@teamscala/service-boot 0.23.515 → 0.23.517

package/package.json

@@ -1187,5 +1187,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.515"
-}
+  "version": "0.23.517"
+}

package/src/pg-boss-mount.ts

@@ -31,10 +31,8 @@ import "./handlers/sweep-event-log.ts";
 import "./handlers/bun-stable-watch.ts";
 import "./handlers/whatsapp-liveness.ts";
 import "./handlers/messaging-send-recording-watch.ts";
-import "./handlers/upstream-issue-sync.ts";
 import "./handlers/scala-tools-currency-watch.ts";
 import "./handlers/singleton-tools-currency-watch.ts";
-import "./handlers/registry-stale-inactive-sweep.ts";
 import "./handlers/platform-fault-escalation.ts";
 import "./handlers/quiz-research.ts";
 

package/src/register-page-server-client.test.ts

@@ -0,0 +1,185 @@
+// @system ui-service-boot
+// @status handwritten
+// @edit edit directly
+//
+// register-page-server-client.test.ts — the declaredModels lookup must never
+// quietly report "declares nothing".
+//
+// The regression this exists for (measured scala-sign 2026-09-24/25): the boot
+// looked up service_schema with `undefined as never`, so loadRegistryConfig's
+// `v.parse(undefined, raw)` threw a TypeError on EVERY service, the bare
+// `catch {}` swallowed it into `declaredModels = []`, and the
+// "declares > 0 models + no router → refuse the boot" check below never fired.
+// A service declaring 18 models logged "0 declared model(s)", registered a
+// router-less server client as healthy, and served 500 on every page while
+// /health answered 200.
+//
+// Three assertions, each the operator's demand ("the catch must tell 'no
+// service_schema row' apart from 'the read failed'. A read error must never
+// quietly become 'no models'. Test both"):
+//   1. a service that DECLARES models with no generated router → REFUSES the
+//      boot (proves the refusal actually fires now — it did not before);
+//   2. a service with NO service_schema row → passes through clean (legitimate
+//      daemon/portal shell owns no DB models);
+//   3. a service_schema READ that FAILS → REFUSES the boot naming the error
+//      (a read error is never treated as "declares nothing").
+
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const originalCwd = process.cwd();
+const tempDirs: string[] = [];
+
+afterEach(async () => {
+	process.chdir(originalCwd);
+	for (const directory of tempDirs.splice(0)) {
+		await rm(directory, { recursive: true, force: true });
+	}
+});
+
+// The registry read is scenario-driven: ONE load-config mock serves all three
+// tests, and each test flips the mode before calling the function. The mock
+// function is re-invoked on every call (the target imports it dynamically
+// inside registerPageServerClient), so switching the mode takes effect.
+let registryMode:
+	| { kind: "row"; models: string[] }
+	| { kind: "missing" }
+	| { kind: "missing-thrown" }
+	| { kind: "read-failed"; message: string } = { kind: "missing" };
+
+// The class identity the catch's `instanceof` compares against. The target
+// imports RegistryConfigMissingError from @teamscala/db/registry/errors, so the
+// SAME mocked class must back both the throw path and the instanceof check.
+class MockRegistryConfigMissingError extends Error {
+	readonly type: string;
+	readonly slug: string;
+	constructor(type: string, slug: string) {
+		super(`[registry] Config entry "${slug}" of type "${type}" not found`);
+		this.name = "RegistryConfigMissingError";
+		this.type = type;
+		this.slug = slug;
+	}
+}
+
+mock.module("@teamscala/db/registry/load-config", () => ({
+	loadOptionalRegistryConfig: async () => {
+		if (registryMode.kind === "missing") return null;
+		if (registryMode.kind === "missing-thrown") {
+			throw new MockRegistryConfigMissingError("service_schema", "scala-sign");
+		}
+		if (registryMode.kind === "row") return { models: registryMode.models };
+		throw new Error(registryMode.message);
+	},
+	loadRegistryConfig: async () => ({ platformOrganisationId: "org-platform" }),
+}));
+
+mock.module("@teamscala/db/registry/errors", () => ({
+	RegistryConfigMissingError: MockRegistryConfigMissingError,
