@teamscala/service-boot 0.23.369 → 0.23.373

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.369",
+  "version": "0.23.373",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -410,14 +410,6 @@
       "types": "./src/handlers/bun-stable-watch.d.ts",
       "default": "./src/handlers/bun-stable-watch.ts"
     },
-    "./handlers/lane-attention-sweep": {
-      "types": "./src/handlers/lane-attention-sweep.d.ts",
-      "default": "./src/handlers/lane-attention-sweep.ts"
-    },
-    "./handlers/lane-attention-sweep.ts": {
-      "types": "./src/handlers/lane-attention-sweep.d.ts",
-      "default": "./src/handlers/lane-attention-sweep.ts"
-    },
     "./handlers/pane-outbox-drain": {
       "types": "./src/handlers/pane-outbox-drain.d.ts",
       "default": "./src/handlers/pane-outbox-drain.ts"
@@ -490,14 +482,6 @@
       "types": "./src/handlers/sweep-event-log.d.ts",
       "default": "./src/handlers/sweep-event-log.ts"
     },
-    "./handlers/sweep-host-cache": {
-      "types": "./src/handlers/sweep-host-cache.d.ts",
-      "default": "./src/handlers/sweep-host-cache.ts"
-    },
-    "./handlers/sweep-host-cache.ts": {
-      "types": "./src/handlers/sweep-host-cache.d.ts",
-      "default": "./src/handlers/sweep-host-cache.ts"
-    },
     "./handlers/upstream-issue-sync": {
       "types": "./src/handlers/upstream-issue-sync.d.ts",
       "default": "./src/handlers/upstream-issue-sync.ts"

package/src/handlers/platform-fault-escalation.test.ts

@@ -65,10 +65,10 @@ describe("decideSweep — thresholds", () => {
 	});
 
 	test("the 490-over-12h shape escalates (duration + recurrence)", () => {
-		const sustained = agg("host-command-bus.error", 490, 720, 0);
+		const sustained = agg("host-command-bus.command.failed", 490, 720, 0);
 		const decision = decideSweep([sustained], [], POLICY, NOW);
 		expect(decision.escalate).toHaveLength(1);
-		expect(decision.escalate[0]!.aggregate.kind).toBe("host-command-bus.error");
+		expect(decision.escalate[0]!.aggregate.kind).toBe("host-command-bus.command.failed");
 		expect(decision.escalate[0]!.episode).toBeNull();
 	});
 
@@ -85,9 +85,9 @@ describe("decideSweep — thresholds", () => {
 	});
 
 	test("override raises a floor too — bursty kinds can be tightened", () => {
-		const sustained = agg("llm.provider.error", 40, 60, 0); // passes default
+		const sustained = agg("llm.provider.call.failed", 40, 60, 0); // passes default
 		const decision = decideSweep([sustained], [], POLICY, NOW, {
-			"llm.provider.error": { minCount: 100 },
+			"llm.provider.call.failed": { minCount: 100 },
 		});
 		expect(decision.escalate).toHaveLength(0);
 	});
@@ -95,16 +95,16 @@ describe("decideSweep — thresholds", () => {
 
 describe("decideSweep — dedup (one escalation per fault, no re-fire)", () => {
 	test("already escalated and unresolved does NOT re-escalate", () => {
-		const sustained = agg("host-command-bus.error", 500, 720, 0);
-		const open = episode({ kind: "host-command-bus.error", escalatedAt: new Date(NOW.getTime() - 3_600_000) });
+		const sustained = agg("host-command-bus.command.failed", 500, 720, 0);
+		const open = episode({ kind: "host-command-bus.command.failed", escalatedAt: new Date(NOW.getTime() - 3_600_000) });
 		const decision = decideSweep([sustained], [open], POLICY, NOW);
 		expect(decision.escalate).toHaveLength(0);
 	});
 
 	test("open delivered episode past the update window gets an UPDATE, not a message", () => {
-		const sustained = agg("llm.provider.error", 300, 720, 0);
+		const sustained = agg("llm.provider.call.failed", 300, 720, 0);
 		const open = episode({
-			kind: "llm.provider.error",
+			kind: "llm.provider.call.failed",
 			escalatedAt: new Date(NOW.getTime() - 90 * 60_000), // last update long ago
 			lastUpdatedAt: new Date(NOW.getTime() - 90 * 60_000),
 		});
@@ -115,9 +115,9 @@ describe("decideSweep — dedup (one escalation per fault, no re-fire)", () => {
 	});
 
