agent-relay-server 0.121.5 → 0.122.1

package/src/db/provider-quota-burn.ts

@@ -1,28 +1,38 @@
-import { DEFAULT_QUOTA_TARGET_UTILIZATION, quotaPaceMetrics, quotaWindowMetrics } from "agent-relay-sdk/provider-quota";
+import { DEFAULT_QUOTA_TARGET_UTILIZATION, quotaPaceMetrics, quotaTrendProjection, quotaWindowMetrics } from "agent-relay-sdk/provider-quota";
 import type { ProviderQuotaBurn, ProviderQuotaBurnRole, ProviderQuotaBurnWindow, ProviderQuotaSnapshot, QuotaState } from "../types";
 
 const QUOTA_BURN_MIN_SAMPLE_SPAN_MS = 10 * 60_000;
 
-// #760 — nominal window length per role, used to scale the recency half-life.
+// #760 — nominal window length per role. windowStartAt = resetAt − this, and it scales the
+// evidence-confidence horizon below.
 const WINDOW_NOMINAL_MS: Record<ProviderQuotaBurnRole, number> = {
   "5h": 5 * 3_600_000,
   "7d": 7 * 24 * 3_600_000,
 };
 
-// #760 — recency half-life as a fraction of the window length. 0.25 → ~75min for the 5h
-// window (within the issue's ~60–90min trailing-window guidance) and ~42h for the 7d window.
-// A burst at the START of the history span decays out as it ages, so an idle stretch pulls the
-// observed rate (and burnRatio) back toward 0 instead of freezing the endpoint slope.
-const RECENCY_HALFLIFE_FRACTION = 0.25;
-
-// #798 — idle de-bias: once a provider's utilization has held flat for this long, any residual
-// forward-burn rate is a stale-burst artifact (the recency half-life decays it, but for the 7d
-// window — half-life ~42h — far too slowly: codex idle ~24h still projected ~1.07 at reset,
-// walking the band boundary tick-to-tick). When idle this long the forward-burn term is collapsed
-// so projectedUtilAtReset → current utilization. The threshold is absolute (NOT window-scaled): a
-// 5h window resets long before reaching it, so this only de-biases the slow-decaying 7d window;
-// shorter idle stretches keep the graceful #760 recency decay. The over-target avoid is preserved
-// by the position penalty in spawn-targets (a stable, position-based floor), not by this rate.
+// #1072 — SLOW EWMA time constant (dt-correct). This is the sustained-trend requirement made
+// mechanical: a 15-min onset burst barely moves a 24h-τ average, so a transient spawn-burst spike
+// cannot flip the band — only a trend that holds for hours does. Drives the band projection.
+const EWMA_TAU_SLOW_MS: Record<ProviderQuotaBurnRole, number> = {
+  "5h": 2 * 3_600_000,
+  "7d": 24 * 3_600_000,
+};
+
+// #1072 — continuous trend confidence reaches 1 once the observed span covers this horizon (the
+// slow-EWMA τ). A fresh window (tiny observed span) ⇒ ~0 confidence ⇒ the projected (not the
+// measured) overshoot cannot hard-escalate the band; by the time the span covers τ, a sustained
+// trend is real. Absorbs the #1073 confidence-gate stopgap into the model.
+const CONFIDENCE_FULL_EVIDENCE_MS: Record<ProviderQuotaBurnRole, number> = {
+  "5h": 2 * 3_600_000,
+  "7d": 24 * 3_600_000,
+};
+
+// #798 — idle collapse, retained for STABILITY (not for the penalty). Once utilization has held
+// flat for this long, the residual slow-EWMA rate is a stale-burst tail: the slow average decays
+// but never reaches exactly 0 in finite time, so a small rate × a multi-day horizon would still
+// creep the projection tick-to-tick (the band walk from #798). Pinning the rate to 0 once idle
+// this long fixes the projection at current utilization so the band is flat across ticks. The
+// threshold is absolute (a 5h window resets long before reaching it, so this only affects 7d).
 const IDLE_FORWARD_COLLAPSE_MS = 6 * 3_600_000;
 const IDLE_UTILIZATION_EPSILON = 1e-9;
 
@@ -63,32 +73,38 @@ function lowConfidenceBurnWindow(role: ProviderQuotaBurnRole, window: QuotaWindo
     projectedUtilAtReset: null,
     slack: null,
     target: null,
+    confidenceScore: null,
   };
 }
 
