agent-relay-server 0.120.6 → 0.121.1

package/src/services/plan-graph.ts

@@ -1,10 +1,11 @@
 import { isRecord } from "agent-relay-sdk";
-import { addTaskDependency, createPlanRow, deletePlan, getAgent, getEntry, getPlan, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlan, setPlanArchived, ValidationError } from "../db";
+import { addTaskDependency, createPlanRow, deletePlan, getAgent, getEntry, getPlan, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlan, sendMessage, setPlanArchived, ValidationError } from "../db";
 import { associateIssue, planNodeIssueEntityId, removeAssociation } from "../db/issue-associations";
 import { resolveIssueRefFromString } from "../db/issue-refs";
 import { emitRelayEvent } from "../events";
 import { cleanString, cleanStringArray, optionalEnum } from "../validation";
 import { defaultIssueRepo } from "../config";
+import { issueRepoForAgent } from "../agent-issue-repo";
 import { buildTaskGraphView, parseTaskId, planStatusToTaskStatus, projectPlanOverTasks } from "./task-plan-view";
 import { createTaskEntity, setTaskEntityStatus } from "./task-entity";
 import type { AuthContext } from "./auth-context";
@@ -75,14 +76,25 @@ function cleanOwnerRef(value: unknown): PlanOwnerRef | undefined {
   return Object.keys(out).length ? out : undefined;
 }
 
-function cleanRefs(value: unknown): PlanNode["refs"] | undefined {
+// #220: a bare `#NNN` issueId ref needs a default repo to resolve against — issue-refs.ts
+// throws without one, contrary to its own error text advertising the bare form as accepted.
+// Resolve it the same way #533 resolves chat `#NNN` linkify: the CALLING agent's own project
+// (cwd → project → issueRepo), falling back to the single global env default. This scopes the
+// default to the actor's actual repo rather than guessing from teamId — agents have no
+// team→project FK; cwd is the only durable link (see agent-issue-repo.ts).
+function resolveDefaultIssueRepo(actor: string): string | undefined {
+  const agent = getAgent(actor);
+  return (agent ? issueRepoForAgent(agent) : undefined) ?? defaultIssueRepo();
+}
+
+function cleanRefs(value: unknown, actor: string): PlanNode["refs"] | undefined {
   if (value === undefined || value === null) return undefined;
   const ref = cleanRecordRef(value, "refs");
   if (!ref) return undefined;
   const out: PlanNode["refs"] = {};
   const issueId = cleanString(ref.issueId, "refs.issueId", { max: 1000 });
   if (issueId) {
-    out.issueId = resolveIssueRefFromString({ ref: issueId, defaultRepo: defaultIssueRepo() }).id;
+    out.issueId = resolveIssueRefFromString({ ref: issueId, defaultRepo: resolveDefaultIssueRepo(actor) }).id;
   }
   // #836: refs.taskId is the live binding seam to a durable Task. Validate it resolves to a
   // deliverable Task; store the canonical numeric id as a string. Once bound, the node's
@@ -147,12 +159,12 @@ function applyBoundStatus(node: PlanNode): PlanNode {
   return { ...node, status: boundStatusForAgent(getAgent(agentId)) ?? "pending" };
 }
 
-function cleanNode(input: PlanNodeInput, planTeamId?: string): PlanNode {
+function cleanNode(input: PlanNodeInput, actor: string, planTeamId?: string): PlanNode {
   if (!isRecord(input)) throw new ValidationError("node must be an object");
   const scopeBlurb = cleanString(input.scopeBlurb, "node.scopeBlurb", { max: 2000 });
   const ownerRef = cleanOwnerRef(input.ownerRef);
   const lane = cleanString(input.lane, "node.lane", { max: 120 });
-  const refs = cleanRefs(input.refs);
+  const refs = cleanRefs(input.refs, actor);
   const blackboardRefs = cleanBlackboardRefs(input.blackboardRefs, planTeamId);
   const statusSource = cleanStatusSource(input.statusSource);
   return applyBoundStatus({
@@ -168,10 +180,10 @@ function cleanNode(input: PlanNodeInput, planTeamId?: string): PlanNode {
   });
 }
 