 	test("open episode inside the update window gets NOTHING (dedup window)", () => {
-		const sustained = agg("llm.provider.error", 300, 720, 0);
+		const sustained = agg("llm.provider.call.failed", 300, 720, 0);
 		const open = episode({
-			kind: "llm.provider.error",
+			kind: "llm.provider.call.failed",
 			escalatedAt: new Date(NOW.getTime() - 10 * 60_000),
 			lastUpdatedAt: new Date(NOW.getTime() - 10 * 60_000),
 		});
@@ -150,9 +150,9 @@ describe("decideSweep — resolution + re-arm", () => {
 	});
 
 	test("after resolution the same fault escalates again (new episode)", () => {
-		const recurring = agg("host-command-bus.error", 50, 40, 0);
+		const recurring = agg("host-command-bus.command.failed", 50, 40, 0);
 		const resolved = episode({
-			kind: "host-command-bus.error",
+			kind: "host-command-bus.command.failed",
 			resolvedAt: new Date(NOW.getTime() - 35 * 60_000),
 		});
 		const decision = decideSweep([recurring], [resolved], POLICY, NOW);
@@ -190,12 +190,12 @@ describe("extractGowaMessageId — delivery verification", () => {
 describe("composeEscalationMessage", () => {
 	test("carries the three escalation-routing fields and stays phone-sized", () => {
 		const message = composeEscalationMessage({
-			kind: "host-command-bus.error",
-			aggregate: agg("host-command-bus.error", 490, 720, 0),
+			kind: "host-command-bus.command.failed",
+			aggregate: agg("host-command-bus.command.failed", 490, 720, 0),
 			impact: "scala-tools verbs are failing host-wide",
 			recommendation: "check oxmgr logs for the bus consumer",
 		});
-		expect(message).toContain("Platform fault: host-command-bus.error");
+		expect(message).toContain("Platform fault: host-command-bus.command.failed");
 		expect(message).toContain("Observed: 490 errors over 12 h");
 		expect(message).toContain("Impact: scala-tools verbs are failing host-wide");
 		expect(message).toContain("Recommendation: check oxmgr logs for the bus consumer");

package/src/handlers/platform-fault-escalation.ts

@@ -5,9 +5,10 @@
  *
  * The `platform-fault-escalation` pg-boss handler — closes the "receiving is
  * decoupled from consequence" gap measured 2026-08-15 (760 error events over
- * 12 hours, zero escalations: host-command-bus.error 490, llm.provider.error
- * 231, guard.fail.open 16, scale-to-zero.wake_failed 12, listen.connect_failed
- * 11). Emission works and observability-is-passive is satisfied; nothing
+ * 12 hours, zero escalations: host-command-bus.command.failed (then spelled
+ * host-command-bus.error) 490, llm.provider.call.failed (then spelled
+ * llm.provider.error) 231, guard.fail.open 16, scale-to-zero.wake_failed 12,
+ * listen.connect_failed 11). Emission works and observability-is-passive is satisfied; nothing
  * acted. This sweep makes RECEIVING have CONSEQUENCE: sustained platform
  * faults escalate to the OPERATOR over the existing PA path (WhatsApp, the
  * scala PA operator-relay bot — escalation-routing's channel; no second
@@ -38,8 +39,7 @@
  * not a state transition any single event can announce. The sweep reads one
  * server-side aggregate (GROUP BY kind) per run against indexed event_log;
  * while the platform is healthy it returns zero rows and costs nothing
- * beyond the tick (idle-costs-nothing). Same justification
- * lane-attention-sweep carries on its row as `poll_justification`.
+ * beyond the tick (idle-costs-nothing).
  *
  * Registered under slug `@teamscala/service-boot:platform-fault-escalation`.
  */
@@ -130,9 +130,8 @@ async function getSystemIdentity(): Promise<{ userId: string | undefined; organi
  * TypeError this replaced). Per `no-direct-prisma-outside-orpc`, every WRITE
  * in this handler routes through this client; the single raw read (the
  * event_log recurrence aggregate, a GROUP BY no generated CRUD expresses) uses
- * the assigned-client form with $queryRawUnsafe — the lane-attention-sweep
- * precedent in this same directory. Timestamps are ISO strings, never Date
- * instances (the generated valibot schemas require it).
+ * the assigned-client form with $queryRawUnsafe. Timestamps are ISO strings,
+ * never Date instances (the generated valibot schemas require it).
  */
 let cachedOrpc: OrpcSurface | null = null;
 async function orpc(): Promise<OrpcSurface> {

