@@ -122,16 +122,28 @@ printf '    ✓ schema registered\n'
 
 # ── 7b. assert the event was consumed (proves Avro decode via registry) ───────
 step "Polling notification-service /received for the decoded order.placed event"
+# ~180s window, not ~60s: when the bootstrap-applied KEDA ScaledObject has
+# notification-service scaled to zero, this very event is what wakes it —
+# KEDA's kafka lag poll + pod start + consumer-group join must fit here.
 seen=0
-for i in $(seq 1 30); do
-    RECV="$(curl -fsS "http://127.0.0.1:${LOCAL_NOTIF}/received" 2>/dev/null || echo '[]')"
+for i in $(seq 1 90); do
+    if ! RECV="$(curl -fsS "http://127.0.0.1:${LOCAL_NOTIF}/received" 2>/dev/null)"; then
+        # A port-forward pins the pod it attached to at start. With the KEDA
+        # ScaledObject applied, that pod can be replaced or scaled away at any
+        # moment (helm sets replicas=1, KEDA reconciles to 0, the tested event
+        # wakes a NEW pod) — leaving us polling a dead tunnel forever. Re-attach
+        # to the Service and treat this attempt as "not yet".
+        kill "$PF_N" 2>/dev/null
+        kubectl port-forward -n "$NS" service/notification-service "${LOCAL_NOTIF}:80" >/dev/null 2>&1 & PF_N=$!
+        RECV='[]'
+    fi
     if printf '%s' "$RECV" | python3 -c "import sys,json; d=json.load(sys.stdin); sys.exit(0 if any(e.get('order_id')=='$ORDER_ID' and e.get('event_type')=='order.placed' and e.get('item_sku')=='WIDGET-001' for e in d) else 1)" 2>/dev/null; then
         printf '    ✓ notification decoded order.placed for %s (after ~%ds)\n' "$ORDER_ID" "$((i*2))"
         seen=1; break
     fi
     sleep 2
 done
-(( seen )) || fail "notification did not consume/decode the Avro event within ~60s"
+(( seen )) || fail "notification did not consume/decode the Avro event within ~180s"
 
 printf '\n✓ SUCCESS — order.placed flows as registered Avro: schema in Apicurio + event decoded by the consumer via the registry\n'
 
 
@@ -89,6 +89,17 @@ for svc in "${DEPLOY[@]}"; do
     kubectl rollout status "deployment/${svc}" -n "$NS" --timeout=120s || fail "${svc} rollout failed"
 done
 
+# The SDL fetch port-forwards straight to the gateway Service, but the
+# bootstrap-applied KEDA HTTPScaledObject scales the gateway to zero when idle
+# (rollout status on a 0-replica deployment succeeds instantly, so the loop
+# above doesn't catch it). Wake it by hand; KEDA re-adopts it afterwards.
+gw_avail="$(kubectl get deploy graphql-gateway -n "$NS" -o jsonpath='{.status.availableReplicas}' 2>/dev/null)"
+if ! [[ "$gw_avail" =~ ^[1-9][0-9]*$ ]]; then
+    step "graphql-gateway is scaled to zero — waking it for the SDL fetch"
+    kubectl scale deploy graphql-gateway -n "$NS" --replicas=1 >/dev/null 2>&1
+    kubectl rollout status deployment/graphql-gateway -n "$NS" --timeout=120s || fail "graphql-gateway did not wake"
+fi
+
 # ── port-forwards ─────────────────────────────────────────────────────────────
 step "Port-forwards: order(${LOCAL_ORDER}) gateway(${LOCAL_GW}) apicurio(${LOCAL_APIC})"
 kubectl port-forward -n "$NS" service/order-service "${LOCAL_ORDER}:80" >/dev/null 2>&1 & PF_O=$!
 
@@ -35,6 +35,10 @@ step() { printf '\n==> %s\n' "$1"; }
 fail() {
     printf '\nFAILED: %s\n' "$1" >&2
     printf '\n--- notification-service pods (incl. init container) ---\n' >&2
+    # Deployment + ScaledObject first: an empty pod list here usually means
+    # KEDA has it scaled to zero, not that the deploy is missing.
+    kubectl get deploy notification-service -n "$NS" 2>&1 || true
+    kubectl get scaledobject -n "$NS" 2>&1 || true
     kubectl get pods -n "$NS" -l "app.kubernetes.io/name=notification-service" -o wide 2>&1 || true
     kubectl logs -n "$NS" -l "app.kubernetes.io/name=notification-service" -c migrate --tail=40 2>&1 || true
     kubectl logs -n "$NS" -l "app.kubernetes.io/name=notification-service" --tail=30 2>&1 || true
@@ -46,7 +50,16 @@ fail() {
 check_received() {
     # $1 = order_id to look for in /received
     local recv
-    recv="$(curl -fsS "http://127.0.0.1:${LOCAL_NOTIF}/received" 2>/dev/null || echo '[]')"
+    if ! recv="$(curl -fsS "http://127.0.0.1:${LOCAL_NOTIF}/received" 2>/dev/null)"; then
+        # A port-forward pins the pod it attached to at start. With the KEDA
+        # ScaledObject applied, that pod can be replaced or scaled away at any
+        # moment (helm sets replicas=1, KEDA reconciles to 0, the tested event
+        # wakes a NEW pod) — leaving us polling a dead tunnel forever. Re-attach
+        # to the Service and report "not yet" for this attempt.
+        kill "$PF_N" 2>/dev/null
+        kubectl port-forward -n "$NS" service/notification-service "${LOCAL_NOTIF}:80" >/dev/null 2>&1 & PF_N=$!
+        return 1
+    fi
     printf '%s' "$recv" | python3 -c "import sys,json; d=json.load(sys.stdin); sys.exit(0 if any(e.get('order_id')=='$1' for e in d) else 1)" 2>/dev/null
 }
 
