@teamscala/service-boot 0.23.524 → 0.23.525

package/package.json

@@ -118,8 +118,6 @@
     "./content-gate/gate-entry-clears.ts": "./src/content-gate/gate-entry-clears.ts",
     "./content-gate/parse-cookie": "./src/content-gate/parse-cookie.ts",
     "./content-gate/parse-cookie.ts": "./src/content-gate/parse-cookie.ts",
-    "./content-gate/token": "./src/content-gate/token.ts",
-    "./content-gate/token.ts": "./src/content-gate/token.ts",
     "./content-page-floor": "./src/content-page-floor.ts",
     "./content-page-floor.ts": "./src/content-page-floor.ts",
     "./csrf-protection": "./src/csrf-protection.ts",
@@ -138,8 +136,6 @@
     "./install-harness.ts": "./src/install-harness.ts",
     "./install-logging": "./src/install-logging.ts",
     "./install-logging.ts": "./src/install-logging.ts",
-    "./is-react-element-type": "./src/is-react-element-type.ts",
-    "./is-react-element-type.ts": "./src/is-react-element-type.ts",
     "./load-page-manifest": "./src/load-page-manifest.ts",
     "./load-page-manifest.ts": "./src/load-page-manifest.ts",
     "./load-service-install-row": "./src/load-service-install-row.ts",
@@ -162,8 +158,6 @@
     "./page-route-shell-types.ts": "./src/page-route-shell-types.ts",
     "./page-server-loader-graph": "./src/page-server-loader-graph.ts",
     "./page-server-loader-graph.ts": "./src/page-server-loader-graph.ts",
-    "./page-server-orpc/hub-mcp-client": "./src/page-server-orpc/hub-mcp-client.ts",
-    "./page-server-orpc/hub-mcp-client.ts": "./src/page-server-orpc/hub-mcp-client.ts",
     "./page-server-orpc/server-client": "./src/page-server-orpc/server-client.ts",
     "./page-server-orpc/server-client.ts": "./src/page-server-orpc/server-client.ts",
     "./pg-boss-handler-registry": "./src/pg-boss-handler-registry.ts",
@@ -246,8 +240,6 @@
     "./resolvers/portal-route-paths.ts": "./src/resolvers/portal-route-paths.ts",
     "./resolvers/website-by-host-map": "./src/resolvers/website-by-host-map.ts",
     "./resolvers/website-by-host-map.ts": "./src/resolvers/website-by-host-map.ts",
-    "./resource-chat-inject": "./src/resource-chat-inject.ts",
-    "./resource-chat-inject.ts": "./src/resource-chat-inject.ts",
     "./resource-not-found": "./src/resource-not-found.ts",
     "./resource-not-found.ts": "./src/resource-not-found.ts",
     "./run-boot-hook-list": "./src/run-boot-hook-list.ts",
@@ -302,5 +294,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.524"
+  "version": "0.23.525"
 }

package/src/agreement-gate/authorized-emails.ts

@@ -8,7 +8,6 @@ import { parseAgreementParties } from "@teamscala/document-signing/agreement-par
 import { findFirstAgreement } from "./agreement-lookup.ts";
 import { resolveAgreementViewerDirectory } from "./resolution-caches.ts";
 
-/** The agreement's authorized email set (its signer roster) for the access endpoint. */
 export async function resolveAgreementSignerEmails(
 	agreementId: string,
 ): Promise<Set<string>> {
@@ -40,12 +39,6 @@ export async function resolveAgreementSignerEmails(
 	}
 }
 
-/**
- * Every email allowed PAST the gate: the signer roster (who may sign) UNION every
- * member of the owning org (who may VIEW). Signing authority stays roster-only —
- * buildSigningSession gives a non-party org member a view-only session. This is
- * what the access endpoint and session-authorize check.
- */
 export async function resolveAgreementAuthorizedEmails(
 	agreementId: string,
 ): Promise<Set<string>> {

package/src/agreement-gate/placeholder-strip.ts

@@ -5,7 +5,6 @@
 
 import type { ContentBlock } from "./signing-session.ts";
 
