agent-relay-server 0.121.5 → 0.122.1

package/src/project-instructions.ts

@@ -10,7 +10,8 @@
 // content — a policy switch here, zero schema/composer change. `project_entries.source`
 // is that lever: the included-source set is a policy PARAMETER, and the `vanilla`
 // policy includes `manual`+`promoted` while excluding `ingested`.
-import { resolveProjectEntries } from "./db";
+import { DEFAULT_USER_ID } from "agent-relay-sdk";
+import { resolveProjectEntries, resolveProjectForCwd, resolveScopedAnchor } from "./db";
 import { renderTemplate } from "./prompt-resolver";
 import { PROJECT_ENTRY_SOURCES, type AgentProfile, type Project, type ProjectEntryKind, type ProjectEntrySource, type RelayInjectionCategory, type ResolvedProjectEntry } from "./types";
 
@@ -57,7 +58,7 @@ interface SpawnInstructionInjectionEvent {
   detail: Record<string, unknown>;
 }
 
-interface ComposedSpawnInstructions {
+export interface ComposedSpawnInstructions {
   systemPromptAppend?: string;
   relayInjectionEvents: SpawnInstructionInjectionEvent[];
 }
@@ -295,6 +296,39 @@ export function composeSpawnInstructions(input: Parameters<typeof composeSpawnIn
   return composeSpawnInstructionsWithEvents(input).systemPromptAppend;
 }
 
+/**
+ * #1052 — the SINGLE home that resolves a profile's spawn-time knowledge world (project
+ * preamble for the cwd + scoped {profile|user} memory anchors) and runs
+ * `composeSpawnInstructionsWithEvents`. Every path that (re)builds a profile-bearing spawn —
+ * fresh managed spawn, managed-policy restart, AND the dashboard "restart Runner/Agent" relaunch
+ * for a NON-policy agent — must call this so a restarted agent is onboarded byte-identically to
+ * its first launch (role charter + project knowledge + scoped memory). Before #1052-v2 the
+ * dashboard-restart path for a dashboard-spawned (non-policy) coordinator called
+ * `buildSpawnCommand` WITHOUT this projection, so the relaunched process came back with EMPTY
+ * injection logs and silently reverted to provider-default IC behavior.
+ */
+export function composeProfileSpawnInstructions(input: {
+  cwd?: string;
+  profileName?: string;
+  profile?: Pick<AgentProfile, "instructions" | "maxSpawnedAgents" | "projectInstructions">;
+  callerSystemPromptAppend?: string;
+  /** Operator/user anchor key; defaults to the single-operator default store. */
+  operatorId?: string;
+}): ComposedSpawnInstructions {
+  const callerProject = input.cwd ? resolveProjectForCwd(input.cwd) ?? undefined : undefined;
+  const projectInstructions = input.profile?.projectInstructions;
+  const profileAnchor = input.profileName ? resolveScopedAnchor("profile", input.profileName) ?? undefined : undefined;
+  const userAnchor = resolveScopedAnchor("user", input.operatorId ?? DEFAULT_USER_ID) ?? undefined;
+  return composeSpawnInstructionsWithEvents({
+    ...(callerProject ? { callerProject } : {}),
+    ...(projectInstructions ? { projectInstructions } : {}),
+    ...(profileAnchor ? { profileAnchor } : {}),
+    ...(userAnchor ? { userAnchor } : {}),
+    ...(input.profile ? { profile: input.profile } : {}),
+    ...(input.callerSystemPromptAppend ? { callerSystemPromptAppend: input.callerSystemPromptAppend } : {}),
+  });
+}
+
 /**
  * Parse a spawn-transport's `projectInstructions` wire value into the normalized policy
  * (or undefined = OFF). Shared by the MCP and HTTP spawn paths so they cannot drift.

package/src/quota-advisory.ts

@@ -5,7 +5,7 @@ import { emitRelayEvent } from "./events";
 import { routeNotification } from "./notification-router";
 import { DEFAULT_QUOTA_THRESHOLD_CONFIG, validateQuotaThresholdConfig } from "./quota-threshold-config";
 import { parseJson } from "./utils";
-import { setProviderQuotaAdvisoryHandler, type ProviderQuotaAdvisoryInput } from "./db/provider-quotas.ts";
+import { setProviderQuotaAdvisoryHandler, type ProviderQuotaAdvisoryInput, type ProviderQuotaAdvisoryResult } from "./db/provider-quotas.ts";
 import { processBandTransitions } from "./quota-band-transition";
 import type { QuotaState } from "./types";
 
@@ -40,7 +40,7 @@ export function installQuotaAdvisoryHandler(): void {
   setProviderQuotaAdvisoryHandler(handleProviderQuotaAdvisory);
 }
 
-function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): string {
+function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): ProviderQuotaAdvisoryResult {
   const config = effectiveQuotaNotificationConfig().quotaThreshold;
   const state = parseJson<QuotaAdvisoryState>(input.previousAdvisoryState ?? "{}", {});
   const nextState: QuotaAdvisoryState = { ...state };
@@ -101,8 +101,10 @@ function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): string
     };
   }
 
