@@ -3,18 +3,23 @@
 /**
  * [#23050 slice 7] The API-description routes of `RestServer` — the discovery
  * document (`GET {basePath}` and `GET {basePath}/discovery`) and the OpenAPI
- * pair (`GET {basePath}/openapi.json` and its `GET {basePath}/docs` viewer) —
- * moved out of `rest-server.ts` whole. Both registrars run once per mounted
- * base, so an environment-scoped deployment mounts each family twice.
+ * document (`GET {basePath}/openapi.json`) — moved out of `rest-server.ts`
+ * whole. Both registrars run once per mounted base, so an environment-scoped
+ * deployment mounts each family twice.
+ *
+ * [#25104] The OpenAPI document's HTML viewer page, `GET {basePath}/docs`,
+ * moved here with it and has since been RETIRED on both route shapes: nothing
+ * read it, and the API origin serves no HTML viewer. A request to that path
+ * meets the host's ordinary not-found answer; the machine-readable document
+ * stays. `rest-docs-viewer-retired.pin.test.ts` pins both halves.
  *
  * A MOVE, not a redesign. The two functions below are the bodies of
  * `RestServer#registerDiscoveryEndpoints` and
  * `RestServer#registerOpenApiEndpoints` as they stood, each re-indented one
- * level — except the viewer page's HTML, a template literal whose lines are
- * runtime text and sit at column 0, kept byte for byte — the same routes,
- * registered in the same order, by the same handlers, answering the same
- * bodies. Every path expression (`basePath`, `realBase`, `unscopedBase`) is
- * as written. The imports only these bodies read moved with them; the two
+ * level — the same routes, registered in the same order, by the same
+ * handlers, answering the same bodies. Every path expression (`basePath`,
+ * `realBase`, `unscopedBase`) is as written. The imports only these bodies
+ * read moved with them; the two
  * registrars share ONE module because they are the one API-description family
  * (`/discovery` advertises the surfaces `/openapi.json` describes), and they
  * still share no code, exactly as before.
@@ -67,8 +72,6 @@
 // half is the class's `probeMcpServeable`, reached through the host.
 import { isMcpServerEnabled } from '@objectstack/types';
 import { handleRouteError, sendThrownError } from './error-response.js';
-// [#25077] The docs viewer page escapes the value it places into its attribute.
-import { escapeHtml } from './html-escape.js';
 import { logError } from './log.js';
 // [#5040 E6] The `api`-metadata endpoints the OpenAPI document folds in.
 import { enrichOpenApiWithEndpoints } from './openapi-endpoints.js';
@@ -447,26 +450,23 @@ export function registerDiscoveryEndpoints(this: DiscoveryRouteHost, basePath: s
 }
 
 /**
- * Register the OpenAPI document and its viewer — `RestServer#registerOpenApiEndpoints`'
+ * Register the OpenAPI document — `RestServer#registerOpenApiEndpoints`'
  * body, called by that method with the server as `this`. The method's own
- * docblock, which the published declaration carries, names the two routes and
+ * docblock, which the published declaration carries, names the route and
  * the request-time enrichment of the document.
  */
 export function registerOpenApiEndpoints(this: OpenApiRouteHost, basePath: string): void {
     const isScoped = basePath.includes('/environments/:environmentId');
 
-    // [#22430] Both API-description endpoints — the document and its
-    // viewer — refuse an anonymous caller with the shared anonymous-deny
-    // 401, the same body the `/data` and `/meta` routes answer (ADR-0056 D2
-    // is default-deny, and no ADR-0138 D2 door class names these two). The
-    // refusal is each handler's FIRST act: before the bundled artifact is
-    // loaded and before any protocol is resolved, so a refused request
-    // costs no work and its answer does not even say whether a document is
-    // bundled here. A signed-in caller is served exactly as before, under
-    // the same ADR-0069 auth-policy gate every other protected route
-    // applies. The viewer page fetches the document from the browser, and
-    // that request carries the browser's session, so a signed-in browser is
-    // served on both endpoints.
+    // [#22430] The API-description document refuses an anonymous caller
+    // with the shared anonymous-deny 401, the same body the `/data` and
+    // `/meta` routes answer (ADR-0056 D2 is default-deny, and no ADR-0138
+    // D2 door class names it). The refusal is the handler's FIRST act:
+    // before the bundled artifact is loaded and before any protocol is
+    // resolved, so a refused request costs no work and its answer does not
+    // even say whether a document is bundled here. A signed-in caller is
+    // served exactly as before, under the same ADR-0069 auth-policy gate
+    // every other protected route applies.
 
     const openApiHandler = async (req: any, res: any) => {
         try {
@@ -487,8 +487,9 @@ export function registerOpenApiEndpoints(this: OpenApiRouteHost, basePath: strin
             // expanded paths) don't bleed into the cached base spec.
             let enriched: any = { ...spec, servers: [...(spec.servers ?? [])] };
 
