@teamscala/service-boot 0.23.425 → 0.23.427

package/src/agreement-gate/agreement-lookup.ts

@@ -3,18 +3,13 @@
  * @status handwritten
  * @edit edit directly
  *
- * Agreement lookups + the gate's resolution caches: the page→agreement
- * association cache, the owning/party org member-directory caches, and the
- * event-driven invalidation (LISTEN registry_config_changed) that clears them.
+ * Agreement lookup: typed first-match query over the agreements model via
+ * the page-server ORPC client.
  *
  * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
  * paths adjusted only.
  */
 
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { queryRows } from "@teamscala/db/query-rows";
-import { createCache } from "@teamscala/cache/create-cache";
-import { createNotifyListener, getDirectDatabaseUrl } from "@teamscala/db/notify-listener/index";
 import { getServerClient } from "../page-server-orpc/server-client.ts";
 
 export async function findFirstAgreement<T>(input: {
@@ -26,102 +21,3 @@ export async function findFirstAgreement<T>(input: {
 	};
 	return client.agreements.findFirst(input);
 }
-
-/**
- * Cache for the page→agreement association (new-flow pages that have no
- * pre-placed gate block). The association changes rarely (only when a new
- * agreement is created or a page is rebound), so a 30s TTL avoids a DB query
- * per request while staying fresh enough for just-created agreements to appear.
- * Negative results are cached too (id="") so non-agreement pages never re-query.
- */
-export const pageAgreementCache = createCache<{ id: string; name: string }>(
-	"agreement-gate:page-association",
-	{ maxSize: 256, ttlMs: 30_000 },
-);
-
-/**
- * Cache for the owning org's member directory (org id → lowercased email → name),
- * used to grant VIEW-ONLY access to an agreement to any member of the org that
- * owns it (signing stays roster-bound). Membership changes on human timescales,
- * so a 30s TTL keeps the per-request authorize cheap (hot-path-resolutions-are-cached).
- */
-export const orgMemberCache = createCache<Map<string, string>>(
-	"agreement-gate:org-members",
-	{ maxSize: 256, ttlMs: 30_000 },
-);
-
-/**
- * The owning org's member directory: lowercased email → display name, for every
- * member of `organisationId`. Empty when the org is unknown or has no members.
- *
- * Resolved via a parameterized raw join over better_auth_member + "user" rather
- * rather than a service-local Prisma `member` model: `member` is a shared
- * @@map'd Prisma model, and each
- * service's per-service client is generated by live DB introspection from only
- * the tables its service_schema declares — so that model is undefined
- * on a service (scala-sign, scala-proposals) that doesn't list better_auth_member.
- * A read-only raw query needs no model declaration and works on every client,
- * which is what makes org-member VIEW access actually resolve (the typed access
- * silently crashed → caught → empty directory → org members wrongly challenged).
- */
-export async function resolveOrgMemberDirectory(
-	organisationId: string | null,
-): Promise<Map<string, string>> {
-	if (!organisationId) return new Map();
-	const cached = orgMemberCache.get(organisationId);
-	if (cached !== undefined) return cached;
-	const directory = new Map<string, string>();
-	try {
-		const rows = await queryRows`
-			SELECT u.email AS email, u.name AS name
-			FROM better_auth_member m
-			JOIN "user" u ON u.id = m.user_id
-			WHERE m.organization_id = ${organisationId}
-		` as
-			Array<{ email: string | null; name: string | null }>
-		;
-		for (const r of rows) {
-			const email = typeof r.email === "string" ? r.email.trim().toLowerCase() : "";
-			if (email) directory.set(email, String(r.name ?? r.email));
-		}
-		orgMemberCache.set(organisationId, directory);
-		return directory;
-	} catch (err) {
-		getAppLogger().error(
-			`[agreement-gate] org-member resolve failed: ${err instanceof Error ? err.message : String(err)}`,
-		);
-		return directory;
-	}
-}
-
-/**
- * The combined member directory for EVERY org an agreement's parties represent
- * (each party's `organisationId`) plus the agreement's owning org. Any of these
- * members may VIEW the agreement; signing stays restricted to the designated
- * signer (the party email). Usually 1 org (one of our orgs + an external party),
- * so the loop is over a 1-2 element set, each entry cached.
- */
-export async function resolveAgreementViewerDirectory(
-	orgIds: Iterable<string | null | undefined>,
-): Promise<Map<string, string>> {
-	const out = new Map<string, string>();
-	const unique = new Set(
-		[...orgIds].filter((id): id is string => typeof id === "string" && id.length > 0),
-	);
-	for (const orgId of unique) {
-		const dir = await resolveOrgMemberDirectory(orgId);
-		for (const [email, name] of dir) if (!out.has(email)) out.set(email, name);
-	}
-	return out;
-}
-
-// Event-driven invalidation via LISTEN on registry_config_changed
-{
-	const _url = getDirectDatabaseUrl();
-	if (_url) {
-		createNotifyListener(_url).listen("registry_config_changed", () => {
-			pageAgreementCache.clear();
-			orgMemberCache.clear();
-		}).catch((e: unknown) => console.error("[cache-invalidation] subscribe failed: " + e));
-	}
-}

