@teamscala/service-boot 0.23.523 → 0.23.525

package/src/orpc-contract-rows.json

@@ -120,6 +120,295 @@
       "package": "@teamscala/service-boot",
       "suite_type": "function_call",
       "slug": "boot:openapi-contract-refuses-when-no-key-is-configured"
+    },
+    {
+      "args": [
+        {},
+        "quiz_token=good; quiz_token_entered=1",
+        1730000000000,
+        {
+          "cookieName": "quiz_token",
+          "verifyToken": {
+            "$fn": {
+              "returns": {
+                "name": "V",
+                "email": "v@example.com"
+              }
+            }
+          },
+          "onAuthorized": {
+            "$fn": {
+              "returns": null
+            }
+          },
+          "getResourceId": {
+            "$fn": {
+              "returns": "res-1"
+            }
+          },
+          "onUnauthorized": {
+            "$fn": {
+              "returns": null
+            }
+          },
+          "entryCookieName": "quiz_token_entered"
+        }
+      ],
+      "note": "Converts gate-entry-marker.test.ts case 3, including the measured first-shipped-version failure (the clears read after the run() scope saw nothing and left the marker in the browser, measured live 2026-09-14): recording is asserted from the recorded call itself, which a post-scope read cannot fake.",
+      "label": "an opting gate with token AND marker authorizes and RECORDS the marker for clearing — one view, then the gate returns",
+      "expect": {
+        "email": "v@example.com",
+        "applies": true,
+        "authorized": true
+      },
+      "export": "runContentGate",
+      "module": "src/content-gate/gate.ts",
+      "package": "@teamscala/service-boot",
+      "fixtures": {
+        "stubs": [
+          {
+            "export": "recordGateEntryClear",
+            "module": "./gate-entry-clears.ts",
+            "record": "clears",
+            "returns": null
+          }
+        ]
+      },
+      "outcomes": {
+        "clears": [
+          {
+            "count": 1
+          },
+          {
+            "equals": [
+              {
+                "args": [
+                  "quiz_token_entered"
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      "suite_type": "function_call",
+      "slug": "gate-entry-marker:marker-plus-token-authorizes-and-records-clear"
+    },
+    {
+      "args": [
+        {},
+        "quiz_token=bad; quiz_token_entered=1",
+        1730000000000,
+        {
+          "cookieName": "quiz_token",
+          "verifyToken": {
+            "$fn": {
+              "returns": null
+            }
+          },
+          "onAuthorized": {
+            "$fn": {
+              "returns": null
+            }
+          },
+          "getResourceId": {
+            "$fn": {
+              "returns": "res-1"
+            }
+          },
+          "onUnauthorized": {
+            "$fn": {
+              "returns": null
+            }
+          },
+          "entryCookieName": "quiz_token_entered"
+        }
+      ],
+      "note": "Converts gate-entry-marker.test.ts case 4.",
+      "label": "marker present but token invalid stays unauthorized and records no clear",
+      "expect": {
+        "applies": true,
+        "authorized": false
+      },
+      "export": "runContentGate",
+      "module": "src/content-gate/gate.ts",
+      "package": "@teamscala/service-boot",
+      "fixtures": {
+        "stubs": [
+          {
+            "export": "recordGateEntryClear",
+            "module": "./gate-entry-clears.ts",
+            "record": "clears",
+            "returns": null
+          }
+        ]
+      },
+      "outcomes": {
+        "clears": [
+          {
+            "count": 0
+          }
+        ]
+      },
+      "suite_type": "function_call",
+      "slug": "gate-entry-marker:marker-without-valid-token-records-no-clear"
+    },
+    {
+      "args": [
+        {},
+        "quiz_token=good",
+        1730000000000,
+        {
+          "cookieName": "quiz_token",
+          "verifyToken": {
+            "$fn": {
+              "returns": {
+                "name": "V",
+                "email": "v@example.com"
+              }
+            }
+          },
+          "onAuthorized": {
+            "$fn": {
+              "returns": null
+            }
+          },
+          "getResourceId": {
+            "$fn": {
+              "returns": "res-1"
+            }