package/src/pg-boss-mount.ts

@@ -26,7 +26,9 @@ import { pgBossHandlerRegistry } from "./pg-boss-handler-registry.ts";
 import "./handlers/prune-stale-data.ts";
 import "./handlers/projects-digest.ts";
 import "./handlers/sweep-event-log.ts";
-import "./handlers/sweep-host-cache.ts";
+// `sweep-host-cache` is Rust-native: loga (the job's service_slug) registers it
+// via scala_os::host_cache_retention with the config/cleanup-allowed-roots
+// bound. No TypeScript copy may exist beside it.
 import "./handlers/bun-stable-watch.ts";
 import "./handlers/whatsapp-liveness.ts";
 import "./handlers/upstream-issue-sync.ts";
@@ -34,7 +36,6 @@ import "./handlers/scala-tools-currency-watch.ts";
 import "./handlers/singleton-tools-currency-watch.ts";
 import "./handlers/registry-stale-inactive-sweep.ts";
 import "./handlers/pane-outbox-drain.ts";
-import "./handlers/lane-attention-sweep.ts";
 import "./handlers/platform-fault-escalation.ts";
 
 /**

package/src/handlers/lane-attention-sweep.ts

@@ -1,81 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The `lane-attention-sweep` pg-boss handler. Calls the database function that
- * reminds an orchestrator about lanes waiting on it, and records the outcome.
- *
- * This handler holds NO POLICY. Which lanes are waiting, how long counts as
- * waiting, who is told, what the message says, and how often it may repeat are
- * all in `lane_needs_attention` and `sweep_lanes_needing_attention` — so
- * changing any of them is a migration, not a rebuild and redeploy of this
- * service. All this file supplies is the tick and the telemetry.
- *
- * WHY A TICK EXISTS AT ALL, given `observability-is-passive` and
- * `no-polling-for-pushable-state`. Both forbid polling for state a source CAN
- * push. Here the trigger is the PASSAGE OF TIME against a threshold: a lane
- * going silent emits nothing, because emitting is exactly what it stopped
- * doing. There is no state transition to react to, so nothing could push it.
- * The same justification `registry-stale-inactive-sweep` carries, recorded on
- * the row as `poll_justification`.
- *
- * Registered under slug `@teamscala/service-boot:lane-attention-sweep`.
- */
-import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
-import { getPrisma } from "@teamscala/db/prisma-registry";
-import { recordEvent } from "@teamscala/event-log/record-event";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
-
-interface RemindedLane {
-	task_id: string;
-	window_name: string | null;
-	reason: string;
-	orchestrator_project_id: string;
-}
-
-async function laneAttentionSweep(ctx: { config: ScheduledJobConfig }): Promise<void> {
-	const log = getAppLogger();
-	const prisma = getPrisma();
-
-	// The repeat window is the row's, so silencing a chatty reminder is a
-	// registry edit. The default lives in the SQL function's signature, which is
-	// the one place it is defined.
-	const repeatAfter = (ctx.config as { repeat_after?: string }).repeat_after;
-
-	const reminded = repeatAfter
-		? await prisma.$queryRawUnsafe<RemindedLane[]>(
-				"SELECT * FROM sweep_lanes_needing_attention($1::interval)",
-				repeatAfter,
-			)
-		: await prisma.$queryRawUnsafe<RemindedLane[]>("SELECT * FROM sweep_lanes_needing_attention()");
-
-	// Emitted even when nothing was due. A sweep that only reports on the runs
-	// where it found something is indistinguishable from a sweep that stopped
-	// running, and this exists precisely to notice silence.
-	recordEvent({
-		kind: "fleet.lane-attention.swept",
-		payload: {
-			remindedCount: reminded.length,
-			lanes: reminded.map((lane) => ({
-				task: lane.task_id,
-				window: lane.window_name,
-				reason: lane.reason,
-				toldOrchestrator: lane.orchestrator_project_id,
-			})),
-		},
-	});
-
-	if (reminded.length > 0) {
-		log.info(
-			`[lane-attention-sweep] reminded ${reminded.length} orchestrator(s) about waiting lanes`,
-			{ lanes: reminded.map((lane) => `${lane.window_name}: ${lane.reason}`) },
-		);
-	}
-}
-
-pgBossHandlerRegistry.register(
-	"@teamscala/service-boot:lane-attention-sweep",
-	laneAttentionSweep as (ctx: { config: ScheduledJobConfig }) => Promise<void>,
-);

