deepline 0.3.474 → 0.3.476

package/dist/bundling-sources/sdk/src/play.ts

@@ -185,8 +185,8 @@ export type PlayFetchResponse = PlayAuthoringFetchResponse;
  *   The changed row is delivered as the listener event's `after` in the play function's input.
  *
  * The default Play runtime is 30 minutes with the `standard` 1 GiB / 1 CPU
- * profile. Preview deployments also support `large` (4 GiB / 2 CPU) and
- * `xlarge` (8 GiB / 4 CPU) through `runtime.size`. Production uses `standard`.
+ * profile. Select `large` (4 GiB / 2 CPU) or `xlarge` (8 GiB / 4 CPU)
+ * through `runtime.size` when a step needs more memory.
  * Compute pricing follows the workspace plan; use `deepline billing quote`
  * for the session ceiling.
  * Set `runtime.timeout` for longer bounded runs; duration values are whole

package/dist/bundling-sources/sdk/src/release.ts

@@ -205,7 +205,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.474',
+  version: '0.3.476',
   updateSummary: {
     introducedIn: '0.3.90',
     summary:
@@ -252,9 +252,9 @@ export const SDK_RELEASE = {
       },
       {
         command: 'search',
-        introducedIn: '0.3.91',
+        introducedIn: '0.3.287',
         reason:
-          'deepline search was added in SDK CLI 0.3.91 as the one search across tools, monitors, and plays. On an older version run deepline tools search or deepline plays search, or update.',
+          'deepline search was added in SDK CLI 0.3.287 as the one search across tools, monitors, and plays. On an older version run deepline tools search or deepline plays search, or update.',
       },
       {
         command: 'notifications',

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-upstream-identity.ts

@@ -46,8 +46,9 @@ type ProviderMonitorUpstreamIdentityDefinition = {
    * Payload fields that never change which findings the provider resource
    * delivers. `updates_since` only sets how far back the first delivery
    * replays, so two monitors that differ only there watch the same feed.
-   * Claim keys written before this list existed still carry these fields;
-   * readers resolve them through `canonicalProviderMonitorIdentityClaimKey`.
+   * New claim keys omit them. Keys stored before that still carry them until
+   * the `normalizeProviderMonitorIdentityClaimKeys` migration rewrites them;
+   * readers resolve both through `canonicalProviderMonitorIdentityClaimKey`.
    */
   nonConfigurationFields?: readonly string[];
 };
@@ -171,9 +172,11 @@ export function providerMonitorUpstreamIdentitySignature(
 /**
  * Exact claim identity used by the Convex conflict index. The provider's
  * declared scope remains visible in `scopeKey`; providers that allow
- * configuration variants add every non-scope payload field to the claim key.
- * Keeping the old scope JSON as the prefix lets readers recognize claims
- * created before this distinction was introduced.
+ * configuration variants add every non-scope payload field to the claim key,
+ * except `nonConfigurationFields`. Keeping the old scope JSON as the prefix
+ * lets readers recognize claims created before this distinction was
+ * introduced. The result is always canonical
+ * (`canonicalProviderMonitorIdentityClaimKey` returns it unchanged).
  */
 export function providerMonitorUpstreamIdentityClaimKey(
   tool: string,
@@ -206,9 +209,10 @@ export function providerMonitorUpstreamIdentityClaimKey(
         : []),
     ]),
   );
+  const ignored = new Set(definition.nonConfigurationFields ?? []);
   const configuration = Object.fromEntries(
     Object.entries(payload ?? {}).filter(
-      ([field]) => !scopeAndAliases.has(field),
+      ([field]) => !scopeAndAliases.has(field) && !ignored.has(field),
     ),
   );
   if (Object.keys(configuration).length === 0) return scopeKey;
@@ -275,6 +279,15 @@ export function canonicalProviderMonitorIdentityClaimKey(
   return `${parts.scopeKey}${CONFIGURATION_SEPARATOR}${stableJson(configuration)}`;
 }
 