-function cleanNodes(value: unknown, planTeamId?: string): PlanNode[] {
+function cleanNodes(value: unknown, actor: string, planTeamId?: string): PlanNode[] {
   if (value === undefined || value === null) return [];
   if (!Array.isArray(value)) throw new ValidationError("nodes must be an array");
-  const nodes = value.map((item) => cleanNode(item as PlanNodeInput, planTeamId));
+  const nodes = value.map((item) => cleanNode(item as PlanNodeInput, actor, planTeamId));
   assertUnique(nodes.map((node) => node.id), "node id");
   return nodes;
 }
@@ -252,14 +264,32 @@ function emitPlan(type: "plan.created" | "plan.changed" | "plan.deleted", plan:
   emitRelayEvent({ type, source: actor, subject: plan.id, data: { plan, actor } });
 }
 
+// #1035: a plan anchors to a messages.thread_id, but a fresh coordinator has no thread yet —
+// forcing it to send a throwaway message just to mint one. When no threadId is supplied, mint the
+// thread server-side by self-threading a lightweight system message (the same sendMessage path the
+// caller would have used). Sent AS the actor when that agent is registered, else the reserved
+// `system` sink, so the mint always passes the sender-registration gate.
+function mintPlanThread(actor: string, channel: string | undefined): number {
+  const sender = getAgent(actor) ? actor : "system";
+  const root = sendMessage({
+    from: sender,
+    to: "system",
+    body: "Plan thread root",
+    ...(channel ? { channel } : {}),
+  });
+  return root.threadId ?? root.id;
+}
+
 export function createPlan(input: PlanCreateInput, ctx: AuthContext): Plan {
-  const threadId = cleanThreadId(input.threadId);
-  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const channel = cleanString(input.channel, "channel", { max: 120 });
   const actor = actorId(ctx);
+  const threadId = input.threadId === undefined || input.threadId === null
+    ? mintPlanThread(actor, channel)
+    : cleanThreadId(input.threadId);
+  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const explicitTeamId = cleanString(input.teamId, "teamId", { max: 120 });
   const teamId = explicitTeamId ?? (input.teamId === undefined || input.teamId === null ? getAgent(actor)?.teamId : undefined);
-  const nodes = cleanNodes(input.nodes, teamId);
+  const nodes = cleanNodes(input.nodes, actor, teamId);
   const edges = cleanEdges(input.edges);
   validateEdges(nodes, edges);
   const plan = createPlanRow({
@@ -279,7 +309,7 @@ export function createPlan(input: PlanCreateInput, ctx: AuthContext): Plan {
 
 export function addPlanNode(planId: string, nodeInput: PlanNodeInput, ctx: AuthContext): Plan {
   const plan = existingPlan(planId);
-  const node = cleanNode(nodeInput, plan.teamId);
+  const node = cleanNode(nodeInput, actorId(ctx), plan.teamId);
   if (plan.nodes.some((item) => item.id === node.id)) throw new ValidationError(`node ${node.id} already exists`);
   const updated = replacePlan({ ...plan, nodes: [...plan.nodes, node] }, actorId(ctx));
   syncPlanNodeIssueAssociation(updated.id, node);
@@ -299,7 +329,7 @@ export function updatePlanNode(planId: string, nodeId: string, patch: PlanNodePa
     ...(patch.ownerRef !== undefined ? optionalProp("ownerRef", cleanOwnerRef(patch.ownerRef)) : {}),
     ...(patch.lane !== undefined ? optionalProp("lane", cleanString(patch.lane, "lane", { max: 120 })) : {}),
     ...(patch.status !== undefined ? { status: optionalEnum(patch.status, "status", PLAN_STATUSES) as PlanStatus } : {}),
-    ...(patch.refs !== undefined ? optionalProp("refs", cleanRefs(patch.refs)) : {}),
+    ...(patch.refs !== undefined ? optionalProp("refs", cleanRefs(patch.refs, actorId(ctx))) : {}),
     ...(patch.blackboardRefs !== undefined ? optionalProp("blackboardRefs", cleanBlackboardRefs(patch.blackboardRefs, plan.teamId)) : {}),
     statusSource,
   };

