@teamscala/service-boot 0.23.284

package/src/handlers/scala-tools-currency-watch.ts

@@ -0,0 +1,171 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The `scala-tools-currency-watch` pg-boss handler — keeps scala-sentinel's
+ * INSTALLED @teamscala/scala-tools at registry `latest` (open migration
+ * `daemon-scala-tools-currency`). scala-sentinel resolves scala-tools via its
+ * own node_modules (the installed copy), which goes STALE on every
+ * @teamscala/scala-tools publish until a manual deps install + restart — so the
+ * daemon's publish-chain + codegen trio run OLD scala-tools while workspace
+ * source is current (incident #58). This watch polls the registry dist-tag and,
+ * when scala-sentinel's installed copy lags, REINSTALLS it. It does not restart
+ * anything: sentinel spawns `node_modules/.bin/scala-tools` per invocation
+ * rather than importing it, so the next spawn picks up the new binary. See the
+ * no-restart note at the call site for the evidence and for why the restart that
+ * used to live there was disabling enforcement on every publish.
+ *
+ * Boot-safety (protective-layers-fail-explicitly): every step is wrapped — a
+ * dist-tag fetch failure, a version-parse failure, OR an install failure NEVER
+ * crashes the job or loga; each records a failure event + returns. Repeated
+ * reinstalls are prevented by strict semver-lt (re-installs only when installed
+ * is genuinely behind latest) + the idempotent --force-resolve install.
+ * Subprocesses go through @teamscala/os spawn (the single spawn surface).
+ *
+ * Registered under slug `@teamscala/service-boot:scala-tools-currency-watch`.
+ */
+import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
+import { recordEvent } from "@teamscala/event-log/record-event";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { workspaceRoot } from "@teamscala/os/host-paths";
+import { spawn } from "@teamscala/os/spawn";
+import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
+
+const PKG = "@teamscala/scala-tools";
+const SENTINEL_DIR = `${workspaceRoot()}/scala-sentinel`;
+const INSTALLED_PKG_JSON = `${SENTINEL_DIR}/node_modules/@teamscala/scala-tools/package.json`;
+
+interface PkgJson {
+	version: string;
+}
+
+function parseSemver(v: string): [number, number, number] | null {
+	const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v.trim());
+	return m ? [Number(m[1]!), Number(m[2]!), Number(m[3]!)] : null;
+}
+
+/** Strict a < b on major.minor.patch (pre-releases ignored — latest is a stable dist-tag). */
+function semverLt(a: string, b: string): boolean {
+	const pa = parseSemver(a);
+	const pb = parseSemver(b);
+	if (!pa || !pb) return false;
+	for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i]! < pb[i]!;
+	return false;
+}
+
+async function scalaToolsCurrencyWatch(_ctx: { config: ScheduledJobConfig }): Promise<void> {
+	const log = getAppLogger();
+	try {
+		const installedPkg = await Bun.file(INSTALLED_PKG_JSON).json() as PkgJson;
+		const installed = installedPkg.version;
+
+		const distTag = await spawn({
+			name: "scala-tools-currency-watch:dist-tag",
+			command: ["scala-tools", "packages", "dist-tag", "get", PKG, "latest"],
+			timeoutMs: 30_000,
+		});
+		// dist-tag get prints the version (last non-empty line).
+		const latest =
+			(distTag.stdout ?? "")
+				.split("\n")
+				.map((l) => l.trim())
+				.filter(Boolean)
+				.pop() ?? "";
+		if (!latest || !parseSemver(latest)) {
+			log.warn(
+				`[scala-tools-currency-watch] no readable latest (exit=${distTag.exitCode}, stdout=${(distTag.stdout ?? "").slice(0, 80)}) — skip`,
+			);
+			recordEvent({
+				kind: "scala-tools.currency.tick",
+				payload: { installed, latest: null, note: "dist-tag fetch unreadable" },
+			});
+			return;
+		}
+
+		if (!semverLt(installed, latest)) {
+			recordEvent({
+				kind: "scala-tools.currency.tick",
+				payload: { installed, latest, status: "current" },
+			});
+			return;
+		}
+
+		// STALE — reinstall + restart.
