@desplega.ai/agent-swarm 1.145.0 → 1.147.0

package/src/be/db.ts

@@ -1,5 +1,4 @@
-import { Database } from "bun:sqlite";
-import { parseProviderMeta } from "@/utils/provider-metadata.ts";
+import type { Database } from "bun:sqlite";
 import pkg from "../../package.json";
 import { defaultAssetKey, normalizeAssetKey } from "../assets/key";
 import {
@@ -8,7 +7,6 @@ import {
   matchesDefaultClaudeMd,
   matchesDefaultIdentityMd,
 } from "../prompts/defaults";
-import { configureDbResolver } from "../prompts/resolver";
 import { realtimeBus } from "../realtime/bus";
 import { slackChannelFromContextKey } from "../tasks/slack-routing";
 import { _resolveIntegrationType, emitIntegrationConnected, telemetry } from "../telemetry";
@@ -16,14 +14,11 @@ import type {
   ActiveSession,
   Agent,
   AgentAvatar,
-  AgentCredStatus,
   AgentLog,
   AgentLogEventType,
   AgentMcpServer,
   AgentSkill,
-  AgentStatus,
   AgentTask,
-  AgentTaskSource,
   AgentTaskStatus,
   AgentTaskSummary,
   AgentWithTasks,
@@ -35,16 +30,13 @@ import type {
   BudgetRefusalCause,
   BudgetRefusalNotification,
   BudgetScope,
-  ChangeSource,
   Channel,
   ChannelMessage,
   ChannelType,
   ContextSnapshot,
   ContextSnapshotEventType,
-  ContextVersion,
   CooldownConfig,
   FavoriteItemType,
-  FollowUpConfig,
   InboxItemState,
   InboxItemStatus,
   InboxItemType,
@@ -71,12 +63,12 @@ import type {
   PricingProvider,
   PricingRow,
   PricingTokenClass,
+  ProfileExpectedHashes,
+  ProfileSyncConflict,
   PromptTemplate,
   PromptTemplateHistory,
   ProviderName,
-  ReasoningEffort,
   RepoGuidelines,
-  RoutingAffinity,
   ScheduledTask,
   ScheduledTaskSummary,
   ScriptRun,
@@ -123,22 +115,18 @@ import type {
   WorkflowVersion,
 } from "../types";
 import {
-  AgentAvatarSchema,
   type CreateTaskOptions,
   CreateTaskOptionsSchema,
-  FollowUpConfigSchema,
   isTerminalTaskStatus,
   type ModelTier,
   parseModelTier,
-  ReasoningEffortSchema,
-  RoutingAffinitySchema,
   SERVER_GENERATED_ATTACHMENT_CAPABILITY,
   SessionCostModelBreakdownSchema,
 } from "../types";
 import { deriveProviderFromKeyType } from "../utils/credentials";
-import { isEnvFlagEnabled } from "../utils/env-flag";
 import type { RateLimitWindowTelemetry } from "../utils/error-tracker";
 import { extractGitHubPullRequestUrls } from "../utils/github-pull-request";
+import { validateHeartbeatExpiry } from "../utils/heartbeat-expiry";
 import {
   type BudgetedIdentityField,
   checkIdentityFieldBudget,
@@ -146,20 +134,167 @@ import {
 } from "../utils/identity-field-budget";
 import { getCurrentRequestUserId } from "../utils/request-auth-context";
 import { registerVolatileSecret, scrubSecrets } from "../utils/secret-scrubber";
-import { auditAssetKeys, enforceAssetKeyStartupAudit } from "./asset-key-audit";
-import { migrateLegacyCredentialBindingBlob } from "./connection-bindings-blob-migration";
-import { decryptSecret, encryptSecret, getEncryptionKey, resolveEncryptionKey } from "./crypto";
+import { auditAssetKeys } from "./asset-key-audit";
+import { decryptSecret, encryptSecret, getEncryptionKey } from "./crypto";
 import { normalizeDate, normalizeDateRequired } from "./date-utils";
-import { createBunSqliteClient, type DbClient } from "./db-client";
-import { runMigrations } from "./migrations/runner";
-import { autoEncryptLegacyOAuthSecrets } from "./oauth-encryption-backfill";
-import { seedDefaultTemplates } from "./seed-prompt-templates";
+import {
+  type AgentRow,
+  configureAgentDependencies,
+  getActiveTaskCount,
+  getAgentById,
+  getAllAgents,
+  isAgentEligibleForTask,
+  rowToAgent,
+} from "./db/agents";
+import {
+  computeContentHash,
+  createContextVersion,
+  getLatestContextVersion,
+} from "./db/context-versions";
+import { getDb, getDbClient } from "./db/runtime";
+import {
+  type AgentTaskRow,
+  configureTaskReadDependencies,
+  type ExistingTrackerContextWork,
+  findExistingLinearTrackerContextWork,
+  getTaskById,
+  getTasksByAgentId,
+  rowToAgentTask,
+  rowToAgentTaskSummary,
+} from "./db/tasks/read";
+import { configureTaskWriteDependencies, failTask } from "./db/tasks/write";
 import { promotePendingSteeringForTask } from "./steering";
 import { isReservedConfigKey, reservedKeyError } from "./swarm-config-guard";
 import { emitTaskStarted } from "./task-lifecycle-events";
 