package/src/handlers/sweep-host-cache.test.ts

@@ -1,133 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Unit tests for the `retention_dirs` helpers (`expandGlob`, `checkDirStale`) —
- * the whole-directory prune that bounds Rust `target/` waste. The file-by-mtime
- * `retention` path is unchanged; these cover ONLY the new build-cache model:
- * (1) glob expansion reaches every repo's target dir; (2) an actively-built dir
- * is kept (short-circuits on a fresh file); (3) an abandoned dir is reported
- * stale with its full size. Lives next to the handler per co-located-test rule.
- */
-import { describe, expect, test, beforeEach, afterEach } from "bun:test";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, utimesSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { expandGlob, checkDirStale, parseRootDiskPct } from "./sweep-host-cache.ts";
-
-const DAY = 86_400_000;
-const now = Date.now();
-const daysAgo = (n: number) => new Date(now - n * DAY);
-const touch = (p: string, t: Date) => utimesSync(p, t, t);
-
-let root: string;
-beforeEach(() => {
-	root = mkdtempSync(join(tmpdir(), "sweep-"));
-});
-afterEach(() => {
-	rmSync(root, { recursive: true, force: true });
-});
-
-describe("expandGlob", () => {
-	test("expands a single-segment wildcard to concrete dirs", () => {
-		mkdirSync(join(root, "scala-rust", "target"), { recursive: true });
-		mkdirSync(join(root, "scala-os", "target"), { recursive: true });
-		mkdirSync(join(root, "scala-os", "src"), { recursive: true });
-		const matches = expandGlob(`${root}/*/target`).sort();
-		expect(matches).toEqual(
-			[join(root, "scala-os", "target"), join(root, "scala-rust", "target")].sort(),
-		);
-	});
-	test("literal segment matches only itself", () => {
-		mkdirSync(join(root, "scala-rust", "target"), { recursive: true });
-		mkdirSync(join(root, "other", "target"), { recursive: true });
-		const matches = expandGlob(`${root}/scala-rust/target`);
-		expect(matches).toEqual([join(root, "scala-rust", "target")]);
-	});
-	test("no matches when the wildcard segment has no children", () => {
-		const matches = expandGlob(`${root}/does-not-exist/*/target`);
-		expect(matches).toEqual([]);
-	});
-});
-
-describe("checkDirStale", () => {
-	test("stale dir: all files older than cutoff → stale + full size", async () => {
-		const dir = join(root, "target");
-		mkdirSync(join(dir, "debug", "deps"), { recursive: true });
-		writeFileSync(join(dir, "debug", "deps", "a.o"), "x".repeat(40));
-		writeFileSync(join(dir, "debug", "deps", "b.o"), "y".repeat(60));
-		touch(join(dir, "debug", "deps", "a.o"), daysAgo(40));
-		touch(join(dir, "debug", "deps", "b.o"), daysAgo(35));
-		const res = await checkDirStale(dir, now - 30 * DAY);
-		expect(res.stale).toBe(true);
-		expect(res.fileCount).toBe(2);
-		expect(res.bytes).toBe(100);
-	});
