agent-relay-server 0.121.5 → 0.122.1

package/src/db/agents.ts

@@ -145,7 +145,7 @@ function tagsWithProvider(input: RegisterAgentInput): string[] {
 }
 
 
-export function upsertAgent(input: RegisterAgentInput): AgentCard {
+export function upsertAgent(input: RegisterAgentInput, opts?: { verifiedKeepJtis?: string[] }): AgentCard {
   const now = Date.now();
   const kind = inferAgentKind(input);
   if (kind === "channel") {
@@ -190,35 +190,48 @@ export function upsertAgent(input: RegisterAgentInput): AgentCard {
       last_seen = $now
   `);
 
-  stmt.run({
-    $id: input.id,
-    $name: input.name,
-    $kind: kind,
-    $label: input.label ?? null,
-    $labelProvided: labelProvided ? 1 : 0,
-    $tags: JSON.stringify(tags),
-    $machine: input.machine ?? null,
-    $rig: input.rig ?? null,
-    $capabilities: JSON.stringify(input.capabilities ?? []),
-    $ready: input.ready ? 1 : 0,
-    $readyProvided: readyProvided ? 1 : 0,
-    $status: input.status ?? "idle",
-    $instanceId: input.instanceId ?? null,
-    $instanceProvided: instanceProvided ? 1 : 0,
-    $initialEpoch: instanceProvided ? 1 : 0,
-    $providerCapabilities: input.providerCapabilities ? JSON.stringify(input.providerCapabilities) : null,
-    $contextState: contextState ? JSON.stringify(contextState) : null,
-    $quotaState: input.quota ? JSON.stringify(input.quota) : null,
-    $meta: JSON.stringify(input.meta ?? {}),
-    $lifecycle: input.lifecycle ?? "persistent",
-    $lifecycleProvided: lifecycleProvided ? 1 : 0,
-    $spawnedBy: input.spawnedBy ?? null,
-    $teamId: input.teamId ?? null,
-    $now: now,
-  });
+  // #1057(2) — the takeover revoke fires on the SAME predicate as the epoch bump, by observing
+  // the bump itself (prior.epoch !== next.epoch) rather than re-deriving the SQL's instance-
+  // transition condition. The old guard in registerAgent required a truthy prior instanceId, so a
+  // NULL→instanceId takeover bumped the epoch yet skipped the revoke, stranding the prior token
+  // until the 24h prune. #1057(4) — write + revoke share one transaction: a revoke failure rolls
+  // the epoch bump back, so registration fails loudly with no committed bump / un-revoked token.
+  const agent = getDb().transaction(() => {
+    const prior = getAgent(input.id);
+    stmt.run({
+      $id: input.id,
+      $name: input.name,
+      $kind: kind,
+      $label: input.label ?? null,
+      $labelProvided: labelProvided ? 1 : 0,
+      $tags: JSON.stringify(tags),
+      $machine: input.machine ?? null,
+      $rig: input.rig ?? null,
+      $capabilities: JSON.stringify(input.capabilities ?? []),
+      $ready: input.ready ? 1 : 0,
+      $readyProvided: readyProvided ? 1 : 0,
+      $status: input.status ?? "idle",
+      $instanceId: input.instanceId ?? null,
+      $instanceProvided: instanceProvided ? 1 : 0,
+      $initialEpoch: instanceProvided ? 1 : 0,
+      $providerCapabilities: input.providerCapabilities ? JSON.stringify(input.providerCapabilities) : null,
+      $contextState: contextState ? JSON.stringify(contextState) : null,
+      $quotaState: input.quota ? JSON.stringify(input.quota) : null,
+      $meta: JSON.stringify(input.meta ?? {}),
+      $lifecycle: input.lifecycle ?? "persistent",
+      $lifecycleProvided: lifecycleProvided ? 1 : 0,
+      $spawnedBy: input.spawnedBy ?? null,
+      $teamId: input.teamId ?? null,
+      $now: now,
+    });
+    const next = getAgent(input.id)!;
+    if (prior && next.epoch !== prior.epoch) {
+      revokeSupersededRuntimeTokens(prior, opts?.verifiedKeepJtis ?? [], now);
+    }
+    return next;
+  })();
   if (contextState) recordContextSnapshot(input.id, contextState, now);
 
