Module web 

The web UI, embedded at build time (build.rs; kernel spec §7): the router’s fallback, so it answers only paths no route claims.

• /api and /api/…, and /mcp/… (the gateway’s proxy, umbrella §8): a JSON 404, whatever the method. Never the app.
• Any method but GET and HEAD: a JSON 404.
• A file of the build: the file. Hashed files (/assets/…) are cached for good; the rest revalidate with their ETag.
• A missing file under /assets/: a plain 404, so a stale chunk fails rather than running the page as a script.
• Anything else: index.html, whose router shows the route.

The page holds no data, so the fallback sits outside the browser rules and the cookie: a link opened from another site loads the app, and the app’s API calls are where those rules apply. Every answer is nosniff; every file and page is no-referrer, /index.html asked for by name included, and /setup’s no-store (kernel spec §3.1). The Content-Security-Policy comes from csp::on_html over the whole router.

Constants

EMBEDDED

The real UI is embedded.

Functions

serve

The router’s fallback.

ui_embedded

Whether the real UI is embedded, not the placeholder.