-/** True if any of the block's OWN string props carries an {{agreement.*}} token. */
 function blockHasAgreementPlaceholder(block: ContentBlock): boolean {
 	const props = block.props;
 	if (!props) return false;
@@ -15,7 +14,6 @@ function blockHasAgreementPlaceholder(block: ContentBlock): boolean {
 	return false;
 }
 
-/** Drop blocks whose own text still holds an {{agreement.*}} token, recursively. */
 export function stripAgreementPlaceholderBlocks(content: ContentBlock[]): ContentBlock[] {
 	const out: ContentBlock[] = [];
 	for (const block of content) {

package/src/agreement-gate/settings.ts

@@ -8,13 +8,6 @@ import * as v from "valibot";
 
 export const AG_COOKIE = "ag_token";
 
-/**
- * Agreement gate display + behaviour, DB-driven (config/content-gate-agreement),
- * never hardcoded — mirrors proposal-gate's loadProposalGateSettings. requireOtp
- * is the per-gate OTP switch (agreements default ON: a signer verifies identity
- * before signing). title is the fallback used when no agreement name resolves. A
- * missing/invalid row falls back to these defaults so the gate UI ALWAYS renders.
- */
 export const AGREEMENT_GATE_DEFAULTS = {
 	title: "Private document",
 	subtitle: "Verify your email to view and sign this document.",
@@ -29,16 +22,8 @@ const AgreementGateSettingsSchema = v.object({
 	requireOtp: v.optional(v.boolean(), AGREEMENT_GATE_DEFAULTS.requireOtp),
 });
 
-/**
- * The settings type is the SCHEMA'S output, never a hand mirror
- * (`autosave-single-surface` rule 2): the interface re-spelled the schema one
- * block away and drifts the first time the schema grows a field.
- */
 export type AgreementGateSettings = v.InferOutput<typeof AgreementGateSettingsSchema>;
 
-/** Gate copy/behaviour, or null when the config row is absent/broken. Null is
- *  the absent signal — callers default explicitly so a missing row neither 500s
- *  the page nor masks as a populated value (protective-layers-fail-explicitly). */
 export async function loadAgreementGateSettings(): Promise<AgreementGateSettings | null> {
 	try {
 		return await loadRegistryConfig(

package/src/agreement-gate.ts

@@ -9,7 +9,6 @@ import {
 	verifyAgreementAccessToken,
 } from "@teamscala/document-signing/agreement-access-token";
 import { expandRosterTemplates } from "./expand-roster.ts";
-import { injectResourceChatLauncher } from "./resource-chat-inject.ts";
 import { agTtlMs } from "./gate-ttls.ts";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { AG_COOKIE, AGREEMENT_GATE_DEFAULTS, loadAgreementGateSettings } from "./agreement-gate/settings.ts";
@@ -36,7 +35,6 @@ import { resolveAgreementAuthorizedEmails } from "./agreement-gate/authorized-em
 export const agreementGateConfig: ContentGateConfig = {
 	cookieName: AG_COOKIE,
 	async getResourceId(resolved) {
-		// Old-flow pages: a pre-placed SignIn gate block carries the UUID.
 		const gate = findAgreementGate(resolved);
 		if (gate.agreementUuid) {
 			const gateRegion = gate.gateRegions[0];
@@ -47,7 +45,6 @@ export const agreementGateConfig: ContentGateConfig = {
 			return gate.agreementUuid;
 		}
 
-		// New-flow pages: resolve UUID from the page→agreement association.
 		const pageId = (resolved.page as { id?: string } | undefined)?.id;
 		if (!pageId) return "";
 
