-		// gates the legitimate no-router case (daemon/portal services that own no DB
-		// schema) so it stays a clean skip, never a misleading warn.
 		const { existsSync } = await import("node:fs");
 		const routerPath = join(
 			process.cwd(),
@@ -64,8 +31,6 @@ export async function registerPageServerClient(
 				const { getAppRouter } = await import("@teamscala/orpc/app-router");
 				appRouter = ((await getAppRouter()) as Record<string, unknown>) ?? null;
 			} catch (err) {
-				// A genuine load failure here means every data-backed page 500s, so it
-				// must surface, never be swallowed (protective-layers-fail-explicitly).
 				log.warn(
 					`[scala-install:${serviceSlug}] appRouter load failed — data-backed pages will 500: ${err instanceof Error ? `${err.message}\n${err.stack ?? ""}` : String(err)}`,
 				);
@@ -73,28 +38,6 @@ export async function registerPageServerClient(
 		}
 		const declaredModels = await (async (): Promise<string[]> => {
 			const capSlug = toCapabilitySlug(serviceSlug);
-			// LOOK IT UP BY CAPABILITY, NOT BY DEPLOYABLE NAME. A service_schema
-			// row describes the APPLICATION's data surface, so there is ONE row
-			// for both lanes; the dev lane arrives here as
-			// `scala-projects-bun-dev`. Both sides normalize through
-			// toCapabilitySlug, so the join is tier-agnostic by construction.
-			// See ./capability-slug.ts.
-			//
-			// READ WITH THE REAL SCHEMA, NOT `undefined`. The previous call passed
-			// `undefined as never`, so v.parse(undefined, raw) threw a TypeError
-			// (schema is not a schema) on EVERY service, the bare catch below turned
-			// that into "declares nothing", and the refusal at the bottom NEVER
-			// fired — a service declaring 18 models booted "0 declared model(s)"
-			// and served 500s. (measured scala-sign 2026-09-24/25: row declares 18,
-			// boot logged 0.) loadOptionalRegistryConfig parses against
-			// ServiceSchemaConfigSchema and returns null ONLY for a missing row.
-			//
-			// A MISSING ROW is legitimately "declares nothing" (daemon/portal
-			// shells own no DB models) and passes through clean. A READ FAILURE is
-			// NOT "declares nothing" — it fails the boot naming the error, so the
-			// database can never quietly become "no models" and let a router-less,
-			// data-backed service boot and serve 500s
-			// (`a-component-may-not-report-a-state-it-has-not-verified`).
 			const { loadOptionalRegistryConfig } = await import(
 				"@teamscala/db/registry/load-config"
 			);
@@ -145,8 +88,6 @@ export async function registerPageServerClient(
 		const { PlatformIdentitySchema } = await import(
 			"@teamscala/db-validation/registry-schemas/platform-identity"
 		);
-		// Platform org id is a registry value (registries-are-source-of-truth),
-		// not a hardcoded literal — read from config/platform-identity.
 		const platformIdentity = await loadRegistryConfig(
 			"config",
 			"platform-identity",
@@ -166,19 +107,13 @@ export async function registerPageServerClient(
 			} as never,
 		);
 		mod.setServerClient(client);
-		// Record declared-vs-present capability for /health. Property lookups only.
 		(mod as unknown as { recordServerClientCapability?: (m: readonly string[]) => void })
 			.recordServerClientCapability?.(declaredModels);
-		// State the model count. "registered" alone was true in the outage and told
-		// nobody anything; a zero here is now visible in the boot log.
 		log.info(
 			`[scala-install:${serviceSlug}] ORPC serverClient registered (system:super-admin) — ` +
 				`${Object.keys(composed).length} router(s), ${declaredModels.length} declared model(s)`,
 		);
 	} catch (err) {
-		// RETHROW. Swallowing this into a warn is what let a service boot, pass its
-		// healthcheck and serve 500s on every page. The boot must fail so the
-		// supervisor and the deploy healthcheck can see it.
 		log.error(
 			`[scala-install:${serviceSlug}] serverClient registration FAILED — data-backed pages cannot render: ${err instanceof Error ? `${err.message}\n${err.stack ?? ""}` : String(err)}`,
 		);

package/src/register-registry-page-route/ai-chat-prefetch.ts

@@ -1,33 +1,10 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * SSR-prefetch the signed-in user's AI-chat conversation so a click-opened AI
- * panel renders the real conversation on first paint. Extracted from
- * register-registry-page-route.ts (single-purpose-file split).
- */
-/**
- * SSR-prefetch the signed-in user's AI-chat conversation so a CLICK-opened AI
- * panel renders the real conversation on first paint — never a loading gate
- * (ssr-then-live-handoff). The AiChat block lives on the /ai PANEL page, which
- * isn't rendered when the panel is closed, so its block serverLoader can't run
- * at page-load; this prefetches server-side (regardless of panel open-state) +
- * stamps pageData.aiChatSession, which AiChat reads on mount. The agent is
- * resolved from the /ai panel page's own AiChat block (single source of truth —
- * no duplicate config to drift). Fired in parallel with the post-processors +
- * bounded by their window; a failure degrades silently to the client-side
- * createOrRestore fallback, never an error page.
  */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";
 
