@teamscala/service-boot 0.23.523 → 0.23.525

package/src/register-registry-page-route/graph-cache.ts

@@ -1,43 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The two SWR loader-graph caches (static-shell + parameterised routes) for the
- * registry page registrar, plus readCachedGraph — the testable stale-while-
- * revalidate read. Extracted from register-registry-page-route.ts so the SWR
- * decision is unit-testable independent of the Hono/DB/graph machinery.
- *
- * The SWR contract rides @teamscala/cache directly (the hand-rolled `at` timestamp,
- * FRESH_MS window, and graphRefreshInflight single-flight Set are gone): each
- * cache is configured ttlMs = the fresh window (serve, no refresh) + staleTtlMs =
- * the rest (serve stale + fire ONE background refresh). readCachedGraph uses
- * getWithMeta for the fresh/stale/miss decision and cache.refreshInBackground
- * for the fire-and-forget refresh — deduped against the cache's own in-flight map
- * (so delete/clear/disable drop its flights, and a refresh in flight across an
- * invalidation can no longer resurrect the dropped entry).
- *
- * Graphs deep-clone on BOTH set and get at the caller (registerRegistryPageRoute):
- * gateAgreementContent + downstream block resolution MUTATE the object in place,
- * so handing a cached tree out twice would ship request A's resolved data to
- * request B (ssr-first-tick-parity). Clone-on-get stays local to the caller.
- */
-/**
- * Stale-while-revalidate read of a cached loader graph.
- *
- * - Fresh hit (within ttlMs): return the cached graph, no refresh.
- * - Stale hit (within ttlMs + staleTtlMs): return the cached graph AND fire ONE
- *   background refresh via cache.refreshInBackground — single-flight (deduped
- *   against the cache's in-flight map), never rejects, leaves the stale entry in
- *   place on failure. The caller deep-clones the returned value before use.
- * - Miss (past staleTtlMs, or never cached): return undefined — the caller
- *   resolves synchronously and cache.set()s the clone.
- *
- * The refresh callback must return a graph safe to store. To SKIP caching a
- * refresh result (e.g. a primary-missing / dead-link graph that must stay
- * per-request so a just-created record appears immediately), the callback THROWS
- * — refreshInBackground catches it, leaves the stale entry, and logs one line
- * (an observable dead-link signal, not a hard error).
  */
 
 import { createCache } from "@teamscala/cache/create-cache";

package/src/register-registry-page-route/live-loader-config.ts

@@ -1,27 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * live-loader-config.ts — the per-request resource_loader read.
- *
- * The constitution's deploy-time bake list (installer-and-runtime) names
- * service_install, service_manifest, block_schema, page_route, api_route and
- * scheduled_job — resource_loader is NOT among it, so a loader row is runtime
- * data: a registry edit must reach the running service on a subsequent request
- * without a restart. This module is that contract: `readLiveLoaderConfig`
- * re-reads the row through `loadRegistryConfig` on EVERY request (its SWR
- * cache makes the fresh-window hit a memory read, not a DB round trip) and
- * FAILS CLOSED — a row that vanished or stopped validating mid-flight throws
- * into the branded error path rather than silently serving the boot-time
- * snapshot of a row that no longer exists.
- *
- * `fingerprintLoaderConfig` gives the per-request graph cache a key component
- * derived from the LIVE config, so a row edit invalidates cached graphs for
- * that route immediately (the graph cache keys on route+host+path alone would
- * otherwise serve a stale graph until its SWR window lapsed — right cache,
- * wrong key: the graph is a function of the config, so the config belongs in
- * the key).
  */
 