@@ -70,7 +67,6 @@ export const agreementGateConfig: ContentGateConfig = {
 				stashAgreementMeta(resolved, agreement.id, agreement.name);
 				return agreement.id;
 			}
-			// Cache negative so non-agreement pages never re-query.
 			pageAgreementCache.set(pageId, { id: "", name: "" });
 			return "";
 		} catch (err) {
@@ -80,10 +76,6 @@ export const agreementGateConfig: ContentGateConfig = {
 			return "";
 		}
 	},
-	// Baked-in unified auth (engine default): a logged-in viewer whose session
-	// email is in the authorized set (signer roster ∪ owning/party-org members)
-	// is released with no per-gate OTP — session verify is local, works on
-	// Railway. Just exposing the resolver opts into the platform-wide behaviour.
 	resolveAuthorizedEmails: resolveAgreementAuthorizedEmails,
 	verifyToken(token, resourceId, nowMs) {
 		const email = verifyAgreementAccessToken(token, resourceId, nowMs);
@@ -92,7 +84,6 @@ export const agreementGateConfig: ContentGateConfig = {
 	async onAuthorized(resolved, agreementUuid, { email }) {
 		const session = await buildSigningSession(agreementUuid, email);
 		if (!session) {
-			// Session build failed — withhold content as if unauthorized.
 			if (!hasPrePlacedGate(resolved)) {
 				const content = getBodyContentArray(resolved);
 				if (content) {
@@ -117,9 +108,6 @@ export const agreementGateConfig: ContentGateConfig = {
 				})
 			: "";
 
-		// New-flow pages: inject the signing shell BEFORE roster expansion so
-		// the SignatureField template is expanded per party. Old-flow pages
-		// already have pre-placed blocks — skip injection.
 		if (!hasPrePlacedGate(resolved)) {
 			const content = getBodyContentArray(resolved);
 			if (content) {
@@ -130,37 +118,18 @@ export const agreementGateConfig: ContentGateConfig = {
 			}
 		}
 
-		// Expand roster templates + bind agreement-meta placeholders (both flows).
 		expandRosterTemplates(resolved, session.parties, {
 			name: session.agreementName,
 			ref: session.agreementRef,
 			org: session.orgName ?? "",
 			signer: session.authedName,
-			// Role-aware verb for the header status line. authedRole is a party key
-			// for a designated signer, or the literal "viewer" for a view-only
-			// recipient (an org member who isn't on the signer roster). So the
-			// header reads "Viewing as <name>" for a viewer, "Signing as <name>"
-			// for a signer — never implying a viewer can sign.
 			signerVerb: session.authedRole === "viewer" ? "Viewing" : "Signing",
 			signedCount: String(signedCount),
 			total: String(session.parties.length),
 			completedDate,
 		});
-		// Seed the verified session into every SignatureField (both flows).
 		seedSigningBlocks(resolved, session);
 
-		// Floating "Ask about this agreement" GPT bubble — the generic
-		// ResourceChatLauncher (one-ai-chat-system), strictly behind the email
-		// gate. The agreement's clause text becomes the chat's runtime context.
-		await injectResourceChatLauncher(resolved, email, {
-			resourceKey: "agreement",
-			agentConfigSlug: "agreement-assistant-agent",
-			organisationId: session.organisationId ?? undefined,
-			launchLabel: "Ask about this agreement",
-			placeholder: "Ask about this agreement…",
-		});
-
-		// Old-flow only: drop the pre-placed gate block (new flow has none).
 		if (hasPrePlacedGate(resolved)) {
 			const { gateRegions } = findAgreementGate(resolved);
 			for (const { pd, content, gateIdx } of gateRegions) {
@@ -170,13 +139,11 @@ export const agreementGateConfig: ContentGateConfig = {
 	},
 	async onUnauthorized(resolved, agreementUuid) {
 		if (hasPrePlacedGate(resolved)) {
-			// Old flow: strip region to gate-only.
 			const { gateRegions } = findAgreementGate(resolved);
 			for (const { pd, content, gateIdx } of gateRegions) {
 				pd.content = [content[gateIdx]];
 			}
 		} else {
-			// New flow: inject gate, withhold all body content.
 			const meta = resolved[AGREEMENT_META_KEY] as
 				| { name?: string }
 				| undefined;
@@ -195,7 +162,6 @@ export const agreementGateConfig: ContentGateConfig = {
 			}
 		}
 
