Run summary can misattribute an earlier session's act — a drain-time-stamped act with no reliable `at` lands in a later run's time window

[serge-ivo]

What happened

Owner feedback (recorded in-session, instance a185b1db PAGS Coder, 2026-08-16): the run summary for run 906cf1d3 ended with "Acts: opened a pull request", but that run only posted a comment and closed PR #675 — and PR #675 was opened in an earlier session (2026-08-16T01:55:40Z), before run 906cf1d3 started. The pr.open act was attributed to the wrong run, and the objective explicitly said no pull requests, so the summary reads as a policy breach the run did not commit.

Where it lives

closeDelegation in workers/api/src/workflows/coding-session.ts builds the actLine from actsInWindow(env, userId, instanceId, runStartedAt, Date.now()) (lib/instance-work.ts). Attribution is by time window, deliberately (not trace_id), because a console terminal poll can drain a run's acts before the Pilot does and stamps the session id — see the actsInWindow doc comment. The window [runStartedAt, now] correctly excludes an earlier act only if that act's recorded ts is its real time.

Residual vector

recordEngineActs (lib/engine-acts.ts) writes ts: Date.parse(act.at) || Date.now(). If a runner reports an act with a missing or unparseable at, the act is stamped with the drain time instead of when it happened. An earlier-session act drained during a later run's window then lands inside [runStartedAt, now] and is misattributed — exactly the observed symptom. The window fix closed the trace-id race but not this fallback-timestamp case.

Ask

1. Confirm whether at is always populated for pr.open in the browser-runner's EngineActRecord; if it can be absent, stop the || Date.now() fallback from placing an act inside an unrelated run's window (e.g. drop acts with no reliable at from the window, or clamp them out).
2. If already covered by later hardening, close with the evidence.

Filed from owner feedback 53e9701c-f2ad-477f-9471-22f297b22e87. Original run's trace has aged out (14-day retention), so this is code-grounded rather than reproducible from the trace.

[serge-ivo]

Fixed in commit 6f714ec. sanitizeEngineActs now tracks atReliable: boolean — false when the runner omitted or sent an unparseable at. recordEngineActs stores ts = 0 for those rows so they can never satisfy actsInWindow's ts >= runStartedAt predicate. Properly-timestamped acts continue to use the runner's timestamp.