+/**
+ * The scope part of a stored claim key: the whole key when it is scope-only.
+ * Every key for one provider scope starts with this exact JSON object, so it
+ * bounds an index range over that scope's claims.
+ */
+export function providerMonitorIdentityClaimScopeKey(identityKey: string) {
+  return splitClaimKey(identityKey)?.scopeKey ?? identityKey;
+}
+
 /** Whether a claim key carries configuration beyond its scope. */
 export function providerMonitorIdentityClaimKeyHasConfiguration(
   identityKey: string,

package/dist/bundling-sources/shared_libs/observability/scheduled-jobs.json

@@ -241,7 +241,7 @@
     "id": "github.eval-agent-cli-matrix",
     "name": "Eval Agent CLI Matrix",
     "scheduler": "github_actions",
-    "cadence": "0 7 * * *",
+    "cadence": "0 7 * * *; 0 22 * * 4; 0 3 * * 1,3,5",
     "timezone": "America/New_York",
     "source": ".github/workflows/eval-agent-cli-matrix.yml",
     "locator": "schedule:",
@@ -265,9 +265,9 @@
     "locator": "schedule:",
     "owner": "platform",
     "criticality": "maintenance",
-    "purpose": "Reconcile completed PR Preview Machines and release capacity only after the per-app lease fence allows it. Its named-estate lane plans every named Preview estate (eval reuse keys, runtime up preview branch lanes, one-off namespaces) with `bun scripts/fly-preview-estate-lifecycle.ts --report --named-reclaim-plan` and, only on a workflow_dispatch with reclaim_named_estates=true, scales at most 8 planned estates per pass (interrupted reclaims first, then reclaimable estates idle 24 h by lease, release or reclaim evidence) to zero through the claimed runtime-preview-namespace.yml scale-to-zero, recording the start and lane app before the seam, retiring the release lane and recording reclaimed history; scheduled passes only report it.",
-    "successDefinition": "Fly inventory is reconciled and eligible terminal/closed PR capacity is released; every named estate is classified without a read failure, and a dispatched named reclaim leaves each target at zero Machines with its release lane retired and reclaimed history written. No eligible app or estate is a valid no-op.",
-    "failureDefinition": "Inventory, lease resolution, scale-down, or empty-app cleanup fails or is ambiguous; a named-estate Fly or authority read fails; a named reclaim is refused inside its claim (active owner, used since discovery, ownership or lane-app refusal) or any role keeps a Machine; or any named reclaim is incomplete (started but its release lane was never retired), which fails every pass until a dispatch finishes it.",
+    "purpose": "Reconcile completed PR Preview Machines and release capacity only after the per-app lease fence allows it. Its named-estate lane plans every named Preview estate (eval reuse keys, runtime up preview branch lanes, one-off namespaces) with `bun scripts/fly-preview-estate-lifecycle.ts --report --named-reclaim-plan` and, only on a workflow_dispatch with reclaim_named_estates=true, scales at most 8 planned estates per pass (interrupted reclaims first, then reclaimable estates idle 24 h by lease, release or reclaim evidence) to zero through the claimed runtime-preview-namespace.yml scale-to-zero, recording the start and lane app before the seam, retiring the release lane and recording reclaimed history; scheduled passes only report it. Each pass also returns the deeplinev1/load PlanetScale branch to its parked size when no Customer Workload Suite run is active on load-tests/framework, in case a load test's own teardown never ran.",
+    "successDefinition": "Fly inventory is reconciled and eligible terminal/closed PR capacity is released; every named estate is classified without a read failure, and a dispatched named reclaim leaves each target at zero Machines with its release lane retired and reclaimed history written. No eligible app or estate is a valid no-op. The load database is parked, a change toward that size is in flight, or an active Customer Workload Suite run on load-tests/framework may be holding it.",
+    "failureDefinition": "Inventory, lease resolution, scale-down, or empty-app cleanup fails or is ambiguous; a named-estate Fly or authority read fails; a named reclaim is refused inside its claim (active owner, used since discovery, ownership or lane-app refusal) or any role keeps a Machine; or any named reclaim is incomplete (started but its release lane was never retired), which fails every pass until a dispatch finishes it; or reading or parking the load database fails.",
     "startGraceMs": 600000,
     "runTimeoutMs": 3600000,
     "failureAlert": "github_workflow_run",

package/dist/bundling-sources/shared_libs/play-runtime/governor/app-runtime-rate-state-backend.ts

