@teamscala/service-boot 0.23.431 → 0.23.433

package/src/handlers/platform-fault-escalation/orpc-client.ts

@@ -11,20 +11,6 @@
  * byte-for-byte move; import paths adjusted only.
  */
 
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import * as v from "valibot";
-
-let cachedSystemIdentity: { userId: string | undefined; organisationId: string | undefined } | undefined;
-export async function getSystemIdentity(): Promise<{ userId: string | undefined; organisationId: string | undefined }> {
-	if (cachedSystemIdentity) return cachedSystemIdentity;
-	const row = await loadRegistryConfig("config", "system-identity", v.looseObject({}));
-	cachedSystemIdentity = {
-		userId: row?.system_user_id as string | undefined,
-		organisationId: row?.system_org_id as string | undefined,
-	};
-	return cachedSystemIdentity;
-}
-
 /**
  * The system-authed in-process ORPC client, built LAZILY on first use from the
  * SAME composed appRouter the /api/rpc mount uses (getAppRouter — never a raw
@@ -40,9 +26,39 @@ export async function getSystemIdentity(): Promise<{ userId: string | undefined;
  * the assigned-client form with $queryRawUnsafe. Timestamps are ISO strings,
  * never Date instances (the generated valibot schemas require it).
  */
-let cachedOrpc: OrpcSurface | null = null;
+
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import * as v from "valibot";
+import { createCache } from "@teamscala/cache/create-cache";
+
+const systemIdentityCache = createCache<{
+	userId: string | undefined;
+	organisationId: string | undefined;
+}>("service-boot:fault-escalation-system-identity", {
+	ttlMs: Number.POSITIVE_INFINITY,
+	maxSize: 1,
+});
+
+export async function getSystemIdentity(): Promise<{ userId: string | undefined; organisationId: string | undefined }> {
+	const hit = systemIdentityCache.get("default");
+	if (hit) return hit;
+	const row = await loadRegistryConfig("config", "system-identity", v.looseObject({}));
+	const identity = {
+		userId: row?.system_user_id as string | undefined,
+		organisationId: row?.system_org_id as string | undefined,
+	};
+	systemIdentityCache.set("default", identity);
+	return identity;
+}
+
+const orpcSurfaceCache = createCache<OrpcSurface>(
+	"service-boot:fault-escalation-orpc",
+	{ ttlMs: Number.POSITIVE_INFINITY, maxSize: 1 },
+);
+
 export async function orpc(): Promise<OrpcSurface> {
-	if (cachedOrpc) return cachedOrpc;
+	const hit = orpcSurfaceCache.get("default");
+	if (hit) return hit;
 	const { createRouterClient } = await import("@orpc/server");
 	const { getAppRouter } = await import("@teamscala/orpc/app-router");
 	const appRouter = (await getAppRouter()) as Record<string, unknown> | null;
@@ -61,7 +77,7 @@ export async function orpc(): Promise<OrpcSurface> {
 		"platform-identity",
 		PlatformIdentitySchema,
 	);
-	cachedOrpc = createRouterClient(
+	const surface = createRouterClient(
 		{ ...appRouter } as never,
 		{
 			context: {
@@ -74,7 +90,8 @@ export async function orpc(): Promise<OrpcSurface> {
 			},
 		} as never,
 	) as unknown as OrpcSurface;
-	return cachedOrpc;
+	orpcSurfaceCache.set("default", surface);
+	return surface;
 }
 
 /** The router subset this handler uses — mirrors the generated procedure args. */

package/src/handlers/projects-digest.ts

@@ -4,7 +4,7 @@
  * @edit edit directly
  *
  * The `projects-daily-digest` / `projects-weekly-digest` pg-boss handlers for
- * scala-projects. Same fixed-query shape as prune-stale-data: no row-driven
+ * scala-projects. Fixed-query shape: no row-driven
  * SQL, every query is a literal Prisma call against work_items; the
  * scheduled_job row only carries the cron.
  *

package/src/handlers/scala-tools-currency-watch.test.ts

@@ -1,5 +1,4 @@
 import { describe, expect, test } from "bun:test";
-import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 /**
@@ -20,10 +19,7 @@ import { join } from "node:path";
  * the module proves it cannot fire on any path. It also stays honest if someone
  * reintroduces the restart behind a new condition.
  */
-const SOURCE = readFileSync(
-	join(import.meta.dir, "scala-tools-currency-watch.ts"),
-	"utf-8",
-);
+const SOURCE = await Bun.file(join(import.meta.dir, "scala-tools-currency-watch.ts")).text();
 