-/**
- * Deep-find the serving `website_id` in the loader graph (resolved). The
- * Utility/Portal shell carries the website id (not a slug) under a loader
- * source key; the client RegionPageSwap reads it from loaderData.*.website_id
- * the same way. Bounded walk (cycle-safe) over the resolved loader results.
- */
 function findWebsiteId(root: unknown): string | undefined {
 	if (!root || typeof root !== "object") return undefined;
 	const seen = new Set<unknown>();

package/src/register-registry-page-route/apply-page-branding.ts

@@ -1,75 +1,10 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The three brand-override paths of a registered page route: the /sign-in
- * callback-org override, the signed-in session-org personalisation
- * (platform pages only), and the brand_org_path resource-owner override.
- *
- * Split out of register-registry-page-route.ts (924 lines) — the loadData
- * closure segments moved byte-identical; only the closure variables became
- * explicit parameters.
  */
 
-/**
- * /sign-in brand override: a shared org-scoped link 302→/sign-in for the
- * unauthed crawler (WhatsApp), which saw the service's default website
- * brand (the platform owner). The callbackURL carries the destination org
- * — override resolved.brand (before the title/meta/og are built from it)
- * so the page reflects the org the visitor is signing in to. Scoped to
- * /sign-in; resource pages keep their own brand.
- *
- * The org is segment 1 of the canonical portal shape /<websiteId>/<orgId>/
- * <path>, NOT segment 0 (the website id): reading segment 0 fed a website id
- * into fetchOrganisationPageBranding, which resolved no org and left the
- * default (super-admin) brand — the cross-tenant mis-branding this override
- * exists to prevent (portal-branding-resolves-page-org-first, 2026-07-21).
- * Shared helper so this and bind-page-handler cannot drift on the answer.
- */
 
-/**
- * brand-is-org-owned-full-scheme, reconciled with page-org-first
- * (portal-branding-resolves-page-org-first): the session override now
- * personalizes ONLY platform pages (page org === website owning-org).
- * Tenant pages keep their resolved page-org brand — the page is
- * authoritative, the menu switcher changes which tenant's pages you
- * view. Anonymous/public (no session) keeps the resolved brand. Same
- * fetchOrganisationPageBranding pattern as the /sign-in brand override.
- *
- * A PUBLIC PAGE IS NEVER PERSONALISED TO THE READER'S ORG. Personalising
- * the brand is right for a portal — you are looking at your own
- * workspace. It is wrong for a public document, which belongs to the org
- * that PUBLISHED it and must look identical to every reader.
- *
- * Measured 2026-08-17: the Launcha Authority Blueprint, owned by GMG
- * APAC, rendered correctly for an anonymous customer and in GBG Indo's
- * navy with the scala logo for any signed-in staff member — so the two
- * people checking it before it went to clients were the only two who
- * could not see what a client sees. Silent, and inverted: the reviewers
- * got the wrong page.
- */
 
-/**
- * BRAND FROM THE ORG THAT OWNS THE RESOURCE, not the website's owner.
- * A public resource page (an assessment report, a shared document) is
- * hosted on a shared website but BELONGS to a tenant. resolvePageBrand
- * reads pageData.orgId, which is the WEBSITE's org, so every tenant's
- * report rendered the host org's logo and palette.
- *
- * Measured 2026-08-17: the Launcha Authority Blueprint is owned by GMG
- * APAC (#FF4500, launcha logo) and rendered with GBG Indo's navy and
- * scala mark, because both pages live on the shared "Public Pages"
- * site. The loader had already resolved the right org — nothing
- * consumed it.
- *
- * `brand_org_path` names where the owning org id lives in the resolved
- * loader data (e.g. "quiz.organisation_id"), so which resource owns the
- * brand is a ROW, never a per-service branch
- * (`business-logic-is-rows-plus-executors`). Absent or unresolvable,
- * the website's org stands — this can only ever narrow the brand to a
- * more specific owner, never blank it.
- */
 