-  processBandTransitions(input);
-  return JSON.stringify(nextState);
+  // #1074 — thread the persisted band-hysteresis state through the transition pipeline and return
+  // the new state so it is written back to quota_band_state, surviving relay restarts.
+  const bandState = processBandTransitions(input, input.previousBandState);
+  return { advisoryState: JSON.stringify(nextState), bandState };
 }
 
 function hasLastQuotaAdvisory(previous: QuotaAdvisoryWindowState | undefined): boolean {

package/src/quota-band-transition.ts

@@ -38,6 +38,7 @@ import { getSpawnCapableAgentIds } from "./routing-policy-push";
 import { getProviderBandInfo, quotaBandFromSignal, windowRecommendedAction } from "./spawn-targets";
 import type { ProviderBandInfo, ProviderBandWindow, QuotaBand } from "./spawn-targets";
 import type { ProviderQuotaAdvisoryInput } from "./db/provider-quotas";
+import { parseJson } from "./utils";
 
 const DEBOUNCE_SAMPLES = 3;
 // #798 — EMA time constant for the low-pass. "A few minutes": longer than the ~5-min poll-cadence
@@ -68,6 +69,13 @@ interface TransitionState {
   emaUpdatedAt: number;
 }
 
+// #1074 — the per-`provider:role` hysteresis state (EMA low-pass, lastNotifiedBand, debounce
+// counters, lastTransitionAt). Serialized to the provider_quotas.quota_band_state DB column so it
+// survives a relay restart: without it every restart re-seeds lastNotifiedBand="normal" and re-fires
+// an already-sent degradation to the whole fleet. Mirrors the previousAdvisoryState round-trip in
+// quota-advisory.ts — state is passed IN and returned OUT, this module holds no cross-call memory.
+type BandTransitionState = Record<string, TransitionState>;
+
 // #798 — dt-based EMA blend factor: 1 − e^(−dt/τ). dt = 0 (or first sample) → seed verbatim.
 function emaAlpha(dtMs: number): number {
   if (!(dtMs > 0)) return 1;
@@ -79,12 +87,6 @@ function emaStep(prev: number | null, value: number, dtMs: number): number {
   return prev + emaAlpha(dtMs) * (value - prev);
 }
 
-const bandState = new Map<string, TransitionState>();
-
-export function _resetBandTransitionStateForTesting(): void {
-  bandState.clear();
-}
-
 // Test hook: supply a controlled band-info function to exercise hysteresis logic
 // without a full DB setup. Set to null to restore the real implementation.
 let _bandInfoSupplier: ((provider: string, now: number) => ProviderBandInfo | undefined) | null = null;
@@ -95,15 +97,24 @@ export function _clearBandInfoSupplierForTesting(): void {
   _bandInfoSupplier = null;
 }
 
-export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void {
+// #1074 — pure state-threading transition step. Takes the previously persisted band state
+// (serialized `quota_band_state`, may be null/empty on a fresh provider), applies the band-transition
+// hysteresis pipeline for this sample, and returns the new serialized state to persist. Holds no
+// module-level memory, so a relay restart that re-hydrates from the DB continues hysteresis seamlessly
+// instead of re-seeding to "normal" and re-firing an already-sent degradation.
+export function processBandTransitions(
+  input: ProviderQuotaAdvisoryInput,
+  previousBandState?: string | null,
+): string {
+  const bandState = parseJson<BandTransitionState>(previousBandState ?? "{}", {});
   const info = (_bandInfoSupplier ?? getProviderBandInfo)(input.provider, input.now);
-  if (!info) return;
+  if (!info) return JSON.stringify(bandState);
 
   for (const window of info.windows) {
     if (window.confidence === "low" || window.burnRatio === null) continue;
 
     const key = `${input.provider}:${window.role}`;
-    const state: TransitionState = bandState.get(key) ?? {
+    const state: TransitionState = bandState[key] ?? {
       lastNotifiedBand: "normal",
       pendingBand: null,
       pendingCount: 0,
@@ -124,7 +135,7 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
     state.emaUpdatedAt = input.now;
     // Persist immediately so the low-pass state survives every early-continue below (the state is
     // then mutated in place by reference — the EMA must carry across ticks to smooth excursions).
-    bandState.set(key, state);
+    bandState[key] = state;
     const smoothedBand = quotaBandFromSignal(emaPenalty, emaSlack, info.quotaBands, info.preferSlackAt);
 
     // #756 (layer 2): asymmetric hysteresis — recovery needs penalty HYSTERESIS_MARGIN below the
@@ -149,7 +160,6 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
       // #756: rate-limit recovery — it is not an actionable signal for coordinators.
       const isRecovery = bandRank(effectiveBand) < bandRank(state.lastNotifiedBand);
       if (isRecovery && input.now - state.lastTransitionAt < RECOVERY_MIN_INTERVAL_MS) {
-        bandState.set(key, state);
         continue;
       }
 
@@ -158,7 +168,6 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
       state.pendingBand = null;
       state.pendingCount = 0;
       state.lastTransitionAt = input.now;
-      bandState.set(key, state);
       emitBandTransition({
         provider: input.provider,
         window,
@@ -169,10 +178,10 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
         recommendedAction: windowRecommendedAction(effectiveBand, window.slack),
         now: input.now,
       });
-    } else {
-      bandState.set(key, state);
     }
   }
+
+  return JSON.stringify(bandState);
 }
 