 /** Comment prose legitimately discusses the removed restart; code must not do it. */
 const CODE = SOURCE.split("\n")

package/src/handlers/scala-tools-currency-watch.ts

@@ -25,6 +25,26 @@
  *
  * Registered under slug `@teamscala/service-boot:scala-tools-currency-watch`.
  */
+		// NO RESTART. The reinstall alone is sufficient, and restarting here was actively harmful.
+		//
+		// The premise this watch was written on — "restart so the fresh scala-tools loads" — does not hold for THIS package. scala-sentinel never
+		// imports `@teamscala/scala-tools`; it SPAWNS `node_modules/.bin/scala-tools` per invocation, so a freshly installed binary is picked up by the next
+		// spawn with no process restart at all. Verified 2026-07-27: the package is declared in scala-sentinel/package.json, yet scala-guard/src contains zero
+		// import statements resolving to it — it is spawned, never linked. dep-sync already encodes the same conclusion — HARNESS_CRITICAL_FAST_PATH
+		// maps this exact pair to install-WITHOUT-restart, while its PM2_CACHED sibling map exists for packages a daemon really does load at boot
+		// (@teamscala/codegen → codegen-daemon). This handler was the odd one out.
+		//
+		// The cost was not theoretical. Restarting the guard daemon takes enforcement offline for its warmup, and every shutdown logs "152 guard(s)
+		// failed to run (fail-open)" — so each unnecessary restart opened a window in which tool-check, turn-end and pre-push silently did not run. Three
+		// scala-tools versions published on 2026-07-26 alone, and this watch polls, so it re-fired for each. That inverts
+		// `infrastructure-outranks-application-durability`: a currency convenience was repeatedly disabling the thing it exists to keep current.
+		//
+		// It also used a bare `pm2 restart`, which is forbidden (`forbid-bare-pm2-restart`) precisely because it bypasses the
+		// currency-gated canonical pipeline — the guard blocks agents from that exact call.
+		//
+		// If a future package genuinely needs a restart to take effect, it does not belong here: add it to dep-sync's PM2_CACHED map, which already owns
+		// install-plus-restart and coalesces them.
+
 import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
@@ -124,38 +144,6 @@ async function scalaToolsCurrencyWatch(_ctx: { config: ScheduledJobConfig }): Pr
 			payload: { from: installed, to: latest },
 		});
 
-		// NO RESTART. The reinstall alone is sufficient, and restarting here was
-		// actively harmful.
-		//
-		// The premise this watch was written on — "restart so the fresh
-		// scala-tools loads" — does not hold for THIS package. scala-sentinel never
-		// imports `@teamscala/scala-tools`; it SPAWNS `node_modules/.bin/scala-tools`
-		// per invocation, so a freshly installed binary is picked up by the next
-		// spawn with no process restart at all. Verified 2026-07-27: the package is
-		// declared in scala-sentinel/package.json, yet scala-guard/src contains zero
-		// import statements resolving to it — it is spawned, never linked.
-		// dep-sync already encodes the same conclusion — HARNESS_CRITICAL_FAST_PATH
-		// maps this exact pair to install-WITHOUT-restart, while its PM2_CACHED
-		// sibling map exists for packages a daemon really does load at boot
-		// (@teamscala/codegen → codegen-daemon). This handler was the odd one out.
-		//
-		// The cost was not theoretical. Restarting the guard daemon takes
-		// enforcement offline for its warmup, and every shutdown logs "152 guard(s)
-		// failed to run (fail-open)" — so each unnecessary restart opened a window
-		// in which tool-check, turn-end and pre-push silently did not run. Three
-		// scala-tools versions published on 2026-07-26 alone, and this watch polls,
-		// so it re-fired for each. That inverts
-		// `infrastructure-outranks-application-durability`: a currency convenience
-		// was repeatedly disabling the thing it exists to keep current.
-		//
-		// It also used a bare `pm2 restart`, which is forbidden
-		// (`forbid-bare-pm2-restart`) precisely because it bypasses the
-		// currency-gated canonical pipeline — the guard blocks agents from that
-		// exact call.
-		//
-		// If a future package genuinely needs a restart to take effect, it does not
-		// belong here: add it to dep-sync's PM2_CACHED map, which already owns
-		// install-plus-restart and coalesces them.
 		log.info(
 			`[scala-tools-currency-watch] reinstalled ${PKG} ${installed} → ${latest} (no restart: sentinel spawns the binary, it does not import it)`,
 		);