package/src/agreement-gate/authorized-emails.ts

@@ -12,7 +12,8 @@
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { parseAgreementParties } from "@teamscala/document-signing/agreement-parties";
-import { findFirstAgreement, resolveAgreementViewerDirectory } from "./agreement-lookup.ts";
+import { findFirstAgreement } from "./agreement-lookup.ts";
+import { resolveAgreementViewerDirectory } from "./resolution-caches.ts";
 
 /** The agreement's authorized email set (its signer roster) for the access endpoint. */
 export async function resolveAgreementSignerEmails(

package/src/agreement-gate/resolution-caches.ts

@@ -0,0 +1,108 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The agreement gate's resolution caches: the page→agreement association
+ * cache, the owning/party org member-directory caches, and the event-driven
+ * invalidation (LISTEN registry_config_changed) that clears them.
+ */
+
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { queryRows } from "@teamscala/db/query-rows";
+import { createCache } from "@teamscala/cache/create-cache";
+import { registerCacheInvalidation } from "@teamscala/db/notify-listener/index";
+
+/**
+ * Cache for the page→agreement association (new-flow pages that have no
+ * pre-placed gate block). The association changes rarely (only when a new
+ * agreement is created or a page is rebound), so a 30s TTL avoids a DB query
+ * per request while staying fresh enough for just-created agreements to appear.
+ * Negative results are cached too (id="") so non-agreement pages never re-query.
+ */
+export const pageAgreementCache = createCache<{ id: string; name: string }>(
+	"agreement-gate:page-association",
+	{ maxSize: 256, ttlMs: 30_000 },
+);
+
+/**
+ * Cache for the owning org's member directory (org id → lowercased email → name),
+ * used to grant VIEW-ONLY access to an agreement to any member of the org that
+ * owns it (signing stays roster-bound). Membership changes on human timescales,
+ * so a 30s TTL keeps the per-request authorize cheap (hot-path-resolutions-are-cached).
+ */
+export const orgMemberCache = createCache<Map<string, string>>(
+	"agreement-gate:org-members",
+	{ maxSize: 256, ttlMs: 30_000 },
+);
+
+/**
+ * The owning org's member directory: lowercased email → display name for
+ * every member of `organisationId`; empty when the org is unknown. Raw join,
+ * NOT the shared @@map'd Prisma `member` model — per-service clients are
+ * introspected from only the tables their service_schema declares, so that
+ * model is undefined on services that don't list better_auth_member. The
+ * typed access silently crashed → empty directory → org members wrongly
+ * challenged; the raw query works on every client.
+ */
+export async function resolveOrgMemberDirectory(
+	organisationId: string | null,
+): Promise<Map<string, string>> {
+	if (!organisationId) return new Map();
+	const cached = orgMemberCache.get(organisationId);
+	if (cached !== undefined) return cached;
+	const directory = new Map<string, string>();
+	try {
+		const rows = await queryRows`
+			SELECT u.email AS email, u.name AS name