-            // 1) Override servers[0] with the actual request origin so
-            //    "Try it" works straight from the docs viewer.
+            // 1) Override servers[0] with the actual request origin so a
+            //    client built from this document calls the server that
+            //    served it.
             const host = req.headers?.host ?? req.headers?.['host'];
             const proto = (req.headers?.['x-forwarded-proto'] as string)
                 || (req.protocol as string)
@@ -672,56 +673,4 @@ export function registerOpenApiEndpoints(this: OpenApiRouteHost, basePath: strin
             tags: ['openapi'],
         },
     });
-
-    // Scalar HTML viewer — single inline page that loads the spec from
-    // the sibling /openapi.json endpoint. No build-time bundling, no
-    // server-side render cost.
-    this.routeManager.register({
-        method: 'GET',
-        path: `${basePath}/docs`,
-        handler: async (req: any, res: any) => {
-            try {
-                const environmentId = isScoped ? req.params?.environmentId : undefined;
-                const context = await this.resolveExecCtx(environmentId, req);
-                if (this.enforceAuth(req, res, context)) return;
-
-                // Resolve the openapi.json URL relative to the current
-                // request so the docs page works for any host / scoped
-                // base path (e.g. /api/v1 vs /api/v1/environments/abc).
-                const reqPath: string = req.path || req.url || `${basePath}/docs`;
-                // Strip the trailing /docs to get the API base.
-                const apiBase = reqPath.replace(/\/docs\/?$/, '');
-                const specUrl = `${apiBase}/openapi.json`;
-                // [#25077] Escaped for the attribute it lands in (ruling 3C on
-                // #25040: every outlet that renders a value into HTML escapes it
-                // by context). A path without HTML-special characters renders
-                // byte for byte as before. `html-outlets.pin.test.ts` pins both.
-                const html = `<!doctype html>
-<html>
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>ObjectStack API Docs</title>
-</head>
-<body>
-<script id="api-reference" data-url="${escapeHtml(specUrl)}"></script>
-<script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
-</body>
-</html>`;
-                if (res.setHeader) res.setHeader('content-type', 'text/html; charset=utf-8');
-                if (res.send) res.send(html);
-                else if (res.body) res.body = html;
-                else res.json?.(html);
-            } catch (error: any) {
-                // Only the identity read above can throw here (a
-                // permission-store outage), which keeps its declared answer.
-                logError('[REST] docs viewer error:', error);
-                sendThrownError(res, error);
-            }
-        },
-        metadata: {
-            summary: 'Interactive API docs (Scalar viewer)',
-            tags: ['openapi'],
-        },
-    });
 }
@@ -204,8 +204,9 @@ const EXTRA_MOVED_REGISTRARS: Readonly<Partial<Record<(typeof SITE_FILES)[number
  * so whose host literals hand over no forwarder — measured by the AST walk of
  * the body, not assumed. `registerDiscoveryEndpoints`' body resolves no caller
  * (the discovery document is served to anyone), so its host literal names no
- * `resolveExecCtx` member; its module's other registrar, the OpenAPI pair,
- * reads it twice and carries the forwarder. A body that starts reading the
+ * `resolveExecCtx` member; its module's other registrar, the OpenAPI
+ * document's, reads it once (twice until its `/docs` viewer page was retired,
+ * #25104) and carries the forwarder. A body that starts reading the
  * seam gains a forwarder, and §2's exact count reds until this entry goes.
  *
  * [#23050 slice 11] `registerFormEndpoints`' body reads no `resolveExecCtx`
@@ -488,7 +489,13 @@ describe('[#13160] §1 the production supplier fulfils with `undefined` rather t
 // ---------------------------------------------------------------------------
 