+		log.warn(
+			`[scala-tools-currency-watch] scala-sentinel ${PKG} ${installed} < latest ${latest} — reinstalling + restarting`,
+		);
+		const install = await spawn({
+			name: "scala-tools-currency-watch:deps-install",
+			command: ["scala-tools", "deps", "install", "--force-resolve"],
+			cwd: SENTINEL_DIR,
+			timeoutMs: 300_000,
+		});
+		if ((install.exitCode ?? -1) !== 0) {
+			log.error(
+				`[scala-tools-currency-watch] deps install failed (exit ${install.exitCode}) — NOT restarting to avoid boot-looping the enforcement daemon: ${(install.stderr ?? "").slice(0, 200)}`,
+			);
+			recordEvent({
+				kind: "scala-tools.currency.install-failed",
+				payload: {
+					installed,
+					latest,
+					exitCode: install.exitCode,
+					stderr: (install.stderr ?? "").slice(0, 300),
+				},
+			});
+			return;
+		}
+		recordEvent({
+			kind: "scala-tools.currency.reinstalled",
+			payload: { from: installed, to: latest },
+		});
+
+		// NO RESTART. The reinstall alone is sufficient, and restarting here was
+		// actively harmful.
+		//
+		// The premise this watch was written on — "restart so the fresh
+		// scala-tools loads" — does not hold for THIS package. scala-sentinel never
+		// imports `@teamscala/scala-tools`; it SPAWNS `node_modules/.bin/scala-tools`
+		// per invocation, so a freshly installed binary is picked up by the next
+		// spawn with no process restart at all. Verified 2026-07-27: the package is
+		// declared in scala-sentinel/package.json, yet scala-guard/src contains zero
+		// import statements resolving to it — it is spawned, never linked.
+		// dep-sync already encodes the same conclusion — HARNESS_CRITICAL_FAST_PATH
+		// maps this exact pair to install-WITHOUT-restart, while its PM2_CACHED
+		// sibling map exists for packages a daemon really does load at boot
+		// (@teamscala/codegen → codegen-daemon). This handler was the odd one out.
+		//
+		// The cost was not theoretical. Restarting the guard daemon takes
+		// enforcement offline for its warmup, and every shutdown logs "152 guard(s)
+		// failed to run (fail-open)" — so each unnecessary restart opened a window
+		// in which tool-check, turn-end and pre-push silently did not run. Three
+		// scala-tools versions published on 2026-07-26 alone, and this watch polls,
+		// so it re-fired for each. That inverts
+		// `infrastructure-outranks-application-durability`: a currency convenience
+		// was repeatedly disabling the thing it exists to keep current.
+		//
+		// It also used a bare `pm2 restart`, which is forbidden
+		// (`forbid-bare-pm2-restart`) precisely because it bypasses the
+		// currency-gated canonical pipeline — the guard blocks agents from that
+		// exact call.
+		//
+		// If a future package genuinely needs a restart to take effect, it does not
+		// belong here: add it to dep-sync's PM2_CACHED map, which already owns
+		// install-plus-restart and coalesces them.
+		log.info(
+			`[scala-tools-currency-watch] reinstalled ${PKG} ${installed} → ${latest} (no restart: sentinel spawns the binary, it does not import it)`,
+		);
+	} catch (err) {
+		// Boot-safety: never propagate — record + return (a watch error must not crash loga).
+		log.error(
+			`[scala-tools-currency-watch] caught — fail-open (no restart): ${err instanceof Error ? err.message : String(err)}`,
+		);
+		recordEvent({
+			kind: "scala-tools.currency.watch-error",
+			payload: { error: err instanceof Error ? err.message : String(err) },
+		});
+	}
+}
+
+pgBossHandlerRegistry.register("@teamscala/service-boot:scala-tools-currency-watch", scalaToolsCurrencyWatch);

package/src/handlers/scheduled-browser-tests.ts

@@ -0,0 +1,85 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The `scheduled-browser-tests` pg-boss handler — the single scheduled-test
+ * home for the platform's regression suite (open migration
+ * `test-execution-consolidation`). Spawns `scala-tools test run --existing`
+ * on a cadence so every automated test execution flows through the one
+ * registry-driven harness, emitting the queryable `test.run.*` event pair
+ * (event-log-is-the-only-durable-event-log) that the deleted quartet of
+ * interval `guard_rule` rows never did (2026-06-29: 4 interval guards each
+ * autonomously drove headless Chrome against live UI services on 15/30-min
+ * timers with no central schedule/run-log).