+			FROM better_auth_member m
+			JOIN "user" u ON u.id = m.user_id
+			WHERE m.organization_id = ${organisationId}
+		` as
+			Array<{ email: string | null; name: string | null }>
+		;
+		for (const r of rows) {
+			const email = typeof r.email === "string" ? r.email.trim().toLowerCase() : "";
+			if (email) directory.set(email, String(r.name ?? r.email));
+		}
+		orgMemberCache.set(organisationId, directory);
+		return directory;
+	} catch (err) {
+		getAppLogger().error(
+			`[agreement-gate] org-member resolve failed: ${err instanceof Error ? err.message : String(err)}`,
+		);
+		return directory;
+	}
+}
+
+/**
+ * The combined member directory for EVERY org an agreement's parties represent
+ * (each party's `organisationId`) plus the agreement's owning org. Any of these
+ * members may VIEW the agreement; signing stays restricted to the designated
+ * signer (the party email). Usually 1 org (one of our orgs + an external party),
+ * so the loop is over a 1-2 element set, each entry cached.
+ */
+export async function resolveAgreementViewerDirectory(
+	orgIds: Iterable<string | null | undefined>,
+): Promise<Map<string, string>> {
+	const out = new Map<string, string>();
+	const unique = new Set(
+		[...orgIds].filter((id): id is string => typeof id === "string" && id.length > 0),
+	);
+	for (const orgId of unique) {
+		const dir = await resolveOrgMemberDirectory(orgId);
+		for (const [email, name] of dir) if (!out.has(email)) out.set(email, name);
+	}
+	return out;
+}
+
+// Event-driven invalidation via the process-wide shared LISTEN connection.
+// `createNotifyListener` is a FACTORY — each call opens its own client
+// (max:1, idle_timeout:0) that is never reused or stopped, so calling it at
+// module scope costs one permanent connection per module. Measured
+// 2026-08-28: twelve such sites gave every Puck UI service 8 LISTEN
+// connections and zero query connections (scala-portal 18).
+registerCacheInvalidation(() => {
+	pageAgreementCache.clear();
+	orgMemberCache.clear();
+});

package/src/agreement-gate/signing-session.ts

@@ -21,7 +21,8 @@ import {
 	buildCertificateData,
 	type CertificateData,
 } from "../fn-routers/agreement-certificate.ts";
-import { findFirstAgreement, resolveAgreementViewerDirectory } from "./agreement-lookup.ts";
+import { findFirstAgreement } from "./agreement-lookup.ts";
+import { resolveAgreementViewerDirectory } from "./resolution-caches.ts";
 
 export interface ContentBlock {
 	type?: string;

package/src/agreement-gate.ts

@@ -31,7 +31,8 @@ import { injectResourceChatLauncher } from "./resource-chat-inject.ts";
 import { agTtlMs } from "./gate-ttls.ts";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { AG_COOKIE, AGREEMENT_GATE_DEFAULTS, loadAgreementGateSettings } from "./agreement-gate/settings.ts";
-import { findFirstAgreement, pageAgreementCache } from "./agreement-gate/agreement-lookup.ts";
+import { findFirstAgreement } from "./agreement-gate/agreement-lookup.ts";
+import { pageAgreementCache } from "./agreement-gate/resolution-caches.ts";
 import {
 	brandOrgName,
 	buildSigningSession,