-  const agent = getAgent(input.id)!;
   seedContinuationObjectiveFromSpawnPrompt(agent.id, stringValue(agent.meta?.spawnRequestId), DEFAULT_SELF_RESUME_CONFIG, now);
   if (agent.kind === "channel") upsertChannelForAgent(agent);
   evaluatePoolBindings();
@@ -363,15 +376,49 @@ export function clearAgentMetaKeys(id: string, keys: string[]): boolean {
   return getDb().query("UPDATE agents SET meta = ? WHERE id = ?").run(JSON.stringify(meta), id).changes > 0;
 }
 
+/**
+ * #1059 — decide whether a process-exit certificate belongs to an agent row's CURRENT
+ * instance. A late/duplicate orchestrator exit report for a SUPERSEDED session (the agent id
+ * re-registered as a fresh instance after the report was generated) carries the prior session's
+ * `spawnRequestId`; the live successor's meta carries the new one. When both are known and
+ * differ, the certificate is for a dead predecessor and must never mark the successor gone.
+ * Unknown on either side (legacy / unmanaged sessions that never carried a spawnRequestId) can't
+ * be disproven, so it is treated as matching — preserving the pre-#1059 fast-exit path.
+ *
+ * The single home for the death-certificate/instance identity check, shared by the stamp site
+ * (recordAgentExitDiagnostics, below) and the reaper's death predicate (isOwnerProcessConfirmedGone
+ * in workspace-merge.ts) so the two can't drift.
+ */
+export function exitCertificateMatchesInstance(
+  currentMeta: Record<string, unknown> | undefined,
+  certificate: { spawnRequestId?: unknown } | undefined,
+): boolean {
+  const current = currentMeta ? stringValue(currentMeta.spawnRequestId) : undefined;
+  const cert = certificate ? stringValue(certificate.spawnRequestId) : undefined;
+  if (current && cert && current !== cert) return false;
+  return true;
+}
+
 export function recordAgentExitDiagnostics(id: string, diagnostics: ManagedSessionExitDiagnostics): AgentCard | null {
   const agent = getAgent(id);
   if (!agent) return null;
+  // #1059 — drop a stale/duplicate exit report for a SUPERSEDED instance. The agent id
+  // re-registered as a fresh session (new spawnRequestId) after this report was generated;
+  // stamping its predecessor's certificate here would poison the LIVE successor's row (false
+  // offline flip + false death notification via the caller + a certificate the dead-owner reaper
+  // would later act on — the #1054 reopener). Returning null makes the caller skip both the status
+  // emit and notifyAgentOffline, exactly as for an absent row.
+  if (!exitCertificateMatchesInstance(isRecord(agent.meta) ? agent.meta : undefined, diagnostics)) return null;
   const now = Date.now();
   const merged = {
     ...(agent.meta ?? {}),
     lastError: diagnostics.lastError,
     lastExit: diagnostics,
     lastExitAt: diagnostics.detectedAt || now,
+    // #1057(1) — RELAY-clock receipt of the process-confirmed death. The orphan-token sweep
+    // (revokeOrphanedRuntimeTokens) compares this against last_seen (also relay clock); the
+    // orchestrator-clock detectedAt in lastExitAt is not comparable across hosts.
+    lastExitReceivedAt: now,
   };
   // #636 — do NOT clobber last_seen with `now`: it is the agent's genuine last heartbeat, and the
   // death diagnosis derives the real heartbeat gap from it (the orchestrator exit path diagnoses
@@ -585,6 +632,35 @@ export function deleteAgent(id: string): { ok: boolean; error?: string } {
   return deleted ? { ok: true } : { ok: false, error: "agent not found" };
 }
 