-// #760 — recency-weighted consumption rate (utilization-fraction per ms). A weighted slope:
-// each consecutive interval contributes its actual Δutilization and Δt, decayed by the age of
-// its midpoint with the given half-life. A recent idle interval (large Δt, ~0 Δutil, high
-// weight) dominates the denominator and drives the rate toward 0; an old burst is down-weighted.
-function recencyWeightedRatePerMs(
+// #1072 — dt-correct EWMA of the consumption rate (utilization-fraction per ms). Each consecutive
+// interval contributes its mean rate Δutil/Δt, held constant over Δt and decayed by exp(−Δt/τ), so
+// a long idle interval (Δt≫τ, rate ~0) drives the average toward 0 while a short burst barely
+// moves a long-τ average. The EWMA is SEEDED AT 0 (not at the first interval's raw slope) so a
+// sustained trend is required to build the rate up — a single onset interval can never set the
+// full slope. Interval rates are clamped ≥0 (a within-window utilization drop is treated as no
+// consumption, not negative burn).
+function ewmaRatePerMs(
   samples: Array<{ capturedAt: number; utilization: number }>,
   now: number,
-  halfLifeMs: number,
+  tauMs: number,
 ): number {
-  let weightedDelta = 0;
-  let weightedDt = 0;
+  let r = 0;
   for (let i = 1; i < samples.length; i++) {
-    const prev = samples[i - 1]!;
-    const cur = samples[i]!;
-    const dt = cur.capturedAt - prev.capturedAt;
+    const dt = samples[i]!.capturedAt - samples[i - 1]!.capturedAt;
     if (dt <= 0) continue;
-    const midAge = Math.max(0, now - (prev.capturedAt + cur.capturedAt) / 2);
-    const weight = Math.pow(0.5, midAge / halfLifeMs);
-    weightedDelta += weight * (cur.utilization - prev.utilization);
-    weightedDt += weight * dt;
+    const rate = Math.max(0, (samples[i]!.utilization - samples[i - 1]!.utilization) / dt);
+    const decay = Math.exp(-dt / tauMs);
+    r = decay * r + (1 - decay) * rate;
+  }
+  // Idle observability: extend to `now` with a zero-rate interval so a deduped idle stretch (no new
+  // distinct samples arrive while utilization holds) still decays the average instead of freezing
+  // the last observed slope — the same synthetic-tail trick #760 used, applied to the EWMA.
+  const last = samples[samples.length - 1];
+  if (last && now > last.capturedAt) {
+    r *= Math.exp(-(now - last.capturedAt) / tauMs);
   }
-  if (weightedDt <= 0) return 0;
-  return Math.max(0, weightedDelta / weightedDt);
+  return Math.max(0, r);
 }
 
 // #798 — when did utilization last differ from its current value? Scanning back from the newest
@@ -148,62 +164,75 @@ function deriveProviderQuotaBurnWindow(input: {
   const timeToResetMs = resetAt - input.now;
   if (remainingQuota <= 0 || timeToResetMs <= 0) return low;
 
