deepline 0.3.475 → 0.3.477

package/dist/bundling-sources/sdk/src/play.ts

@@ -185,8 +185,8 @@ export type PlayFetchResponse = PlayAuthoringFetchResponse;
  *   The changed row is delivered as the listener event's `after` in the play function's input.
  *
  * The default Play runtime is 30 minutes with the `standard` 1 GiB / 1 CPU
- * profile. Preview deployments also support `large` (4 GiB / 2 CPU) and
- * `xlarge` (8 GiB / 4 CPU) through `runtime.size`. Production uses `standard`.
+ * profile. Select `large` (4 GiB / 2 CPU) or `xlarge` (8 GiB / 4 CPU)
+ * through `runtime.size` when a step needs more memory.
  * Compute pricing follows the workspace plan; use `deepline billing quote`
  * for the session ceiling.
  * Set `runtime.timeout` for longer bounded runs; duration values are whole

package/dist/bundling-sources/sdk/src/release.ts

@@ -205,7 +205,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.475',
+  version: '0.3.477',
   updateSummary: {
     introducedIn: '0.3.90',
     summary:
@@ -252,9 +252,9 @@ export const SDK_RELEASE = {
       },
       {
         command: 'search',
-        introducedIn: '0.3.91',
+        introducedIn: '0.3.287',
         reason:
-          'deepline search was added in SDK CLI 0.3.91 as the one search across tools, monitors, and plays. On an older version run deepline tools search or deepline plays search, or update.',
+          'deepline search was added in SDK CLI 0.3.287 as the one search across tools, monitors, and plays. On an older version run deepline tools search or deepline plays search, or update.',
       },
       {
         command: 'notifications',

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-upstream-identity.ts

@@ -46,8 +46,9 @@ type ProviderMonitorUpstreamIdentityDefinition = {
    * Payload fields that never change which findings the provider resource
    * delivers. `updates_since` only sets how far back the first delivery
    * replays, so two monitors that differ only there watch the same feed.
-   * Claim keys written before this list existed still carry these fields;
-   * readers resolve them through `canonicalProviderMonitorIdentityClaimKey`.
+   * New claim keys omit them. Keys stored before that still carry them until
+   * the `normalizeProviderMonitorIdentityClaimKeys` migration rewrites them;
+   * readers resolve both through `canonicalProviderMonitorIdentityClaimKey`.
    */
   nonConfigurationFields?: readonly string[];
 };
@@ -171,9 +172,11 @@ export function providerMonitorUpstreamIdentitySignature(
 /**
  * Exact claim identity used by the Convex conflict index. The provider's
  * declared scope remains visible in `scopeKey`; providers that allow
- * configuration variants add every non-scope payload field to the claim key.
- * Keeping the old scope JSON as the prefix lets readers recognize claims
- * created before this distinction was introduced.
+ * configuration variants add every non-scope payload field to the claim key,
+ * except `nonConfigurationFields`. Keeping the old scope JSON as the prefix
+ * lets readers recognize claims created before this distinction was
+ * introduced. The result is always canonical
+ * (`canonicalProviderMonitorIdentityClaimKey` returns it unchanged).
  */
 export function providerMonitorUpstreamIdentityClaimKey(
   tool: string,
@@ -206,9 +209,10 @@ export function providerMonitorUpstreamIdentityClaimKey(
         : []),
     ]),
   );
+  const ignored = new Set(definition.nonConfigurationFields ?? []);
   const configuration = Object.fromEntries(
     Object.entries(payload ?? {}).filter(
-      ([field]) => !scopeAndAliases.has(field),
+      ([field]) => !scopeAndAliases.has(field) && !ignored.has(field),
     ),
   );
   if (Object.keys(configuration).length === 0) return scopeKey;
@@ -275,6 +279,15 @@ export function canonicalProviderMonitorIdentityClaimKey(
   return `${parts.scopeKey}${CONFIGURATION_SEPARATOR}${stableJson(configuration)}`;
 }
 