+}));
+
+mock.module("@teamscala/db-validation/registry-schemas/service-schema", () => ({
+	ServiceSchemaConfigSchema: {},
+}));
+
+mock.module("@teamscala/db-validation/registry-schemas/platform-identity", () => ({
+	PlatformIdentitySchema: {},
+}));
+
+mock.module("@teamscala/logger/app-loggers", () => ({
+	getAppLogger: () => ({
+		info: (..._args: unknown[]) => {},
+		warn: (..._args: unknown[]) => {},
+		error: (..._args: unknown[]) => {},
+	}),
+}));
+
+mock.module("@orpc/server", () => ({
+	createRouterClient: () => ({}),
+}));
+
+mock.module("@teamscala/db/prisma-registry", () => ({
+	getPrisma: () => ({}),
+}));
+
+// The page-server server-client is imported dynamically via a string-cast
+// specifier inside the function; mock the exact specifier so setServerClient
+// is a recording no-op and the real runtime never loads.
+const setServerClientCalls: number[] = [];
+mock.module("@teamscala/service-boot/page-server-orpc/server-client", () => ({
+	setServerClient: () => {
+		setServerClientCalls.push(1);
+	},
+}));
+
+const { registerPageServerClient } = await import(
+	"./register-page-server-client.ts"
+);
+
+/** Make an empty service dir with NO generated router anywhere, and reset the
+ *  setServerClient recorder so each test's count is its own. */
+async function cwdWithoutRouter(): Promise<string> {
+	setServerClientCalls.length = 0;
+	const dir = await mkdtemp(join(tmpdir(), "register-psc-test-"));
+	tempDirs.push(dir);
+	process.chdir(dir);
+	return dir;
+}
+
+describe("registerPageServerClient — declaredModels lookup never lies", () => {
+	test("refuses the boot when the service DECLARES models but no router exists", async () => {
+		await cwdWithoutRouter();
+		registryMode = {
+			kind: "row",
+			// 18 models — the exact scala-sign row size whose absence from the
+			// boot log was the outage.
+			models: Array.from({ length: 18 }, (_unused, index) => `model_${index}`),
+		};
+
+		await expect(registerPageServerClient("scala-sign")).rejects.toThrow(
+			/service_schema declares 18 model\(s\).*no generated ORPC router is present/s,
+		);
+		expect(setServerClientCalls.length).toBe(0);
+	});
+
+	test("passes through clean when there is NO service_schema row", async () => {
+		await cwdWithoutRouter();
+		// loadOptionalRegistryConfig returns null — the legitimately-declares-
+		// nothing case (daemon/portal shell). With no models declared there is no
+		// router required, so the boot must NOT refuse.
+		registryMode = { kind: "missing" };
+
+		await expect(registerPageServerClient("some-daemon-shell")).resolves.toBeUndefined();
+		expect(setServerClientCalls.length).toBeGreaterThan(0);
+	});
+
+	test("refuses the boot when the service_schema READ fails, naming the error", async () => {
+		await cwdWithoutRouter();
+		// A read error (NOT a missing row) must fail the boot, never degrade to
+		// "declares nothing" — otherwise a data-backed service boots "0 models"
+		// and 500s on every page.
+		registryMode = { kind: "read-failed", message: "connection refused: db down" };
+
+		await expect(registerPageServerClient("scala-sign")).rejects.toThrow(
+			/service_schema read FAILED for "scala-sign"/,
+		);
+		await expect(registerPageServerClient("scala-sign")).rejects.toThrow(
+			/connection refused: db down/,
+		);
+		expect(setServerClientCalls.length).toBe(0);
+	});
+
+	test("treats a thrown RegistryConfigMissingError as declares-nothing, not failure", async () => {
+		await cwdWithoutRouter();
+		// The read path throws RegistryConfigMissingError (a genuinely-absent row,
+		// the same signal as a null return, just a different code path): the catch
+		// must classify it as "declares nothing" via the instanceof check and boot
+		// CLEAN — this is exactly the branch that must NOT fail the boot. Contrast
+		// the read-failed test above, where an unrelated error DOES fail the boot.
+		registryMode = { kind: "missing-thrown" };
+
+		await expect(registerPageServerClient("scala-sign")).resolves.toBeUndefined();
+		expect(setServerClientCalls.length).toBeGreaterThan(0);
+	});
+});

