@agent-native/core 0.131.7 → 0.132.0

package/src/db/client.ts

@@ -954,19 +954,19 @@ export function isServerlessRuntime(): boolean {
 }
 
 /**
- * postgres.js pool options tuned per runtime. A serverless instance handles
- * one request at a time, so a single connection is enough. Keeping the
- * foreground pool at 1 is important because each instance can also open an
- * app and Better Auth pool; a max of 2 on each pool still exhausted Neon
- * under a burst of warm instances. idle_timeout is shortened on
+ * postgres.js pool options tuned per runtime. idle_timeout is shortened on
  * serverless so a thawed-but-idle instance releases its connections quickly.
- * Long-lived Node servers keep the normal pool for throughput.
+ * Long-lived Node servers keep the larger pool for throughput.
+ *
+ * The cap assumes {@link sharedDbPool}: one pool per URL for the whole
+ * process, not one per consumer. See {@link neonPoolMax} for why the cap must
+ * leave room for concurrency.
  */
 export function pgPoolOptions(url: string): Record<string, unknown> {
   const serverless = isServerlessRuntime();
   return {
     onnotice: () => {},
-    max: serverless ? 1 : 10,
+    max: serverless ? 4 : 20,
     idle_timeout: serverless ? 20 : 240,
     max_lifetime: 60 * 30,
     connect_timeout: 10,
@@ -977,13 +977,21 @@ export function pgPoolOptions(url: string): Record<string, unknown> {
 }
 
 /**
- * Connection cap for the @neondatabase/serverless `Pool`. Same instance
- * accumulation risk as postgres.js — one connection is enough for a
- * foreground serverless invocation and keeps the aggregate app/framework/auth
- * budget bounded.
+ * Connection cap for the @neondatabase/serverless `Pool`.
+ *
+ * TRAP: this number is the ceiling on how many statements one request can have
+ * in flight at once. It used to be 1 on serverless, which made every
+ * `Promise.all([...reads])` in a request serialize behind the single slot —
+ * against a remote endpoint that is ~83ms of pure wait per query, so ten
+ * "concurrent" reads took ~880ms instead of ~86ms. The cap was 1 only because
+ * every consumer built its OWN pool (the DbExec singleton, Better Auth, and one
+ * per `createGetDb()` schema module), so the real per-instance connection count
+ * was that number multiplied by ~6. {@link sharedDbPool} collapses those into
+ * one pool per URL, so the same aggregate budget buys in-request concurrency.
+ * Keep pools shared if you raise this.
  */
 export function neonPoolMax(): number {
-  if (!isServerlessRuntime()) return 10;
+  if (!isServerlessRuntime()) return 20;
   // The durable background-function worker is a SINGLE process per run (unlike
   // the many warm request-instances the foreground serverless has), so it can
   // safely hold a larger pool without risking Neon's connection cap. The agent's
@@ -996,7 +1004,7 @@ export function neonPoolMax(): number {
   // burst; keep the foreground serverless pool tiny to avoid "Max client
   // connections reached" across many warm instances.
   if (isBackgroundFunctionPoolContext()) return 8;
-  return 1;
+  return 4;
 }
 
