fix(tasks): reap ancient queued runs whose updated_at keeps bumping

[tatoalo]

Problem

The TasksAgentStaleQueuedRuns alert fires when the oldest queued cloud TaskRun (measured by created_at) is older than 24h. The janitor that's supposed to clear these (kill_stale_queued_task_runs) selects candidates by a different clock — updated_at < now-24h.

That divergence leaves a gap: a run that stays QUEUED while something keeps bumping its updated_at (a stuck workflow writing run state, never progressing to IN_PROGRESS) never trips the janitor's updated_at rule. The janitor never reaps it, so the alert fires indefinitely and is not actionable.

This was caught by a live prod-us alert: a single user_created cloud run stuck in QUEUED, created_at ~24.7h old, that survived the hourly janitor tick because its updated_at was materially newer than its created_at.

Changes

Add a created_at hard-cap backstop to the janitor, alongside the existing updated_at rule:

• get_stale_queued_task_run_ids gains an optional created_hard_cap (and a hard_cap_min_queued grace, default 1h). A run is now a candidate if its updated_at is older than the primary window OR its created_at is older than the cap AND it has been untouched for longer than the grace.
• The janitor passes created_hard_cap=48h, so a run older than 48h that hasn't been touched in over an hour is reaped regardless of updated_at.

The one-hour grace is what preserves the original intent of keying on updated_at: a run that prepare_for_cloud_handoff re-queued moments ago (and is about to resume) has a fresh updated_at and is still spared, so long-lived interactive runs are unaffected. Worst-case cleanup for a genuinely stuck run is now bounded at 48h instead of never.

[github-actions]

Focused janitor-task fix with correct OR-query logic, backward-compatible signature change, single call site updated in the same PR, and good test coverage for both the reap and grace-window paths. No data model, API contract, or security surface touched.

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(tasks): reap ancient queued runs who..." | Re-trigger Greptile}

[stamphog]

Retaining stamphog approval — delta since last review classified as trivial_paths.

[tests-posthog]

⏭️ Skipped snapshot commit because branch advanced to ea7475f while workflow was testing ca0d336.

The new commit will trigger its own snapshot update workflow.

If you expected this workflow to succeed: This can happen due to concurrent commits. To get a fresh workflow run, either:

• Merge master into your branch, or
• Push an empty commit: git commit --allow-empty -m 'trigger CI' && git push

[stamphog]

Retaining stamphog approval — delta since last review classified as mixed_trivial.

[tests-posthog]

⏭️ Skipped snapshot commit because branch advanced to 236daa9 while workflow was testing ea7475f.

The new commit will trigger its own snapshot update workflow.

If you expected this workflow to succeed: This can happen due to concurrent commits. To get a fresh workflow run, either:

• Merge master into your branch, or
• Push an empty commit: git commit --allow-empty -m 'trigger CI' && git push

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-06-26 17:47 UTC	Run
prod-us	✅ Deployed	2026-06-26 18:13 UTC	Run
prod-eu	✅ Deployed	2026-06-26 18:15 UTC	Run