+/**
+ * The scope part of a stored claim key: the whole key when it is scope-only.
+ * Every key for one provider scope starts with this exact JSON object, so it
+ * bounds an index range over that scope's claims.
+ */
+export function providerMonitorIdentityClaimScopeKey(identityKey: string) {
+  return splitClaimKey(identityKey)?.scopeKey ?? identityKey;
+}
+
 /** Whether a claim key carries configuration beyond its scope. */
 export function providerMonitorIdentityClaimKeyHasConfiguration(
   identityKey: string,

package/dist/bundling-sources/shared_libs/observability/scheduled-jobs.json

@@ -241,7 +241,7 @@
     "id": "github.eval-agent-cli-matrix",
     "name": "Eval Agent CLI Matrix",
     "scheduler": "github_actions",
-    "cadence": "0 7 * * *",
+    "cadence": "0 7 * * *; 0 22 * * 4; 0 3 * * 1,3,5",
     "timezone": "America/New_York",
     "source": ".github/workflows/eval-agent-cli-matrix.yml",
     "locator": "schedule:",
@@ -265,9 +265,9 @@
     "locator": "schedule:",
     "owner": "platform",
     "criticality": "maintenance",
-    "purpose": "Reconcile completed PR Preview Machines and release capacity only after the per-app lease fence allows it. Its named-estate lane plans every named Preview estate (eval reuse keys, runtime up preview branch lanes, one-off namespaces) with `bun scripts/fly-preview-estate-lifecycle.ts --report --named-reclaim-plan` and, only on a workflow_dispatch with reclaim_named_estates=true, scales at most 8 planned estates per pass (interrupted reclaims first, then reclaimable estates idle 24 h by lease, release or reclaim evidence) to zero through the claimed runtime-preview-namespace.yml scale-to-zero, recording the start and lane app before the seam, retiring the release lane and recording reclaimed history; scheduled passes only report it.",
-    "successDefinition": "Fly inventory is reconciled and eligible terminal/closed PR capacity is released; every named estate is classified without a read failure, and a dispatched named reclaim leaves each target at zero Machines with its release lane retired and reclaimed history written. No eligible app or estate is a valid no-op.",
-    "failureDefinition": "Inventory, lease resolution, scale-down, or empty-app cleanup fails or is ambiguous; a named-estate Fly or authority read fails; a named reclaim is refused inside its claim (active owner, used since discovery, ownership or lane-app refusal) or any role keeps a Machine; or any named reclaim is incomplete (started but its release lane was never retired), which fails every pass until a dispatch finishes it.",
+    "purpose": "Reconcile completed PR Preview Machines and release capacity only after the per-app lease fence allows it. Its named-estate lane plans every named Preview estate (eval reuse keys, runtime up preview branch lanes, one-off namespaces) with `bun scripts/fly-preview-estate-lifecycle.ts --report --named-reclaim-plan` and, only on a workflow_dispatch with reclaim_named_estates=true, scales at most 8 planned estates per pass (interrupted reclaims first, then reclaimable estates idle 24 h by lease, release or reclaim evidence) to zero through the claimed runtime-preview-namespace.yml scale-to-zero, recording the start and lane app before the seam, retiring the release lane and recording reclaimed history; scheduled passes only report it. Each pass also returns the deeplinev1/load PlanetScale branch to its parked size when no Customer Workload Suite run is active on load-tests/framework, in case a load test's own teardown never ran.",
+    "successDefinition": "Fly inventory is reconciled and eligible terminal/closed PR capacity is released; every named estate is classified without a read failure, and a dispatched named reclaim leaves each target at zero Machines with its release lane retired and reclaimed history written. No eligible app or estate is a valid no-op. The load database is parked, a change toward that size is in flight, or an active Customer Workload Suite run on load-tests/framework may be holding it.",
+    "failureDefinition": "Inventory, lease resolution, scale-down, or empty-app cleanup fails or is ambiguous; a named-estate Fly or authority read fails; a named reclaim is refused inside its claim (active owner, used since discovery, ownership or lane-app refusal) or any role keeps a Machine; or any named reclaim is incomplete (started but its release lane was never retired), which fails every pass until a dispatch finishes it; or reading or parking the load database fails.",
     "startGraceMs": 600000,
     "runTimeoutMs": 3600000,
     "failureAlert": "github_workflow_run",