-		// Common: strip agreement-placeholder blocks + neutralize page meta.
 		for (const value of Object.values(resolved)) {
 			const pd = (
 				value as { puck_data?: { content?: unknown[] } } | null

package/src/attach-proposal-accept.ts

@@ -7,7 +7,7 @@ import type { Hono } from "hono";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { signAgreementAccessToken } from "@teamscala/document-signing/agreement-access-token";
 import { parseCookie } from "./content-gate/parse-cookie.ts";
-import { verifyAccessToken } from "./content-gate/token.ts";
+import { verifyAccessToken } from "@teamscala/agreement-generation/content-gate-token";
 import { agTtlMs } from "./gate-ttls.ts";
 import { createAgreementFromProposal } from "@teamscala/agreement-generation/create-agreement-from-proposal";
 import { getCookieDomain } from "@teamscala/db/registry/cookie-domain";

package/src/attach-proposal-magic.ts

@@ -5,7 +5,7 @@
 
 import type { Hono } from "hono";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { verifyAccessToken } from "./content-gate/token.ts";
+import { verifyAccessToken } from "@teamscala/agreement-generation/content-gate-token";
 import { propTtlMs } from "./gate-ttls.ts";
 
 const PROP_COOKIE = "prop_token";

package/src/auth/sign-out.ts

@@ -5,9 +5,7 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 
 export interface SignOutResult {
-	/** True once the local session is revoked (and the central one, when centralised). */
 	ok: boolean;
-	/** True when the sign-out was forwarded to scala-otp. */
 	forwarded: boolean;
 }
 

package/src/auth-gate/public-paths.ts

@@ -13,16 +13,6 @@ export const SIGN_IN_PATHS = new Set([
 	"/magic-link",
 ]);
 
-/// A STATIC ASSET IS NEVER A PROTECTED RESOURCE, so it is decided by EXTENSION / rather than by remembering to list it.
-/// / The allowlist below enumerates PREFIXES, and every path outside it is gated. / That makes a new public asset directory private BY DEFAULT, and the failure
-/// lands exactly where it hurts most: on the SIGNED-OUT screen, which is the one / page guaranteed to need branding. `/assets/` was listed; `/logos/` never was,
-/// so `/logos/cropped.png` answered 302 → /sign-in and the browser rendered a / blank logo under a "starting up" splash. Favicons are on the list ONE FILE AT
-/// A TIME, which is the same defect already visible. / / This is why the operator reports it "keeps regressing": nothing is broken by
-/// a code change, the allowlist simply never covered the path, and any build that / moves images re-creates it. Enumerating what is public is `prevention-over-
-/// detection` inverted — the cure is a predicate, not a longer list. /
-/// Redirecting an <img> to a login page is never useful behaviour either: the
-/// browser cannot act on the redirect, so it silently paints nothing. Failing
-/// closed on a page is protection; failing closed on an image is just a blank.
 const STATIC_ASSET_EXTENSIONS = [
 	".png", ".jpg", ".jpeg", ".gif", ".webp", ".avif", ".svg", ".ico", ".bmp",
 	".woff", ".woff2", ".ttf", ".otf", ".eot",
@@ -38,17 +28,7 @@ export const PUBLIC_INFRA_PREFIXES = [
 	"/assets/",
 	"/api/assets/",
 	"/api/auth/",
-	// fn.signInFlow procedures serve the unauthenticated sign-in flow (config
-	// load, session check, portal list) — anonymous-allowed by design (return {}
-	// for no session). They replaced the former /api/data/sign-in-flow-config,
-	// /check-session, /portals HANDLER_MAP entries (handler-map-retirement).
 	"/api/rpc/fn/signInFlow/",
-	// scala-enroll device-onboarding: the machine-facing installer + register
-	// routes are TOKEN-authenticated (a single-use enrollment token issued by a
-	// logged-in, dev_access-approved operator), fetched by the onboardee via
-	// `irm`/`curl` with NO session cookie — so they must skip the page login
-	// gate, exactly like /mcp (Bearer) and /api/rpc/ws self-authenticate. The
-	// TOKEN is the delegated capability; issuance (/issue) stays login-gated.
 	"/provision/",
 ];
 