-	test("active dir: a file newer than cutoff → not stale (short-circuit)", async () => {
-		const dir = join(root, "target");
-		mkdirSync(join(dir, "debug"), { recursive: true });
-		writeFileSync(join(dir, "debug", "old.o"), "x".repeat(40));
-		touch(join(dir, "debug", "old.o"), daysAgo(40));
-		writeFileSync(join(dir, "debug", "fresh.o"), "y".repeat(60));
-		touch(join(dir, "debug", "fresh.o"), daysAgo(1));
-		const res = await checkDirStale(dir, now - 30 * DAY);
-		expect(res.stale).toBe(false);
-	});
-	test("empty dir → stale with zero bytes", async () => {
-		const dir = join(root, "target");
-		mkdirSync(dir, { recursive: true });
-		const res = await checkDirStale(dir, now - 30 * DAY);
-		expect(res.stale).toBe(true);
-		expect(res.bytes).toBe(0);
-		expect(res.fileCount).toBe(0);
-	});
-});
-
-describe("parseRootDiskPct", () => {
-	test("extracts root-fs Use% from df --output=pcent,target output", () => {
-		const df =
-			"Use% Mounted on\n" +
-			"  97% /\n" +
-			"  45% /home\n";
-		expect(parseRootDiskPct(df)).toBe(97);
-	});
-	test("picks the root mount (/) over nested mounts", () => {
-		const df =
-			"Use% Mounted on\n" +
-			"  10% /proc/x\n" +
-			"  76% /\n";
-		expect(parseRootDiskPct(df)).toBe(76);
-	});
-	test("returns null when no root-mount line present", () => {
-		const df = "Use% Mounted on\n  40% /mnt/other\n";
-		expect(parseRootDiskPct(df)).toBeNull();
-	});
-	test("returns null on empty / malformed output", () => {
-		expect(parseRootDiskPct("")).toBeNull();
-		expect(parseRootDiskPct("Use% Mounted on")).toBeNull();
-	});
-});
-
-describe("disk-threshold early-warning regression lock", () => {
-	const { readFileSync } = require("node:fs");
-	// Source-shape lock (same pattern as singleton-tools-currency-watch.test.ts):
-	// the df-check that rides this periodic sweep was once removed in favour of an
-	// in-process interval watchdog — the wrong architecture (interval watchdogs
-	// are forbidden; observability is event-driven). This asserts the corrected
-	// shape survives: the sweep handler MUST carry the event-driven host.disk.high
-	// emission (logger.warn -> GlitchTip) + the pure parseRootDiskPct helper that
-	// backs it. Removing either fails this test. The asserted surface is the
-	// disk early-warning cell of host-resources-have-complete-monitoring.
-	const src = readFileSync(import.meta.dir + "/sweep-host-cache.ts", "utf-8");
-	test("handler emits the host.disk.high event (event-driven, not an interval)", () => {
-		expect(src).toContain('log.warn("host.disk.high"');
-		expect(src).toContain('kind: "host.disk.high"');
-	});
-	test("handler reads df via the sanctioned spawn (no in-process poller)", () => {
-		expect(src).toContain('command: ["df", "--output=pcent,target"]');
-	});
-	test("threshold parse is the exported pure helper", () => {
-		expect(src).toContain("export function parseRootDiskPct");
-	});
-});