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";

package/src/register-registry-page-route/meta-title.ts

@@ -1,36 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Meta/title helpers for the route registrar: interpolate the route's
- * meta_context against the resolved graph. Extracted from
- * register-registry-page-route.ts.
- *
- * resolveTemplateTitle (the page_meta_template title reader) was DELETED
- * 2026-08-17: it only ever applied when NO resource entity resolved, and on a
- * resource page an entity ALWAYS resolves — the curated template was discarded
- * by construction, dead on exactly the pages the type exists for (Valencia's
- * finding). composePageTitle (+ the org-prefix flag) owns titles end to end.
- */
-/**
- * THE ONE SUBJECT DERIVATION. What a page is ABOUT — the entity whose name the
- * browser tab should carry.
- *
- * This existed as THREE hand-written `||` chains, one per render branch in
- * resolve-page-data, and they had already diverged: two ordered form before
- * proposal, the third ordered proposal first. So which resource named the page
- * depended on which branch happened to render it, silently.
- *
- * The divergence is the cheap half of the cost. The expensive half is that a
- * correction has to be applied three times to work, and applying it twice looks
- * exactly like applying it correctly — measured 2026-08-17, when a fix to the
- * quiz subject was shipped, installed and verified present in the bundle while
- * the page kept its old title, because the branch that rendered it held the
- * second copy.
- *
- * One chain, one precedence, one place to change. Adding a resource type is an
- * edit here rather than a fourth branch in three files.
  */
 
 import { interpolateMeta } from "@teamscala/resolver-engine/loader-config/resolve-from-loader-config";
@@ -43,11 +13,6 @@ export function buildMetaFromContext(
 	return interpolateMeta(metaContext as Record<string, unknown>, resolved);
 }
 
-/**
- * The page's own meta_title row (loaderData.page first, resolved.page second)
- * — used only on /sign-in, where the org's sign-in page title overrides the
- * derived one. Moved from register-registry-page-route.ts.
- */
 export function resolvePageMetaTitle(
 	resolved: Record<string, unknown>,
 ): unknown {

package/src/register-registry-page-route/page-data-shared.ts

@@ -1,27 +1,11 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Shared Puck-page-data helpers for the resolved-graph → pageData conversion:
- * the PuckData alias of the canonical boundary Data, JSON extraction with an
- * honest null on
- * malformed input, layout-default application, region root-prop picking, the
- * RegionEntry shape, and the unresolved-region-slot warn. Plus the brand-token
- * prologue shared by all three render branches.
- *
- * Split out of resolve-page-data.ts (547 lines) — byte-for-byte moves; only
- * closure variables became explicit parameters.
  */
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Data } from "@teamscala/puck-boundary/data";
 
-/**
- * The canonical identity from the generated boundary (the platform's one
- * declaration site for framework shapes) — never a hand-spelled structural
- * duplicate of it.
- */
 export type PuckData = Data;
 
 export const EMPTY_PUCK_DATA: PuckData = { root: { props: {} }, content: [] };
@@ -97,7 +81,6 @@ export function warnUnresolvedRegionSlot(slot: string): void {
 	);
 }
 
-/** The resolved brand tokens every branch reads (the old file's shared prologue). */
 export function readBrandTokens(resolved: Record<string, unknown>): {
 	brand: Record<string, unknown>;
 	primaryColor: string;

package/src/register-registry-page-route/prefetch-org-id.ts

@@ -1,31 +1,8 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Resolves the organisation id for the background AI-chat session prefetch
- * from the request path. A canonical portal URL is /<websiteId>/<orgId>/
- * <path> — the org is segment 1, NOT segment 0. Moved from
- * register-registry-page-route.ts.
  */
 
-/**
- * Prefer segment 1; fall back to segment 0 only when segment 1 is not a
- * UUID (the single-UUID shape, which is live and supported — NOT
- * transitional). The fallback is deliberately kept
- * UNCHANGED-BEHAVIOUR rather than "fixed": a UUID in segment 0 is
- * genuinely ambiguous — of the 40 UUID-first page paths in builda_pages,
- * ZERO are websites and ZERO are organisations, so segment 0 can also be
- * an unrelated record id. Position alone cannot resolve that; only
- * validating the id against organisation_profile can, and that is a DB
- * read this hot prefetch path should not take without caching
- * (`hot-path-resolutions-are-cached`). Preferring segment 1 is strictly
- * better for the canonical shape and no worse for any other. Reading
- * segment 0 first captured the WEBSITE id and passed it as an
- * organisation id, which failed silently because both are well-formed
- * UUIDs: the prefetch simply warmed a session against the wrong tenant
- * (found 2026-07-21).
- */
 