 // Asymmetric hysteresis: degradation uses the normal (entry) threshold; recovery requires

package/src/routes/agent-sessions.ts

@@ -2,7 +2,7 @@
 import { RELAY_TOKEN_HEADER, isRecord, isSpawnProvider } from "agent-relay-sdk";
 import { VALID_AGENT_ACTIONS, agentControlActionIcon, auditEvent, authAuditMetadata, authorizeAgentRoute, authorizeRoute, canViewAgentRoute, cleanAttachmentRefs, dashboardAttribution, emitCommand, error, json, metaString, parseBody, requestUserAddress, requestUserId, spawnRequestId, type AgentControlAction, type Handler } from "./_shared";
 import { arbitrateDrive, currentDriver, drivingMessage, releaseDrive, type DriveArbitration } from "../agent-drive-arbiter";
-import { ValidationError, getAgent, getAgentTimeline, getOrchestrator, markReady, mergeAgentMeta, sendMessage, withResolvedProvisioning } from "../db";
+import { ValidationError, getAgent, getAgentTimeline, getOrchestrator, markReady, mergeAgentMeta, readSpawnCallerSystemPromptAppend, resolveAgentOwnership, sendMessage, withResolvedProvisioning } from "../db";
 import { announcePresence, viewersForAgent } from "../dashboard-presence";
 import { buildManagedSpawnParams } from "../managed-policy";
 import { buildSpawnCommand, generateSpawnRequestId, resolveSpawnModelParams } from "../spawn-command";
@@ -19,6 +19,7 @@ import { ShutdownAuthError, ShutdownTargetError, shutdownAgent } from "../servic
 import { type AgentCard, type SpawnApprovalMode } from "../types";
 import { type ProviderEffort } from "agent-relay-sdk/provider-catalog";
 import { getManifest } from "agent-relay-providers";
+import { composeProfileSpawnInstructions } from "../project-instructions";
 import { relayToken } from "../config";
 
 // 409 when a second human tries to drive an agent another user is already driving (#394). The
@@ -95,7 +96,7 @@ function managedControlOrchestrator(agent: AgentCard): NonNullable<ReturnType<ty
   return candidates.find((orch) => orch.status === "online") ?? null;
 }
 
-function restartSpawnParamsForAgent(
+export function restartSpawnParamsForAgent(
   agent: AgentCard,
   orchestrator: NonNullable<ReturnType<typeof getOrchestrator>> | null,
   policyName?: string,
@@ -103,7 +104,15 @@ function restartSpawnParamsForAgent(
   opts: { resumeId?: string } = {},
 ): Record<string, unknown> | undefined {
   if (!orchestrator) return undefined;
-  const requestId = spawnRequestId ?? spawnRequestIdForRestart();
+  // #1065 — mint a FRESH spawnRequestId for the successor, NEVER reuse the predecessor's. Reusing
+  // it voided the #1059 instance guard (exitCertificateMatchesInstance keys death-certificate
+  // identity on spawnRequestId): a late/duplicate exit report for the dead predecessor carried the
+  // same id as the live successor, so the guard treated the stale certificate as a match and
+  // false-reaped the running session (#1054/#1059 reopener). Every other respawn path mints fresh
+  // (lifecycle-manager, spawn-policy) and the runner documents the invariant (control.ts:284). The
+  // predecessor id (`spawnRequestId`) is still used below to recover the #1062 parent brief from the
+  // ORIGINAL agent.spawn command — read before the mint so the brief follows the agent, not the id.
+  const requestId = generateSpawnRequestId();
   const policy = policyName ? getSpawnPolicy(policyName) : null;
   const requestedBy = opts.resumeId ? "dashboard-resume" : "dashboard-restart";
   if (policy) {
@@ -124,6 +133,27 @@ function restartSpawnParamsForAgent(
   const agentProfile = resolvedProfile ? applyDefaultSharedMcp(resolvedProfile) : undefined;
   const workspaceMode = metaString(agent.meta, "workspaceMode") ?? "inherit";
   const resolvedModel = resolveSpawnModelParams(provider, model, effort, { onError: "passthrough", skipDefaultWhenEmpty: true });
+  // #1052-v2 — a dashboard-spawned agent has NO spawn policy, so its restart skips the
+  // `buildManagedSpawnParams` policy branch above and lands here. Re-project the profile role
+  // charter / project knowledge / scoped memory (the SAME projection a fresh spawn gets) so the
+  // relaunch is onboarded byte-identically instead of reverting to provider-default IC behavior.
+  // #1062 — two remaining fresh-spawn divergences closed here: (1) anchor the user/operator scoped
+  // memory to the agent's OWNER via resolveAgentOwnership (a fresh spawn does the same), not the
+  // default operator; and (2) re-thread the parent's ORIGINAL caller brief, recovered from the
+  // persisted agent.spawn command, so a restarted spawned child keeps its task brief.
+  // #1065 — key this on the PREDECESSOR id (`spawnRequestId`), NOT the freshly-minted `requestId`:
+  // the caller brief was persisted on the original agent.spawn command, which the successor's fresh
+  // id has no row for. Recovering it here re-injects the brief onto the new instance.
+  // #1067 — recovery must survive N restarts, not just one. Because #1065 rotates the id every
+  // restart and never writes an agent.spawn row for the successor, a naive single-hop lookup found
+  // the brief on restart #1 (predecessor = original id) but lost it on restart #2 (predecessor =
+  // the fresh id from restart #1, which has no spawn row). Fix: re-persist the RAW brief under the
+  // fresh id below (passed through to `callerSystemPromptAppend` on this restart's `restartSpawn`
+  // params — the SAME field a fresh agent.spawn stashes it in, see spawn-agent.ts). The reader then
+  // recovers it from either the original agent.spawn row OR a later agent.restart row, so each
+  // generation has its own recoverable copy and the brief follows the agent across every rotation.
+  const callerAppend = readSpawnCallerSystemPromptAppend(spawnRequestId);
+  const composed = composeProfileSpawnInstructions({ cwd, operatorId: resolveAgentOwnership(agent.id).ownerUserId, ...(profileName ? { profileName } : {}), ...(agentProfile ? { profile: agentProfile } : {}), ...(callerAppend ? { callerSystemPromptAppend: callerAppend } : {}) });
   const params = buildSpawnCommand({
     provider,
     modelParams: resolvedModel,
@@ -138,6 +168,12 @@ function restartSpawnParamsForAgent(
     approvalMode: approvalMode ?? "guarded",
     permissionMode: approvalMode ?? "guarded",
     providerArgs: providerArgs.length ? providerArgs : undefined,
+    ...(composed.systemPromptAppend ? { systemPromptAppend: composed.systemPromptAppend } : {}),
+    // #1067 — re-persist the RAW brief (pre-composition) under this restart's fresh spawnRequestId so
+    // the NEXT restart, whose predecessor id is this fresh id, can recover it. Without this the brief
+    // survives only one restart (the original agent.spawn row is keyed on the very first id).
+    ...(callerAppend ? { callerSystemPromptAppend: callerAppend } : {}),
+    ...(composed.relayInjectionEvents.length ? { relayInjectionEvents: composed.relayInjectionEvents } : {}),
     policyName: policyName || undefined,
     headless: true,
     spawnRequestId: requestId,
@@ -157,10 +193,6 @@ function restartSpawnParamsForAgent(
   return opts.resumeId ? withResumeParams(params, opts.resumeId, agent.id) : params;
 }
 