package/src/handlers/sweep-host-cache.ts

@@ -1,328 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The `host-cache-sweep` pg-boss handler. Reads the `retention` map from the
- * `scheduled_job` row config — where each KEY is a host cache path (with
- * `${HOME}`/`${WORKSPACE}` placeholders) and each VALUE is a day-granularity
- * duration — and prunes files older than the cutoff. This is the mechanical
- * automation that makes "host disk bounded by construction" real: it extends
- * `no-uncontrolled-repetition-or-cascade` / `shared-resource-bounds-are-host-wide`
- * (which bound install CONCURRENCY) to cache RETENTION, so the dev-host caches
- * that accumulate every published version forever — canonical:
- * `~/.bun/install/cache`, the @teamscala/* install cache — cannot grow unbounded.
- *
- * Path convention (config.retention keys, substituted at runtime via `userHome()`
- * / `workspaceRoot()` per `host-literals-via-substitution` — source never
- * hardcodes host paths):
-*   "${HOME}/.bun/install/cache"          → "30 days"
-*   "${HOME}/.config/*.retired-*"         → "14 days"  (glob leaf, optional)
-*
-* config.retention_dirs — whole-DIRECTORY prune for build caches (Rust
-* `target/`) whose unit is the dir, not the file (file-by-mtime would corrupt
-* the cache). Keys support `*` globs; a matched dir is deleted ENTIRELY only
-* when its newest file is older than the cutoff:
-*   "${WORKSPACE}/<repo>/target"         → "30 days"  (glob wildcard, whole-dir delete)
- *
- * Deletion runs through Bun fs APIs — pure filesystem deletion needs no shell,
- * so `spawn-is-the-only-spawn` does not apply (that governs shell commands).
- * Hardlinked node_modules copies SURVIVE cache pruning (a hardlink shares an
- * inode; removing the cache's link leaves the installed copy's link intact), so
- * installed packages stay whole — a pruned version simply re-downloads on the
- * next install that needs it. Empty parent directories are left in place
- * (negligible — directory entries are a few KB total); only file data is reclaimed.
- *
- * Liveness: records a `host.cache.swept` event after a run (distinct from
- * event-log-sweep's `sweep.completed` so the event-log sweep-liveness watchdog
- * is not confused). A silently-stopped sweep is detectable from the event stream.
- *
- * Registered under slug `@teamscala/service-boot:sweep-host-cache`.
- */
-import { rm, readdir, stat } from "node:fs/promises";
-import { readdirSync, type Dirent } from "node:fs";
-import { join } from "node:path";
-import { spawnSync } from "@teamscala/os/spawn/spawn";
-import { userHome, workspaceRoot } from "@teamscala/os/host-paths";
-import { formatBytes } from "@teamscala/formatters/format-bytes";
-import { recordEvent } from "@teamscala/event-log/record-event";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
-
-const DURATION_RE = /^(\d+)\s+(day|week|month)s?$/;
-const UNIT_TO_DAYS: Record<string, number> = {
-	day: 1,
-	week: 7,
-	month: 30,
-};
-const MS_PER_DAY = 86_400_000;
-
-function parseDays(raw: string): number | null {
-	const match = DURATION_RE.exec(raw.trim());
-	if (!match) return null;
-	return Number(match[1]) * (UNIT_TO_DAYS[match[2]] ?? 0);
-}
-
-/** Resolve `${HOME}` / `${WORKSPACE}` placeholders against the live host. */
-function resolveHostPath(raw: string): string {
-	return raw
-		.replaceAll("${HOME}", userHome())
-		.replaceAll("${WORKSPACE}", workspaceRoot());
-}
-
-interface SweepResult {
-	path: string;
-	scanned: number;
-	deleted: number;
-	bytesFreed: number;
-}
-
-/**
- * Walk `rootDir` (stack-based, bounded memory) and delete regular files whose
- * mtime is older than `cutoffMs`. Directories are traversed but not removed.
- */
-async function sweepPath(
-	rootDir: string,
-	cutoffMs: number,
-): Promise<SweepResult> {
-	const log = getAppLogger();
-	let scanned = 0;
-	let deleted = 0;
-	let bytesFreed = 0;
-	const stack: string[] = [rootDir];
-
-	while (stack.length > 0) {
-		const dir = stack.pop();
-		if (dir === undefined) break;