package/src/services/register-agent.ts

@@ -10,7 +10,7 @@
 // status broadcast, the single timeline note, the spawned-child parent-wake, and
 // the first-registration audit row.
 import { errMessage, isReservedAgentId } from "agent-relay-sdk";
-import { ValidationError, createActivityEvent, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, seedSpawnPromptMirror, seedSpawnReplyObligation, upsertAgent } from "../db";
+import { ValidationError, createActivityEvent, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, mergeAgentMeta, readSpawnReportVerbosity, seedSpawnPromptMirror, seedSpawnReplyObligation, upsertAgent } from "../db";
 import { emitAgentStatus, emitNewMessage } from "../sse";
 import { noteAgentTimelineEvent } from "../compaction-watch";
 import { agentProviderTimelineEvent } from "../provider-timeline-event";
@@ -128,6 +128,10 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext): Agen
     // spawner so it can't idle with its verdict undelivered (vent #121). First-registration only.
     const spawnRequestId = metaStr(agent.meta, "spawnRequestId");
     const provider = metaStr(agent.meta, "provider");
+    // #1037 — stamp the spawner-chosen report-up verbosity onto the child's meta from the persisted
+    // spawn command, so the lineage report-up delivery gate can read it (defaults to quiet if absent).
+    const reportVerbosity = readSpawnReportVerbosity(spawnRequestId);
+    if (reportVerbosity) mergeAgentMeta(agent.id, { reportVerbosity });
     const promptMirror = seedSpawnPromptMirror(agent.id, spawnRequestId);
     if (promptMirror?.created || promptMirror?.updated) emitNewMessage(promptMirror.message);
     seedSpawnReplyObligation(agent.id, agent.spawnedBy, spawnRequestId);

