@teamscala/service-boot 0.23.524 → 0.23.525

package/src/register-registry-page-route/page-data-shared.ts

@@ -6,11 +6,6 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { Data } from "@teamscala/puck-boundary/data";
 
-/**
- * The canonical identity from the generated boundary (the platform's one
- * declaration site for framework shapes) — never a hand-spelled structural
- * duplicate of it.
- */
 export type PuckData = Data;
 
 export const EMPTY_PUCK_DATA: PuckData = { root: { props: {} }, content: [] };
@@ -86,7 +81,6 @@ export function warnUnresolvedRegionSlot(slot: string): void {
 	);
 }
 
-/** The resolved brand tokens every branch reads (the old file's shared prologue). */
 export function readBrandTokens(resolved: Record<string, unknown>): {
 	brand: Record<string, unknown>;
 	primaryColor: string;

package/src/register-registry-page-route/prefetch-org-id.ts

@@ -3,23 +3,6 @@
  * @status handwritten
  */
 
-/**
- * Prefer segment 1; fall back to segment 0 only when segment 1 is not a
- * UUID (the single-UUID shape, which is live and supported — NOT
- * transitional). The fallback is deliberately kept
- * UNCHANGED-BEHAVIOUR rather than "fixed": a UUID in segment 0 is
- * genuinely ambiguous — of the 40 UUID-first page paths in builda_pages,
- * ZERO are websites and ZERO are organisations, so segment 0 can also be
- * an unrelated record id. Position alone cannot resolve that; only
- * validating the id against organisation_profile can, and that is a DB
- * read this hot prefetch path should not take without caching
- * (`hot-path-resolutions-are-cached`). Preferring segment 1 is strictly
- * better for the canonical shape and no worse for any other. Reading
- * segment 0 first captured the WEBSITE id and passed it as an
- * organisation id, which failed silently because both are well-formed
- * UUIDs: the prefetch simply warmed a session against the wrong tenant
- * (found 2026-07-21).
- */
 
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 

package/src/register-registry-page-route/proposal-approval-email-token.ts

@@ -2,17 +2,6 @@
  * @system service-boot
  * @status handwritten
  */
-/**
- * Resolve the `{{approvalEmail}}` placeholder in a proposal page's button props
- * (e.g. the Approve CTA) in place. Routing: the organisation's registered
- * company email FIRST (organisation_profile.contact_email, already resolved
- * into pageData.brand.contactEmail); the proposal creator's user email only as
- * a fallback when the org has none — so a cloned proposal can never carry a
- * stale hard-coded address. The creator lookup is null-safe and adds no user
- * exposure: it resolves only where the in-process ORPC client exposes `user`
- * (super-admin), degrading to the org email elsewhere. Called only for proposal
- * pages; other registry pages are untouched.
- */
 
 import { getServerClient } from "../page-server-orpc/server-client.ts";
 

package/src/register-registry-page-route/proposal-brand-stamping.ts

@@ -3,20 +3,6 @@
  * @status handwritten
  */
 
-/**
- * Stash a proposal's connected partner logo/colour on `pageData` from the
- * `partnerOrg` loader source (`crm_organisations` loaded by the proposal's
- * `partner_id`, via the SAME proven ORPC loader path that loads the proposal
- * itself). resolve-page-brand (service-runtime) prefers `pageData.partnerLogo`
- * over any inline body-Hero prop and fans it into the shared `/header` so a
- * `source: "partner"` OrgLogo fills automatically — the partner logo lives on
- * the CRM record, never duplicated per proposal. No partner → partnerOrg is
- * null → nothing set → the partner logo block renders blank. Reading the
- * already-resolved loader value (not a second hand-rolled getServerClient call)
- * is what makes this reliable: the earlier direct `crm_organisations.findFirst`
- * with a Prisma-style object `select` resolved intermittently/never against the
- * generated ORPC, leaving the header partner blank (2026-06-12).
- */
 export function applyPartnerBrand(
 	pageData: Record<string, unknown>,
 	partnerOrg:
@@ -30,12 +16,6 @@ export function applyPartnerBrand(
 		pageData.partnerBrandColor = partnerOrg.brand_primary_color;
 }
 
