@desplega.ai/agent-swarm 1.159.0 → 1.161.0

package/src/azure-devops/index.ts

@@ -0,0 +1,27 @@
+// Azure DevOps Integration
+export {
+  likeAzureDevOpsComment,
+  postAzureDevOpsPullRequestComment,
+  resetAzureDevOpsBotIdCache,
+  resolveAzureDevOpsBotId,
+} from "./api";
+export {
+  AZURE_DEVOPS_BOT_NAME,
+  getAzureDevOpsOrgUrl,
+  getAzureDevOpsToken,
+  initAzureDevOps,
+  isAzureDevOpsEnabled,
+  resetAzureDevOps,
+  verifyAzureDevOpsWebhook,
+} from "./auth";
+export {
+  commentedPayloadOf,
+  createdPullRequestOf,
+  handlePullRequestCommented,
+  handlePullRequestCreated,
+} from "./handlers";
+export type {
+  AzureDevOpsWebhookEvent,
+  PullRequestCommentedEvent,
+  PullRequestCreatedEvent,
+} from "./types";

package/src/azure-devops/templates.ts

@@ -0,0 +1,108 @@
+/**
+ * Azure DevOps event prompt template definitions.
+ *
+ * Each template is registered at module load time via registerTemplate().
+ * Handlers import this module for the side-effect of registration.
+ *
+ * Template text uses {{variable}} syntax. The resolver interpolates variables
+ * and expands {{@template[id]}} references before returning the final text.
+ */
+
+import { registerTemplate } from "../prompts/registry";
+
+// ============================================================================
+// Common building blocks (Azure DevOps-specific)
+// ============================================================================
+
+registerTemplate({
+  eventType: "common.delegation_instruction.azure_devops",
+  header: "",
+  defaultBody:
+    "\n\n**Delegation instruction:** As the lead agent, analyze this and decide whether to handle it yourself or delegate to a worker agent. Use `send-task` to delegate with clear instructions.",
+  variables: [],
+  category: "common",
+});
+
+// `az repos` has no comment command, so replies go through `az devops invoke`.
+registerTemplate({
+  eventType: "common.command_suggestions.azure_devops_pr",
+  header: "",
+  defaultBody:
+    'Workers have the `az` CLI with the azure-devops extension, authenticated with the swarm PAT. Inspect the PR with `az repos pr show --id {{pr_id}}`. To reply on the PR, write `{"comments":[{"content":"<reply>"}],"status":1}` to a JSON file and run `az devops invoke --area git --resource pullRequestThreads --route-parameters project={{project}} repositoryId={{repository}} pullRequestId={{pr_id}} --http-method POST --in-file <file> --api-version 7.1`.',
+  variables: [
+    { name: "pr_id", description: "Pull request ID" },
+    { name: "project", description: "Azure DevOps project name" },
+    { name: "repository", description: "Azure Repos repository name" },
+  ],
+  category: "common",
+});
+
+const SHARED_VARIABLES = [
+  { name: "pr_id", description: "Pull request ID" },
+  { name: "pr_title", description: "Pull request title" },
+  {
+    name: "repo",
+    description: "Repository clone URL (https://dev.azure.com/<org>/<project>/_git/<repo>)",
+  },
+  { name: "project", description: "Azure DevOps project name" },
+  { name: "repository", description: "Azure Repos repository name" },
+  { name: "pr_url", description: "Pull request web URL" },
+];
+
+// ============================================================================
+// Pull request events
+// ============================================================================
+
+registerTemplate({
+  eventType: "azure-devops.pull_request.opened",
+  header: "[Azure DevOps PR #{{pr_id}}] {{pr_title}}",
+  defaultBody: `Repo: {{repo}}
+Author: {{username}}
+Branch: {{source_branch}} → {{target_branch}}
+URL: {{pr_url}}
+
+{{context_section}}{{@template[common.command_suggestions.azure_devops_pr]}}{{@template[common.delegation_instruction.azure_devops]}}`,
+  variables: [
+    ...SHARED_VARIABLES,
+    {
+      name: "username",
+      description:
+        "Author identity — resolved canonical name (e.g. 'Luis (azure-devops:luis@example.com)') or the UNKNOWN sentinel",
+    },
+    { name: "source_branch", description: "Source branch name" },
+    { name: "target_branch", description: "Target branch name" },
+    { name: "context_section", description: "Context section with description or empty string" },
+  ],
+  category: "event",
+});
+
+// ============================================================================
+// Pull request comment events
+// ============================================================================
+
+registerTemplate({
+  eventType: "azure-devops.comment.mentioned",
+  header: "[Azure DevOps Comment on PR #{{pr_id}}] {{username}} mentioned bot",
+  defaultBody: `Repo: {{repo}}
+PR: {{pr_title}}
+URL: {{pr_url}}
+
+Comment:
+{{context}}{{existing_task_note}}
+
+{{@template[common.command_suggestions.azure_devops_pr]}}{{@template[common.delegation_instruction.azure_devops]}}`,
+  variables: [
+    ...SHARED_VARIABLES,
+    {
+      name: "username",
+      description:
+        "Comment author identity — resolved canonical name (e.g. 'Luis (azure-devops:luis@example.com)') or the UNKNOWN sentinel",
+    },
+    { name: "context", description: "Extracted mention context from comment" },
+    {
+      name: "existing_task_note",
+      description: "Note about existing active task, or empty string",
+    },
+  ],
+  category: "event",
+});