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -2281,6 +2281,39 @@ export async function releaseRateStateViaAppRuntime(
   });
 }
 
+/** Persist the final success batch without acquiring another provider permit. */
+export async function flushRateStateFeedbackViaAppRuntime(
+  context: WorkerRuntimeApiContext,
+  input: PlayRunnerRateStateReleaseInput,
+  signal: AbortSignal,
+): Promise<void> {
+  const batch = input.concurrencyObservationBatch;
+  if (!batch)
+    throw new Error('Rate-state feedback is missing its batch identity.');
+  const result = await postAppRuntimeApi<{
+    acknowledgedObservationBatch?: typeof batch;
+  }>(
+    {
+      ...context,
+      connectionRetryBudgetMs: 0,
+      signal: context.signal
+        ? AbortSignal.any([context.signal, signal])
+        : signal,
+    },
+    { action: 'rate_state_release', ...input },
+  );
+  const acknowledged = result.acknowledgedObservationBatch;
+  if (
+    acknowledged?.observerId !== batch.observerId ||
+    acknowledged.laneId !== batch.laneId ||
+    acknowledged.sequence !== batch.sequence
+  ) {
+    throw new Error(
+      'Rate-state receiver did not acknowledge the success batch.',
+    );
+  }
+}
+
 export async function penalizeRateStateViaAppRuntime(
   context: WorkerRuntimeApiContext,
   input: PlayRunnerRateStatePenalizeInput,

package/dist/bundling-sources/shared_libs/play-runtime/governor/app-runtime-rate-state-backend.ts

@@ -2,6 +2,7 @@ import {
   acquireRateStateViaAppRuntime,
   AppRuntimeApiTransportError,
   capacityShedRetryAfterMs,
+  flushRateStateFeedbackViaAppRuntime,
   penalizeRateStateViaAppRuntime,
   releaseRateStateViaAppRuntime,
   RateStateValidationUnavailableError,
@@ -54,6 +55,7 @@ export const RATE_ACQUIRE_MAX_WAIT_MS = 300_000;
  */
 export const PROVIDER_ADMISSION_WAIT_BUDGET_MS = 120_000;
 const PROVIDER_NO_PROGRESS_WARNING_MS = 180_000;
+const SUCCESS_FEEDBACK_DRAIN_TIMEOUT_MS = 10_000;
 