@@ -58,81 +38,15 @@ export const PUBLIC_INFRA_PATHS = new Set([
 	"/favicon.svg",
 	"/api/session",
 	"/api/rpc/ws",
-	// The MCP endpoint is a service-to-service surface with its OWN Bearer auth
-	// (the gateway sends `Authorization: Bearer SCALA_DEV_KEY`, validated by the
-	// MCP route handler). It must never be session-page-gated: on a kind:ui
-	// service that also mounts an MCP server (scala-agents — the fleet
-	// orchestration + cross-pane channel), the auth-gate would 302 /mcp to
-	// /sign-in, so the gateway sees toolCount=0 and the whole channel goes
-	// degraded. Backend-only MCP hosts have no auth-gate, so this only bit the
-	// one UI MCP host once the localhost super-admin bypass was removed
-	// (the bypass had been masking it). Exempt alongside /api/rpc/ws and
-	// /api/auth/, which self-authenticate the same way.
 	"/mcp",
-	// build-id is polled by the client self-heal; it must always return JSON
-	// (a tiny bundle hash) regardless of session, never a /sign-in redirect —
-	// otherwise an expired-session tab would compare a redirect body to its
-	// booted build and never heal.
 	"/api/build-id",
-	// /_heap is the localhost-gated heap-attribution probe (register-static-assets);
-	// like /health it is infra, not a page, so it must never 302 to /sign-in on an
-	// auth-gated service. The probe's own localhost Host check is the real gate.
 	"/_heap",
-	// /api/fleet/events is the SSE fleet event stream consumed self-contained by
-	// the generated opencode scala-hooks plugin (and any future client without
-	// an @orpc/client dep) for native cross-pane channel delivery. The plugin
-	// runs in the opencode process with no scala-agents session cookie, so the
-	// route must be public; the stream is keyed by the orchestratorSessionId
-	// query param (the subscriber's own tmux pane id) and carries no sensitive
-	// data, and dispatch only emits events targeted at that identity.
 	"/api/fleet/events",
-	// /api/fleet/claude-sessions is a non-sensitive lane-identity read (active
-	// Claude lane sessionIDs + cwds) consumed by the session-picker daemon to
-	// RESTORE transcript tails after its own restart. The picker runs with no
-	// scala-agents session cookie; the data is less sensitive than the
-	// /api/fleet/events stream above (no message content), so it is public like
-	// the other dev-host infra reads.
 	"/api/fleet/claude-sessions",
-	// /api/fleet/ingest-event receives parsed lane-action events
-	// (message.part.updated etc.) from the cli-session transcript-tail — a
-	// dev-host INTERNAL machine caller that POSTs with no session cookie, exactly
-	// like the lane-event hook. Without this exemption the page auth-gate 302s
-	// every POST and the lane's tool/text action stream never reaches the
-	// ingestEvent pipeline. A first-class
-	// api_route (sibling to lane-event); security is the handler's loopback gate
-	// on the platform's x-caller-remote-address (set by register-api-routes).
 	"/api/fleet/ingest-event",
-	// /api/fleet/lane-event receives Claude Code http lifecycle hooks
-	// (Stop/UserPromptSubmit/Pre*ToolUse) for live-lane visibility. Like /mcp it
-	// is a service-to-service surface with its OWN Bearer auth (the hook sends
-	// `Authorization: Bearer SCALA_DEV_KEY`, validated by the handler); the hook
-	// runs in the Claude process with no scala-agents session cookie, so it must
-	// not be session-page-gated. The handler filters to fleet lanes by workspace
-	// cwd + resolves the lane via the session-picker, so an unauth'd caller
-	// writes no lane state.
 	"/api/fleet/lane-event",
-	// /api/fleet/sweep-executor receives the loga monitor engine's sweep dispatch
-	// (POST {slug}) -- a service-to-service surface like /api/fleet/lane-event /
-	// /api/fleet/ingest-event (loga -> scala-agents, localhost). Security is the
-	// handler's loopback gate (x-caller-remote-address), identical to its siblings.
 	"/api/fleet/sweep-executor",
-	// /api/terminal-ws is the in-browser terminal WebSocket bridge (a real PTY
-	// login shell). It is a dev-tool surface analogous to /api/fleet/events:
-	// the operator's own shell, no sensitive data beyond what the operator
-	// already has in their terminal. Must not be session-gated — the test
-	// harness and the terminal block both connect without a session cookie.
 	"/api/terminal-ws",
-	// /unauthorised is the access-gate's rejection target (the PageGuard access
-	// page). It MUST be exempt: an authed-but-not-allowed viewer is redirected
-	// here, so gating it would re-reject and loop. It renders no sensitive data.
 	"/unauthorised",
-	// The OpenAPI contract for the ORPC router — a service-to-service surface
-	// with its OWN Bearer auth (`Authorization: Bearer SCALA_DEV_KEY`,
-	// validated by the mount-orpc-router handler, fail-closed), exactly like
-	// /mcp and /api/fleet/lane-event above. The MCP gateway fetches it at boot
-	// (SCALA_OPENAPI_SPEC_URL) with no session cookie; without this exemption
-	// the page auth-gate 302s the fetch to /sign-in and the gateway reads an
-	// HTML sign-in page where the JSON document belongs (observed probing
-	// scala-portal.internal:5200/api/rpc/openapi.json on 2026-09-30).
 	"/api/rpc/openapi.json",
 ]);