package/src/register-page-server-client.ts

@@ -7,6 +7,12 @@
  * the platform-owned routers into the service's generated `appRouter` and
  * stashes the resulting client via setServerClient. Called once at boot before
  * any page route handler fires.
+ *
+ * Handwritten because no machine-readable contract generates it: this is the
+ * EXECUTOR half of a rows+executor pair (`business-logic-is-rows-plus-executors`),
+ * whose declared half is the `service_install`/`service_schema` rows read at
+ * boot. There is no supplier spec, CLI or registry row that could emit this
+ * boot-time wiring, so it stays hand-written; the row half remains the source.
  */
 
 		// REFUSE, DO NOT SKIP. `existsSync(routerPath)` being false used to fall straight through with appRouter=null and still register a client + log
@@ -65,37 +71,58 @@ export async function registerPageServerClient(
 				);
 			}
 		}
-		const declaredModels = await (async () => {
+		const declaredModels = await (async (): Promise<string[]> => {
+			const capSlug = toCapabilitySlug(serviceSlug);
+			// LOOK IT UP BY CAPABILITY, NOT BY DEPLOYABLE NAME. A service_schema
+			// row describes the APPLICATION's data surface, so there is ONE row
+			// for both lanes; the dev lane arrives here as
+			// `scala-projects-bun-dev`. Both sides normalize through
+			// toCapabilitySlug, so the join is tier-agnostic by construction.
+			// See ./capability-slug.ts.
+			//
+			// READ WITH THE REAL SCHEMA, NOT `undefined`. The previous call passed
+			// `undefined as never`, so v.parse(undefined, raw) threw a TypeError
+			// (schema is not a schema) on EVERY service, the bare catch below turned
+			// that into "declares nothing", and the refusal at the bottom NEVER
+			// fired — a service declaring 18 models booted "0 declared model(s)"
+			// and served 500s. (measured scala-sign 2026-09-24/25: row declares 18,
+			// boot logged 0.) loadOptionalRegistryConfig parses against
+			// ServiceSchemaConfigSchema and returns null ONLY for a missing row.
+			//
+			// A MISSING ROW is legitimately "declares nothing" (daemon/portal
+			// shells own no DB models) and passes through clean. A READ FAILURE is
+			// NOT "declares nothing" — it fails the boot naming the error, so the
+			// database can never quietly become "no models" and let a router-less,
+			// data-backed service boot and serve 500s
+			// (`a-component-may-not-report-a-state-it-has-not-verified`).
+			const { loadOptionalRegistryConfig } = await import(
+				"@teamscala/db/registry/load-config"
+			);
+			const { RegistryConfigMissingError } = await import(
+				"@teamscala/db/registry/errors"
+			);
+			const { ServiceSchemaConfigSchema } = await import(
+				"@teamscala/db-validation/registry-schemas/service-schema"
+			);
 			try {
-				const { loadRegistryConfig: loadCfg } = await import(
-					"@teamscala/db/registry/load-config"
-				);
-				// serviceSlug is runtime-dynamic (the service being booted), so it
-				// cannot satisfy the generated ServiceSchemaKey union statically.
-				//
-				// LOOK IT UP BY CAPABILITY, NOT BY DEPLOYABLE NAME. A service_schema
-				// row describes the APPLICATION's data surface, so there is ONE row
-				// for both lanes; the dev lane arrives here as
-				// `scala-projects-bun-dev` and matched nothing. The catch below then
-				// read "declares nothing" and the refusal fifteen lines down never
-				// fired — so a router-less client registered as healthy and every
-				// data-backed page 500ed with MissingLoaderModelCapabilityError,
-				// which is precisely the outage this refusal exists to prevent
-				// (measured 2026-09-11 on scala-projects-bun-dev: "0 declared
-				// model(s)" against a row declaring 31). See ./capability-slug.ts.
-				const row = (await loadCfg(
+				const row = await loadOptionalRegistryConfig(
 					"service_schema",
-					toCapabilitySlug(serviceSlug) as never,
-					undefined as never,
-				)) as
-					| { models?: string[] }
-					| null;
-				return Array.isArray(row?.models) ? row.models : [];
-			} catch {
-				// No service_schema row, or it could not be read: fall back to
-				// "declares nothing", so a read failure cannot manufacture a boot
-				// refusal on a service that never needed a router.
-				return [] as string[];
+					capSlug as never,
+					ServiceSchemaConfigSchema,
+				);
+				if (row === null) return [];
+				return Array.isArray(row.models) ? row.models : [];
+			} catch (err) {
+				if (err instanceof RegistryConfigMissingError) return [];
+				throw new Error(
+					`[scala-install:${serviceSlug}] service_schema read FAILED for ` +
+						`"${capSlug}" — this is NOT treated as "declares nothing". A ` +
+						`registry read error must never quietly become an empty model ` +
+						`set, because a data-backed service with no generated ORPC ` +
+						`router would otherwise boot healthy and 500 on every page. ` +
+						`Underlying error: ${err instanceof Error ? `${err.message}\n${err.stack ?? ""}` : String(err)}`,
+					{ cause: err },
+				);
 			}
 		})();
 		if (declaredModels.length > 0 && !appRouter) {
@@ -104,10 +131,10 @@ export async function registerPageServerClient(
 					`model(s) (${declaredModels.slice(0, 5).join(", ")}${declaredModels.length > 5 ? ", …" : ""}) ` +
 					`but no generated ORPC router is present at ${routerPath}. Every data-backed page ` +
 					`would 500 with MissingLoaderModelCapabilityError while /health reported 200. ` +
-					`This is a BUILD fault: deploy-build did not emit prisma/generated/orpc. Check that ` +
-					`the service's railpack.json runs deploy-build with DATABASE_URL_FROM_OUTSIDE ` +
-					`(the builder cannot resolve *.railway.internal) and that its codegen_output row ` +
-					`for railpack-json carries the composite input the transform declares.`,
+					`This is a BUILD fault: the codegen_output emission for the ORPC router ` +
+					`(prisma/generated/orpc/routers/index.ts) is missing from the bundle — check that ` +
+					`the service's codegen_output rows are active and their outputs land in the image. ` +
+					`Rebuild via scala-pack; never patch the image by hand.`,
 			);
 		}
 