package/src/handlers/platform-fault-escalation/config.ts

@@ -49,6 +49,25 @@ export const FaultEscalationConfigSchema = v.object({
 			}),
 		),
 	),
+	/** Per-kind CAPABILITY PROBES gating the recovery transition (operator
+	 * ruling 2026-08-28: a layer emitting a degraded transition owes a
+	 * recovery transition backed by a capability probe, never a timer over
+	 * an empty event stream). A kind declared here resolves only when its
+	 * probe answers HTTP OK; an unreachable probe HOLDS the episode open —
+	 * once per episode-state, never an alarm. The volume floor above is
+	 * still event-stream evidence and cannot answer alone: its window is
+	 * cumulative, so hours of healthy history mask a just-died producer
+	 * (measured 2026-08-28: llm.provider.call.failed resolved after 31
+	 * quiet minutes on 12h-old volume while the pipeline was down). */
+	probe_sources: v.optional(
+		v.record(
+			v.string(),
+			v.object({
+				url: v.pipe(v.string(), v.minLength(1)),
+				timeout_seconds: v.optional(v.number()),
+			}),
+		),
+	),
 	/** The orchestrator's work item — escalations are COMMENTS on it, never
 	 * task rows (the fleet-task-placement CHECK constraint refuses a system
 	 * task without session identity, and an escalation is a finding, not an

package/src/handlers/platform-fault-escalation/event-log-queries.ts

@@ -145,6 +145,26 @@ export async function fetchVolumeCount(pattern: string, windowMinutes: number):
 	return Number(rows[0]?.n ?? 0);
 }
 
+/** Whether a resolve-HOLD has already been raised for this episode state:
+ * the newest `platform.fault.resolve_held` naming the kind is newer than the
+ * episode's last transition. Durable, never process memory — a restart must
+ * not re-raise the hold, and a NEW episode state (a later last_updated_at)
+ * may raise it again. */
+export async function resolveHoldRaisedSince(kind: string, since: Date | null): Promise<boolean> {
+	const prisma = getPrisma();
+	const rows = await prisma.$queryRawUnsafe<Array<{ occurred_at: Date }>>(
+		`SELECT occurred_at FROM event_log
+			 WHERE kind = 'platform.fault.resolve_held'
+			   AND payload_json->>'event_kind' = $1::text
+			 ORDER BY occurred_at DESC LIMIT 1`,
+		kind,
+	);
+	const latest = rows[0]?.occurred_at;
+	if (!latest) return false;
+	if (!since) return true;
+	return new Date(latest) > since;
+}
+
 /** Whether a zero-volume hold marker STANDS for a fault kind: derived from
  * the durable stream (latest flagged/cleared wins), never from process
  * memory — a restart must not re-raise or silently drop a standing hold.

package/src/handlers/platform-fault-escalation/probe.test.ts

@@ -0,0 +1,64 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavioural tests for the capability probe behind the resolve gate
+ * (operator ruling 2026-08-28): an episode whose subject is genuinely down
+ * must FAIL to close. Health surfaces encode capability in the STATUS CODE
+ * (llm-router /health answers 503 while degraded), so healthy means 2xx.
+ */
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { probeHttpOk } from "./probe.ts";
+
+describe("probeHttpOk — the resolve gate's instrument", () => {
+	let server: Bun.Server<undefined>;
+	let port = 0;
+
+	beforeAll(() => {
+		server = Bun.serve({
+			port: 0,
+			fetch(request) {
+				const url = new URL(request.url);
+				if (url.pathname === "/ok") return new Response('{"status":"ok"}');
+				if (url.pathname === "/degraded") return new Response('{"status":"degraded"}', { status: 503 });
+				return new Response("not found", { status: 404 });
+			},
+		});
+		port = server.port as number;
+	});
+
+	afterAll(() => {
+		server.stop(true);
+	});
+
+	test("an answering, healthy endpoint verifies", async () => {
+		expect(await probeHttpOk(`http://127.0.0.1:${port}/ok`)).toBe(true);
+	});
+
+	test("a subject answering DEGRADED must not read as healthy — 503 is not an OK", async () => {
+		// THE MEASURED SHAPE: the 2026-08-28 close-on-quiet fired while the
+		// pipeline was down. A probe that treated "any response" as health
+		// would resolve an episode whose subject is still answering
+		// "degraded" — the same verdict with no instrument behind it.
+		expect(await probeHttpOk(`http://127.0.0.1:${port}/degraded`)).toBe(false);
+	});
+
+	test("a subject that does not answer the probe's question must not read as healthy", async () => {
+		expect(await probeHttpOk(`http://127.0.0.1:${port}/missing`)).toBe(false);
+	});
+
+	test("a subject that cannot be reached at all must not read as healthy", async () => {
+		// Port 1 on loopback: nothing listens there; the probe must refuse
+		// promptly, not hang or throw.
+		expect(await probeHttpOk("http://127.0.0.1:1/health", 1)).toBe(false);
+	});
+
+	test("an unreachable subject must not read as healthy", async () => {
+		expect(await probeHttpOk("http://127.0.0.1:1/health", 1)).toBe(false);
+	});
+
+	test("an unreachable subject with a tiny timeout still refuses, never throws", async () => {
+		expect(await probeHttpOk("http://10.255.255.1:9/health", 1)).toBe(false);
+	});
+});