-/**
- * Auto-resolve the client's company logo from the `clientOrg` loader source
- * (contact_id → company_id → crm_organisations.logo_url). Injects into the
- * Hero block's clientLogo prop when it's empty — no manual logo URL needed
- * per proposal when the contact's company profile has a logo.
- */
 export function applyClientLogo(
 	pageData: Record<string, unknown>,
 	clientOrg:

package/src/register-registry-page-route/public-shell-page-data.ts

@@ -88,12 +88,6 @@ export function publicShellPageData(
 	const overrideHeading = pickRootProp<string>(regions, "headingFont");
 	const overrideBody = pickRootProp<string>(regions, "bodyFont");
 
-	// The page's own screenMode, threaded the same way Branch 1 threads it
-	// (single-page-data.ts). Dropping it here is not neutral: build-page-tree
-	// falls back to `fullScreen: renderMode === "public" || "gpts"`, and for a
-	// shell page that resolves false — which wraps the body in a centred card
-	// and puts the site header INSIDE that card instead of across the top of
-	// the page. A page that declares "full-screen" was rendering as a form.
 	const screenMode = pickRootProp<string>(regions, "screenMode");
 
 	const pageName = (page.name as string) || null;
@@ -108,22 +102,11 @@ export function publicShellPageData(
 	return {
 		puckData: { root: { props: {} }, content: [] } as PuckData,
 		regions,
-		// Region-shell blocks (e.g. the header Navigation deriving the body's
-		// document sections) read the resolved entity graph from
-		// pageData.loaderData — the same surface Branch 1 exposes. Without it a
-		// header/footer block serverLoader gets ctx.loaderData=undefined and
-		// cannot see the body page, so a server-derived nav produced no items
-		// and the menu was client-only (vanished on stale tabs / narrow views).
 		loaderData: resolved,
 		website: {
 			slug: website.slug as string,
 			name: website.name as string,
 			organisation_id: website.organisation_id as string | null,
-			// header_settings carries the DB-driven header config (e.g.
-			// backdropBlur) the public shell applies — PublicTemplate reads
-			// pageData.website.header_settings.backdropBlur. Dropping it here
-			// silently kills the header blur even though the DB switch is set
-			// (the 2026-06-17 regression). Pass it through verbatim.
 			header_settings:
 				(website.header_settings as Record<string, unknown> | null) ?? null,
 		},
@@ -132,10 +115,6 @@ export function publicShellPageData(
 			null,
 		brand: {
 			primaryColor: overrideColor ?? primaryColor,
-			// Thread the org brand's dark surface (brand_background_color /
-			// brand_dark_color) when the page sets no explicit override — so
-			// dark-mode pages use the brand's real dark colour, not a
-			// primary-derived tint. Uses the org brand's real dark colour.
 			backgroundColor:
 				overrideBg ?? (brand.backgroundColor as string | null) ?? null,
 			lightSurface: (brand.lightSurface as string | null) ?? null,
@@ -159,11 +138,6 @@ export function publicShellPageData(
 					pageMetaTitle: bodyMetaTitle,
 					templateTitle: (meta.title as string) || undefined,
 					websiteName: (website.name as string) || undefined,
-					// The FRIENDLY name is what the public sees — the trading brand,
-					// not the legal entity. Reading companyName here put "GMG APAC"
-					// in the title of every launcha page, which the operator has
-					// corrected repeatedly; the friendly name is "launcha". Falls
-					// back to companyName only where no friendly name is set.
 					organisationName:
 						(brand.companyFriendlyName as string) ||
 						(brand.companyName as string) ||

package/src/register-registry-page-route/resolve-request-graph.ts

@@ -61,8 +61,6 @@ function cloneForCache(
 			`[scala-install:${serviceSlug}] graph-cache structuredClone failed for ${graphKey} — falling back to JSON-clone (non-cloneable value in loader graph): ${err instanceof Error ? err.message : err}`,
 		);
 		try {
-			// JSON-clone preserves the data graph, dropping the functions and
-			// undefined a loader graph should not be carrying anyway.
 			return JSON.parse(JSON.stringify(graph)) as unknown;
 		} catch (err2) {
 			log.warn(
@@ -78,19 +76,7 @@ export async function resolveRequestGraph(
 ): Promise<Record<string, unknown>> {
 	const { pattern, routeSlug, routeConfig, loaderConfig, params, isStaticShell, serviceSlug, configFingerprint } = args;
 