 /**
  * Permits leased per app-runtime round trip for the direct Node substrate.
@@ -77,6 +79,10 @@ export interface AppRuntimeRatePort {
   penalize(
     input: Parameters<typeof penalizeRateStateViaAppRuntime>[1],
   ): ReturnType<typeof penalizeRateStateViaAppRuntime>;
+  flushFeedback?(
+    input: Parameters<typeof flushRateStateFeedbackViaAppRuntime>[1],
+    signal: AbortSignal,
+  ): Promise<void>;
   validate?(
     input: Parameters<typeof validateRateStateViaAppRuntime>[1],
   ): ReturnType<typeof validateRateStateViaAppRuntime>;
@@ -87,6 +93,8 @@ function contextRatePort(context: WorkerRuntimeApiContext): AppRuntimeRatePort {
     acquire: (input) => acquireRateStateViaAppRuntime(context, input),
     release: (input) => releaseRateStateViaAppRuntime(context, input),
     penalize: (input) => penalizeRateStateViaAppRuntime(context, input),
+    flushFeedback: (input, signal) =>
+      flushRateStateFeedbackViaAppRuntime(context, input, signal),
     validate: (input) => validateRateStateViaAppRuntime(context, input),
   };
 }
@@ -296,6 +304,16 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
   private readonly effectiveRps = new Map<string, number>();
   private readonly pendingSuccesses = new Map<string, number>();
   private readonly successFeedbackFlights = new Map<string, SuccessFeedback>();
+  private readonly successFeedbackScopes = new Map<
+    string,
+    {
+      bucketId: string;
+      rateScopeToken?: string | null;
+      rules: readonly PacingRule[];
+    }
+  >();
+  private readonly successFeedbackSupported = new Set<string>();
+  private successFeedbackDrain: Promise<void> | null = null;
   /**
    * Completion samples travel with the next lease refill. This keeps the
    * Gradient2 checkpoint current without adding one gateway request per row.
@@ -790,6 +808,13 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
   ): void {
     if (retryAtMs <= (this.localProviderRetryAtMs.get(bucketId) ?? 0)) return;
     this.localProviderRetryAtMs.set(bucketId, retryAtMs);
+    const cadence = this.validatedDispatchCadences.get(bucketId);
+    const serverOffsetMs = this.serverClockOffsetsMs.get(bucketId) ?? 0;
+    // A new hold fences old tickets and their dispatch debt. Keep debt from
+    // sends after an expired hold; their physical spacing is still current.
+    if (cadence && cadence.lastAtMs + serverOffsetMs <= retryAtMs) {
+      this.validatedDispatchCadences.delete(bucketId);
+    }
     for (const waiting of this.scheduledPermitWaits.get(bucketId) ?? []) {
       if (waiting.retryAtMsAtGrant < retryAtMs) waiting.invalidate();
     }
@@ -1066,6 +1091,11 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
             }
           : rawResponse;
         this.acknowledgeSuccessFeedback(successKey, feedback);
+        if (response.successFeedbackSupported === true) {
+          this.successFeedbackSupported.add(bucketId);
+        } else {
+          this.successFeedbackSupported.delete(bucketId);
+        }
         this.recordCooldown(bucketId, response);
         if (response.scopeValidationSupported === true)
           this.validationScopes.add(bucketId);
@@ -1552,11 +1582,17 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
 
   observeSuccess(input: {
     bucketId: string;
+    rateScopeToken?: string | null;
     rules: readonly PacingRule[];
     latencyMs?: number | null;
   }): void {
     this.providerStalls.delete(input.bucketId);
     const key = pendingSuccessKey(input.bucketId, input.rules);
+    this.successFeedbackScopes.set(key, {
+      bucketId: input.bucketId,
+      rateScopeToken: input.rateScopeToken,
+      rules: input.rules,
+    });
     this.pendingSuccesses.set(
       key,
       Math.min(1_000_000, (this.pendingSuccesses.get(key) ?? 0) + 1),
@@ -1586,6 +1622,43 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
     this.pendingConcurrencyObservations.set(key, pending);
   }
 