package/src/handlers/singleton-tools-currency-watch.test.ts

@@ -1,11 +1,7 @@
 import { describe, expect, test } from "bun:test";
-import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
-const SOURCE = readFileSync(
-	join(import.meta.dir, "singleton-tools-currency-watch.ts"),
-	"utf-8",
-);
+const SOURCE = await Bun.file(join(import.meta.dir, "singleton-tools-currency-watch.ts")).text();
 
 const CODE = SOURCE.split("\n")
 	.filter((l) => !l.trimStart().startsWith("//") && !l.trimStart().startsWith("*"))

package/src/handlers/singleton-tools-currency-watch.ts

@@ -23,14 +23,6 @@
  *
  * Registered under slug `@teamscala/service-boot:singleton-tools-currency-watch`.
  */
-import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import { recordEvent } from "@teamscala/event-log/record-event";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { spawn } from "@teamscala/os/spawn";
-import { getDistTagVersion } from "@teamscala/publish-registry";
-import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
-
 /**
  * Where a tool's "latest" comes from.
  *
@@ -47,6 +39,27 @@ import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
  * never shadow a /usr/local/bin singleton wrapper. The gap was currency
  * tracking, never placement.
  */
+
+		// A GitHub-released binary is NOT installed by a package manager, so there
+		// is no "reinstall" verb to call — it would have to be downloaded, verified,
+		// made executable and swapped atomically over a file that may be RUNNING.
+		// That is a real install path with real failure modes (partial download,
+		// wrong architecture, replacing a binary mid-execution), and doing it badly
+		// is worse than not doing it: a half-written CLI is a broken CLI.
+		//
+		// So this reports the drift and stops. Detection is live from today; the
+		// automated swap is a separate, deliberate change. Reporting a version the
+		// watcher cannot actually install is honest — silently claiming currency
+		// would not be.
+
+import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { recordEvent } from "@teamscala/event-log/record-event";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { spawn } from "@teamscala/os/spawn";
+import { getDistTagVersion } from "@teamscala/publish-registry";
+import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
+
 type VersionSource =
 	| {
 			type: "npm_package";
@@ -210,17 +223,6 @@ async function reinstallTool(tool: SingletonTool, latest: string): Promise<boole
 	if (!vs) return false;
 
 	if (vs.type === "github_release") {
-		// A GitHub-released binary is NOT installed by a package manager, so there
-		// is no "reinstall" verb to call — it would have to be downloaded, verified,
-		// made executable and swapped atomically over a file that may be RUNNING.
-		// That is a real install path with real failure modes (partial download,
-		// wrong architecture, replacing a binary mid-execution), and doing it badly
-		// is worse than not doing it: a half-written CLI is a broken CLI.
-		//
-		// So this reports the drift and stops. Detection is live from today; the
-		// automated swap is a separate, deliberate change. Reporting a version the
-		// watcher cannot actually install is honest — silently claiming currency
-		// would not be.
 		log.warn(
 			`[singleton-tools-currency] ${tool.name}: STALE, latest ${latest} from ${vs.repo}. Automated github_release install is not implemented — update it manually.`,
 		);

package/src/handlers/upstream-issue-sync.ts

@@ -32,6 +32,7 @@ import { spawn } from "@teamscala/os/spawn";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
+import { createCache } from "@teamscala/cache/create-cache";
 
 interface GhIssue {
 	state: string;
@@ -52,12 +53,18 @@ interface CapturedResponse {
 }
 
