deepline 0.3.331 → 0.3.333

package/dist/bundling-sources/sdk/src/billing-idempotency.ts

@@ -2,8 +2,12 @@ import { DeeplineError } from './errors.js';
 
 export function requireBillingIdempotencyKey(value: string): string {
   const normalized = value.trim();
+  // Headers accepts some control characters that HTTP delivery rejects.
   let valid =
-    normalized.length > 0 && normalized.length <= 200 && normalized === value;
+    normalized.length > 0 &&
+    normalized.length <= 200 &&
+    normalized === value &&
+    !/[\u0000-\u0008\u000a-\u001f\u007f]/.test(value);
   if (valid) {
     try {
       valid =

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.331',
+  version: '0.3.333',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -222,7 +222,8 @@ import {
   classifyToolExecuteHttpFailure,
   createToolExecuteHttpFailureAttemptTracker,
   parseToolExecuteRetryAfterMs,
-  parseToolExecuteRetryAtMs,
+  parseToolExecuteProviderRetryAtMs,
+  parseToolExecuteExactProviderRetryAtMs,
   parseToolExecuteAuthScopeChangedError,
   ToolExecuteAuthScopeChangedError,
   type ToolExecuteHttpFailureOutcome,
@@ -17849,8 +17850,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const executionRequestNonce = crypto.randomUUID();
           // Transport ambiguity must retain the billing identity. An ordinary
           // (unfenced) call advances it after a definite rejection released
-          // that attempt's reservation, including app pacing refusals. Fenced
-          // calls retain it: gateway-qualified retries own their distinct charge lifecycle.
+          // that attempt's reservation. A proven app pacing refusal also
+          // renews fenced billing attribution, keeping its invocation and
+          // provider-operation identities unchanged. Ambiguous deliveries retain it.
           let deeplineRequestId = `ctx-tool-${stableDigest(executionRequestNonce).slice(0, 32)}`;
           // The provider operation has a semantic identity independent of
           // the response receipt. Its key is supplied by the caller that owns
@@ -18647,13 +18649,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                 // settle the row as failed instead of pacing.
                                 [TOOL_EXECUTE_RUNNER_ACCEPTS_HEADER]:
                                   TOOL_EXECUTE_RUNNER_ACCEPTS_VALUE,
-                                ...(!usesDurableInvocationFence &&
-                                !providerExecutionFenceKey
-                                  ? {
-                                      [TOOL_EXECUTE_APP_PACING_REFUSAL_HEADER]:
-                                        TOOL_EXECUTE_APP_PACING_REFUSAL_VALUE,
-                                    }
-                                  : {}),
+                                [TOOL_EXECUTE_APP_PACING_REFUSAL_HEADER]:
+                                  TOOL_EXECUTE_APP_PACING_REFUSAL_VALUE,
                                 ...(providerGatewayDispatchProof
                                   ? {
                                       [TOOL_EXECUTE_PROVIDER_RATE_SCOPE_HEADER]:
@@ -18698,18 +18695,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                             recordProviderDispatch();
                           if (dispatchedResponse.status === 429) {
                             const observedAt = Date.now();
-                            const retryAfter =
-                              dispatchedResponse.headers.get('retry-after');
                             // Preserve absolute provider deadlines even when the
                             // response did not carry the gateway's counter
                             // attestation. Classification below still decides
                             // whether this 429 may update shared provider pacing.
-                            providerRetryAtMs = retryAfter?.trim()
-                              ? parseToolExecuteRetryAtMs(
-                                  retryAfter,
-                                  observedAt,
-                                )
-                              : undefined;
+                            providerRetryAtMs =
+                              parseToolExecuteProviderRetryAtMs(
+                                dispatchedResponse,
+                                observedAt,
+                              );
                           }
                           if (
                             isAttestedProvider429Response(dispatchedResponse)
@@ -18877,6 +18871,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                               schemaVersion: toolErrorSchemaVersion,
                               retryAfterHeader:
                                 dispatchedResponse.headers.get('retry-after'),
+                              retryAtMs:
+                                parseToolExecuteExactProviderRetryAtMs(
+                                  dispatchedResponse,
+                                ),
                               transientHttpRetrySafe:
                                 retrySafeTransientHttp || fixtureReplaySafe,
                               executionFenced: usesDurableInvocationFence,
@@ -18898,6 +18896,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                 schemaVersion: toolErrorSchemaVersion,
                                 retryAfterHeader:
                                   dispatchedResponse.headers.get('retry-after'),
+                                retryAtMs:
+                                  parseToolExecuteExactProviderRetryAtMs(
+                                    dispatchedResponse,
+                                  ),
                                 transientHttpRetrySafe:
                                   retrySafeTransientHttp || fixtureReplaySafe,
                                 executionFenced: usesDurableInvocationFence,
@@ -19294,6 +19296,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   bodyText: text,
                   schemaVersion: toolErrorSchemaVersion,
                   retryAfterHeader: response.headers.get('retry-after'),
+                  retryAtMs: parseToolExecuteExactProviderRetryAtMs(response),
                   transientHttpRetrySafe:
                     retrySafeTransientHttp || fixtureReplaySafe,
                   executionFenced: usesDurableInvocationFence,
@@ -19519,11 +19522,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 );
                 logProvider429RetryPhase('retry_sleep_completed');
                 if (
-                  !usesDurableInvocationFence &&
-                  (failure.backpressureDelayMs !== null ||
-                    failure.reason === 'provider_pacing_wait' ||
-                    (failure.reason === 'rate_limit' &&
-                      failure.knownNotDispatched))
+                  failure.reason === 'provider_pacing_wait' ||
+                  (!usesDurableInvocationFence &&
+                    (failure.backpressureDelayMs !== null ||
+                      (failure.reason === 'rate_limit' &&
+                        failure.knownNotDispatched)))
                 ) {
                   // These refusals release the prior reservation. App pacing
                   // does not advance invocationAttempt, so use its own HTTP

package/dist/bundling-sources/shared_libs/play-runtime/execution-gateway-invocation-fence.ts

@@ -62,6 +62,14 @@ export type DurableInvocationDiagnostic = {
   error?: unknown;
 };
 
+/** Authenticated transport proof that this owner sent no provider request. */
+export class DurableInvocationDispatchNotStartedError extends Error {
+  constructor(readonly reason: string) {
+    super(reason);
+    this.name = 'DurableInvocationDispatchNotStartedError';
+  }
+}
+
 export class DurableInvocationConflictError extends Error {
   readonly code = 'DURABLE_INVOCATION_REQUEST_CONFLICT';
 
@@ -313,6 +321,14 @@ export async function executeWithDurableInvocationFence(input: {
       response = await input.execute();
     } catch (error) {
       diagnose('dispatch_failed', error);
+      if (error instanceof DurableInvocationDispatchNotStartedError) {
+        // An authenticated app refusal proves no provider request was sent.
+        // Release only this owner; ordinary transport failures stay unknown.
+        if (!(await input.store.abandon(begun))) {
+          throw new DurableInvocationInProgressError();
+        }
+        throw error;
+      }
       if (input.replaySafeAfterDispatch) {
         return await retryReplaySafeInvocation(begun);
       }

package/dist/bundling-sources/shared_libs/play-runtime/governor/app-runtime-rate-state-backend.ts

@@ -140,7 +140,6 @@ function sleepWithAbort(
  * hold more than a moment of a shared provider window.
  */
 const RATE_BLOCK_HORIZON_MS = 1_000;
-const UNKNOWN_PROVIDER_RECOVERY_BLOCK_HORIZON_MS = 500;
 const STORE_FAILURE_RETRY_DELAYS_MS = [100, 250] as const;
 /**
  * Jitter fraction applied to a server-supplied `waitMs` so a synchronized wave
@@ -667,23 +666,22 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
     // a hot map is a round trip per permit. The store's own token floor, not
     // this number, is what bounds the grant.
     const learnedRps = this.effectiveRps.get(laneKey);
+    const currentRps = learnedRps ?? configuredRps;
     const recoveringUnknownProvider =
       learnedRps !== undefined &&
       learnedRps < DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS &&
       rules.some((rule) => rule.ruleId === 'default:provider-scope') &&
       rules.every((rule) => rule.ruleId.startsWith('default:'));
-    // Below recovered capacity, the next clean observation can double the
-    // pace after 500ms. Do not reserve a full second at the old slower pace:
-    // that schedule debt would delay grants even after learning succeeds.
+    // Below recovered capacity, one dispatch interval (500/250/125ms at
+    // 2/4/8 RPS) can prove the next step. Reserve only that interval so cached
+    // old-pace tickets cannot postpone the next fresh-feedback refill.
     const horizonMs = Math.min(
-      recoveringUnknownProvider
-        ? UNKNOWN_PROVIDER_RECOVERY_BLOCK_HORIZON_MS
-        : RATE_BLOCK_HORIZON_MS,
+      recoveringUnknownProvider ? 1_000 / currentRps : RATE_BLOCK_HORIZON_MS,
       leasedBlockTtlMs(rules),
     );
     const rateBudget = Math.max(
       1,
-      Math.floor(((learnedRps ?? configuredRps) * horizonMs) / 1_000),
+      Math.floor((currentRps * horizonMs) / 1_000),
     );
     if (!Number.isFinite(rateBudget) || rateBudget <= 0) return floor;
     const waiters = this.waiters.get(laneKey) ?? 1;
@@ -1018,7 +1016,8 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
         const releaseGeneration = releaseSignal?.generation;
         const successKey = pendingSuccessKey(bucketId, ordered);
         const feedback = this.snapshotSuccessFeedback(successKey);
-        const response = await this.port.acquire({
+        const requestStartedAtMs = this.now();
+        const rawResponse = await this.port.acquire({
           bucketId,
           rateScopeToken,
           rules: withAdaptiveMaxRps(ordered),
@@ -1026,6 +1025,28 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
           ...feedback,
           schedulerSchema: this.schedulerSchema,
         });
+        const serverElapsedMs = rawResponse.serverClockElapsedMs;
+        const validServerElapsed =
+          typeof rawResponse.serverNowMs === 'number' &&
+          Number.isFinite(rawResponse.serverNowMs) &&
+          rawResponse.serverNowMs >= 0 &&
+          typeof serverElapsedMs === 'number' &&
+          Number.isSafeInteger(serverElapsedMs) &&
+          serverElapsedMs >= 0 &&
+          serverElapsedMs <= this.now() - requestStartedAtMs;
+        // The clock was already this old when the response left the server.
+        // Advance only by confirmed elapsed time; unknown transit remains
+        // conservative, and an invalid/legacy response keeps the old clock.
+        const response = validServerElapsed
+          ? {
+              ...rawResponse,
+              serverNowMs: rawResponse.serverNowMs! + serverElapsedMs,
+              waitMs:
+                rawResponse.waitMs > 0
+                  ? Math.max(1, rawResponse.waitMs - serverElapsedMs)
+                  : rawResponse.waitMs,
+            }
+          : rawResponse;
         this.acknowledgeSuccessFeedback(successKey, feedback);
         this.recordCooldown(bucketId, response);
         if (response.scopeValidationSupported === true)

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -96,6 +96,12 @@ export type PlayRunnerRateStateAcquireResult = {
    * provider spacing.
    */
   serverNowMs?: number;
+  /**
+   * Confirmed elapsed time after receiving the database clock and before
+   * returning this grant. This is a lower bound on the clock's age: uncertain
+   * database and HTTP transit time is excluded. Absent on older receivers.
+   */
+  serverClockElapsedMs?: number;
   /**
    * One globally reserved dispatch timestamp per granted permit. The runtime
    * may cache the block, but must not dispatch a permit before its timestamp.

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-rate-scope.ts

@@ -4,7 +4,10 @@
  * learn from copies of the same provider feedback. These CTEs are shared by
  * pure-rate and concurrency-bearing admission, in the same atomic grant SQL.
  */
-import { DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS } from '../governor/rate-state-backend';
+import {
+  DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS,
+  DEFAULT_UNKNOWN_PROVIDER_MIN_RPS,
+} from '../governor/rate-state-backend';
 
 const AIMD_RECOVERY_STEP_MS = 1_000;
 // Increase relative to the learned rate, not by a fixed RPS amount: a long
@@ -14,15 +17,17 @@ const AIMD_RECOVERY_STEP_MS = 1_000;
 const AIMD_ADDITIVE_STEP_FRACTION = 0.25;
 // Keep upward probes small enough to retain headroom after a productive
 // decrease. Sparse successes use the earlier observation window; sustained
-// useful work can establish another small probe each second.
+// useful work at nearly the current target can establish another small probe
+// each second. Demand or historical successes cannot certify the next target.
 const UNKNOWN_PROVIDER_PROBE_STEP_RPS = 0.1;
 const UNKNOWN_PROVIDER_PROBE_INTERVAL_CAP_MS = 5_000;
-const UNKNOWN_PROVIDER_PRODUCTIVE_RATE_FRACTION = 0.8;
+const UNKNOWN_PROVIDER_PRODUCTIVE_RATE_FRACTION = 0.95;
 export function acquireRateScopeSql(
   table: string,
   successesParameter: string,
   minimumRateSql = 'NULL::float8',
   unknownProvider = false,
+  probeBaselineSupported = true,
 ): string {
   const refillRate = `CASE WHEN ${minimumRateSql} IS NULL
     THEN h.refill_per_sec
@@ -35,11 +40,29 @@ export function acquireRateScopeSql(
   // Success counts are already applied once by the feedback writer. Measure
   // this post-hold epoch, excluding Retry-After and earlier idle history. A
   // productive second justifies a small new probe; a lone completion does not.
+  const probeStartedAtMs = probeBaselineSupported
+    ? 'GREATEST(h.rate_probe_started_at_ms, h.rate_observation_started_at_ms)'
+    : 'h.rate_observation_started_at_ms';
+  const probeSuccesses = probeBaselineSupported
+    ? 'GREATEST(0, h.rate_successes - h.rate_probe_successes_at_ramp)'
+    : 'h.rate_successes';
+  const productiveRateFraction = probeBaselineSupported
+    ? UNKNOWN_PROVIDER_PRODUCTIVE_RATE_FRACTION
+    : 0.8;
+  const storedRecoveryInterval = `LEAST(${UNKNOWN_PROVIDER_PROBE_INTERVAL_CAP_MS}, GREATEST(${AIMD_RECOVERY_STEP_MS}, h.rate_recovery_interval_ms))`;
+  const sparseRecoveryInterval = probeBaselineSupported
+    ? `CASE WHEN ${refillRate} > ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
+      THEN ${UNKNOWN_PROVIDER_PROBE_INTERVAL_CAP_MS} ELSE ${storedRecoveryInterval} END`
+    : storedRecoveryInterval;
+  const floorRecoveryInterval = probeBaselineSupported
+    ? `GREATEST(${AIMD_RECOVERY_STEP_MS}, h.rate_recovery_interval_ms)`
+    : 'h.rate_recovery_interval_ms';
   const productiveRecovery = `h.rate_observation_started_at_ms IS NOT NULL
-    AND nv.now_ms - h.rate_observation_started_at_ms >= ${AIMD_RECOVERY_STEP_MS}
-    AND h.rate_successes * 1000.0
-      / GREATEST(${AIMD_RECOVERY_STEP_MS}, nv.now_ms - h.rate_observation_started_at_ms)
-      >= ${refillRate} * ${UNKNOWN_PROVIDER_PRODUCTIVE_RATE_FRACTION}`;
+    ${probeBaselineSupported ? 'AND h.rate_probe_started_at_ms >= h.last_ramp_at_ms AND h.rate_probe_started_at_ms >= h.rate_observation_started_at_ms' : ''}
+    AND nv.now_ms - ${probeStartedAtMs} >= ${AIMD_RECOVERY_STEP_MS}
+    AND ${probeSuccesses} * 1000.0
+      / GREATEST(${AIMD_RECOVERY_STEP_MS}, nv.now_ms - ${probeStartedAtMs})
+      >= ${refillRate} * ${productiveRateFraction}`;
   // Below useful seed capacity, a confirmed success can prove the next probe
   // after one dispatch interval at the current rate. Keeping the floor's 500ms
   // interval at 4/8 RPS waits through additional clean sends unnecessarily.
@@ -47,9 +70,29 @@ export function acquireRateScopeSql(
   const backpressuredRecoveryInterval = unknownProvider
     ? `CASE WHEN ${refillRate} >= ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
         THEN CASE WHEN ${productiveRecovery} THEN ${AIMD_RECOVERY_STEP_MS}
-          ELSE LEAST(${UNKNOWN_PROVIDER_PROBE_INTERVAL_CAP_MS}, GREATEST(${AIMD_RECOVERY_STEP_MS}, h.rate_recovery_interval_ms)) END
-        ELSE LEAST(h.rate_recovery_interval_ms, CEIL(1000.0 / ${refillRate})) END`
+          ELSE ${sparseRecoveryInterval} END
+        ELSE LEAST(${floorRecoveryInterval}, CEIL(1000.0 / ${refillRate})) END`
     : `LEAST(h.rate_recovery_interval_ms, ${AIMD_RECOVERY_STEP_MS})`;
+  // A local no-progress pause remains active after the provider's shorter
+  // Retry-After. Only time beyond every outstanding dispatch/hold is idle.
+  const observationWasIdle = `${successesParameter}::int = 0
+    AND nv.now_ms - GREATEST(h.refilled_at_ms, h.next_dispatch_at_ms, h.retry_at_ms, h.cool_until_ms)
+      > GREATEST(1000, 2000.0 / ${refillRate})`;
+  // A denied refill may fold a completion before the next floor interval is
+  // due. Keep that fresh completion available for one later ramp rather than
+  // requiring another provider call at the old pace. Its baseline advances on
+  // every floor ramp, so time alone cannot reuse it for another increase.
+  const recoverySuccess =
+    unknownProvider && probeBaselineSupported
+      ? `(${successesParameter}::int > 0 OR (
+          h.seen_backpressure
+          AND ${refillRate} < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
+          AND h.rate_probe_started_at_ms >= h.last_ramp_at_ms
+          AND h.rate_probe_started_at_ms >= h.rate_observation_started_at_ms
+          AND h.rate_successes > h.rate_probe_successes_at_ramp
+          AND NOT (${observationWasIdle})
+        ))`
+      : `${successesParameter}::int > 0`;
   return `provider_hold_rows AS (
     SELECT * FROM ${table} WHERE bucket_id = $1 FOR UPDATE
   ), provider_hold AS (
@@ -58,12 +101,8 @@ export function acquireRateScopeSql(
         GREATEST(CASE WHEN h.seen_backpressure THEN 1 ELSE h.capacity END, ${refillRate}),
         h.tokens + GREATEST(0, nv.now_ms - h.refilled_at_ms) * ${refillRate} / 1000.0
       ) AS tokens_after_refill,
-      ${successesParameter}::int = 0
-        -- A local no-progress pause remains an active observation episode,
-        -- even after the provider's shorter Retry-After has elapsed.
-        AND nv.now_ms - GREATEST(h.refilled_at_ms, h.next_dispatch_at_ms, h.retry_at_ms, h.cool_until_ms)
-          > GREATEST(1000, 2000.0 / ${refillRate}) AS observation_was_idle,
-      CASE WHEN ${successesParameter}::int > 0
+      ${observationWasIdle} AS observation_was_idle,
+      CASE WHEN ${recoverySuccess}
           AND h.rate_observation_started_at_ms IS NOT NULL
           AND nv.now_ms - h.last_ramp_at_ms >= CASE WHEN h.seen_backpressure
             THEN ${backpressuredRecoveryInterval}
@@ -73,7 +112,7 @@ export function acquireRateScopeSql(
           THEN ${recoveryRate}
           ELSE ${refillRate} * 2 END)
         ELSE ${refillRate} END AS next_refill_per_sec,
-      CASE WHEN ${successesParameter}::int > 0
+      CASE WHEN ${recoverySuccess}
           AND h.rate_observation_started_at_ms IS NOT NULL
           AND nv.now_ms - h.last_ramp_at_ms >= CASE WHEN h.seen_backpressure
             THEN ${backpressuredRecoveryInterval}
@@ -87,13 +126,24 @@ export function acquireRateScopeSql(
 export function updateRateScopeSql(
   table: string,
   unknownProvider = false,
+  probeBaselineSupported = true,
 ): string {
-  // Floor recovery and productive probing measure different rates. Once the
-  // geometric ramp reaches useful capacity, start a fresh measurement instead
-  // of diluting its successful throughput with the earlier slow-start period.
+  // Keep the throttle epoch's productive evidence while measuring each upward
+  // probe from a new counter baseline. Losing the earlier useful work would
+  // turn an exploratory rejection into a zero-progress failure.
   const recoveredObservation = `${unknownProvider} AND ph.seen_backpressure
     AND ph.refill_per_sec < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
     AND ph.next_refill_per_sec >= ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}`;
+  const probedObservation = `${unknownProvider} AND ph.seen_backpressure
+    AND ph.refill_per_sec >= ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
+    AND ph.next_refill_per_sec > ph.refill_per_sec`;
+  const floorRampedObservation = `${unknownProvider} AND ph.seen_backpressure
+    AND ph.refill_per_sec < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
+    AND ph.next_refill_per_sec > ph.refill_per_sec`;
+  const idleFloorObservation = `ph.observation_was_idle
+    AND ph.refill_per_sec < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}`;
+  const rebaseProbe =
+    'ph.rate_probe_started_at_ms < ph.last_ramp_at_ms OR ph.rate_probe_started_at_ms < COALESCE(ph.rate_observation_started_at_ms, 0) OR ph.rate_probe_successes_at_ramp > ph.rate_successes';
   return `updated_scope AS (
     UPDATE ${table} h SET
       tokens = ph.tokens_after_refill - (SELECT granted FROM grant_calc),
@@ -112,13 +162,34 @@ export function updateRateScopeSql(
           AND ph.rate_observation_started_at_ms IS NULL THEN 0
         WHEN (SELECT granted FROM grant_calc) > 0 AND ph.observation_was_idle THEN 0
         ELSE ph.rate_successes END,
-      -- Do not turn an earlier productive measurement window into a failed
-      -- probe streak when an unknown provider starts a new run after idle.
-      -- Active Retry-After/local cooldowns are excluded by observation_was_idle.
+      ${
+        unknownProvider && probeBaselineSupported
+          ? `rate_probe_successes_at_ramp = CASE
+        WHEN ${recoveredObservation} THEN 0
+        WHEN (SELECT granted FROM grant_calc) > 0
+          AND (ph.rate_observation_started_at_ms IS NULL OR ph.observation_was_idle) THEN 0
+          WHEN ${idleFloorObservation} THEN ph.rate_successes
+          WHEN ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN ph.rate_successes
+          ELSE ph.rate_probe_successes_at_ramp END,
+      rate_probe_started_at_ms = CASE
+        WHEN ${idleFloorObservation} OR ${recoveredObservation} OR ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN nv.now_ms
+        WHEN (SELECT granted FROM grant_calc) > 0
+          AND (ph.rate_observation_started_at_ms IS NULL OR ph.observation_was_idle) THEN nv.now_ms
+        ELSE ph.rate_probe_started_at_ms END,`
+          : ''
+      }
+      -- At the floor, a new successful epoch must not inherit failed-probe
+      -- backoff. Above the floor, retain its useful measurement duration for
+      -- sparse upward probes; that rate already proves successful recovery.
       rate_recovery_interval_ms = CASE
         WHEN ${unknownProvider} AND (SELECT granted FROM grant_calc) > 0
-          AND ph.observation_was_idle AND ph.rate_successes > 0
-          THEN ${AIMD_RECOVERY_STEP_MS}
+          AND ph.rate_successes > 0
+          AND ph.next_refill_per_sec <= ${DEFAULT_UNKNOWN_PROVIDER_MIN_RPS}
+          AND (ph.observation_was_idle
+            OR ph.rate_observation_started_at_ms IS NULL)
+          -- Zero is an unmeasured new episode, not a failed-probe interval.
+          -- A real failure establishes the interval before it can double.
+          THEN ${probeBaselineSupported ? 0 : AIMD_RECOVERY_STEP_MS}
         ELSE ph.rate_recovery_interval_ms END,
       rate_throttle_ceiling_rps = CASE
         WHEN (SELECT granted FROM grant_calc) > 0