package/src/resolve-app-base-url.ts

@@ -3,33 +3,21 @@
  * @status handwritten
  * @edit edit directly
  *
- * The scala-projects app's own public hostname, read from its `service_install`
- * row rather than hardcoded — a service knows its own deploy config only
- * through the registry (registries-are-source-of-truth), never a literal in
- * source. Cached for the process lifetime: this changes only on a redeploy,
- * not per-request. Shared by every server-side path that builds a link back
- * into the app (approval emails, mention emails, digest emails).
+ * The scala-projects app's own public base URL, from its `service_routing`
+ * row through db's canonical reader (`makeServiceRoutingReader`) — the one
+ * copy of every public hostname, the same row the tunnel's ingress and DNS
+ * derive from (collapsed 2026-09-26: service_install no longer carries
+ * public_hostname). A missing hostname throws naming the row; there is no
+ * fallback literal to link to a guessed address. Shared by every server-side
+ * path that builds a link back into the app (approval, mention and digest
+ * emails).
  */
 
-import { ServiceInstallConfigSchema } from "@teamscala/db-validation/registry-schemas/service-install";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import { createCache } from "@teamscala/cache/create-cache";
+import { ServiceRoutingConfigSchema } from "@teamscala/db-validation/registry-schemas/service-routing";
+import { makeServiceRoutingReader } from "@teamscala/db/registry/service-routing";
 
-const appUrlCache = createCache<string>("service-boot:app-base-url", {
-	ttlMs: Number.POSITIVE_INFINITY,
-	maxSize: 1,
-});
+const { resolveServicePublicUrl } = makeServiceRoutingReader(ServiceRoutingConfigSchema);
 