@@ -120,12 +133,15 @@ ORDER_ID="$(curl -fsS -X POST "http://127.0.0.1:${LOCAL_ORDER}/orders" -H 'Conte
 printf '    order id=%s\n' "$ORDER_ID"
 
 step "Waiting for the notification to be persisted (/received, DB-backed)"
+# ~180s window, not ~60s: when the bootstrap-applied KEDA ScaledObject has
+# notification-service scaled to zero, this very event is what wakes it —
+# KEDA's kafka lag poll + pod start + consumer-group join must fit here.
 seen=0
-for i in $(seq 1 30); do
+for i in $(seq 1 90); do
     if check_received "$ORDER_ID"; then printf '    ✓ persisted after ~%ds\n' "$((i*2))"; seen=1; break; fi
     sleep 2
 done
-(( seen )) || fail "notification was not persisted within ~60s"
+(( seen )) || fail "notification was not persisted within ~180s"
 
 # ── durability: restart notification, the row must still be there ─────────────
 step "Restarting notification-service to prove durability (in-memory would lose it)"
 
@@ -208,10 +208,13 @@ preflight() {
     if want_act trace; then
         # trace bypasses the interceptor and port-forwards directly to the
         # graphql-gateway Service — see CAP-046. Confirm the Deployment + Service
-        # are both there so the port-forward has something to attach to.
-        check "graphql-gateway Deployment available" \
-              "kubectl -n $NS get deploy graphql-gateway -o jsonpath='{.status.availableReplicas}' 2>/dev/null | grep -qE '^[1-9][0-9]*$'" \
-              "kubectl -n $NS rollout status deploy/graphql-gateway   (or re-run bootstrap-capstone.sh)"
+        # are both there so the port-forward has something to attach to. Zero
+        # available replicas is fine here: bootstrap applies the KEDA
+        # HTTPScaledObject, which scales the gateway to zero when idle, and the
+        # trace act wakes it before port-forwarding.
+        check "graphql-gateway Deployment exists" \
+              "kubectl -n $NS get deploy graphql-gateway >/dev/null 2>&1" \
+              "helm upgrade --install graphql-gateway charts/capstone/charts/graphql-gateway -n $NS   (or re-run bootstrap-capstone.sh)"
         check "graphql-gateway Service exists" \
               "kubectl -n $NS get svc graphql-gateway >/dev/null 2>&1" \
               "kubectl -n $NS get svc graphql-gateway   (or re-run bootstrap-capstone.sh)"
@@ -287,6 +290,19 @@ trace_act() {
     local pf_pid=0 result=0
     local query='{"query":"{ order(id: \"trace-probe\") { id itemSku quantity stock { sku quantityOnHand available } } }"}'
 
+    # The direct port-forward needs a live pod behind the Service, but the KEDA
+    # HTTPScaledObject (applied by bootstrap) scales the gateway to zero when
+    # idle — and only interceptor traffic wakes it, which is exactly the path
+    # this act bypasses (CAP-046). Wake it by hand; KEDA reconciles afterwards.
+    local avail
+    avail="$(kubectl -n "$NS" get deploy graphql-gateway -o jsonpath='{.status.availableReplicas}' 2>/dev/null)"
+    if ! [[ "$avail" =~ ^[1-9][0-9]*$ ]]; then
+        info "graphql-gateway is scaled to zero — waking it (KEDA re-adopts it after the act)"
+        kubectl -n "$NS" scale deploy graphql-gateway --replicas=1 >/dev/null 2>&1
+        kubectl -n "$NS" rollout status deploy/graphql-gateway --timeout=120s >/dev/null 2>&1 \
+            || { narrate "✗ graphql-gateway did not become Ready after wake"; return 1; }
+    fi
+
     info "starting port-forward: graphql-gateway Service (capstone) → 127.0.0.1:8080"
     info "  (bypasses keda-add-ons-http-interceptor-proxy — see CAP-046)"
     kubectl port-forward -n "$NS" svc/graphql-gateway 8080:80 >/dev/null 2>&1 &