 const DEFAULT_GH_TIMEOUT_MS = 20_000;
-let cachedGhTimeoutMs: number | undefined;
+const ghTimeoutCache = createCache<number>("service-boot:gh-timeout", {
+	ttlMs: Number.POSITIVE_INFINITY,
+	maxSize: 1,
+});
+
 async function getGhTimeoutMs(): Promise<number> {
-	if (cachedGhTimeoutMs !== undefined) return cachedGhTimeoutMs;
+	const hit = ghTimeoutCache.get("default");
+	if (hit !== undefined) return hit;
 	const row = await loadRegistryConfig("config", "upstream-issue-sync", v.looseObject({}));
-	cachedGhTimeoutMs = (row?.gh_timeout_ms as number | undefined) ?? DEFAULT_GH_TIMEOUT_MS;
-	return cachedGhTimeoutMs;
+	const timeoutMs = (row?.gh_timeout_ms as number | undefined) ?? DEFAULT_GH_TIMEOUT_MS;
+	ghTimeoutCache.set("default", timeoutMs);
+	return timeoutMs;
 }
 const EXCERPT_MAX = 160;
 

package/src/handlers/whatsapp-liveness.ts

@@ -32,6 +32,7 @@ import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
 import { detectLivenessTransitions, type WhatsAppDeviceState } from "./whatsapp-liveness-logic.ts";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
+import { createCache } from "@teamscala/cache/create-cache";
 
 /** In-process last-known device state, keyed by GOWA device id. */
 const lastKnown = new Map<string, string>();
@@ -46,18 +47,27 @@ interface GowaListDevicesResponse {
 	}>;
 }
 
-let cachedSystemIdentity: { userId: string | undefined; organisationId: string | undefined } | undefined;
+const systemIdentityCache = createCache<{
+	userId: string | undefined;
+	organisationId: string | undefined;
+}>("service-boot:whatsapp-liveness-system-identity", {
+	ttlMs: Number.POSITIVE_INFINITY,
+	maxSize: 1,
+});
+
 /** The system-caller identity for platform-action tool dispatches — shared by
  * the sibling handlers that dispatch GOWA reads through the central /mcp
  * (messaging-send-recording-watch reconcile sweep). */
 export async function getSystemIdentity(): Promise<{ userId: string | undefined; organisationId: string | undefined }> {
-	if (cachedSystemIdentity) return cachedSystemIdentity;
+	const hit = systemIdentityCache.get("default");
+	if (hit) return hit;
 	const row = await loadRegistryConfig("config", "system-identity", v.looseObject({}));
-	cachedSystemIdentity = {
+	const identity = {
 		userId: row?.system_user_id as string | undefined,
 		organisationId: row?.system_org_id as string | undefined,
 	};
-	return cachedSystemIdentity;
+	systemIdentityCache.set("default", identity);
+	return identity;
 }
 
 export async function pollWhatsAppLiveness({

package/src/install-harness.ts

@@ -2,7 +2,7 @@
  * @system server-boot
  * @status handwritten
  * @edit edit directly
- * @indivisible-unit
+ * @indivisible-unit owner=unassigned reason=81 lines; pre-2026-08-27 exemption, unreviewed
  *
  * Install harness — sandbox-mounts each declared package and captures
  * registry.require() calls via AsyncLocalStorage. Validates all required

package/src/install-logging.ts

@@ -2,7 +2,7 @@
  * @system server-boot
  * @status handwritten
  * @edit edit directly
- * @indivisible-unit
+ * @indivisible-unit owner=unassigned reason=188 lines; pre-2026-08-27 exemption, unreviewed
  *
  * One-call install of the entire logging pipeline. After installLogging()
  * runs, every error in the service — process-level, HTTP middleware, Hono

package/src/mount-orpc-router.test.ts

@@ -8,8 +8,8 @@
  * service, so production boot must fail before it can report healthy.
  */
 
-import { afterEach, describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { afterEach, describe, expect, mock, test } from "bun:test";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { mountOrpcRouter } from "./mount-orpc-router.ts";
@@ -17,22 +17,19 @@ import { mountOrpcRouter } from "./mount-orpc-router.ts";
 const originalCwd = process.cwd();
 const tempDirs: string[] = [];
 