+          },
+          "onUnauthorized": {
+            "$fn": {
+              "returns": null
+            }
+          }
+        }
+      ],
+      "note": "Converts the hand-written gate-entry-marker.test.ts case 1: the entry marker is opt-in, so every non-opting service behaves exactly as before. Converted 2026-10-07 by the tests-out conversion.",
+      "label": "a gate that does NOT declare an entry marker authorizes on any load and records nothing for clearing",
+      "expect": {
+        "email": "v@example.com",
+        "applies": true,
+        "authorized": true
+      },
+      "export": "runContentGate",
+      "module": "src/content-gate/gate.ts",
+      "package": "@teamscala/service-boot",
+      "fixtures": {
+        "stubs": [
+          {
+            "export": "recordGateEntryClear",
+            "module": "./gate-entry-clears.ts",
+            "record": "clears",
+            "returns": null
+          }
+        ]
+      },
+      "outcomes": {
+        "clears": [
+          {
+            "count": 0
+          }
+        ]
+      },
+      "suite_type": "function_call",
+      "slug": "gate-entry-marker:non-opting-authorizes-any-load-records-nothing"
+    },
+    {
+      "args": [
+        {},
+        "quiz_token=good",
+        1730000000000,
+        {
+          "cookieName": "quiz_token",
+          "verifyToken": {
+            "$fn": {
+              "returns": {
+                "name": "V",
+                "email": "v@example.com"
+              }
+            }
+          },
+          "onAuthorized": {
+            "$fn": {
+              "returns": null
+            }
+          },
+          "getResourceId": {
+            "$fn": {
+              "returns": "res-1"
+            }
+          },
+          "onUnauthorized": {
+            "$fn": {
+              "returns": null
+            }
+          },
+          "entryCookieName": "quiz_token_entered"
+        }
+      ],
+      "note": "Converts gate-entry-marker.test.ts case 2: the marker, not the token alone, is what skips the gate — the mechanism measured live 2026-09-14 when the quiz_token cookie alone let a refresh past the identity gate.",
+      "label": "an opting gate authorizes only the request carrying the marker — a token WITHOUT it is unauthorized, so a refresh shows the gate",
+      "expect": {
+        "applies": true,
+        "authorized": false
+      },
+      "export": "runContentGate",
+      "module": "src/content-gate/gate.ts",
+      "package": "@teamscala/service-boot",
+      "fixtures": {
+        "stubs": [
+          {
+            "export": "recordGateEntryClear",
+            "module": "./gate-entry-clears.ts",
+            "record": "clears",
+            "returns": null
+          }
+        ]
+      },
+      "outcomes": {
+        "clears": [
+          {
+            "count": 0
+          }
+        ]
+      },
+      "suite_type": "function_call",
+      "slug": "gate-entry-marker:opting-gate-without-marker-is-unauthorized"
+    },
+    {
+      "args": [],
+      "note": "Converts the pairing half of gate-entry-marker.test.ts: gate and access endpoint must declare the SAME marker name, or the endpoint's redirect carries a cookie the gate never reads and the one-view never happens. Converted 2026-10-07.",
+      "label": "the quiz access endpoint opts into the SAME entry marker as the gate",
+      "expect": {
+        "export_shape": {
+          "member_equals": {
+            "entryCookieName": "quiz_token_entered"
+          }
+        }
+      },
+      "export": "quizAccessConfig",
+      "module": "src/quiz-gate.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "quiz-gate:access-endpoint-shares-the-entry-marker"
+    },
+    {
+      "args": [],
+      "note": "Converts the pairing half of gate-entry-marker.test.ts: the quiz SSR gate carries the marker name, so a refresh returns to the identity gate (operator ruling 2026-09-14). Converted 2026-10-07.",
+      "label": "the quiz gate opts into the one-view entry marker",
+      "expect": {
+        "export_shape": {
+          "member_equals": {
+            "entryCookieName": "quiz_token_entered"
+          }
+        }
+      },
+      "export": "quizGateConfig",
+      "module": "src/quiz-gate.ts",
+      "package": "@teamscala/service-boot",
+      "suite_type": "function_call",
+      "slug": "quiz-gate:gate-declares-the-one-view-entry-marker"
     }
   ]
 }