-  // #760 (Defect 1) — recency-weighted rate so an old burst decays and idle relaxes toward 0,
-  // instead of a frozen two-point endpoint slope over the whole span.
-  //
-  // Idle is invisible in the raw samples: identical utilization snapshots are deduped, so during
-  // an idle stretch no new rows arrive and the latest sample stays frozen at the last CHANGE
-  // (this is why codex sat at burn×6.3 — a stale burst slope). We make idle observable by
-  // appending a synthetic "utilization is still X as of now" point, which adds a recent
-  // zero-delta interval [lastSample, now] that the recency weighting lets dominate as it grows.
-  const halfLifeMs = WINDOW_NOMINAL_MS[role] * RECENCY_HALFLIFE_FRACTION;
-  const rateSamples = input.now > current.capturedAt
-    ? [...samples, { capturedAt: input.now, utilization: utilizationNow }]
-    : samples;
-  const observedRatePerMs = recencyWeightedRatePerMs(rateSamples, input.now, halfLifeMs);
-  // #798 — idle de-bias: if utilization has held flat (no change vs. now) for IDLE_FORWARD_COLLAPSE_MS,
-  // treat the forward-burn term as a stale-burst artifact and collapse it to 0 so the projection
-  // pins to current utilization instead of walking the band boundary. lastChangeAt is the moment
-  // utilization last differed from the current value (the synthetic "still X as of now" interval is
-  // what makes a deduped idle stretch observable here).
+  // #1072 — the SLOW EWMA is the burn rate: a sustained trend is required by construction, so a
+  // transient onset burst (100% of a young window's evidence) can't drive the band. The EWMA walks
+  // the real sample timeline and extends a zero-rate tail to `now`, so a deduped idle stretch
+  // decays the rate instead of freezing the last observed slope (the #760 burn×6.3 stale-slope bug).
+  const rSlow = ewmaRatePerMs(samples, input.now, EWMA_TAU_SLOW_MS[role]);
+  // #798 idle collapse (stability only): once utilization has held flat ≥ IDLE_FORWARD_COLLAPSE_MS
+  // the residual slow rate is a stale-burst tail — pin it to 0 so the projection == current
+  // utilization and stays flat tick-to-tick (no band walk). lastChangeAt is when utilization last
+  // differed from the current value.
   const lastChangeAt = lastUtilizationChangeAt(samples, utilizationNow);
-  const effectiveRate = input.now - lastChangeAt >= IDLE_FORWARD_COLLAPSE_MS ? 0 : observedRatePerMs;
-  // #760 (Defect 2) — pace against a configurable target (<100%); slack carries the underburn
-  // signal. The query layer (spawn-targets) may re-derive these against a per-provider target;
-  // the ingest-time values use the default so direct burn consumers (dashboard) have a number.
+  const bandRate = input.now - lastChangeAt >= IDLE_FORWARD_COLLAPSE_MS ? 0 : rSlow;
+
+  // #1072 — evidence span and continuous trend confidence. evidenceMs is how long we've actually
+  // observed this window instance (bounded by both the window's own start and our first sample);
+  // it caps the projection horizon and drives the confidence that gates hard-escalation.
+  const windowStartAt = resetAt - WINDOW_NOMINAL_MS[role];
+  const evidenceMs = Math.max(0, input.now - Math.max(windowStartAt, oldest.capturedAt));
+  const confidence = Math.max(0, Math.min(1, evidenceMs / CONFIDENCE_FULL_EVIDENCE_MS[role]));
+
+  // #1072 — evidence-capped band projection off the slow rate. The query layer (spawn-targets)
+  // re-derives slack/penalty against the per-provider target from this (target-independent)
+  // projection + confidenceScore; the ingest-time values use the default target so direct burn
+  // consumers (dashboard) have a number.
+  const trend = quotaTrendProjection({
+    utilization: utilizationNow,
+    slowRatePerMs: bandRate,
+    timeToResetMs,
+    evidenceMs,
+    confidence,
+    target: DEFAULT_QUOTA_TARGET_UTILIZATION,
+  });
+  // burnRatio (display) paces the same slow rate against the target, so the widget's burn number
+  // and the routing band always agree — a bursty spike shows in the raw sparkline, not here.
   const pace = quotaPaceMetrics({
     utilization: utilizationNow,
-    observedRatePerMs: effectiveRate,
+    observedRatePerMs: bandRate,
     timeToResetMs,
     target: DEFAULT_QUOTA_TARGET_UTILIZATION,
   });
-  if (effectiveRate <= 0) {
-    // Idle (decayed-to-idle, or #798 idle-collapsed): no projected wall, but slack still flags the
-    // headroom (positive = underburn) or, when over target, the position the band-floor avoids.
+  if (bandRate <= 0) {
+    // Idle (flat, decayed-to-idle, or #798 idle-collapsed): no projected wall, but the projection
+    // still pins to current utilization and slack flags headroom (positive) or the over-target
+    // position the penalty avoids (negative).
     return {
       ...low,
       confidence: "high",
       burnRatio: 0,
       observedRatePerMs: 0,
-      projectedUtilAtReset: pace.projectedUtilAtReset,
-      slack: pace.slack,
-      target: pace.target,
+      projectedUtilAtReset: trend.projectedUtilAtReset,
+      slack: trend.slack,
+      target: trend.target,
+      confidenceScore: confidence,
     };
   }
-  const timeToWallMs = remainingQuota / effectiveRate;
+  const timeToWallMs = remainingQuota / bandRate;
   const projectedWallAt = input.now + timeToWallMs;
   return {
     ...low,
     confidence: "high",
     burnRatio: pace.burnRatio,
-    observedRatePerMs: effectiveRate,
+    observedRatePerMs: bandRate,
     timeToWallMs,
     projectedWallAt,
     // #760 (Defect 2) — symmetric: negative means the wall lands AFTER reset (headroom left).
     earlyWallMs: resetAt - projectedWallAt,
-    projectedUtilAtReset: pace.projectedUtilAtReset,
-    slack: pace.slack,
-    target: pace.target,
+    projectedUtilAtReset: trend.projectedUtilAtReset,
+    slack: trend.slack,
+    target: trend.target,
+    confidenceScore: confidence,
   };
 }
 

package/src/db/provider-quotas.ts

@@ -26,12 +26,22 @@ export interface ProviderQuotaAdvisoryInput {
   quota: QuotaState;
   sourceAgentIds: string[];
   previousAdvisoryState?: string | null;
+  // #1074 — serialized quota-band hysteresis state (quota_band_state column). Threaded in so the
+  // band-transition pipeline hydrates instead of re-seeding to "normal" on every relay restart.
+  previousBandState?: string | null;
   now: number;
 }
 