-function spawnRequestIdForRestart(): string {
-  return generateSpawnRequestId();
-}
-
 function withResumeParams(params: Record<string, unknown>, resumeId: string, agentId: string): Record<string, unknown> {
   return {
     ...params,

package/src/routes/agents.ts

@@ -2,6 +2,7 @@
 import { VALID_AGENT_STATUSES, agentSessionStatus, auditEvent, canViewAgentRoute, error, json, memoryContext, memoryErrorResponse, normalizeAgentSessionGuard, parseBody, parseId, parseQueryInt, visibleAgentIdsForRequest, type Handler } from "./_shared";
 import { ValidationError, deleteAgent, getAgent, getAgentTimeline, getCrashReport, heartbeat, listAgentChatHistory, listAgents, listArtifactsForEntity, listContextSnapshots, listPendingReplyObligations, listQuotaSnapshots, markReady, searchAgents, setLabel, setStatus, setTags, validateAgentSession } from "../db";
 import { attachBranchState, attachBranchStates } from "../agent-branch-state";
+import { attachCommandActivities, attachCommandActivity } from "../agent-command-activity";
 import { attachIssueRepo, attachIssueRepos } from "../agent-issue-repo";
 import { cleanStringArray } from "../validation";
 import { clearActiveMemories, memoryBroker } from "../memory-service";
@@ -53,7 +54,7 @@ export const getAgents: Handler = (req) => {
   // (visibleAgentIdsForRequest returns every id), so today's list is byte-for-byte unchanged.
   const agents = listAgents({ tag, machine, status });
   const visible = visibleAgentIdsForRequest(req, agents.map((a) => a.id));
-  return json(attachIssueRepos(attachBranchStates(agents.filter((a) => visible.has(a.id)))));
+  return json(attachCommandActivities(attachIssueRepos(attachBranchStates(agents.filter((a) => visible.has(a.id))))));
 };
 
 export const findAgents: Handler = (req) => {
@@ -69,7 +70,7 @@ export const getAgentById: Handler = (req, params) => {
   if (!agent) return error("agent not found", 404);
   // #392: a non-visible agent must look indistinguishable from a missing one (no existence leak).
   if (!canViewAgentRoute(req, agent.id)) return error("agent not found", 404);
-  return json(attachIssueRepo(attachBranchState(agent)));
+  return json(attachCommandActivity(attachIssueRepo(attachBranchState(agent))));
 };
 