package/src/azure-devops/types.ts

@@ -0,0 +1,90 @@
+/**
+ * Azure DevOps service-hook payload types.
+ *
+ * Based on https://learn.microsoft.com/azure/devops/service-hooks/events
+ * (resource version 1.0 for pull requests, 2.0 for pull request comments).
+ * Only the fields we actually use are typed.
+ */
+
+export interface AzureDevOpsIdentityRef {
+  id: string; // identity GUID; a picker @mention stores it as `@<GUID>`
+  displayName: string;
+  uniqueName?: string; // usually the sign-in email
+  url?: string;
+  imageUrl?: string;
+}
+
+export interface AzureDevOpsProjectRef {
+  id: string;
+  name: string;
+  url?: string;
+}
+
+export interface AzureDevOpsRepository {
+  id: string;
+  name: string;
+  url: string; // REST URL of the repository
+  project: AzureDevOpsProjectRef;
+  defaultBranch?: string;
+  remoteUrl: string; // clone URL, may carry a `user@` prefix
+}
+
+export interface AzureDevOpsPullRequest {
+  repository: AzureDevOpsRepository;
+  pullRequestId: number;
+  status: string; // "active" | "abandoned" | "completed"
+  createdBy: AzureDevOpsIdentityRef;
+  title: string;
+  description?: string | null;
+  sourceRefName: string; // e.g. "refs/heads/feature"
+  targetRefName: string;
+  url: string; // REST URL of the pull request
+  _links?: { web?: { href: string } };
+}
+
+export interface AzureDevOpsComment {
+  id: number;
+  parentCommentId: number;
+  author: AzureDevOpsIdentityRef;
+  content: string;
+  publishedDate: string;
+  lastContentUpdatedDate?: string;
+  commentType: string; // "text" | "system" | "codeChange"
+  _links?: {
+    self?: { href: string };
+    threads?: { href: string };
+  };
+}
+
+interface ResourceContainer {
+  id: string;
+  baseUrl?: string; // e.g. "https://dev.azure.com/fabrikam/"
+}
+
+interface ServiceHookEvent<TType extends string, TResource> {
+  id: string;
+  eventType: TType;
+  publisherId: string;
+  resource: TResource;
+  resourceVersion?: string;
+  resourceContainers?: {
+    collection?: ResourceContainer;
+    account?: ResourceContainer;
+    project?: ResourceContainer;
+  };
+  createdDate?: string;
+}
+
+/** `git.pullrequest.created` */
+export type PullRequestCreatedEvent = ServiceHookEvent<
+  "git.pullrequest.created",
+  AzureDevOpsPullRequest
+>;
+
+/** `ms.vss-code.git-pullrequest-comment-event` */
+export type PullRequestCommentedEvent = ServiceHookEvent<
+  "ms.vss-code.git-pullrequest-comment-event",
+  { comment: AzureDevOpsComment; pullRequest: AzureDevOpsPullRequest }
+>;
+
+export type AzureDevOpsWebhookEvent = PullRequestCreatedEvent | PullRequestCommentedEvent;