package/src/services/send-message.ts

@@ -24,15 +24,19 @@
 import { canonicalHumanAgentId, isHumanAgentId, isMechanicalMessageKind, isRecord, isReservedAgentId } from "agent-relay-sdk";
 import {
   ValidationError,
+  flushDeferredLineageReport,
   getAgent,
   getMessage,
   listAgents,
+  listRecentFinalResponseCaptures,
   promoteLineageCapturedResponse,
+  sendMessagesBatchWithResult,
   sendMessageWithResult,
   channelObligationAnsweredBy,
+  type SendMessageResult as DbSendMessageResult,
 } from "../db";
 import { planSend, type DeliveryReceipt } from "../agent-ref";
-import { emitMessageQueued, emitNewMessage } from "../sse";
+import { emitMessageQueued, emitNewMessages } from "../sse";
 import { getLifecycleManager } from "../lifecycle-manager";
 import { isComponentAuthorizedFor, isIntegrationAllowed } from "../security";
 import { AmbiguousTargetError, ServiceAuthError } from "./errors";
@@ -175,6 +179,42 @@ export function sendMessageService(
   ctx: AuthContext,
   opts: SendMessageOptions = {},
 ): SendMessageResult {
+  const { receipt, suppressedParent } = prepareSendMessage(input, ctx, opts);
+  if (suppressedParent) return { message: suppressedParent, created: false, receipt };
+  const result = sendMessageWithResult(input);
+  emitSendResults([result]);
+  return { message: result.message, created: result.created, receipt };
+}
+
+export function sendMessagesBatchService(
+  inputs: SendMessageInput[],
+  ctx: AuthContext,
+  opts: SendMessageOptions = {},
+): SendMessageResult[] {
+  const prepared = inputs.map((input) => ({ input, ...prepareSendMessage(input, ctx, opts) }));
+  const results: SendMessageResult[] = [];
+  const storeInputs: SendMessageInput[] = [];
+  const storeIndexes: number[] = [];
+  for (const item of prepared) {
+    if (item.suppressedParent) {
+      results.push({ message: item.suppressedParent, created: false, receipt: item.receipt });
+      continue;
+    }
+    results.push(null as unknown as SendMessageResult);
+    storeIndexes.push(results.length - 1);
+    storeInputs.push(item.input);
+  }
+  const stored = sendMessagesBatchWithResult(storeInputs);
+  for (let i = 0; i < stored.length; i++) {
+    const result = stored[i]!;
+    const outputIndex = storeIndexes[i]!;
+    results[outputIndex] = { message: result.message, created: result.created, receipt: prepared[outputIndex]!.receipt };
+  }
+  emitSendResults(stored);
+  return results;
+}
+
+function prepareSendMessage(input: SendMessageInput, ctx: AuthContext, opts: SendMessageOptions): { receipt: DeliveryReceipt; suppressedParent: Message | null } {
   const receipt = validateSendMessageAuthorization(input, ctx, opts);
   // Reply-obligation linking: some real answers are ordinary sends without replyTo/thread linkage.
   // Channel bridge replies have a single unambiguous open obligation case;
@@ -184,29 +224,67 @@ export function sendMessageService(
     const answered = channelObligationAnsweredBy(input.from, input.to);
     if (answered !== null) input.replyTo = answered;
   }
-  const suppressedParent = suppressResultsOnlyAck(input);
-  if (suppressedParent) return { message: suppressedParent, created: false, receipt };
-  const result = sendMessageWithResult(input);
-  if (result.created) {
-    if (result.message.deliveryStatus === "queued") {
-      emitMessageQueued(result.message);
-      // Wake an on-demand managed policy that has no live agent attached yet.
-      if (result.message.to?.startsWith("policy:")) {
-        getLifecycleManager().onMessageForPolicy(result.message.to.slice("policy:".length));
+  return { receipt, suppressedParent: suppressResultsOnlyAck(input) };
+}
+
+/**
+ * #1037 — the child transitioned out of busy (idle/awaiting-input). Deliver its deferred turn-final
+ * report-up (a quiet child's last turn, held back so mid-work narration never reached the spawner)
+ * and fan it out over SSE. No-op when nothing was deferred. Driven off the bus turn-end edge.
+ */
+export function flushIdleLineageReport(childId: string): void {
+  const promoted = flushDeferredLineageReport(childId);
+  if (promoted?.created) emitNewMessages([promoted.message]);
+}
+
+/** How far back the startup sweep re-scans for held-but-lost turn-final captures (#1040). A report
+ * is only ever deferred while its child is mid-turn, so any capture lost across a restart is recent;
+ * a day is a generous ceiling that still bounds the scan. */
+const LINEAGE_STARTUP_SWEEP_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * #1040 — startup re-promotion sweep. `deferredLineageReports` is an in-memory Map, so a relay
+ * restart drops every held turn-final report-up. The captures are persisted, though, so re-run
+ * promotion for recent final response captures: an idle child whose report was lost gets it
+ * delivered now, an already-delivered one is a no-op (idempotency key), and a still-busy child
+ * re-defers (re-arming the in-memory hold so a later idle edge flushes it). Idempotent and safe to
+ * run periodically.
+ */
+export function sweepDeferredLineageReportsOnStartup(now: number = Date.now()): { promoted: number; scanned: number } {
+  const captures = listRecentFinalResponseCaptures(now - LINEAGE_STARTUP_SWEEP_WINDOW_MS);
+  const emitted: Message[] = [];
+  for (const capture of captures) {
+    const promoted = promoteLineageCapturedResponse(capture);
+    if (promoted?.created) emitted.push(promoted.message);
+  }
+  if (emitted.length > 0) emitNewMessages(emitted);
+  return { promoted: emitted.length, scanned: captures.length };
+}
+
+function emitSendResults(results: DbSendMessageResult[]): void {
+  const liveMessages: Message[] = [];
+  for (const result of results) {
+    if (result.created) {
+      if (result.message.deliveryStatus === "queued") {
+        emitMessageQueued(result.message);
+        // Wake an on-demand managed policy that has no live agent attached yet.
+        if (result.message.to?.startsWith("policy:")) {
+          getLifecycleManager().onMessageForPolicy(result.message.to.slice("policy:".length));
+        }
+      } else {
+        liveMessages.push(result.message);
       }
-    } else {
-      emitNewMessage(result.message);
+      const promoted = promoteLineageCapturedResponse(result.message);
+      if (promoted?.created) liveMessages.push(promoted.message);
+    } else if (result.updated) {
+      // Session-step upsert (#parity): the row changed in place (same DB id). Re-emit so the
+      // dashboard's id-keyed merge replaces the existing step live — no duplicate row.
+      liveMessages.push(result.message);
+      const promoted = promoteLineageCapturedResponse(result.message);
+      if (promoted?.created) liveMessages.push(promoted.message);
     }
-    const promoted = promoteLineageCapturedResponse(result.message);
-    if (promoted?.created) emitNewMessage(promoted.message);
-  } else if (result.updated) {
-    // Session-step upsert (#parity): the row changed in place (same DB id). Re-emit so the
-    // dashboard's id-keyed merge replaces the existing step live — no duplicate row.
-    emitNewMessage(result.message);
-    const promoted = promoteLineageCapturedResponse(result.message);
-    if (promoted?.created) emitNewMessage(promoted.message);
   }
-  return { message: result.message, created: result.created, receipt };
+  emitNewMessages(liveMessages);
 }
 