 /**
@@ -1110,6 +1118,113 @@ export function attachNeonPoolErrorLogger(
   });
 }
 
+// ---------------------------------------------------------------------------
+// Shared connection pools
+// ---------------------------------------------------------------------------
+
+interface ClosablePool {
+  end(): Promise<unknown>;
+}
+
+const _sharedDbPools = new Map<string, ClosablePool>();
+const _sharedDbPoolCloseHooks = new Set<() => void>();
+const _sharedDbPoolReplacementHooks = new Map<string, Set<() => void>>();
+
+/**
+ * One connection pool per (driver, URL) for the whole process.
+ *
+ * Opening a connection to a remote database costs a full TCP + TLS + auth
+ * round-trip chain (~300-800ms measured against Neon in-region), and it used
+ * to be paid once per CONSUMER: the `getDbExec` singleton, Better Auth, and one
+ * more for every `createGetDb()` schema module (four in core alone, plus each
+ * app's). Their `max` values also multiplied against the provider's connection
+ * cap, which forced each pool down to a size too small to run a request's reads
+ * concurrently.
+ *
+ * TRAP: only consumers that live as long as the process may share. Anything
+ * handed a `close()` — `createDbExec()`, the migration exec on the direct
+ * endpoint — must keep a private pool, or closing it takes the whole process's
+ * database access down with it.
+ */
+export function sharedDbPool<T extends ClosablePool>(
+  driver: string,
+  url: string,
+  create: () => T,
+): T {
+  const key = `${driver}${url}`;
+  const existing = _sharedDbPools.get(key);
+  if (existing) return existing as T;
+  const created = create();
+  _sharedDbPools.set(key, created);
+  return created;
+}
+
+/**
+ * Swap the pool registered for a key, for the postgres.js recycle path that
+ * replaces a pool whose query timed out. Without this the registry would keep
+ * handing out the discarded pool.
+ */
+export function replaceSharedDbPool<T extends ClosablePool>(
+  driver: string,
+  url: string,
+  previous: T,
+  next: T,
+): void {
+  const key = `${driver}${url}`;
+  if (_sharedDbPools.get(key) !== previous) return;
+  _sharedDbPools.set(key, next);
+  for (const hook of _sharedDbPoolReplacementHooks.get(key) ?? []) {
+    try {
+      hook();
+    } catch {
+      // A consumer's reset must not block the replacement from being used.
+    }
+  }
+}
+
+/**
+ * Run `hook` when one shared pool is replaced, so derived consumers rebuild
+ * their handles instead of continuing to use the timed-out pool.
+ */
+export function onSharedDbPoolReplaced(
+  driver: string,
+  url: string,
+  hook: () => void,
+): void {
+  const key = `${driver}${String.fromCharCode(0)}${url}`;
+  const hooks = _sharedDbPoolReplacementHooks.get(key) ?? new Set();
+  hooks.add(hook);
+  _sharedDbPoolReplacementHooks.set(key, hooks);
+}
+
+/**
+ * Run `hook` when the shared pools are closed, so consumers holding a derived
+ * handle (a Drizzle instance bound to the pool, the Better Auth adapter) drop
+ * it instead of issuing queries on a closed pool.
+ */
+export function onSharedDbPoolsClosed(hook: () => void): void {
+  _sharedDbPoolCloseHooks.add(hook);
+}
+
+export async function closeSharedDbPools(): Promise<void> {
+  const pools = [..._sharedDbPools.values()];
+  _sharedDbPools.clear();
+  for (const hook of _sharedDbPoolCloseHooks) {
+    try {
+      hook();
+    } catch {
+      // A consumer's reset must not block the rest from being released.
+    }
+  }
+  await Promise.all(
+    pools.map((pool) =>
+      Promise.resolve(pool.end()).catch(() => {
+        // Already closed (process exiting, provider hung up) — nothing to do.
+      }),
+    ),
+  );
+}
+
 function disposePostgresPoolEventually(
   pool: { end: () => Promise<unknown> },
   label: string,
@@ -1130,8 +1245,6 @@ function disposePostgresPoolEventually(
 // ---------------------------------------------------------------------------
 
 let _exec: DbExec | undefined;
-let _pgPool: any;
-let _neonPool: any;
 let _sqlite: any;
 let _initPromise: Promise<void> | undefined;
 
