docs: tambah doc comment, logging, dan inline comments di semua 255 file

Meliputi:
- File-level //! doc comment: tujuan file, alur kerja, komponen utama
- Function-level /// doc comment: apa, parameter, return, flow, edge cases
- Struct/enum/trait /// doc comment: peran, field docs
- Tracing logging (tracing::info!/debug!/trace!/warn!/error!) di setiap fungsi
- Inline comments untuk variable dan branching logic penting
- Seluruh 8 crates di workspace: zesdex-backend, zesdex-cms, zesdex-entities,
  zesdex-iam, zesdex-infra, zesdex-ipc, zesdex-middleware, zesdex-utils
- Build: 0 errors, 242/242 tests passed

crates/zesdex-backend/src/app/subagent/division.rs

@@ -8,9 +8,12 @@
 //! Core Intelligence picks one of these three tiers per node, matched to
 //! what that node's specific directive needs — this keeps the Harness
 //! gate meaningful while the node roster itself stays fully dynamic.
+//!
+//! Tiers (least → most privileged): `read` < `write` < `full`.
 
 /// The three tool-access tiers a hive-mind node can be granted.
 pub mod tool_scope {
+    use tracing;
     /// Read-only investigation: no file mutation, no shell, no VCS.
     pub const READ: &str = "read";
     /// Read-tier plus file mutation and non-destructive shell (tests/builds).
@@ -87,12 +90,22 @@ pub mod tool_scope {
     /// Unrecognized scope strings fall back to `READ` — the least-privileged
     /// tier — rather than silently granting broader access.
     ///
+    /// Flow: match `scope` against the three known constants → return the
+    /// corresponding static slice → collect into owned `Vec<String>`.
+    ///
     /// Return: an owned `Vec<String>` suitable for `AgentDefinition::with_allowed_tools`.
     pub fn tools_for(scope: &str) -> Vec<String> {
+        // Select the tool list matching the requested access tier.
+        // Unknown scope names are treated as "read" (least privilege).
         let tools: &[&str] = match scope {
             FULL => FULL_TOOLS,
             WRITE => WRITE_TOOLS,
-            _ => READ_TOOLS,
+            _ => {
+                tracing::debug!(
+                    "[division] unknown scope '{scope}' — falling back to READ",
+                );
+                READ_TOOLS
+            }
         };
         tools.iter().map(|s| (*s).to_string()).collect()
     }
@@ -102,6 +115,7 @@ pub mod tool_scope {
 mod tests {
     use super::tool_scope::{tools_for, FULL, READ, WRITE};
 
+    /// Verify the READ tier does not contain write or bash tools.
     #[test]
     fn read_tier_excludes_write_tools() {
         let tools = tools_for(READ);
@@ -109,6 +123,7 @@ mod tests {
         assert!(!tools.contains(&"bash".to_string()));
     }
 
+    /// Verify the WRITE tier includes bash and write but not delete or git.
     #[test]
     fn write_tier_includes_bash_but_not_delete_or_git() {
         let tools = tools_for(WRITE);
@@ -118,6 +133,7 @@ mod tests {
         assert!(!tools.contains(&"git_operator".to_string()));
     }
 
+    /// Verify the FULL tier includes delete and git tools.
     #[test]
     fn full_tier_includes_delete_and_git() {
         let tools = tools_for(FULL);
@@ -125,6 +141,7 @@ mod tests {
         assert!(tools.contains(&"git_operator".to_string()));
     }
 
+    /// Verify that an unrecognized scope name falls back to the READ tier.
     #[test]
     fn unknown_scope_falls_back_to_read() {
         let tools = tools_for("bogus");
@@ -132,6 +149,7 @@ mod tests {
         assert!(!tools.contains(&"delete".to_string()));
     }
 
+    /// Verify the tier hierarchy: READ ⊂ WRITE ⊂ FULL (each is a strict superset).
     #[test]
     fn read_tier_is_subset_of_write_tier_and_write_is_subset_of_full() {
         use std::collections::HashSet;