# Monthly worker logging and observability gap

## Scope

Review of the logging and monitoring surfaces after user-authorized recovery of the independent monthly worker.

## Confirmed gaps

- The worker emits sparse JSON outcomes only when it is not idle; it does not emit startup, heartbeat, claim, duration or
  private exception-detail records. Detached Screen is the current process owner and is not durable application logging.
- Web request logs go through the standard handler's stderr logger with path-only request data. The checked-in local
  runtime has no service-specific rotating log file.
- Anonymous `/healthz` checks Web database/upload readiness only. Authenticated `monthly_ready` describes Web's manual
  monthly coordinator, not the separate worker process.
- PostgreSQL outbox status and the daily task trace are durable and privacy-minimized, but they cannot prove the worker
  is alive. The trace also uses generic downstream wording for the monthly event.

## Recommendation

Add structured worker/Web logs with bounded retention, a durable worker heartbeat/status surface, monthly-specific task
trace states, and supervisor/alert checks for stale heartbeat, old pending events, expired leases and dead events. Keep
database lifecycle state authoritative and keep raw business/source payloads, secrets and full hashes out of logs.

No code, migration, supervisor or runtime change was made during this review.