+ *
+ * `--existing` runs every ACTIVE `test_vector` row across all services (the
+ * registry suite — both auto-generated and hand-authored vectors); `--no-boot`
+ * leaves service supervision to PM2 so a DOWN service fails its own health
+ * vector (the intended signal) instead of the scheduler booting a duplicate.
+ * `--source scheduled:scheduled-browser-tests` stamps the run's invoker block
+ * so a scheduled run is distinguishable from a manual agent run in the event
+ * log (`SELECT … FROM event_log WHERE kind LIKE 'test.run.%'`).
+ *
+ * The per-service outcomes land in the `test.run.result` events sharing the
+ * spawned run's `run_id`; this handler records only the schedule-level
+ * `scheduled.test.run` "did the run fire + finish" event. Spawns via
+ * `@teamscala/os` `spawn` (the single spawn surface); `scala-tools` resolves on
+ * PATH — on the dev host that is the source-mode link (always current).
+ *
+ * Registered under slug `@teamscala/service-boot:scheduled-browser-tests`.
+ * Mirrors `bun-stable-watch` / `upstream-issue-sync` (dev-host pg-boss
+ * handlers on scala-loga).
+ */
+import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
+import { recordEvent } from "@teamscala/event-log/record-event";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { spawn } from "@teamscala/os/spawn";
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import * as v from "valibot";
+import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
+
+const SOURCE = "scheduled:scheduled-browser-tests";
+
+// A full --existing sweep across all UI services (Chrome-driven hydration +
+// responsive + node-diff vectors, paced 5s apart between browser vectors) runs
+// in the tens of minutes; bound the subprocess so a stuck vector's 90s wall can
+// never hang the pg-boss worker indefinitely. exitCode null (SIGKILL on
+// timeout) is treated as a failure + recorded.
+const DEFAULT_RUN_TIMEOUT_MS = 30 * 60 * 1000;
+let cachedRunTimeoutMs: number | undefined;
+async function getRunTimeoutMs(): Promise<number> {
+	if (cachedRunTimeoutMs !== undefined) return cachedRunTimeoutMs;
+	const row = await loadRegistryConfig("config", "scheduled-browser-tests", v.looseObject({}));
+	cachedRunTimeoutMs = (row?.run_timeout_ms as number | undefined) ?? DEFAULT_RUN_TIMEOUT_MS;
+	return cachedRunTimeoutMs;
+}
+
+async function scheduledBrowserTests(_ctx: { config: ScheduledJobConfig }): Promise<void> {
+	const log = getAppLogger();
+
+	const { stdout, stderr, exitCode } = await spawn({
+		name: "scheduled-browser-tests",
+		command: ["scala-tools", "test", "run", "--existing", "--no-boot", "--source", SOURCE],
+		timeoutMs: await getRunTimeoutMs(),
+	});
+
+	const code = exitCode ?? -1;
+	const ok = exitCode === 0;
+	// Surface the run's own summary line (the CLI prints a final
+	// "N/M vectors pass across K services" footer) so the schedule outcome is
+	// visible in the loga tail without re-querying the event log.
+	const tail = (stdout || stderr || "").trim().split("\n").slice(-2).join(" | ");
+	log.info(
+		`[scheduled-browser-tests] scala-tools test run --existing exited ${code} (${ok ? "pass" : "fail"}) — ${tail}`,
+	);
+	recordEvent({
+		kind: "scheduled.test.run",
+		payload: { source: SOURCE, exit_code: code, ok },
+	});
+}
+
+pgBossHandlerRegistry.register(
+	"@teamscala/service-boot:scheduled-browser-tests",
+	scheduledBrowserTests,
+);

package/src/handlers/sweep-event-log.ts

@@ -0,0 +1,98 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The `event-log-sweep` pg-boss handler. Reads the `retention` map from
+ * the `scheduled_job` row config and sweeps the two dev-host operational
+ * log tables via `@teamscala/event-log`'s sweep executors (those run
+ * through the event-log primitive's configured writer — neither table is
+ * a Prisma model, and the audited @teamscala/db client blocks raw SQL, so
+ * the primitive owns their lifecycle).