@@ -790,6 +790,13 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
   ): void {
     if (retryAtMs <= (this.localProviderRetryAtMs.get(bucketId) ?? 0)) return;
     this.localProviderRetryAtMs.set(bucketId, retryAtMs);
+    const cadence = this.validatedDispatchCadences.get(bucketId);
+    const serverOffsetMs = this.serverClockOffsetsMs.get(bucketId) ?? 0;
+    // A new hold fences old tickets and their dispatch debt. Keep debt from
+    // sends after an expired hold; their physical spacing is still current.
+    if (cadence && cadence.lastAtMs + serverOffsetMs <= retryAtMs) {
+      this.validatedDispatchCadences.delete(bucketId);
+    }
     for (const waiting of this.scheduledPermitWaits.get(bucketId) ?? []) {
       if (waiting.retryAtMsAtGrant < retryAtMs) waiting.invalidate();
     }
@@ -1626,6 +1633,14 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
       scopeRetryAtMsAtGrant,
       dispatchValidationSupported,
     ] = scheduled;
+    // Legacy grants have no shared hold snapshot. Capture their local fence
+    // when assigned, while keeping the signed gateway proof unchanged.
+    const localRetryAtMsAtGrant = this.validationScopes.has(bucketId)
+      ? scopeRetryAtMsAtGrant
+      : Math.max(
+          scopeRetryAtMsAtGrant,
+          this.localProviderRetryAtMs.get(bucketId) ?? 0,
+        );
     let settled = false;
     const refund = async (): Promise<void> => {
       if (!reservationId) {
@@ -1732,7 +1747,15 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
                 });
               }
               if (waitMs > 0) {
-                await this.sleep(waitMs, signal);
+                if (
+                  !(await this.waitForScheduledPermit(
+                    bucketId,
+                    localRetryAtMsAtGrant,
+                    waitMs,
+                    signal,
+                  ))
+                )
+                  return false;
                 continue;
               }
               this.validatedDispatchCadences.set(bucketId, {

package/dist/bundling-sources/shared_libs/play-runtime/play-run-recovery-policy.ts

@@ -72,11 +72,14 @@ export type PlayRunRecoveryDecision = Readonly<{
 export class PlayRunRecoveryError extends Error {
   readonly decision: PlayRunRecoveryDecision;
   readonly cause?: unknown;
+  /** Log-only provider facts; see `playRunRecoveryLogDetail`. */
+  readonly recoveryLogDetail?: unknown;
 
   constructor(input: {
     decision: PlayRunRecoveryDecision;
     message: string;
     cause?: unknown;
+    recoveryLogDetail?: unknown;
   }) {
     super(input.message);
     this.name = PLAY_RUN_RECOVERY_ERROR_NAME;
@@ -84,6 +87,9 @@ export class PlayRunRecoveryError extends Error {
     if (input.cause !== undefined) {
       this.cause = input.cause;
     }
+    if (input.recoveryLogDetail !== undefined) {
+      this.recoveryLogDetail = input.recoveryLogDetail;
+    }
   }
 }
 
@@ -106,7 +112,7 @@ export type PlayRunRecoveryLogDetail = Readonly<
 >;
 
 /**
- * Provider facts an adapter attached to the cause of a recovery error, for the
+ * Provider facts an adapter attached to a recovery error or its cause, for the
  * scheduler's defer log only. The decision's `reason` stays the single durable
  * recovery fact: this detail is never persisted, never returned to a caller,
  * and never read to choose a recovery action. It is bounded here, at the edge
@@ -119,9 +125,11 @@ export function playRunRecoveryLogDetail(
   try {
     if (!isPlayRunRecoveryError(error)) return null;
     const cause: unknown = error.cause;
-    if (!cause || typeof cause !== 'object') return null;
-    const supplied = (cause as { recoveryLogDetail?: unknown })
-      .recoveryLogDetail;
+    const supplied =
+      error.recoveryLogDetail ??
+      (cause && typeof cause === 'object'
+        ? (cause as { recoveryLogDetail?: unknown }).recoveryLogDetail
+        : undefined);
     if (!supplied || typeof supplied !== 'object' || Array.isArray(supplied)) {
       return null;
     }
@@ -203,6 +211,14 @@ export function recoveryForModalSandboxCreateFailure(
   const code = errorCode(error);
   const status = errorStatus(error);
   const message = messageOf(error);
+  // Only this rejection carries Modal's own words. Once it opens the circuit,
+  // later runs defer without calling Modal, and every reason here groups
+  // several provider conditions.
+  const recoveryLogDetail = {
+    providerCode: code,
+    providerStatus: status,
+    providerMessage: message,
+  };
   const resourceExhausted =
     code === 8 ||
     (typeof code === 'string' && /RESOURCE_EXHAUSTED/i.test(code)) ||
@@ -218,6 +234,7 @@ export function recoveryForModalSandboxCreateFailure(
       message:
         'Modal sandbox capacity is unavailable before customer execution began.',
       cause: error,
+      recoveryLogDetail,
     });
   }
 

package/dist/bundling-sources/shared_libs/play-runtime/runtime-capacity-policy.ts