package/src/orpc-openapi-document.ts

@@ -1,26 +1,8 @@
 /**
  * @system service-boot
- * @status handwritten — none derivable: the title and the server URL are the MOUNT's facts (the slug it was handed, the host the request arrived on) and no row carries either — searched the portal's package-manifest rows (scala-portal, scala-portal-ts-dev, portal-ui, portal-shell) for a public base URL and the service_env rows for a configured origin; none carries one, so the reachable address can only come from the request
- * @edit edit directly
- *
- * THE DOCUMENT'S OWN FACTS, DERIVED WHERE THEY ARE KNOWN: the service
- * names itself, and the request knows where it arrived. Deriving rather
- * than configuring is what makes ONE document correct for the internal
- * address the MCP gateway uses and for a public host at the same time
- * (`information-exists-in-one-location` — the request is the only place
- * the reachable address exists).
- *
- * The `/api/rpc` prefix is part of the answer, not an accident of the
- * mount: it is the prefix the POST handler serves under, so a client that
- * reads the document can call what the document describes.
+ * @status handwritten
  */
 
-/**
- * Both fallbacks are read through FALSYNESS, not `??`: a header that is
- * present but empty named nothing, and `"" ?? "http"` would splice an
- * empty scheme into the URL as `://host` — a document that serves and
- * cannot be called from (caught by the row passing empty positions).
- */
 import type { OpenApiDocumentOptions } from "@teamscala/orpc/openapi";
 
 const FALLBACK_HOST = "localhost";

package/src/orpc-openapi-gate.ts

@@ -1,37 +1,15 @@
 /**
  * @system service-boot
- * @status handwritten — none derivable: the gate is a REJECTION RULE over four request facts, and no row states a rule — searched the service-boot auth surfaces (auth-gate.ts, auth/, content-gate/, gpt-gate.ts, bind-page-handler.ts) for an existing static-key check to call, and public-paths.ts names exempted PATHS, never a verifier
- * @edit edit directly
- *
- * THE OpenAPI CONTRACT GATE: who may read the document.
- *
- * It refuses a PROXIED request even when the key is right. The guard
- * `auth-helpers-fail-closed` holds a static key internal-only and never a
- * public sole-gate, and names the remedy: also reject on proxy-header
- * presence. Here the two are one fact from both sides — public ingress
- * crosses the tunnel and injects those headers, an internal fetch carries
- * neither, and the MCP gateway is the internal fetch.
- *
- * EVERY REFUSAL IS A REFUSAL: no key, no header, wrong key, proxied.
+ * @status handwritten
  */
 
-/**
- * The four request facts the gate reads, all optional: a fact the caller
- * did not send is absent, never a value to trust. Truthiness reads absence
- * and null identically, so a header is an assertion, not a hint.
- */
 export interface OpenApiContractRequest {
-	/** The raw `authorization` header, absent when the caller sent none. */
 	authorization?: string | null;
-	/** The configured `SCALA_DEV_KEY`, absent when the service has none. */
 	key?: string | null;
-	/** `x-forwarded-proto`. Its presence means the request was proxied. */
 	forwardedProto?: string | null;
-	/** `x-forwarded-for`. Same meaning, checked so neither alone is load-bearing. */
 	forwardedFor?: string | null;
 }
 
-/** True only for an unproxied request presenting exactly the configured key. */
 export function openApiContractAuthorised(request: OpenApiContractRequest): boolean {
 	if (!request.key) return false;
 	if (request.forwardedProto || request.forwardedFor) return false;

package/src/page-route-shell-types.ts

@@ -1,13 +1,6 @@
 /**
- * @system ui-service-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Render mode literal shared across page route registration. The old
- * shell-variant types (LegacyShell, PageSlugShell, RegionsShell,
- * PublicShell, ConfigPageRoute) were removed when the Phase 2 deploy-time
- * `service_install.page_routes[]` path was eliminated — all routing is
- * now registry-driven `page_route` rows (Phase 1).
  */
 
 export type RenderModeLiteral =

package/src/page-server-loader-graph.ts

@@ -1,16 +1,6 @@
 /**
  * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * page-server-loader-graph.ts — binds the ONE loader-graph resolver
- * (@teamscala/resolver-engine's createLoaderConfigResolver) to the page-server
- * SSR client. The resolver used to be duplicated here with its own algorithm;
- * the copies drifted (a non-UUID URL ref resolved absent on this surface and
- * still threw into the render breaker on the fn-router surface), so the
- * algorithm became one injected function and each surface binds its own
- * client source. This module IS that binding for the SSR surface — the single
- * place the page-server client and the loader-graph resolver meet.
  */
 
 import { createLoaderConfigResolver } from "@teamscala/resolver-engine/loader-config/resolve-from-loader-config";