package/src/handlers/platform-fault-escalation/probe.ts

@@ -0,0 +1,19 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The capability probe behind the resolve gate (operator ruling 2026-08-28):
+ * a recovery transition is backed by an ACTIVE question to the subject's
+ * capability surface, never a timer over an empty event stream. Healthy
+ * means HTTP OK (2xx) — llm-router /health answers 503 while degraded.
+ */
+
+export async function probeHttpOk(url: string, timeoutSeconds = 5): Promise<boolean> {
+	try {
+		const response = await fetch(url, { signal: AbortSignal.timeout(timeoutSeconds * 1000) });
+		return response.ok;
+	} catch {
+		return false;
+	}
+}

package/src/handlers/platform-fault-escalation-logic.ts

@@ -61,6 +61,17 @@ export interface SweepDecision {
 	 * model backend at all). The episode HOLDS OPEN and the hold raises
 	 * once; it never resolves from silence alone. */
 	zeroVolumeHold: Array<{ episode: EscalationEpisode; quietMinutes: number; volumeCount: number }>;
+	/** Open episodes quiet past the resolve window whose kind declares a
+	 * CAPABILITY PROBE: the close is withheld until the probe answers OK.
+	 * The handler runs the probe and either resolves or holds — the decision
+	 * core stays pure (it selects WHO must be probed, it never probes). */
+	resolveProbeGate: Array<{
+		episode: EscalationEpisode;
+		quietMinutes: number;
+		clearZeroVolumeFlag: boolean;
+		probeUrl: string;
+		probeTimeoutSeconds: number;
+	}>;
 }
 
 /** Per-kind config naming the kind whose VOLUME proves the producing
@@ -72,6 +83,15 @@ export interface ZeroVolumeSource {
 	min_volume?: number;
 }
 
+/** Per-kind config naming the capability probe that must answer OK before
+ * this fault kind's episode may close. The probe is an ACTIVE question to
+ * the subject's capability surface (HTTP OK), never a read of the event
+ * stream — absence of events is never evidence of state. */
+export interface ProbeSource {
+	url: string;
+	timeout_seconds?: number;
+}
+
 /** Everything decideSweep needs to judge quiet-vs-healthy, computed by the
  * caller from the valibot-validated config row + bounded queries. */
 export interface ZeroVolumeInputs {
@@ -125,10 +145,12 @@ export function decideSweep(
 	now: Date,
 	kindThresholds: Record<string, KindThresholdOverride> = {},
 	zeroVolume?: ZeroVolumeInputs,
+	probeSources: Record<string, ProbeSource> = {},
 ): SweepDecision {
 	const byKind = new Map(episodes.map((e) => [e.kind, e]));
 	const aggregateByKind = new Map(aggregates.map((a) => [a.kind, a]));
-	const decision: SweepDecision = { escalate: [], resolve: [], zeroVolumeHold: [] };
+	const decision: SweepDecision =
+		{ escalate: [], resolve: [], resolveProbeGate: [], zeroVolumeHold: [] };
 