package/src/be/db/api-keys.ts

@@ -0,0 +1,70 @@
+import { deriveProviderFromKeyType } from "../../utils/credentials";
+import type { ModelFamily } from "../../utils/model-rate-limit-windows";
+import { planAllowsModelFamily } from "../../utils/subscription-plans";
+import { getDbClient } from "./runtime";
+
+/**
+ * Records a `credits_required` rejection: the key's seat cannot run `model`.
+ * Sets `lastSeatMismatchAt` / `lastSeatMismatchModel` on every scope row of
+ * the key. A Claude key whose plan the operator did not pick gets
+ * `claude_team_standard` / `detected`, the only plan that excludes Fable,
+ * but only when that plan excludes `model`: an Opus or Sonnet rejection is
+ * no evidence of a standard seat. A `manual` plan is never changed; a
+ * contradiction is logged instead. The key `status` is not touched.
+ */
+export async function recordKeySeatMismatch(
+  keyType: string,
+  keySuffix: string,
+  keyIndex: number,
+  model: ModelFamily,
+  scope = "global",
+  scopeId: string | null = null,
+): Promise<{ planChanged: boolean }> {
+  const now = new Date().toISOString();
+  const effectiveScopeId = scopeId ?? "";
+  const provider = deriveProviderFromKeyType(keyType);
+  return getDbClient().transaction(async (tx) => {
+    await tx.run(
+      `INSERT INTO api_key_status (keyType, keySuffix, keyIndex, scope, scopeId, provider, updatedAt)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(keyType, keySuffix, scope, scopeId)
+         DO UPDATE SET
+           keyIndex = excluded.keyIndex,
+           provider = excluded.provider,
+           updatedAt = excluded.updatedAt`,
+      [keyType, keySuffix, keyIndex, scope, effectiveScopeId, provider, now],
+    );
+    await tx.run(
+      `UPDATE api_key_status SET lastSeatMismatchAt = ?, lastSeatMismatchModel = ?
+         WHERE keyType = ? AND keySuffix = ?`,
+      [now, model, keyType, keySuffix],
+    );
+
+    let planChanged = false;
+    if (
+      keyType === "CLAUDE_CODE_OAUTH_TOKEN" &&
+      !planAllowsModelFamily("claude_team_standard", model)
+    ) {
+      const result = await tx.run(
+        `UPDATE api_key_status SET plan = 'claude_team_standard', planSource = 'detected'
+           WHERE keyType = ? AND keySuffix = ? AND COALESCE(planSource, '') != 'manual'`,
+        [keyType, keySuffix],
+      );
+      planChanged = result.changes > 0;
+    }
+
+    if (!planChanged) {
+      const stored = await tx.get<{ plan: string | null }>(
+        `SELECT plan FROM api_key_status
+           WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?`,
+        [keyType, keySuffix, scope, effectiveScopeId],
+      );
+      if (planAllowsModelFamily(stored?.plan, model)) {
+        console.warn(
+          `[api-keys] seat mismatch: key ...${keySuffix} (${keyType}) has plan ${stored?.plan ?? "none"} but cannot run ${model}`,
+        );
+      }
+    }
+    return { planChanged };
+  });
+}

package/src/be/db/tasks/read.ts

@@ -288,7 +288,7 @@ export function rowToAgentTask(row: AgentTaskRow): AgentTask {
     slackReplySent: !!row.slackReplySent,
     slackProgressMessageTs: row.slackProgressMessageTs ?? undefined,
     slackTreeRootMessageTs: row.slackTreeRootMessageTs ?? undefined,
-    vcsProvider: (row.vcsProvider as "github" | "gitlab" | null) ?? undefined,
+    vcsProvider: (row.vcsProvider as "github" | "gitlab" | "azure-devops" | null) ?? undefined,
     vcsRepo: row.vcsRepo ?? undefined,
     vcsEventType: row.vcsEventType ?? undefined,
     vcsNumber: row.vcsNumber ?? undefined,

package/src/be/db/tasks/write.ts

@@ -317,6 +317,22 @@ export async function updateTaskClaudeSessionId(
   return row ? rowToAgentTask(row) : null;
 }
 