package/src/auth-gate.ts

@@ -3,25 +3,6 @@
  * @status handwritten
  */
 
-/**
- * Point the event-log primitive at the process's Prisma singleton.
- *
- * Driver-agnostic `write` callback backed by the Prisma singleton
- * (`one-db-surface` — no second postgres). Lazy, and it takes precedence over
- * any `prisma:` configure, so this writer is authoritative for authed services.
- * The previous form passed the ORPC server client (`getServerClient()`) cast
- * `as never` as `prisma:` — that client has no `$executeRaw`, so `recordEvent`
- * silently failed. Routing it through ORPC would reintroduce exactly that.
- * Retention is owned by the event-log-sweep pg-boss job.
- *
- * EXTRACTED so its name states what it is. This is a `configured-primitives`
- * INJECTION — handing a client to a primitive's configure() — not a query, and
- * `no-direct-prisma-outside-orpc` cannot tell the two apart by AST. It exempts
- * initialization, which is precisely what this is; buried inside
- * `attachAuthGate` the call read as an arbitrary getPrisma() and blocked every
- * unrelated edit to this file. Naming the boot step honestly is the fix. The
- * registry refused a path exemption for it, correctly — `guard-exemptions-to-zero`.
- */
 
 	// Eager-warm the local BetterAuth runtime at boot whenever a request path
 	// will build it: the session-READ path (getSession, better-auth-cookie mode)

package/src/bind-page-handler.ts

@@ -3,17 +3,6 @@
  * @status handwritten
  */
 
-		// Per-page root.props.maxWidth (the canonical mechanism) centers any page at the chosen width via inline styles — already hydration-safe
-		// and page-scoped. Bind-page-handler MUST NOT inject unscoped CSS selectors: a global `.puck-root-slot { max-width }` rule shrinks
-		// every portal pane that hosts a Puck root (the 2026-06-17 dashboard sliver bug — `.puck-root-slot` matches every Puck page in every
-		// region, including the dashboard center pane). The `no-bind-page-handler-css-injection` guard enforces this; this comment is the load-bearing rationale.
-		// Live dashboards must never be served from a stale cache (intermediary, browser back-forward, mobile Safari aggressive caching). Force every
-		// SSR HTML response to be revalidated. Static assets (CSS/JS bundles) keep their hash-busted caching — those are content-addressed.
-		// no-transform: intermediaries must not mutate SSR HTML — Cloudflare's Email Address Obfuscation rewrites mailto: hrefs at the edge, which
-		// breaks the server-serializes-client-reads-verbatim hydration contract (React recoverable-error on every page with a mailto link). Per CF
-		// docs, Email Obfuscation does not apply when no-transform is present. NOTE: a shared-edge-caching (CDN max-age) variant shipped briefly on 2026-06-10
-		// and was REMOVED by operator ruling the same day ("the origin should be so fast we don't care") — the origin-speed work (SWR caches,
-		// wave-parallel loader, brotli) is the sanctioned path; re-adding shared-cache headers needs a fresh operator ruling.
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { withGateEntryClears } from "./content-gate/gate-entry-clears.ts";
@@ -42,34 +31,12 @@ export async function bindPageHandler(
 		let orgId: string | undefined;
 		let visitor: { id: string; name: string; email: string } | null = null;
 