 	for (const aggregate of aggregates) {
 		const episode = byKind.get(aggregate.kind);
@@ -180,6 +202,22 @@ export function decideSweep(
 				continue;
 			}
 		}
+		// PROBE-GATED RESOLUTION (operator ruling 2026-08-28): a kind with a
+		// declared capability probe does not close on quiet + volume alone —
+		// the handler must first ask the subject's capability surface and
+		// only an HTTP OK closes the episode. An unreachable probe holds the
+		// episode open (once per episode-state, never an alarm).
+		const probe = probeSources[episode.kind];
+		if (probe) {
+			decision.resolveProbeGate.push({
+				episode,
+				quietMinutes,
+				clearZeroVolumeFlag: Boolean(source && zeroVolume?.flagActiveByKind[episode.kind]),
+				probeUrl: probe.url,
+				probeTimeoutSeconds: probe.timeout_seconds ?? 5,
+			});
+			continue;
+		}
 		decision.resolve.push({
 			episode,
 			quietMinutes,

package/src/handlers/platform-fault-escalation.test.ts

@@ -115,7 +115,12 @@ describe("decideSweep — dedup (one escalation per fault, no re-fire)", () => {
 		const decision = decideSweep([sustained], [longOpen], POLICY, NOW);
 		expect(decision.escalate).toHaveLength(0);
 		expect(decision.resolve).toHaveLength(0);
-		expect(Object.keys(decision).sort()).toEqual(["escalate", "resolve", "zeroVolumeHold"]);
+		expect(Object.keys(decision).sort()).toEqual([
+			"escalate",
+			"resolve",
+			"resolveProbeGate",
+			"zeroVolumeHold",
+		]);
 	});
 
 	test("a claimed-but-undelivered episode is RETRIED, not counted as escalated", () => {
@@ -399,3 +404,43 @@ describe("composeZeroVolumeMessage — the quiet-is-not-healthy notice", () => {
 		expect(message.split("\n").length).toBeLessThanOrEqual(4);
 	});
 });
+
+describe("decideSweep — probe-gated resolution (operator ruling 2026-08-28)", () => {
+	const PROBE_SOURCES = {
+		"llm.provider.call.failed": { url: "https://ai.scala.business/health", timeout_seconds: 5 },
+	};
+
+	test("a kind with a declared probe is gated, not resolved on quiet", () => {
+		const gone = episode({
+			kind: "llm.provider.call.failed",
+			lastSeenAt: new Date(NOW.getTime() - 60 * 60_000),
+		});
+		const decision = decideSweep([agg("llm.provider.call.failed", 10, 700, 60)], [gone], POLICY, NOW, {}, undefined, PROBE_SOURCES);
+		expect(decision.resolve).toHaveLength(0);
+		expect(decision.resolveProbeGate).toHaveLength(1);
+		expect(decision.resolveProbeGate[0]!.probeUrl).toBe("https://ai.scala.business/health");
+		expect(decision.resolveProbeGate[0]!.quietMinutes).toBeGreaterThanOrEqual(30);
+	});
+
+	test("a kind without a declared probe resolves on quiet exactly as before", () => {
+		const gone = episode({ kind: "wake.failed", lastSeenAt: new Date(NOW.getTime() - 60 * 60_000) });
+		const decision = decideSweep([agg("wake.failed", 10, 700, 60)], [gone], POLICY, NOW, {}, undefined, PROBE_SOURCES);
+		expect(decision.resolve).toHaveLength(1);
+		expect(decision.resolveProbeGate).toHaveLength(0);
+	});
+
+	test("the gate passes through the zero-volume flag so a healthy probe clears it", () => {
+		const gone = episode({
+			kind: "llm.provider.call.failed",
+			lastSeenAt: new Date(NOW.getTime() - 60 * 60_000),
+		});
+		const zeroVolume = {
+			sources: { "llm.provider.call.failed": { volume_kind_pattern: "^llm\.router\.routing_decision$", min_volume: 1 } },
+			countByKind: { "llm.provider.call.failed": 12 },
+			flagActiveByKind: { "llm.provider.call.failed": true },
+		};
+		const decision = decideSweep([agg("llm.provider.call.failed", 10, 700, 60)], [gone], POLICY, NOW, {}, zeroVolume, PROBE_SOURCES);
+		expect(decision.resolveProbeGate).toHaveLength(1);
+		expect(decision.resolveProbeGate[0]!.clearZeroVolumeFlag).toBe(true);
+	});
+});