+/**
+ * Records the harness that ran (or tried to run) a task when no session ever
+ * reported it. `provider` is otherwise written only by the session-init path,
+ * so a task whose harness failed to spawn kept `provider` NULL and looked like
+ * a task that never started. Never overwrites a provider already recorded.
+ */
+export async function recordTaskProviderIfUnset(
+  taskId: string,
+  provider: ProviderName,
+): Promise<void> {
+  await getDbClient().run("UPDATE agent_tasks SET provider = ? WHERE id = ? AND provider IS NULL", [
+    provider,
+    taskId,
+  ]);
+}
+
 /**
  * Sets or clears a task's display title (session rename). Trims the input and
  * normalizes an empty string to NULL (clear). Deliberately does NOT touch

package/src/be/db-client.ts

@@ -68,6 +68,9 @@ export interface DbClient extends DbExecutor {
    * really did occupy the driver and block the event loop, up to
    * `attemptSpinMs` per BUSY attempt. It excludes all lock waiting and all
    * backoff sleeping.
+   *
+   * `changes` counts only the rows the statement itself changed. Unlike
+   * `run`, it excludes rows touched by foreign-key actions.
    */
   runTimed(sql: string, params?: DbParam[]): Promise<{ changes: number; executionMs: number }>;
   /**
@@ -278,8 +281,14 @@ class BunSqliteClient implements DbClient {
     const result = await this.execute(
       sql,
       (db) => {
-        const run = db.query(sql).run(...params);
-        return { changes: run.changes };
+        db.query(sql).run(...params);
+        // bun:sqlite's `run().changes` also counts rows touched by foreign-key
+        // actions (an ON DELETE SET NULL child update counts as a change), so
+        // a DELETE on a self-referencing table reports up to twice the rows it
+        // removed. SQLite's changes() counts only the statement's own rows.
+        // Same connection, still inside the lock: nothing can run in between.
+        const own = db.query("SELECT changes() AS n").get() as { n: number } | null;
+        return { changes: own?.n ?? 0 };
       },
       (ms) => {
         executionMs += ms;

package/src/be/db-retention.ts

@@ -20,33 +20,63 @@ const YIELD_MS = 25;
  * This is deliberately a closed list. Neither table nor column names may come
  * from operator configuration: a retention policy must never target a table
  * that code review has not explicitly approved as safe to delete from.
+ *
+ * Two policies exist:
+ *  - `age`: the env value is a number of days; rows whose `timeColumn` is older
+ *    than that horizon are deleted.
+ *  - `keepLatest`: the env value is a count; within each `partitionBy` group,
+ *    only the newest `rankBy` rows are kept. The newest row of a group is
+ *    never deleted, because the smallest accepted count is 1.
  */
 export const DB_RETENTION_TABLES = [
   {
     table: "session_logs",
+    policy: "age",
     timeColumn: "createdAt",
     envKey: "SESSION_LOG_RETENTION_DAYS",
     metricsKey: "sessionLogs",
   },
   {
     table: "agent_log",
+    policy: "age",
     timeColumn: "createdAt",
     envKey: "AGENT_LOG_RETENTION_DAYS",
     metricsKey: "agentLog",
   },
   {
     table: "events",
+    policy: "age",
     timeColumn: "createdAt",
     envKey: "EVENTS_RETENTION_DAYS",
     metricsKey: "events",
   },
-] as const satisfies ReadonlyArray<{
-  table: string;
-  timeColumn: string;
-  envKey: string;
-  metricsKey: string;
-  initialBatchSize?: number;
-}>;
+  {
+    // Every profile self-edit stores a full copy of the field, so a large,
+    // frequently edited field grows this table without bound. Ranking runs on
+    // the covering idx_cv_agent_field index, so neither the COUNT nor the
+    // candidate scan reads `content`. Rows are large (a version can be
+    // hundreds of KB), so batches start and stay small.
+    table: "context_versions",
+    policy: "keepLatest",
+    partitionBy: "agentId, field",
+    rankBy: "version",
+    envKey: "CONTEXT_VERSIONS_KEEP_LATEST",
+    metricsKey: "contextVersions",
+    initialBatchSize: 50,
+    maxBatchSize: 100,
+  },
+] as const satisfies ReadonlyArray<
+  {
+    table: string;
+    envKey: string;
+    metricsKey: string;
+    initialBatchSize?: number;
+    maxBatchSize?: number;
+  } & (
+    | { policy: "age"; timeColumn: string }
+    | { policy: "keepLatest"; partitionBy: string; rankBy: string }
+  )
+>;
 
 type RetentionTable = (typeof DB_RETENTION_TABLES)[number];
 type RetentionMetricsKey = RetentionTable["metricsKey"];
@@ -261,27 +291,65 @@ function yieldTick(): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, YIELD_MS));
 }
 