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 

package/src/register-registry-page-route/proposal-approval-email-token.ts

@@ -1,27 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Resolve the `{{approvalEmail}}` token on a proposal page, after pageData is
- * built.
- *
- * Split from proposal-post-processors.ts, which single-purpose-file correctly
- * flagged as two unrelated export groups. This unit is an async ORPC lookup
- * that rewrites button props; its former co-tenants are synchronous brand
- * stamping that touch no network. Sharing a file made an I/O-bound resolver
- * look like a pure formatter.
- */
-/**
- * Resolve the `{{approvalEmail}}` placeholder in a proposal page's button props
- * (e.g. the Approve CTA) in place. Routing: the organisation's registered
- * company email FIRST (organisation_profile.contact_email, already resolved
- * into pageData.brand.contactEmail); the proposal creator's user email only as
- * a fallback when the org has none — so a cloned proposal can never carry a
- * stale hard-coded address. The creator lookup is null-safe and adds no user
- * exposure: it resolves only where the in-process ORPC client exposes `user`
- * (super-admin), degrading to the org email elsewhere. Called only for proposal
- * pages; other registry pages are untouched.
  */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";

package/src/register-registry-page-route/proposal-brand-stamping.ts

@@ -1,32 +1,8 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Stamp partner and client brand assets onto a proposal page's pageData, after
- * it is built.
- * Split from proposal-post-processors.ts (single-purpose-file: two unrelated
- * export groups). Both helpers here are synchronous, take an already-resolved
- * loader-graph org, and only map a logo/colour onto pageData — no network, no
- * ORPC. The approval-email token resolver they used to share a file with is an
- * async ORPC lookup, which is the distinction that was invisible while they sat
- * together.
  */
 
-/**
- * Stash a proposal's connected partner logo/colour on `pageData` from the
- * `partnerOrg` loader source (`crm_organisations` loaded by the proposal's
- * `partner_id`, via the SAME proven ORPC loader path that loads the proposal
- * itself). resolve-page-brand (service-runtime) prefers `pageData.partnerLogo`
- * over any inline body-Hero prop and fans it into the shared `/header` so a
- * `source: "partner"` OrgLogo fills automatically — the partner logo lives on
- * the CRM record, never duplicated per proposal. No partner → partnerOrg is
- * null → nothing set → the partner logo block renders blank. Reading the
- * already-resolved loader value (not a second hand-rolled getServerClient call)
- * is what makes this reliable: the earlier direct `crm_organisations.findFirst`
- * with a Prisma-style object `select` resolved intermittently/never against the
- * generated ORPC, leaving the header partner blank (2026-06-12).
- */
 export function applyPartnerBrand(
 	pageData: Record<string, unknown>,
 	partnerOrg:
@@ -40,12 +16,6 @@ export function applyPartnerBrand(
 		pageData.partnerBrandColor = partnerOrg.brand_primary_color;
 }
 
-/**
- * Auto-resolve the client's company logo from the `clientOrg` loader source
- * (contact_id → company_id → crm_organisations.logo_url). Injects into the
- * Hero block's clientLogo prop when it's empty — no manual logo URL needed
- * per proposal when the contact's company profile has a logo.
- */
 export function applyClientLogo(
 	pageData: Record<string, unknown>,
 	clientOrg:

package/src/register-registry-page-route/public-shell-page-data.ts

@@ -1,13 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Branch 2 of the resolved-graph → pageData conversion: the public shell
- * (header/body/footer regions from header/footer sources).
- *
- * Split out of resolve-page-data.ts (547 lines) — byte-identical body; only
- * the closure variables became explicit parameters.
  */
 
 import { resolveThemeMode } from "../resolve-theme-mode.ts";
@@ -95,12 +88,6 @@ export function publicShellPageData(
 	const overrideHeading = pickRootProp<string>(regions, "headingFont");
 	const overrideBody = pickRootProp<string>(regions, "bodyFont");
 