package/src/handlers/platform-fault-escalation.ts

@@ -25,6 +25,8 @@ import {
 	type ZeroVolumeInputs,
 } from "./platform-fault-escalation-logic.ts";
 import { loadFaultEscalationConfig } from "./platform-fault-escalation/config.ts";
+import { probeHttpOk } from "./platform-fault-escalation/probe.ts";
+import { resolveHoldRaisedSince } from "./platform-fault-escalation/event-log-queries.ts";
 import {
 	fetchAggregates,
 	fetchVolumeCount,
@@ -70,6 +72,7 @@ async function platformFaultEscalationSweep(ctx: { config: ScheduledJobConfig })
 		lastUpdatedAt: row.last_updated_at ? new Date(row.last_updated_at) : null,
 	}));
 
+	const probeSources = config.probe_sources ?? {};
 	const kindThresholds: Record<string, KindThresholdOverride> = {};
 	for (const [kind, override] of Object.entries(config.kind_thresholds ?? {})) {
 		kindThresholds[kind] = {
@@ -104,6 +107,7 @@ async function platformFaultEscalationSweep(ctx: { config: ScheduledJobConfig })
 		now,
 		kindThresholds,
 		Object.keys(volumeSources).length > 0 ? zeroVolume : undefined,
+		probeSources,
 	);
 
 	// Per-kind isolation: one fault's delivery failure must never block the
@@ -139,6 +143,39 @@ async function platformFaultEscalationSweep(ctx: { config: ScheduledJobConfig })
 			log.error(`[platform-fault-escalation] zero-volume hold for '${episode.kind}' failed (retried next sweep): ${err instanceof Error ? err.message : String(err)}`);
 		}
 	}
+	// PROBE-GATED RESOLUTION (operator ruling 2026-08-28): the recovery
+	// transition fires only when the subject's capability probe answers OK.
+	// An unreachable probe HOLDS the episode open — the close-refusal is
+	// raised ONCE per episode state as a durable event, never an alarm: the
+	// original verdict (failures went quiet) was correct; it lacked the
+	// probe behind the verdict.
+	let resolveProbeHeld = 0;
+	for (const { episode, quietMinutes, clearZeroVolumeFlag, probeUrl, probeTimeoutSeconds } of decision.resolveProbeGate) {
+		try {
+			if (await probeHttpOk(probeUrl, probeTimeoutSeconds)) {
+				await resolveEpisode(episode, quietMinutes);
+				if (clearZeroVolumeFlag) await clearZeroVolumeHold(episode, zeroVolume.countByKind[episode.kind] ?? 0);
+				log.info(`[platform-fault-escalation] RESOLVED '${episode.kind}' — capability probe ${probeUrl} answered OK after ${quietMinutes} quiet min`);
+			} else {
+				resolveProbeHeld += 1;
+				if (await resolveHoldRaisedSince(episode.kind, episode.lastUpdatedAt ?? episode.firstSeenAt)) continue;
+				recordEvent({
+					kind: "platform.fault.resolve_held",
+					payload: {
+						event_kind: episode.kind,
+						probe: probeUrl,
+						quiet_minutes: quietMinutes,
+						work_item_id: episode.workItemId,
+					},
+				});
+				log.warn(
+					`[platform-fault-escalation] resolve HELD for '${episode.kind}' — capability probe ${probeUrl} did not answer OK; episode stays open (raised once, not an alarm)`,
+				);
+			}
+		} catch (err) {
+			log.error(`[platform-fault-escalation] probe-gated resolve for '${episode.kind}' failed (episode stays open; retried next sweep): ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
 	for (const { episode, quietMinutes, clearZeroVolumeFlag } of decision.resolve) {
 		try {
 			await resolveEpisode(episode, quietMinutes);
@@ -155,7 +192,8 @@ async function platformFaultEscalationSweep(ctx: { config: ScheduledJobConfig })
 		payload: {
 			watched_kinds: aggregates.length,
 			escalated: decision.escalate.length,
-			resolved: decision.resolve.length,
+			resolved: decision.resolve.length + (decision.resolveProbeGate.length - resolveProbeHeld),
+			resolve_probe_held: resolveProbeHeld,
 			zero_volume_holds: decision.zeroVolumeHold.length,
 		},
 	});