-function retentionDays(table: RetentionTable): number | null {
+/** Days for an `age` table, kept-version count for a `keepLatest` table; null when disabled. */
+function retentionValue(table: RetentionTable): number | null {
   return readPositiveIntEnv(table.envKey);
 }
 
+function initialBatchSize(table: RetentionTable): number {
+  return "initialBatchSize" in table ? table.initialBatchSize : DEFAULT_BATCH_SIZE;
+}
+
+function maxBatchSize(table: RetentionTable): number {
+  return "maxBatchSize" in table ? table.maxBatchSize : MAX_BATCH_SIZE;
+}
+
+/** The backlog COUNT and the batched DELETE for one table under its policy. */
+type SweepStatements = {
+  backlogSql: string;
+  /** Takes `params` followed by the batch LIMIT. */
+  deleteSql: string;
+  params: Array<string | number>;
+};
+
+export function sweepStatements(table: RetentionTable, value: number, now: Date): SweepStatements {
+  if (table.policy === "keepLatest") {
+    // ROW_NUMBER over the (partition, rank DESC) index: rank 1 is the newest
+    // row of its group. The DELETE removes the deepest history first, so an
+    // interrupted sweep leaves each group's surviving versions contiguous.
+    const ranked = `SELECT rowid AS rid, ROW_NUMBER() OVER (PARTITION BY ${table.partitionBy} ORDER BY ${table.rankBy} DESC) AS rn FROM ${table.table}`;
+    return {
+      backlogSql: `SELECT COUNT(*) AS n FROM (${ranked}) WHERE rn > ?`,
+      deleteSql: `DELETE FROM ${table.table} WHERE rowid IN (
+         SELECT rid FROM (${ranked}) WHERE rn > ? ORDER BY rn DESC LIMIT ?
+       )`,
+      params: [value],
+    };
+  }
+  const cutoff = new Date(now.getTime() - value * DAY_MS).toISOString();
+  return {
+    backlogSql: `SELECT COUNT(*) AS n FROM ${table.table} WHERE ${table.timeColumn} < ?`,
+    deleteSql: `DELETE FROM ${table.table} WHERE rowid IN (
+         SELECT rowid FROM ${table.table} WHERE ${table.timeColumn} < ? ORDER BY ${table.timeColumn} LIMIT ?
+       )`,
+    params: [cutoff],
+  };
+}
+
 function dryRunEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
   const raw = env.DB_RETENTION_DRY_RUN;
   if (raw === undefined || raw.trim() === "") return false;
   return isEnvFlagEnabled("DB_RETENTION_DRY_RUN", true, env);
 }
 
-async function indexedBacklogCount(table: RetentionTable, cutoff: string): Promise<number> {
-  const row = await getDbClient().get<{ n: number }>(
-    `SELECT COUNT(*) AS n FROM ${table.table} WHERE ${table.timeColumn} < ?`,
-    [cutoff],
-  );
+async function indexedBacklogCount(statements: SweepStatements): Promise<number> {
+  const row = await getDbClient().get<{ n: number }>(statements.backlogSql, statements.params);
   return row?.n ?? 0;
 }
 
 async function sweepTable(
   table: RetentionTable,
-  cutoff: string,
+  statements: SweepStatements,
   dryRun: boolean,
   deadline: number,
   signal: AbortSignal,
@@ -290,33 +358,29 @@ async function sweepTable(
   const client = getDbClient();
 
   if (dryRun) {
-    const backlogRemaining = await indexedBacklogCount(table, cutoff);
+    const backlogRemaining = await indexedBacklogCount(statements);
     return {
       rowsDeleted: 0,
       batches: 0,
       backlogRemaining,
       drained: backlogRemaining === 0,
       slowestStatementMs: 0,
-      batchSize: batchSizeByTable[table.metricsKey] ?? DEFAULT_BATCH_SIZE,
+      batchSize: batchSizeByTable[table.metricsKey] ?? initialBatchSize(table),
     };
   }
 
   let rowsDeleted = 0;
   let batches = 0;
   let slowestStatementMs = 0;
-  let size = batchSizeByTable[table.metricsKey] ?? DEFAULT_BATCH_SIZE;
+  let size = batchSizeByTable[table.metricsKey] ?? initialBatchSize(table);
+  const ceiling = maxBatchSize(table);
 