 // #636 — "why did it die" data source. The crash report outlives the agent row (separate table),

package/src/routes/tasks.ts

@@ -3,9 +3,9 @@ import { MAX_BODY_BYTES } from "../config";
 import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacks, emitCommand, error, json, normalizeAgentSessionGuard, parseBody, parseId, parseQueryInt, resolveActorLabel, type Handler } from "./_shared";
 import { getComponentAuth, isFullReachRequest } from "../security";
 import { authContextFromRequest } from "../services/auth-context";
-import { agentIdFromComponent, isTaskDispatchAuthorized, isTaskReadAuthorized } from "../task-authz";
+import { agentIdFromComponent, hasTaskReadAdminScope, isTaskDispatchAuthorized, isTaskReadAuthorized } from "../task-authz";
 import { dispatchShapeArg, pinArg, runTaskDispatch } from "../mcp-dispatch-tools";
-import { ValidationError, claimTask, getMessage, getTask, listTaskEvents, listTasks, recordTaskEvent, renewTaskClaim, updateTaskStatus } from "../db";
+import { ValidationError, claimTask, getMessage, getTask, listTaskEvents, listTasks, recordTaskEvent, renewTaskClaim, updateTaskStatus, type TaskStatusActor } from "../db";
 import { readTaskMemoryEnvelope } from "../db/task-memory";
 import {
   addTaskEntityDependency, addTaskEntityRef, assignTaskEntityAgent, createTaskEntity, getTaskEntity,
@@ -531,9 +531,21 @@ export const patchTaskStatus: Handler = async (req, params) => {
   if (id === null) return error("invalid task id");
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
+  // Ownership fence (#1063): bind the write to the AUTHENTICATED caller, not the request body.
+  // Full-reach/system callers and task-admin scopes bypass (same convention as isTaskDispatchAuthorized
+  // / #1043's ensureCanMintThread); an ordinary task:write holder is pinned to its own agent id and
+  // can only advance a task it actually owns. An unidentified non-privileged caller is refused rather
+  // than silently falling back to the owner id.
+  const ctx = authContextFromRequest(req);
+  const privileged = ctx.actor.kind === "system" || hasTaskReadAdminScope(ctx.scopes);
+  if (!privileged && !ctx.callerAgentId) return error("task status requires an identified caller", 403);
+  const actor: TaskStatusActor = privileged ? { privileged: true } : { agentId: ctx.callerAgentId };
   try {
-    const result = updateTaskStatus(id, normalizeTaskStatusInput(parsed.body));
-    if (!result.ok) return error(result.error!, result.error === "task not found" ? 404 : agentSessionStatus(result.error));
+    const result = updateTaskStatus(id, normalizeTaskStatusInput(parsed.body), actor);
+    if (!result.ok) {
+      const status = result.error === "task not found" ? 404 : result.conflict ? 409 : agentSessionStatus(result.error);
+      return error(result.error!, status);
+    }
     emitTaskChanged(result.task!, "task.status");
     const capturedMemory = result.task!.status === "done"
       ? await captureTaskResultMemory(result.task!, result.task!.result)

package/src/routes/workspaces.ts

@@ -433,6 +433,12 @@ export const postWorkspaceCleanupStale: Handler = async (req) => {
   const workspaceId = cleanString(body.workspaceId, "workspaceId", { max: 160 });
   const dryRun = body.dryRun !== false; // safe by default
   const landedOnly = true;
+  // #965 — an explicit operator force-discard for a genuinely-abandoned branch: clear even when
+  // git state is a conflict / unlanded / unprobeable. The land-safety gate is correct for LIVE
+  // work but wrong for a confirmed-abandoned branch, which otherwise left a raw DELETE as the only
+  // path. Gated hard on the owner NOT being online (force can never override liveness) and, like
+  // every mutation here, on `--execute` (dryRun:false) — the two together are the confirmation.
+  const force = body.force === true;
 