-let db: Database | null = null;
-let sqliteVecAvailable = false;
+export {
+  buildRoutingAffinityFromAgent,
+  createAgent,
+  deleteAgent,
+  getActiveTaskCount,
+  getAgentById,
+  getAgentHarnessProviders,
+  getAllAgents,
+  getLeadAgent,
+  getRemainingCapacity,
+  hasCapacity,
+  incrementEmptyPollCount,
+  isAgentEligibleForTask,
+  isPoolAffinityEnforcementEnabled,
+  listAgentsWithCredStatusByProvider,
+  MAX_EMPTY_POLLS,
+  resetEmptyPollCount,
+  setAgentHarnessProvider,
+  shouldBlockPolling,
+  updateAgentActivity,
+  updateAgentCredentialMissing,
+  updateAgentCredentialState,
+  updateAgentCredStatus,
+  updateAgentMaxTasks,
+  updateAgentProvider,
+  updateAgentStatus,
+  updateAgentStatusFromCapacity,
+} from "./db/agents";
+export {
+  computeContentHash,
+  createContextVersion,
+  getContextVersion,
+  getContextVersionHistory,
+  getLatestContextVersion,
+} from "./db/context-versions";
+
+configureAgentDependencies({
+  createLogEntry: (entry) => createLogEntry(entry),
+  installSystemDefaultSkillsForAgent: (agentId) => installSystemDefaultSkillsForAgent(agentId),
+});
+
+export {
+  __resetSqliteVecExtensionPathCacheForTests,
+  closeDb,
+  getDb,
+  getDbClient,
+  initDb,
+  isSqliteVecAvailable,
+  resolveSqliteVecExtensionPath,
+} from "./db/runtime";
+
+export {
+  type ExistingTrackerContextWork,
+  type ExistingTrackerContextWorkReason,
+  findCompletedTaskInThread,
+  findExistingLinearTrackerContextWork,
+  findRecentCancelledTaskInThread,
+  findTaskByGitHub,
+  findTaskByVcs,
+  getAgentCurrentTask,
+  getAgentWorkingOnThread,
+  getAllTasks,
+  getChildTasks,
+  getCompletedSlackTasks,
+  getInProgressSlackTasks,
+  getInProgressTasksByContextKey,
+  getLatestActiveTaskInThread,
+  getLatestLeadTaskInThread,
+  getLatestScriptRunStepTaskByContextKey,
+  getLatestTaskByContextKey,
+  getMostRecentTaskInThread,
+  getPendingSlackRelayTasks,
+  getRecentlyFinishedWorkerTasks,
+  getSlackTasksMissingTree,
+  getTaskById,
+  getTaskStats,
+  getTasksByAgentId,
+  getTasksByStatus,
+  getTasksCount,
+  hasNonTerminalRerouteDecisionChild,
+  hasNonTerminalResumeChild,
+  markFinalizedSlackRelaysDelivered,
+  markSlackRelayAttempted,
+  markSlackRelayDelivered,
+  markTasksNotified,
+  resetTasksNotified,
+  type TaskFilters,
+} from "./db/tasks/read";
+
+export {
+  assignUnassignedTaskPending,
+  backfillSupersedeTaskResumeTaskId,
+  cancelTask,
+  completeTask,
+  createTask,
+  deleteTask,
+  failTask,
+  getOrphanedInProgressTasksForAgent,
+  getPausedTasksForAgent,
+  getPendingTaskForAgent,
+  getRecentlyCancelledTasksForAgent,
+  overwriteTerminalTaskResultText,
+  pauseTask,
+  resetOrphanedInProgressTasksForAgent,
+  resumeTask,
+  startTask,
+  supersedeTask,
+  updateTaskClaudeSessionId,
+  updateTaskProgress,
+  updateTaskTitle,
+} from "./db/tasks/write";
+
+configureTaskWriteDependencies({
+  createLogEntry: (...args) => createLogEntry(...args),
+  checkDependencies: (...args) => checkDependencies(...args),
+  reconcileTaskPullRequestAttachments: (...args) => reconcileTaskPullRequestAttachments(...args),
+  emitTaskLifecycleTelemetryAfterCommit: (...args) =>
+    emitTaskLifecycleTelemetryAfterCommit(...args),
+  taskContextForTelemetry: (...args) => taskContextForTelemetry(...args),
+  promotePendingSteeringForTask: (...args) => promotePendingSteeringForTask(...args),
+  cascadeFailDependents: (...args) => cascadeFailDependents(...args),
+});
+
+configureTaskReadDependencies({
+  checkDependencies: (taskId) => checkDependencies(taskId),
+  assetKeyPrefixPattern: (input) => assetKeyPrefixPattern(input),
+  previewText: (text, maxChars) => previewText(text, maxChars),
+});
 
 type TaskTelemetryProps = Parameters<typeof telemetry.taskEvent>[1];
 type TaskTelemetryContext = {
@@ -211,303 +346,6 @@ function taskContextForTelemetry(task: AgentTask): TaskTelemetryContext {
   return context;
 }
 