package/src/page-server-orpc/server-client.ts

@@ -1,28 +1,6 @@
 /**
- * @system page-server
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Server-side ORPC client for in-process direct invocation, per the canonical
- * Vite/Next/Nuxt SSR pattern documented at https://orpc.dev/docs/best-practices/optimize-ssr
- *
- * The host service (scala-install) must call `setServerClient(client)` once
- * at boot, after createRouterClient(appRouter, { context: { prisma } }).
- * Then page-server's createPageHandler reads `getServerClient()` per request
- * — no HTTP loopback, just a typed function call.
- *
- * NO EMPTY-ROUTER SUBSTITUTE. This used to answer an unregistered read by
- * fabricating `createRouterClient({}, …)` — a client with no models on it. That
- * turned "boot never registered a client" into "every model lookup returns
- * undefined", which surfaces far away as MissingLoaderModelCapabilityError on
- * page render rather than as a boot failure. Measured 2026-08-20: quiz and forms
- * served 500s on every data-backed page for hours while /health returned 200 and
- * boot logged "ORPC serverClient registered", because the empty router is
- * indistinguishable from a real one until something asks it for a model
- * (`a-component-may-not-report-a-state-it-has-not-verified`).
- *
- * A missing client is now a thrown error naming the boot step that should have
- * set it, so the failure is reported by the component that has the fault.
  */
 
 import { createRouterClient } from "@orpc/server";

package/src/pg-boss-handler-registry.ts

@@ -1,38 +1,15 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * The pg-boss scheduled-job handler registry — `handler_slug` → handler
- * function. Built on `@teamscala/generic-registry` `createRegistry` (the mandated
- * primitive per `generic-registry-is-the-only-registry-pattern`); a hand-rolled
- * Map or a hardcoded switch in service-boot is the prohibited alternative.
- *
- * Handlers live in packages and self-register at boot (a boot hook / package
- * subscriber shape) by calling `registerScheduledJobHandler`. `resolveHandler`
- * in `pg-boss-mount.ts` reads this registry to dispatch a firing `scheduled_job`
- * row to its registered function.
  */
 import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
 import { createRegistry } from "@teamscala/generic-registry/create-registry";
 
 export type PgBossJobHandler = (ctx: {
 	config: ScheduledJobConfig;
-	/** Per-job data payload from a one-shot `boss.send()` — absent for scheduled jobs. */
 	jobData?: unknown;
 }) => Promise<unknown> | unknown;
 
 export const pgBossHandlerRegistry = createRegistry<PgBossJobHandler>(
 	"pg-boss-handlers",
 );
-
-/**
- * Register a handler for a `scheduled_job.handler_slug`. Idempotent on re-import
- * (createRegistry.register overwrites silently — last registration wins).
- */
-export function registerScheduledJobHandler(
-	slug: string,
-	handler: PgBossJobHandler,
-): void {
-	pgBossHandlerRegistry.register(slug, handler);
-}

package/src/pg-boss-mount.ts

@@ -1,13 +1,6 @@
 /**
- * @system server-boot
+ * @system service-boot
  * @status handwritten
- * @edit edit directly
- *
- * Mounts pg-boss for a backend service. Reads all scheduled_job registry
- * entries scoped to the current service from the registry cache, registers
- * pg-boss workers per queue_name, and schedules cron/interval jobs.
- * Per Constitution Rule 6: pg-boss is the single mechanism for all
- * application background work.
  */
 
 import type { ScheduledJobConfig } from "@teamscala/db-validation/registry-schemas/scheduled-job";
@@ -21,25 +14,8 @@ import type { ScheduleOptions } from "pg-boss";
 import { PgBoss } from "pg-boss";
 import { pgBossHandlerRegistry } from "./pg-boss-handler-registry.ts";
 
-// Handlers register via their package's own boot hook / subscriber import
-// (package-subscriber shape) — no bundled copies. The mount resolves each
-// row's handler_slug against this registry at dispatch time.
 
 
-/**
- * Module-level reference to the mounted PgBoss instance — set by mountPgBoss on
- * successful start. Exposed via getPgBoss() so ORPC procedures (and other
- * in-process callers) can submit one-shot jobs via boss.send() without a second
- * PgBoss connection. Null before mount or when mountPgBoss found no scheduled
- * jobs for this service (boss never created).
- */
-let pgBossInstance: PgBoss | null = null;
-
-/** Returns the mounted PgBoss instance, or null if pg-boss is not running on this service. */
-export function getPgBoss(): PgBoss | null {
-	return pgBossInstance;
-}
-
 export interface PgBossMountContext {
 	databaseUrl: string;
 	serviceSlug: string;
@@ -66,9 +42,6 @@ function belongsToService(
 	const config = entry.config as Record<string, unknown>;
 	const handlerSlug = config.handler_slug as string | undefined;
 	if (!handlerSlug) return false;
-	// Explicit row-driven targeting takes precedence — a universal boot-package
-	// handler (e.g. one in @teamscala/service-boot, which no service declares in
-	// server_packages) cannot be scoped by the server_package prefix match.
 	const targetService = config.service_slug as string | undefined;
 	if (targetService) return targetService === serviceSlug;
 	return packages.some(
@@ -120,50 +93,13 @@ export async function mountPgBoss(
 	const log = getAppLogger();
 	const jobs: MountedJob[] = [];
 
