docs(comments): correct comments the cuts left stale

The registration language is read today (preferences.language, the mail language); the Modal and
the players order against popovers through layerStack, not the FloatingTree; the upload's auth
dependency is current_user; the module of access tests covers onboarding and access, not only the
canonical email. The dev proxy's WebSocket upgrade served the removed messages socket and goes; the
test compose header says a pure-logic run needs SIFTLODE_TEST_REQUIRE_DB=0; the speed measure no
longer reports an unreachable database as "no share link".

frontend/e2e/speed.measure.ts

@@ -38,19 +38,17 @@ function shareTokens(): string[] {
     " join media_assets a on a.id = j.asset_id" +
     " where l.password_hash is null and (l.expires_at is null or l.expires_at > now())" +
     " and a.status = 'ready' order by l.id";
-  try {
-    const out = execFileSync(
-      "docker",
-      ["exec", CONTAINER, "psql", "-U", "siftlode", "-d", "siftlode", "-tAc", sql],
-      { encoding: "utf8" },
-    );
-    return out
-      .split("\n")
-      .map((t) => t.trim())
-      .filter(Boolean);
-  } catch {
-    return [];
-  }
+  // Not caught: a database this cannot reach (no docker, a renamed container) is a failed
+  // measurement, not "no playable share link on the local stack".
+  const out = execFileSync(
+    "docker",
+    ["exec", CONTAINER, "psql", "-U", "siftlode", "-d", "siftlode", "-tAc", sql],
+    { encoding: "utf8" },
+  );
+  return out
+    .split("\n")
+    .map((t) => t.trim())
+    .filter(Boolean);
 }
 
 test("speed baseline", async ({ browser, page: page0 }) => {

frontend/src/components/ui/AnchoredPopover.tsx

@@ -28,7 +28,8 @@ import type { useAnchoredPopover } from "./anchoredPopoverHooks";
 //   - autoUpdate → follows the trigger on scroll/resize (the old rAF loop), coalesced by the library
 // Positioning is portalled through FloatingPortal (escapes ancestor stacking contexts — same job the
 // house <Overlay> did for TagsCell). Every popover is a node in the app's <FloatingTree> so Escape /
-// outside-press dispatch is topmost-only across nested layers (the Modal and players included).
+// outside-press dispatch is topmost-only across nested popovers; against the Modal and the players,
+// which are not nodes, it is lib/layerStack that decides who is topmost.
 //
 // This layer adds the keyboard/ARIA model the roles promise, mirroring `ViewSwitcher` (the house's
 // textbook menu) but via Floating UI's idioms rather than a second hand-rolled roving engine:

frontend/src/lib/api/core.test.ts

@@ -434,7 +434,7 @@ describe("the debug session a tab records into", () => {
 
 // P1 — the upload's wire shape is a security boundary, not a detail. A multipart part is a DECLARED
 // body, which the server reads and spools BEFORE its auth dependency runs; the raw body is what lets
-// `require_human` resolve first. A revert to FormData here would silently re-open that, and the
+// `current_user` resolve first. A revert to FormData here would silently re-open that, and the
 // backend's own test only sees the shape the client actually sends.
 describe("uploadDownload's wire shape", () => {
   it("sends the File as the raw body, with the names as percent-encoded headers", () => {

frontend/src/lib/api/downloads.ts

@@ -198,7 +198,7 @@ export const downloadsApi = {
   // show upload progress; any file type is accepted (media gets the full function set, a generic
   // file is download-only). Returns the already-`done` job the ingest creates.
   // The body IS the file, and the two names ride as headers. Not a style choice: a multipart part is
-  // a DECLARED body, which FastAPI reads and spools BEFORE the route's `require_human` dependency
+  // a DECLARED body, which FastAPI reads and spools BEFORE the route's `current_user` dependency
   // runs — so with the old shape an unauthenticated caller could make the server write the whole
   // per-file allowance to temp (P1). Headers are latin-1 on the wire, hence `encodeURIComponent`;
   // the server percent-decodes both. Content-Type is left to the browser (the File's own type).

frontend/src/main.tsx

@@ -77,7 +77,8 @@ const root =
   ) : (
     <QueryClientProvider client={queryClient}>
       {/* One tree for the whole app: every anchored popover registers as a node so Escape and
-          outside-press act only on the topmost layer (the Modal and the players join it too). */}
+          outside-press act only on the topmost popover. The Modal and the players are not nodes:
+          they order against the popovers through lib/layerStack. */}
       <FloatingTree>
         <ConfirmProvider>
           {/* Nothing below renders until the tab knows which account it is: every provider

frontend/vite.config.ts

@@ -12,10 +12,7 @@ const target = "http://127.0.0.1:8080";
 // server returns to :5173 instead of the fixed :8080 callback. (Both are registered in the console.)
 const proxyOpts = { target, changeOrigin: false };
 const proxy = {
-  // ws: the in-app messages socket (/api/messages/ws) is a WebSocket. Without it Vite hands that upgrade
-  // to nobody, so the socket never connects on :5173 — and the first reset on it (a closed tab, a dropped
-  // connection) throws an unhandled ECONNRESET that takes the whole dev server down.
-  "/api": { ...proxyOpts, ws: true },
+  "/api": proxyOpts,
   "/auth": proxyOpts,
   "/healthz": proxyOpts,
 };