-export function isSqliteVecAvailable(): boolean {
-  return sqliteVecAvailable;
-}
-
-/**
- * Resolve the sqlite-vec loadable extension path without opening a Database.
- * Mirrors loadSqliteVec's env-var-first, npm-fallback resolution, but returns
- * the path instead of loading it: the bounded db-query child process (see
- * src/http/db-query-bounded.ts) opens its own read-only connection and must
- * load the extension itself, so the parent resolves the path once and passes
- * it along. The result is memoized — `undefined` is a valid resolved answer
- * (extension genuinely unavailable) and is cached too, so a failing
- * `require` doesn't retry on every query.
- */
-let cachedSqliteVecExtensionPath: string | undefined | null = null;
-
-export function resolveSqliteVecExtensionPath(): string | undefined {
-  if (cachedSqliteVecExtensionPath !== null) return cachedSqliteVecExtensionPath;
-  const extensionPath = process.env.SQLITE_VEC_EXTENSION_PATH;
-  if (extensionPath) {
-    cachedSqliteVecExtensionPath = extensionPath;
-    return cachedSqliteVecExtensionPath;
-  }
-  try {
-    cachedSqliteVecExtensionPath = (
-      require("sqlite-vec") as { getLoadablePath(): string }
-    ).getLoadablePath();
-  } catch {
-    cachedSqliteVecExtensionPath = undefined;
-  }
-  return cachedSqliteVecExtensionPath;
-}
-
-/** Test-only: clear the memoized sqlite-vec extension path cache. */
-export function __resetSqliteVecExtensionPathCacheForTests(): void {
-  cachedSqliteVecExtensionPath = null;
-}
-
-function loadSqliteVec(database: Database): void {
-  sqliteVecAvailable = false;
-  try {
-    const extensionPath = process.env.SQLITE_VEC_EXTENSION_PATH;
-    if (extensionPath) {
-      database.loadExtension(extensionPath);
-    } else {
-      const sqliteVec = require("sqlite-vec");
-      sqliteVec.load(database);
-    }
-    sqliteVecAvailable = true;
-    console.log(`[db] sqlite-vec loaded${extensionPath ? ` from ${extensionPath}` : ""}`);
-  } catch (err) {
-    console.warn(
-      "[db] sqlite-vec not available, falling back to in-memory cosine:",
-      (err as Error).message,
-    );
-  }
-}
-
-export function initDb(dbPath = "./agent-swarm-db.sqlite"): Database {
-  if (db) {
-    return db;
-  }
-
-  // Fast path for tests: restore from pre-built template that already has
-  // migrations, seeds, and all post-init work baked in. Only the per-connection
-  // PRAGMA and the in-memory resolver function need to be set.
-  const templateGlobals = globalThis as typeof globalThis & {
-    __testMigrationTemplate?: Uint8Array;
-  };
-  const templateBytes = templateGlobals.__testMigrationTemplate;
-  if (templateBytes) {
-    db = Database.deserialize(templateBytes);
-    db.run("PRAGMA busy_timeout = 5000;");
-    db.run("PRAGMA foreign_keys = ON;");
-    loadSqliteVec(db);
-    configureDbResolver(resolvePromptTemplate);
-    enforceAssetKeyStartupAudit(db);
-    // Ensure the encryption key is resolved even when restoring from the test
-    // template. The cache may have been cleared via __resetEncryptionKeyForTests
-    // between test suites; this call is a no-op if the cache is already warm.
-    resolveEncryptionKey(dbPath);
-    return db;
-  }
-
-  db = new Database(dbPath, { create: true });
-  console.log(`Database initialized at ${dbPath}`);
-
-  const database = db;
-  database.run("PRAGMA journal_mode = WAL;");
-  database.run("PRAGMA busy_timeout = 5000;");
-  database.run("PRAGMA foreign_keys = ON;");
-  database.run("PRAGMA synchronous = NORMAL;");
-  database.run("PRAGMA cache_size = -64000;");
-  database.run("PRAGMA mmap_size = 268435456;");
-  database.run("PRAGMA temp_store = MEMORY;");
-
-  // Load sqlite-vec extension for vector search.
-  // In compiled binaries (`bun build --compile`) the JS lives in /$bunfs/ and
-  // `require.resolve("sqlite-vec-<platform>/vec0.so")` can't find the native
-  // asset — so we prefer an explicit filesystem path when set, and only fall
-  // back to the npm resolver for normal dev runs.
-  loadSqliteVec(database);
-
-  // Run database migrations (schema creation + incremental changes)
-  try {
-    runMigrations(database);
-  } catch (error) {
-    db = null;
-    try {
-      database.close();
-    } catch (closeError) {
-      console.error("[migrations] Failed to close database after migration failure:", closeError);
-    }
-    throw error;
-  }
-
-  // Compatibility migration for legacy databases that predate profile fields
-  ensureAgentProfileColumns(database);
-
-  // Migration: Remove restrictive CHECK constraint on agent_tasks.status
-  // Old databases have CHECK(status IN ('pending','in_progress','completed','failed'))
-  // which blocks 'cancelled', 'paused', 'offered', 'unassigned' statuses
-  try {
-    const taskSchemaInfo = db
-      .prepare<{ sql: string | null }, []>(
-        "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'agent_tasks'",
-      )
-      .get();
-
-    const schemaSql = taskSchemaInfo?.sql ?? "";
-    const hasStatusCheck = /status\s+TEXT\b[^,]*\bCHECK\s*\(\s*status\s+IN\s*\(/i.test(schemaSql);
-    const statusAllowsCancelled = /status\s+IN\s*\([^)]*'cancelled'/i.test(schemaSql);
-    const needsStatusMigration = hasStatusCheck && !statusAllowsCancelled;
-
-    if (needsStatusMigration) {
-      console.log("[Migration] Removing restrictive CHECK constraint on agent_tasks.status");
-      db.run("PRAGMA foreign_keys=off");
-
-      // Migrations run before this compatibility guard, so a legacy table now
-      // carries every current column. Rebuilding from an old hard-coded column
-      // list would silently discard later fields. Derive the replacement
-      // schema, copy list, indexes, and triggers from the live table instead;
-      // remove only the obsolete status CHECK.
-      const rebuiltSchemaSql = schemaSql
-        .replace(
-          /^(CREATE TABLE\s+(?:IF NOT EXISTS\s+)?)(?:"agent_tasks"|agent_tasks)/i,
-          "$1agent_tasks_new",
-        )
-        .replace(/\s+CHECK\s*\(\s*status\s+IN\s*\([^)]*\)\s*\)/i, "");
-      if (rebuiltSchemaSql === schemaSql || !/agent_tasks_new/i.test(rebuiltSchemaSql)) {
-        throw new Error("Could not derive agent_tasks schema without legacy status CHECK");
-      }
-      const columns = db
-        .prepare<{ name: string }, []>('PRAGMA table_info("agent_tasks")')
-        .all()
-        .map((column) => `"${column.name.replaceAll('"', '""')}"`)
-        .join(", ");
-      const schemaObjects = db
-        .prepare<{ sql: string }, []>(
-          `SELECT sql FROM sqlite_master
-           WHERE tbl_name = 'agent_tasks'
-             AND type IN ('index', 'trigger')
-             AND sql IS NOT NULL
-           ORDER BY type, name`,
-        )
-        .all()
-        .map((row) => row.sql);
-
-      database.transaction(() => {
-        database.run("DROP TABLE IF EXISTS agent_tasks_new");
-        database.run(rebuiltSchemaSql);
-        database.run(`INSERT INTO agent_tasks_new (${columns}) SELECT ${columns} FROM agent_tasks`);
-        database.run("DROP TABLE agent_tasks");
-        database.run("ALTER TABLE agent_tasks_new RENAME TO agent_tasks");
-        for (const sql of schemaObjects) database.run(sql);
-      })();
-
-      db.run("PRAGMA foreign_keys=on");
-      console.log("[Migration] Successfully removed CHECK constraint on agent_tasks.status");
-    }
-  } catch (e) {
-    console.error("[Migration] Failed to update agent_tasks CHECK constraint:", e);
-    try {
-      db.run("PRAGMA foreign_keys=on");
-    } catch (cleanupError) {
-      console.error("[Migration] Failed to re-enable SQLite foreign_keys pragma:", cleanupError);
-    }
-    throw e;
-  }
-
-  // Mandatory namespace invariant: structural corruption is fatal before the
-  // API starts listening. Unknown personal users/provider drift remain
-  // readable warnings so operators can repair them through the audit surface.
-  enforceAssetKeyStartupAudit(database);
-
-  // Backfill: Seed v1 for existing agents that don't have any context versions yet
-  seedContextVersions();
-
-  // Inject DB resolver into the prompt template resolver (DI to avoid worker/API boundary violation)
-  configureDbResolver(resolvePromptTemplate);
-
-  // Seed default prompt templates from the in-memory code registry
-  seedDefaultTemplates();
-
-  const hasExistingEncryptedSecrets =
-    (database
-      .prepare<{ present: number }, []>(
-        `SELECT EXISTS(
-           SELECT 1 FROM swarm_config WHERE isSecret = 1 AND encrypted = 1
-           UNION ALL
-           SELECT 1 FROM oauth_apps
-             WHERE clientSecretEncrypted = 1 AND clientSecret IS NOT NULL
-           UNION ALL
-           SELECT 1 FROM oauth_authorizations WHERE tokensEncrypted = 1
-         ) AS present`,
-      )
-      .get()?.present ?? 0) === 1;
-
-  // Track whether user provided the key (for backup decision)
-  const userProvidedKey = !!(
-    process.env.SECRETS_ENCRYPTION_KEY?.length || process.env.SECRETS_ENCRYPTION_KEY_FILE?.length
-  );
-
-  // Resolve the secrets encryption key after migrations so we can tell whether
-  // this DB already contains encrypted secret rows (must reuse an explicit or
-  // on-disk key) or is still plaintext-only (safe to generate a new key before
-  // auto-migrating legacy plaintext rows).
-  resolveEncryptionKey(dbPath, { allowGenerate: !hasExistingEncryptedSecrets });
-
-  // Migration 117 carries plaintext tracker OAuth rows with explicit flags;
-  // encrypt them only after the shared key has been resolved. This pass is
-  // idempotent and intentionally fatal on failure so boot never continues
-  // with OAuth credentials left in plaintext.
-  try {
-    autoEncryptLegacyOAuthSecrets(database);
-  } catch (err) {
-    console.error(
-      `[oauth-encryption] FATAL: failed to auto-encrypt legacy OAuth secrets: ${(err as Error).message}`,
-    );
-    throw err;
-  }
-
-  // Auto-encrypt any legacy plaintext secrets that predate the encryption
-  // feature. Runs after all compatibility guards; failures are fatal because
-  // continuing would leave secrets at rest in plaintext — the opposite of the
-  // guarantee this feature provides.
-  try {
-    autoEncryptLegacyPlaintextSecrets(database, dbPath, { createBackup: !userProvidedKey });
-  } catch (err) {
-    console.error(
-      `[secrets] FATAL: failed to auto-encrypt legacy secrets: ${(err as Error).message}`,
-    );
-    throw err;
-  }
-
-  // Retire the legacy SCRIPT_CREDENTIAL_BINDINGS swarm-config blob: promote any
-  // remaining entries to relational rows so the credential broker is
-  // relational-only. Idempotent; failures are fatal because a silently-dropped
-  // binding would leave scripts unable to authenticate.
-  try {
-    migrateLegacyCredentialBindingBlob(database);
-  } catch (err) {
-    console.error(
-      `[credential-bindings] FATAL: failed to migrate legacy credential binding blob: ${(err as Error).message}`,
-    );
-    throw err;
-  }
-
-  return db;
-}
-
-export function getDb(path?: string): Database {
-  if (!db) {
-    return initDb(path ?? process.env.DATABASE_PATH);
-  }
-  return db;
-}
-
-export function closeDb(): void {
-  if (db) {
-    db.close();
-    db = null;
-  }
-  sqliteVecAvailable = false;
-}
-
-// Async seam over the shared connection. The client resolves the underlying
-// handle per operation via getDb(), so close/reopen cycles need no reset.
-let dbClientInstance: DbClient | null = null;
-
-export function getDbClient(): DbClient {
-  if (!dbClientInstance) {
-    dbClientInstance = createBunSqliteClient(() => getDb());
-  }
-  return dbClientInstance;
-}
-
 // ============================================================================
 // Context Versioning
 // ============================================================================
@@ -528,1408 +366,241 @@ const BUDGETED_IDENTITY_FIELDS: BudgetedIdentityField[] = [
   "toolsMd",
 ];
 
