Bridge refusals and pickup stalls

The central ASGI observer records failed responses (400–599) under /bridge/v1/executions*, /bridge/v1/claims* and /bridge/v1/heartbeat, including the retired standalone POST (410), unmatched paths and unhandled exceptions. It stores only authenticated node attribution, method, registered route template, status, allowlisted error code and UUID path parameters. Request bodies, headers, tokens and response bodies are never stored. Unmatched paths use unmatched. An invalid JSON body or a response over 16 KiB uses unparsed; a JSON error code outside [a-z0-9_]{1,64} uses unknown.

Read recent failures with a read-only operator database connection:

SELECT created_at, node_id, method, route, status, error_code, execution_id, claim_id
FROM bridge_request_failures
WHERE created_at >= now() - interval '24 hours'
ORDER BY created_at DESC
LIMIT 100;

Add AND node_id = '<node UUID>'::uuid to focus on a known Mac. node_id is NULL when authentication did not succeed or the identity has no linked node. The retired POST never authenticates, so its node is NULL even with a bearer.

Recording is best-effort and runs in separate background tasks; the ASGI call does not wait for recording or cancellation cleanup. At most 32 records are in flight; excess records are dropped with a warning containing only the type. Pool acquisition, attribution lookup, INSERT and release share a two-second deadline, with one-second acquisition and query timeouts. Cancellation begins at the deadline, but a slot remains occupied until connection cleanup actually finishes. An error or timeout logs only the exception type and leaves the original status and body unchanged. Shutdown stops admission and cancels/drains the task set for at most two seconds before closing the pool; unfinished cleanup remains referenced and logs a warning. When the pool is unavailable, the 503 not_ready response has no record. This is not a complete audit ledger. Server Beat deletes records older than 14 days, at most 1000 per tick.

The table migration is 061_bridge_request_failures.sql. Its rename from 059 applies to fresh databases only: the earlier file was never deployed. It does not introduce a migration-history transition.

bridge.pickup is retired (S2); Server Beat no longer monitors background pickup or offered executions.