chore(hexclave): scrub references to deleted RENAME-TO-HEXCLAVE.md

9 source comments pointed at the planning doc removed in the prior commit.
Drop the 'See RENAME-TO-HEXCLAVE.md' sentence/parenthetical from each;
keep the surrounding substantive context intact (CORS allowlist derivation,
JWT issuer dual-acceptance rationale, OIDC opaque-identifier carve-out
explanation, Hexclave/Stack alias rationale).

apps/backend/src/app/api/latest/integrations/idp.ts

@@ -169,7 +169,7 @@ export async function createOidcProvider(options: { id: string, baseUrl: string,
   // never exposed to OIDC clients (the actual OIDC `aud` claim is set elsewhere).
   // Changing this string rotates ALL outstanding JWT signing keys and invalidates
   // every cached client JWKS — so it is intentionally pinned to the pre-rebrand
-  // domain. Carve-out per RENAME-TO-HEXCLAVE.md ("internal opaque identifiers").
+  // domain (internal opaque identifier — never exposed to clients).
   const privateJwks = await getPrivateJwks({
     audience: `https://idp-jwk-audience.stack-auth.com/${encodeURIComponent(options.id)}`,
   });

apps/backend/src/lib/tokens.tsx

@@ -63,7 +63,7 @@ const getIssuer = (projectId: string, userType: UserType) => {
 // Hexclave rebrand: api.stack-auth.com ↔ api.hexclave.com. During the domain transition a
 // backend served from one host must keep validating tokens issued under the other, so the
 // validator accepts the issuer under both hosts. Signing always uses getIssuer() (the
-// configured host), so new tokens follow the deployment. See RENAME-TO-HEXCLAVE.md (Tier 0, JWT).
+// configured host), so new tokens follow the deployment.
 // Use a Map (not a plain object) for the dynamic host lookup — avoids any chance of a
 // prototype-key collision when the input host comes from an attacker-controlled JWT.
 const issuerHostAliases = new Map<string, string>([

apps/backend/src/proxy.tsx

@@ -54,7 +54,7 @@ const corsAllowedResponseHeaders = [
 ];
 
 // Hexclave rebrand: every `x-stack-*` header is dual-accepted under its `x-hexclave-*` equivalent.
-// Derive the alias names so the CORS allowlists never drift. See RENAME-TO-HEXCLAVE.md (Tier 0).
+// Derive the alias names so the CORS allowlists never drift.
 function withHexclaveHeaderAliases(headers: string[]): string[] {
   return headers.flatMap((header) => header.startsWith('x-stack-')
     ? [header, `x-hexclave-${header.slice('x-stack-'.length)}`]
@@ -125,7 +125,7 @@ export async function proxy(request: NextRequest) {
   // Hexclave rebrand: dual-accept request headers. New SDKs emit `x-hexclave-*`; copy each onto its
   // `x-stack-*` equivalent here — before routing and yup validation — so downstream auth parsing
   // and route schemas (which read `x-stack-*`) keep working unchanged. The new form wins when both
-  // are present. See RENAME-TO-HEXCLAVE.md (Tier 0, HTTP request headers).
+  // are present.
   for (const [name, value] of request.headers) {
     if (name.startsWith('x-hexclave-')) {
       newRequestHeaders.set(`x-stack-${name.slice('x-hexclave-'.length)}`, value);

apps/dashboard/src/proxy.tsx

@@ -35,7 +35,7 @@ const corsAllowedResponseHeaders = [
 ];
 
 // Hexclave rebrand: every `x-stack-*` header is dual-accepted under its `x-hexclave-*` equivalent.
-// Derive the alias names so the CORS allowlists never drift. See RENAME-TO-HEXCLAVE.md (Tier 0).
+// Derive the alias names so the CORS allowlists never drift.
 function withHexclaveHeaderAliases(headers: string[]): string[] {
   return headers.flatMap((header) => header.startsWith('x-stack-')
     ? [header, `x-hexclave-${header.slice('x-stack-'.length)}`]
@@ -60,7 +60,7 @@ export async function proxy(request: NextRequest) {
 
   // Hexclave rebrand: dual-accept request headers — copy each `x-hexclave-*` onto its `x-stack-*`
   // equivalent so downstream API routes that read `x-stack-*` keep working unchanged. The new form
-  // wins when both are present. See RENAME-TO-HEXCLAVE.md (Tier 0, HTTP request headers).
+  // wins when both are present.
   const newRequestHeaders = new Headers(request.headers);
   for (const [name, value] of request.headers) {
     if (name.startsWith('x-hexclave-')) {

packages/template/src/index.ts

@@ -1,6 +1,6 @@
 export * from './lib/stack-app';
 export { getConvexProvidersConfig } from "./integrations/convex";
-// Hexclave aliases — same symbols under the new brand name (see RENAME-TO-HEXCLAVE.md, Tier 1)
+// Hexclave aliases — same symbols under the new brand name
 export type { StackConfig as HexclaveConfig } from "@hexclave/shared/config";
 export { defineStackConfig as defineHexclaveConfig } from "@hexclave/shared/config";
 /** @deprecated Use `HexclaveConfig` instead — same symbol, new brand name. */
@@ -10,7 +10,7 @@ export { defineStackConfig } from "@hexclave/shared/config";
 
 // IF_PLATFORM react-like
 export type { AnalyticsOptions, AnalyticsReplayOptions } from "./lib/stack-app/apps/implementations/session-replay";
-// Hexclave aliases — same symbols under the new brand name (see RENAME-TO-HEXCLAVE.md, Tier 1)
+// Hexclave aliases — same symbols under the new brand name
 export { default as HexclaveHandler } from "./components-page/stack-handler";
 export { useStackApp as useHexclaveApp } from "./lib/hooks";
 export { default as HexclaveProvider } from "./providers/stack-provider";

packages/template/src/lib/stack-app/index.ts

@@ -5,7 +5,7 @@ export {
 } from "./apps";
 
 // Legacy Stack* aliases — same runtime symbols, kept for backwards compatibility.
-// Prefer the Hexclave* equivalents in new code. See RENAME-TO-HEXCLAVE.md (Tier 1).
+// Prefer the Hexclave* equivalents in new code.
 /** @deprecated Use `HexclaveAdminApp` instead — same symbol, new brand name. */
 export { StackAdminApp } from "./apps";
 /** @deprecated Use `HexclaveClientApp` instead — same symbol, new brand name. */