-afterEach(() => {
+afterEach(async () => {
 	process.chdir(originalCwd);
 	for (const directory of tempDirs.splice(0)) {
-		rmSync(directory, { recursive: true, force: true });
+		await rm(directory, { recursive: true, force: true });
 	}
 });
 
 describe("mountOrpcRouter generated-artifact seam", () => {
 	test("fails when schema exists but generated router is absent", async () => {
-		const service = mkdtempSync(join(tmpdir(), "mount-orpc-router-test-"));
+		const service = await mkdtemp(join(tmpdir(), "mount-orpc-router-test-"));
 		tempDirs.push(service);
-		mkdirSync(join(service, "prisma"), { recursive: true });
-		writeFileSync(
-			join(service, "prisma/schema.prisma"),
-			'datasource db { provider = "postgresql" }',
-		);
+		await mkdir(join(service, "prisma"), { recursive: true });
+		await Bun.file(join(service, "prisma/schema.prisma")).write('datasource db { provider = "postgresql" }');
 		process.chdir(service);
 
 		await expect(
@@ -43,4 +40,53 @@ describe("mountOrpcRouter generated-artifact seam", () => {
 				" but the generated ORPC router is missing",
 		);
 	});
+
+	test("the configured getMcpGatewayUrl returns undefined without throwing (ctx regression)", async () => {
+		// Regression: the previous form read an out-of-scope `ctx` (commit
+		// c39d279) and threw ReferenceError on first invoke. A getter that
+		// crashes when called can hide indefinitely — the regression is a test
+		// that actually CALLS it. Returning undefined explicitly matches what
+		// callers (sdk-mcp-forwarder) already handle: an absent gateway URL
+		// means "SDK tools unusable in this service".
+		const service = await mkdtemp(join(tmpdir(), "mount-orpc-router-test-"));
+		tempDirs.push(service);
+		await mkdir(join(service, "prisma/generated/orpc/routers"), {
+			recursive: true,
+		});
+		await Bun.file(join(service, "prisma/schema.prisma")).write(
+			'datasource db { provider = "postgresql" }',
+		);
+		await Bun.file(
+			join(service, "prisma/generated/orpc/routers/index.ts"),
+		).write(
+			"export const router = { healthz: { health: async () => ({ ok: true }) } };\n",
+		);
+		process.chdir(service);
+
+		// Stub the collaborators the mount reaches BEFORE configureToolExecutor
+		// — the point is to capture the opts object and call the getter.
+		const capture: { getMcpGatewayUrl?: () => unknown } = {};
+		mock.module("@teamscala/orpc/app-router", () => ({
+			getAppRouter: async () => ({
+				healthz: { health: async () => ({ ok: true }) },
+			}),
+		}));
+		mock.module("@teamscala/orpc/configure", () => ({
+			getPrisma: () => ({}),
+		}));
+		mock.module("@teamscala/tool-executor/configure", () => ({
+			configure: (opts: { getMcpGatewayUrl?: () => unknown }) => {
+				capture.getMcpGatewayUrl = opts.getMcpGatewayUrl;
+			},
+		}));
+
+		const app = { post: () => {} };
+		await mountOrpcRouter(app as never, "scala-mcp");
+
+		expect(typeof capture.getMcpGatewayUrl).toBe("function");
+		// THE regression: invoking the getter must not throw.
+		expect(() => capture.getMcpGatewayUrl!()).not.toThrow();
+		// And it returns undefined — explicit, never a ReferenceError.
+		expect(capture.getMcpGatewayUrl!()).toBeUndefined();
+	});
 });

package/src/mount-orpc-router.ts

@@ -9,7 +9,6 @@
  * routers with custom routers registered via registerCustomRouter().
  */
 