-	// pg-boss connects through pg, whose sslmode dialect differs from the
-	// shared URL's libpq spelling — route through the canonical rewrite.
-	// Config object (not a bare connectionString) so the internal pool is
-	// bounded + tagged for the ~220ms cross-internet dev→Railway RTT.
-	// POLL-ONLY, EXPLICITLY. pg-boss v12 dispatches by polling (SELECT .. FOR
-	// UPDATE SKIP LOCKED inside a transaction; its locks are
-	// pg_advisory_xact_lock — transaction-scoped, so a transaction pooler
-	// cannot leak them); LISTEN/NOTIFY is a supplier-documented latency hint
-	// whose registration dies on a transaction-pooler backend reassignment
-	// (measured 2026-09-14: the opted-in sync worker boss logged
-	// `LISTEN/NOTIFY channel registration was lost` every log window).
-	// attorney.js defaults useListenNotify to false in 12.29.0 (pinned),
-	// 12.30.0 (deployed) and 12.31.1 (latest) — all three read directly —
-	// and spelling it here keeps that contract explicit so a pg-boss bump
-	// cannot silently re-introduce a LISTEN dependency
-	// (close-the-session-mode-door, 2026-09-14). The connection dials the
-	// injected DATABASE_URL — the transaction pooler — reconciling the pg
-	// sslmode dialect; the mount adds no endpoint derivation of its own.
 	const boss = new PgBoss({
 		useListenNotify: false,
 		connectionString: pgSslCompatUrl(ctx.databaseUrl),
 		application_name: `pgboss:${ctx.serviceSlug}`,
-		// ONE connection, not three: pg-boss is a sibling pool that sits OUTSIDE
-		// the Prisma budget, and with ~46 declared holders the fleet saturated
-		// at 304/300 (2026-08-27) partly on 3-connection pg-boss pools that had
-		// no idle timeout. At max:1 jobs serialize into a queue — the sanctioned
-		// background degradation (`a-per-consumer-pool-max-is-not-a-bound-on-the-server`:
-		// background work degrades to a queue, interactive work degrades to an
-		// outage). The sibling total is declared in
-		// config/db-pool-sizing.perServiceOverhead (pg-boss 1; the LISTEN allowance is gone with poll-only).
 		max: 1,
-		// Generous connection-acquisition budget for the cross-internet link so
-		// a slow TLS handshake under sustained load doesn't terminate the conn.
 		connectionTimeoutMillis: 30_000,
 	});
-	// crash-isolation: pg-boss's manager emits 'error' on a worker-connection
-	// failure (a proxy-killed idle conn under sustained cross-internet writes).
-	// With NO listener, EventEmitter THROWS on emit('error'), the worker's
-	// promise rejects unhandled, and Bun exits the process — the scala-extract
-	// restart-storm of 2026-07-19. The listener makes it a logged, recovered
-	// event. This is the pg-boss-owned connection, the sibling of @teamscala/db's
-	// application-pool pool.on('error') handler (the app pool alone did not
-	// cover pg-boss's separate pool). Registered before start() so a boot-time
-	// error is caught too.
 	boss.on("error", (err) => {
 		log.warn(`[pg-boss:${ctx.serviceSlug}] recovered error event (process kept alive)`, {
 			error: err instanceof Error ? err.message : String(err),
@@ -172,21 +108,10 @@ export async function mountPgBoss(
 	boss.on("warning", (w) => {
 		log.warn(`[pg-boss:${ctx.serviceSlug}] warning`, { warning: String(w) });
 	});
-	// start() MUST precede work()/schedule() — it opens the DB connection;
-	// calling schedule() before start() crashes the timekeeper with
-	// "Database not opened. Call open() before executing SQL." (pg-boss v12)
 	await boss.start();
-	pgBossInstance = boss;
 