-export async function resolveAppBaseUrl(): Promise<string> {
-	const hit = appUrlCache.get("default");
-	if (hit) return hit;
-	try {
-		const config = await loadRegistryConfig("service_install", "scala-projects", ServiceInstallConfigSchema);
-		const url = `https://${config.public_hostname}`;
-		appUrlCache.set("default", url);
-		return url;
-	} catch {
-		appUrlCache.set("default", "https://projects.scala.business");
-		return "https://projects.scala.business";
-	}
+export function resolveAppBaseUrl(): Promise<string> {
+	return resolveServicePublicUrl("scala-projects");
 }

package/src/handlers/registry-stale-inactive-sweep.ts

@@ -1,82 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The `registry-stale-inactive-sweep` pg-boss handler. Surfaces registry
- * rows that have been inactive beyond a threshold with no deliberate-pause
- * metadata — the "deactivated and forgotten" class that caused the
- * fleet_agent_slots miscount (operator directive 2026-07-20).
- *
- * This is a MONITOR (detection), not enforcement: it records an event_log
- * entry so the operator sees stale rows accumulate, but never blocks or
- * auto-reaps. The structural prevention is the `deactivated_at` stamp the
- * registry_edit deactivate path writes; this sweep is the detection
- * backstop that surfaces rows whose `updated_at` (the deactivation
- * timestamp) has aged past the threshold.
- *
- * Excluded from the sweep (deliberate deactivation — NOT stale):
- * - config.pause_owner / config.reactivate_when (progressive-activation paused guards)
- * - config.operator_deactivated = true (operator emergency off)
- *
- * Registered under slug `@teamscala/service-boot:registry-stale-inactive-sweep`.
- */
-import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
-import { getPrisma } from "@teamscala/db/prisma-registry";
-import { recordEvent } from "@teamscala/event-log/record-event";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
-
-const STALE_AFTER_DAYS = 30;
-const SAMPLE_LIMIT = 20;
-
-interface StaleRow {
-	type: string;
-	slug: string;
-	updated_at: Date;
-}
-
-async function registryStaleInactiveSweep(): Promise<void> {
-	const log = getAppLogger();
-	const prisma = getPrisma();
-
-	const rows = await prisma.$queryRawUnsafe<StaleRow[]>(`
-		SELECT type, slug, updated_at
-		FROM registry_entries
-		WHERE is_active = false
-			AND updated_at < NOW() - INTERVAL '${STALE_AFTER_DAYS} days'
-			AND NOT (config ? 'pause_owner')
-			AND NOT (config ? 'reactivate_when')
-			AND NOT (config->>'operator_deactivated' = 'true')
-		ORDER BY updated_at ASC
-	`);
-
-	const byType = new Map<string, number>();
-	for (const r of rows) {
-		byType.set(r.type, (byType.get(r.type) ?? 0) + 1);
-	}
-
-	const samples = rows
-		.slice(0, SAMPLE_LIMIT)
-		.map((r) => `${r.type}/${r.slug}(${r.updated_at.toISOString().slice(0, 10)})`);
-
-	recordEvent({
-		kind: "registry.stale-inactive.detected",
-		payload: {
-			totalStale: rows.length,
-			staleAfterDays: STALE_AFTER_DAYS,
-			byType: Object.fromEntries(byType),
-			samples,
-		},
-	});
-
-	log.info(
-		`[registry-stale-inactive-sweep] ${rows.length} stale inactive row(s) (>${STALE_AFTER_DAYS}d, no pause metadata) — recorded to event_log`,
-		{ byType: Object.fromEntries(byType), samples },
-	);
-}
-
-pgBossHandlerRegistry.register(
-	"@teamscala/service-boot:registry-stale-inactive-sweep",
-	registryStaleInactiveSweep as (ctx: { config: ScheduledJobConfig }) => Promise<void>,
-);

