fix(broker): reconcile owned identity cleanup on a jittered backoff until it resolves

.agentworkforce/trajectories/rs-relaycast-d1/active/traj_jumh13krdh7q/trajectory.json

@@ -0,0 +1,162 @@
+{
+  "id": "traj_jumh13krdh7q",
+  "version": 1,
+  "task": {
+    "title": "Finish relay PR 1969 checks and review threads without bypassing required approval",
+    "source": {
+      "system": "plain",
+      "id": "relay#1969"
+    }
+  },
+  "status": "active",
+  "startedAt": "2026-10-13T09:52:37.132Z",
+  "agents": [
+    {
+      "name": "default",
+      "role": "lead",
+      "joinedAt": "2026-10-13T09:58:24.852Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_wo294hy0g2za",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-10-13T09:58:24.852Z",
+      "events": [
+        {
+          "ts": 1791885504852,
+          "type": "decision",
+          "content": "Require exact-token evidence before treating a persistent release 404 as terminal: Require exact-token evidence before treating a persistent release 404 as terminal",
+          "raw": {
+            "question": "Require exact-token evidence before treating a persistent release 404 as terminal",
+            "chosen": "Require exact-token evidence before treating a persistent release 404 as terminal",
+            "alternatives": [],
+            "reasoning": "The by-name release index is eventually consistent. A successful exact-token read proves the identity is still live and retains custody; an invalid/not-found exact token or a locally proven replacement generation permits safe completion. Missing ownership proof remains retryable and keeps the worker name reserved."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791886108683,
+          "type": "reflection",
+          "content": "All five open review findings are covered by code or tests; the new RelayFlow proves base versus head generation-conflict behavior, while the full broker suite and build pass.",
+          "raw": {
+            "focalPoints": [
+              "review-safety",
+              "proof",
+              "verification"
+            ],
+            "confidence": 0.9
+          },
+          "significance": "high",
+          "tags": [
+            "focal:review-safety",
+            "focal:proof",
+            "focal:verification",
+            "confidence:0.9"
+          ]
+        },
+        {
+          "ts": 1791886828636,
+          "type": "decision",
+          "content": "Use durable agent-id workspace verification for cleanup recovery: Use durable agent-id workspace verification for cleanup recovery",
+          "raw": {
+            "question": "Use durable agent-id workspace verification for cleanup recovery",
+            "chosen": "Use durable agent-id workspace verification for cleanup recovery",
+            "alternatives": [],
+            "reasoning": "A restarted broker no longer has the exact bearer token, and persisting that reusable secret would violate journal hygiene. The existing journal agent_id plus an independent workspace lookup distinguishes confirmed absence, replacement, and a still-live original generation without weakening custody."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791888565057,
+          "type": "decision",
+          "content": "Use Relaycast atomic exact-release for journaled cleanups: Use Relaycast atomic exact-release for journaled cleanups",
+          "raw": {
+            "question": "Use Relaycast atomic exact-release for journaled cleanups",
+            "chosen": "Use Relaycast atomic exact-release for journaled cleanups",
+            "alternatives": [],
+            "reasoning": "Relaycast 10.3 exposes a crash-safe immutable-ID and idempotency-key release endpoint. Using it avoids stale by-name absence proofs; legacy journals without agent_id remain retryable and fail closed."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791889916352,
+          "type": "decision",
+          "content": "Extended the 1615 RelayFlow fake Relaycast with the 10.3 release-exact contract: Extended the 1615 RelayFlow fake Relaycast with the 10.3 release-exact contract",
+          "raw": {
+            "question": "Extended the 1615 RelayFlow fake Relaycast with the 10.3 release-exact contract",
+            "chosen": "Extended the 1615 RelayFlow fake Relaycast with the 10.3 release-exact contract",
+            "alternatives": [],
+            "reasoning": "The production cleanup path now uses immutable agent-id and token-hash proof. The existing routing proof must accept and validate that exact release during teardown while preserving legacy release for its base arm."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791890710219,
+          "type": "decision",
+          "content": "Pinned Fleet E2E to the released Relaycast v10.3 engine: Pinned Fleet E2E to the released Relaycast v10.3 engine",
+          "raw": {
+            "question": "Pinned Fleet E2E to the released Relaycast v10.3 engine",
+            "chosen": "Pinned Fleet E2E to the released Relaycast v10.3 engine",
+            "alternatives": [],
+            "reasoning": "The prior fixture predates /v1/agents/release-exact, so failed-spawn cleanup could not settle. The release workflow was completed first specifically to make the atomic contract available; the targeted unsupported-resume scenario passes against the v10.3 source tree."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791891580056,
+          "type": "decision",
+          "content": "Queued fleet release completion before inventory removal: Queued fleet release completion before inventory removal",
+          "raw": {
+            "question": "Queued fleet release completion before inventory removal",
+            "chosen": "Queued fleet release completion before inventory removal",
+            "alternatives": [],
+            "reasoning": "Relaycast v10.3 atomically authorizes a built-in release while the exact agent binding is still active. Sending agent.deregister first creates a deterministic generation conflict; FIFO action.result first lets the engine own the atomic lifecycle transition, after which local inventory can be pruned."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791895058900,
+          "type": "decision",
+          "content": "Pin the draft Relay integration to Relaycast SDK PR commit 3fa31906: Pin the draft Relay integration to Relaycast SDK PR commit 3fa31906",
+          "raw": {
+            "question": "Pin the draft Relay integration to Relaycast SDK PR commit 3fa31906",
+            "chosen": "Pin the draft Relay integration to Relaycast SDK PR commit 3fa31906",
+            "alternatives": [],
+            "reasoning": "The atomic helper is not published and publishing is explicitly out of scope; an exact Git revision makes the preparatory commit reproducible and must be replaced by a released SDK version before merge."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791895058953,
+          "type": "reflection",
+          "content": "The cache race predates PR 1969 in the synchronous release path; PR 1969 adds a second background-cleanup occurrence. Both now use the SDK atomic helper in the draft integration.",
+          "raw": {
+            "focalPoints": [
+              "scope",
+              "atomicity",
+              "integration"
+            ],
+            "confidence": 0.95
+          },
+          "significance": "high",
+          "tags": [
+            "focal:scope",
+            "focal:atomicity",
+            "focal:integration",
+            "confidence:0.95"
+          ]
+        }
+      ]
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "AgentWorkforce/relay",
+  "tags": [],
+  "_trace": {
+    "startRef": "7ce7ba5e9bbb77019e40e2e25965307070b9ee3c",
+    "endRef": "7ce7ba5e9bbb77019e40e2e25965307070b9ee3c"
+  }
+}