-		let entries: Dirent[];
-		try {
-			entries = await readdir(dir, { withFileTypes: true });
-		} catch {
-			continue; // unreadable / vanished — skip
-		}
-		for (const entry of entries) {
-			const full = join(dir, entry.name);
-			if (entry.isDirectory()) {
-				stack.push(full);
-			} else if (entry.isFile()) {
-				scanned++;
-				try {
-					const st = await stat(full);
-					if (st.mtimeMs < cutoffMs) {
-						bytesFreed += st.size;
-						await rm(full, { force: true });
-						deleted++;
-					}
-				} catch (error) {
-					log.warn(`[host-cache-sweep] could not process ${full}: ${String(error)}`);
-				}
-			}
-		}
-	}
-
-	return { path: rootDir, scanned, deleted, bytesFreed };
-}
-
-/**
- * Expand a path pattern containing single-segment `*` wildcards into concrete
- * paths (files or dirs). Used by `retention_dirs` so a single config key like
-* a pattern like `${WORKSPACE}/<star>/target` reaches every repo's target dir.
-* Sync + bounded: the
- * pattern is shallow (3 segments), and this runs once
- * nightly. Non-existent segments yield no matches (the caller stats each result).
- */
-export function expandGlob(pattern: string): string[] {
-	const absolute = pattern.startsWith("/");
-	const segments = (absolute ? pattern.slice(1) : pattern)
-		.split("/")
-		.filter((s) => s.length > 0);
-	let current: string[] = [absolute ? "/" : "."];
-	for (const seg of segments) {
-		if (current.length === 0) break;
-		const next: string[] = [];
-		for (const dir of current) {
-			let names: string[];
-			try {
-				names = readdirSync(dir);
-			} catch {
-				continue;
-			}
-			for (const name of names) {
-				if (seg === "*" || seg === name) next.push(join(dir, name));
-			}
-		}
-		current = next;
-	}
-	return current;
-}
-
-/**
- * Is `dir` stale — i.e. NO file under it is newer than `cutoffMs`? Walks
- * recursively and SHORT-CIRCUITS the instant it finds a fresh file (so an
- * actively-built target dir returns fast without walking its full tree). On a
- * stale dir the walk is complete and returns the total size + file count, so
- * the caller can report bytes-freed before deleting the dir whole.
- */
-export async function checkDirStale(
-	dir: string,
-	cutoffMs: number,
-): Promise<{ stale: boolean; bytes: number; fileCount: number }> {
-	const stack: string[] = [dir];
-	let bytes = 0;
-	let fileCount = 0;
-	while (stack.length > 0) {
-		const d = stack.pop();
-		if (d === undefined) break;
-		let entries: Dirent[];
-		try {
-			entries = await readdir(d, { withFileTypes: true });
-		} catch {
-			continue;
-		}
-		for (const entry of entries) {
-			const full = join(d, entry.name);
-			if (entry.isDirectory()) {
-				stack.push(full);
-			} else if (entry.isFile()) {
-				try {
-					const st = await stat(full);
-					if (st.mtimeMs >= cutoffMs) {
-						return { stale: false, bytes: 0, fileCount: 0 };
-					}
-					bytes += st.size;
-					fileCount++;
-				} catch {
-					// vanished/unreadable — skip
-				}
-			}
-		}
-	}
-	return { stale: true, bytes, fileCount };
-}
-
-/** Parse the root-fs Use% from `df --output=pcent,target` output (pure, for tests).
- *  Returns null if no root-mount line is found. */
-export function parseRootDiskPct(out: string): number | null {
-	const rootLine = out.split("\n").find((l) => l.trim().endsWith("/"));
-	const m = rootLine?.match(/(\d+)%/);
-	return m ? Number(m[1]) : null;
-}
-
-async function sweepHostCache(ctx: {
-	config: { retention?: Record<string, string>; retention_dirs?: Record<string, string> };
-}): Promise<void> {
-	const log = getAppLogger();
-	const retention = ctx.config.retention ?? {};
-	const retentionDirs = ctx.config.retention_dirs ?? {};
-	const now = Date.now();
-	const results: SweepResult[] = [];
-
-	for (const [rawPath, rawDuration] of Object.entries(retention)) {
-		const days = parseDays(rawDuration);
-		if (days === null || days <= 0) {
-			log.warn(
-				`[host-cache-sweep] skipping "${rawPath}" — value "${rawDuration}" is not a day-granularity duration (expected e.g. "30 days")`,