   const candidates = listWorkspaces().filter((ws) =>
     ws.mode === "isolated" && Boolean(ws.worktreePath) && !TERMINAL_WORKSPACE_STATUSES.has(ws.status)
@@ -455,22 +461,41 @@ export const postWorkspaceCleanupStale: Handler = async (req) => {
     const landed = gitState?.landed === true;
     // Safe = gone from disk, OR clean tree with no unmerged work (landed/empty).
     const safe = missing || (gitState !== undefined && (dirtyCount ?? 1) === 0 && (!landedOnly || landed || ahead === 0));
+    // #965 — a force-discard clears an unsafe (conflict/unlanded/unprobeable) row too, but only
+    // for an offline owner. #1066: the `ownerOnline` snapshot above predates the
+    // `fetchWorkspaceGitState` await, so it is stale by dispatch time; liveness is re-verified
+    // immediately before dispatch below. Force overrides the land-safety gate, NEVER liveness.
+    const forced = force && !safe;
+    const discardable = safe || force;
     const proof = { ownerStatus: owner?.status ?? "missing", ownerOnline, ahead, behind: gitState?.behind, landed, dirtyCount, missing, gitStateUnavailable: gitState ? undefined : ("unavailable" in fetched ? fetched.unavailable : undefined) };
-    const row: Record<string, unknown> = { workspaceId: ws.id, branch: ws.branch, worktreePath: ws.worktreePath, repoRoot: ws.repoRoot, safe, proof };
-    if (safe && !dryRun) {
-      const built = buildWorkspaceCleanupCommand(ws, "cleanup-stale");
-      if (built.ok) {
-        updateWorkspaceStatus(ws.id, "cleanup_requested", { lastWorkspaceAction: "cleanup-stale", lastWorkspaceActionAt: Date.now(), cleanupProof: proof });
-        emitCommand(built.command);
-        row.commandId = built.command.id;
-        cleaned.push(ws.id);
+    const row: Record<string, unknown> = { workspaceId: ws.id, branch: ws.branch, worktreePath: ws.worktreePath, repoRoot: ws.repoRoot, safe, discardable, ...(forced ? { forced: true } : {}), proof };
+    if (discardable && !dryRun) {
+      // #1066 — re-snapshot liveness AFTER the git-state probe, immediately before dispatch. An
+      // owner offline at the initial snapshot can reconnect during the probe window (relay lag —
+      // #1054), and `force` bypasses buildWorkspaceCleanupCommand's dispatch-time live-owner guard,
+      // so this route is the only place that can refuse a just-reconnected owner under force.
+      // Force may clear an unsafe/conflict/unlanded row, but it must never nuke a live owner's tree.
+      if (isOwnerAlive(ws.ownerAgentId)) {
+        row.discardable = false;
+        row.cleanupError = `workspace ${ws.id} owner reconnected during git-state probe; force cannot override liveness`;
+        row.proof = { ...proof, ownerOnline: true };
       } else {
-        row.cleanupError = built.error;
+        // Owner re-confirmed offline just above; force past buildWorkspaceCleanupCommand's
+        // live-owner guard and carry a reason so the host records an intentional force-discard.
+        const built = buildWorkspaceCleanupCommand(ws, "cleanup-stale", forced ? { force: true, reason: "operator force-discard: abandoned branch, owner offline" } : {});
+        if (built.ok) {
+          updateWorkspaceStatus(ws.id, "cleanup_requested", { lastWorkspaceAction: "cleanup-stale", lastWorkspaceActionAt: Date.now(), cleanupProof: { ...proof, forced } });
+          emitCommand(built.command);
+          row.commandId = built.command.id;
+          cleaned.push(ws.id);
+        } else {
+          row.cleanupError = built.error;
+        }
       }
     }
     rows.push(row);
   }
-  return json({ dryRun, landedOnly, repoRoot, ...(workspaceId ? { workspaceId } : {}), scanned: candidates.length, eligible: rows.filter((r) => r.safe).length, cleaned, candidates: rows }, dryRun ? 200 : 202);
+  return json({ dryRun, landedOnly, force, repoRoot, ...(workspaceId ? { workspaceId } : {}), scanned: candidates.length, eligible: rows.filter((r) => r.discardable).length, cleaned, candidates: rows }, dryRun ? 200 : 202);
 };
 
 export const postWorkspaceAction: Handler = async (req, params) => {

package/src/services/plan-graph.ts

@@ -1,4 +1,4 @@
-import { isRecord } from "agent-relay-sdk";
+import { hasScope, isRecord } from "agent-relay-sdk";
 import { addTaskDependency, createPlanRow, deletePlan, getAgent, getEntry, getPlan, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlan, sendMessage, setPlanArchived, ValidationError } from "../db";
 import { associateIssue, planNodeIssueEntityId, removeAssociation } from "../db/issue-associations";
 import { resolveIssueRefFromString } from "../db/issue-refs";
@@ -9,6 +9,7 @@ import { issueRepoForAgent } from "../agent-issue-repo";
 import { buildTaskGraphView, parseTaskId, planStatusToTaskStatus, projectPlanOverTasks } from "./task-plan-view";
 import { createTaskEntity, setTaskEntityStatus } from "./task-entity";
 import type { AuthContext } from "./auth-context";
+import { ServiceAuthError } from "./errors";
 import type { AgentCard, Plan, PlanEdge, PlanNode, PlanOwnerRef, PlanStatus } from "../types";
 
 export const PLAN_STATUSES = ["pending", "in-progress", "landed", "blocked"] as const;
@@ -37,7 +38,7 @@ interface PlanNodePatch {
 }
 
 interface PlanCreateInput {
-  threadId: unknown;
+  threadId?: unknown;
   teamId?: unknown;
   channel?: unknown;
   title?: unknown;
@@ -269,7 +270,9 @@ function emitPlan(type: "plan.created" | "plan.changed" | "plan.deleted", plan:
 // thread server-side by self-threading a lightweight system message (the same sendMessage path the
 // caller would have used). Sent AS the actor when that agent is registered, else the reserved
 // `system` sink, so the mint always passes the sender-registration gate.
-function mintPlanThread(actor: string, channel: string | undefined): number {
+function mintPlanThread(ctx: AuthContext, channel: string | undefined): number {
+  ensureCanMintThread(ctx);
+  const actor = actorId(ctx);
   const sender = getAgent(actor) ? actor : "system";
   const root = sendMessage({
     from: sender,
@@ -280,24 +283,39 @@ function mintPlanThread(actor: string, channel: string | undefined): number {
   return root.threadId ?? root.id;
 }
 