-	// A bare root ("/") that declares a resource_type is a UUID-driven
-	// public site (proposals/forms/quiz) with no resource selected — it
-	// must render the branded holding/not-found page ("no <resource> at
-	// this link"), never fall through the shared public loader to the
-	// marketing site. PrimaryResourceMissingError is the existing signal
-	// the page binder maps to buildResourceNotFoundResponse. A "/" route
-	// WITHOUT a resource_type (e.g. scala-public's marketing root) is
-	// unaffected and still renders its content.
 	if (pattern === "/" && routeConfig.resource_type) {
-		// Status 200: the bare root is a valid "no <resource> selected"
-		// landing, not an error — and kind:ui services must answer GET /
-		// with 200 (verify-prod-persistent-slot). An invalid /:id keeps
-		// the default 404 (genuinely not found).
 		throw new PrimaryResourceMissingError(routeConfig.resource_type, 200);
 	}
 	const graphKey = `graph:${routeSlug}:${params.host}:${params.path}${configFingerprint ? `:${configFingerprint}` : ""}`;
@@ -111,13 +97,6 @@ export async function resolveRequestGraph(
 		>;
 	};
 	let resolved: Record<string, unknown>;
-	// SWR read over @teamscala/cache: fresh hit serves the cached graph, stale
-	// hit serves it AND fires ONE background refresh (refreshInBackground,
-	// single-flight via the cache's in-flight map), miss returns undefined.
-	// The refresh callback re-resolves + stores a clone; a primary-missing
-	// (dead-link) graph THROWS so the cache is not updated — a dead link must
-	// stay per-request so a just-created record appears immediately
-	// (refreshInBackground catches, leaves the stale entry, logs one line).
 	const cachedGraph = readCachedGraph(
 		graphCache,
 		graphKey,
@@ -133,16 +112,6 @@ export async function resolveRequestGraph(
 							`primary resource "${primaryType}" missing — skip cache update for ${graphKey}`,
 						);
 					}
-					// SAME DEFENSIVE CLONE AS THE COLD PATH. This used to call
-					// structuredClone bare, so a non-cloneable value in the loader
-					// graph threw on EVERY background refresh: refreshInBackground
-					// caught it, kept the stale entry, and logged one line — so the
-					// cache could never update, expired at staleTtlMs, and the next
-					// request re-resolved the whole graph in-request. Measured
-					// 2026-09-03 on the live proposal page: "The object can not be
-					// cloned" every ~13 minutes on the same graphKey, indefinitely.
-					// The cold path was hardened for exactly this and the refresh
-					// path was not — one defect, two clone sites, one protected.
 					const refreshed = cloneForCache(freshGraph, graphKey, serviceSlug);
 					if (refreshed === undefined) {
 						throw new Error(
@@ -154,47 +123,21 @@ export async function resolveRequestGraph(
 			),
 	);
 	if (cachedGraph !== undefined) {
-		// Clone-on-get: gateAgreementContent + block resolution MUTATE the
-		// graph in place, so each request gets its own copy.
 		resolved = structuredClone(cachedGraph) as Record<string, unknown>;
 	} else {
 		resolved = await resolveFromLoaderConfig(typedLoaderConfig, params);
 		const primaryMissing =
 			hasPrimarySource && primaryType && resolved[primaryType] == null;
 		if (!primaryMissing) {
-			// Defensive clone: structuredClone throws on non-cloneable loader
-			// graphs (functions/Proxies/Prisma instances). A swallowed throw
-			// here used to SILENTLY disable the graph cache for this key
-			// (fail-open-silent — forbidden by protective-layers-fail-explicitly),
-			// which left affected routes re-resolving the loader graph every
-			// request (measured ~1.2s on the projects utility shell). JSON-clone
-			// preserves the data graph (dropping functions/undefined a loader
-			// graph shouldn't carry) so the cache stays effective; both fallbacks
-			// are LOGGED so the offending non-cloneable source is observable +
-			// fixable, never silently disabling the cache again.
 			const cloned = cloneForCache(resolved, graphKey, serviceSlug);
 			if (cloned !== undefined) {
 				graphCache.set(graphKey, cloned);
 			}
 		}
 	}
-	// A route that declares resource_type is meaningless without that
-	// entity: a dead link (wrong id, deleted row) must 404 with the
-	// branded not-found page — never fall through to default content
-	// (the "Vision Toolbar" leak, operator-observed 2026-06-05).
 	if (hasPrimarySource && primaryType && resolved[primaryType] == null) {
 		throw new PrimaryResourceMissingError(primaryType);
 	}
-	// A CONTENT route (no resource_type) whose loader resolves a `page`
-	// body source must not synthesize an empty page for an unmatched path
-	// and serve a cacheable 200 — the generalized "Vision Toolbar" leak
-	// (operator-reported 5×: a deleted page, e.g. /roadmap, returned 200
-	// with an empty body instead of not-found). No page row → dead link →
-	// branded 404 floor. A page row that exists but has zero blocks → a
-	// content gap → the floor's empty-page surface (200). Both carry the
-	// "Take me home" action. The pure decision lives in content-page-floor.ts
-	// (unit-tested without the Hono/DB/graph machinery). Region-slot
-	// (utility/portal) shells without a `page` source are untouched.
 	const contentFloorError = decideContentPageFloor({
 		hasResourceType: !!primaryType,
 		hasPageContentSource: !!(loaderConfig as { sources?: { key: string }[] }).sources?.some(