.github/workflows/fleet-e2e.yml

@@ -65,15 +65,15 @@ jobs:
 
       # The relaycast engine lives in a separate repo. This E2E drives the
       # node-provider model and heartbeats whose load may be unreported for
-      # unbounded providers. This companion PR candidate supplies isolated
-      # registration, acknowledged cleanup and node-owned spawn status reads.
-      # It is a test pin, not a released or deployed product dependency.
+      # unbounded providers. This released engine supplies isolated
+      # registration, atomic generation-guarded cleanup and node-owned spawn
+      # status reads. It is a test pin, not a deployed product dependency.
       - name: Checkout relaycast engine (node-provider model)
         uses: actions/checkout@v4
         with:
           persist-credentials: false
           repository: AgentWorkforce/relaycast
-          ref: a5c7ac66f64a650274fbe2c60e3cd5d3c9b87dcd # relaycast#387: verified served-node spawn completion
+          ref: aabc862dd0ef9ea77bbddb1590907530e30ac070 # relaycast v10.3.0: atomic exact-agent release
           path: relaycast-engine
 
       - name: Setup Node.js

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Owned worker-name cleanup no longer gives up after five tries and blocks the name until manual recovery. The broker keeps reconciling the release on a jittered backoff (up to five minutes between attempts), confirms persistent by-name absence through the captured agent token, and preserves a replacement generation's cached credential. Cleanup without captured ownership proof fails closed and keeps the name reserved instead of claiming an unverified deletion.
 - `npx @agent-relay/connect join` no longer waits 60 seconds and rolls back when the local probe is running but cannot match the command to a live Claude Code or Codex session (for example, when it was run from a separate terminal). It stops within about a second and says to run the command from the agent's own shell. A timeout that does happen now names the probe's last answer. `connect install` no longer reports such a probe as ready when its version cannot be checked.
 
 ## [13.4.0] - 2026-10-11

crates/broker/Cargo.toml

@@ -29,7 +29,7 @@ json5 = "0.4"
 sha2 = "0.10"
 shlex = "1.3"
 thiserror = "2.0"
-relaycast = "=8.0.1"
+relaycast = "9.0.0"
 tokio = { version = "1.44", features = ["full"] }
 tracing = "0.1"
 tracing-appender = "0.2"

crates/broker/src/node_control.rs

@@ -386,6 +386,7 @@ pub(crate) fn create_node_request(
         max_agents: None,
         tags: None,
         version: Some(broker_version.to_string()),
+        machine_id: None,
     }
 }