-let providerQuotaAdvisoryHandler: ((input: ProviderQuotaAdvisoryInput) => string) | undefined;
+// #1074 — the handler returns BOTH persisted blobs: the utilization advisory state and the
+// band-transition hysteresis state. Both are written back to their respective columns.
+export interface ProviderQuotaAdvisoryResult {
+  advisoryState: string;
+  bandState: string;
+}
+
+let providerQuotaAdvisoryHandler: ((input: ProviderQuotaAdvisoryInput) => ProviderQuotaAdvisoryResult) | undefined;
 
-export function setProviderQuotaAdvisoryHandler(handler: ((input: ProviderQuotaAdvisoryInput) => string) | undefined): void {
+export function setProviderQuotaAdvisoryHandler(handler: ((input: ProviderQuotaAdvisoryInput) => ProviderQuotaAdvisoryResult) | undefined): void {
   providerQuotaAdvisoryHandler = handler;
 }
 
@@ -42,6 +52,7 @@ type ProviderQuotaRow = {
   codex_reset_credits?: string | null;
   source_agent_ids?: string | null;
   quota_advisory_state?: string | null;
+  quota_band_state?: string | null;
   last_updated_at?: number | null;
   last_attempt_at: number;
   last_error?: string | null;
@@ -182,6 +193,13 @@ function newestQuotaAdvisoryState(rows: ProviderQuotaRow[]): string {
   return row?.quota_advisory_state ?? "{}";
 }
 
+function newestQuotaBandState(rows: ProviderQuotaRow[]): string {
+  const row = rows
+    .filter((candidate) => candidate.quota_band_state)
+    .sort((a, b) => b.updated_at - a.updated_at)[0];
+  return row?.quota_band_state ?? "{}";
+}
+
 function mergeProviderQuotaRows(provider: string, accountKey: string, oldAccountKeys: string[], now: number): number {
   const keys = [...new Set(oldAccountKeys.filter((key) => key && key !== accountKey))];
   if (keys.length === 0) return 0;
@@ -203,9 +221,9 @@ function mergeProviderQuotaRows(provider: string, accountKey: string, oldAccount
   getDb().query(`
     INSERT INTO provider_quotas (
       provider, account_key, quota_state, codex_reset_credits, source_agent_ids, last_updated_at,
-      last_attempt_at, last_error, quota_advisory_state, updated_at, created_at
+      last_attempt_at, last_error, quota_advisory_state, quota_band_state, updated_at, created_at
     )
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT(provider, account_key) DO UPDATE SET
       quota_state = excluded.quota_state,
       codex_reset_credits = excluded.codex_reset_credits,
@@ -214,6 +232,7 @@ function mergeProviderQuotaRows(provider: string, accountKey: string, oldAccount
       last_attempt_at = excluded.last_attempt_at,
       last_error = excluded.last_error,
       quota_advisory_state = excluded.quota_advisory_state,
+      quota_band_state = excluded.quota_band_state,
       updated_at = excluded.updated_at
   `).run(
     provider,
@@ -225,6 +244,7 @@ function mergeProviderQuotaRows(provider: string, accountKey: string, oldAccount
     lastAttemptAt || now,
     newestLastError(rows),
     newestQuotaAdvisoryState(rows),
+    newestQuotaBandState(rows),
     updatedAt,
     createdAt,
   );
@@ -552,17 +572,19 @@ export function upsertProviderQuota(input: ProviderQuotaUpdateInput, now = Date.
     recordProviderQuotaUnavailable({ provider, accountKey, error: input.lastError, sourceAgentId: input.sourceAgentId }, now);
   }
   if (hasFreshSuccessfulProviderQuota(input, now) && mergedQuota?.acceptedIncomingWindow) {
-    const quotaAdvisoryState = providerQuotaAdvisoryHandler?.({
+    const advisoryResult = providerQuotaAdvisoryHandler?.({
       provider,
       accountKey,
       previousQuota: existingQuota ? publicQuotaState(existingQuota) : undefined,
       quota: publicQuotaState(mergedQuota.quota),
       sourceAgentIds,
       previousAdvisoryState: existing?.quota_advisory_state,
+      previousBandState: existing?.quota_band_state,
       now,
     });
-    if (quotaAdvisoryState !== undefined) {
-      getDb().query("UPDATE provider_quotas SET quota_advisory_state = ? WHERE provider = ? AND account_key = ?").run(quotaAdvisoryState, provider, accountKey);
+    if (advisoryResult !== undefined) {
+      getDb().query("UPDATE provider_quotas SET quota_advisory_state = ?, quota_band_state = ? WHERE provider = ? AND account_key = ?")
+        .run(advisoryResult.advisoryState, advisoryResult.bandState, provider, accountKey);
     }
   }
   if (!unstableProviderQuotaAccountKey(accountKey)) {

package/src/db/scheduled-timers.ts

@@ -185,6 +185,27 @@ export function countActiveScheduledTimers(createdBy: string): number {
   return row.count;
 }
 