-function ensureAgentProfileColumns(database: Database): void {
-  // `PRAGMA table_info` on a nonexistent table returns an empty result set
-  // rather than erroring, which used to make every column below look
-  // "missing" on a table that was never created and throw `no such table:
-  // agents` from the ALTER below. This is a legacy-compat shim for
-  // pre-migration-system databases; runMigrations() (and its own
-  // assertNotEmptyDatabase guard) is what's responsible for the `agents`
-  // table existing at all, and already fails loudly if it doesn't. This
-  // function must never be the thing that crashes startup instead.
-  const agentsTableExists = database
-    .prepare<{ name: string }, []>(
-      "SELECT name FROM sqlite_master WHERE type='table' AND name='agents'",
-    )
-    .get();
-  if (!agentsTableExists) {
-    console.warn("[Migration] agents table does not exist yet — skipping profile column backfill");
-    return;
-  }
+// ============================================================================
+// AgentTask Queries
+// ============================================================================
 
-  const existingColumns = new Set(
-    database
-      .prepare<{ name: string }, []>("PRAGMA table_info(agents)")
-      .all()
-      .map((row) => row.name),
+export async function getSlackRenderV2ActivatedAt(): Promise<string | null> {
+  const row = await getDbClient().get<{ activated_at: string }>(
+    `SELECT activated_at FROM slack_render_v2_state WHERE id = 1`,
   );
-
-  for (const column of VERSIONABLE_FIELDS) {
-    if (!existingColumns.has(column)) {
-      try {
-        database.run(`ALTER TABLE agents ADD COLUMN ${column} TEXT`);
-      } catch (error) {
-        console.error(`[Migration] Failed to add missing agents.${column} column`, error);
-        throw error;
-      }
-    }
-  }
-}
-
-export function computeContentHash(content: string): string {
-  const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(content);
-  return hasher.digest("hex");
-}
-
-type ContextVersionRow = {
-  id: string;
-  agentId: string;
-  field: string;
-  content: string;
-  version: number;
-  changeSource: string;
-  changedByAgentId: string | null;
-  changeReason: string | null;
-  contentHash: string;
-  previousVersionId: string | null;
-  createdAt: string;
-};
-
-function rowToContextVersion(row: ContextVersionRow): ContextVersion {
-  return {
-    id: row.id,
-    agentId: row.agentId,
-    field: row.field as VersionableField,
-    content: row.content,
-    version: row.version,
-    changeSource: row.changeSource as ChangeSource,
-    changedByAgentId: row.changedByAgentId,
-    changeReason: row.changeReason,
-    contentHash: row.contentHash,
-    previousVersionId: row.previousVersionId,
-    createdAt: row.createdAt,
-  };
+  return row?.activated_at ?? null;
 }
 
-export async function createContextVersion(params: {
-  agentId: string;
-  field: VersionableField;
-  content: string;
-  version: number;
-  changeSource: ChangeSource;
-  changedByAgentId?: string | null;
-  changeReason?: string | null;
-  contentHash: string;
-  previousVersionId?: string | null;
-}): Promise<ContextVersion> {
-  const id = crypto.randomUUID();
-  const now = new Date().toISOString();
-
-  const row = await getDbClient().get<ContextVersionRow>(
-    `INSERT INTO context_versions (id, agentId, field, content, version, changeSource, changedByAgentId, changeReason, contentHash, previousVersionId, createdAt)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
-    [
-      id,
-      params.agentId,
-      params.field,
-      params.content,
-      params.version,
-      params.changeSource,
-      params.changedByAgentId ?? null,
-      params.changeReason ?? null,
-      params.contentHash,
-      params.previousVersionId ?? null,
-      now,
-    ],
+export async function ensureSlackRenderV2Activation(): Promise<string> {
+  const activatedAt = new Date().toISOString();
+  await getDbClient().run(
+    `INSERT INTO slack_render_v2_state (id, activated_at)
+     VALUES (1, ?)
+     ON CONFLICT(id) DO NOTHING`,
+    [activatedAt],
   );
-
-  if (!row) throw new Error("Failed to create context version");
-  return rowToContextVersion(row);
+  const persisted = await getSlackRenderV2ActivatedAt();
+  if (!persisted) throw new Error("Failed to persist Slack render v2 activation");
+  return persisted;
 }
 
-export async function getLatestContextVersion(
-  agentId: string,
-  field: VersionableField,
-): Promise<ContextVersion | null> {
-  const row = await getDbClient().get<ContextVersionRow>(
-    `SELECT * FROM context_versions WHERE agentId = ? AND field = ? ORDER BY version DESC LIMIT 1`,
-    [agentId, field],
+export async function getSlackDelegationActivatedAt(): Promise<string | null> {
+  const row = await getDbClient().get<{ delegation_activated_at: string | null }>(
+    `SELECT delegation_activated_at FROM slack_render_v2_state WHERE id = 1`,
   );
-
-  return row ? rowToContextVersion(row) : null;
+  return row?.delegation_activated_at ?? null;
 }
 
-export async function getContextVersion(id: string): Promise<ContextVersion | null> {
-  const row = await getDbClient().get<ContextVersionRow>(
-    `SELECT * FROM context_versions WHERE id = ?`,
-    [id],
+export async function ensureSlackDelegationActivation(): Promise<string> {
+  const activatedAt = new Date().toISOString();
+  await getDbClient().run(
+    `INSERT INTO slack_render_v2_state (id, activated_at, delegation_activated_at)
+     VALUES (1, ?, ?)
+     ON CONFLICT(id) DO UPDATE SET
+       delegation_activated_at = COALESCE(slack_render_v2_state.delegation_activated_at, excluded.delegation_activated_at)`,
+    [activatedAt, activatedAt],
   );
-
-  return row ? rowToContextVersion(row) : null;
+  const persisted = await getSlackDelegationActivatedAt();
+  if (!persisted) throw new Error("Failed to persist Slack render v2 delegation activation");
+  return persisted;
 }
 
-export async function getContextVersionHistory(params: {
-  agentId: string;
-  field?: VersionableField;
-  limit?: number;
-}): Promise<ContextVersion[]> {
-  const limit = params.limit ?? 10;
-
-  if (params.field) {
-    const rows = await getDbClient().query<ContextVersionRow>(
-      `SELECT * FROM context_versions WHERE agentId = ? AND field = ? ORDER BY version DESC LIMIT ?`,
-      [params.agentId, params.field, limit],
-    );
-    return rows.map(rowToContextVersion);
-  }
+export type SlackMessageKind = "tree" | "outcome" | "agent";
+export type SlackConclusionKind = "complete" | "timeout";
 
