Remove over-comments, dead code, and duplicate logic (#375)

## Summary

Repo-wide quality cleanup. No intended behavior change, and no public
API change.

```
area                          change
packages/void/src/cli         merge copied helpers, drop unused exports and labels
packages/void (other)         merge runtime/pages/migrations copies, fix stale docs
platform/packages/api         merge copied queries and flows, drop 1 duplicate test
platform (other)              5 HMAC copies -> proxy/src/hmac.ts, drop unused props
deploy-*, edge, isr, md, UI   use isRecord and shared helpers, drop pages-manifest.ts
docs, playground, test/       fix stale facts, replace repeated text with links
```

- Remove comments that restate code, bug-fix history, and stale notes.
- Delete unused functions, exports, parameters, branches, and tests.
Each deletion was checked with a repo-wide search.
- Replace copied logic with existing or shared helpers.

## Shared helpers

- `void/pages-client` now exports `getValidationErrors`,
`mergeDataIntoHref` and `isModifiedEvent` from a new leaf module
(`packages/void/src/pages/adapter-helpers.ts`, no runtime imports). The
React, Vue, Svelte and Solid adapters import them instead of keeping 16
copies. `hasPrefetch` stays local because the Solid copy differs.
- `platform/packages/api/src/auth/hmac.ts` now exports
`constantTimeEqual`. It replaces `timingSafeEqual`,
`constantTimeHexEqual` and `sameSecret`. All inputs are ASCII (UUID or
hex), so results are unchanged. The compare method (JS loop) is
unchanged.

## Fixes found during the cleanup

- `voidVue()` now accepts `prefetch: { hoverDelay, cacheFor }`, like
React, Svelte and Solid. The Vue pages plugin already supported it, but
the option was never passed.
- `void gen model` keeps `name:type?` columns nullable. The Drizzle
column code always added `.notNull()`.
- **Breaking:** names that start with `__VOID_` are reserved. If `.env`
or `env.ts` defines one, `vp dev`, `vite build` and `void env check`
stop with an error that names the keys. Before, dev warned that it
ignored `__VOID_PROXY_TOKEN`, but Wrangler still loaded it, so the
working trigger header depended on whether `env.ts` declared required
keys.
- In dev, `/__void/scheduled` and `/__void/queue` accept only
`x-void-dev-trigger`, and the dev hint always prints that header. The
rule is fixed at compile time from the dev server flag, so builds made
with `NODE_ENV=development` keep the proxy token and build key rule.
`jobs.md` and `queues.md` no longer say that a `.env` token takes
priority.
- Reserved-name checks read `.env` with the same grammar as Wrangler, so
`export __VOID_X=1` and `__VOID_X: 1` are rejected too.
- Production builds keep every local `.env` client value out of the
bundle. The strip used to miss lines Vite still loads (`export
VITE_X=1`, values with an inline `#` comment, dotted keys). It now reads
keys with Vite's own parser, keeps values from the shell or the `vp run`
task runner, and does nothing when Vite loads env files from another
`envDir`.
- Void reads `.env` values with Vite's parser (`node:util` `parseEnv`)
everywhere it reads `.env` (for example `DATABASE_URL`, auth, `void env
check`). `export KEY=value`, inline `#` comments, quoted escapes and
multi-line values now read the same as in Vite and Wrangler. An unquoted
value ends at the first `#` (for example `postgres://h/db#x` reads as
`postgres://h/db`), as Vite and Wrangler already do. Quote a value that
must contain `#`.
- `NODE_ENV`, `BROWSER` and `BROWSER_ARGS` from `.env` no longer reach a
production bundle through the copies Vite writes into `process.env`.
- `GET /admin/` runs the admin auth check once instead of twice.
- `react-island-hydration` uses its own Vite `cacheDir`. It shared
`packages/react/node_modules/.vite` with
`react-pages-navigation-fallback`, and the second suite timed out when
both ran together.
- The kitchen sink smoke test shows the searched text in its row errors.
- `packages/void/AGENTS.md` describes how `void gen migration` uses
`drizzle-kit generate --custom`.

## Small observable differences

- Framework deploys print the `routing.notFound` warning after the lint
warnings, not between them.
- The admin build table shows durations for timestamps written with
`+00:00` or a space.
- `head.ts` skips null attributes instead of throwing. The type allows
strings only.
- The migration single-statement check strips a leading BOM.
- `build-runtime.mjs` reports a bad migration journal with the manifest
parser's message.

