docs(server): finish the stale 'at boot' JSDoc sweep (vendorImportMapEntries, check rule, two comments)

Follow-up to e501ea0, found in the confirming review: vendorImportMapEntries JSDoc still said 'during server boot' (and named the wrong caller); the components-have-register lint-rule description (user-visible in webjs check) said the scanner derives URLs 'at boot'; and two comments in actions.js/dev.js were imprecise about the now-lazy action index. All corrected. The only 'at boot' claims left in source are the genuinely-eager setCoreInstall + .env load, and correct negations.

Author: vivek7405

packages/server/src/actions.js

@@ -109,9 +109,9 @@ export async function buildActionIndex(appDir, dev) {
     fileToHash.set(file, h);
     // Pure-RPC actions are NOT executed at boot: invokeAction and
     // serveActionStub import the module on demand (first RPC call / first stub
-    // fetch), so the hash index above is all that boot needs. Running every
-    // server module at boot (and its transitive Prisma init, DB connects, etc.)
-    // is wasted work. The one thing that DOES need eager loading is expose(),
+    // fetch), so the hash index above is all the analysis needs. Eagerly
+    // running every server module (and its transitive Prisma init, DB
+    // connects, etc.) would be wasted work. The one thing that DOES need eager loading is expose(),
     // which registers a REST route the router must know before any request can
     // hit it. So load only files that REFERENCE expose. We match the bare
     // `expose` identifier (not `expose(`) so an aliased import

packages/server/src/check.js

@@ -62,7 +62,7 @@ export const RULES = [
   {
     name: 'components-have-register',
     description:
-      'Component files that define a class extending WebComponent must register the class with ClassName.register(\'tag\') (or customElements.define). The server-side scanner derives the module URL from the file path at boot.',
+      'Component files that define a class extending WebComponent must register the class with ClassName.register(\'tag\') (or customElements.define). The server-side scanner derives the module URL from the file path.',
   },
   {
     name: 'no-server-env-in-components',

packages/server/src/dev.js

@@ -852,8 +852,9 @@ async function handleCore(req, ctx) {
       // Server-file guardrail: a file matching `.server.{js,ts,mjs,mts}`
       // MUST NEVER be served as source to the browser. The extension is
       // the path-level boundary; we re-verify it on every request (not
-      // just the action-index snapshot taken at boot) so files created
-      // after boot, FS races, or developer error never punch through.
+      // just rely on the action-index snapshot, which is built on the first
+      // request and refreshed on rebuild) so files created later, FS races,
+      // or developer error never punch through.
       //
       // What the browser gets depends on the file's `'use server'` status:
       //   - With `'use server'` => server action: a generated RPC stub

packages/server/src/vendor.js

@@ -428,7 +428,8 @@ export async function jspmGenerate(installs, provider = 'jspm') {
  * api.jspm.io/generate for the full importmap fragment.
  *
  * Async because the Generator API call is networked. Called from
- * `setVendorEntries` during server boot and rebuild; not per request.
+ * `resolveVendorImports` on the first request (and after a rebuild),
+ * inside `ensureReady`; never at boot, and not on every request.
  *
  * @param {Set<string>} bareImports  from scanBareImports()
  * @param {string} appDir