@@ -1231,9 +1344,14 @@ async function createDbExecInternal(
       // connections, so its direct executions use stateless Neon HTTP instead.
       // The foreground and transaction surface keep the WebSocket pool.
       const bgHttp = isBackgroundFunctionPoolContext();
-      const pool = new Pool({ connectionString: url, max: neonPoolMax() });
+      const makePool = () =>
+        new Pool({ connectionString: url, max: neonPoolMax() });
+      // The singleton exec shares the process pool; `createDbExec()` callers own
+      // a `close()` and so must not be handed it.
+      const pool = trackSingletonResources
+        ? sharedDbPool("neon", url, makePool)
+        : makePool();
       attachNeonPoolErrorLogger(pool);
-      if (trackSingletonResources) _neonPool = pool;
       const httpSql = bgHttp ? neon(url, { fullResults: true }) : null;
       async function queryNeonClient(
         client: any,
@@ -1461,6 +1579,7 @@ async function createDbExecInternal(
           }, 1);
         },
         async close() {
+          if (trackSingletonResources) return closeSharedDbPools();
           await pool.end();
         },
       };
@@ -1566,12 +1685,17 @@ async function createDbExecInternal(
       // server-side timeout, avoiding ECONNRESET when the server hangs up.
       const createPool = () => postgres(url, pgPoolOptions(url));
       type PostgresPool = ReturnType<typeof createPool>;
-      let pool = createPool();
-      if (trackSingletonResources) _pgPool = pool;
+      // Same rule as the Neon path: the singleton exec shares the process pool,
+      // `createDbExec()` callers own a `close()` and get a private one.
+      let pool = trackSingletonResources
+        ? sharedDbPool("postgres-js", url, createPool)
+        : createPool();
       const recyclePool = (timedOutPool: PostgresPool) => {
         if (pool === timedOutPool) {
           pool = createPool();
-          if (trackSingletonResources) _pgPool = pool;
+          if (trackSingletonResources) {
+            replaceSharedDbPool("postgres-js", url, timedOutPool, pool);
+          }
         }
         disposePostgresPoolEventually(timedOutPool, "timed-out pooled query");
       };
@@ -1626,6 +1750,7 @@ async function createDbExecInternal(
           return result as T;
         },
         async close() {
+          if (trackSingletonResources) return closeSharedDbPools();
           await pool.end();
         },
       };
@@ -1884,14 +2009,9 @@ export function getDbExec(): DbExec {
 
 /** Close the database connection (for scripts that need cleanup). */
 export async function closeDbExec(): Promise<void> {
-  if (_pgPool) {
-    await _pgPool.end();
-    _pgPool = undefined;
-  }
-  if (_neonPool) {
-    await _neonPool.end();
-    _neonPool = undefined;
-  }
+  // Both Postgres pools live in the shared registry, which also notifies the
+  // Drizzle / Better Auth consumers bound to them.
+  await closeSharedDbPools();
   if (_sqlite) {
     _sqlite.close();
     _sqlite = undefined;

package/src/db/create-get-db.ts

@@ -21,6 +21,9 @@ import {
   withDbTimeout,
   retryOnConnectionError,
   dbOpTimeoutMs,
+  sharedDbPool,
+  onSharedDbPoolsClosed,
+  onSharedDbPoolReplaced,
 } from "./client.js";
 
 // Lazy driver loaders — cached promises so dynamic import only runs once.
@@ -444,6 +447,27 @@ export function createGetDb<T extends Record<string, unknown>>(schema: T) {
   let _db: any;
   let _dbReady: Promise<any> | undefined;
 
+  // The Drizzle instance is bound to a shared pool, so a `closeDbExec()` (test
+  // teardown, script cleanup) must invalidate it rather than leave this store
+  // issuing queries on a closed pool. Registered lazily from the pooled
+  // branches only — `createGetDb` is called at module scope by every store, and
+  // core's specs widely mock `db/client.js`.
+  let _closeHookRegistered = false;
+  function resetOnPoolClose(driver?: string, url?: string): void {
+    if (_closeHookRegistered) return;
+    _closeHookRegistered = true;
+    onSharedDbPoolsClosed(() => {
+      _db = undefined;
+      _dbReady = undefined;
+    });
+    if (driver && url) {
+      onSharedDbPoolReplaced(driver, url, () => {
+        _db = undefined;
+        _dbReady = undefined;
+      });
+    }
+  }
+
   function startInit(): Promise<any> {
     if (_dbReady) return _dbReady;
 