package/src/register-registry-page-route/run-content-gates.ts

@@ -3,67 +3,15 @@
  * @status handwritten
  */
 
-import type { PageRouteConfig } from "../register-registry-page-route.ts";
 import { runContentGate } from "../content-gate/gate.ts";
-import type { ContentGateOutcome } from "../content-gate/gate.ts";
-import { CONTENT_GATES, withholdsContent } from "../content-gate/catalog.ts";
-import { injectResourceChatLauncher } from "../resource-chat-inject.ts";
+import { CONTENT_GATES } from "../content-gate/catalog.ts";
 
 export async function runContentGatesForPage(
 	resolved: Record<string, unknown>,
 	gateCookie: string | null,
 	gateNow: number,
-	assistant: PageRouteConfig["assistant"],
-	regionSlots: string[] | undefined,
 ): Promise<void> {
-	// EVERY REGISTERED GATE, IN CATALOG ORDER (content-gate/catalog.ts).
-	// This used to name proposalGateConfig, agreementGateConfig and
-	// gptGateConfig by hand, so a fourth gated resource type meant editing
-	// this file AND the second hand-written list in two-phase-boot.ts.
-	//
-	// SEQUENTIAL, NEVER PARALLEL. An authorized proposal viewer has their
-	// gate block removed from the resolved graph, and that removal is what
-	// makes the agreement gate find no resource and no-op on a page that
-	// carries both. Awaiting these together would race that dependency.
-	const gateOutcomes: ContentGateOutcome[] = [];
 	for (const entry of CONTENT_GATES) {
-		const outcome = await runContentGate(
-			resolved,
-			gateCookie,
-			gateNow,
-			entry.gate,
-		);
-		// A seed-only gate (open capture — the public GPT identity gate)
-		// withholds nothing, so its verdict is not evidence about whether
-		// this viewer may see the page and must not reach the assistant
-		// decision below. See withholdsContent, which derives that from the
-		// access config rather than restating it here.
-		if (withholdsContent(entry)) gateOutcomes.push(outcome);
-	}
-
-	// THE ASSISTANT IS A ROW, AND THIS IS THE ONE PLACE IT IS APPLIED. It used to be a call inside each gate's onAuthorized plus an entry
-	// in the hardcoded gate sequence above, so a third resource type meant editing this file. Now any page declaring `assistant` gets
-	// one and no page without the key does.
-	//
-	// GATED PAGES ONLY WHEN AUTHORIZED. The launcher's runtime context is
-	// the whole document serialised, so injecting past a closed gate
-	// would hand withheld bytes to the chat. A page no gate governs is
-	// public and gets the assistant unconditionally -- that is a
-	// different state from an unauthorized viewer, which is why the gate
-	// reports `applies` separately from `authorized`.
-	if (assistant) {
-		const governing = gateOutcomes.filter((outcome) => outcome.applies);
-		const authorized = governing.find((outcome) => outcome.authorized);
-		if (governing.length === 0 || authorized) {
-			await injectResourceChatLauncher(resolved, authorized?.email ?? "", {
-				resourceKey: assistant.resource_key,
-				agentConfigSlug: assistant.agent_config_slug as never,
-				launchLabel: assistant.launch_label,
-				placeholder: assistant.placeholder,
-				// From the loader row, so the injector never has to guess
-				// which resolved keys hold rendered content.
-				regionSlots,
-			});
-		}
+		await runContentGate(resolved, gateCookie, gateNow, entry.gate);
 	}
 }

package/src/register-registry-page-route/warn-uncovered-blocks.ts

@@ -6,16 +6,6 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { RendererComponentEntry } from "../types.ts";
 