@@ -56,8 +56,20 @@ export const RUNTIME_CAPACITY_POLICY = {
     maxScaleDownMachinesPerReconcile: 2,
     /** Empty relay capacity must be quiet before it is reclaimed. */
     scaleDownQuietMs: 120_000,
+    /**
+     * Pooled Postgres clients per relay Machine when
+     * DEEPLINE_RUNTIME_GATEWAY_POOL_MAX_CLIENTS sets none, as in production.
+     * packages/runtime-gateway/server.ts explains the budget.
+     */
+    poolMaxClients: 6,
   },
   receiptGateway: {
+    /**
+     * Pooled Postgres clients per receipt-gateway Machine when
+     * DEEPLINE_RUNTIME_GATEWAY_POOL_MAX_CLIENTS sets none, as in production.
+     * packages/runtime-gateway/server.ts explains the budget.
+     */
+    poolMaxClients: 8,
     admissionTimeoutMs: 10_000,
     /** End identical receipt-row work before the caller can overlap a retry. */
     claimOperationTimeoutMs: 20_000,

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-rate-scope.ts

@@ -72,35 +72,57 @@ export function acquireRateScopeSql(
         THEN CASE WHEN ${productiveRecovery} THEN ${AIMD_RECOVERY_STEP_MS}
           ELSE ${sparseRecoveryInterval} END
         ELSE LEAST(${floorRecoveryInterval}, CEIL(1000.0 / ${refillRate})) END`
-    : `LEAST(h.rate_recovery_interval_ms, ${AIMD_RECOVERY_STEP_MS})`;
+    : `${AIMD_RECOVERY_STEP_MS}`;
   // A local no-progress pause remains active after the provider's shorter
   // Retry-After. Only time beyond every outstanding dispatch/hold is idle.
   const observationWasIdle = `${successesParameter}::int = 0
     AND nv.now_ms - GREATEST(h.refilled_at_ms, h.next_dispatch_at_ms, h.retry_at_ms, h.cool_until_ms)
       > GREATEST(1000, 2000.0 / ${refillRate})`;
-  // A denied refill may fold a completion before the next floor interval is
-  // due. Keep that fresh completion available for one later ramp rather than
-  // requiring another provider call at the old pace. Its baseline advances on
-  // every floor ramp, so time alone cannot reuse it for another increase.
-  const recoverySuccess =
-    unknownProvider && probeBaselineSupported
-      ? `(${successesParameter}::int > 0 OR (
+  // A denied refill may fold a completion before the next recovery interval.
+  // Keep it available for one later ramp rather than requiring another call at
+  // the old pace. The baseline consumes it once. Unknown-provider upward probes
+  // above useful seed capacity retain their separate observation policy.
+  const recoverySuccess = probeBaselineSupported
+    ? `(${successesParameter}::int > 0 OR (
           h.seen_backpressure
-          AND ${refillRate} < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
+          AND (${!unknownProvider} OR ${refillRate} < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS})
           AND h.rate_probe_started_at_ms >= h.last_ramp_at_ms
           AND h.rate_probe_started_at_ms >= h.rate_observation_started_at_ms
           AND h.rate_successes > h.rate_probe_successes_at_ramp
           AND NOT (${observationWasIdle})
         ))`
-      : `${successesParameter}::int > 0`;
+    : `${successesParameter}::int > 0`;
+  // Known-provider feedback can arrive before its recovery interval. Wake at
+  // that opportunity instead of sleeping an entire old, slow token interval;
+  // the baseline below consumes each confirmed success for at most one ramp.
+  const pendingRecoveryWaitMs =
+    !unknownProvider && probeBaselineSupported
+      ? `CASE WHEN ${recoverySuccess}
+          AND h.seen_backpressure
+          AND h.rate_observation_started_at_ms IS NOT NULL
+          AND GREATEST(h.retry_at_ms, h.cool_until_ms) <= nv.now_ms
+          AND nv.now_ms < h.last_ramp_at_ms + ${backpressuredRecoveryInterval}
+        THEN h.last_ramp_at_ms + ${backpressuredRecoveryInterval} - nv.now_ms
+        ELSE NULL END`
+      : 'NULL::bigint';
+  // A provider's elapsed hold authorizes one shared recovery probe. Requiring
+  // a whole token at the newly learned rate would add another wait when the
+  // measured quota cycle is longer than Retry-After itself. The first grant
+  // starts an observation epoch, so competing callers cannot reuse this floor.
+  const postHoldProbeDue = `h.seen_backpressure