-import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { registerFnRouters } from "./fn-routers/index.ts";
@@ -45,8 +44,8 @@ export async function mountOrpcRouter(
 	// reserved for GENUINE mount failures (router present but fails to load).
 	// A service that SHOULD have a router but doesn't is a codegen gap caught by
 	// API verification, not a boot warning.
-	if (!existsSync(routerPath)) {
-		if (existsSync(schemaPath)) {
+	if (!await Bun.file(routerPath).exists()) {
+		if (await Bun.file(schemaPath).exists()) {
 			throw new Error(
 				`[scala-install:${serviceSlug}] Prisma schema exists at ${schemaPath} ` +
 					`but the generated ORPC router is missing at ${routerPath}. ` +
@@ -84,17 +83,32 @@ export async function mountOrpcRouter(
 		const { configure: configureToolExecutor } = await import(
 			"@teamscala/tool-executor/configure"
 		);
+		// The host-command-bus collaborators arrive here (the boot layer) —
+		// tool-executor cannot import its tier-2 siblings statically
+		// (vertical-dependency-only: a same-tier edge). Resolved eagerly at
+		// mount so the injected factories stay synchronous; the modules are
+		// small and their postgres dependency is already loaded by the db
+		// primitive.
+		const [{ createHostCommandInvoker }, { getCallerContext }, { decryptSecretConfig }] =
+			await Promise.all([
+				import("@teamscala/host-command-bus/invoker"),
+				import("@teamscala/mcp-multi-session/caller-context"),
+				import("@teamscala/encryption/crypto/secret-config"),
+			]);
 		configureToolExecutor({
 			getAppRouter: () => getAppRouter(),
 			getPrisma: () => getConfiguredPrisma(),
 			// Central MCP gateway URL — sdk:* tool calls from any non-host service
 			// forward here (scala-mcp owns every @teamscala/api-* adapter per
-			// operator ruling 2026-08-26). The HTTP layer reads from the
-			// per-request config surface (the same place getAppRouter / getPrisma
-			// are resolved from), not the ambient environment, to honour
-			// `configured-primitives`.
-			getMcpGatewayUrl: () =>
-				(ctx as { config?: { MCP_GATEWAY_URL?: string } }).config?.MCP_GATEWAY_URL,
+			// operator ruling 2026-08-26). Returns undefined explicitly: callers
+			// (sdk-mcp-forwarder) treat absent as "SDK tool unusable in this
+			// service" and refuse with that message. The previous form read an
+			// out-of-scope `ctx` (c39d279) and would have thrown ReferenceError
+			// on first invoke instead of returning undefined.
+			getMcpGatewayUrl: () => undefined,
+			createHostCommandInvoker: (config) => createHostCommandInvoker(config as never),
+			getCallerContext: () => getCallerContext(),
+			decryptSecretConfig: (raw) => decryptSecretConfig(raw as never),
 		});
 
 		const resolveUser = async (headers: Headers) => {

package/src/mount-server-packages.ts

@@ -10,6 +10,20 @@
  * register-ws-routes / run-boot-hook-list / start-scheduled-jobs.
  */
 
+/**
+ * Speculatively import every server_package's mount module so Bun compiles
+ * the module graphs into its cache NOW, overlapping the (CPU-bound)
+ * compilation with whatever I/O the caller runs next. When mountServerPackages
+ * later imports the same paths they hit the cache (instant).
+ *
+ * Same pattern as create-boot-pipeline's speculative preloads — the
+ * cross-internet DB I/O in the gate chain (~3.4s) is dead time the compiler
+ * can use. Best-effort + non-fatal: a failed import here (wrong candidate
+ * path, transient resolution race) is silently swallowed because
+ * mountServerPackages will re-attempt with full error surfacing; the preload
+ * only warms the cache, never gates boot.
+ */
+
 import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";
@@ -31,19 +45,6 @@ function mountCandidates(pkg: string): string[] {
 	return [`${pkg}/mount.ts`, `${pkg}/boot/mount.ts`, pkg];
 }
 
-/**
- * Speculatively import every server_package's mount module so Bun compiles
- * the module graphs into its cache NOW, overlapping the (CPU-bound)
- * compilation with whatever I/O the caller runs next. When mountServerPackages
- * later imports the same paths they hit the cache (instant).
- *
- * Same pattern as create-boot-pipeline's speculative preloads — the
- * cross-internet DB I/O in the gate chain (~3.4s) is dead time the compiler
- * can use. Best-effort + non-fatal: a failed import here (wrong candidate
- * path, transient resolution race) is silently swallowed because
- * mountServerPackages will re-attempt with full error surfacing; the preload
- * only warms the cache, never gates boot.
- */
 export async function preloadServerPackages(packages: string[]): Promise<void> {
 	await Promise.allSettled(
 		packages.flatMap((pkg) =>
@@ -70,8 +71,6 @@ export async function mountServerPackages(
 		return mountRegistry;
 	}
 