+// #1057(1) — close the orphan-token window #1051 left open. A dead runner with no replacement
+// used to keep its token valid until the 24h offline prune (~720× the pre-#1051 ~2min horizon).
+// This sweep revokes ("stale", re-mintable — #484) the runtime tokens of agents whose process the
+// orchestrator CONFIRMED dead (meta.lastExit, the #1054 signal — never a liveness inference, so
+// the #1051 decouple holds) once a full grace has passed with no heartbeat since the relay
+// received the report. The two guards make a late exit report harmless to a live replacement:
+//   - a replacement registration replaces meta wholesale (no lastExitReceivedAt) → excluded;
+//   - a replacement that got the late report stamped ONTO its row keeps heartbeating, pushing
+//     last_seen past the receipt (heartbeat also flips it off 'offline') → excluded.
+// `lagGraceMs` mirrors the stale reaper's #1048/#1055 discipline: while the relay's own event
+// loop was stalled, a live claimant's heartbeats may not have been processed yet, so the window
+// widens by the observed lag rather than misreading the backlog as post-mortem silence.
+export function revokeOrphanedRuntimeTokens(graceMs: number = STALE_TTL_MS, lagGraceMs = 0, now = Date.now()): Array<{ agentId: string; jtis: string[] }> {
+  const cutoff = now - graceMs - Math.max(0, lagGraceMs);
+  const rows = getDb()
+    .query("SELECT id, meta, last_seen FROM agents WHERE status = 'offline' AND meta LIKE '%lastExitReceivedAt%' AND id NOT IN ('user', 'system')")
+    .all() as Array<{ id: string; meta: string | null; last_seen: number }>;
+  const revoked: Array<{ agentId: string; jtis: string[] }> = [];
+  for (const row of rows) {
+    const meta = parseJson<Record<string, unknown>>(row.meta ?? "{}", {});
+    const receivedAt = typeof meta.lastExitReceivedAt === "number" ? meta.lastExitReceivedAt : undefined;
+    if (receivedAt === undefined || receivedAt > cutoff) continue;
+    if (row.last_seen > receivedAt) continue;
+    const jtis = revokeProviderRuntimeTokensByJti(runtimeTokenJtisFromMeta(meta), "stale", now);
+    if (jtis.length > 0) revoked.push({ agentId: row.id, jtis });
+  }
+  return revoked;
+}
+
 // #484: `reason` is stamped on each revocation so a stale-on-restart revocation
 // (recoverable via orchestrator re-mint for a still-live process) is distinguishable
 // from a hard kill. Default "agent-removed" (hard) — callers that revoke a possibly-
@@ -598,17 +674,22 @@ export function revokeRuntimeTokensForAgent(agentId: string, now = Date.now(), r
 // #1051 — the #484 restart-strand invariant, re-homed from heartbeat-lapse to instance
 // takeover. Staleness (a missed heartbeat) no longer revokes anything; instead, when a
 // FRESH runner process re-registers under an existing agent id — a new instanceId, which
-// bumps the agent epoch (see upsertAgent) — the PRIOR instance's runtime tokens are
-// revoked "stale" here. "stale" (not a hard kill) keeps them re-mintable via the
-// orchestrator (#484), so a live process that merely rotated instances still self-heals,
-// while an orphaned prior-instance token can no longer authenticate a request directly.
-// The incoming instance's own token (already stamped into the NEW meta) is preserved: a
-// same-instance reconnect (relay-restart / lag recovery) keeps its instanceId, does not
-// bump the epoch, and so never reaches this path — its token stays valid untouched.
-export function revokeSupersededRuntimeTokens(prior: AgentCard, current: AgentCard, now = Date.now()): string[] {
+// bumps the agent epoch — the PRIOR instance's runtime tokens are revoked "stale" here,
+// atomically with the bump (fired from inside upsertAgent). "stale" (not a hard kill)
+// keeps them re-mintable via the orchestrator (#484), so a live process that merely
+// rotated instances still self-heals, while an orphaned prior-instance token can no
+// longer authenticate a request directly. A same-instance reconnect (relay-restart / lag
+// recovery) keeps its instanceId, does not bump the epoch, and so never reaches this
+// path — its token stays valid untouched.
+// #1057(3) — `keepJtis` must be SERVER-verified (the jti of the token that authenticated the
+// registration, resolved to this very agent — see registerAgent). It is never derived from the
+// incoming client meta: a takeover caller could otherwise list the prior jti in meta.auth.jtis
+// and spare it from revocation. The incoming instance's own token needs no keep entry — only
+// PRIOR jtis are ever revoked, so a fresh token is structurally never collateral.
+export function revokeSupersededRuntimeTokens(prior: AgentCard, keepJtis: string[] = [], now = Date.now()): string[] {
   const priorJtis = runtimeTokenJtisFromMeta((prior.meta ?? {}) as Record<string, unknown>);
   if (priorJtis.length === 0) return [];
-  const keep = new Set(runtimeTokenJtisFromMeta((current.meta ?? {}) as Record<string, unknown>));
+  const keep = new Set(keepJtis);
   const superseded = priorJtis.filter((jti) => !keep.has(jti));
   return revokeProviderRuntimeTokensByJti(superseded, "stale", now);
 }