+// #1004 — a command timer whose background command is still pending/running is active work
+// executing on the creator's behalf (a shell command on an orchestrator), even though its
+// provider turn already ended and reports idle. A prompt-wakeup timer (no command) is just a
+// future alarm and never counts. These back the running-command → busy DISPLAY derivation; the
+// timer/command row is the source of truth, so the signal self-heals when the command settles.
+const RUNNING_COMMAND_TIMER_PREDICATE =
+  "enabled = 1 AND command IS NOT NULL AND json_extract(command, '$.status') IN ('pending', 'running')";
+
+export function agentHasRunningCommandTimer(createdBy: string): boolean {
+  return getDb()
+    .query(`SELECT 1 FROM scheduled_timers WHERE created_by = ? AND ${RUNNING_COMMAND_TIMER_PREDICATE} LIMIT 1`)
+    .get(createdBy) != null;
+}
+
+export function agentsWithRunningCommandTimers(): Set<string> {
+  const rows = getDb()
+    .query(`SELECT DISTINCT created_by FROM scheduled_timers WHERE ${RUNNING_COMMAND_TIMER_PREDICATE}`)
+    .all() as Array<{ created_by: string }>;
+  return new Set(rows.map((row) => row.created_by));
+}
+
 export function listDueScheduledTimerIds(now: number, limit = 25): string[] {
   const rows = getDb().query(`
     SELECT id FROM scheduled_timers

package/src/db/schema.ts

@@ -366,6 +366,7 @@ export function initDb(path: string = "agent-relay.db"): Database {
       codex_reset_credits TEXT,
       source_agent_ids TEXT NOT NULL DEFAULT '[]',
       quota_advisory_state TEXT NOT NULL DEFAULT '{}',
+      quota_band_state TEXT NOT NULL DEFAULT '{}',
       last_updated_at INTEGER,
       last_attempt_at INTEGER NOT NULL,
       last_error TEXT,

package/src/db/tasks.ts

@@ -327,15 +327,45 @@ export function renewTaskClaim(taskId: number, agentId: string, guard?: AgentSes
   return { ok: true, task: getTask(taskId)! };
 }
 
-export function updateTaskStatus(taskId: number, input: TaskStatusInput): { ok: boolean; error?: string; task?: Task; event?: TaskEvent } {
+/**
+ * The AUTHENTICATED principal behind a status write, derived at the transport boundary from the
+ * signed token (`ctx.callerAgentId` / scopes) — NEVER from the request body. The ownership fence
+ * keys on this, not `input.agentId`, so omitting/spoofing the body field cannot advance another
+ * agent's claim (#1063).
+ */
+export interface TaskStatusActor {
+  /** The caller's own agent id (`ctx.callerAgentId`). undefined for full-reach/system/multi-agent tokens. */
+  agentId?: string;
+  /** Full-reach `*`, internal `system`, or a task-admin scope: may advance a task it does not own. */
+  privileged?: boolean;
+}
+
+export function updateTaskStatus(taskId: number, input: TaskStatusInput, actor?: TaskStatusActor): { ok: boolean; error?: string; conflict?: boolean; task?: Task; event?: TaskEvent } {
   const task = getTask(taskId);
   if (!task) return { ok: false, error: "task not found" };
   // Fence: the claim-lane status updater writes `claimed_by`; deliverable Tasks must never
   // be mutated here. They transition through setTaskStatus (src/db/task-entity.ts), which
   // never touches claimed_by. (#834)
   if (task.kind === DELIVERABLE_TASK_KIND) return { ok: false, error: "deliverable task: use the task-entity status API" };
+  // Ownership fence (#1061, hardened #1063): once a task is claimed, only its current owner may
+  // advance the status. The acting identity is the AUTHENTICATED caller (`actor.agentId`, resolved
+  // from the signed token at the route) — NEVER the client-supplied `input.agentId`. Trusting the
+  // body let any task:write holder omit or spoof it and steal another agent's claim (#1063).
+  // A privileged caller (full-reach `*`, internal `system`, or a task-admin scope) may advance a
+  // task it does not own — the same escape hatch #1043's `ensureCanMintThread` grants. An undefined
+  // `actor` is an in-process trusted caller (automations, tests) and is likewise privileged.
+  // A null claimed_by still self-claims (fresh status write).
+  const privileged = actor?.privileged ?? actor === undefined;
+  const callerAgentId = actor?.agentId;
+  if (!privileged && task.claimedBy && callerAgentId !== task.claimedBy) {
+    return { ok: false, error: `task claimed by ${task.claimedBy}`, conflict: true };
+  }
   const now = Date.now();
-  const agentId = input.agentId ?? task.claimedBy ?? null;
+  // Effective owner/session identity. A privileged caller may act on behalf of the supplied
+  // `input.agentId` (or the existing owner — the automation/system self-claim path); an ordinary
+  // caller is bound to its authenticated identity and must NOT fall back to `claimedBy` — that
+  // fallback was the #1063 bypass that let a missing `agentId` silently inherit the owner.
+  const agentId = privileged ? (input.agentId ?? task.claimedBy ?? null) : (callerAgentId ?? null);
   if (agentId) {
     const session = validateAgentSession(agentId, input);
     if (!session.ok) return { ok: false, error: session.error };
@@ -360,7 +390,7 @@ export function updateTaskStatus(taskId: number, input: TaskStatusInput): { ok:
     }
   }
   const event = insertTaskEvent(taskId, {
-    source: input.agentId ?? "agent-relay",
+    source: agentId ?? "agent-relay",
     type: `status:${input.status}`,
     severity: task.severity,
     title: `Task ${input.status}`,