   try {
     while (!signal.aborted && Date.now() < deadline) {
       const limitUsed = size;
       // Never wrap multiple batches in a transaction: one autocommit DELETE per
       // batch, so the write lock and any event-loop stall end with each statement.
-      const result = await client.runTimed(
-        `DELETE FROM ${table.table} WHERE rowid IN (
-         SELECT rowid FROM ${table.table} WHERE ${table.timeColumn} < ? ORDER BY ${table.timeColumn} LIMIT ?
-       )`,
-        [cutoff, limitUsed],
-      );
+      const result = await client.runTimed(statements.deleteSql, [...statements.params, limitUsed]);
       // Execution time only. Wall time around the call also covers waiting for
       // the client's FIFO lock and its BUSY backoff sleeps, neither of which
       // this statement spent in the driver: charging those to the stall metric
@@ -331,7 +395,7 @@ async function sweepTable(
       if (elapsed > maxStatementMs) {
         size = Math.max(MIN_BATCH_SIZE, Math.floor(size / 2));
       } else if (elapsed < maxStatementMs / 5) {
-        size = Math.min(MAX_BATCH_SIZE, size * 2);
+        size = Math.min(ceiling, size * 2);
       }
 
       // A DELETE that changed fewer rows than the LIMIT it used means the
@@ -351,7 +415,7 @@ async function sweepTable(
     // backlogRemaining > 0 drops the table from `undrained`, leaves catch-up
     // unarmed, and publishes that contradiction on /api/metrics until the next
     // hourly tick.
-    const backlogRemaining = await indexedBacklogCount(table, cutoff);
+    const backlogRemaining = await indexedBacklogCount(statements);
     return {
       rowsDeleted,
       batches,
@@ -409,7 +473,7 @@ export function runDbRetentionTick(options: DbRetentionTickOptions = {}): Promis
       const sweepAllTables = async (rawTickSpan: SwarmSpan): Promise<void> => {
         const tickSpan = bestEffortSpan(rawTickSpan);
         const tickDeadline = tickStartedAt + budget;
-        const enabled = DB_RETENTION_TABLES.filter((table) => retentionDays(table) !== null);
+        const enabled = DB_RETENTION_TABLES.filter((table) => retentionValue(table) !== null);
         if (enabled.length === 0) {
           lastSweepOrder = [];
           tickSpan.setAttributes({
@@ -431,18 +495,17 @@ export function runDbRetentionTick(options: DbRetentionTickOptions = {}): Promis
         const undrained = new Set<RetentionMetricsKey>();
 
         const sweepOne = async (table: RetentionTable, tableDeadline: number): Promise<void> => {
-          const days = retentionDays(table);
-          if (days === null) return;
+          const value = retentionValue(table);
+          if (value === null) return;
           const startedAt = Date.now();
           const previous = retentionStats[table.metricsKey];
           const tableSpan = bestEffortStartSpan("db.retention.table", {
             "agentswarm.retention.table": table.table,
           });
           try {
-            const cutoff = new Date(cutoffBase.getTime() - days * DAY_MS).toISOString();
             const result = await sweepTable(
               table,
-              cutoff,
+              sweepStatements(table, value, cutoffBase),
               dryRun,
               tableDeadline,
               abortController.signal,
@@ -529,7 +592,7 @@ export function runDbRetentionTick(options: DbRetentionTickOptions = {}): Promis
               partial?.progress.batchSize ??
               previous?.batchSize ??
               batchSizeByTable[table.metricsKey] ??
-              DEFAULT_BATCH_SIZE;
+              initialBatchSize(table);
             // Committed rows advance the running total and justify the vacuum,
             // exactly as they would have on the success path.
             const cumulative = (cumulativeRowsDeleted[table.metricsKey] ?? 0) + rowsDeleted;
@@ -670,7 +733,7 @@ export function _getLastSweepOrderForTests(): RetentionMetricsKey[] {
 export async function startDbRetention(intervalMs = RETENTION_INTERVAL_MS): Promise<void> {
   if (retentionTimer) return;
   const configured = DB_RETENTION_TABLES.map(
-    (table) => `${table.table}=${retentionDays(table) ?? "disabled"}`,
+    (table) => `${table.table}=${retentionValue(table) ?? "disabled"}`,
   ).join(", ");
   console.log(`[db-retention] starting (${configured}, dryRun=${dryRunEnabled()})`);
   retentionTimer = scheduleContextFree(() =>