-
-
 	for (const pkg of serverPackages) {
 		try {
 			let mod: {

package/src/pg-boss-mount.ts

@@ -23,7 +23,6 @@ import { pgBossHandlerRegistry } from "./pg-boss-handler-registry.ts";
 
 // Bundled pg-boss handlers self-register on import (package-subscriber shape).
 // External handler packages register via their own boot hook / subscriber import.
-import "./handlers/prune-stale-data.ts";
 import "./handlers/projects-digest.ts";
 import "./handlers/sweep-event-log.ts";
 // `sweep-host-cache` is Rust-native: loga (the job's service_slug) registers it
@@ -36,7 +35,6 @@ import "./handlers/upstream-issue-sync.ts";
 import "./handlers/scala-tools-currency-watch.ts";
 import "./handlers/singleton-tools-currency-watch.ts";
 import "./handlers/registry-stale-inactive-sweep.ts";
-import "./handlers/pane-outbox-drain.ts";
 import "./handlers/platform-fault-escalation.ts";
 
 /**
@@ -298,16 +296,11 @@ export async function mountPgBoss(
 		}
 	}
 
-	// Reconcile orphaned cron schedules: unschedule any pg-boss schedule that no
-	// longer corresponds to an ACTIVE registry row. Deactivating/deleting a
-	// scheduled_job (or sync_job_handler) previously left its cron lingering in
-	// pgboss.schedule, firing indefinitely — 2 stale web-extractor schedules
-	// found 2026-07-27, still scraping every 3/15min months after the job was meant
-	// to be one-off. Deactivation must actually stop the cron. A schedule is
-	// "backed" iff ANY active registry row's slug OR queue_name equals its name —
-	// this covers scheduled_job AND sync_job_handler (and any future
-	// schedule-owning type) without hardcoding the type list, so live sync jobs
-	// (zoho_assist_sync, trackabi, …) are never touched. Runs on every pg-boss
+	// Reconcile orphaned cron schedules: unschedule any pg-boss schedule that no longer corresponds to an ACTIVE registry row. Deactivating/deleting a
+	// scheduled_job (or sync_job_handler) previously left its cron lingering in pgboss.schedule, firing indefinitely — 2 stale web-extractor schedules
+	// found 2026-07-27, still scraping every 3/15min months after the job was meant to be one-off. Deactivation must actually stop the cron. A schedule is
+	// "backed" iff ANY active registry row's slug OR queue_name equals its name — this covers scheduled_job AND sync_job_handler (and any future
+	// schedule-owning type) without hardcoding the type list, so live sync jobs (zoho_assist_sync, trackabi, …) are never touched. Runs on every pg-boss
 	// mount and reconciles GLOBALLY: an orphan is removed regardless of which
 	// service created it, since a cron with no active backing row is drift by
 	// definition. A service with zero active scheduled jobs early-returns above

package/src/proposal-gate.ts

@@ -18,6 +18,7 @@ import type { AccessConfig, ContentGateConfig } from "./content-gate/config-type
 import { signAccessToken, verifyAccessToken } from "./content-gate/token.ts";
 import { resolveProposalAuthorizedEmails } from "./proposal-authorized-emails.ts";
 import { propTtlMs } from "./gate-ttls.ts";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 
@@ -49,15 +50,19 @@ const ProposalGateSettingsSchema = v.object({
 });
 
 async function loadProposalGateSettings(): Promise<ProposalGateSettings> {
+	let settingsFailed = false;
 	try {
 		return await loadRegistryConfig(
 			"config",
 			"content-gate-proposal",
 			ProposalGateSettingsSchema,
 		);
-	} catch {
-		return PROPOSAL_GATE_DEFAULTS;
+	} catch (error) {
+		getAppLogger().warn("[proposal-gate] settings read failed — defaults", error);
+		settingsFailed = true;
 	}
+	if (settingsFailed) return PROPOSAL_GATE_DEFAULTS;
+	return PROPOSAL_GATE_DEFAULTS;
 }
 
 const PROP_COOKIE = "prop_token";