-/**
- * A page that renders a block whose component is NOT registered — because
- * its package is missing from service_install.config.block_packages —
- * silently renders BLANK. That is the exact failure behind the 2026-06-04
- * scala-sign regression (sign-in-block dropped from block_packages → the
- * gate + signature fields vanished) which left only a benign boot WARN.
- * This turns that silent blank into a loud, GlitchTip-visible ERROR naming
- * the page + block, throttled to once per (service, block type) so a hot
- * path can never spam it.
- */
 const uncoveredBlocksLogged = new Set<string>();
 
 function collectBlockTypes(node: unknown, out: Set<string>): void {

package/src/register-registry-page-route.ts

@@ -122,22 +122,11 @@ export async function registerRegistryPageRoute(
 	for (const routeRow of serviceRoutes) {
 		const routeConfig = routeRow.config;
 		const pattern = routeConfig.pattern;
-		// loader_slug is a page_route runtime value and resource_loader is runtime
-		// data: a row created after this build is exactly the live-edit case this
-		// module serves, so the generated slug union (a build-time snapshot) can
-		// only be asserted, never enforced, here. An unknown slug still fails
-		// closed below (RegistryConfigMissingError skips the route).
 		const loaderSlug = routeConfig.loader_slug as ResourceLoaderKey;
 		const routeProviders = routeConfig.providers ?? baseProviders;
 
 		let loaderConfig: LoaderConfig | null = null;
 		try {
-			// Boot-time warm + validate: a missing row skips the route (warn),
-			// an invalid row fails closed. resource_loader is NOT on the
-			// deploy-time bake list (constitution installer-and-runtime) — it
-			// is re-read per request via readLiveLoaderConfig below — so this
-			// boot read exists ONLY to catch a misconfigured row early, never
-			// as the source of truth for live rendering.
 			loaderConfig = await loadRegistryConfig(
 				"resource_loader",
 				loaderSlug,
@@ -156,22 +145,12 @@ export async function registerRegistryPageRoute(
 			throw err;
 		}
 
-		// Gate for the static-shell graph cache (see module header).
 		const isStaticShell =
 			!routeConfig.resource_type &&
 			!pattern.includes(":") &&
 			!pattern.includes("*");
 