+  async flushSuccessFeedback(): Promise<void> {
+    if (!this.port.flushFeedback) return;
+    if (this.successFeedbackDrain) return await this.successFeedbackDrain;
+    const signal = AbortSignal.timeout(SUCCESS_FEEDBACK_DRAIN_TIMEOUT_MS);
+    const drain = async () => {
+      for (const [key, scope] of this.successFeedbackScopes) {
+        // Older receivers retain their existing piggyback behavior. An explicit
+        // capability and matching batch acknowledgement protect rolling deploys.
+        if (!this.successFeedbackSupported.has(scope.bucketId)) continue;
+        for (;;) {
+          if (signal.aborted) throw abortReason(signal);
+          const feedback = this.snapshotSuccessFeedback(key);
+          if (!feedback.concurrencyObservationBatch) break;
+          await this.port.flushFeedback!(
+            {
+              ...scope,
+              rules: [...scope.rules],
+              leaseIds: [],
+              ...feedback,
+              schedulerSchema: this.schedulerSchema,
+            },
+            signal,
+          );
+          // A lost response leaves this exact frozen payload available to retry.
+          this.acknowledgeSuccessFeedback(key, feedback);
+        }
+        this.successFeedbackScopes.delete(key);
+      }
+    };
+    this.successFeedbackDrain = drain();
+    try {
+      await this.successFeedbackDrain;
+    } finally {
+      this.successFeedbackDrain = null;
+    }
+  }
+
   private newPendingConcurrencyObservations(
     key: string,
     observations: Array<{ kind: 'success'; latencyMs: number }> = [],
@@ -1626,6 +1699,14 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
       scopeRetryAtMsAtGrant,
       dispatchValidationSupported,
     ] = scheduled;
+    // Legacy grants have no shared hold snapshot. Capture their local fence
+    // when assigned, while keeping the signed gateway proof unchanged.
+    const localRetryAtMsAtGrant = this.validationScopes.has(bucketId)
+      ? scopeRetryAtMsAtGrant
+      : Math.max(
+          scopeRetryAtMsAtGrant,
+          this.localProviderRetryAtMs.get(bucketId) ?? 0,
+        );
     let settled = false;
     const refund = async (): Promise<void> => {
       if (!reservationId) {
@@ -1732,7 +1813,15 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
                 });
               }
               if (waitMs > 0) {
-                await this.sleep(waitMs, signal);
+                if (
+                  !(await this.waitForScheduledPermit(
+                    bucketId,
+                    localRetryAtMsAtGrant,
+                    waitMs,
+                    signal,
+                  ))
+                )
+                  return false;
                 continue;
               }
               this.validatedDispatchCadences.set(bucketId, {

package/dist/bundling-sources/shared_libs/play-runtime/governor/governor.ts

@@ -868,6 +868,7 @@ export function createPlayExecutionGovernor(
         if (!rules) return;
         input.rateState.observeSuccess?.({
           bucketId: rateScope[0],
+          ...(rateScope[1] ? { rateScopeToken: rateScope[1] } : {}),
           rules,
           latencyMs: success.latencyMs,
         });

package/dist/bundling-sources/shared_libs/play-runtime/governor/rate-state-backend.ts

@@ -197,6 +197,9 @@ export interface RateStateBackend {
     /** Provider residence measured at the HTTP boundary. */
     latencyMs?: number | null;
   }): void;
+
+  /** Bounded final feedback write after the invocation's provider work settles. */
+  flushSuccessFeedback?(): Promise<void>;
 }
 
 const NOOP_PERMIT: PacingPermit = {

package/dist/bundling-sources/shared_libs/play-runtime/play-run-recovery-policy.ts

@@ -72,11 +72,14 @@ export type PlayRunRecoveryDecision = Readonly<{
 export class PlayRunRecoveryError extends Error {
   readonly decision: PlayRunRecoveryDecision;
   readonly cause?: unknown;
+  /** Log-only provider facts; see `playRunRecoveryLogDetail`. */
+  readonly recoveryLogDetail?: unknown;
 
   constructor(input: {
     decision: PlayRunRecoveryDecision;
     message: string;
     cause?: unknown;
+    recoveryLogDetail?: unknown;
   }) {
     super(input.message);
     this.name = PLAY_RUN_RECOVERY_ERROR_NAME;
@@ -84,6 +87,9 @@ export class PlayRunRecoveryError extends Error {
     if (input.cause !== undefined) {
       this.cause = input.cause;
     }
+    if (input.recoveryLogDetail !== undefined) {
+      this.recoveryLogDetail = input.recoveryLogDetail;
+    }
   }
 }
 
@@ -106,7 +112,7 @@ export type PlayRunRecoveryLogDetail = Readonly<
 >;
 