+ *
+ * Retention map convention (values are durations, "90 days"):
+ *   "event_log"            → default window for kinds with no override
+ *   "event_log:<prefix>"   → kind-prefix override (e.g. "event_log:guard.gate." for gate-latency telemetry)
+ *   "hook_execution_log"   → flat window for the agent-CLI hook log
+ * auth.* events are permanent regardless of config (enforced in the sweep
+ * executor). Unknown keys are skipped + logged, never executed.
+ *
+ * Registered under slug `@teamscala/service-boot:sweep-event-log`.
+ */
+import { recordEvent } from "@teamscala/event-log/record-event";
+import { sweepHookExecutionLog, sweepOldEvents } from "@teamscala/event-log/sweep-old";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
+
+const DURATION_RE = /^(\d+)\s+(day|week|month)s?$/;
+const UNIT_TO_DAYS: Record<string, number> = {
+	day: 1,
+	week: 7,
+	month: 30,
+};
+
+function parseDays(raw: string): number | null {
+	const match = DURATION_RE.exec(raw.trim());
+	if (!match) return null;
+	return Number(match[1]) * (UNIT_TO_DAYS[match[2] as string] ?? 0);
+}
+
+async function sweepEventLog(ctx: {
+	config: { retention?: Record<string, string> };
+}): Promise<void> {
+	const log = getAppLogger();
+	const retention = ctx.config.retention ?? {};
+
+	let defaultDays: number | undefined;
+	const byPrefix: Record<string, number> = {};
+	let hookLogDays: number | null = null;
+
+	for (const [key, rawValue] of Object.entries(retention)) {
+		const days = parseDays(rawValue);
+		if (days === null || days <= 0) {
+			log.warn(
+				`[event-log-sweep] skipping "${key}" — value "${rawValue}" is not a day-granularity duration (expected e.g. "90 days")`,
+			);
+			continue;
+		}
+		if (key === "event_log") defaultDays = days;
+		else if (key.startsWith("event_log:")) byPrefix[key.slice("event_log:".length)] = days;
+		else if (key === "hook_execution_log") hookLogDays = days;
+		else {
+			log.warn(`[event-log-sweep] skipping "${key}" — not a sweep target this handler knows`);
+		}
+	}
+
+	const events = await sweepOldEvents({
+		retentionDays: defaultDays,
+		retentionByPrefix: byPrefix,
+	});
+	log.info(
+		`[event-log-sweep] event_log: ${events.deleted} row(s) swept (default cutoff ${events.cutoffAt.toISOString()}, ${Object.keys(byPrefix).length} prefix override(s))`,
+	);
+
+	let hookLogDeleted: number | null = null;
+	if (hookLogDays !== null) {
+		const hooks = await sweepHookExecutionLog(hookLogDays);
+		hookLogDeleted = hooks.deleted;
+		log.info(
+			`[event-log-sweep] hook_execution_log: ${hooks.deleted} row(s) swept (cutoff ${hooks.cutoffAt.toISOString()})`,
+		);
+	}
+
+	// Liveness signal: loga's sweep-liveness watchdog escalates if no
+	// sweep.completed event lands within 48h (a silently-stopped sweep means
+	// unbounded event_log growth returns). Recorded AFTER the sweep so a failed
+	// sweep emits no heartbeat.
+	recordEvent({
+		kind: "sweep.completed",
+		payload: {
+			eventLogDeleted: events.deleted,
+			hookLogDeleted,
+			cutoffAt: events.cutoffAt.toISOString(),
+			completedAt: new Date().toISOString(),
+		},
+	});
+}
+
+pgBossHandlerRegistry.register("@teamscala/service-boot:sweep-event-log", sweepEventLog);

package/src/handlers/sweep-host-cache.ts

@@ -0,0 +1,211 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The `host-cache-sweep` pg-boss handler. Reads the `retention` map from the
+ * `scheduled_job` row config — where each KEY is a host cache path (with
+ * `${HOME}`/`${WORKSPACE}` placeholders) and each VALUE is a day-granularity
+ * duration — and prunes files older than the cutoff. This is the mechanical
+ * automation that makes "host disk bounded by construction" real: it extends
+ * `no-uncontrolled-repetition-or-cascade` / `shared-resource-bounds-are-host-wide`
+ * (which bound install CONCURRENCY) to cache RETENTION, so the dev-host caches
+ * that accumulate every published version forever — canonical:
+ * `~/.bun/install/cache`, the @teamscala/* install cache — cannot grow unbounded.