-	// The page's own screenMode, threaded the same way Branch 1 threads it
-	// (single-page-data.ts). Dropping it here is not neutral: build-page-tree
-	// falls back to `fullScreen: renderMode === "public" || "gpts"`, and for a
-	// shell page that resolves false — which wraps the body in a centred card
-	// and puts the site header INSIDE that card instead of across the top of
-	// the page. A page that declares "full-screen" was rendering as a form.
 	const screenMode = pickRootProp<string>(regions, "screenMode");
 
 	const pageName = (page.name as string) || null;
@@ -115,22 +102,11 @@ export function publicShellPageData(
 	return {
 		puckData: { root: { props: {} }, content: [] } as PuckData,
 		regions,
-		// Region-shell blocks (e.g. the header Navigation deriving the body's
-		// document sections) read the resolved entity graph from
-		// pageData.loaderData — the same surface Branch 1 exposes. Without it a
-		// header/footer block serverLoader gets ctx.loaderData=undefined and
-		// cannot see the body page, so a server-derived nav produced no items
-		// and the menu was client-only (vanished on stale tabs / narrow views).
 		loaderData: resolved,
 		website: {
 			slug: website.slug as string,
 			name: website.name as string,
 			organisation_id: website.organisation_id as string | null,
-			// header_settings carries the DB-driven header config (e.g.
-			// backdropBlur) the public shell applies — PublicTemplate reads
-			// pageData.website.header_settings.backdropBlur. Dropping it here
-			// silently kills the header blur even though the DB switch is set
-			// (the 2026-06-17 regression). Pass it through verbatim.
 			header_settings:
 				(website.header_settings as Record<string, unknown> | null) ?? null,
 		},
@@ -139,10 +115,6 @@ export function publicShellPageData(
 			null,
 		brand: {
 			primaryColor: overrideColor ?? primaryColor,
-			// Thread the org brand's dark surface (brand_background_color /
-			// brand_dark_color) when the page sets no explicit override — so
-			// dark-mode pages use the brand's real dark colour, not a
-			// primary-derived tint. Uses the org brand's real dark colour.
 			backgroundColor:
 				overrideBg ?? (brand.backgroundColor as string | null) ?? null,
 			lightSurface: (brand.lightSurface as string | null) ?? null,
@@ -166,11 +138,6 @@ export function publicShellPageData(
 					pageMetaTitle: bodyMetaTitle,
 					templateTitle: (meta.title as string) || undefined,
 					websiteName: (website.name as string) || undefined,
-					// The FRIENDLY name is what the public sees — the trading brand,
-					// not the legal entity. Reading companyName here put "GMG APAC"
-					// in the title of every launcha page, which the operator has
-					// corrected repeatedly; the friendly name is "launcha". Falls
-					// back to companyName only where no friendly name is set.
 					organisationName:
 						(brand.companyFriendlyName as string) ||
 						(brand.companyName as string) ||

package/src/register-registry-page-route/region-slots-page-data.ts

@@ -1,13 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Branch 1 of the resolved-graph → pageData conversion: arbitrary region-slots
- * (portal/agents/docs) driven by resource_loader.region_slots.
- *
- * Split out of resolve-page-data.ts (547 lines) — byte-identical body; only
- * the closure variables became explicit parameters.
  */
 
 import { resolveThemeMode } from "../resolve-theme-mode.ts";

package/src/register-registry-page-route/resolve-page-data.ts

@@ -1,15 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Converts the resolved loader-graph into the pageData shape the renderer
- * consumes — three branches: arbitrary region-slots (portal/utility), the
- * header/body/footer public shell, and the single-page fallback. Extracted
- * from register-registry-page-route.ts (single-purpose-file split); the three
- * branches + shared helpers were split out of THIS file at 547 lines
- * (region-slots-page-data.ts, public-shell-page-data.ts, single-page-data.ts,
- * page-data-shared.ts).
  */
 