## Not changed

- Public exports that nothing uses yet stay, because they are reachable
from package `exports`.
- `deploy-direct-r2.test.ts` stays as it was, because the schema-compat
script pins its checksum.

## Verification

- `vp run build:all`
- `vp run check`
- `vp lint`, `vp fmt --check`
- `vp test run`: all files pass after `build:all`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Brooooooklyn

docs/.vitepress/theme/FileTree.vue

@@ -365,7 +365,6 @@ const TreeNode = defineComponent({
   color: var(--vp-c-brand-1);
 }
 
-/* Adapter tabs */
 /* Adapter tabs */
 .adapter-tabs {
   display: flex;

docs/guide/ai.md

@@ -41,7 +41,7 @@ export const POST = defineHandler(async (c) => {
 });
 ```
 
-AI methods return promises. Await them to receive the result, or return the promise directly from a handler. Usage limits reject with [`UsageLimit`](#usage-limits); Void route handlers and Pages actions automatically send a structured HTTP 429 when it is left uncaught.
+AI methods return promises. Await them to receive the result, or return the promise directly from a handler. See [Usage Limits](#usage-limits) for limit errors.
 
 You can use any model available through Cloudflare's AI binding, including Workers AI models such as `@cf/meta/llama-3.3-70b-instruct-fp8-fast` and Cloudflare Gateway models such as `google/gemini-2.5-flash` or `openai/gpt-4.1-mini`. The input object must match the selected Cloudflare model's schema. Models that return binary data, such as generated images, are returned as a `Blob` from `ai.run()`.
 

docs/guide/auth.md

@@ -92,7 +92,7 @@ Email/password is enabled by default. To add social providers:
 }
 ```
 
-Use `auth.providers` when you want to enable social providers explicitly. Provider credentials come from `AUTH_<PROVIDER>_CLIENT_ID` and `AUTH_<PROVIDER>_CLIENT_SECRET`.
+Provider credentials come from `AUTH_<PROVIDER>_CLIENT_ID` and `AUTH_<PROVIDER>_CLIENT_SECRET`.
 
 See the full provider list in the [config reference](../reference/config.md#auth).
 

docs/guide/database/postgresql.md

@@ -59,7 +59,7 @@ export const users = pgTable('users', {
 });
 ```
 
-`void gen model` generates PostgreSQL-appropriate code when the dialect is set to `postgresql`.
+`void gen model` generates PostgreSQL-appropriate code when `database` is set to `"pg"`.
 
 ## Migrations
 
@@ -88,4 +88,4 @@ To update a linked Void project's connection, for example after moving the datab
 void db set-url
 ```
 
-This prompts for the new connection string and updates the Hyperdrive configuration. The change takes effect on the next deploy.
+This prompts for the new connection string and updates the Hyperdrive configuration.

docs/guide/edge/rewrites.md

@@ -109,15 +109,13 @@ The file can include [3xx redirects](./redirects) too. Rules in `void.config.ts`
 
 ## Client navigation
 
-Rewrites run on the server. In Pages mode, a client-side `<Link to="/docs">` navigation may fetch loader data for `/docs` rather than the rewritten route `/en/docs`.
+Rewrites run on the server. In Pages mode, a client-side `<Link href="/docs">` navigation may fetch loader data for `/docs` rather than the rewritten route `/en/docs`.
 
 Use `<a href="/docs">` to make a full server request when the destination has a different loader. Use a redirect if the URL should change.
 
 ## ISR cache keys with rewrites
 
-Static rewrites cache the destination separately for each original pathname. Query parameters vary the cache only when included in `routing.revalidateQueryAllowlist`. Middleware rewrites don't create a separate cache variant.
-
-Purge the destination with `revalidate({ paths: ['/en/docs/foo'] })` to clear direct and rewritten requests. Purging only `/docs/foo` does not clear that entry. See [Revalidation](./revalidation).
+Purge the destination path, such as `/en/docs/foo`, to clear rewritten cache entries. See [Cache keys and rewrites](./revalidation#cache-keys-and-rewrites).
 