@@ -473,10 +497,15 @@ export function createGetDb<T extends Record<string, unknown>>(schema: T) {
     if (dialect === "postgres") {
       if (isNeonUrl(url)) {
         _dbReady = getNeonServerlessDrizzle().then(({ drizzle, Pool }) => {
-          const rawPool = new Pool({
-            connectionString: url,
-            max: neonPoolMax(),
-          });
+          // Shared with the DbExec singleton, Better Auth, and every other
+          // `createGetDb` store: one connect per process instead of one per
+          // schema module. See `sharedDbPool` in client.ts.
+          resetOnPoolClose("neon", url);
+          const rawPool = sharedDbPool(
+            "neon",
+            url,
+            () => new Pool({ connectionString: url, max: neonPoolMax() }),
+          );
           attachNeonPoolErrorLogger(rawPool);
           // Wrap the pool with the resilience layer so Drizzle queries get the
           // same withDbTimeout + retryOnConnectionError protection as the raw
@@ -489,8 +518,12 @@ export function createGetDb<T extends Record<string, unknown>>(schema: T) {
         _dbReady = getPgDrizzle().then(({ drizzle, postgres }) => {
           // pgPoolOptions caps the pool to a small size on serverless so
           // concurrent frozen instances don't exhaust Neon/Postgres'
-          // connection limit ("Max client connections reached").
-          const client = postgres(url, pgPoolOptions(url));
+          // connection limit ("Max client connections reached"). Shared across
+          // consumers — see `sharedDbPool` in client.ts.
+          resetOnPoolClose("postgres-js", url);
+          const client = sharedDbPool("postgres-js", url, () =>
+            postgres(url, pgPoolOptions(url)),
+          );
           _db = drizzle(buildResilientPostgresJsClient(client), { schema });
         });
       }

package/src/db/runtime-diagnostics.ts

@@ -51,7 +51,7 @@ export interface DatabaseSchemaHealthResult {
   error?: string;
 }
 
-const DEFAULT_REQUIRED_SCHEMA: RequiredSchemaTable[] = [
+export const DEFAULT_REQUIRED_SCHEMA: RequiredSchemaTable[] = [
   {
     table: "agent_runs",
     columns: [
@@ -253,6 +253,24 @@ async function tableColumns(
     : sqliteTableColumns(exec, table);
 }
 
+/**
+ * Memo for the default probe, which several client surfaces re-run on every
+ * page load at one `information_schema` round trip per required table.
+ *
+ * Only a clean, completed result is memoized: a probe reporting a missing table
+ * or an unreadable database must never be served from cache, or the repair that
+ * follows stays invisible for the whole window. Schema changes are additive and
+ * applied by migrations, so a clean answer cannot silently go bad — but the
+ * window is still kept to seconds, short enough that anything a deploy changes
+ * shows up on the next page load rather than being pinned. Callers that
+ * override `exec`, `dialect`, or `required` bypass it entirely.
+ */
+const SCHEMA_HEALTH_MEMO_MS = 5_000;
+let schemaHealthMemo: {
+  at: number;
+  result: DatabaseSchemaHealthResult;
+} | null = null;
+
 export async function runDatabaseSchemaHealthCheck(
   options: {
     exec?: DbExec;
@@ -260,6 +278,15 @@ export async function runDatabaseSchemaHealthCheck(
     required?: RequiredSchemaTable[];
   } = {},
 ): Promise<DatabaseSchemaHealthResult> {
+  const memoizable = !options.exec && !options.dialect && !options.required;
+  if (
+    memoizable &&
+    schemaHealthMemo &&
+    Date.now() - schemaHealthMemo.at < SCHEMA_HEALTH_MEMO_MS
+  ) {
+    return schemaHealthMemo.result;
+  }
+
   const dialect = options.dialect ?? getDialect();
   const exec = options.exec ?? getDbExec();
   const required = options.required ?? DEFAULT_REQUIRED_SCHEMA;
@@ -267,18 +294,24 @@ export async function runDatabaseSchemaHealthCheck(
   const missingColumns: Array<{ table: string; column: string }> = [];
 