package/src/db/work-evidence.ts

@@ -24,13 +24,16 @@ export function hasArtifactCreatedBy(createdBy: string, since: number = 0): bool
 
 export function listFinalResponseCaptureMessages(from: string, since: number = 0, limit: number = 20): Message[] {
   const safeLimit = Math.min(Math.max(Math.floor(limit), 1), 100);
-  const rows = getDb().query(`
-    ${MSG_SELECT}
-    WHERE m.from_agent = ?
-      AND m.kind = 'chat'
-      AND m.created_at >= ?
-      AND json_extract(m.payload, '$.responseCapture.type') = 'response'
-      AND json_extract(m.payload, '$.responseCapture.final') = 1
+	  const rows = getDb().query(`
+	    ${MSG_SELECT}
+	    WHERE m.from_agent = ?
+	      AND m.kind = 'chat'
+	      AND m.created_at >= ?
+	      AND json_extract(m.payload, '$.responseCapture.type') = 'response'
+	      AND (
+	        json_extract(m.payload, '$.responseCapture.turnFinal') = 1
+	        OR json_extract(m.payload, '$.responseCapture.final') = 1
+	      )
     ORDER BY m.id DESC
     LIMIT ?
   `).all(from, since, safeLimit) as any[];

package/src/event-loop-lag.ts

@@ -53,6 +53,21 @@ export function eventLoopLagMaxMs(): number {
   return maxMs;
 }
 
+// Cumulative retained lag — the SUM of every sample in the ring, i.e. the total
+// event-loop processing debt across the retained window. SIDE-EFFECT-FREE (like
+// eventLoopLagMaxMs it never touches maxSinceLastReadMs, so reading it doesn't steal
+// the /health poller's spike). This is the stale/bus reaper's grace (#1055): the max
+// SINGLE sample (#1048) covers one contiguous stall (the 337s incident) but UNDER-
+// covers sustained NON-contiguous degradation — many sub-TTL stalls whose backlog
+// still sums past STALE_TTL. Summing every stall in the window extends the grace to the
+// real accumulated heartbeat backlog. Always >= eventLoopLagMaxMs(), so it can only
+// WIDEN the #1048 grace, never shrink it — no new false-reap risk introduced.
+export function eventLoopLagGraceMs(): number {
+  let total = 0;
+  for (let i = 0; i < sampleCount; i += 1) total += samples[i] ?? 0;
+  return total;
+}
+
 export function getEventLoopLagSnapshot(): EventLoopLagSnapshot {
   const maxMs = eventLoopLagMaxMs();
   const maxSinceLastRead = maxSinceLastReadMs;