 describe('[#13160] §2 the consumer surface, counted from the tree', () => {
-    it('62 invocation sites, 77 mentions — the thread\'s two control numbers hold', () => {
+    it('61 invocation sites, 144 mentions — the thread\'s two control numbers hold', () => {
+        // [#25104] 62 → 61 sites / 145 → 144 mentions: the OpenAPI document's
+        // `/docs` viewer page retired with its route, taking one BARE site
+        // (46 → 45) from `discovery-routes.ts` with it and no prose mention. The
+        // caught half (16) is untouched, and so is the forwarder count: the
+        // OpenAPI body still reads the seam, for the document.
+        //
         // [ADR-0131 cutover, stage 7-pre] 63 → 62 sites / 78 → 77 mentions:
         // the permission-set overlay-discard route retired, taking one BARE
         // site (47 → 46) with it and no prose mention. The caught half (16)
@@ -833,8 +840,8 @@ describe('[#13160] §2 the consumer surface, counted from the tree', () => {
         // counted as the history module's second registrar in BOTH maps and the new
         // module in `MOVED_REGISTRARS_READING_NO_EXECCTX`.
         expect(SITE_FILES).toHaveLength(18);
-        expect(SITES.length).toBe(62);
-        expect([...SOURCES.values()].reduce((n, text) => n + text.split('resolveExecCtx').length - 1, 0)).toBe(145);
+        expect(SITES.length).toBe(61);
+        expect([...SOURCES.values()].reduce((n, text) => n + text.split('resolveExecCtx').length - 1, 0)).toBe(144);
         const extraMovedRegistrars = Object.values(EXTRA_MOVED_REGISTRARS).reduce((n, k) => n + (k ?? 0), 0);
         expect(extraMovedRegistrars).toBe(4);
         const registrarsReadingNoExecCtx = Object.values(MOVED_REGISTRARS_READING_NO_EXECCTX).reduce((n, k) => n + (k ?? 0), 0);
@@ -843,7 +850,7 @@ describe('[#13160] §2 the consumer surface, counted from the tree', () => {
             .toHaveLength(SITE_FILES.length - 1 + extraMovedRegistrars - registrarsReadingNoExecCtx);
     });
 
-    it('the split is 16 locally caught / 46 bare — NOT 12 / 46, which does not add to 62', () => {
+    it('the split is 16 locally caught / 45 bare — NOT 12 / 45, which does not add to 61', () => {
         // 12 sites spell the catch on the invocation line; 4 more spell it on
         // the continuation line. A single-line grep sees 12 and the arithmetic
         // silently loses four sites. [#20237] 15 → 13 and 23 → 21: the list
@@ -857,42 +864,42 @@ describe('[#13160] §2 the consumer surface, counted from the tree', () => {
         const sameLine = CAUGHT.filter((s) => SOURCES.get(s.file)!.split('\n')[s.line - 1].includes('.catch('));
         expect(sameLine.length).toBe(12);
         expect(CAUGHT.length).toBe(16);
-        expect(BARE.length).toBe(46);
+        expect(BARE.length).toBe(45);
         expect(CAUGHT.length + BARE.length).toBe(SITES.length);
     });
 
-    it('⭐ every one of the 46 bare sites is guarded on the VERY NEXT LINE, and none of the 16 caught ones is', () => {
+    it('⭐ every one of the 45 bare sites is guarded on the VERY NEXT LINE, and none of the 16 caught ones is', () => {
         // This inverts the reason the thread gave for doing the bare sites
         // first ("no local signal that a fault becomes an anonymous subject").
         // The bare sites are bare BECAUSE the shared anonymous floor is the
         // next statement; the locally-caught ones carry a `.catch` because
         // they are NOT behind that floor and each must decide for itself.
-        expect(BARE.filter((s) => s.nextLine === ENFORCE_AUTH_GUARD).length).toBe(46);
+        expect(BARE.filter((s) => s.nextLine === ENFORCE_AUTH_GUARD).length).toBe(45);
         expect(CAUGHT.filter((s) => s.nextLine === ENFORCE_AUTH_GUARD).length).toBe(0);
     });
 });
 
 // ---------------------------------------------------------------------------
-// 3. The 46 bare sites, driven
+// 3. The 45 bare sites, driven
 // ---------------------------------------------------------------------------
 
-describe('[#13160] §3 the 46 bare sites — driven, every one of them', () => {
-    it('all 46 are reached by the mounted route table, so none is classified by inference', async () => {
+describe('[#13160] §3 the 45 bare sites — driven, every one of them', () => {
+    it('all 45 are reached by the mounted route table, so none is classified by inference', async () => {
         const reached = sitesOf(await sweep(undefined, 'FULL'));
         const unreached = BARE.map((s) => s.key).filter((k) => !reached.has(k));
         // ⛔ A bare site that stopped being reachable must show up as a
         // shrinking census, never as a row silently inherited from a neighbour.
         expect(unreached).toEqual([]);
     }, 120_000);
 
-    it('an absent context is the ANONYMOUS SUBJECT at all 46: 401 UNAUTHENTICATED, and the same instrument serves an entitled caller', async () => {
+    it('an absent context is the ANONYMOUS SUBJECT at all 45: 401 UNAUTHENTICATED, and the same instrument serves an entitled caller', async () => {
         const fault = await sweep(undefined, 'FULL');
         const control = await sweep(ENTITLED, 'FULL');
         const bareLines = new Set(BARE.map((s) => s.key));
         const controlByRoute = new Map(control.map((r) => [r.route, r]));
 
         const rows = fault.filter((r) => r.sites.some((l) => bareLines.has(l)));
-        expect(rows.length).toBeGreaterThanOrEqual(46);
+        expect(rows.length).toBeGreaterThanOrEqual(45);
 
         for (const row of rows) {
             expect(row.status, `${row.route} under an absent context`).toBe(ANONYMOUS_DENY_STATUS);