+    AND h.rate_observation_started_at_ms IS NULL
+    AND h.retry_at_ms > 0
+    AND GREATEST(h.retry_at_ms, h.cool_until_ms) <= nv.now_ms`;
   return `provider_hold_rows AS (
     SELECT * FROM ${table} WHERE bucket_id = $1 FOR UPDATE
   ), provider_hold AS (
     SELECT h.*,
-      LEAST(
+      ${postHoldProbeDue} AS post_hold_probe_due,
+      ${pendingRecoveryWaitMs} AS pending_recovery_wait_ms,
+      GREATEST(CASE WHEN ${postHoldProbeDue} THEN 1.0 ELSE 0.0 END, LEAST(
         GREATEST(CASE WHEN h.seen_backpressure THEN 1 ELSE h.capacity END, ${refillRate}),
         h.tokens + GREATEST(0, nv.now_ms - h.refilled_at_ms) * ${refillRate} / 1000.0
-      ) AS tokens_after_refill,
+      )) AS tokens_after_refill,
       ${observationWasIdle} AS observation_was_idle,
       CASE WHEN ${recoverySuccess}
           AND h.rate_observation_started_at_ms IS NOT NULL
@@ -140,7 +162,9 @@ export function updateRateScopeSql(
   const floorRampedObservation = `${unknownProvider} AND ph.seen_backpressure
     AND ph.refill_per_sec < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
     AND ph.next_refill_per_sec > ph.refill_per_sec`;
-  const idleFloorObservation = `ph.observation_was_idle
+  const knownRampedObservation = `${!unknownProvider} AND ph.seen_backpressure
+    AND ph.next_refill_per_sec > ph.refill_per_sec`;
+  const idleFloorObservation = `${unknownProvider} AND ph.observation_was_idle
     AND ph.refill_per_sec < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}`;
   const rebaseProbe =
     'ph.rate_probe_started_at_ms < ph.last_ramp_at_ms OR ph.rate_probe_started_at_ms < COALESCE(ph.rate_observation_started_at_ms, 0) OR ph.rate_probe_successes_at_ramp > ph.rate_successes';
@@ -163,28 +187,30 @@ export function updateRateScopeSql(
         WHEN (SELECT granted FROM grant_calc) > 0 AND ph.observation_was_idle THEN 0
         ELSE ph.rate_successes END,
       ${
-        unknownProvider && probeBaselineSupported
+        probeBaselineSupported
           ? `rate_probe_successes_at_ramp = CASE
         WHEN ${recoveredObservation} THEN 0
         WHEN (SELECT granted FROM grant_calc) > 0
           AND (ph.rate_observation_started_at_ms IS NULL OR ph.observation_was_idle) THEN 0
           WHEN ${idleFloorObservation} THEN ph.rate_successes
-          WHEN ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN ph.rate_successes
+          WHEN ${knownRampedObservation} OR ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN ph.rate_successes
           ELSE ph.rate_probe_successes_at_ramp END,
       rate_probe_started_at_ms = CASE
-        WHEN ${idleFloorObservation} OR ${recoveredObservation} OR ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN nv.now_ms
+        WHEN ${knownRampedObservation} OR ${idleFloorObservation} OR ${recoveredObservation} OR ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN nv.now_ms
         WHEN (SELECT granted FROM grant_calc) > 0
           AND (ph.rate_observation_started_at_ms IS NULL OR ph.observation_was_idle) THEN nv.now_ms
         ELSE ph.rate_probe_started_at_ms END,`
           : ''
       }
-      -- At the floor, a new successful epoch must not inherit failed-probe
-      -- backoff. Above the floor, retain its useful measurement duration for
-      -- sparse upward probes; that rate already proves successful recovery.
+      -- A productive known-provider epoch uses the one-second recovery window,
+      -- so its old measurement must not become a failed-probe streak when the
+      -- success counter resets. Unknown providers above the floor retain that
+      -- measurement for their separate sparse upward-probe policy.
       rate_recovery_interval_ms = CASE
-        WHEN ${unknownProvider} AND (SELECT granted FROM grant_calc) > 0
+        WHEN (SELECT granted FROM grant_calc) > 0
           AND ph.rate_successes > 0
-          AND ph.next_refill_per_sec <= ${DEFAULT_UNKNOWN_PROVIDER_MIN_RPS}
+          AND (${!unknownProvider}
+            OR ph.next_refill_per_sec <= ${DEFAULT_UNKNOWN_PROVIDER_MIN_RPS})
           AND (ph.observation_was_idle
             OR ph.rate_observation_started_at_ms IS NULL)
           -- Zero is an unmeasured new episode, not a failed-probe interval.