package/src/gate-resolver.ts

@@ -9,7 +9,11 @@
 //      outright. A project that declared gates knows better than any heuristic.
 //   2. Derive from `package.json` — run the repo's DECLARED scripts via its detected
 //      package manager (from `packageManager` field or lockfile). A repo whose
-//      `scripts.test` is `jest` gets `<pm> run test`, never `bun test`.
+//      `scripts.test` is `jest` gets `<pm> run test`, never `bun test`. When the repo
+//      declares a full-gate script (`ci:land` preferred, else `ci`), that IS its gate
+//      (the set the repo wants enforced before land/release): the steward runs it
+//      wholesale so land gates == release gates (#1044/#1089), instead of a
+//      file-relevance subset that would let drift/lint/doc breakage land.
 //   3. Default — the legacy bun heuristic, only when there's nothing to derive from
 //      (no repo path, or no readable package.json).
 import { existsSync, readFileSync } from "node:fs";
@@ -98,6 +102,20 @@ export function resolveStewardChecks(files: string[], repoRoot?: string): Stewar
   const pkg = repoRoot ? readPackageInfo(repoRoot) : null;
   if (pkg) {
     const runScript = (name: string) => `${pkg.pm} run ${name}`;
+    // 2a. Land==release parity (#1044): a repo that declares its full validation gate as
+    // a script has ALREADY named the set the release enforces. Run that ONE gate wholesale
+    // instead of a file-relevance subset (typecheck+test), so a land can't introduce
+    // drift/lint/doc breakage that only a narrower gate misses and that would otherwise
+    // surface at release time (failing `*:check`/lint gates).
+    //
+    // Prefer an explicit `ci:land` script when the repo declares one: it is the repo's
+    // named pre-land full gate, so the steward should respect that contract over a more
+    // generic `ci`. Repos that want exact parity can make `ci` delegate to `ci:land`;
+    // repos that need a different land-safe full gate still have a first-class name for it.
+    const fullGate = pkg.scripts["ci:land"] ? "ci:land" : pkg.scripts.ci ? "ci" : undefined;
+    if (fullGate && files.length) {
+      return [{ command: runScript(fullGate), reason: `repo declares a full "${fullGate}" gate (land==release parity)` }];
+    }
     if (has(/\.(ts|tsx|mts|cts)$/) && pkg.scripts.typecheck) {
       checks.push({ command: runScript("typecheck"), reason: "TypeScript files changed" });
     }

package/src/maintenance/jobs.ts

@@ -1,7 +1,7 @@
 import { getArtifactStorage } from "../artifact-storage";
 import { deriveAgentBusyHealth } from "../agent-busy-health";
 import { expireStaleBusAgents } from "../bus";
-import { eventLoopLagMaxMs } from "../event-loop-lag";
+import { eventLoopLagGraceMs } from "../event-loop-lag";
 import { pruneOutbox } from "../bus-outbox";
 import { expireCommands } from "../commands-db";
 import { getRetentionConfig } from "../retention-config-store";
@@ -22,6 +22,7 @@ import {
   releaseExpiredClaims,
   releaseExpiredDriveLeases,
   releaseOrphanedTasks,
+  revokeOrphanedRuntimeTokens,
   runDbMaintenanceAsync,
   sweepArtifacts,
 } from "../db";
@@ -278,7 +279,7 @@ export const definitions: MaintenanceJobDefinition[] = [
     intervalMs: REAP_INTERVAL_MS,
     runOnStart: true,
     handler() {
-      const expired = expireStaleBusAgents(undefined, eventLoopLagMaxMs());
+      const expired = expireStaleBusAgents(undefined, eventLoopLagGraceMs());
       for (const id of expired.agentIds) {
         getLifecycleManager().onAgentDisappeared(id);
         // #636/#659 — only after the stale reconnect grace expires do we turn a bare
@@ -301,11 +302,13 @@ export const definitions: MaintenanceJobDefinition[] = [
     intervalMs: REAP_INTERVAL_MS,
     runOnStart: true,
     handler() {
-      // #1048 — gate staleness on the relay's OWN event-loop health. eventLoopLagMaxMs()
-      // is side-effect-free (does not consume the /health poller's spike max). During a
-      // relay self-stall this grace keeps live agents whose heartbeats we simply couldn't
+      // #1048/#1055 — gate staleness on the relay's OWN event-loop health.
+      // eventLoopLagGraceMs() is side-effect-free (does not consume the /health poller's
+      // spike max) and sums the retained window's lag, so BOTH one contiguous stall and
+      // sustained non-contiguous overload (many sub-TTL stalls whose backlog sums past the
+      // TTL) extend the grace. Keeps live agents whose heartbeats we simply couldn't
       // process from being reaped as dead.
-      const lagGraceMs = eventLoopLagMaxMs();
+      const lagGraceMs = eventLoopLagGraceMs();
       const reapedAgentIds = reapStaleAgents(STALE_TTL_MS, lagGraceMs);
       for (const id of reapedAgentIds) {
         emitAgentStatus(id);
@@ -336,6 +339,20 @@ export const definitions: MaintenanceJobDefinition[] = [
       return { prunedAgentIds };
     },
   },
+  {
+    id: "orphan-token-revoker",
+    title: "Orphaned runtime-token revoker",
+    description: "Revoke ('stale', re-mintable) the runtime tokens of agents whose process the orchestrator confirmed dead and that have not been heard from since.",
+    intervalMs: REAP_INTERVAL_MS,
+    runOnStart: false,
+    handler() {
+      // #1057(1) — same lag discipline as the stale reaper (#1048/#1055): while the relay's own
+      // event loop was stalled, a live replacement's heartbeats may still be unprocessed, so the
+      // grace widens by the observed lag instead of misreading the backlog as post-mortem silence.
+      const revokedOrphanTokens = revokeOrphanedRuntimeTokens(STALE_TTL_MS, eventLoopLagGraceMs());
+      return { revokedOrphanTokens };
+    },
+  },
   {
     id: "orphaned-session-reaper",
     title: "Orphaned session reaper",