-  const rows = await getDbClient().query<ContextVersionRow>(
-    `SELECT * FROM context_versions WHERE agentId = ? ORDER BY createdAt DESC LIMIT ?`,
-    [params.agentId, limit],
-  );
-  return rows.map(rowToContextVersion);
+export interface SlackMessageRecord {
+  id: string;
+  contextKey: string;
+  channelId: string;
+  threadTs: string;
+  ts: string;
+  kind: SlackMessageKind;
+  taskId?: string;
+  permalink?: string;
+  finalizedAt?: string;
+  streamChunksAppended: number;
+  conclusionKind?: SlackConclusionKind;
+  createdAt: string;
+  updatedAt: string;
 }
 
-/**
- * Seed v1 context versions for existing agents that don't have any versions yet.
- * Called during migration.
- */
-function seedContextVersions(): void {
-  const database = getDb();
-  const agents = database
-    .prepare<
-      {
-        id: string;
-        soulMd: string | null;
-        identityMd: string | null;
-        toolsMd: string | null;
-        claudeMd: string | null;
-        setupScript: string | null;
-        heartbeatMd: string | null;
-      },
-      []
-    >(`SELECT id, soulMd, identityMd, toolsMd, claudeMd, setupScript, heartbeatMd FROM agents`)
-    .all();
-
-  for (const agent of agents) {
-    for (const field of VERSIONABLE_FIELDS) {
-      const content = agent[field];
-      if (!content) continue;
-
-      // Check if a version already exists for this agent+field
-      const existing = database
-        .prepare<{ id: string }, [string, string]>(
-          `SELECT id FROM context_versions WHERE agentId = ? AND field = ? LIMIT 1`,
-        )
-        .get(agent.id, field);
-      if (existing) continue;
-
-      const id = crypto.randomUUID();
-      const hash = computeContentHash(content);
-      const now = new Date().toISOString();
+const PENDING_SLACK_MESSAGE_TS_PREFIX = "pending:";
 
-      database
-        .prepare(
-          `INSERT INTO context_versions (id, agentId, field, content, version, changeSource, contentHash, createdAt)
-           VALUES (?, ?, ?, ?, 1, 'system', ?, ?)`,
-        )
-        .run(id, agent.id, field, content, hash, now);
-    }
-  }
+export function isPendingSlackMessage(record: SlackMessageRecord): boolean {
+  return record.ts.startsWith(PENDING_SLACK_MESSAGE_TS_PREFIX);
 }
 
-// ============================================================================
-// Agent Queries
-// ============================================================================
-
-type AgentRow = {
+type SlackMessageRow = {
   id: string;
-  name: string;
-  isLead: number;
-  status: AgentStatus;
-  description: string | null;
-  role: string | null;
-  capabilities: string | null;
-  maxTasks: number | null;
-  emptyPollCount: number | null;
-  claudeMd: string | null;
-  soulMd: string | null;
-  identityMd: string | null;
-  setupScript: string | null;
-  toolsMd: string | null;
-  heartbeatMd: string | null;
-  lastActivityAt: string | null;
-  provider: string | null;
-  createdAt: string;
-  lastUpdatedAt: string;
-  /** JSON array of env-var names; populated only when status is `waiting_for_credentials`. */
-  credentialMissing: string | null;
-  /** Phase 1.5: per-agent harness provider pushed on worker registration. */
-  harness_provider: string | null;
-  /** Migration 055: worker-self-reported credential snapshot (JSON of AgentCredStatus). NULL = unreported. */
-  cred_status: string | null;
-  /** Migration 119: custom avatar (JSON of AgentAvatar). NULL = deterministic hash-derived fallback. */
-  avatar: string | null;
+  context_key: string;
+  channel_id: string;
+  thread_ts: string;
+  ts: string;
+  kind: SlackMessageKind;
+  task_id: string | null;
+  permalink: string | null;
+  finalized_at: string | null;
+  stream_chunks_appended: number;
+  conclusion_kind: SlackConclusionKind | null;
+  created_at: string;
+  updated_at: string;
 };
 
-/** Safe-parse the `avatar` JSON column. Malformed/invalid content (e.g. a
- * hand-edited row, or a future downgrade) falls back to `null` so rendering
- * always has a deterministic path — never throws. */
-function parseAgentAvatar(raw: string | null): AgentAvatar | null {
-  if (!raw) return null;
-  try {
-    const parsed = AgentAvatarSchema.safeParse(JSON.parse(raw));
-    return parsed.success ? parsed.data : null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Map an agent row to the `Agent` shape. When `slim` is true the six identity
- * markdown blobs (`claudeMd`/`soulMd`/`identityMd`/`toolsMd`/`heartbeatMd`/
- * `setupScript`) are omitted — they bloat list responses by ~16 KB/agent and
- * are never needed at the swarm-overview level. Fetch them via
- * `GET /api/agents/{id}` when required.
- */
-function rowToAgent(row: AgentRow, slim = false): Agent {
-  const base: Agent = {
-    id: row.id,
-    name: row.name,
-    isLead: row.isLead === 1,
-    status: row.status,
-    description: row.description ?? undefined,
-    role: row.role ?? undefined,
-    capabilities: row.capabilities ? JSON.parse(row.capabilities) : [],
-    maxTasks: row.maxTasks ?? 1,
-    emptyPollCount: row.emptyPollCount ?? 0,
-    lastActivityAt: row.lastActivityAt ?? undefined,
-    provider: (row.provider as ProviderName | null) ?? undefined,
-    harnessProvider: (row.harness_provider as ProviderName | null) ?? null,
-    createdAt: row.createdAt,
-    lastUpdatedAt: row.lastUpdatedAt,
-    credentialMissing: row.credentialMissing
-      ? (JSON.parse(row.credentialMissing) as string[])
-      : null,
-    credStatus: row.cred_status ? (JSON.parse(row.cred_status) as AgentCredStatus) : null,
-    avatar: parseAgentAvatar(row.avatar),
-  };
-  if (slim) return base;
+function rowToSlackMessage(row: SlackMessageRow): SlackMessageRecord {
   return {
-    ...base,
-    claudeMd: row.claudeMd ?? undefined,
-    soulMd: row.soulMd ?? undefined,
-    identityMd: row.identityMd ?? undefined,
-    setupScript: row.setupScript ?? undefined,
-    toolsMd: row.toolsMd ?? undefined,
-    heartbeatMd: row.heartbeatMd ?? undefined,
+    id: row.id,
+    contextKey: row.context_key,
+    channelId: row.channel_id,
+    threadTs: row.thread_ts,
+    ts: row.ts,
+    kind: row.kind,
+    taskId: row.task_id ?? undefined,
+    permalink: row.permalink ?? undefined,
+    finalizedAt: row.finalized_at ?? undefined,
+    streamChunksAppended: row.stream_chunks_appended,
+    conclusionKind: row.conclusion_kind ?? undefined,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
   };
 }
 