 /**
- * Provider facts an adapter attached to the cause of a recovery error, for the
+ * Provider facts an adapter attached to a recovery error or its cause, for the
  * scheduler's defer log only. The decision's `reason` stays the single durable
  * recovery fact: this detail is never persisted, never returned to a caller,
  * and never read to choose a recovery action. It is bounded here, at the edge
@@ -119,9 +125,11 @@ export function playRunRecoveryLogDetail(
   try {
     if (!isPlayRunRecoveryError(error)) return null;
     const cause: unknown = error.cause;
-    if (!cause || typeof cause !== 'object') return null;
-    const supplied = (cause as { recoveryLogDetail?: unknown })
-      .recoveryLogDetail;
+    const supplied =
+      error.recoveryLogDetail ??
+      (cause && typeof cause === 'object'
+        ? (cause as { recoveryLogDetail?: unknown }).recoveryLogDetail
+        : undefined);
     if (!supplied || typeof supplied !== 'object' || Array.isArray(supplied)) {
       return null;
     }
@@ -203,6 +211,14 @@ export function recoveryForModalSandboxCreateFailure(
   const code = errorCode(error);
   const status = errorStatus(error);
   const message = messageOf(error);
+  // Only this rejection carries Modal's own words. Once it opens the circuit,
+  // later runs defer without calling Modal, and every reason here groups
+  // several provider conditions.
+  const recoveryLogDetail = {
+    providerCode: code,
+    providerStatus: status,
+    providerMessage: message,
+  };
   const resourceExhausted =
     code === 8 ||
     (typeof code === 'string' && /RESOURCE_EXHAUSTED/i.test(code)) ||
@@ -218,6 +234,7 @@ export function recoveryForModalSandboxCreateFailure(
       message:
         'Modal sandbox capacity is unavailable before customer execution began.',
       cause: error,
+      recoveryLogDetail,
     });
   }
 

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -90,6 +90,8 @@ export type PlayRunnerRateStateAcquireResult = {
   scopeValidationSupported?: boolean;
   /** This gateway rechecks signed provider permits on integration execute. */
   dispatchValidationSupported?: boolean;
+  /** This receiver acknowledges replay-safe success batches on release. */
+  successFeedbackSupported?: boolean;
   /**
    * Gateway clock used to produce `scheduledAtMs`. Runners translate the
    * schedule into relative delays so cross-machine clock skew cannot compress
@@ -138,6 +140,10 @@ export type PlayRunnerRateStateReleaseInput = {
   leaseIds: string[];
   /** Idempotently refund rate reservations that never reached provider fetch. */
   refundReservationIds?: string[];
+  /** Flush confirmed outcomes without reserving another provider permit. */
+  observedSuccesses?: number;
+  concurrencyObservations?: PlayRunnerRateStateConcurrencyObservation[];
+  concurrencyObservationBatch?: PlayRunnerRateStateConcurrencyObservationBatch;
   schedulerSchema?: string | null;
 };
 

package/dist/bundling-sources/shared_libs/play-runtime/runner-app/index.ts

@@ -3788,6 +3788,19 @@ async function run(
   } finally {
     clearInterval(workCounterTimer);
     emitWorkCounters();
+    try {
+      await rateStateBackend.rateState?.flushSuccessFeedback?.();
+    } catch (feedbackError) {
+      // Feedback is advisory: preserve the Play's result or original failure.
+      emitWorkerLog(
+        `[warn] runtime.provider_success_feedback_flush_failed: ${
+          feedbackError instanceof Error
+            ? feedbackError.message
+            : String(feedbackError)
+        }`,
+        options,
+      );
+    }
   }
 }
 

package/dist/bundling-sources/shared_libs/play-runtime/runtime-capacity-policy.ts

