@teamscala/service-boot 0.23.420 → 0.23.421

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.420",
+  "version": "0.23.421",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/public-agreement-router.ts

@@ -8,25 +8,17 @@
  * (getOrpcClient().fn.publicAgreement.*). The unguessable agreement id plus an
  * email that matches one of the agreement's parties IS the gate (no password).
  *
- * This is the off-the-shelf path per building-applications: server logic beyond
- * CRUD is a typed ORPC procedure (the publicAssessment/publicGptSession shape),
- * NOT a hand-written /api/data/* Hono handler and NOT a loopback fetch to the
- * service's own ORPC. Writes go through context.prisma inside the handler — the
- * sanctioned in-handler DB access (orpc-is-the-only-api) — so the audit trigger
- * sees the ORPC caller context, the same proven path publicGptSession uses.
+ * Off-the-shelf path (building-applications): typed ORPC procedure, not a
+ * hand-written Hono handler; writes go through context.prisma inside the
+ * handler (orpc-is-the-only-api) so the audit trigger sees the ORPC caller.
+ * Multi-party model: signature_data holds a parties roster (JSON); each party
+ * is gated by its own email and the agreement completes only when every party
+ * has signed; single-signer falls back to signer_email/signer_name.
  *
- * Multi-party model: signature_data holds a parties roster (JSON) so one
- * agreement can require signatures from several parties (e.g. Provider + Client)
- * with no schema change. Each party is gated by its own email; the agreement
- * completes (signed_at set) only when every party has signed. A single-signer
- * agreement falls back to the original signer_email/signer_name columns.
- *
- * This module holds the three procedures (verify/sign/verifyDocument). The
- * supporting machinery lives as siblings: agreement-signing-evidence.ts
- * (origin/IP extraction, tamper-evident hash, evidence parser),
- * agreement-certificate.ts (Certificate of Completion), and
- * agreement-sign-side-effects.ts (invoice, demo-reset, CRM connect) — split
- * when the parent held them all at 853 lines.
+ * This module holds the three procedures (verify/sign/verifyDocument); the
+ * supporting machinery lives as siblings (agreement-signing-evidence,
+ * agreement-certificate, agreement-sign-side-effects) — split when the parent
+ * held them all at 853 lines.
  */
 
 import { os } from "@orpc/server";

package/src/pg-boss-mount.ts

@@ -140,9 +140,15 @@ export async function mountPgBoss(
 	const boss = new PgBoss({
 		connectionString: pgSslCompatUrl(ctx.databaseUrl),
 		application_name: `pgboss:${ctx.serviceSlug}`,
-		// Same per-service budget as the application Prisma pool (railway.ts):
-		// ~30 consumers share one 200-conn Postgres; 3 keeps the aggregate ≤90.
-		max: 3,
+		// ONE connection, not three: pg-boss is a sibling pool that sits OUTSIDE
+		// the Prisma budget, and with ~46 declared holders the fleet saturated
+		// at 304/300 (2026-08-27) partly on 3-connection pg-boss pools that had
+		// no idle timeout. At max:1 jobs serialize into a queue — the sanctioned
+		// background degradation (`a-per-consumer-pool-max-is-not-a-bound-on-the-server`:
+		// background work degrades to a queue, interactive work degrades to an
+		// outage). The sibling total is declared in
+		// config/db-pool-sizing.serviceSiblingConnections.
+		max: 1,
 		// Generous connection-acquisition budget for the cross-internet link so
 		// a slow TLS handshake under sustained load doesn't terminate the conn.
 		connectionTimeoutMillis: 30_000,