fix

apps/api/cmd/api/main.go

@@ -26,6 +26,12 @@ func main() {
 	if err != nil {
 		log.Fatalf("config: %v", err)
 	}
+	if cfg.InsecureLocalProductionActive() {
+		slog.Warn("ALLOW_INSECURE_LOCAL_PRODUCTION=1 with loopback WEB_ORIGIN — not for public deploy",
+			"web_origin", cfg.WebOrigin,
+			"http_addr", cfg.HTTPAddr,
+		)
+	}
 	if cfg.ShouldWarnRateLimits() {
 		slog.Warn(cfg.RateLimitWarningMessage(),
 			"rate_limit_replicas", cfg.RateLimitReplicas,

apps/api/cmd/worker/main.go

@@ -157,6 +157,21 @@ func main() {
 	jobSlots := processing.NewJobSlots(processing.DefaultProcessingWorkers)
 	syncSlots := jobs.NewSyncSlots(jobs.DefaultSyncWorkers)
 	log.Printf("worker started - processing workers=%d sync workers=%d poll=%s LISTEN=%s,%s (ClaimNext SKIP LOCKED) + feed sync claim + support AI auto + woo/shopify claim + scheduled enqueue + billing cycles", jobSlots.Workers, syncSlots.Workers, cfg.ProcessingPollInterval, jobs.ChannelProcessingJobs, jobs.ChannelFeedSyncJobs)
+	if cfg.InsecureLocalProductionActive() {
+		log.Printf("worker WARNING: ALLOW_INSECURE_LOCAL_PRODUCTION=1 with loopback WEB_ORIGIN=%s — not for public deploy", cfg.WebOrigin)
+	}
+
+	// Before claiming a fresh heartbeat, reclaim running orphans left by a prior
+	// crash/SIGTERM (ClaimNext only selects pending). Skip when another worker is live.
+	probe := jobs.ProbeWorkerReadiness(ctx, pool, jobs.DefaultHeartbeatStaleAfter)
+	if probe.WorkerCheck == "missing" || probe.WorkerCheck == "stale" {
+		if res, err := processing.ReclaimOrphanedRunning(ctx, pool); err != nil {
+			log.Printf("worker orphan reclaim: %v", err)
+		} else if res.JobsRequeued > 0 || res.ProductsReset > 0 || res.SyncJobsRequeued > 0 {
+			log.Printf("worker orphan reclaim jobs_requeued=%d products_reset=%d sync_requeued=%d (prior worker %s)",
+				res.JobsRequeued, res.ProductsReset, res.SyncJobsRequeued, probe.WorkerCheck)
+		}
+	}
 
 	if err := jobs.TouchHeartbeat(ctx, pool, jobs.ProcessingWorkerID); err != nil {
 		log.Printf("worker heartbeat bootstrap: %v", err)