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-rate-state.ts

@@ -1444,7 +1444,12 @@ async function acquirePureRate(
           LEAST(
             ${effectiveCapacitySql('normalized', 'refill_per_sec', unknownProvider)},
             ph.tokens_after_refill,
-            LEAST(b.tokens, sc.capacity)
+            GREATEST(CASE WHEN ph.post_hold_probe_due
+              AND LEAST(b.tokens, sc.capacity)
+                + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
+                  * CASE WHEN sc.adaptive_max_configured
+                    THEN sc.max_rps ELSE b.max_rps END >= 1
+              THEN 1.0 ELSE 0.0 END, LEAST(b.tokens, sc.capacity)
               + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
                 * LEAST(
                     CASE
@@ -1452,7 +1457,7 @@ async function acquirePureRate(
                       ELSE b.max_rps
                     END,
                     GREATEST(sc.min_rps, ph.refill_per_sec)
-                  )
+                  ))
           ) AS tokens_after_refill
         FROM ${bucketTableName(input)} b
         JOIN seed_config sc ON sc.rule_id = b.rule_id
@@ -1683,7 +1688,7 @@ async function acquirePureRate(
               (SELECT cool_until_ms FROM cooling),
               (SELECT retry_at_ms FROM cooling)
             ) - (SELECT now_ms FROM refreshed LIMIT 1)${fair?.waitBranch ?? ''}
-          ELSE (
+          ELSE LEAST((SELECT pending_recovery_wait_ms FROM provider_hold), (
             SELECT CEIL(
               MAX(
                 (
@@ -1699,7 +1704,7 @@ async function acquirePureRate(
               )
             )::bigint
             FROM updated
-          )
+          ))
         END AS wait_ms
     `,
     [
@@ -1964,7 +1969,12 @@ async function grantWithConcurrency(
           LEAST(
             ${effectiveCapacitySql('normalized', 'refill_per_sec', unknownProvider)},
             ph.tokens_after_refill,
-            LEAST(b.tokens, sc.capacity)
+            GREATEST(CASE WHEN ph.post_hold_probe_due
+              AND LEAST(b.tokens, sc.capacity)
+                + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
+                  * CASE WHEN sc.adaptive_max_configured
+                    THEN sc.max_rps ELSE b.max_rps END >= 1
+              THEN 1.0 ELSE 0.0 END, LEAST(b.tokens, sc.capacity)
               + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
                 * LEAST(
                     CASE
@@ -1972,7 +1982,7 @@ async function grantWithConcurrency(
                       ELSE b.max_rps
                     END,
                     GREATEST(sc.min_rps, ph.refill_per_sec)
-                  )
+                  ))
           ) AS tokens_after_refill
         FROM ${bucketTableName(input)} b
         JOIN seed_config sc ON sc.rule_id = b.rule_id
@@ -2306,7 +2316,7 @@ async function grantWithConcurrency(
               (SELECT retry_at_ms FROM cooling)
             ) - (SELECT now_ms FROM refreshed LIMIT 1)${fair?.waitBranch ?? ''}
           WHEN (SELECT free FROM free_slots) <= 0 THEN $7::bigint
-          ELSE (
+          ELSE LEAST((SELECT pending_recovery_wait_ms FROM provider_hold), (
             SELECT CEIL(
               MAX(
                 (
@@ -2323,7 +2333,7 @@ async function grantWithConcurrency(
               )
             )::bigint
             FROM updated
-          )
+          ))
         END AS wait_ms
     `,
     [