package/src/db/message-reads.ts

@@ -523,6 +523,19 @@ export function listPendingReplyObligations(agentId: string, limit = 20): ReplyO
  *
  * Returns the inbound message id this outbound answers, or null when nothing should be auto-linked.
  */
+/**
+ * #976 — the most recent message `fromId` addressed to `recipientId` (direct target OR resolved
+ * recipient). Used to anchor a suppressed standalone self→parent ack onto the conversation it
+ * belongs to, so a bare ack collapses onto the inbound it answers — mirroring the reply-path
+ * collapse (which returns the parent message being acked). Returns null when no such inbound exists.
+ */
+export function latestInboundMessage(recipientId: string, fromId: string): Message | null {
+  const sql = `${MSG_SELECT} WHERE m.from_agent = ? AND (m.to_target = ? OR m.resolved_to_agent = ?) ORDER BY m.id DESC LIMIT 1`;
+  const rows = timedQuery("latestInboundMessage", () =>
+    getDb().query(sql).all(fromId, recipientId, recipientId) as any[]);
+  return rows.length ? rowToMessage(rows[0]) : null;
+}
+
 export function channelObligationAnsweredBy(
   agentId: string,
   channelAgentId: string,
@@ -624,6 +637,43 @@ export function readSpawnReportVerbosity(spawnRequestId: string | undefined): Re
   }
 }
 
+/**
+ * #1062 — the RAW caller/parent brief a spawner supplied, read from the persisted `agent.spawn`
+ * command params by spawnRequestId. Mirrors {@link readSpawnReportVerbosity}: the dashboard
+ * (non-policy) restart path recovers this and re-threads it as `callerSystemPromptAppend` so a
+ * restarted spawned child keeps its parent's task brief while the rest of the projection
+ * (project/profile/scoped memory) is re-composed fresh. Returns undefined when absent/unparseable
+ * (pre-#1062 spawns never persisted it → the restart simply re-projects without a caller brief).
+ *
+ * #1067 — recovers across ANY number of dashboard restarts, not just one. #1065 rotates the
+ * spawnRequestId on every restart and never writes an agent.spawn row for the successor, so keying
+ * only on the original agent.spawn row lost the brief from the 2nd restart onward (the predecessor
+ * id was then the fresh id, which has no spawn row). The dashboard restart path re-persists the raw
+ * brief under each fresh id on the restart command's `restartSpawn.callerSystemPromptAppend`
+ * (agent-sessions.ts), so this lookup also matches an `agent.restart` row whose rotated id equals
+ * the query id — every generation has its own recoverable copy and the brief follows the agent.
+ */
+export function readSpawnCallerSystemPromptAppend(spawnRequestId: string | undefined): string | undefined {
+  if (!spawnRequestId) return undefined;
+  try {
+    const row = getDb().query(`
+      SELECT coalesce(
+               json_extract(params, '$.callerSystemPromptAppend'),
+               json_extract(params, '$.restartSpawn.callerSystemPromptAppend')
+             ) AS append
+      FROM commands
+      WHERE (type = 'agent.spawn' AND correlation_id = ?)
+         OR (type = 'agent.restart' AND json_extract(params, '$.restartSpawn.spawnRequestId') = ?)
+      ORDER BY created_at DESC
+      LIMIT 1
+    `).get(spawnRequestId, spawnRequestId) as { append: string | null } | undefined;
+    const append = row?.append;
+    return typeof append === "string" && append.trim() ? append : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export function markRead(messageId: number, agentId: string): boolean {
   const exists = getDb().query("SELECT 1 FROM messages WHERE id = ?").get(messageId);
   if (!exists) return false;