 		const loadData = async (request: Request) => {
-			// resource_loader is runtime data, not deploy-time baked. Re-read it
-			// per request — loadRegistryConfig's SWR cache makes the fresh-window
-			// hit a memory read, not a DB round trip. Throws into the branded
-			// error path on a vanished or invalid row: the boot-time snapshot
-			// must NEVER silently outlive the row it captured. This is the fix
-			// for the loader-row-edits-look-like-they-don't-work defect (every
-			// edit used to need a service restart; the sign-page-with-brand
-			// `agreement` source added at 22:16 still hadn't reached
-			// __PAGE_DATA__.loaderData at 22:29 — 13 minutes, and never).
 			const liveLoaderConfig = await readLiveLoaderConfig(loaderSlug);
 			const url = new URL(request.url);
 			const params = extractUrlParams(pattern, url.pathname);
@@ -185,10 +164,6 @@ export async function registerRegistryPageRoute(
 				params,
 				isStaticShell,
 				serviceSlug,
-				// Folds the live config into the per-route graphKey so a row edit
-				// invalidates the cached graph immediately (the graph is a
-				// function of the config; without this the SWR graph cache
-				// would still hold the old shape until its fresh window lapsed).
 				configFingerprint: fingerprintLoaderConfig(liveLoaderConfig),
 			});
 			const { sessionUserId, sessionOrgId } = await stampSessionContext(
@@ -203,8 +178,6 @@ export async function registerRegistryPageRoute(
 				resolved,
 				gateCookie,
 				Date.now(),
-				routeConfig.assistant,
-				regionSlots,
 			);
 			const meta = buildMetaFromContext(routeConfig.meta_context, resolved);
 			await applySignInBrandOverride(resolved, request);
@@ -216,13 +189,6 @@ export async function registerRegistryPageRoute(
 		) {
 			meta.title = pageMetaTitle.trim();
 		}
-		// Org-prefixed page titles (feature flag page-title-org-prefix, read
-		// LIVE per request — feature flags are never cached). The title prefix
-		// is the OWNING ORG'S name, never the internal website label
-		// ("Public Pages: <subject>" on a client-facing document was the
-		// defect; operator ruling 2026-08-17). Absent or unreadable flag ⇒
-		// legacy <website.name>: <subject> derivation — the switch fails toward
-		// the pre-flag behaviour, and flipping it back is one registry edit.
 		let orgTitlePrefix = false;
 		try {
 			orgTitlePrefix = (
@@ -233,14 +199,8 @@ export async function registerRegistryPageRoute(
 				)
 			).enabled;
 		} catch {
-			// Flag row absent — legacy derivation.
 		}
 			const themeParam = url.searchParams.get("theme");
-			// ?theme is the EMBED override — only honor it when this page is
-			// actually framed (a form/quiz in a GPT tool panel, sec-fetch-dest:
-			// iframe). A DIRECT visit carrying ?theme= (e.g. copied from a GPT
-			// embed URL) must NOT override the org's DB theme — what the visitor
-			// sees is org-driven, never URL-driven.
 			const isFramedEmbed =
 				request.headers.get("sec-fetch-dest") === "iframe";
 			const themeOverride =
@@ -257,12 +217,6 @@ export async function registerRegistryPageRoute(
 				themeOverride,
 				orgTitlePrefix,
 			);
-			// The matched route params (extractUrlParams + host/path) ride the
-			// per-request pageData so the SSR resolve ctx can scope PUBLIC
-			// block data per request — data_source loaders read ctx.pathParams
-			// (query-data-source); without them a public table would return
-			// every person's rows. Attached AFTER the graph cache (per-request,
-			// never cached with the graph).
 			(pageData as Record<string, unknown>).pathParams = params;
 			const panelSlug = new URL(request.url).searchParams.get("panel");
 			await attachPanelPage(pageData as Record<string, unknown>, panelSlug);
@@ -284,39 +238,22 @@ export async function registerRegistryPageRoute(
 			await applyBrandOrgPath(
 				pageData as Record<string, unknown>,
 				resolved,
-				// brand_org_path is the row schema's own field now — the derived
-				// type sees it, so the narrowing cast the mirror needed is gone.
 				routeConfig.brand_org_path,
 				params,
 				serviceSlug,
 			);
 			warnUncoveredBlocks(pageData, components, serviceSlug, params.path, log);
-			// Detached (NOT awaited into the response). prefetchAiChatSession -> createOrRestore is DB-heavy (~1.1s), per-user, and uncached, and was
-			// awaited on EVERY loadData — the dominant board loadMs cost (confirmed
-			// aiChatPrefetch=1145ms = the full loadMs). Fire it in the background so
-			// it still warms the server-side session (users who open chat find it
-			// warm via their live fetch) without blocking the page response. The SSR
-			// chat seed (pageData.aiChatSession) is sacrificed — chat opens with a
-			// live fetch instead of SSR-instant — the right trade: most loads never
-			// open chat, so eager-awaited prefetch was the waste. orgId is the
-			// URL-derived org (resolveAiOrgId) — see prefetch-org-id.ts for why
-			// segment 1 is preferred over segment 0.
 			const aiOrgId = resolveAiOrgId(new URL(request.url).pathname);
 			void prefetchAiChatSession(resolved, sessionUserId, aiOrgId).catch((err) =>
 				log.warn(
 					`[scala-install:${serviceSlug}] background ai-chat prefetch failed: ${err instanceof Error ? err.message : err}`,
 				),
 			);
-			// Proposal pages: resolve the {{approvalEmail}} button token to the
-			// org's registered company email (creator email as fallback).
 			if (resolved.proposal) {
 				await applyApprovalEmailToken(
 					pageData as Record<string, unknown>,
 					resolved.proposal as { created_by?: string } | undefined,
 				);
-				// Stash the partner logo from the partnerOrg loader source (CRM record
-				// loaded by partner_id) onto pageData.partnerLogo — header fills
-				// automatically, no inline body-Hero prop needed.
 				applyPartnerBrand(
 					pageData as Record<string, unknown>,
 					resolved.partnerOrg as
@@ -324,10 +261,6 @@ export async function registerRegistryPageRoute(
 						| undefined
 						| null,
 				);
-				// Auto-resolve the client's company logo from the clientOrg loader
-				// source (contact → company → crm_organisations.logo_url). Only
-				// injects when the Hero's clientLogo prop is empty — a manually set
-				// logo always wins.
 				applyClientLogo(
 					pageData as Record<string, unknown>,
 					resolved.clientOrg as
@@ -353,10 +286,6 @@ export async function registerRegistryPageRoute(
 			providers: routeProviders,
 			renderMode: routeRenderMode,
 			loadData: loadData as never,
-			// The portal home redirect follows the DECLARED portal_scoped service
-		// fact (see RegistryRouteArgs.portalScoped) — a signed-in user at "/" of
-		// an org-scoped portal belongs at /<websiteId>/<orgId>/dashboard; a
-		// flat-path service (the fleet dashboard) serves its real page at "/".
 			portalHomeRedirect: portalScoped,
 			serviceSlug,
 		});
@@ -374,10 +303,6 @@ export async function registerRegistryPageRoute(
 		});
 