package/src/install-logging.ts

@@ -19,7 +19,6 @@
 
 import { ManagedCache } from "@teamscala/cache/cache";
 import { createCache } from "@teamscala/cache/create-cache";
-import { createNotifyListener, getDirectDatabaseUrl } from "@teamscala/db/notify-listener/index";
 import { createDiskCache } from "@teamscala/cache/disk-cache";
 import { join } from "node:path";
 import { userHome } from "@teamscala/os/host-paths";
@@ -181,5 +180,8 @@ function safeStringify(v: unknown): string {
 		return String(v);
 	}
 }
-// Guard predicate: event-driven invalidation subscription
-{ const _u = getDirectDatabaseUrl(); if (_u) createNotifyListener(_u).listen("registry_config_changed", () => {}).catch((e: unknown) => console.error("[cache-invalidation] subscribe failed: " + e)); }
+// No event-driven invalidation subscription here: this module caches nothing.
+// The removed block opened a dedicated LISTEN connection whose handler was
+// empty `() => {}` — a connection held for the process lifetime to run no
+// code. Registering a no-op against the shared listener would be the same
+// defect one layer down, so it is deleted rather than migrated.

package/src/mount-server-packages.ts

@@ -58,10 +58,11 @@ export async function mountServerPackages(
 	app: Hono,
 	config: ServiceInstallConfig,
 	serviceSlug: string,
+	getSharedDb?: () => unknown,
 ): Promise<MountRegistry> {
 	const log = getAppLogger();
 	const mountRegistry = createMountRegistry();
-	const mountCtx = createMountContext(serviceSlug, config, app, mountRegistry);
+	const mountCtx = createMountContext(serviceSlug, config, app, mountRegistry, getSharedDb);
 	const serverPackages = (config.server_packages ?? []) as string[];
 
 	if (serverPackages.length === 0) {

package/src/resource-not-found.ts

@@ -30,7 +30,7 @@
 
 import { getClient } from "@teamscala/object-storage/create/client/get-client";
 import { createCache } from "@teamscala/cache/create-cache";
-import { createNotifyListener, getDirectDatabaseUrl } from "@teamscala/db/notify-listener/index";
+import { registerCacheInvalidation } from "@teamscala/db/notify-listener/index";
 import { getServerClient } from "@teamscala/orpc/server-client-registry";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -290,11 +290,9 @@ export function buildResourceNotFoundResponse(
 	});
 }
 
-{
-	const _url = getDirectDatabaseUrl();
-	if (_url) {
-		createNotifyListener(_url).listen("registry_config_changed", () => {
-		logoCache.clear();
-		}).catch((e: unknown) => console.error("[cache-invalidation] subscribe failed: " + e));
-	}
-}
+// Shares the one process-wide LISTEN connection rather than opening its own:
+// `createNotifyListener` is a factory, so a module-scope call holds a
+// connection for the process lifetime (see resolution-caches.ts).
+registerCacheInvalidation(() => {
+	logoCache.clear();
+});