 import { regionSlotsPageData } from "./region-slots-page-data.ts";

package/src/register-registry-page-route/resolve-panel-page.ts

@@ -1,15 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * ?panel=<slug> resolution: reads the panel_view row, follows its
- * content.page_slug to the builda_pages row, and stashes the panel page
- * data + active panel slug on pageData.
- *
- * Split out of register-registry-page-route.ts (924 lines) — the loadData
- * closure segment moved byte-identical; only the closure variables became
- * explicit parameters.
  */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";

package/src/register-registry-page-route/resolve-request-graph.ts

@@ -1,16 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Per-request loader-graph resolution for a registered page route: SWR cache
- * read (static-shell vs param-route cache), clone-on-get, defensive clone
- * with logged fallbacks, primary-resource-missing dead-link 404s, and the
- * content-page floor.
- *
- * Split out of register-registry-page-route.ts (924 lines) — the loadData
- * closure segments moved byte-identical; only the closure variables became
- * explicit parameters.
  */
 
 import type { PageRouteConfig } from "../register-registry-page-route.ts";
@@ -71,8 +61,6 @@ function cloneForCache(
 			`[scala-install:${serviceSlug}] graph-cache structuredClone failed for ${graphKey} — falling back to JSON-clone (non-cloneable value in loader graph): ${err instanceof Error ? err.message : err}`,
 		);
 		try {
-			// JSON-clone preserves the data graph, dropping the functions and
-			// undefined a loader graph should not be carrying anyway.
 			return JSON.parse(JSON.stringify(graph)) as unknown;
 		} catch (err2) {
 			log.warn(
@@ -88,19 +76,7 @@ export async function resolveRequestGraph(
 ): Promise<Record<string, unknown>> {
 	const { pattern, routeSlug, routeConfig, loaderConfig, params, isStaticShell, serviceSlug, configFingerprint } = args;
 