package/src/db/messages.ts

@@ -1,6 +1,15 @@
 import { Database } from "bun:sqlite";
 import { randomUUID } from "node:crypto";
-import { isRecord, stringValue, isMechanicalMessageKind, isReportVerbosity, type ReportVerbosity } from "agent-relay-sdk";
+import {
+  isRecord,
+  isTurnFinalSession,
+  stringValue,
+  isMechanicalMessageKind,
+  isReportVerbosity,
+  type MessagePayload,
+  type MessageWorkFinality,
+  type ReportVerbosity,
+} from "agent-relay-sdk";
 import { LIFECYCLE_STATE_WORKING, childSignalKey, stampLifecycleSignal, taskSignalKey } from "../lifecycle-signal-registry";
 import { ORCHESTRATOR_PROTOCOL_VERSION, VERSION } from "../config.ts";
 import { parseJson } from "../utils";
@@ -108,6 +117,19 @@ function sessionStepId(payload: Record<string, unknown> | undefined): string | u
   return stringValue(session?.stepId);
 }
 
+function normalizeMessagePayload(payload: MessagePayload | undefined): MessagePayload {
+  const original = payload ?? {};
+  let next: MessagePayload = original;
+  for (const key of ["session", "responseCapture"] as const) {
+    const value = next[key];
+    if (!isTurnFinalSession(value)) continue;
+    if (value.turnFinal === true && value.final === true) continue;
+    if (next === original) next = { ...original };
+    next[key] = { ...value, turnFinal: true, final: true };
+  }
+  return next;
+}
+
 /**
  * Codex session-mirror upsert (#parity): a provider step that emits more than once — a
  * tool's running→completed lifecycle, a reasoning/response row that streams — carries a
@@ -200,7 +222,7 @@ function responseCaptureMeta(input: Message | SendMessageInput): Record<string,
 }
 
 function isFinalSessionResponse(session: Record<string, unknown>): boolean {
-  return session.type === "response" && session.final === true;
+  return session.type === "response" && isTurnFinalSession(session);
 }
 
 function childStreamForSession(session: Record<string, unknown>): ChildStream | null {
@@ -373,14 +395,19 @@ function childIsBusy(child: AgentCard): boolean {
 // narration flood by the legacy tail budget, never slicing the block we keep.
 const REPORT_UP_DISTILL_THRESHOLD = 800;
 const REPORT_UP_TAIL_MAX = 800;
-const REPORT_UP_ELISION = "[…mid-work narration trimmed by report-up…]";
+// #1058 — distillation only ever runs on a FINAL turn (promoteLineageCapturedResponse gates on
+// isFinalSessionResponse), so the old "[…mid-work narration trimmed…]" label was a lie: it read as
+// if the real report were still coming when THIS is the deliverable. The elision marks that only the
+// LEADING narration was dropped, states plainly that this is the final report, and points at the
+// untrimmed turn via relay_get_message so the coordinator never has to guess whether the child is done.
+const reportUpElision = (messageId: number): string => `[…leading narration trimmed by report-up — this IS the final report; full turn: relay_get_message #${messageId}…]`;
 const REPORT_UP_HEADING = /^#{1,6}\s/m;
 