   try {
-    for (const requirement of required) {
-      const columns = await tableColumns(exec, dialect, requirement.table);
+    // Independent probes: serially they cost one network round trip each.
+    const found = await Promise.all(
+      required.map((requirement) =>
+        tableColumns(exec, dialect, requirement.table),
+      ),
+    );
+    required.forEach((requirement, index) => {
+      const columns = found[index];
       if (!columns) {
         missingTables.push(requirement.table);
-        continue;
+        return;
       }
       for (const column of requirement.columns) {
         if (!columns.has(column)) {
           missingColumns.push({ table: requirement.table, column });
         }
       }
-    }
+    });
   } catch (err) {
     return {
       ok: false,
@@ -290,13 +323,15 @@ export async function runDatabaseSchemaHealthCheck(
     };
   }
 
-  return {
+  const result: DatabaseSchemaHealthResult = {
     ok: missingTables.length === 0 && missingColumns.length === 0,
     checked: true,
     dialect,
     missingTables,
     missingColumns,
   };
+  if (memoizable && result.ok) schemaHealthMemo = { at: Date.now(), result };
+  return result;
 }
 
 export function formatRuntimeDebugFingerprint(

package/src/deploy/build.ts

@@ -30,7 +30,7 @@ import {
   AGENT_BACKGROUND_PROCESSOR_ROUTE,
   AGENT_BACKGROUND_PROCESSOR_ROUTE_FIELD,
   AGENT_CHAT_PROCESS_RUN_PATH,
-  isDurableBackgroundFlagEnabled,
+  isDurableBackgroundFlagExplicitlyDisabled,
 } from "../agent/durable-background.js";
 import {
   INTEGRATION_RECOVERY_RUNTIME_MARKER,
@@ -2576,29 +2576,14 @@ export function findInstalledResvgPackages(
 
 /**
  * Deploy-time gate for emitting the second `-background` Netlify function.
- * Reads the same env flag the runtime gate uses
- * (`AGENT_CHAT_DURABLE_BACKGROUND`).
- *
- * DEFAULT-OFF (opt-in). It IS the runtime gate's flag parse
- * (`isDurableBackgroundFlagEnabled`), so the two can no longer drift:
- * unset/empty/unknown means DISABLED; an app opts IN
- * only with an explicit truthy value (`true`/`1`/`yes`/`on`). A premature
- * fleet-wide default-on caused real-user incidents (2026-06-24) before the
- * async worker path was proven, so durable is opt-in until verified live. This
- * gate is what emits the 15-min `-background` function so the `_process-run`
- * dispatch lands on it (async 202 → the worker runs with the real 15-min budget
- * → its ~13-min soft-timeout fits). The deploy gate and runtime gate MUST agree:
- * if the deploy emitted no `-background` function but the runtime still routed
- * the worker into the ~13-min timeout regime, the worker would overshoot the
- * ~60s synchronous wall and re-dispatch in a loop. (The runtime now also guards
- * the ~13-min budget on the real function name via `isInBackgroundFunctionRuntime`,
- * so a missing emit does not loop.) A missing emit is NOT benign, though: the
- * app then runs every turn on the ~60s synchronous wall for the life of the
- * deploy, so an opted-in build that cannot emit the function FAILS rather than
- * warning.
+ * Netlify deploys are default-on; an explicit falsy
+ * `AGENT_CHAT_DURABLE_BACKGROUND` value opts out. This is called only from the
+ * Netlify preset, so non-Netlify builds remain unaffected. The gate and runtime
+ * default must agree: otherwise the runtime could target a worker that the
+ * deploy did not emit.
  */
 export function isDurableBackgroundDeployEnabled(): boolean {
-  return isDurableBackgroundFlagEnabled();
+  return !isDurableBackgroundFlagExplicitlyDisabled();
 }
 