package/src/handlers/upstream-issue-sync.ts

@@ -1,220 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The `upstream-issue-sync` pg-boss handler (doctrine `upstream-issues-tracked-in-
- * registry`). For each active `upstream_issue` registry row it polls the row's
- * GitHub issue + comments and writes back `state` / `comment_count` /
- * `last_comment_at` / `latest_response` / `last_synced_at`, emitting
- * `recordEvent({ kind: "upstream.issue.response" })` when a NEW maintainer
- * (non-filer) comment appears — so a maintainer response on an issue we filed
- * never goes unnoticed.
- *
- * Polls via the authenticated `gh` CLI (`@teamscala/os` spawn — `gh api` is the
- * off-the-shelf GitHub client; NOT a bespoke fetch). There is deliberately NO
- * `@teamscala/api-github` adapter: one existed as a hand-written `rest_client`
- * row with zero importers — this handler chose the CLI instead — so it was
- * deleted on 2026-09-02 rather than converted to a spec-derived adapter. GitHub
- * publishes an OpenAPI spec, so if a future consumer needs typed access the
- * answer is a spec-derived row, never a hand-listed one.
- *
- * Registered under slug `@teamscala/service-boot:upstream-issue-sync`. Mirrors
- * `bun-stable-watch` (dev-host pg-boss handler). Reads rows via the `getAllEntries`
- * helper and writes back via `persistRegistryEntryConfig` (the validated
- * registry_entries writer — `registry-via-helper` blocks direct registry Prisma
- * in package code).
- */
-import { getAllEntries } from "@teamscala/db/registry/accessors";
-import { persistRegistryEntryConfig } from "@teamscala/db/registry/persist-entry-config";
-import { validateRow } from "@teamscala/db-validation/validate-row";
-import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
-import { recordEvent } from "@teamscala/event-log/record-event";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { spawn } from "@teamscala/os/spawn";
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import * as v from "valibot";
-import { pgBossHandlerRegistry } from "../pg-boss-handler-registry.ts";
-import { createCache } from "@teamscala/cache/create-cache";
-
-interface GhIssue {
-	state: string;
-	comments: number;
-	author: string;
-}
-
-interface GhComment {
-	author: string;
-	at: string;
-	body: string;
-}
-
-interface CapturedResponse {
-	author: string;
-	excerpt: string;
-	at: string;
-}
-
-const DEFAULT_GH_TIMEOUT_MS = 20_000;
-const ghTimeoutCache = createCache<number>("service-boot:gh-timeout", {
-	ttlMs: Number.POSITIVE_INFINITY,
-	maxSize: 1,
-});
-
-async function getGhTimeoutMs(): Promise<number> {
-	const hit = ghTimeoutCache.get("default");
-	if (hit !== undefined) return hit;
-	const row = await loadRegistryConfig("config", "upstream-issue-sync", v.looseObject({}));
-	const timeoutMs = (row?.gh_timeout_ms as number | undefined) ?? DEFAULT_GH_TIMEOUT_MS;
-	ghTimeoutCache.set("default", timeoutMs);
-	return timeoutMs;
-}
-const EXCERPT_MAX = 160;
-
-/** Fetch a GitHub issue's state/comment-count/author via `gh api`. */
-async function ghIssue(owner: string, repo: string, number: number): Promise<GhIssue | null> {
-	const { stdout, exitCode, stderr } = await spawn({
-		name: "upstream-issue-sync:gh-issue",
-		command: [
-			"gh",
-			"api",
-			`repos/${owner}/${repo}/issues/${number}`,
-			"--jq",
-			"{state: .state, comments: .comments, author: .user.login}",
-		],
-		timeoutMs: await getGhTimeoutMs(),
-	});
-	if (exitCode !== 0) {
-		getAppLogger().warn(
-			`[upstream-issue-sync] gh api issue ${owner}/${repo}#${number} failed: ${stderr.trim() || stdout.trim()}`,
-		);
-		return null;
-	}
-	try {
-		return JSON.parse(stdout) as GhIssue;
-	} catch {
-		return null;
-	}
-}
-
-/** Fetch a GitHub issue's comments via `gh api` (per_page=100). */
-async function ghComments(owner: string, repo: string, number: number): Promise<GhComment[]> {