 		registeredPatterns.push(pattern);
-		// Boot-validated snapshot (the LIVE read is per request — see
-		// readLiveLoaderConfig); name the shape so a misconfigured row is
-		// visible at boot, and note the live contract so "my loader edit
-		// didn't take effect" routes to the graph SWR window, not a restart.
 		log.info(
 			`[scala-install:${serviceSlug}] registered registry page route "${pattern}" → resource_loader "${loaderSlug}" (boot-validated: ${describeCapturedLoaderConfig(loaderConfig)}; re-read live per request)`,
 		);

package/src/register-static-assets.ts

@@ -14,10 +14,6 @@ import { isLoopbackHost } from "@teamscala/os/observability/loopback-host";
 import { handleAssetProxy } from "./asset-proxy";
 import { resolveBrandFaviconPath, warmBrandFaviconCache } from "./resolve-brand-favicon";
 
-// Served ONLY when the org has no brand favicon, so the correct colour is the
-// platform brand default rather than a literal. This changes the generic
-// fallback mark from indigo to the canonical slate; any org with its own
-// favicon is unaffected (resolveBrandFaviconPath wins before this is reached).
 const FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="6" fill="${FALLBACK_PRIMARY_COLOR}"/><text x="16" y="23" text-anchor="middle" font-size="20" font-family="system-ui" fill="white">S</text></svg>`;
 
 export async function registerStaticAssets(
@@ -25,9 +21,6 @@ export async function registerStaticAssets(
 	serviceSlug: string,
 	brandOrg?: string,
 ): Promise<void> {
-	// Warm the brand-favicon cache at boot — the S3 existence probe is a 6-21s
-	// cold call that otherwise stalls the first /favicon.ico after every
-	// restart. Fire-and-forget; never blocks boot or a request.
 	warmBrandFaviconCache(brandOrg);
 
 	app.get("/health", (c) =>
@@ -38,16 +31,6 @@ export async function registerStaticAssets(
 		}),
 	);
 
-	// Localhost-gated heap-attribution probe — the heapSize-vs-RSS split (JS heap
-	// vs native: OTel/Prisma-engine/buffers/compiled code) plus the top object
-	// types by count. Read-only, no secrets; gated to a localhost Host so it never
-	// answers over the public domain. Registered here (before auth + page routes)
-	// so it is reachable on every service kind, like /health
-	// (`verify-via-127.0.0.1`, sibling of `runtime-metrics-via-railway-cli`).
-	//
-	// The payload shape lives in @teamscala/os so standalone `Bun.serve` daemons
-	// (scala-guard) answer this probe identically — `scala-tools heap <slug>` must
-	// not mean different things depending on which process replied.
 	app.get("/_heap", async (c) => {
 		if (!isLoopbackHost(c.req.header("host"))) return c.json({ error: "localhost only" }, 403);
 		try {
@@ -61,16 +44,6 @@ export async function registerStaticAssets(
 		}
 	});
 
