fix(selfhost): isolate per-event enqueue failures in the Orb relay drain loop

[JSONbored]

Summary

• drainOrbRelayWithMonitor's per-event loop called args.enqueue(...) with no try/catch. enqueueWebhookByEnv swallows its own anticipated failures (missing queue binding, queue send failure) and returns a string result — but two of its recordWebhookEvent calls are not wrapped in try/catch, so a D1/Postgres write failure there throws uncaught out of the loop, aborting the ENTIRE remaining batch for that drain tick. Every event still in the batch after the failing one was silently never attempted.
• Wraps the enqueue call in its own try/catch: a throw is treated exactly like the existing non-throwing "enqueue_failed" result — logged (new orb_relay_enqueue_threw structured error, Sentry-visible) and counted (gittensory_orb_webhook_total{result="enqueue_failed"}), not acked (so the relay redelivers it next drain), and the loop continues to the next event instead of aborting.

Closes #3813.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session/CORS surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/OpenAPI/MCP surface changed.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — backend-only change, no UI touched.)
• Visible UI changes include a UI Evidence section below. (N/A — no visible UI change.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.41%. Comparing base (ca6a6d7) to head (73f9987).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3842   +/-   ##
=======================================
  Coverage   93.41%   93.41%           
=======================================
  Files         326      326           
  Lines       32855    32860    +5     
  Branches    12035    12036    +1     
=======================================
+ Hits        30691    30696    +5     
  Misses       1530     1530           
  Partials      634      634           

Files with missing lines	Coverage Δ
src/selfhost/monitored-work.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-06 14:51:12 UTC}

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): src/selfhost/monitored-work.ts (matched src/selfhost/**).

Review summary
This PR wraps the `args.enqueue(...)` call in monitored-work.ts's drainOrbRelayWithMonitor loop in a try/catch, treating a thrown enqueue failure (e.g., a D1/Postgres write error inside recordWebhookEvent) identically to the existing non-throwing "enqueue_failed" result: it increments the same metric, logs a new structured `orb_relay_enqueue_threw` error, skips the ack push, and continues to the next event via `continue` rather than letting the exception propagate and abort the rest of the batch. The fix is correctly scoped to the actual bug (an uncaught throw escaping the per-event loop and killing the remaining batch for that drain tick) and is well covered by two new tests: one regression test proving all three events in a batch are still attempted when the middle one throws, and one covering the non-Error rejection stringification branch (`error instanceof Error ? ... : String(error)`). The EnqueueWebhookResult type used for the `let result` declaration is already imported at the top of the file, so there's no missing-symbol risk.

Nits — 5 non-blocking

• The external brief's "debug leftover" flag on `console.error` at monitored-work.ts:107 is a false positive — this is the same structured JSON error-logging convention used elsewhere in this file (e.g., registerOrbRelayWithMonitor's console.error/warn calls), not a stray debug print.
• The new catch block's JSON.stringify({level, event, eventName, error}) shape closely mirrors the pattern in registerOrbRelayWithMonitor's failure logging a few dozen lines down — consider a small shared helper if a third call site appears, though two occurrences don't yet justify it.
• Nothing else to change here — the isolation fix, metric/log parity with the existing enqueue_failed path, and test coverage (including the non-Error rejection arm) are all in place.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#3813
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 54 registered-repo PR(s), 46 merged, 399 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 54 PR(s), 399 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 54 PR(s), 399 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review