-/**
- * Phase 3 of the worker credential safe-loop plan.
- *
- * `ready=true` clears the waiting state — the agent transitions to `idle`
- * and the dispatcher will start handing it tasks again.
- *
- * `ready=false` parks the agent on `waiting_for_credentials` with the env-var
- * names it's blocked on. The capacity dispatch query already filters
- * `status === 'idle'` so the new value is implicitly excluded with no other
- * code change.
- */
-export async function updateAgentCredentialState(
-  agentId: string,
-  ready: boolean,
-  missing: string[] | null,
-): Promise<Agent | null> {
-  const prev = await getAgentById(agentId);
-  const status: AgentStatus = ready ? "idle" : "waiting_for_credentials";
-  const missingJson = ready ? null : missing && missing.length > 0 ? JSON.stringify(missing) : null;
-  const row = await getDbClient().get<AgentRow>(
-    "UPDATE agents SET status = ?, credentialMissing = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ? RETURNING *",
-    [status, missingJson, agentId],
-  );
-  // Only clear the accumulated empty-poll count on a genuine recovery
-  // (waiting_for_credentials -> ready), so routine post-task `ready:true`
-  // reports don't clobber a legitimately accumulated count and defeat the
-  // MAX_EMPTY_POLLS polling gate.
-  if (ready && prev?.status === "waiting_for_credentials") await resetEmptyPollCount(agentId);
-  return row ? rowToAgent(row) : null;
-}
-
-/**
- * Record which env vars a worker is missing without touching status — the
- * logical status is derived from runtime readiness in multi-runtime mode.
- */
-export async function updateAgentCredentialMissing(
-  agentId: string,
-  missing: string[] | null,
-): Promise<void> {
-  const json = missing && missing.length > 0 ? JSON.stringify(missing) : null;
-  await getDbClient().run(
-    "UPDATE agents SET credentialMissing = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?",
-    [json, agentId],
-  );
-}
-
-export async function createAgent(
-  agent: Omit<Agent, "id" | "createdAt" | "lastUpdatedAt"> & { id?: string },
-): Promise<Agent> {
-  const id = agent.id ?? crypto.randomUUID();
-  const maxTasks = agent.maxTasks ?? 1;
-  const row = await getDbClient().get<AgentRow>(
-    "INSERT INTO agents (id, name, isLead, status, maxTasks, provider, harness_provider, createdAt, lastUpdatedAt) VALUES (?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')) RETURNING *",
+export async function recordSlackMessage(input: {
+  contextKey: string;
+  channelId: string;
+  threadTs: string;
+  ts: string;
+  kind: SlackMessageKind;
+  taskId?: string;
+  permalink?: string;
+  finalized?: boolean;
+  streamChunksAppended?: number;
+  conclusionKind?: SlackConclusionKind;
+  actorId?: string;
+}): Promise<SlackMessageRecord> {
+  const id = crypto.randomUUID();
+  const now = new Date().toISOString();
+  const row = await getDbClient().get<SlackMessageRow>(
+    `INSERT INTO slack_messages (
+         id, context_key, channel_id, thread_ts, ts, kind, task_id, permalink,
+         finalized_at, stream_chunks_appended, conclusion_kind, created_at, updated_at, created_by, updated_by
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(channel_id, ts) DO UPDATE SET
+         context_key = excluded.context_key,
+         kind = excluded.kind,
+         task_id = COALESCE(excluded.task_id, slack_messages.task_id),
+         permalink = COALESCE(excluded.permalink, slack_messages.permalink),
+         finalized_at = COALESCE(excluded.finalized_at, slack_messages.finalized_at),
+         stream_chunks_appended = MAX(
+           excluded.stream_chunks_appended,
+           slack_messages.stream_chunks_appended
+         ),
+         conclusion_kind = COALESCE(excluded.conclusion_kind, slack_messages.conclusion_kind),
+         updated_at = excluded.updated_at,
+         updated_by = excluded.updated_by
+       RETURNING *`,
     [
       id,
-      agent.name,
-      agent.isLead ? 1 : 0,
-      agent.status,
-      maxTasks,
-      agent.provider ?? null,
-      agent.harnessProvider ?? null,
+      input.contextKey,
+      input.channelId,
+      input.threadTs,
+      input.ts,
+      input.kind,
+      input.taskId ?? null,
+      input.permalink ?? null,
+      input.finalized ? now : null,
+      input.streamChunksAppended ?? 0,
+      input.conclusionKind ?? null,
+      now,
+      now,
+      input.actorId ?? null,
+      input.actorId ?? null,
     ],
   );
-  if (!row) throw new Error("Failed to create agent");
-  try {
-    await installSystemDefaultSkillsForAgent(id);
-  } catch (err) {
-    console.warn(
-      "[db] Failed to install system-default skills for new agent:",
-      (err as Error).message,
-    );
-  }
-  try {
-    await createLogEntry({ eventType: "agent_joined", agentId: id, newValue: agent.status });
-  } catch {}
-  return rowToAgent(row);
-}
-
-export async function getAgentById(id: string): Promise<Agent | null> {
-  const row = await getDbClient().get<AgentRow>("SELECT * FROM agents WHERE id = ?", [id]);
-  return row ? rowToAgent(row) : null;
-}
-
-export async function getAllAgents(opts?: { slim?: boolean }): Promise<Agent[]> {
-  const rows = await getDbClient().query<AgentRow>("SELECT * FROM agents ORDER BY name");
-  return rows.map((row) => rowToAgent(row, opts?.slim ?? false));
-}
-
-export async function getLeadAgent(): Promise<Agent | null> {
-  const leads = (await getAllAgents()).filter((a) => a.isLead);
-  // Prefer a usable (non-offline) lead so callers route to one that can actually
-  // poll — e.g. an old offline lead must not shadow a live replacement. Falls
-  // back to any lead (incl. offline) so existing "is there a lead at all?"
-  // semantics are preserved; callers that require a live lead must check
-  // `status` themselves (see escalateUnreclaimedResumes).
-  return leads.find((a) => a.status !== "offline") ?? leads[0] ?? null;
+  if (!row) throw new Error("Failed to record Slack message");
+  return rowToSlackMessage(row);
 }
 
-export async function updateAgentStatus(id: string, status: AgentStatus): Promise<Agent | null> {
-  const oldAgent = await getAgentById(id);
-  const row = await getDbClient().get<AgentRow>(
-    "UPDATE agents SET status = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ? RETURNING *",
-    [status, id],
-  );
-  if (row && oldAgent) {
-    try {
-      await createLogEntry({
-        eventType: "agent_status_change",
-        agentId: id,
-        oldValue: oldAgent.status,
-        newValue: status,
-      });
-    } catch {}
+export async function reserveSlackMessage(input: {
+  contextKey: string;
+  channelId: string;
+  threadTs: string;
+  kind: "tree" | "outcome";
+  taskId?: string;
+  actorId?: string;
+}): Promise<{ record: SlackMessageRecord; created: boolean }> {
+  if (input.kind === "outcome" && !input.taskId) {
+    throw new Error("Outcome Slack message reservations require a task ID");
   }
-  return row ? rowToAgent(row) : null;
-}
 
