From 929b5353866ef65cb805b91edab0539e1272d26b Mon Sep 17 00:00:00 2001
From: Derek <derek@hyperi.io>
Date: Sun, 15 Nov 2026 10:47:15 +1100
Subject: [PATCH 1/2] fix(scalo): rebuild on 2.14.30

scalo 2.14.30's chart removes at most 25 percent of the replicas each minute after the 300 s KEDA scale-down window. The Kubernetes default could remove every surplus replica in one 15 s step.

scalo reports worker saturation as leased over max.

Update the scalo pin, the lock and the helm library pin to 2.14.30.
---
 .hyperi-ci.yaml | 2 +-
 Cargo.lock      | 6 +++---
 Cargo.toml      | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.hyperi-ci.yaml b/.hyperi-ci.yaml
index 9cb093e..ab69f49 100644
--- a/.hyperi-ci.yaml
+++ b/.hyperi-ci.yaml
@@ -67,7 +67,7 @@ release:
   helm:
     enabled: true
     contract: emit
-    library: "2.14.29"
+    library: "2.14.30"
   container:
     enabled: true
     dockerfile: Dockerfile
diff --git a/Cargo.lock b/Cargo.lock
index 43fa3ee..8c81b62 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4304,9 +4304,9 @@ dependencies = [
 
 [[package]]
 name = "scalo"
-version = "2.14.29"
+version = "2.14.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "feceebb26b38815f5f1b78b03f235630d011240810c75af6e230dd7518245a1f"
+checksum = "aee9c374451af23a6ebf90c02ce4ae33ea37fda7f397622825a3e0618988c566"
 dependencies = [
  "aes-gcm",
  "backon",
@@ -4463,7 +4463,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d43fb82d550b07e6f929a58d7d0935182602f48ddead875f5ee313c41c8f07fe"
 dependencies = [
  "annotate-snippets",
- "base64 0.22.1",
+ "base64 0.23.1",
  "encoding_rs_io",
  "granit-parser",
  "nohash-hasher",
diff --git a/Cargo.toml b/Cargo.toml
index bc05d03..b2af0a6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,7 +29,7 @@ tokio = { version = ">=1.54.1, <2", features = ["full"] }
 tokio-util = { version = ">=0.7.20, <0.8", features = ["rt"] }
 
 # The floor moves with `release.helm.library` in .hyperi-ci.yaml.
-scalo = { version = ">=2.14.29, <3", features = ["config-schema", "transport-kafka", "transport-grpc", "dlq-kafka", "config", "config-reload", "deployment", "version-check", "scaling", "cli-service", "top", "logger", "metrics", "service-metrics", "expression", "memory", "worker-batch", "governor", "secrets", "sink-stack", "geoip-download"] }
+scalo = { version = ">=2.14.30, <3", features = ["config-schema", "transport-kafka", "transport-grpc", "dlq-kafka", "config", "config-reload", "deployment", "version-check", "scaling", "cli-service", "top", "logger", "metrics", "service-metrics", "expression", "memory", "worker-batch", "governor", "secrets", "sink-stack", "geoip-download"] }
 
 # Steps scalo's jittered retry schedule (sink_stack backoff). Range MUST track
 # scalo's: BackoffBuilder only applies to the ExponentialBuilder scalo returns.
@@ -109,7 +109,7 @@ test-case = ">=3.4.1, <4"
 reqwest = { version = ">=0.12, <0.13", default-features = false, features = ["blocking", "rustls-tls-native-roots"] }
 
 # The Kafka tests' broker image pin and TLS/SASL broker fixture.
-scalo = { version = ">=2.14.29, <3", features = ["transport-kafka-test-support"] }
+scalo = { version = ">=2.14.30, <3", features = ["transport-kafka-test-support"] }
 
 # The status code a raw Push is refused with, through scalo's generated gRPC
 # client. Same range as the copy scalo resolves, so cargo unifies to one.

From fc82d3deb93b6863cca758e2b606eb87d8569e0f Mon Sep 17 00:00:00 2001
From: Derek <derek@hyperi.io>
Date: Sun, 15 Nov 2026 11:01:14 +1100
Subject: [PATCH 2/2] fix(scalo): regenerate the config artefacts on 2.14.30

scalo 2.14.30 rewords some of its config doc comments, which the generated config schema carries as descriptions. Regenerate the committed artefacts so the drift test matches.
---
 docs/config-schema.json | 2 +-
 docs/config-schema.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/config-schema.json b/docs/config-schema.json
index fd06f5e..6fd9710 100644
--- a/docs/config-schema.json
+++ b/docs/config-schema.json
@@ -989,7 +989,7 @@
           "const": "sapics"
         },
         {
-          "description": "Caller supplies the MMDB paths directly; nothing is downloaded.",
+          "description": "Caller supplies the MMDB paths directly. Nothing is downloaded.",
           "type": "string",
           "const": "custom"
         }
diff --git a/docs/config-schema.yaml b/docs/config-schema.yaml
index 9e6c981..a8a5468 100644
--- a/docs/config-schema.yaml
+++ b/docs/config-schema.yaml
@@ -901,7 +901,7 @@ $defs:
         anonymous, ASN only, CC BY 4.0.
       type: string
       const: sapics
-    - description: Caller supplies the MMDB paths directly; nothing is downloaded.
+    - description: Caller supplies the MMDB paths directly. Nothing is downloaded.
       type: string
       const: custom
   AutoDownloadConfig: