cartethyia 2.5.9 → 2.6.0

package/src/transport/routing/route-catalog.ts

@@ -30,6 +30,7 @@ import { DEFAULT_PROXY_SKIP_PROVIDER_IDS } from "../../providers/provider-metada
 import { buildClaudeCliUserAgent } from "../../providers/operations/custom-cli-headers";
 import { isBundledProviderId } from "../../providers/provider-contracts";
 import type { ServiceKind, WireFamily } from "../../protocol/canonical-model";
+import { BoundedLruMap } from "./bounded-lru";
 import { providerHasAdapterUserAgent, providerUsesBespokeWire } from "../../providers/provider-metadata";
 
 const CLAUDE_MODEL_FAMILIES = new Set(["opus", "sonnet", "haiku", "fable", "mythos"]);
@@ -156,17 +157,28 @@ export function buildCapabilityProfile(row: {
 }
 
 /**
- * The capability profile for one model row, memoized across rebuilds.
- *
- * Bounded LRU keyed by `providerId/modelId`: the value is a pure function of
- * the row's metadata, so two rebuilds that see the same row get the same object
- * instead of two identical ones. The bound keeps a long-lived process from
- * pinning one profile per row it has ever seen — a model deleted from the
- * catalog must not leave its profile behind forever.
+ * Upper bound on the capability-profile memo. Same value as the hand-rolled
+ * bound it replaces: far above any real catalog, so eviction only ever targets
+ * rows deleted from the catalog.
  */
 const CAPABILITY_PROFILE_CACHE_MAX_ENTRIES = 4096;
-const capabilityProfileCache = new Map<string, Record<string, boolean>>();
+const capabilityProfileCache = new BoundedLruMap<string, Record<string, boolean>>(
+  CAPABILITY_PROFILE_CACHE_MAX_ENTRIES,
+);
 
+/**
+ * The capability profile for one model row, memoized across rebuilds.
+ *
+ * The value is a pure function of the row's metadata, so two rebuilds that see
+ * the same row get the same object instead of two identical ones. The cache is
+ * a {@link BoundedLruMap} keyed by `providerId/modelId` **plus the row's
+ * modalities**: the key must change when the operator edits a row's modalities
+ * (text-only → vision), otherwise the rebuild would hand routing the stale
+ * pre-edit profile until the entry aged out of the LRU. A row that has never
+ * carried modality metadata keys with `null`, which only collides with another
+ * metadata-less row for the same provider/model — the same profile by
+ * construction.
+ */
 function capabilityProfileFor(row: {
   modalities: unknown;
   reasoning: boolean;
@@ -174,14 +186,10 @@ function capabilityProfileFor(row: {
   providerId: string;
   modelId: string;
 }): Record<string, boolean> {
-  const key = `${row.providerId}/${row.modelId}`;
+  const key = `${row.providerId}/${row.modelId}/${JSON.stringify(row.modalities ?? null)}`;
   const cached = capabilityProfileCache.get(key);
   if (cached !== undefined) return cached;
   const profile = buildCapabilityProfile(row);
-  if (capabilityProfileCache.size >= CAPABILITY_PROFILE_CACHE_MAX_ENTRIES) {
-    const oldest = capabilityProfileCache.keys().next().value;
-    if (oldest !== undefined) capabilityProfileCache.delete(oldest);
-  }
   capabilityProfileCache.set(key, profile);
   return profile;
 }
@@ -421,10 +429,14 @@ class RouteCatalogRepository {
      * preference's own doc.
      */
     const cooldownOverrideTenants = new Set<string>();
+    const invokeDisabledTenants = new Set<string>();
     for (const row of settingsRows ?? []) {
       if (row.preferences?.forceDisableCooldown === true && row.tenantId) {
         cooldownOverrideTenants.add(row.tenantId);
       }
+      if (row.preferences?.invokeDisabled === true && row.tenantId) {
+        invokeDisabledTenants.add(row.tenantId);
+      }
     }
     /**
      * A shared account has no tenant of its own (`tenant_id IS NULL`), so a
@@ -843,6 +855,7 @@ class RouteCatalogRepository {
       combos,
       ...(routingMap ? { providerRouting: routingMap } : {}),
       ...(Object.keys(poolRouting).length > 0 ? { poolRouting } : {}),
+      ...(invokeDisabledTenants.size > 0 ? { invokeDisabledTenants } : {}),
     };
   }
 }

package/src/transport/routing/route-model.ts

@@ -199,6 +199,15 @@ export interface RouteSnapshot {
   readonly providerRouting?: ProviderRoutingMap;
   /** Optional per-tenant pool selection strategy (absent = `least_loaded`). */
   readonly poolRouting?: Readonly<Record<string, PoolRoutingSetting>>;
+  /**
+   * Tenants whose invoke switch is off, so `/v1/*` must be refused outright.
+   *
+   * Read from the cached snapshot rather than per request: it is a console
+   * preference write, and the snapshot is already invalidated when one lands, so
+   * the switch takes effect on the next request without adding a query to the
+   * proxy path.
+   */
+  readonly invokeDisabledTenants?: ReadonlySet<string>;
 }
 
 export type EligibilityReason =
@@ -247,8 +256,19 @@ export interface AdmissionDecision {
 export interface AdmissionController {
   admit(candidate: RouteCandidate): Promise<AdmissionDecision>;
   release(reservation: Reservation): Promise<void>;
-  /** Observable current counters by admission bucket (`provider:model[:account]`). */
-  snapshotAccountInflight?(): Promise<ReadonlyMap<string, number>> | ReadonlyMap<string, number>;
+  /**
+   * Current inflight counts for exactly the buckets the given candidates draw
+   * from, keyed by the unprefixed admission bucket (`provider:model[:account]`).
+   *
+   * Required, not optional: the previous fleet-wide
+   * `snapshotAccountInflight()` was the only reason `plan()` could issue a
+   * Redis `KEYS` on the request path. Scoped reads make the ordering cost
+   * proportional to the candidates being ordered, and an empty input must be
+   * answerable with zero backend commands.
+   */
+  readAccountInflight(
+    candidates: readonly RouteCandidate[],
+  ): Promise<ReadonlyMap<string, number>> | ReadonlyMap<string, number>;
 }
 
 /**

package/src/transport/routing/router.ts

@@ -25,24 +25,17 @@ import {
 import { planAllowsCandidate } from "./plan-gate";
 import { InMemoryAdmissionController, admissionKey } from "./admission";
 import { ReservationManager } from "./reservations";
-import { getOrCreateRoundRobin, RoundRobinState } from "./round-robin";
+import { createRoundRobinMap, RoundRobinState } from "./round-robin";
+import {
+  lookupRouteCandidates,
+  parseModelReference,
+  routeCandidateIndex,
+} from "./candidate-index";
 import { totalRemainingCredit, totalRemainingPercent, type ProviderQuotaWindow } from "../../providers/quota/quota-contracts";
 import { getCachedQuotaEntry, quotaLens } from "../../console/quota/cache";
 import type { RedisClient } from "../../persistence/redis";
 import { sharedClaudeSlowLanes } from "../../providers/integrations/claude/claude-slow-lane";
 
-function parseModel(model: string): { providerId: string | null; bare: string } {
-  const slash = model.indexOf("/");
-  if (slash === -1) return { providerId: null, bare: model };
-  return { providerId: model.slice(0, slash), bare: model.slice(slash + 1) };
-}
-
-function candidateMatches(candidate: RouteCandidate, model: string): boolean {
-  const parsed = parseModel(model);
-  if (parsed.providerId === null) return candidate.model_id === parsed.bare;
-  return candidate.model_id === parsed.bare && candidate.provider_id === parsed.providerId;
-}
-
 /**
  * True when the account's remaining allowance is at or below its provider's
  * floor. Credit mode sums the absolute remaining credit; percent mode uses the
@@ -352,8 +345,8 @@ export class EligibilityEvaluator {
 }
 
 export class RoutingEngine {
-  private readonly _roundRobinByCombo = new Map<string, RoundRobinState>();
-  private readonly _roundRobinByProvider = new Map<string, RoundRobinState>();
+  private readonly _roundRobinByCombo = createRoundRobinMap();
+  private readonly _roundRobinByProvider = createRoundRobinMap();
   private readonly eligibility = new EligibilityEvaluator();
   private readonly reservations = new ReservationManager();
 
@@ -363,11 +356,19 @@ export class RoutingEngine {
   ) {}
 
   private getRoundRobin(key: string): RoundRobinState {
-    return getOrCreateRoundRobin(this._roundRobinByCombo, key);
+    const existing = this._roundRobinByCombo.get(key);
+    if (existing) return existing;
+    const created = new RoundRobinState();
+    this._roundRobinByCombo.set(key, created);
+    return created;
   }
 
   private getProviderRoundRobin(key: string): RoundRobinState {
-    return getOrCreateRoundRobin(this._roundRobinByProvider, key);
+    const existing = this._roundRobinByProvider.get(key);
+    if (existing) return existing;
+    const created = new RoundRobinState();
+    this._roundRobinByProvider.set(key, created);
+    return created;
   }
 
   /** Observable bounded-collection sizes for the runtime metrics sampler. */
@@ -375,11 +376,20 @@ export class RoutingEngine {
     return { combo: this._roundRobinByCombo.size, provider: this._roundRobinByProvider.size };
   }
 
-  /** Live admission counters by `provider:model[:account]` bucket. */
-  async accountInflightSnapshot(): Promise<ReadonlyMap<string, number>> {
-    // Both controllers hand back a fresh map, so no defensive copy here —
-    // this feeds an admin read, not a mutation site.
-    return (await this.admission.snapshotAccountInflight?.()) ?? new Map();
+  /**
+   * Live admission counters for the buckets the given candidates draw from.
+   *
+   * Takes candidates rather than returning a fleet-wide snapshot: the scoped
+   * read is what keeps `plan()` off Redis `KEYS` (the fleet-wide read had no
+   * other implementation) and bounds the console's per-provider read to the
+   * accounts it will actually report on. Both controllers hand back a fresh
+   * map, so no defensive copy here — this feeds an admin read, not a mutation
+   * site.
+   */
+  async accountInflightSnapshot(
+    candidates: readonly RouteCandidate[],
+  ): Promise<ReadonlyMap<string, number>> {
+    return this.admission.readAccountInflight(candidates);
   }
 
   /**
@@ -402,7 +412,12 @@ export class RoutingEngine {
       (candidate) => typeof candidate.max_inflight === "number" && candidate.max_inflight > 0,
     );
     if (bounded.length === 0) return new Set();
-    const snapshot = await this.accountInflightSnapshot().catch(() => new Map<string, number>());
+    // Only the bounded candidates can be saturated, so only their buckets are
+    // read. A failed ordering read must never fail routing — the admission
+    // attempt itself is the real gate; this read only optimizes attempt order.
+    const snapshot = await this.accountInflightSnapshot(bounded).catch(
+      () => new Map<string, number>(),
+    );
     if (snapshot.size === 0) return new Set();
     const saturated = new Set<RouteCandidate>();
     for (const candidate of bounded) {
@@ -792,16 +807,23 @@ export class RoutingEngine {
       ? combo.members.flatMap((name) => expandMember(name, new Set([resolved.model])))
       : [resolved.model];
     const modelIds = [...new Set(rawModelIds)];
-    let matching = snapshot.candidates.filter(
-      (candidate) =>
-        modelIds.some((id) => candidateMatches(candidate, id)) &&
-        (candidate.tenant_id == null || candidate.tenant_id === tid),
-    );
+    // One index build per snapshot (cached on the immutable snapshot), one
+    // lookup per unique resolved model. The previous shape rescanned every
+    // candidate per model — O(C×K) string parses per plan — which was the
+    // quadratic cost the catalog rebuild had already paid once and the request
+    // path was paying again on every plan.
+    const index = routeCandidateIndex(snapshot);
+    const parsedModels = modelIds.map((id) => ({ id, parsed: parseModelReference(id) }));
+    let matching = parsedModels.flatMap((entry) => lookupRouteCandidates(index, entry.parsed, tid));
+    // Preserve the resolver's flatten-then-dedupe contract: one candidate can
+    // serve two member groups only via a combo listing the same model twice,
+    // and the plan must not dial it twice.
+    matching = [...new Set(matching)];
     let unmatchedMembers: readonly string[] = [];
     if (combo) {
-      const perId = modelIds.map((id) => ({
-        id,
-        group: matching.filter((c) => candidateMatches(c, id)),
+      const perId = parsedModels.map((entry) => ({
+        id: entry.id,
+        group: lookupRouteCandidates(index, entry.parsed, tid),
       }));
       unmatchedMembers = perId.filter((entry) => entry.group.length === 0).map((entry) => entry.id);
       const groups = perId.map((entry) => entry.group).filter((g) => g.length > 0);

package/src/transport/surface/chat/encode.ts

@@ -1,6 +1,7 @@
 import type { CanonicalEvent, CanonicalStopReason } from "../../../protocol/canonical-model";
 import { jsonrepair } from "jsonrepair";
 import { reasoningSummaryIdentity, reasoningSummarySeparator, type ReasoningSummaryIdentity } from "../reasoning-summary";
+import { reasoningTextOf } from "../../../protocol/reasoning-text";
 import { eventText } from "../adapters";
 import { isRecord } from "../../../protocol/codecs";
 import {
@@ -113,9 +114,7 @@ export function eventAudio(event: CanonicalEvent): Record<string, unknown> | und
 
 export function eventReasoningText(event: CanonicalEvent): string | undefined {
   if (event.type !== "content_delta" || event.content.kind !== "reasoning") return undefined;
-  if (event.content.opaque === true) return undefined;
-  if (typeof event.content.payload === "string") return event.content.payload;
-  return typeof event.content.summary === "string" ? event.content.summary : undefined;
+  return reasoningTextOf(event.content);
 }
 
 function mergedReasoningText(events: readonly CanonicalEvent[]): string {

package/src/transport/surface/chat/parse.ts

@@ -1,6 +1,7 @@
 import type { CanonicalMessage, ContentPart, GenerationControls } from "../../../protocol/canonical-model";
 import type { SurfaceInput } from "../adapters";
 import { isRecord } from "../../../protocol/codecs";
+import { asNumber } from "../../../shared/coerce";
 import { textPart, normalizeInlineFile } from "../content-parts";
 import { SERVICE_TIERS } from "../dialects";
 import { readNumber, readString } from "../../../protocol/codecs";
@@ -75,7 +76,7 @@ export function requestBody(input: unknown): unknown {
 }
 
 export function nonNegativeNumber(value: unknown): number | undefined {
-  const number = typeof value === "number" && Number.isFinite(value) ? value : undefined;
+  const number = asNumber(value);
   return number !== undefined && number >= 0 ? number : undefined;
 }
 

package/src/transport/surface/dialects.ts

@@ -71,11 +71,14 @@ function parseToolObject(item: Record<string, unknown>, dialect: ToolDialect): T
     } else {
       const functionValue = item["function"];
       schema = isRecord(functionValue)
-        ? functionValue["parameters"] ?? functionValue["jsonSchema"] ?? {}
+        ? functionValue["parameters"] ??
+          functionValue["jsonSchema"] ??
+          functionValue["parametersJsonSchema"] ??
+          {}
         : // The Responses flat spelling (`{type:"function", parameters:…}`) is
           // common here too; without this a tool arrived with an empty schema
           // and the upstream rejected it.
-          item["parameters"] ?? item["input_schema"] ?? {};
+          item["parameters"] ?? item["input_schema"] ?? item["parametersJsonSchema"] ?? {};
     }
   } else if (dialect === "responses") {
     // A Responses caller may still send the Chat-shaped envelope — the two
@@ -88,8 +91,13 @@ function parseToolObject(item: Record<string, unknown>, dialect: ToolDialect): T
     schema =
       item["input_schema"] ??
       item["parameters"] ??
+      item["parametersJsonSchema"] ??
       (wrapped !== undefined
-        ? wrapped["parameters"] ?? wrapped["input_schema"] ?? wrapped["jsonSchema"] ?? {}
+        ? wrapped["parameters"] ??
+          wrapped["input_schema"] ??
+          wrapped["jsonSchema"] ??
+          wrapped["parametersJsonSchema"] ??
+          {}
         : item);
   } else {
     schema = item["input_schema"] ?? item["inputSchema"] ?? {};

package/src/transport/surface/messages/encode.ts

@@ -1,6 +1,7 @@
 import type { CanonicalEvent, CanonicalStopReason, ContentPart, UsageRecord } from "../../../protocol/canonical-model";
 import { assertBoundedJsonDepth, isRecord } from "../../../protocol/codecs";
 import { messagesStopReason } from "../../../protocol/stop-reason";
+import { reasoningTextOf } from "../../../protocol/reasoning-text";
 import {
   reasoningSummaryHasBoundary,
   reasoningSummaryIdentity,
@@ -111,7 +112,7 @@ export function blockFromPart(part: ContentPart): MessagesWireObject | undefined
           : { type: "redacted_thinking", data: part.payload };
       return {
         type: "thinking",
-        thinking: part.summary ?? (typeof part.payload === "string" ? part.payload : ""),
+        thinking: reasoningTextOf(part) ?? "",
         ...(part.signature === undefined ? {} : { signature: part.signature }),
       };
     }

package/src/transport/surface/messages/parse.ts

@@ -145,8 +145,10 @@ export function parseBlock(value: unknown): ContentPart {
     const thinking = stringValue(value.thinking) ? value.thinking : "";
     return {
       kind: "reasoning",
+      // Readable thinking lives in `payload` only. Duplicating it into
+      // `summary` too emitted the same text twice on surfaces that carry both
+      // channels (Responses `reasoning_text` + `reasoning_summary_text`).
       payload: thinking,
-      summary: thinking,
       ...(stringValue(value.signature) ? { signature: value.signature } : {}),
     };
   }

package/src/transport/surface/messages/stream.ts

@@ -5,6 +5,7 @@ import {
   reasoningSummarySeparator,
   type ReasoningSummaryIdentity,
 } from "../reasoning-summary";
+import { reasoningTextOf } from "../../../protocol/reasoning-text";
 import {
   argumentsFrom,
   createToolCallTracker,
@@ -230,12 +231,7 @@ export class MessagesStreamEncoder extends SurfaceStreamEncoder<CanonicalEvent,
       }
       if (part.kind === "reasoning") {
         const isRedacted = part.opaque === true;
-        const summary =
-          typeof part.summary === "string"
-            ? part.summary
-            : typeof part.payload === "string"
-              ? part.payload
-              : "";
+        const summary = reasoningTextOf(part) ?? "";
         const signature = typeof part.signature === "string" ? part.signature : "";
         // Nothing to render: an empty thinking delta must not open a block
         // (same fragmentation as the empty-text case above).

package/src/workers/maintenance-lease.ts

@@ -0,0 +1,200 @@
+/**
+ * A Redis lease so one maintenance task runs once across the fleet.
+ *
+ * Maintenance work is side-effecting and shared: telemetry retention deletes
+ * rows for every tenant, the payload sweeper deletes files, the session sweep
+ * deletes sessions. Two processes running "telemetry-retention" at once do not
+ * produce two correct halves — they produce two passes over the same batches,
+ * double the row churn, and a WAL spike on a box that is already short of
+ * memory. On a 1-core VPS the second pass is not parallel speedup; it is
+ * contention with the request path.
+ *
+ * The lease is a Redis key with a token. The token matters: release must be
+ * conditional (`compare-and-delete`), or a process that overran its lease and
+ * was replaced would delete its SUCCESSOR's lease and let a third process in.
+ * An unconditional `DEL` is the classic version of that bug.
+ */
+import { randomUUID } from "node:crypto";
+
+import type { RedisClient } from "../persistence/redis";
+
+/** Key prefix; the task name is the discriminator. */
+const LEASE_KEY_PREFIX = "cartethyia:maintenance:lease:v1:";
+
+/**
+ * Bounds on the lease TTL.
+ *
+ * The floor prevents a fast task from holding a lease so briefly that a peer
+ * with a slightly skewed clock steals it mid-run. The ceiling keeps a crashed
+ * holder from blocking the task for longer than a maintenance interval is
+ * likely to be.
+ */
+const MIN_LEASE_TTL_MS = 5_000;
+const MAX_LEASE_TTL_MS = 60_000;
+
+/**
+ * Acquires the lease: `SET key token PX ttl NX`.
+ *
+ * One atomic statement rather than GET-then-SET: two processes can both read
+ * "absent" before either writes, and both would then believe they held it.
+ */
+const ACQUIRE_SCRIPT = `
+local ok = redis.call('set', KEYS[1], ARGV[1], 'PX', tonumber(ARGV[2]), 'NX')
+if ok then return 1 end
+return 0
+`;
+
+/**
+ * Renews only if the token still matches: `GET` + compare + `PEXPIRE`.
+ *
+ * Extending a lease this process no longer holds — because it overran its TTL
+ * and a peer took over — would make two holders of one lease.
+ */
+const RENEW_SCRIPT = `
+if redis.call('get', KEYS[1]) == ARGV[1] then
+  redis.call('pexpire', KEYS[1], tonumber(ARGV[2]))
+  return 1
+end
+return 0
+`;
+
+/**
+ * Releases only if the token still matches.
+ *
+ * An unconditional DEL would delete a successor's lease, letting a third
+ * process acquire while the second is still running.
+ */
+const RELEASE_SCRIPT = `
+if redis.call('get', KEYS[1]) == ARGV[1] then
+  redis.call('del', KEYS[1])
+  return 1
+end
+return 0
+`;
+
+export interface MaintenanceLease {
+  readonly taskName: string;
+  /** True when this process holds the lease. */
+  readonly held: boolean;
+  /** Extends the lease. Returns false when it has already been lost. */
+  renew(): Promise<boolean>;
+  /** Releases the lease. Safe (and a no-op) when it was never held or already lost. */
+  release(): Promise<void>;
+}
+
+export interface MaintenanceLeaseStore {
+  /**
+   * One acquisition attempt.
+   *
+   * Deliberately not a retry loop: a tick that cannot acquire should SKIP, not
+   * wait. Waiting would hold the tick open, and the next tick would arrive and
+   * queue behind it — turning a missed interval into a catch-up storm.
+   */
+  tryAcquire(taskName: string, ttlMs: number): Promise<MaintenanceLease>;
+}
+
+/** The TTL for a task, clamped into the supported range. */
+export function leaseTtlMs(intervalMs: number): number {
+  return Math.min(MAX_LEASE_TTL_MS, Math.max(MIN_LEASE_TTL_MS, Math.trunc(intervalMs)));
+}
+
+/** A store that hands out no lease — used when Redis is absent. */
+export function createNoopMaintenanceLeaseStore(): MaintenanceLeaseStore {
+  return {
+    async tryAcquire(taskName) {
+      return {
+        taskName,
+        // Held = true: with no shared store this process cannot coordinate, so
+        // the local registry's own re-entrancy rule is the only guard. The
+        // alternative — reporting not-held — would silently disable every
+        // maintenance task on single-process deployments, which is most of
+        // them.
+        held: true,
+        async renew() {
+          return true;
+        },
+        async release() {
+          /* nothing to give back */
+        },
+      };
+    },
+  };
+}
+
+/**
+ * A Redis-backed lease store.
+ *
+ * Every failure is non-throwing at the caller's level: a Redis that is down
+ * must not stop a task that only that process can do, and must not crash a
+ * maintenance tick. Acquisition failure is reported as "not held" so the
+ * registry skips and counts.
+ */
+export function createRedisMaintenanceLeaseStore(redis: RedisClient): MaintenanceLeaseStore {
+  const evalScript = async (
+    script: string,
+    key: string,
+    args: readonly (string | number)[],
+  ): Promise<number> => {
+    const raw = await (
+      redis as unknown as {
+        eval: (
+          script: string,
+          numKeys: number,
+          ...args: (string | number)[]
+        ) => Promise<unknown>;
+      }
+    ).eval(script, 1, key, ...args);
+    return Number(raw);
+  };
+
+  return {
+    async tryAcquire(taskName, ttlMs) {
+      const key = `${LEASE_KEY_PREFIX}${taskName}`;
+      const token = randomUUID();
+      const ttl = leaseTtlMs(ttlMs);
+      let held = false;
+      try {
+        held = (await evalScript(ACQUIRE_SCRIPT, key, [token, ttl])) === 1;
+      } catch {
+        // Redis unreachable: skip. Reported, not swallowed silently — the
+        // registry counts the skip so a persistent outage is visible.
+        held = false;
+      }
+      if (!held) {
+        return {
+          taskName,
+          held: false,
+          async renew() {
+            return false;
+          },
+          async release() {
+            /* nothing held */
+          },
+        };
+      }
+      let released = false;
+      return {
+        taskName,
+        held: true,
+        async renew() {
+          if (released) return false;
+          try {
+            return (await evalScript(RENEW_SCRIPT, key, [token, ttl])) === 1;
+          } catch {
+            return false;
+          }
+        },
+        async release() {
+          if (released) return;
+          released = true;
+          try {
+            await evalScript(RELEASE_SCRIPT, key, [token]);
+          } catch {
+            // Best-effort: the TTL releases it anyway, and a failed release
+            // must not turn a successful task run into an error.
+          }
+        },
+      };
+    },
+  };
+}