@@ -56,8 +56,20 @@ export const RUNTIME_CAPACITY_POLICY = {
     maxScaleDownMachinesPerReconcile: 2,
     /** Empty relay capacity must be quiet before it is reclaimed. */
     scaleDownQuietMs: 120_000,
+    /**
+     * Pooled Postgres clients per relay Machine when
+     * DEEPLINE_RUNTIME_GATEWAY_POOL_MAX_CLIENTS sets none, as in production.
+     * packages/runtime-gateway/server.ts explains the budget.
+     */
+    poolMaxClients: 6,
   },
   receiptGateway: {
+    /**
+     * Pooled Postgres clients per receipt-gateway Machine when
+     * DEEPLINE_RUNTIME_GATEWAY_POOL_MAX_CLIENTS sets none, as in production.
+     * packages/runtime-gateway/server.ts explains the budget.
+     */
+    poolMaxClients: 8,
     admissionTimeoutMs: 10_000,
     /** End identical receipt-row work before the caller can overlap a retry. */
     claimOperationTimeoutMs: 20_000,

package/dist/bundling-sources/shared_libs/play-runtime/sandbox-compute-usage.ts

@@ -88,6 +88,9 @@ export function resolveRuntimeSandboxComputeItems(input: {
         sandboxId,
         startedAt: resource.startedAt,
         endedAt,
+        maxBillingDurationSeconds: resource.maxBillingDurationSeconds,
+        observedWallTimeSeconds:
+          Math.max(0, observedEndedAt - resource.startedAt) / 1_000,
       }),
     );
   }
@@ -201,6 +204,9 @@ export function resolveDaytonaRuntimeComputeItems(input: {
         sandboxId,
         startedAt: resource.startedAt,
         endedAt,
+        maxBillingDurationSeconds: resource.maxBillingDurationSeconds,
+        observedWallTimeSeconds:
+          Math.max(0, observedEndedAt - resource.startedAt) / 1_000,
       }),
     );
   }

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-rate-scope.ts

@@ -72,7 +72,7 @@ export function acquireRateScopeSql(
         THEN CASE WHEN ${productiveRecovery} THEN ${AIMD_RECOVERY_STEP_MS}
           ELSE ${sparseRecoveryInterval} END
         ELSE LEAST(${floorRecoveryInterval}, CEIL(1000.0 / ${refillRate})) END`
-    : `LEAST(h.rate_recovery_interval_ms, ${AIMD_RECOVERY_STEP_MS})`;
+    : `${AIMD_RECOVERY_STEP_MS}`;
   // A local no-progress pause remains active after the provider's shorter
   // Retry-After. Only time beyond every outstanding dispatch/hold is idle.
   const observationWasIdle = `${successesParameter}::int = 0
@@ -202,13 +202,15 @@ export function updateRateScopeSql(
         ELSE ph.rate_probe_started_at_ms END,`
           : ''
       }
-      -- At the floor, a new successful epoch must not inherit failed-probe
-      -- backoff. Above the floor, retain its useful measurement duration for
-      -- sparse upward probes; that rate already proves successful recovery.
+      -- A productive known-provider epoch uses the one-second recovery window,
+      -- so its old measurement must not become a failed-probe streak when the
+      -- success counter resets. Unknown providers above the floor retain that
+      -- measurement for their separate sparse upward-probe policy.
       rate_recovery_interval_ms = CASE
-        WHEN ${unknownProvider} AND (SELECT granted FROM grant_calc) > 0
+        WHEN (SELECT granted FROM grant_calc) > 0
           AND ph.rate_successes > 0
-          AND ph.next_refill_per_sec <= ${DEFAULT_UNKNOWN_PROVIDER_MIN_RPS}
+          AND (${!unknownProvider}
+            OR ph.next_refill_per_sec <= ${DEFAULT_UNKNOWN_PROVIDER_MIN_RPS})
           AND (ph.observation_was_idle
             OR ph.rate_observation_started_at_ms IS NULL)
           -- Zero is an unmeasured new episode, not a failed-probe interval.