+ *
+ * Path convention (config.retention keys, substituted at runtime via `userHome()`
+ * / `workspaceRoot()` per `host-literals-via-substitution` — source never
+ * hardcodes host paths):
+ *   "${HOME}/.bun/install/cache"          → "30 days"
+ *   "${HOME}/.config/*.retired-*"         → "14 days"  (glob leaf, optional)
+ *
+ * Deletion runs through Bun fs APIs — pure filesystem deletion needs no shell,
+ * so `spawn-is-the-only-spawn` does not apply (that governs shell commands).
+ * Hardlinked node_modules copies SURVIVE cache pruning (a hardlink shares an
+ * inode; removing the cache's link leaves the installed copy's link intact), so
+ * installed packages stay whole — a pruned version simply re-downloads on the
+ * next install that needs it. Empty parent directories are left in place
+ * (negligible — directory entries are a few KB total); only file data is reclaimed.
+ *
+ * Liveness: records a `host.cache.swept` event after a run (distinct from
+ * event-log-sweep's `sweep.completed` so the event-log sweep-liveness watchdog
+ * is not confused). A silently-stopped sweep is detectable from the event stream.
+ *
+ * Registered under slug `@teamscala/service-boot:sweep-host-cache`.
+ */
+import { rm, readdir, stat } from "node:fs/promises";
+import type { Dirent } from "node:fs";
+import { join } from "node:path";
+import { spawnSync } from "@teamscala/os/spawn/spawn";
+import { userHome, workspaceRoot } from "@teamscala/os/host-paths";
+import { formatBytes } from "@teamscala/formatters/format-bytes";
+import { recordEvent } from "@teamscala/event-log/record-event";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
+
+const DURATION_RE = /^(\d+)\s+(day|week|month)s?$/;
+const UNIT_TO_DAYS: Record<string, number> = {
+	day: 1,
+	week: 7,
+	month: 30,
+};
+const MS_PER_DAY = 86_400_000;
+
+function parseDays(raw: string): number | null {
+	const match = DURATION_RE.exec(raw.trim());
+	if (!match) return null;
+	return Number(match[1]) * (UNIT_TO_DAYS[match[2]] ?? 0);
+}
+
+/** Resolve `${HOME}` / `${WORKSPACE}` placeholders against the live host. */
+function resolveHostPath(raw: string): string {
+	return raw
+		.replaceAll("${HOME}", userHome())
+		.replaceAll("${WORKSPACE}", workspaceRoot());
+}
+
+interface SweepResult {
+	path: string;
+	scanned: number;
+	deleted: number;
+	bytesFreed: number;
+}
+
+/**
+ * Walk `rootDir` (stack-based, bounded memory) and delete regular files whose
+ * mtime is older than `cutoffMs`. Directories are traversed but not removed.