+// #1043: the mint inserts a real message row through the db `sendMessage` path, which normally
+// lives behind the `message:send` scope. `plans:write` alone must not be a side-door around it, so
+// gate the mint on `message:send`. Internal `system` principals (empty-scope trusted callers) and
+// full-reach `*` tokens pass through untouched — `hasScope` short-circuits `*`.
+function ensureCanMintThread(ctx: AuthContext): void {
+  if (ctx.actor.kind === "system") return;
+  if (!hasScope(ctx.scopes, "message:send")) {
+    throw new ServiceAuthError("minting a plan thread requires the message:send scope");
+  }
+}
+
 export function createPlan(input: PlanCreateInput, ctx: AuthContext): Plan {
   const channel = cleanString(input.channel, "channel", { max: 120 });
   const actor = actorId(ctx);
-  const threadId = input.threadId === undefined || input.threadId === null
-    ? mintPlanThread(actor, channel)
-    : cleanThreadId(input.threadId);
-  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const explicitTeamId = cleanString(input.teamId, "teamId", { max: 120 });
   const teamId = explicitTeamId ?? (input.teamId === undefined || input.teamId === null ? getAgent(actor)?.teamId : undefined);
   const nodes = cleanNodes(input.nodes, actor, teamId);
   const edges = cleanEdges(input.edges);
   validateEdges(nodes, edges);
+  const title = cleanString(input.title, "title", { max: 240 });
+  const objective = cleanString(input.objective, "objective", { max: 4000 });
+  // Resolve the thread only AFTER the payload validates (#1043): auto-minting first left an orphan
+  // 'Plan thread root' row behind on every rejected create.
+  const threadId = input.threadId === undefined || input.threadId === null
+    ? mintPlanThread(ctx, channel)
+    : cleanThreadId(input.threadId);
+  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const plan = createPlanRow({
     threadId,
     teamId,
     channel,
-    title: cleanString(input.title, "title", { max: 240 }),
-    objective: cleanString(input.objective, "objective", { max: 4000 }),
+    title,
+    objective,
     nodes,
     edges,
     createdBy: actor,

package/src/services/register-agent.ts

@@ -10,7 +10,7 @@
 // status broadcast, the single timeline note, the spawned-child parent-wake, and
 // the first-registration audit row.
 import { errMessage, isReservedAgentId } from "agent-relay-sdk";
-import { ValidationError, createActivityEvent, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, mergeAgentMeta, readSpawnReportVerbosity, revokeSupersededRuntimeTokens, seedSpawnPromptMirror, seedSpawnReplyObligation, upsertAgent } from "../db";
+import { ValidationError, createActivityEvent, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, mergeAgentMeta, readSpawnReportVerbosity, seedSpawnPromptMirror, seedSpawnReplyObligation, upsertAgent } from "../db";
 import { emitAgentStatus, emitNewMessage } from "../sse";
 import { noteAgentTimelineEvent } from "../compaction-watch";
 import { agentProviderTimelineEvent } from "../provider-timeline-event";
@@ -91,18 +91,18 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext): Agen
   // Registration labels are spawn defaults. Runtime /label changes remain authoritative.
   const registrationInput = existing ? { ...input } : input;
   if (existing) delete registrationInput.label;
-  const agent = upsertAgent(registrationInput);
-
   // #1051/#484 — instance takeover is where the restart-strand invariant fires now that a
-  // heartbeat lapse no longer revokes anything. When a FRESH runner process re-registers
-  // under this agent id (new instanceId → epoch bump), revoke the PRIOR instance's runtime
-  // tokens "stale": they can no longer authenticate a request directly, yet stay re-mintable
-  // via the orchestrator (#484). A same-instance reconnect keeps its instanceId, so the epoch
-  // is unchanged and the live token is left valid — the whole point of #1051 (in-band recovery
-  // after lag/relay-restart without a re-mint).
-  if (existing?.instanceId && agent.instanceId && existing.instanceId !== agent.instanceId) {
-    revokeSupersededRuntimeTokens(existing, agent);
-  }
+  // heartbeat lapse no longer revokes anything. When a FRESH runner process re-registers under
+  // this agent id, the epoch bump inside upsertAgent atomically revokes the PRIOR instance's
+  // runtime tokens "stale": refused for auth yet re-mintable via the orchestrator (#484). A
+  // same-instance reconnect keeps its instanceId, so the epoch is unchanged and the live token
+  // is left valid — the whole point of #1051 (in-band recovery after lag without a re-mint).
+  // #1057(3) — the ONLY jti spared from that revoke is server-verified: the token that
+  // authenticated THIS registration, and only when it resolves to this very agent (a
+  // same-credential instance rotation, e.g. a respawn reusing its unexpired env token).
+  // Client-sent meta.auth can no longer nominate jtis to keep.
+  const verifiedKeepJti = ctx.callerAgentId === input.id ? ctx.component?.jti : undefined;
+  const agent = upsertAgent(registrationInput, verifiedKeepJti ? { verifiedKeepJtis: [verifiedKeepJti] } : undefined);
 
   // Managed came-up-running reconcile — no-op for non-managed agents (the guard lives
   // in markManagedAgentRunning). Clears backoff, flushes the policy queue, transitions

package/src/services/send-message.ts

@@ -21,12 +21,13 @@
 //
 // OUT OF SCOPE (transport-edge, excluded from the parity facet): automatic memory injection
 // (needs request-derived context) and per-transport audit (HTTP domain row vs MCP tool-call row).
-import { canonicalHumanAgentId, isHumanAgentId, isMechanicalMessageKind, isRecord, isReservedAgentId } from "agent-relay-sdk";
+import { canonicalHumanAgentId, isHumanAgentId, isMechanicalMessageKind, isRecord, isReservedAgentId, isTurnFinalSession } from "agent-relay-sdk";
 import {
   ValidationError,
   flushDeferredLineageReport,
   getAgent,
   getMessage,
+  latestInboundMessage,
   listAgents,
   listRecentFinalResponseCaptures,
   promoteLineageCapturedResponse,
@@ -287,6 +288,14 @@ function emitSendResults(results: DbSendMessageResult[]): void {
   emitNewMessages(liveMessages);
 }
 