 function suppressResultsOnlyAck(input: SendMessageInput): Message | null {

package/src/services/spawn-agent.ts

@@ -23,7 +23,7 @@
 // shared `buildSpawnCommand`/`buildManagedSpawnParams` payload home directly. Folding
 // them through `spawnAgent(systemCtx)` is a clean belt-and-suspenders follow-up (#342),
 // deliberately out of scope here — this slice converges the two external TRANSPORTS.
-import type { SpawnProvider } from "agent-relay-sdk";
+import type { ReportVerbosity, SpawnProvider } from "agent-relay-sdk";
 import { DEFAULT_USER_ID, errMessage, isRecord, stringValue } from "agent-relay-sdk";
 import { statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
@@ -211,6 +211,12 @@ export interface SpawnAgentInput {
    * Explicit true is preserved in the command payload for compatibility only.
    */
   expectReply?: boolean;
+  /**
+   * #1037 — per-spawn report-up verbosity (`quiet` default | `normal` | `verbose`). Persisted in
+   * the spawn command params and stamped onto the child's meta at registration, where the lineage
+   * report-up delivery gate reads it. Absent = `quiet`.
+   */
+  reportVerbosity?: ReportVerbosity;
   tags?: string[];
   capabilities?: string[];
   providerArgs?: string[];
@@ -249,6 +255,8 @@ export interface SpawnAgentResult {
   agentId: string | null;
   registered: boolean;
   command: Command;
+  /** #1033 — the durable Task this spawn is bound to (explicit taskId or auto-scaffolded), when any. */
+  taskId?: number;
   task?: { id: number; autoScaffolded: boolean; nudge: string };
 }
 
@@ -332,7 +340,16 @@ export async function spawnAgent(input: SpawnAgentInput, ctx: AuthContext): Prom
 
   // #255/#328 — bias the host to the caller's own machine when neither an explicit
   // orchestratorId nor a cwd pins it, so an agent spawning a helper lands on its own host.
-  const orchestrator = selectSpawnOrchestrator(input.provider, input.orchestratorId, requestedCwd, caller?.machine ?? lineageAgent?.machine);
+  // #1034 — pass the token's orchestrator allow-set so host selection can NEVER land on a host
+  // the caller isn't authorized for (which would then trip assertResourceAllowed with a
+  // misleading `-32001 component token cannot access this resource` — the concurrent-spawn flap).
+  const orchestrator = selectSpawnOrchestrator(
+    input.provider,
+    input.orchestratorId,
+    requestedCwd,
+    caller?.machine ?? lineageAgent?.machine,
+    ctx.constraints?.orchestrators,
+  );
 
   // #308 §3 — an explicit cwd must resolve within the TARGET host's base dir (a path valid on
   // your host may not exist on a different orchestrator).
@@ -638,6 +655,7 @@ export async function spawnAgent(input: SpawnAgentInput, ctx: AuthContext): Prom
       resumeWorkspace: input.resumeWorkspace,
       acquisition,
       ...(expectReply ? { expectReply } : {}),
+      ...(input.reportVerbosity ? { reportVerbosity: input.reportVerbosity } : {}),
       policyName: input.policyName,
       spawnRequestId,
       env,
@@ -727,6 +745,7 @@ export async function spawnAgent(input: SpawnAgentInput, ctx: AuthContext): Prom
     agentId,
     registered: agentId !== null,
     command,
+    ...(input.taskId !== undefined ? { taskId: input.taskId } : {}),
     ...(autoScaffoldedTask ? { task: autoScaffoldedTask } : {}),
   };
 }

package/src/services/spawn-registration-watchdog.ts

@@ -20,12 +20,21 @@ interface SpawnCommandGroup {
   rows: SpawnCommandRow[];
 }
 
+interface SpawnCandidateRow {
+  spawn_request_id: string;
+  latest_updated_at: number;
+}
+
 interface SpawnRegistrationWatchdogResult extends Record<string, unknown> {
   failedSpawnCommandIds: string[];
   notifiedSpawnCommandIds: string[];
   silencedSpawnCommandIds: string[];
+  confirmedSpawnCommandIds: string[];
+  checkedSpawnGroups: number;
 }
 