-	// Build-id: the content hash of the CURRENT client bundle, read FRESH from the asset manifest on every call (never a process-pinned copy) so a
-	// post-restart rebuild reports its new id immediately. The client self-heal (page-client/boot/build-self-heal) polls this on tab refocus; if it differs
-	// from the build the tab booted with, a new build shipped and the open tab is
-	// stale → it reloads. no-store HTML + immutable hashed assets already prevent
-	// staleness on every FRESH load; this is what closes the one remaining hole —
-	// a tab left OPEN across a deploy, holding old HTML pinned to old asset
-	// hashes, with nothing telling it to re-fetch (the "my tablet still shows the
-	// old broken page" class). The id derives from hydratePath exactly as the
-	// SSR-stamped window.__SCALA_BUILD__ does (render-page-html), so they can
-	// never structurally disagree and trigger a reload loop.
 	app.get("/api/build-id", async (c) => {
 		const path = join(process.cwd(), "dist", "client", "asset-manifest.json");
 		let build = "dev";
@@ -84,10 +57,6 @@ export async function registerStaticAssets(
 		return c.json({ build }, 200, { "cache-control": "no-store" });
 	});
 
-	// A branded host (service_install.config.brand_org) never serves the
-	// generic platform mark — both favicon paths resolve the owning org's
-	// icon from its asset store; the generic SVG remains only for hosts
-	// with no declared owner (multi-tenant / infra).
 	app.get("/favicon.svg", async (_c) => {
 		const brand = await resolveBrandFaviconPath(brandOrg);
 		if (brand)
@@ -105,18 +74,10 @@ export async function registerStaticAssets(
 
 	app.get("/favicon.ico", async (c) => {
 		const brand = await resolveBrandFaviconPath(brandOrg);
-		// 302 (not 301): the brand asset is row-driven and must stay
-		// re-resolvable — a permanent redirect would pin stale targets in
-		// browser caches, the exact failure this route exists to end.
-		// cache-control lets the browser cache the redirect (5min) so it
-		// doesn't re-hit the origin per page load — mirrors /favicon.svg.
 		c.header("cache-control", "public, max-age=300");
 		return c.redirect(brand ?? "/favicon.svg", 302);
 	});
 
-	// Same-origin S3 asset proxy: /api/assets/<key> → bucket. Public,
-	// immutable cache, no auth. Canonical URL form for every logo, favicon,
-	// avatar, uploaded asset — emitted by toAssetPath() in @teamscala/core-ui/theme.
 	app.get("/api/assets/*", (c) => handleAssetProxy(c.req.raw));
 
 	app.use("/assets/*", etag());
@@ -137,12 +98,6 @@ export async function registerStaticAssets(
 		return c.notFound();
 	});
 
-	// Extension auto-update files (.crx + updates.xml) served from ./ext/.
-	// Chrome's extension updater fetches updates.xml over plain HTTPS with no
-	// auth, so this route is registered before any auth gate and on every UI
-	// service. Files are served with short-lived cache so updates propagate
-	// promptly. The ./ext/ directory is gitignored and populated by the
-	// extension build pipeline.
 	app.get("/ext/*", async (c) => {
 		const filePath = join(
 			process.cwd(),

package/src/resolve-brand-favicon.ts

@@ -37,15 +37,6 @@ export async function resolveBrandFaviconPath(
 	});
 }
 
-/**
- * Eagerly resolve + cache the favicon at boot so the FIRST user request never
- * pays the S3 existence-probe latency. The probe (`handleAssetProxy` →
- * `s3.file(key).stat()`) is a COLD S3 call — the connection setup to the asset
- * store takes 6s locally / up to 21s in prod, and the in-process cache resets
- * on every restart (deploys, dep-sync). Without warming, the first
- * /favicon.ico after each restart stalls for that duration (operator-reported
- * 23s). Fire-and-forget — runs in the background during boot, never blocks.
- */
 export function warmBrandFaviconCache(brandOrg: string | undefined): void {
 	if (!brandOrg) return;
 	void resolveBrandFaviconPath(brandOrg);