 /**
@@ -2649,9 +2634,15 @@ export function emitSingleTemplateNetlifyKeepWarmFunction(
   // dispatch (18.4s observed to reach the agent loop). A POST with no runId is
   // rejected by the `_process-run` route before any DB work, so this only keeps
   // the container alive.
-  const backgroundWarmPath = isDurableBackgroundEmitRequired()
-    ? JSON.stringify(AGENT_BACKGROUND_FUNCTION_URL_PATH)
-    : "null";
+  const backgroundEntryPath = path.join(
+    internalDir,
+    AGENT_BACKGROUND_FUNCTION_NAME,
+    `${AGENT_BACKGROUND_FUNCTION_NAME}.mjs`,
+  );
+  const backgroundWarmPath =
+    isDurableBackgroundEmitRequired() && fs.existsSync(backgroundEntryPath)
+      ? JSON.stringify(AGENT_BACKGROUND_FUNCTION_URL_PATH)
+      : "null";
   const entry = `const HEALTH_PATH = "/_agent-native/health";
 const BACKGROUND_WARM_PATH = ${backgroundWarmPath};
 const REQUEST_TIMEOUT_MS = 25_000;
@@ -4148,14 +4139,12 @@ export default bundle;
   }
 
   if (preset === "netlify") {
-    emitSingleTemplateNetlifyKeepWarmFunction(cwd);
-
-    // Durable background agent runs (default-OFF / opt-in; enable with a truthy
-    // AGENT_CHAT_DURABLE_BACKGROUND). Additive ONLY: emits a SECOND Netlify
-    // function whose name ends in `-background` re-exporting the same handler
-    // bundle, so the chat `_process-run` POST lands on Netlify's async (15-min)
-    // function. When not opted in this is a no-op and the single-function
-    // deploy is byte-for-byte unchanged.
+    // Durable background agent runs are default-on for Netlify; a falsy
+    // AGENT_CHAT_DURABLE_BACKGROUND value opts out. Additive ONLY: emits a
+    // SECOND Netlify function whose name ends in `-background` re-exporting the
+    // same handler bundle, so the chat `_process-run` POST lands on Netlify's
+    // async (15-min) function. When opted out this is a no-op and the
+    // single-function deploy is byte-for-byte unchanged.
     // NOT wrapped in try/catch: this block only runs when the runtime depends
     // on the function, and a swallowed failure ships an app that loses the
     // background budget for the life of the deploy with nothing in the log.
@@ -4163,6 +4152,10 @@ export default bundle;
       emitSingleTemplateNetlifyBackgroundFunction(cwd);
     }
 
+    // Emit keep-warm after the background artifact so it only pings a function
+    // that this build actually produced.
+    emitSingleTemplateNetlifyKeepWarmFunction(cwd);
+
     if (isIntegrationDurableDispatchDeployEnabled()) {
       try {
         emitSingleTemplateNetlifyIntegrationRecoveryFunction(cwd);

package/src/feature-flags/store.ts

@@ -89,11 +89,16 @@ export async function getFeatureFlagRules(
   if (!getFeatureFlagDefinition(key)) return defaultFeatureFlagRules();
   // An organization-specific rule overrides the global rule. The fallback is
   // what makes global exact-org targeting meaningful for callers in an org.
-  const stored = scope.orgId?.trim()
-    ? ((await getOrgSetting(scope.orgId, settingKey(key))) ??
-      (await getSetting(settingKey(key))))
-    : await getSetting(settingKey(key));
-  return normalizeFeatureFlagRules(stored);
+  // Most flags have no org override, so `??` made the common path two serial
+  // round trips; both settings rows are independent, so read them together.
+  const orgId = scope.orgId?.trim();
+  if (!orgId)
+    return normalizeFeatureFlagRules(await getSetting(settingKey(key)));
+  const [orgStored, globalStored] = await Promise.all([
+    getOrgSetting(orgId, settingKey(key)),
+    getSetting(settingKey(key)),
+  ]);
+  return normalizeFeatureFlagRules(orgStored ?? globalStored);
 }
 