package/src/managed-policy.ts

@@ -1,8 +1,7 @@
 import { getManifest } from "agent-relay-providers";
-import { DEFAULT_USER_ID } from "agent-relay-sdk";
 import { getAgentProfile } from "./config-store";
-import { resolveProjectForCwd, resolveScopedAnchor, withResolvedProvisioning } from "./db";
-import { composeSpawnInstructionsWithEvents } from "./project-instructions";
+import { withResolvedProvisioning } from "./db";
+import { composeProfileSpawnInstructions } from "./project-instructions";
 import { runnerRuntimeTokenEnv } from "./runtime-tokens";
 import { buildSpawnCommand, resolveSpawnModelParams } from "./spawn-command";
 import { applyDefaultSharedMcp } from "./shared-mcp";
@@ -58,16 +57,10 @@ export function buildManagedSpawnParams(policy: SpawnPolicy, requestId: string,
   // keepalive prompt folds in as the caller append → one ordered `--append-system-prompt` block,
   // no double-inject. The projection is deterministic (sorted + deduped), so re-running it on a
   // native-resume relaunch reproduces a byte-identical block rather than stacking a second copy.
-  const callerProject = resolveProjectForCwd(policy.cwd) ?? undefined;
-  const projectInstructions = agentProfile?.projectInstructions;
-  const profileAnchor = policy.profile ? resolveScopedAnchor("profile", policy.profile) ?? undefined : undefined;
-  const userAnchor = resolveScopedAnchor("user", DEFAULT_USER_ID) ?? undefined;
   const alwaysOnAppend = managedPolicyAppendSystemPrompt(policy);
-  const composed = composeSpawnInstructionsWithEvents({
-    ...(callerProject ? { callerProject } : {}),
-    ...(projectInstructions ? { projectInstructions } : {}),
-    ...(profileAnchor ? { profileAnchor } : {}),
-    ...(userAnchor ? { userAnchor } : {}),
+  const composed = composeProfileSpawnInstructions({
+    cwd: policy.cwd,
+    ...(policy.profile ? { profileName: policy.profile } : {}),
     ...(agentProfile ? { profile: agentProfile } : {}),
     ...(alwaysOnAppend ? { callerSystemPromptAppend: alwaysOnAppend } : {}),
   });

package/src/mcp-plan-tools.ts

@@ -1,5 +1,6 @@
-import { McpNotFoundError } from "./mcp-errors";
+import { McpAuthError, McpNotFoundError } from "./mcp-errors";
 import { ValidationError } from "./db";
+import { ServiceAuthError } from "./services/errors";
 import { authContextFromMcp } from "./services/auth-context";
 import {
   addPlanEdge,
@@ -126,6 +127,17 @@ function stringArg(value: unknown, field: string): string {
 }
 
 export function relayPlanTool(auth: McpAuthLike, name: string, args: Record<string, unknown>): Record<string, unknown> {
+  try {
+    return dispatchPlanTool(auth, name, args);
+  } catch (e) {
+    // A service-layer auth failure (e.g. #1043's message:send gate on the auto-mint) is an auth
+    // error on the wire — map it like the messaging tools do so the MCP edge returns 403.
+    if (e instanceof ServiceAuthError) throw new McpAuthError(e.message);
+    throw e;
+  }
+}
+
+function dispatchPlanTool(auth: McpAuthLike, name: string, args: Record<string, unknown>): Record<string, unknown> {
   const ctx = authContextFromMcp(auth);
   if (name === "relay_plan_create") return createPlan(args as unknown as Parameters<typeof createPlan>[0], ctx) as unknown as Record<string, unknown>;
   if (name === "relay_plan_add_node") {