 	for (const entry of scheduledEntries) {
-		// crash-isolation: a malformed scheduled_job row degrades to "this job
-		// unavailable" (logged + event-log row), NEVER a boot-crash. A bare
-		// pg-boss assert reaching boot is the violation.
 		let config: ScheduledJobConfig;
-		// validateRow returns a RESULT WRAPPER ({ok:true,value}|{ok:false,issues}),
-		// never the config itself — measured 2026-09-16: assigning the wrapper as
-		// the config left queue_name/handler_slug undefined and silently skipped
-		// EVERY row on services holding db-validation 0.1.289+.
 		const validated = validateRow("scheduled_job", entry.config);
 		if (!validated.ok) {
 			const reason = validated.issues
@@ -217,19 +142,12 @@ export async function mountPgBoss(
 		const queueName = config.queue_name;
 
 		try {
-			// pg-boss v12 requires the queue to exist before work()/schedule()
-			// dispatch against it ("Queue X does not exist") — createQueue's
-			// underlying SQL is ON CONFLICT DO NOTHING, so calling it on every
-			// boot is a safe idempotent assert, never a duplicate-creation error.
 			await boss.createQueue(queueName);
 			await boss.work(queueName, async (jobs) => {
 				let result: unknown;
 				for (const job of jobs) {
 					result = await resolveHandler(config.handler_slug, config, job.data);
 				}
-				// pg-boss stores the work handler return as job output when
-				// exactly one job was processed (manager.js complete()). For
-				// batch/scheduled jobs the return is not stored.
 				return jobs.length === 1 ? result : undefined;
 			});
 
@@ -267,15 +185,6 @@ export async function mountPgBoss(
 				});
 			}
 
-			// A SUCCESSFUL mount emitted nothing until now, while every failure
-			// path above recorded an event — so the one state you most need to
-			// confirm ("is this job actually scheduled on this service?") was the
-			// only one with no evidence. Combined with resolveHandler THROWING
-			// into boss.work() rather than warning, that made "never scheduled"
-			// and "fired and threw" externally identical, and cost a
-			// scheduled_job relocation that had to be reverted undiagnosed on
-			// 2026-07-30. Emitting on success makes the mount set queryable
-			// (event-log-is-the-only-durable-event-log).
 			const mounted = jobs[jobs.length - 1];
 			recordEvent({
 				kind: "pgboss.job.mounted",
@@ -289,10 +198,6 @@ export async function mountPgBoss(
 				},
 			});
 		} catch (err) {
-			// crash-isolation for the mount path: a work()/schedule() failure
-			// (e.g. DB not open, queue conflict) degrades to "this job unavailable"
-			// (logged + event-log row), NEVER a boot-crash. Same treatment as the
-			// row-validation guard above.
 			const reason = err instanceof Error ? err.message : String(err);
 			log.error(
 				`[pg-boss-mount:${ctx.serviceSlug}] scheduled_job "${entry.slug}" failed to mount (work/schedule) — skipping`,
@@ -306,16 +211,6 @@ export async function mountPgBoss(
 		}
 	}
 
-	// Reconcile orphaned cron schedules: unschedule any pg-boss schedule that no longer corresponds to an ACTIVE registry row. Deactivating/deleting a
-	// scheduled_job (or sync_job_handler) previously left its cron lingering in pgboss.schedule, firing indefinitely — 2 stale web-extractor schedules
-	// found 2026-07-27, still scraping every 3/15min months after the job was meant to be one-off. Deactivation must actually stop the cron. A schedule is
-	// "backed" iff ANY active registry row's slug OR queue_name equals its name — this covers scheduled_job AND sync_job_handler (and any future
-	// schedule-owning type) without hardcoding the type list, so live sync jobs (zoho_assist_sync, trackabi, …) are never touched. Runs on every pg-boss
-	// mount and reconciles GLOBALLY: an orphan is removed regardless of which
-	// service created it, since a cron with no active backing row is drift by
-	// definition. A service with zero active scheduled jobs early-returns above
-	// and never reaches here — scala-loga (7 cron jobs) is the reliable
-	// reconciler, but any service-with-jobs that boots cleans the full set.
 	try {
 		const backedScheduleNames = new Set(
 			allEntries.flatMap((e) => {
@@ -342,9 +237,6 @@ export async function mountPgBoss(
 			});
 		}
 	} catch (err) {
-		// crash-isolation: a reconciliation failure degrades to "orphans not
-		// cleaned this boot" (logged), never a boot-crash — reconciled on the
-		// next successful mount.
 		log.warn(`[pg-boss:${ctx.serviceSlug}] schedule reconciliation failed`, {
 			error: err instanceof Error ? err.message : String(err),
 		});