-			);
-			continue;
-		}
-
-		const dir = resolveHostPath(rawPath);
-		try {
-			const st = await stat(dir);
-			if (!st.isDirectory()) {
-				log.warn(`[host-cache-sweep] skipping "${rawPath}" — resolved path is not a directory`);
-				continue;
-			}
-		} catch {
-			log.warn(`[host-cache-sweep] skipping "${rawPath}" — path does not exist or is unreadable`);
-			continue;
-		}
-
-		const cutoffMs = now - days * MS_PER_DAY;
-		const result = await sweepPath(dir, cutoffMs);
-		results.push(result);
-		log.info(
-			`[host-cache-sweep] ${rawPath}: scanned ${result.scanned}, deleted ${result.deleted} file(s) (${formatBytes(result.bytesFreed)}) older than ${rawDuration}`,
-		);
-	}
-
-	// retention_dirs — whole-directory prune for build caches (Rust target/).
-	// A matched dir is deleted ENTIRELY only when its newest file is older than
-	// the cutoff, so an actively-built repo keeps its cache and an abandoned one
-	// is reclaimed whole (never the partial slice that would corrupt the cache).
-	for (const [rawPattern, rawDuration] of Object.entries(retentionDirs)) {
-		const days = parseDays(rawDuration);
-		if (days === null || days <= 0) {
-			log.warn(
-				`[host-cache-sweep] skipping retention_dirs "${rawPattern}" — value "${rawDuration}" is not a day-granularity duration (expected e.g. "30 days")`,
-			);
-			continue;
-		}
-		const cutoffMs = now - days * MS_PER_DAY;
-		for (const dir of expandGlob(resolveHostPath(rawPattern))) {
-			try {
-				const st = await stat(dir);
-				if (!st.isDirectory()) continue;
-			} catch {
-				continue; // glob match that is not a dir (or vanished) — skip
-			}
-			const { stale, bytes, fileCount } = await checkDirStale(dir, cutoffMs);
-			if (!stale) continue;
-			await rm(dir, { recursive: true, force: true });
-			results.push({ path: dir, scanned: fileCount, deleted: fileCount, bytesFreed: bytes });
-			log.info(
-				`[host-cache-sweep] ${dir}: no build in ${rawDuration}; reclaimed whole dir — ${fileCount} file(s), ${formatBytes(bytes)}`,
-			);
-		}
-	}
-
-	const totalDeleted = results.reduce((sum, r) => sum + r.deleted, 0);
-	const totalBytes = results.reduce((sum, r) => sum + r.bytesFreed, 0);
-	log.info(
-		`[host-cache-sweep] complete: ${results.length} target(s), ${totalDeleted} file(s) deleted, ${formatBytes(totalBytes)} reclaimed`,
-	);
-
-	// Liveness signal — distinct kind so the event-log sweep watchdog is unaffected.
-	recordEvent({
-		kind: "host.cache.swept",
-		payload: {
-			targets: results.map((r) => ({
-				path: r.path,
-				scanned: r.scanned,
-				deleted: r.deleted,
-				bytesFreed: r.bytesFreed,
-			})),
-			totalDeleted,
-			totalBytesFreed: totalBytes,
-			completedAt: new Date().toISOString(),
-		},
-	});
-
-	// Disk-threshold observability — rides this periodic sweep (NOT an interval:
-	// this job is genuinely periodic application-DATA work — deletion — and the
-	// df read piggybacks once per run). Emits through the event-driven surface:
-	// logger.warn -> GlitchTip (the paging path, same as host.pressure) +
-	// recordEvent for the durable event_log record. Catches a fill faster than
-	// the nightly prune can absorb (a cache with no retention entry, an external
-	// dump, a runaway log) so the operator learns it within a day, not at 100%.
-	const diskHighPct = 90;
-	try {
-		const dfRes = spawnSync({ name: "df:/", command: ["df", "--output=pcent,target"], timeoutMs: 5_000 });
-		const dfOut = (dfRes.stdout ?? "").trim();
-		const usePct = parseRootDiskPct(dfOut);
-		if (usePct !== null && usePct >= diskHighPct) {
-			log.warn("host.disk.high", { usePct, threshold: diskHighPct, df: dfOut });
-			recordEvent({
-				kind: "host.disk.high",
-				payload: { usePct, threshold: diskHighPct, df: dfOut, completedAt: new Date().toISOString() },
-			});
-		}
-	} catch (error) {
-		log.warn("[host-cache-sweep] disk-threshold read failed: " + String(error));
-	}
-}
-
-pgBossHandlerRegistry.register(
-	"@teamscala/service-boot:sweep-host-cache",
-	sweepHostCache,
-);