-function distillLineageReportBody(body: string): string {
+function distillLineageReportBody(body: string, messageId: number): string {
   const trimmed = body.trim();
   if (trimmed.length <= REPORT_UP_DISTILL_THRESHOLD) return body;
   const heading = REPORT_UP_HEADING.exec(trimmed);
-  if (heading) return heading.index === 0 ? body : `${REPORT_UP_ELISION}\n\n${trimmed.slice(heading.index).trim()}`;
+  if (heading) return heading.index === 0 ? body : `${reportUpElision(messageId)}\n\n${trimmed.slice(heading.index).trim()}`;
   const blocks = trimmed.split(/\n{2,}/).map((block) => block.trim()).filter(Boolean);
   const kept: string[] = [];
   let size = 0;
@@ -394,7 +421,7 @@ function distillLineageReportBody(body: string): string {
   // A single oversized trailing block (unsegmented narration) — hard-cap to its own tail.
   if (tail.length > REPORT_UP_TAIL_MAX) tail = tail.slice(tail.length - REPORT_UP_TAIL_MAX).replace(/^\S*\s/, "").trimStart();
   if (tail.length >= trimmed.length) return body; // nothing meaningful trimmed
-  return `${REPORT_UP_ELISION}\n\n${tail}`;
+  return `${reportUpElision(messageId)}\n\n${tail}`;
 }
 
 // #1037 — a quiet child's turn-final response that arrives while the child is still busy is a
@@ -451,7 +478,10 @@ export function listRecentFinalResponseCaptures(sinceMs: number, limit = 1000):
       WHERE kind = 'session'
         AND created_at >= ?
         AND json_extract(payload, '$.session.type') = 'response'
-        AND json_extract(payload, '$.session.final') = 1
+        AND (
+          json_extract(payload, '$.session.turnFinal') = 1
+          OR json_extract(payload, '$.session.final') = 1
+        )
       GROUP BY from_agent
     ) latest ON latest.latest_id = m.id
     ORDER BY m.id DESC
@@ -545,7 +575,7 @@ export function promoteLineageCapturedResponse(message: Message): { message: Mes
     kind: "chat",
     // #1037 — distill the turn-final report-up to a concise result; verbose child-stream captures
     // (an explicit subscriber that asked for the raw stream) are forwarded untouched.
-    body: stream === "responses" ? distillLineageReportBody(message.body) : message.body,
+    body: stream === "responses" ? distillLineageReportBody(message.body, message.id) : message.body,
     replyExpected: false,
     idempotencyKey,
     payload: stream === "responses"
@@ -560,6 +590,14 @@ export function promoteLineageCapturedResponse(message: Message): { message: Mes
   return result;
 }
 
+export function setMessageWorkFinality(messageId: number, finality: MessageWorkFinality): Message | null {
+  const message = getMessage(messageId);
+  if (!message) return null;
+  const payload: MessagePayload = { ...(message.payload ?? {}), finality };
+  getDb().query("UPDATE messages SET payload = ? WHERE id = ?").run(JSON.stringify(payload), messageId);
+  return getMessage(messageId);
+}
+
 // Event time may be queued-then-backfilled, so it can legitimately be older than the
 // receive time — but it must be a sane epoch-ms value. Returns null (column stays NULL, so
 // readers fall back to created_at) for absent/invalid values or anything more than a minute
@@ -586,7 +624,8 @@ export function sendMessagesBatchWithResult(inputs: SendMessageInput[]): SendMes
 
 function sendMessageWithResultInternal(input: SendMessageInput, wrapTransaction: boolean): SendMessageResult {
   const now = Date.now();
-  const payload = input.payload ?? {};
+  const payload = normalizeMessagePayload(input.payload);
+  input.payload = payload;
   const attachmentRefs = cleanAttachmentRefs(payload);
 