-export async function updateAgentMaxTasks(id: string, maxTasks: number): Promise<Agent | null> {
-  const row = await getDbClient().get<AgentRow>(
-    `UPDATE agents SET maxTasks = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? RETURNING *`,
-    [maxTasks, id],
+  const id = crypto.randomUUID();
+  const now = new Date().toISOString();
+  const pendingTs = `${PENDING_SLACK_MESSAGE_TS_PREFIX}${id}`;
+  const inserted = await getDbClient().get<SlackMessageRow>(
+    `INSERT INTO slack_messages (
+         id, context_key, channel_id, thread_ts, ts, kind, task_id,
+         stream_chunks_appended, created_at, updated_at, created_by, updated_by
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)
+       ON CONFLICT DO NOTHING
+       RETURNING *`,
+    [
+      id,
+      input.contextKey,
+      input.channelId,
+      input.threadTs,
+      pendingTs,
+      input.kind,
+      input.taskId ?? null,
+      now,
+      now,
+      input.actorId ?? null,
+      input.actorId ?? null,
+    ],
   );
-  return row ? rowToAgent(row) : null;
-}
+  if (inserted) return { record: rowToSlackMessage(inserted), created: true };
 
-export async function updateAgentProvider(
-  id: string,
-  provider: ProviderName,
-): Promise<Agent | null> {
-  const row = await getDbClient().get<AgentRow>(
-    `UPDATE agents SET provider = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? RETURNING *`,
-    [provider, id],
-  );
-  return row ? rowToAgent(row) : null;
+  const existing =
+    input.kind === "tree"
+      ? await getSlackTreeMessageByThread(input.channelId, input.threadTs)
+      : await getSlackOutcomeMessage(input.taskId!);
+  if (!existing) throw new Error("Failed to reserve Slack message");
+  return { record: existing, created: false };
 }
 
-/**
- * Phase 1.5 (cloud-personalization): set the per-agent `harness_provider`
- * column. Pass `null` to clear. Validation against the canonical provider
- * list happens at the API layer via `ProviderNameSchema`.
- *
- * Returns the updated row, or null if the agent does not exist.
- */
-export async function setAgentHarnessProvider(
+export async function bindSlackMessageTimestamp(
   id: string,
-  provider: ProviderName | null,
-): Promise<Agent | null> {
-  const row = await getDbClient().get<AgentRow>(
-    `UPDATE agents SET harness_provider = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? RETURNING *`,
-    [provider, id],
+  ts: string,
+  options: { streamChunksAppended?: number; renderedThrough?: string } = {},
+): Promise<SlackMessageRecord | null> {
+  const now = new Date().toISOString();
+  const row = await getDbClient().get<SlackMessageRow>(
+    `UPDATE slack_messages SET
+         ts = ?,
+         stream_chunks_appended = MAX(stream_chunks_appended, ?),
+         updated_at = COALESCE(?, ?)
+       WHERE id = ? AND ts LIKE 'pending:%'
+       RETURNING *`,
+    [ts, options.streamChunksAppended ?? 0, options.renderedThrough ?? null, now, id],
   );
-  return row ? rowToAgent(row) : null;
+  return row ? rowToSlackMessage(row) : null;
 }
 