-	// A bare root ("/") that declares a resource_type is a UUID-driven
-	// public site (proposals/forms/quiz) with no resource selected — it
-	// must render the branded holding/not-found page ("no <resource> at
-	// this link"), never fall through the shared public loader to the
-	// marketing site. PrimaryResourceMissingError is the existing signal
-	// the page binder maps to buildResourceNotFoundResponse. A "/" route
-	// WITHOUT a resource_type (e.g. scala-public's marketing root) is
-	// unaffected and still renders its content.
 	if (pattern === "/" && routeConfig.resource_type) {
-		// Status 200: the bare root is a valid "no <resource> selected"
-		// landing, not an error — and kind:ui services must answer GET /
-		// with 200 (verify-prod-persistent-slot). An invalid /:id keeps
-		// the default 404 (genuinely not found).
 		throw new PrimaryResourceMissingError(routeConfig.resource_type, 200);
 	}
 	const graphKey = `graph:${routeSlug}:${params.host}:${params.path}${configFingerprint ? `:${configFingerprint}` : ""}`;
@@ -121,13 +97,6 @@ export async function resolveRequestGraph(
 		>;
 	};
 	let resolved: Record<string, unknown>;
-	// SWR read over @teamscala/cache: fresh hit serves the cached graph, stale
-	// hit serves it AND fires ONE background refresh (refreshInBackground,
-	// single-flight via the cache's in-flight map), miss returns undefined.
-	// The refresh callback re-resolves + stores a clone; a primary-missing
-	// (dead-link) graph THROWS so the cache is not updated — a dead link must
-	// stay per-request so a just-created record appears immediately
-	// (refreshInBackground catches, leaves the stale entry, logs one line).
 	const cachedGraph = readCachedGraph(
 		graphCache,
 		graphKey,
@@ -143,16 +112,6 @@ export async function resolveRequestGraph(
 							`primary resource "${primaryType}" missing — skip cache update for ${graphKey}`,
 						);
 					}
-					// SAME DEFENSIVE CLONE AS THE COLD PATH. This used to call
-					// structuredClone bare, so a non-cloneable value in the loader
-					// graph threw on EVERY background refresh: refreshInBackground
-					// caught it, kept the stale entry, and logged one line — so the
-					// cache could never update, expired at staleTtlMs, and the next
-					// request re-resolved the whole graph in-request. Measured
-					// 2026-09-03 on the live proposal page: "The object can not be
-					// cloned" every ~13 minutes on the same graphKey, indefinitely.
-					// The cold path was hardened for exactly this and the refresh
-					// path was not — one defect, two clone sites, one protected.
 					const refreshed = cloneForCache(freshGraph, graphKey, serviceSlug);
 					if (refreshed === undefined) {
 						throw new Error(
@@ -164,47 +123,21 @@ export async function resolveRequestGraph(
 			),
 	);
 	if (cachedGraph !== undefined) {
-		// Clone-on-get: gateAgreementContent + block resolution MUTATE the
-		// graph in place, so each request gets its own copy.
 		resolved = structuredClone(cachedGraph) as Record<string, unknown>;
 	} else {
 		resolved = await resolveFromLoaderConfig(typedLoaderConfig, params);
 		const primaryMissing =
 			hasPrimarySource && primaryType && resolved[primaryType] == null;
 		if (!primaryMissing) {
-			// Defensive clone: structuredClone throws on non-cloneable loader
-			// graphs (functions/Proxies/Prisma instances). A swallowed throw
-			// here used to SILENTLY disable the graph cache for this key
-			// (fail-open-silent — forbidden by protective-layers-fail-explicitly),
-			// which left affected routes re-resolving the loader graph every
-			// request (measured ~1.2s on the projects utility shell). JSON-clone
-			// preserves the data graph (dropping functions/undefined a loader
-			// graph shouldn't carry) so the cache stays effective; both fallbacks
-			// are LOGGED so the offending non-cloneable source is observable +
-			// fixable, never silently disabling the cache again.
 			const cloned = cloneForCache(resolved, graphKey, serviceSlug);
 			if (cloned !== undefined) {
 				graphCache.set(graphKey, cloned);
 			}
 		}
 	}
-	// A route that declares resource_type is meaningless without that
-	// entity: a dead link (wrong id, deleted row) must 404 with the
-	// branded not-found page — never fall through to default content
-	// (the "Vision Toolbar" leak, operator-observed 2026-06-05).
 	if (hasPrimarySource && primaryType && resolved[primaryType] == null) {
 		throw new PrimaryResourceMissingError(primaryType);
 	}
-	// A CONTENT route (no resource_type) whose loader resolves a `page`
-	// body source must not synthesize an empty page for an unmatched path
-	// and serve a cacheable 200 — the generalized "Vision Toolbar" leak
-	// (operator-reported 5×: a deleted page, e.g. /roadmap, returned 200
-	// with an empty body instead of not-found). No page row → dead link →
-	// branded 404 floor. A page row that exists but has zero blocks → a
-	// content gap → the floor's empty-page surface (200). Both carry the
-	// "Take me home" action. The pure decision lives in content-page-floor.ts
-	// (unit-tested without the Hono/DB/graph machinery). Region-slot
-	// (utility/portal) shells without a `page` source are untouched.
 	const contentFloorError = decideContentPageFloor({
 		hasResourceType: !!primaryType,
 		hasPageContentSource: !!(loaderConfig as { sources?: { key: string }[] }).sources?.some(

package/src/register-registry-page-route/run-content-gates.ts

@@ -1,78 +1,17 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Runs every registered content gate in catalog order (sequential, never
- * parallel — gates depend on prior gates' graph mutations) and applies the
- * page's declared assistant where authorized.
- *
- * Split out of register-registry-page-route.ts (924 lines) — the loadData
- * closure segment moved byte-identical; only the closure variables became
- * explicit parameters.
  */
 