+ */
+async function sweepPath(
+	rootDir: string,
+	cutoffMs: number,
+): Promise<SweepResult> {
+	const log = getAppLogger();
+	let scanned = 0;
+	let deleted = 0;
+	let bytesFreed = 0;
+	const stack: string[] = [rootDir];
+
+	while (stack.length > 0) {
+		const dir = stack.pop();
+		if (dir === undefined) break;
+		let entries: Dirent[];
+		try {
+			entries = await readdir(dir, { withFileTypes: true });
+		} catch {
+			continue; // unreadable / vanished — skip
+		}
+		for (const entry of entries) {
+			const full = join(dir, entry.name);
+			if (entry.isDirectory()) {
+				stack.push(full);
+			} else if (entry.isFile()) {
+				scanned++;
+				try {
+					const st = await stat(full);
+					if (st.mtimeMs < cutoffMs) {
+						bytesFreed += st.size;
+						await rm(full, { force: true });
+						deleted++;
+					}
+				} catch (error) {
+					log.warn(`[host-cache-sweep] could not process ${full}: ${String(error)}`);
+				}
+			}
+		}
+	}
+
+	return { path: rootDir, scanned, deleted, bytesFreed };
+}
+
+async function sweepHostCache(ctx: {
+	config: { retention?: Record<string, string> };
+}): Promise<void> {
+	const log = getAppLogger();
+	const retention = ctx.config.retention ?? {};
+	const now = Date.now();
+	const results: SweepResult[] = [];
+
+	for (const [rawPath, rawDuration] of Object.entries(retention)) {
+		const days = parseDays(rawDuration);
+		if (days === null || days <= 0) {
+			log.warn(
+				`[host-cache-sweep] skipping "${rawPath}" — value "${rawDuration}" is not a day-granularity duration (expected e.g. "30 days")`,
+			);
+			continue;
+		}
+
+		const dir = resolveHostPath(rawPath);
+		try {
+			const st = await stat(dir);
+			if (!st.isDirectory()) {
+				log.warn(`[host-cache-sweep] skipping "${rawPath}" — resolved path is not a directory`);
+				continue;
+			}
+		} catch {
+			log.warn(`[host-cache-sweep] skipping "${rawPath}" — path does not exist or is unreadable`);
+			continue;
+		}
+
+		const cutoffMs = now - days * MS_PER_DAY;
+		const result = await sweepPath(dir, cutoffMs);
+		results.push(result);
+		log.info(
+			`[host-cache-sweep] ${rawPath}: scanned ${result.scanned}, deleted ${result.deleted} file(s) (${formatBytes(result.bytesFreed)}) older than ${rawDuration}`,
+		);
+	}
+
+	const totalDeleted = results.reduce((sum, r) => sum + r.deleted, 0);
+	const totalBytes = results.reduce((sum, r) => sum + r.bytesFreed, 0);
+	log.info(
+		`[host-cache-sweep] complete: ${results.length} target(s), ${totalDeleted} file(s) deleted, ${formatBytes(totalBytes)} reclaimed`,
+	);
+
+	// Liveness signal — distinct kind so the event-log sweep watchdog is unaffected.
+	recordEvent({
+		kind: "host.cache.swept",
+		payload: {
+			targets: results.map((r) => ({
+				path: r.path,
+				scanned: r.scanned,
+				deleted: r.deleted,
+				bytesFreed: r.bytesFreed,
+			})),
+			totalDeleted,
+			totalBytesFreed: totalBytes,
+			completedAt: new Date().toISOString(),
+		},
+	});
+
+	// Disk-threshold monitor — piggybacks on this nightly sweep event (no separate
+	// interval/infra: `guards-never-run-on-interval`). If `/` usage crosses the
+	// configured threshold, emit `host.disk.high` (-> event-log/GlitchTip) so a fill
+	// the sweep can't absorb (external dump, runaway log) is caught within a day.
+	const highPercent = 90;
+	try {
+		const dfRes = spawnSync({ name: "df:/", command: ["df", "--output=pcent,target"], timeoutMs: 5000 });
+		const dfOut = (dfRes.stdout ?? "").trim();
+		const rootLine = dfOut
+			.split("\n")
+			.find((l) => l.trim().endsWith("/"));
+		const pctMatch = rootLine?.match(/(\d+)%/);
+		if (pctMatch) {
+			const usePct = Number(pctMatch[1]);
+			if (usePct >= highPercent) {
+				log.warn(
+					`[host-cache-sweep] disk usage ${usePct}% >= ${highPercent}% threshold — emitting host.disk.high`,
+				);
+				recordEvent({
+					kind: "host.disk.high",
+					payload: { usePct, threshold: highPercent, df: dfOut, completedAt: new Date().toISOString() },
+				});
+			}
+		}
+	} catch (error) {
+		log.warn(`[host-cache-sweep] disk-threshold check failed: ${String(error)}`);
+	}
+}
+
+pgBossHandlerRegistry.register(
+	"@teamscala/service-boot:sweep-host-cache",
+	sweepHostCache,
+);