+// #976 — a spawned child (results-only profile) whose turn-final response Relay already promotes to
+// its spawn-parent does not also need to fire a bare ack/report via relay_send_message. Codex workers
+// do this routinely ("Noted.", "Cleared.", "Going forward I'll…", or a duplicate of the final report),
+// and each redundant message wakes the coordinator and burns the context coordinators exist to
+// protect. This ONE home suppresses such acks on BOTH transports (HTTP + MCP) and BOTH providers
+// (codex + claude): a reply-path ack collapses onto its parent; a standalone self→parent ack (no
+// replyTo — the codex relay_send_message leak) collapses onto the latest inbound it answers. A
+// genuine result (final capture, a session-final step, or non-ack body) always passes through.
 function suppressResultsOnlyAck(input: SendMessageInput): Message | null {
   if (input.kind && input.kind !== "chat" && input.kind !== "session") return null;
   const sender = getAgent(input.from);
@@ -296,21 +305,40 @@ function suppressResultsOnlyAck(input: SendMessageInput): Message | null {
   if (!isPassiveAck(input.body)) return null;
   if (isRecord(input.payload?.responseCapture)) return null;
   const session = isRecord(input.payload?.session) ? input.payload.session : undefined;
-  if (session?.final === true) return null;
-  return input.replyTo ? getMessage(input.replyTo) : null;
+  if (isTurnFinalSession(session)) return null;
+  // Reply-path: collapse onto the parent message being acked.
+  if (input.replyTo) return getMessage(input.replyTo);
+  // Standalone self→parent path (#976): only a spawned child acking its OWN spawn-parent. Anchor to
+  // the latest inbound from that parent so the drop mirrors the reply-path collapse; if there is no
+  // prior inbound to anchor to, deliver (never drop a message we can't attribute to a conversation).
+  if (sender?.spawnedBy && sender.spawnedBy === input.to) {
+    return latestInboundMessage(input.from, sender.spawnedBy);
+  }
+  return null;
 }
 
+// Exact-match ceremonial acks (after normalization). Kept an explicit set — high precision, so a
+// real short status ("Cleared the queue", "PASS") never matches, only the bare acknowledgement.
+const PASSIVE_ACK_PHRASES = new Set([
+  "noted", "noted standing by",
+  "acknowledged", "acknowledged standing by",
+  "standing by", "ok standing by", "okay standing by",
+  "understood", "understood standing by",
+  "cleared", "will do", "will do standing by", "will comply",
+  "on it", "got it", "roger", "roger that", "copy", "copy that",
+  "sounds good", "ok", "okay", "okay will do", "thanks", "thank you",
+  "no problem", "no worries",
+]);
+
+// A short SELF-REFERENTIAL acknowledgement of an instruction about the agent's OWN reporting
+// behavior ("Going forward, I'll only use Relay mid-task…"). Bounded length + it must name the
+// messaging/reporting channel, so a genuine forward-looking REPORT that happens to open with
+// "going forward" ("going forward the build fails unless we bump node") still passes through.
+const REPORTING_META_ACK = /^(going forward|from now on)\b.{0,160}\b(relay|messages?|acks?|reports?|reporting|pings?|notif\w*)\b/;
+
 function isPassiveAck(body: string): boolean {
-  const text = body.toLowerCase().replace(/[.!]+/g, "").replace(/\s+/g, " ").trim();
-  return [
-    "noted",
-    "noted standing by",
-    "acknowledged",
-    "acknowledged standing by",
-    "standing by",
-    "ok standing by",
-    "okay standing by",
-    "understood",
-    "understood standing by",
-  ].includes(text);
+  const text = body.toLowerCase().replace(/[.!,…]+/g, " ").replace(/\s+/g, " ").trim();
+  if (!text) return false;
+  if (PASSIVE_ACK_PHRASES.has(text)) return true;
+  return text.length <= 160 && REPORTING_META_ACK.test(text);
 }

package/src/services/spawn-agent.ts

@@ -647,6 +647,9 @@ export async function spawnAgent(input: SpawnAgentInput, ctx: AuthContext): Prom
       providerArgs: input.providerArgs ?? [],
       prompt: resolvedPrompt,
       systemPromptAppend,
+      // #1062 — stash the RAW caller brief (pre-composition) so a dashboard (non-policy) restart can
+      // re-thread it as callerSystemPromptAppend and stay fresh-spawn-identical instead of dropping it.
+      ...(resolvedSystemPromptAppend ? { callerSystemPromptAppend: resolvedSystemPromptAppend } : {}),
       relayInjectionEvents: composedInstructions.relayInjectionEvents,
       landStrategy: input.landStrategy,
       autoMerge: input.autoMerge,