-	const { stdout, exitCode } = await spawn({
-		name: "upstream-issue-sync:gh-comments",
-		command: [
-			"gh",
-			"api",
-			`repos/${owner}/${repo}/issues/${number}/comments?per_page=100`,
-			"--jq",
-			"[.[] | {author: .user.login, at: .created_at, body: .body}]",
-		],
-		timeoutMs: await getGhTimeoutMs(),
-	});
-	if (exitCode !== 0) return [];
-	try {
-		const parsed = JSON.parse(stdout) as GhComment[];
-		return Array.isArray(parsed) ? parsed : [];
-	} catch {
-		return [];
-	}
-}
-
-function excerpt(body: string): string {
-	const flat = body.replace(/\s+/g, " ").trim();
-	return flat.length > EXCERPT_MAX ? `${flat.slice(0, EXCERPT_MAX)}…` : flat;
-}
-
-/**
- * The newest comment NOT by the issue filer (a maintainer response), or null.
- * GitHub returns comments oldest-first; sort by `at` to be safe.
- */
-function newestMaintainerResponse(
-	comments: GhComment[],
-	filer: string,
-): CapturedResponse | null {
-	const external = comments
-		.filter((c) => c.author !== filer)
-		.sort((a, b) => (a.at < b.at ? 1 : a.at > b.at ? -1 : 0));
-	const newest = external[0];
-	if (!newest) return null;
-	return { author: newest.author, excerpt: excerpt(newest.body), at: newest.at };
-}
-
-async function upstreamIssueSync(_ctx: { config: ScheduledJobConfig }): Promise<void> {
-	const log = getAppLogger();
-
-	const rows = getAllEntries().filter(
-		(e) => (e.type as string) === "upstream_issue" && e.is_active,
-	);
-	if (rows.length === 0) {
-		log.info("[upstream-issue-sync] no active upstream_issue rows");
-		return;
-	}
-
-	let updated = 0;
-	for (const row of rows) {
-		const cfg = row.config as Record<string, unknown>;
-		const repo = String(cfg.repo ?? "");
-		const issueNumber = Number(cfg.issue_number);
-		const [owner, repoName] = repo.split("/");
-		if (!owner || !repoName || !Number.isInteger(issueNumber)) {
-			log.warn(`[upstream-issue-sync] row ${row.slug} has invalid repo/issue_number`);
-			continue;
-		}
-
-		const issue = await ghIssue(owner, repoName, issueNumber);
-		if (!issue) continue; // gh failure already logged; skip this row this cycle
-		const comments = await ghComments(owner, repoName, issueNumber);
-		const lastCommentAt =
-			comments.length > 0 ? (comments.map((c) => c.at).sort().at(-1) ?? null) : null;
-		const latestResponse = newestMaintainerResponse(comments, issue.author);
-
-		const prevResponseAt = (
-			cfg.latest_response as { at?: string } | null | undefined
-		)?.at ?? null;
-
-		const nowIso = new Date().toISOString();
-		const nextConfig = {
-			...cfg,
-			state: issue.state === "closed" ? "closed" : "open",
-			comment_count: issue.comments,
-			last_comment_at: lastCommentAt,
-			latest_response: latestResponse,
-			last_synced_at: nowIso,
-		};
-
-		try {
-			await persistRegistryEntryConfig("upstream_issue", row.slug, nextConfig, validateRow);
-		} catch (err) {
-			log.warn(
-				`[upstream-issue-sync] row ${row.slug} write failed (validation or db): ${err instanceof Error ? err.message : String(err)}`,
-			);
-			continue;
-		}
-		updated += 1;
-
-		// New maintainer response? (newer than the previously-recorded one)
-		const isNewResponse =
-			latestResponse !== null && (prevResponseAt === null || latestResponse.at > prevResponseAt);
-		if (isNewResponse) {
-			recordEvent({
-				kind: "upstream.issue.response",
-				payload: {
-					slug: row.slug,
-					repo,
-					issue_number: issueNumber,
-					author: latestResponse.author,
-					excerpt: latestResponse.excerpt,
-					at: latestResponse.at,
-				},
-			});
-			log.info(
-				`[upstream-issue-sync] ${row.slug}: new maintainer response from @${latestResponse.author}`,
-			);
-		}
-	}
-
-	log.info(`[upstream-issue-sync] synced ${updated}/${rows.length} upstream_issue rows`);
-}
-
-pgBossHandlerRegistry.register("@teamscala/service-boot:upstream-issue-sync", upstreamIssueSync);