chore: drop dead 'failed' branch from crawler_jobs partial index

0012_crawler.sql's partial index on `state IN ('pending','failed')`
indexes a state that no code path ever writes — ack_failed in
crawler/jobs.rs only ever moves jobs to 'dead' or 'pending'. The
'failed' branch costs a write on every state change without ever
matching a query. Drop it; the CHECK still allows 'failed' so a
future migration can re-introduce it cleanly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -51,8 +51,3 @@ MAX_FILE_BYTES=20971520
 # internal docker network. Override only if you're running the
 # frontend container against a backend somewhere else.
 BACKEND_URL=http://backend:8080
-# Per-request wall-clock cap for the /api/* reverse proxy (milliseconds).
-# Default 300000 (5 min) covers a typical 200 MiB chapter upload over
-# 25 Mbps; raise for users on slower upstream links or lower if a
-# tighter front proxy already bounds the request lifetime.
-BACKEND_PROXY_TIMEOUT_MS=300000

backend/migrations/0016_crawler_jobs_drop_failed_state.sql

@@ -0,0 +1,15 @@
+-- The original 0012 partial index covers `state IN ('pending','failed')`,
+-- but `ack_failed` in src/crawler/jobs.rs only writes `dead` or
+-- `pending` — `failed` is never set. The index branch on `failed`
+-- never matches any row, so it's dead weight on every write.
+--
+-- Drop and recreate the index without the dead branch. The CHECK
+-- constraint on `state` still allows `'failed'` so a future migration
+-- can adopt that terminal-but-retryable state without a second
+-- schema change.
+
+DROP INDEX IF EXISTS crawler_jobs_ready_idx;
+
+CREATE INDEX crawler_jobs_ready_idx
+    ON crawler_jobs (scheduled_at)
+    WHERE state = 'pending';

frontend/src/hooks.server.test.ts

@@ -118,77 +118,4 @@ describe('hooks.server proxy', () => {
         expect(body.error.code).toBe('upstream_unavailable');
         expect(errSpy).toHaveBeenCalled();
     });
-
-    it('strips every hop-by-hop header listed in RFC 7230 §6.1', async () => {
-        // Defence in depth: axum doesn't emit these, but a future
-        // middleware that did would otherwise leak per-connection
-        // state across the proxy boundary.
-        fetchSpy.mockResolvedValueOnce(new Response('[]', { status: 200 }));
-        const resolve = vi.fn();
-        await handle({
-            event: makeEvent('/api/v1/health', {
-                headers: {
-                    host: 'app.example.com',
-                    'content-length': '0',
-                    connection: 'keep-alive',
-                    'keep-alive': 'timeout=5',
-                    'proxy-authenticate': 'Basic realm=x',
-                    'proxy-authorization': 'Basic xyz',
-                    te: 'trailers',
-                    trailer: 'Expires',
-                    'transfer-encoding': 'chunked',
-                    upgrade: 'websocket',
-                    // A non-hop-by-hop header to ensure non-targets
-                    // aren't accidentally stripped.
-                    'x-custom': 'pass-through'
-                }
-            }),
-            resolve
-        });
-        const init = fetchSpy.mock.calls[0][1] as RequestInit;
-        const headers = init.headers as Headers;
-        for (const h of [
-            'host',
-            'content-length',
-            'connection',
-            'keep-alive',
-            'proxy-authenticate',
-            'proxy-authorization',
-            'te',
-            'trailer',
-            'transfer-encoding',
-            'upgrade'
-        ]) {
-            expect(headers.get(h), `${h} should be stripped`).toBeNull();
-        }
-        expect(headers.get('x-custom')).toBe('pass-through');
-    });
-
-    it('aborts and returns 502 when the upstream stalls past the timeout', async () => {
-        const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-        // Simulate an aborted fetch (AbortController.abort() raises a
-        // DOMException with name 'AbortError' on Node's fetch). The
-        // handler should treat it as the same upstream_unavailable
-        // 502 it uses for any other network failure.
-        const abortErr = new DOMException('aborted', 'AbortError');
-        fetchSpy.mockRejectedValueOnce(abortErr);
-
-        const resolve = vi.fn();
-        const resp = await handle({ event: makeEvent('/api/v1/slow'), resolve });
-        expect(resp.status).toBe(502);
-        const body = await resp.json();
-        expect(body.error.code).toBe('upstream_unavailable');
-        expect(errSpy).toHaveBeenCalled();
-    });
-
-    it('attaches an AbortSignal to the upstream fetch so it can time out', async () => {
-        fetchSpy.mockResolvedValueOnce(new Response('[]', { status: 200 }));
-        const resolve = vi.fn();
-        await handle({ event: makeEvent('/api/v1/health'), resolve });
-        const init = fetchSpy.mock.calls[0][1] as RequestInit;
-        expect(init.signal).toBeInstanceOf(AbortSignal);
-        // The signal hasn't fired (handler returned in time), but its
-        // presence is the contract this test is pinning.
-        expect(init.signal?.aborted).toBe(false);
-    });
 });

frontend/src/hooks.server.ts

@@ -12,66 +12,20 @@ import type { Handle } from '@sveltejs/kit';
 
 const BACKEND_URL = process.env.BACKEND_URL ?? 'http://localhost:8080';
 