+const MAX_SPAWN_GROUPS_PER_RUN = 25;
+
 export function reapUnregisteredSpawnCommands(
   now = Date.now(),
   deadlineMs = SPAWN_REGISTRATION_DEADLINE_MS,
@@ -33,20 +42,40 @@ export function reapUnregisteredSpawnCommands(
 ): SpawnRegistrationWatchdogResult {
   const cutoff = now - deadlineMs;
   const notifyCutoff = now - notifyMaxAgeMs;
-  const rows = getDb().query(`
-    SELECT id, params, correlation_id, updated_at
-    FROM commands
-    WHERE type = 'agent.spawn'
-      AND status = 'succeeded'
-    ORDER BY updated_at ASC
-  `).all() as SpawnCommandRow[];
+  const candidateRows = getDb().query(`
+    WITH spawn_groups AS (
+      SELECT
+        coalesce(nullif(json_extract(params, '$.spawnRequestId'), ''), correlation_id) AS spawn_request_id,
+        max(updated_at) AS latest_updated_at
+      FROM commands
+      WHERE type = 'agent.spawn'
+        AND status = 'succeeded'
+        AND json_valid(params)
+        AND coalesce(json_extract(params, '$.registrationConfirmed'), 0) != 1
+        AND coalesce(nullif(json_extract(params, '$.spawnedBy'), ''), '') != ''
+      GROUP BY coalesce(nullif(json_extract(params, '$.spawnRequestId'), ''), correlation_id)
+    )
+    SELECT spawn_request_id, latest_updated_at
+    FROM spawn_groups
+    WHERE spawn_request_id IS NOT NULL
+      AND latest_updated_at <= ?
+    ORDER BY latest_updated_at DESC
+    LIMIT ?
+  `).all(cutoff, MAX_SPAWN_GROUPS_PER_RUN) as SpawnCandidateRow[];
+  const rows = loadSpawnCommandRows(candidateRows.map((row) => row.spawn_request_id));
 
   const failedSpawnCommandIds: string[] = [];
   const notifiedSpawnCommandIds: string[] = [];
   const silencedSpawnCommandIds: string[] = [];
+  const confirmedSpawnCommandIds: string[] = [];
+  let checkedSpawnGroups = 0;
   for (const group of groupSpawnCommands(rows)) {
     if (group.latestUpdatedAt > cutoff) continue;
-    if (hasEverRegisteredAgent(group.spawnRequestId)) continue;
+    checkedSpawnGroups++;
+    if (hasEverRegisteredAgent(group.spawnRequestId)) {
+      confirmedSpawnCommandIds.push(...markSpawnGroupRegistrationConfirmed(group, now));
+      continue;
+    }
 
     const reason = `spawned agent did not register within ${deadlineMs}ms`;
     const failedCommands = group.rows
@@ -70,7 +99,25 @@ export function reapUnregisteredSpawnCommands(
     }
   }
 
-  return { failedSpawnCommandIds, notifiedSpawnCommandIds, silencedSpawnCommandIds };
+  return { failedSpawnCommandIds, notifiedSpawnCommandIds, silencedSpawnCommandIds, confirmedSpawnCommandIds, checkedSpawnGroups };
+}
+
+function loadSpawnCommandRows(spawnRequestIds: string[]): SpawnCommandRow[] {
+  if (spawnRequestIds.length === 0) return [];
+  const placeholders = spawnRequestIds.map(() => "?").join(",");
+  return getDb().query(`
+    SELECT id, params, correlation_id, updated_at
+    FROM commands
+    WHERE type = 'agent.spawn'
+      AND status = 'succeeded'
+      AND json_valid(params)
+      AND coalesce(json_extract(params, '$.registrationConfirmed'), 0) != 1
+      AND (
+        correlation_id IN (${placeholders})
+        OR json_extract(params, '$.spawnRequestId') IN (${placeholders})
+      )
+    ORDER BY updated_at ASC
+  `).all(...spawnRequestIds, ...spawnRequestIds) as SpawnCommandRow[];
 }
 
 function groupSpawnCommands(rows: SpawnCommandRow[]): SpawnCommandGroup[] {
@@ -121,6 +168,24 @@ function hasEverRegisteredAgent(spawnRequestId: string): boolean {
   return Boolean(registration);
 }
 