   if (!getAgent(input.from)) {

package/src/db/migrations.ts

@@ -148,6 +148,54 @@ function backfillProjectRootRemoteUrls(): void {
   }
 }
 
+function dualStampLegacyTurnFinality(): void {
+  const messagesTable = getDb().query("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'messages'").get();
+  if (!messagesTable) return;
+  const messageCols = getDb().query("PRAGMA table_info(messages)").all() as Array<{ name: string }>;
+  const messageColNames = new Set(messageCols.map((col) => col.name));
+  if (!messageColNames.has("payload") || !messageColNames.has("created_at")) return;
+  getDb().run(`
+    UPDATE messages
+    SET payload = json_set(
+      payload,
+      '$.finality',
+      json_object(
+        'windowId', 'legacy:' || id,
+        'source', 'edge-fallback',
+        'groupOrder', 0,
+        'markedAt', coalesce(occurred_at, created_at)
+      )
+    )
+    WHERE kind = 'session'
+      AND json_extract(payload, '$.session.final') = 1
+      AND json_type(payload, '$.session.turnFinal') IS NULL
+      AND json_type(payload, '$.finality') IS NULL
+  `);
+  getDb().run(`
+    UPDATE messages
+    SET payload = json_set(payload, '$.session.turnFinal', json('true'))
+    WHERE json_extract(payload, '$.session.final') = 1
+      AND json_type(payload, '$.session.turnFinal') IS NULL
+  `);
+  getDb().run(`
+    UPDATE messages
+    SET payload = json_set(payload, '$.session.final', json('true'))
+    WHERE json_extract(payload, '$.session.turnFinal') = 1
+      AND json_type(payload, '$.session.final') IS NULL
+  `);
+  getDb().run(`
+    UPDATE messages
+    SET payload = json_set(payload, '$.responseCapture.turnFinal', json('true'))
+    WHERE json_extract(payload, '$.responseCapture.final') = 1
+      AND json_type(payload, '$.responseCapture.turnFinal') IS NULL
+  `);
+  getDb().run(`
+    UPDATE messages
+    SET payload = json_set(payload, '$.responseCapture.final', json('true'))
+    WHERE json_extract(payload, '$.responseCapture.turnFinal') = 1
+      AND json_type(payload, '$.responseCapture.final') IS NULL
+  `);
+}
 
 // Incremental schema migrations + one-shot backfills, applied after the base DDL
 // in initDb(). Ordering matters: each block guards on the current column/table
@@ -280,6 +328,7 @@ export function applyMigrations(): void {
   if (!colNames.includes("occurred_at")) {
     getDb().run("ALTER TABLE messages ADD COLUMN occurred_at INTEGER");
   }
+  dualStampLegacyTurnFinality();
   getDb().query(
     "UPDATE messages SET claim_expires_at = coalesce(claimed_at, ?) + ? WHERE claimed_by IS NOT NULL AND claim_expires_at IS NULL",
   ).run(Date.now(), CLAIM_LEASE_MS);
@@ -822,6 +871,11 @@ export function applyMigrations(): void {
   if (!providerQuotaCols.includes("quota_advisory_state")) {
     getDb().run("ALTER TABLE provider_quotas ADD COLUMN quota_advisory_state TEXT NOT NULL DEFAULT '{}'");
   }
+  // #1074 — persist quota-band hysteresis state so a relay restart doesn't re-fire already-sent
+  // band-degradation notifications to the whole fleet.
+  if (!providerQuotaCols.includes("quota_band_state")) {
+    getDb().run("ALTER TABLE provider_quotas ADD COLUMN quota_band_state TEXT NOT NULL DEFAULT '{}'");
+  }
   getDb().run(`
     INSERT INTO provider_quotas (
       provider, account_key, quota_state, source_agent_ids, last_updated_at,