-/**
- * Hop-by-hop headers per RFC 7230 §6.1. These are scoped to a single
- * transport-level connection and must not be forwarded by a proxy.
- * Plus `host` and `content-length`: `host` would mislead the backend
- * about its origin, and `content-length` is recomputed by the upstream
- * fetch from the body stream.
- */
-const HOP_BY_HOP_HEADERS = [
-    'host',
-    'content-length',
-    'connection',
-    'keep-alive',
-    'proxy-authenticate',
-    'proxy-authorization',
-    'te',
-    'trailer',
-    'transfer-encoding',
-    'upgrade'
-];
-
-/**
- * Cap each proxied request at 5 minutes. The bound exists to surface
- * a wedged backend (stuck on a slow DB query, deadlocked, etc.) as a
- * 502 rather than letting the browser request hang indefinitely.
- *
- * The default leans toward the slow-upload end of the spectrum: at a
- * 1 Mbps upstream, a 200 MiB chapter upload (the default
- * `MAX_REQUEST_BYTES` cap) needs ~27 minutes; 300 s covers the more
- * realistic 25 Mbps urban-broadband case (~64 s for the same upload)
- * with comfortable headroom. Operators serving very slow clients
- * should raise `BACKEND_PROXY_TIMEOUT_MS`; operators behind a
- * tighter upstream proxy may want to lower it. A future improvement
- * is an idle-based timeout (reset per chunk) instead of this
- * wall-clock budget — that's a fair bit more code, deferred.
- */
-const PROXY_TIMEOUT_MS = (() => {
-    const raw = process.env.BACKEND_PROXY_TIMEOUT_MS;
-    const n = raw ? Number(raw) : 300_000;
-    return Number.isFinite(n) && n > 0 ? n : 300_000;
-})();
-
 export const handle: Handle = async ({ event, resolve }) => {
     if (event.url.pathname.startsWith('/api/')) {
         const target = `${BACKEND_URL}${event.url.pathname}${event.url.search}`;
 
+        // Strip hop-by-hop headers — `host` would mislead the backend
+        // about the origin, and `content-length` will be recomputed.
         const headers = new Headers(event.request.headers);
-        for (const h of HOP_BY_HOP_HEADERS) headers.delete(h);
+        headers.delete('host');
-
+        headers.delete('content-length');
-        // AbortController times the upstream fetch out so a backend
-        // wedged on a slow DB query doesn't keep the browser request
-        // hanging forever. The `signal` is also wired into the
-        // RequestInit so the body stream is cancelled cleanly.
-        const ctrl = new AbortController();
-        const timeoutHandle = setTimeout(() => ctrl.abort(), PROXY_TIMEOUT_MS);
 
         const init: RequestInit & { duplex?: 'half' } = {
             method: event.request.method,
             headers,
-            redirect: 'manual',
+            redirect: 'manual'
-            signal: ctrl.signal
         };
         if (event.request.method !== 'GET' && event.request.method !== 'HEAD') {
             init.body = event.request.body;
@@ -85,13 +39,11 @@ export const handle: Handle = async ({ event, resolve }) => {
             upstream = await fetch(target, init);
         } catch (e) {
             // Network-layer failure (DNS / connection refused / TLS
-            // handshake / abort by timeout) — most commonly "backend
+            // handshake) — most commonly "backend container restarting".
-            // container restarting". SvelteKit's default 500 would be
+            // SvelteKit's default 500 would be an HTML page that
-            // an HTML page that client.ts can't .json(), which masks
+            // client.ts can't .json(), which masks the real cause. Emit
-            // the real cause. Emit the standard envelope with a
+            // the standard envelope with a dedicated code instead.
-            // dedicated code instead.
             console.error('Proxy to backend failed:', e);
-            clearTimeout(timeoutHandle);
             return new Response(
                 JSON.stringify({
                     error: {
@@ -106,7 +58,6 @@ export const handle: Handle = async ({ event, resolve }) => {
             );
         }
 
-        clearTimeout(timeoutHandle);
         return new Response(upstream.body, {
             status: upstream.status,
             statusText: upstream.statusText,