docs(changelog): every runner lease says whose workspace it belongs to

changelog.mdx

@@ -7,6 +7,35 @@ description: "Stay up to date with the latest agentsfleet product updates, new f
   agentsfleet is in **stealth-mode testing** and pre-production. APIs and agent behavior may change between releases without long deprecation windows. Email [agentsfleet@agentmail.to](mailto:agentsfleet@agentmail.to) if you want a hand calibrating an agent or to join as a design partner.
 </Tip>
 
+<Update label="Jul 31, 2026" tags={["Breaking", "What's new", "Bug fixes", "API", "UI", "Performance"]}>
+  ## Every runner lease says whose workspace it belongs to
+
+  A runner's lease list showed every workspace's work in one undifferentiated table, so an operator looking at a shared host could not tell their own fleet's runs from anyone else's. Each lease now names its workspace, and one click narrows the table to that workspace alone. The same release stops the runner pages re-reading a host's whole history on every load, and starts pruning that history so it cannot grow without bound.
+
+  ## Upgrading
+
+  - **Runner lease history is pruned 30 days after settlement.** A background sweep deletes a settled lease once 30 days pass from the moment it settled — not from when it started — along with the two per-lease activity records that describe it. A lease still running or renewing is never touched, and the runner's lifecycle activity (the Activity feed) is kept at any age, so a long-lived host never shows an empty feed. A lease whose runner died without reporting, on a fleet that is never used again, is marked expired once it passes the same window and then keeps its own window like any settled lease. The lifetime counts on the runner page are unaffected — they count transitions as they happen, not surviving rows — but if you read raw lease history older than 30 days through `GET /v1/fleets/runners/{id}/leases`, export it before upgrading.
+  - **Four migrations apply on startup.** They add a per-runner counter table, an index for the activity feed's filtered reads, the delete grants the sweep needs, and two indexes that keep the sweep itself off whole-table scans. The counter table backfills itself from existing history inside the migration, so no step is manual and no existing row is rewritten.
+
+  ## What's new
+
+  - **The lease table has a Workspace column.** Each row links to that workspace's fleet wall and carries the full identifier in its tooltip; a funnel beside it narrows the table to that workspace alone.
+  - **The workspace filter lives in the address bar.** `?workspace=<id>` is deep-linkable, survives a reload, and Back steps out of it — so a narrowed view is something you can send to someone.
+
+  ## API reference
+
+  - `GET /v1/fleets/runners/{id}/leases?workspace_id=<uuid>` — new optional filter, still requiring `runner:read`. The response shape is unchanged and `total` narrows with the page. A malformed value answers `400` `UZ-REQ-001`; a well-formed identifier that owns nothing answers an empty page rather than an error, so a stale link reads as "no leases" instead of failing. `starting_after` composes with the filter: the cursor must name a lease on the filtered page, and one taken under a different `workspace_id` answers the same `400` `UZ-REQ-001` instead of silently skipping rows.
+
+  ## Bug fixes
+
+  - **A runner that refused a run no longer reads as a fleet missing instructions.** Both conditions reported the same startup class, so a sandbox, egress, or resource-control refusal on the host was blamed on the fleet's own configuration. The chat row now names the runner's reason.
+  - **Deleting an account unregisters its scheduled runs.** The purge removed the schedule rows but never told the upstream scheduler, so an erased tenant's cron kept firing at runners indefinitely. Teardown now unregisters upstream while those rows still exist, and counts a provider failure on `agentsfleet_account_teardown_unregister_failures_total` rather than swallowing it — erasure still completes either way.
+  - **One failed schedule no longer strands the rest.** The unregister pass stopped at the first provider error, leaving every schedule behind it firing forever. Each schedule is now attempted; a failure is logged with the identifiers needed to retire the survivor by hand, and missing provider credentials count on the same failure counter instead of passing silently.
+  - **Simultaneous account deletions no longer skip the scheduler.** Concurrent deletions could exhaust the database connection pool, time out every unregister, and still complete the purge. The unregister pass now runs without holding a connection, so deletions queue instead of starving each other.
+  - **A stale lease link offers a way back.** A bookmarked lease page whose workspace filter or page cursor the server no longer accepts showed "try refreshing", which replayed the same address every time — and the control that could clear the filter sits inside the table that a failed read does not draw. That page now links to the newest leases instead.
+  - **The runner page no longer re-counts a host's whole history to show four numbers.** Acquired, succeeded, failed, and expired are maintained as each lease settles, so the page cost stays flat however long the host has been running.
+</Update>
+
 <Update label="Jul 31, 2026" tags={["Breaking", "What's new", "API", "UI", "Security"]}>
   ## The isolation you assign is the isolation the runner applies