style: trim narration comments from recent changes

src/utils/activities.ts

@@ -41,19 +41,13 @@ type Actor = { player_id?: string };
 
 type ServerFnMeta = { name?: string };
 
-// Start's default generateFunctionId hashes the entry id, so the URL segment is
-// a sha256 and the compile-time meta is the only readable name. The path stays
-// as the fallback for requests that carry no meta.
+// The URL segment is a hash of the fn id; serverFnMeta carries the readable name.
 const serverFnName = (request: Request, meta?: ServerFnMeta): string => {
   if (meta?.name) return meta.name;
   const pathParts = new URL(request.url).pathname.split("/").filter(Boolean);
   return pathParts[pathParts.length - 1] || "unknown";
 };
 
-// The admin middleware refuses before serverFnLoggingMiddleware ever runs, so
-// a denial has to write its own row — otherwise an operator reviewing the log
-// during a probing attempt sees a clean history. The rejected payload is left
-// out: it never reached a validator, so it is unbounded attacker input.
 export const recordDeniedServerFn = (
   request: Request,
   actor?: Actor,
@@ -85,7 +79,6 @@ export const serverFnLoggingMiddleware = createMiddleware({
     const result = await next();
     const duration = Date.now() - startTime;
 
-    // Single audit writer; toServerResult resolves { success:false } instead of throwing, so read the flag.
     const envelope = (result as { result?: unknown })?.result;
     const failed =
       !!envelope &&