-import type { PageRouteConfig } from "../register-registry-page-route.ts";
 import { runContentGate } from "../content-gate/gate.ts";
-import type { ContentGateOutcome } from "../content-gate/gate.ts";
-import { CONTENT_GATES, withholdsContent } from "../content-gate/catalog.ts";
-import { injectResourceChatLauncher } from "../resource-chat-inject.ts";
+import { CONTENT_GATES } from "../content-gate/catalog.ts";
 
 export async function runContentGatesForPage(
 	resolved: Record<string, unknown>,
 	gateCookie: string | null,
 	gateNow: number,
-	assistant: PageRouteConfig["assistant"],
-	regionSlots: string[] | undefined,
 ): Promise<void> {
-	// EVERY REGISTERED GATE, IN CATALOG ORDER (content-gate/catalog.ts).
-	// This used to name proposalGateConfig, agreementGateConfig and
-	// gptGateConfig by hand, so a fourth gated resource type meant editing
-	// this file AND the second hand-written list in two-phase-boot.ts.
-	//
-	// SEQUENTIAL, NEVER PARALLEL. An authorized proposal viewer has their
-	// gate block removed from the resolved graph, and that removal is what
-	// makes the agreement gate find no resource and no-op on a page that
-	// carries both. Awaiting these together would race that dependency.
-	const gateOutcomes: ContentGateOutcome[] = [];
 	for (const entry of CONTENT_GATES) {
-		const outcome = await runContentGate(
-			resolved,
-			gateCookie,
-			gateNow,
-			entry.gate,
-		);
-		// A seed-only gate (open capture — the public GPT identity gate)
-		// withholds nothing, so its verdict is not evidence about whether
-		// this viewer may see the page and must not reach the assistant
-		// decision below. See withholdsContent, which derives that from the
-		// access config rather than restating it here.
-		if (withholdsContent(entry)) gateOutcomes.push(outcome);
-	}
-
-	// THE ASSISTANT IS A ROW, AND THIS IS THE ONE PLACE IT IS APPLIED. It used to be a call inside each gate's onAuthorized plus an entry
-	// in the hardcoded gate sequence above, so a third resource type meant editing this file. Now any page declaring `assistant` gets
-	// one and no page without the key does.
-	//
-	// GATED PAGES ONLY WHEN AUTHORIZED. The launcher's runtime context is
-	// the whole document serialised, so injecting past a closed gate
-	// would hand withheld bytes to the chat. A page no gate governs is
-	// public and gets the assistant unconditionally -- that is a
-	// different state from an unauthorized viewer, which is why the gate
-	// reports `applies` separately from `authorized`.
-	if (assistant) {
-		const governing = gateOutcomes.filter((outcome) => outcome.applies);
-		const authorized = governing.find((outcome) => outcome.authorized);
-		if (governing.length === 0 || authorized) {
-			await injectResourceChatLauncher(resolved, authorized?.email ?? "", {
-				resourceKey: assistant.resource_key,
-				agentConfigSlug: assistant.agent_config_slug as never,
-				launchLabel: assistant.launch_label,
-				placeholder: assistant.placeholder,
-				// From the loader row, so the injector never has to guess
-				// which resolved keys hold rendered content.
-				regionSlots,
-			});
-		}
+		await runContentGate(resolved, gateCookie, gateNow, entry.gate);
 	}
 }

package/src/register-registry-page-route/single-page-data.ts

@@ -1,14 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Branch 3 of the resolved-graph → pageData conversion: the single-page
- * fallback (form/quiz/proposal/gpt pages with no region slots and no
- * header/footer sources).
- *
- * Split out of resolve-page-data.ts (547 lines) — byte-identical body; only
- * the closure variables became explicit parameters.
  */
 
 import { resolveThemeMode } from "../resolve-theme-mode.ts";

package/src/register-registry-page-route/stamp-session-context.ts

@@ -1,15 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Stamps the resolved-in-progress loader graph with the request's session
- * identity: sessionVisitor, portalContext (user/orgId/pane widths from the
- * portal cookie and the user's saved preferences). Anonymous when no session.
- *
- * Split out of register-registry-page-route.ts (924 lines) — the loadData
- * closure segment moved byte-identical; only the closure variables became
- * explicit parameters.
  */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";