-		// NO localhost super-admin bypass: identity comes ONLY from the session
-		// (the auth-gate already forces sign-in for authed services on every
-		// host, 127.0.0.1 included). The old `if (isLocalhost) userId="super-admin"`
-		// rendered authed pages as a privileged user on localhost regardless of
-		// who (if anyone) was signed in — so agent/tool verification on 127.0.0.1
-		// saw a view that diverged from the real signed-in user's. Tools that need
-		// an authed render sign in and carry the cookie (getSuperAdminSessionCookie).
 
-		// The .scala.business session cookie reaches EVERY app on the domain,
-		// so a signed-in platform user is identifiable at SSR regardless of
-		// this service's own auth mode. Resolving it per-request (never via
-		// the cross-request loader graph) lets identity-gated blocks
-		// (PublicGptBlock's SignInBlock gate) first-paint the real experience
-		// instead of a client-side "checking who you are" loading pass
-		// (ssr-then-live-handoff). authMode still governs AUTHORIZATION;
-		// this is read-only identity convenience.
 		const hasSessionCookie = /better-auth\.session_token=/.test(
 			c.req.header("cookie") ?? "",
 		);
 
 		if (authMode === "better-auth-cookie" || hasSessionCookie) {
-			// Visitor identity is an ENHANCEMENT: on auth:none services
-			// (scala-public et al.) no auth factory is registered, and a
-			// signed-in operator's domain-wide cookie reaches every
-			// *.scala.business site — getSession throwing "Auth factory not
-			// registered" 500'd every page for signed-in visitors
-			// (public-dev outage, 2026-06-11). Degrade to anonymous, never
-			// fail the render (block-and-provider-error-isolation).
 			try {
 				const { getSession } = await import("@teamscala/auth/get-session.ts");
 				const session = await getSession(c.req.raw.headers);
@@ -86,27 +53,11 @@ export async function bindPageHandler(
 				}
 			} catch (err) {
 				if (authMode === "better-auth-cookie") throw err;
-				// cookie-only enhancement path: anonymous render proceeds
 			}
 		}
 
-		// Anonymous dynamic routes (proposal/form/quiz/agent) resolve a
-		// resource whose owning org is known from the loader. That org owns
-		// the brand the block-level serverLoaders read — override the
-		// viewer's org (if any) so the SSR injects the resource owner's
-		// logo/colours, not the viewer's.
 		if (resourceOrgId) orgId = resourceOrgId;
 
