[HIGH — Silent failure] The fail-closed try/except here is dead code, so a real Flipt outage is silent.

The docstring promises fail-closed "including any error", and the wrap at lines 123–136 is labelled "defense in depth". But check_feature_flag_status (unstract/flags/src/unstract/flags/feature_flag.py:45-46) already does a bare except Exception: return False with no logging. So:

• The except Exception branch at lines 129–136 can never execute — the logger.warning("...Flipt evaluation failed...") you wrote here will never fire.
• A genuinely broken Flipt (deleted flag, wrong namespace, gRPC connect failure while FLIPT_SERVICE_AVAILABLE=true) collapses into the same False as a healthy "rollout says no", with no decision-layer log.

This PR removes the PG_QUEUE_TRANSPORT_ENABLED master gate, so Flipt is now the sole interlock — making this blind spot load-bearing.

Fix: make check_feature_flag_status log + distinguish "evaluation errored" from "flag off" (e.g. log with exc_info and/or re-raise on a sentinel) so these resolver warnings can actually fire; or, at minimum, drop the misleading "defense in depth" comment so a future reader doesn't trust a guard that can't trip. Same issue in scheduler/ownership.py and unstract/.../executor_rpc.py.

[HIGH — Silent failure] "Fails closed … on any error" is unreachable; a Flipt outage silently leaves schedules on Beat with no log.

The except Exception → warn → return False at lines 66–76 is dead code: check_feature_flag_status (unstract/flags/.../feature_flag.py:45-46) swallows every exception and returns False itself, so the resolve_schedule_owner: Flipt check failed warning never fires. A broken/unreachable Flipt is indistinguishable from "rollout says no", and with the master gate now removed there is no other signal that ownership silently reverted to Beat.

Fix: same as in transport.py — have check_feature_flag_status log/propagate evaluation failures so this fail-closed path is observable, or drop the dead try/except + comment.

[HIGH — Silent failure] Fail-closed try/except (lines 159–167) is dead code; a Flipt outage silently routes to Celery with no log.

check_feature_flag_status already returns False on any exception with no logging, so the resolve_pg_transport: Flipt check failed warning here is unreachable. Same root cause and fix as transport.py/ownership.py.

Separately, the module docstring (lines ~19–22) is now stale — it still describes "a master kill-switch … supplied by the caller … then the single pg_queue_enabled Flipt flag", but this PR removed the master_gate_enabled param. Update it to describe Flipt as the sole gate.

[MEDIUM — Type design] Group the retry knobs into one validated policy.

_DEFAULT_CONNECT_BACKOFF and _CONNECT_BACKOFF_CAP only make sense together, and RETRIES/BACKOFF are env-tunable while the cap is not. An operator who sets WORKER_PG_QUEUE_CONNECT_BACKOFF=10 gets every sleep silently clamped to 5.0 — the knob appears to do nothing past the cap, with no warning.

Fix: fold the three values into a frozen ConnectRetryPolicy dataclass built once from env, with a sleep_for(attempt) method and a __post_init__ that asserts backoff_cap >= base_backoff (and either make the cap env-tunable or document it). This puts the backoff math + invariants in one enforced place and trivialises the loop body.

[LOW — Consistency / reuse] _connect_env validation is inconsistent, and it duplicates an existing helper.

A malformed value (RETRIES=abc) warns, but an out-of-range value (RETRIES=0, negative BACKOFF) is silently coerced by the caller's max(1, …)/max(0.0, …) (lines 85–86) with no log. For a "bad knob must not wedge it" goal, out-of-range deserves the same visibility as unparseable — move the clamping in here and warn when a parsed value is coerced.

Also note unstract.core.utilities._safe_get_env_int/_safe_get_env_float already do "read env, parse, warn-and-default" (core is a workers dependency). Not a drop-in (they take a fixed key and bake in non-negative validation), but worth converging on rather than carrying a near-duplicate.

[LOW] psycopg2.OperationalError is broad — permanent misconfig is retried before surfacing. Auth failures (password authentication failed), database "x" does not exist, and bad-host all raise OperationalError, not a subclass. A permanently-misconfigured DB_* var burns all attempts + ~1.5s of backoff on every create_pg_connection call (invoked by several long-running loops) before raising. The final logger.error + raise does surface it, so this is latency/log-noise, not a silent failure. Optional: skip retry for clearly-permanent SQLSTATEs (28xxx auth, 3D000 invalid db) via exc.pgcode, or tighten the docstring to say auth/db-name errors are retried-then-raised.

[LOW — Simplification] Drop the unreachable AssertionError sentinel by restructuring the loop. The loop already returns on success or raises on the final attempt, so this # pragma: no cover sentinel only exists because the terminal raise lives inside the loop. Invert the guard so the loop body handles only the retryable case and the terminal logger.error(...); raise is reached structurally on the last iteration — functionally identical, no sentinel, no pragma:

except psycopg2.OperationalError:
    if attempt >= attempts:
        logger.error(...)
        raise
    sleep_for = min(backoff * (2 ** (attempt - 1)), _CONNECT_BACKOFF_CAP)
    logger.warning(...)
    time.sleep(sleep_for)

[LOW — Dead code] logger (and import logging at line ~17) is now unused. Its only consumer was the fat-fingered-env warning this PR deletes; the backend counterpart (backend/pg_queue/executor_rpc.py) correctly carries no logger. Ruff won't flag a module-level unused binding, so this is cosmetic — remove both lines to keep the module clean (or keep if you anticipate logging here soon).

[LOW — Docs] The two new operator knobs are undocumented. This PR adds WORKER_PG_QUEUE_CONNECT_RETRIES and WORKER_PG_QUEUE_CONNECT_BACKOFF (read in connection.py:_connect_env) but documents neither here, while sibling PG-queue knobs (e.g. WORKER_PG_REAPER_INTERVAL_SECONDS) are documented by convention. Add commented entries near the other WORKER_PG_* settings noting the defaults (3 attempts / 0.5s base), the doubling behaviour, and the 5.0s cap.

[MEDIUM — Test coverage gaps] The new suite covers the core paths well but misses four behavioural branches of the retry logic:

1. Backoff cap (connection.py:100) — no test drives a sleep past 5.0s, so the min(…, _CONNECT_BACKOFF_CAP) clamp (a real production guarantee) has zero coverage. Add e.g. retries=5, backoff=4 → assert sleeps == [4.0, 5.0, 5.0, 5.0].
2. Unset-env default path (connection.py:47-49) — _patch always setenvs both knobs, so the production default (env absent → 3 attempts / 0.5s) is never exercised. Add a delenv test.
3. Invalid / negative BACKOFF (connection.py:52-59,86) — only the RETRIES cast-failure is tested; add backoff=xyz (→ default) and backoff=-1 (→ [0.0, 0.0], retry-without-sleep).
4. Connection params forwarded (connection.py:90-97) — every test discards connect kwargs; nothing asserts options=-c search_path=… (or host/db) is passed and stable across retries.

Also: test_retries_transient_then_succeeds's sleeps == [0.5, 1.0] can't distinguish exponential from linear growth — add one ≥3-sleep case (e.g. [1.0, 2.0, 4.0]) to pin the geometric contract.