 /**

package/src/integrations/a2a-continuations-store.ts

@@ -777,6 +777,17 @@ export async function recoverDueA2AContinuationIds(
   const receiptFilter = confirmedDeliveryOnly
     ? " AND terminal_delivery_confirmed_at IS NOT NULL"
     : "";
+  // The two lease resets below and the due SELECT all only ever touch rows in
+  // these three statuses, so one probe short-circuits all three. Without it the
+  // 60s retry job pays two blind UPDATE round trips per app forever on a queue
+  // that has been empty since boot.
+  const live = await client.execute({
+    sql: `SELECT id FROM integration_a2a_continuations
+          WHERE status IN ('pending', 'processing', 'delivering')${taskFilter}${receiptFilter}
+          LIMIT 1`,
+    args: [...taskArgs],
+  });
+  if ((live.rows?.length ?? 0) === 0) return [];
   // If a processor dies after a provider receipt, retry history-only custody
   // as soon as its short follow-up deadline passes. A pre-receipt delivery
   // claim retains the longer stale cutoff before an at-least-once resend.

package/src/integrations/config-store.ts

@@ -33,6 +33,17 @@ async function ensureTable(): Promise<void> {
   return _initPromise;
 }
 
+/**
+ * Bumped on every in-process config write. Pollers that back off while their
+ * integration is disabled watch this so enabling one takes effect on the next
+ * tick instead of at the end of their backoff window.
+ */
+let _configWriteEpoch = 0;
+
+export function integrationConfigWriteEpoch(): number {
+  return _configWriteEpoch;
+}
+
 export interface IntegrationConfig {
   platform: string;
   configKey: string;
@@ -88,6 +99,7 @@ export async function saveIntegrationConfig(
       Date.now(),
     ],
   });
+  _configWriteEpoch += 1;
 }
 
 /**
@@ -103,6 +115,7 @@ export async function deleteIntegrationConfig(
     sql: `DELETE FROM integration_configs WHERE platform = ? AND config_key = ?`,
     args: [platform, configKey],
   });
+  _configWriteEpoch += 1;
 }
 
 /**

package/src/integrations/google-docs-poller.ts

@@ -27,7 +27,11 @@ import {
   listChanges,
   listDocComments,
 } from "./adapters/google-docs.js";
-import { getIntegrationConfig, saveIntegrationConfig } from "./config-store.js";
+import {
+  getIntegrationConfig,
+  integrationConfigWriteEpoch,
+  saveIntegrationConfig,
+} from "./config-store.js";
 import { getThreadMapping, saveThreadMapping } from "./thread-mapping-store.js";
 import type { IncomingMessage } from "./types.js";
 
@@ -634,14 +638,34 @@ export async function startGoogleDocsPoller(
   }
 }
 
+/** Backoff for the config probe while google-docs is disabled. */
+const DISABLED_CONFIG_RECHECK_MS = 5 * 60 * 1000;
+
 function startPollLoop(
   options: GoogleDocsPollerOptions,
   intervalMs: number,
 ): void {
+  let disabledUntil = 0;
+  let disabledAtConfigWriteEpoch = -1;
+
   async function poll() {
     try {
+      // The loop starts even when google-docs was never configured (so it picks
+      // up a later enable), which used to mean one `integration_configs` read
+      // every 30s per app forever. While disabled, re-read only every
+      // DISABLED_CONFIG_RECHECK_MS — or immediately after any in-process config
+      // write, so enabling the integration still takes effect on the next tick.
+      const epoch = integrationConfigWriteEpoch();
+      if (Date.now() < disabledUntil && epoch === disabledAtConfigWriteEpoch) {
+        return;
+      }
       const config = await getIntegrationConfig(PLATFORM);
-      if (!config?.configData?.enabled) return;
+      if (!config?.configData?.enabled) {
+        disabledUntil = Date.now() + DISABLED_CONFIG_RECHECK_MS;
+        disabledAtConfigWriteEpoch = epoch;
+        return;
+      }
+      disabledUntil = 0;
       await processChanges(options);
     } catch (err) {
       // Unwrap ErrorEvent (Neon WS driver emits these on network failure) so logs show the real cause