-		// Unauthed /sign-in (no session, no resource) would otherwise resolve no org, and the brand resolver falls back to the super-admin org (GBG Indo)
-		// — so a link shared to org A (e.g. GMG APAC) previews as org B's brand on WhatsApp/crawlers, because the link 302→/sign-in for the unauthed crawler.
-		// The callbackURL carries the org the visitor is signing in to; derive orgId from it so the sign-in page's brand/title/og reflect the destination org.
-		// The canonical portal shape is /<websiteId>/<orgId>/<path> — the org is segment 1, NOT segment 0. Reading segment 0 (the website id) fed a website
-		// id into brand resolution, which resolved no org and fell back to the super-admin org — the exact cross-tenant mis-branding this block exists to
-		// fix, still live until 2026-07-21; violates portal-branding-resolves-page-org-first.
-		// scala-projects routes /<orgId>/… (single UUID) and proposal/form/quiz hosts
-		// route /<resourceId>/… (a non-org first segment) — both keep segment 0 via
-		// the helper's single-UUID fallback (resolves to no brand, falls back as
-		// before). The helper is the single authority shared with the route resolver.
 		if (!orgId) {
 			const cb = c.req.query("callbackURL") ?? "";
 			const resolved = extractOrgIdFromCallbackPath(cb);
@@ -126,10 +77,6 @@ export async function bindPageHandler(
 			}),
 		);
 		const headers = new Headers(resp.headers as HeadersInit);
-		// Gate-entry markers are ONE-VIEW state: the render that consumed one
-		// clears it here, so the next load (a refresh) is unauthorized and shows
-		// the gate again. Without this the marker would outlive the view that
-		// used it and every load would skip the gate.
 		for (const name of gateEntryClears) {
 			headers.append(
 				"Set-Cookie",
@@ -142,26 +89,9 @@ export async function bindPageHandler(
 		);
 		headers.set("Pragma", "no-cache");
 		headers.set("Expires", "0");
-		// Viewport-aware slot loading varies the response by these headers.
-		// Even with Cache-Control: no-store, browsers and intermediaries
-		// honour Vary on back/forward navigation and BFCache; Accept-CH
-		// asks the browser to send Sec-CH-UA-Mobile on subsequent
-		// navigations (Chromium-family auto-sends, others opt in).
 		headers.set("Vary", "Sec-CH-UA-Mobile, User-Agent");
 		headers.set("Accept-CH", "Sec-CH-UA-Mobile");
-		// Origin-side gzip. Cache-Control: no-transform (load-bearing above —
-		// it disables Cloudflare HTML rewrites that corrupt hydration) ALSO
-		// makes hono's compress() middleware skip this response, which shipped
-		// 1.2MB of raw SSR HTML per page load through the dev tunnel (~3s of
-		// pure transfer; the operator's tablet timed out — 2026-06-06).
-		// no-transform forbids INTERMEDIARY transforms; origin-applied
-		// content-coding is part of the representation (RFC 9110 §8.4.1), so
-		// compressing here honors both. Bun.gzipSync on ~1.2MB costs ~10ms.
 		const acceptEnc = c.req.header("Accept-Encoding") ?? "";
-		// Brotli preferred when offered (every modern browser): ~15-20%
-		// smaller than gzip on SSR HTML. Quality 4, NOT the library default
-		// 11 — q11 costs hundreds of ms on a ~1MB page (defeats the point);
-		// q4 compresses in single-digit ms and still beats gzip.
 		if (/\bbr\b/.test(acceptEnc) && resp.body) {
 			const { brotliCompressSync, constants } = await import("node:zlib");
 			const raw = new Uint8Array(await new Response(resp.body as never).arrayBuffer());
@@ -181,8 +111,6 @@ export async function bindPageHandler(
 		}
 		return new Response(resp.body as never, { status: resp.status, headers });
 	} catch (err) {
-		// Dead entity link (wrong id, deleted row) → the branded not-found
-		// page with a real 404 — never a 500, never default-content leakage.
 		if (err instanceof PrimaryResourceMissingError) {
 			log.warn(
 				`[scala-install:${serviceSlug}] 404 ${err.resourceType} not found (${label}) for ${new URL(c.req.url).pathname}`,
@@ -191,10 +119,6 @@ export async function bindPageHandler(
 				err.resourceType,
 				await resolveErrorPageLogo(serviceSlug),
 				err.httpStatus,
-				// "Take me home" → the host root (relative "/" resolves to the
-				// current site's home; the portal redirects / to its dashboard).
-				// empty → the page-row-exists-but-zero-blocks "This page is empty"
-				// surface, distinct from a dead link (operator ruling 2026-07-21).
 				{ homeUrl: "/", empty: err.empty },
 			);
 		}