+function markSpawnGroupRegistrationConfirmed(group: SpawnCommandGroup, now: number): string[] {
+  const confirmed: string[] = [];
+  const stmt = getDb().query(`
+    UPDATE commands
+    SET params = ?
+    WHERE id = ?
+      AND status = 'succeeded'
+  `);
+  for (const row of group.rows) {
+    const params = parseParams(row.params);
+    if (params.registrationConfirmed === true) continue;
+    params.registrationConfirmed = true;
+    params.registrationConfirmedAt = now;
+    if (stmt.run(JSON.stringify(params), row.id).changes > 0) confirmed.push(row.id);
+  }
+  return confirmed;
+}
+
 function parseParams(raw: string): Record<string, unknown> {
   try {
     const parsed = JSON.parse(raw);

package/src/services/task-semantic-events.ts

@@ -1,6 +1,7 @@
 import { getAgent } from "../db";
 import { addSubscription } from "../db/notification-subscriptions";
 import { emitRelayEvent } from "../events";
+import { hasRecentLifecycleSignal, taskSignalKey } from "../lifecycle-signal-registry";
 import { notifySystemMessage } from "../notify";
 import type { NotificationScope, NotificationType } from "../notification-types";
 import { routeNotification } from "../notification-router";
@@ -216,7 +217,18 @@ function dedupeRecipients(recipients: Array<{ agentId: string; matchedRule: stri
   return out;
 }
 
+// #1032b — a status pulse is redundant when a first-class lifecycle event (agent.ready, the lineage
+// report-up, branch.landed/merge) already conveyed this task's state to this recipient. Suppress it
+// rather than waking the spawner a second time for the same fact.
+// #1038 — keyed by the pulse's own transition: a progress signal (report-up / ready) supersedes only
+// a redundant `working` pulse, never a later DISTINCT-state transition (committed / landed / done)
+// for the same task within the TTL.
+function pulseSupersededByLifecycle(agentId: string, taskId: number, transition: TaskSemanticTransition): boolean {
+  return hasRecentLifecycleSignal(agentId, taskSignalKey(taskId, transition));
+}
+
 function enqueueStatusPulse(agentId: string, item: StatusPulseDigestItem): void {
+  if (pulseSupersededByLifecycle(agentId, item.taskId, item.transition)) return; // #1032b/#1038
   const batch = statusPulseBatches.get(agentId) ?? { items: [] };
   batch.items.push(item);
   if (!batch.timer) {
@@ -233,7 +245,11 @@ export function flushTaskStatusPulses(agentId?: string): void {
     if (batch.timer) clearTimeout(batch.timer);
     statusPulseBatches.delete(target);
     if (batch.items.length === 0) continue;
-    const items = compactStatusPulseItems(batch.items);
+    // #1032b — a lifecycle event that fired AFTER these items were queued (but within the batch
+    // window) also supersedes them; drop those before flushing so the digest carries only news.
+    const fresh = batch.items.filter((item) => !pulseSupersededByLifecycle(target, item.taskId, item.transition));
+    if (fresh.length === 0) continue;
+    const items = compactStatusPulseItems(fresh);
     notifySystemMessage(target, {
       subject: `Task status pulse (${items.length})`,
       body: taskStatusPulseBody(items),

package/src/settings/registry.ts

@@ -35,6 +35,7 @@ import {
   NOTIFICATIONS_SETTINGS_SCHEMA,
   parseNotificationSettingsKey,
 } from "../notification-settings";
+import { RETENTION_CONFIG_DEFAULTS, RETENTION_CONFIG_SCHEMA, RETENTION_KEY, RETENTION_NAMESPACE } from "../retention-config";
 
 /** Fail-closed default scope — a descriptor that omits scope requires admin to
  *  read and write (#385 owns the scope grammar; this layer only declares it). */
@@ -400,6 +401,16 @@ function seedBuiltInSettings(): void {
     display: { group: "Teams", label: "Team idle watchdog", description: "Coordinator nudge when a team has no busy members.", order: 45 },
   });
 