 ## Debugging with `X-Void-Routing`
 

docs/guide/email/sending.md

@@ -59,8 +59,6 @@ Cloudflare emails the recipient with a verification link. Once they click it and
 void email destinations
 ```
 
-The project owner’s email is added automatically, but still needs verification as described in [Setup](#setup).
-
 ::: warning When this is the right fit
 The shared sender suits team alerts, project notifications, and replies to inbound mail.
 

docs/guide/env-vars.md

@@ -39,8 +39,12 @@ STRIPE_KEY=sk_test_example
 VITE_API_ORIGIN=http://localhost:5173
 ```
 
+An unquoted value ends at `#`, which starts a comment. Quote a value that contains `#`, such as `DATABASE_URL="postgres://user:p#ss@localhost/my-app"`.
+
 Keep `.env` out of Git. Other dotenv files, including `.env.local`, `.env.production`, `.env.example`, and Wrangler’s `.dev.vars*`, are not supported.
 
+Names starting with `__VOID_` are reserved for Void. Void stops with an error if `.env` or `env.ts` defines one.
+
 Run the local check at any time:
 
 ```sh

docs/guide/jobs.md

@@ -70,8 +70,6 @@ curl -X POST http://localhost:5173/__void/scheduled \
   -d '{"cron":"0 * * * *","scheduledTime":'"$(date +%s000)"'}'
 ```
 
-If you set `__VOID_PROXY_TOKEN` in `.env`, that explicit token takes precedence and the printed curl command uses `x-void-internal: <your-token>` instead.
-
 The endpoint works in native Void apps and supported frameworks. Framework jobs run in the adapter's development runtime and use the bindings it provides.
 
 ## Deployment behavior

docs/guide/pages-routing/markdown.md

@@ -401,7 +401,7 @@ Code blocks include a copy button.
 
 ### Line Numbers
 
-Enable per code block with `:line-numbers` or disable with `:no-line-numbers`:
+Enable per code block with `:line-numbers`:
 
 ````md
 ```ts :line-numbers
@@ -412,14 +412,6 @@ const b = 2;
 
 Start from a specific number with `:line-numbers=5`.
 
-### Snippet Imports
-
-Import code from external files:
-
-```md
-<<< ./path/to/file.ts
-```
-
 ### Emoji
 
 Shortcodes convert to unicode: `:tada:` becomes :tada:, `:rocket:` becomes :rocket:.
@@ -455,16 +447,16 @@ Headings include permalink anchors. Use `[[toc]]` for a table of contents. Image
 ```ts
 voidMarkdown({
   shiki: {
-    themes: { light: 'github-light', dark: 'github-dark' }, // Shiki themes
-    langs: ['sql', 'graphql'], // additional languages
+    themes: { light: 'github-light', dark: 'github-dark' },
   },
 });
 ```
 
-| Option         | Type                             | Default                                          | Description                  |
-| -------------- | -------------------------------- | ------------------------------------------------ | ---------------------------- |
-| `shiki.themes` | `{ light: string; dark: string}` | `{ light: "github-light", dark: "github-dark" }` | Shiki color themes           |
-| `shiki.langs`  | `string[]`                       | Common web languages                             | Additional languages to load |
+| Option         | Type                             | Default                                          | Description        |
+| -------------- | -------------------------------- | ------------------------------------------------ | ------------------ |
+| `shiki.themes` | `{ light: string; dark: string}` | `{ light: "github-light", dark: "github-dark" }` | Shiki color themes |
+
+Code block languages load on demand from Shiki's bundled languages.
 
 ## Building a Sidebar
 

docs/guide/platform/administration/access.md

@@ -30,15 +30,7 @@ the company sign-in before Void login. Interactive Access authentication uses a
 locally installed `cloudflared` and saves its short-lived credential in your
 system keychain for that platform origin. You do not need to copy browser cookies.
 
-For CI, use a [project deploy token](/guide/platform/installation/first-deployment) alongside your Access credentials. An Access service token does not authorize a Void deployment.
-
-Store Access credentials in origin-keyed `VOID_ACCESS_CREDENTIALS`. A deploy
-that uses prerendering or remote bindings needs entries for both the exact API
-and proxy HTTPS origins, even when both entries contain the same admitted
-service-token pair. `VOID_ACCESS_ORIGIN` selects only one recipient and therefore
-cannot cover both calls. Keep the JSON value in your secret manager, not in
-application configuration. See [CI deployment setup](/guide/platform/installation/first-deployment)
-for the required shape.
+For CI, use a [project deploy token](/guide/platform/installation/first-deployment) alongside your Access credentials in origin-keyed `VOID_ACCESS_CREDENTIALS`. An Access service token does not authorize a Void deployment. See [CI deployment setup](/guide/platform/installation/first-deployment) for the required origins and shape.
 
 ## Choosing a Platform