 import { fetchOrganisationPageBranding } from "@teamscala/db/fetch-organisation-page-branding";
 import { getPlatformOrgId } from "@teamscala/db/registry/platform";
@@ -86,9 +21,6 @@ function spreadBranding(
 	return {
 		...existing,
 		companyName: branding.company_name,
-		// Friendly name is the customer-facing one; falling back to the
-		// legal entity fed "GMG APAC" to every consumer that correctly
-		// read companyFriendlyName (e.g. logoAlt in the Puck host codegen).
 		companyFriendlyName:
 			branding.company_friendly_name ?? branding.company_name,
 		primaryColor: branding.brand_primary_color ?? existing?.primaryColor,
@@ -126,7 +58,6 @@ export async function applySignInBrandOverride(
 			}
 		}
 	} catch {
-		// Branding fetch failed — keep the default brand (no regression).
 	}
 }
 
@@ -140,31 +71,9 @@ export async function applySessionOrgBranding(
 		renderMode !== "public" &&
 		sessionOrgId &&
 		sessionOrgId !== (pageData.orgId as string | undefined) &&
-		// Page-org-first (portal-branding-resolves-page-org-first): the
-		// session override personalizes ONLY the shared PLATFORM website
-		// (super-admin org). A TENANT-owned site (a customer GPT/quiz/portal)
-		// keeps its page-org brand regardless of the viewer session org. The
-		// old pageData.orgId===website.org mis-fired for a tenant whose page org equals their own website org.
 		platformOrgId ===
 			((pageData.website as { organisation_id?: string | null } | undefined)
 				?.organisation_id ?? undefined) &&
-		// ...AND the PAGE itself must be platform-owned. A platform-owned
-		// WEBSITE also hosts tenant DOCUMENTS — an agreement, a proposal, a
-		// signed contract — and those belong to the org that published them.
-		// Testing only the website let the viewer's own org repaint a tenant
-		// document, which is the same defect this rule already fixed once at
-		// the website level (2026-08-17, the Launcha Authority Blueprint).
-		//
-		// It recurred on sign.scala.business, whose website IS owned by the
-		// platform org (c503629a), so the website test passed and every
-		// signed-in staff viewer saw a GMG APAC agreement painted in their own
-		// org's brand — while an anonymous client saw it correctly. That is
-		// the worst possible shape: the only people who cannot see what the
-		// client sees are the people reviewing it before it is sent.
-		//
-		// A public document belongs to the org that PUBLISHED it and must look
-		// identical to every reader, so a page whose org is not the platform's
-		// is never personalised.
 		platformOrgId === (pageData.orgId as string | undefined)
 	) {
 		try {
@@ -178,7 +87,6 @@ export async function applySessionOrgBranding(
 				pageData.brand = spreadBranding(existing, branding);
 			}
 		} catch {
-			// Branding fetch failed — keep the default brand (no regression).
 		}
 	}
 }
@@ -202,12 +110,6 @@ export async function applyBrandOrgPath(
 		}
 		if (typeof cursor === "string" && cursor.length > 0) {
 			pageData.orgId = cursor;
-			// orgId alone is not enough. resolvePageBrand fills only the
-			// accent/secondary/muted gaps from the org; primaryColor, logo and
-			// companyName come from pageData.brand, which was built from the
-			// website's org. Replace those too, the same way the session
-			// override above does, or the page keeps the host's logo while
-			// claiming the tenant's org.
 			try {
 				const owner = await fetchOrganisationPageBranding(
 					getServerClient() as never,
@@ -218,7 +120,6 @@ export async function applyBrandOrgPath(
 					pageData.brand = spreadBranding(existing, owner);
 				}
 			} catch {
-				// Branding fetch failed — keep the website brand (no regression).
 			}
 		} else {
 			log.warn(

package/src/register-registry-page-route/captured-loader-config.ts

@@ -1,19 +1,8 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Summarises the resource_loader config a route captured at boot, for the
- * route-registration log line. Registration reads the loader row ONCE into
- * the route closure, so an edit to the row silently does not reach the
- * running service (measured 2026-08-18: a footer region added to a report
- * produced no footer and no diagnostic until a cold wake). Naming the
- * captured shape in the boot log makes the row-vs-running-service gap a
- * one-glance check in the service logs, and the restart contract is stated
- * where the operator will be looking when the edit "doesn't work".
  */
 
-/** Structural slice of the ResourceLoaderConfigSchema output this unit reads. */
 interface LoaderConfigSlice {
 	sources?: { key: string }[];
 	region_slots?: string[];