+  registerSetting({
+    namespace: RETENTION_NAMESPACE,
+    key: RETENTION_KEY,
+    schema: RETENTION_CONFIG_SCHEMA,
+    defaults: RETENTION_CONFIG_DEFAULTS,
+    scope: { read: "settings:read:system", write: "settings:write:system" },
+    tier: "server-runtime",
+    display: { group: "System", label: "Data retention", description: "Retention windows and batch size for high-churn Relay tables.", order: 46 },
+  });
+
   registerSetting({
     namespace: "provider",
     key: "chatCaptureMode",

package/src/spawn-command.ts

@@ -109,6 +109,8 @@ interface BuildSpawnCommandOptions {
    * registration from the persisted spawn command params.
    */
   expectReply?: boolean;
+  /** #1037 — per-spawn report-up verbosity, persisted so registration can stamp it onto child meta. */
+  reportVerbosity?: string;
   profile?: string;
   agentProfile?: unknown;
   headless?: boolean;
@@ -174,6 +176,7 @@ export function buildSpawnCommand(opts: BuildSpawnCommandOptions): Record<string
     ...def(opts.reviewer, "reviewer"),
     ...def(opts.taskId, "taskId"),
     ...def(opts.expectReply, "expectReply"),
+    ...def(opts.reportVerbosity, "reportVerbosity"),
     ...def(opts.headless, "headless"),
     ...def(opts.policyName, "policyName"),
     ...def(opts.automationId, "automationId"),

package/src/spawn-targets.ts

@@ -500,7 +500,25 @@ export function selectSpawnOrchestrator(
   orchestratorId?: string,
   cwd?: string,
   preferHost?: string,
+  /**
+   * #1034 — the caller token's `constraints.orchestrators` allow-set. When present, host
+   * SELECTION must stay INSIDE it: never silently fall back to a host the token isn't
+   * authorized for. Previously, when neither an explicit id nor a cwd nor a resolvable
+   * `preferHost` pinned the host (e.g. the caller's `machine` was transiently unset, or the
+   * caller's own host briefly flapped offline), selection grabbed `candidates[0]` — an
+   * arbitrary online host. If that host was outside the token's allow-set, the downstream
+   * `assertResourceAllowed` gate then rejected the spawn with a MISLEADING `-32001 component
+   * token cannot access this resource`, which cleared "seconds later" once the caller's host
+   * re-appeared (issue #1034). Filtering candidates to the allow-set makes selection
+   * authz-consistent: for the common single-authorized-host token it deterministically returns
+   * that host regardless of transient machine/cwd resolution, so concurrent spawns no longer
+   * spuriously reject; when the authorized host is genuinely offline, the error is an honest
+   * "authorized host offline", not a confusing authz denial. Undefined/empty = no filtering
+   * (admin `*` tokens, byte-identical to before).
+   */
+  allowedOrchestratorIds?: string[],
 ): Orchestrator {
+  const allowSet = allowedOrchestratorIds?.length ? new Set(allowedOrchestratorIds) : null;
   if (orchestratorId) {
     const orchestrator = getOrchestrator(orchestratorId);
     if (!orchestrator) throw new McpNotFoundError(`orchestrator ${orchestratorId} not found`);
@@ -515,7 +533,9 @@ export function selectSpawnOrchestrator(
     }
     return orchestrator;
   }
-  const candidates = listOrchestrators().filter((item) => item.status === "online" && item.providers.includes(provider));
+  const candidates = listOrchestrators().filter(
+    (item) => item.status === "online" && item.providers.includes(provider) && (!allowSet || allowSet.has(item.id)),
+  );
   if (cwd) {
     const match = candidates.find((item) => isPathWithinBase(cwd, item.baseDir));
     if (match) return match;
@@ -530,6 +550,11 @@ export function selectSpawnOrchestrator(
   }
   const orchestrator = candidates[0];
   if (!orchestrator) {
+    // #1034 — when the token's host allow-set is what emptied the candidate list, say so plainly
+    // (the caller's authorized host is offline) instead of the generic "no orchestrator" miss.
+    if (allowSet) {
+      throw new McpNotFoundError(`no online orchestrator authorized for this token runs provider '${provider}'. Your token is scoped to host(s): ${[...allowSet].join(", ")} — check that one is online (call relay_spawn_targets for the live matrix).`);
+    }
     throw new McpNotFoundError(`no online orchestrator runs provider '${provider}'. Available: ${spawnAlternatives()} (call relay_spawn_targets for the live matrix).`);
   }
   return orchestrator;