-/**
- * Migration 055 — write the worker-self-reported credential snapshot.
- * Pass `null` to clear (e.g. on agent re-registration). Validation against
- * the JSON shape happens at the API layer via `AgentCredStatusSchema`.
- *
- * Worker reports this alongside the existing `updateAgentCredentialState`
- * call; we keep the writes in two functions so the dispatch pattern stays
- * one-row-one-fact, and the PATCH handler can choose which to call based
- * on which fields the request body carried.
- */
-export async function updateAgentCredStatus(
+export async function updateSlackMessageRecord(
   id: string,
-  credStatus: AgentCredStatus | null,
-): Promise<Agent | null> {
-  const json = credStatus ? JSON.stringify(credStatus) : null;
-  const row = await getDbClient().get<AgentRow>(
-    `UPDATE agents SET cred_status = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? RETURNING *`,
-    [json, id],
-  );
-  return row ? rowToAgent(row) : null;
-}
-
-/**
- * Migration 055 — read all agents whose `harness_provider` matches a given
- * provider, with their reported `cred_status`. Used by the credential-status
- * API endpoint to roll up "is this provider working across the fleet?".
- *
- * Agents with NULL `cred_status` (never reported, or CRED_CHECK_DISABLE=1)
- * are still returned — the caller surfaces them as "unreported".
- */
-export async function listAgentsWithCredStatusByProvider(provider: string): Promise<Agent[]> {
-  const rows = await getDbClient().query<AgentRow>(
-    `SELECT * FROM agents WHERE harness_provider = ? ORDER BY name`,
-    [provider],
-  );
-  return rows.map((row) => rowToAgent(row));
-}
-
-/**
- * Phase 1.5 (cloud-personalization): aggregate count of registered agents
- * by `harness_provider`. NULL rows (agents that registered before the
- * migration or never pushed a value) are excluded — they show up in the
- * total agent count but not here.
- *
- * Used by future fleet displays. Not consumed in this phase.
- */
-export async function getAgentHarnessProviders(): Promise<
-  Array<{ provider: string; count: number }>
-> {
-  const rows = await getDbClient().query<{ provider: string; count: number }>(
-    `SELECT harness_provider AS provider, COUNT(*) AS count
-       FROM agents
-       WHERE harness_provider IS NOT NULL
-       GROUP BY harness_provider
-       ORDER BY harness_provider`,
-  );
-  return rows.map((r) => ({ provider: r.provider, count: r.count }));
-}
-
-export async function updateAgentActivity(id: string): Promise<void> {
-  await getDbClient().run(
-    `UPDATE agents SET lastActivityAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?`,
-    [id],
-  );
-}
-
-// ============================================================================
-// Agent Poll Tracking Functions
-// ============================================================================
-
-/** Maximum consecutive empty polls before agent should stop polling */
-export const MAX_EMPTY_POLLS = 2;
-
-/**
- * Increment the empty poll count for an agent.
- * Returns the new count after incrementing.
- */
-export async function incrementEmptyPollCount(agentId: string): Promise<number> {
-  const row = await getDbClient().get<{ emptyPollCount: number }>(
-    `UPDATE agents
-       SET emptyPollCount = emptyPollCount + 1,
-           lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ?
-       RETURNING emptyPollCount`,
-    [agentId],
-  );
-  return row?.emptyPollCount ?? 0;
-}
-
-/**
- * Reset the empty poll count for an agent to zero.
- * Called when a task is assigned or agent re-registers.
- */
-export async function resetEmptyPollCount(agentId: string): Promise<void> {
-  await getDbClient().run(
-    `UPDATE agents
-     SET emptyPollCount = 0,
-         lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-     WHERE id = ?`,
-    [agentId],
-  );
-}
-
-/**
- * Check if an agent has exceeded the maximum empty poll count.
- */
-export async function shouldBlockPolling(agentId: string): Promise<boolean> {
-  const agent = await getAgentById(agentId);
-  return (agent?.emptyPollCount ?? 0) >= MAX_EMPTY_POLLS;
-}
-
-export async function deleteAgent(id: string): Promise<boolean> {
-  const agent = await getAgentById(id);
-  if (agent) {
-    try {
-      await createLogEntry({ eventType: "agent_left", agentId: id, oldValue: agent.status });
-    } catch {}
-  }
-  const result = await getDbClient().run("DELETE FROM agents WHERE id = ?", [id]);
-  return result.changes > 0;
-}
-
-// ============================================================================
-// Agent Capacity Functions
-// ============================================================================
-
-/**
- * Get the count of active (in_progress) tasks for an agent.
- * Used to determine current capacity usage.
- */
-/**
- * Tasks occupying one of the agent's concurrency slots.
- *
- * A claimed offer counts too — omitting it let a second concurrent poll take
- * another task past the limit. It is counted only through `offeredTo`, the
- * agent actually reviewing it: `agentId` on an offer may still be the lead
- * that created it, which would otherwise consume the lead's own capacity.
- */
-export async function getActiveTaskCount(agentId: string): Promise<number> {
-  const result = await getDbClient().get<{ count: number }>(
-    `SELECT COUNT(*) as count FROM agent_tasks
-     WHERE (agentId = ? AND status = 'in_progress')
-        OR (offeredTo = ? AND status = 'reviewing')`,
-    [agentId, agentId],
-  );
-  return result?.count ?? 0;
-}
-
-/**
- * Check if an agent has capacity to accept more tasks.
- */
-export async function hasCapacity(agentId: string): Promise<boolean> {
-  const agent = await getAgentById(agentId);
-  if (!agent) return false;
-  const activeCount = await getActiveTaskCount(agentId);
-  return activeCount < (agent.maxTasks ?? 1);
-}
-
-/**
- * Get remaining capacity (available task slots) for an agent.
- */
-export async function getRemainingCapacity(agentId: string): Promise<number> {
-  const agent = await getAgentById(agentId);
-  if (!agent) return 0;
-  const activeCount = await getActiveTaskCount(agentId);
-  return Math.max(0, (agent.maxTasks ?? 1) - activeCount);
-}
-
-/**
- * Update agent status based on current capacity.
- * Agent is 'busy' when any tasks are in progress, 'idle' when none.
- * Does not modify 'offline' status.
- */
-export async function updateAgentStatusFromCapacity(agentId: string): Promise<void> {
-  const agent = await getAgentById(agentId);
-  if (!agent || agent.status === "offline") return;
-  // `waiting_for_credentials` is owned by the worker's credential-wait
-  // tick — task-completion shouldn't accidentally promote a blocked agent
-  // back to idle.
-  if (agent.status === "waiting_for_credentials") return;
-
-  const activeCount = await getActiveTaskCount(agentId);
-  const newStatus = activeCount > 0 ? "busy" : "idle";
-
-  if (agent.status !== newStatus) {
-    await updateAgentStatus(agentId, newStatus);
-  }
-}
-
-// ============================================================================
-// Routing Affinity (interrupted/pooled task role & capability gating)
-// ============================================================================
-
-/**
- * Kill-switch for the pool eligibility gate (`isAgentEligibleForTask` and its
- * callers: `claimTask`, `assignUnassignedTaskPending`,
- * `getUnassignedTaskIdsForAgent`). ON by default. Set to `0` to restore
- * pre-affinity behavior verbatim — mirrors the `HEARTBEAT_PIN_*_RESUME`
- * rollback convention. A function (read dynamically), not a module-load-time
- * const, so it can be toggled mid-test (see `isGracefulResumePinEnabled` in
- * src/tasks/worker-follow-up.ts for the same pattern).
- */
-export function isPoolAffinityEnforcementEnabled(): boolean {
-  return isEnvFlagEnabled("POOL_AFFINITY_ENFORCEMENT", true);
-}
-
-/**
- * Snapshot an agent's role/harness/capabilities into a `RoutingAffinity`
- * blob, for stamping onto a continuation task (resume, retry) at the moment
- * of interruption. Returns `null` when the agent row is already gone —
- * callers fall back to the parent's own (inherited) `routingAffinity` via
- * `createTaskExtended`'s parentTaskId inheritance block.
- */
-export async function buildRoutingAffinityFromAgent(
-  agentId: string,
-): Promise<RoutingAffinity | null> {
-  const agent = await getAgentById(agentId);
-  if (!agent) return null;
-  return {
-    sourceAgentId: agent.id,
-    role: agent.role,
-    harnessProvider: agent.harnessProvider ?? agent.provider ?? undefined,
-    capabilities: agent.capabilities ?? [],
-  };
-}
-
-/**
- * The single eligibility gate every pool consumer (poll auto-claim,
- * `task-action claim`, `autoAssignPoolTasks`) MUST use before handing a task
- * to an agent. Exact-match on the snapshotted role string (no keyword
- * taxonomy in v1); `harnessProvider` is informational only and never
- * enforced (native session resume is deprecated). Missing role data on
- * either side is treated as INELIGIBLE — never fail-open to "anyone" — so a
- * capability-only requirement (no `role` set) can only ever be claimed by
- * its `sourceAgentId`, and otherwise queues until the starvation escalation
- * hands it to the Lead. Lead-only work is different: any Lead may claim it
- * (subject to explicitly required capabilities), because its source/role is
- * only recovery provenance and must not turn a worker's old role into a
- * constraint on the Lead pool.
- */
-export function isAgentEligibleForTask(
-  agent: Pick<Agent, "id" | "isLead" | "role" | "capabilities">,
-  task: Pick<AgentTask, "routingAffinity" | "routingAffinityInvalid">,
-): boolean {
-  const affinity = task.routingAffinity;
-  // A malformed persisted blob is a security boundary failure, not an
-  // untagged task. Quarantine it from every assignment/claim path.
-  if (task.routingAffinityInvalid) return false;
-  if (!affinity) return true; // Untagged task — unchanged behavior.
-
-  const requiredCapabilities = affinity.capabilities ?? [];
-  const hasRequiredCapabilities = () => {
-    const agentCapabilities = new Set(agent.capabilities ?? []);
-    return requiredCapabilities.every((cap) => agentCapabilities.has(cap));
-  };
-  // Lead-only is an authorization boundary, never a best-effort pool hint or
-  // a source-agent exception. Its explicit capability requirements remain
-  // enforced even if the role/capability affinity kill-switch is enabled.
-  // Do not require an unrelated worker role/source to match a Lead-only task.
-  if (affinity.leadOnly) return agent.isLead && hasRequiredCapabilities();
-  if (!isPoolAffinityEnforcementEnabled()) return true;
-
-  if (affinity.sourceAgentId && affinity.sourceAgentId === agent.id) return true; // Own work.
-
-  if (!agent.role || !affinity.role) return false; // Missing role data — no fail-open.
-  if (agent.role !== affinity.role) return false;
-
-  return hasRequiredCapabilities();
-}
-
-// ============================================================================
-// AgentTask Queries
-// ============================================================================
-
-type AgentTaskRow = {
-  id: string;
-  key: string;
-  agentId: string | null;
-  creatorAgentId: string | null;
-  task: string;
-  title: string | null;
-  status: AgentTaskStatus;
-  source: AgentTaskSource;
-  taskType: string | null;
-  tags: string | null;
-  priority: number;
-  dependsOn: string | null;
-  offeredTo: string | null;
-  offeredAt: string | null;
-  acceptedAt: string | null;
-  rejectionReason: string | null;
-  slackChannelId: string | null;
-  slackThreadTs: string | null;
-  slackTriggerMessageTs: string | null;
-  slackUserId: string | null;
-  slackReplySent: number;
-  slackProgressMessageTs: string | null;
-  slackTreeRootMessageTs: string | null;
-  vcsProvider: string | null;
-  vcsRepo: string | null;
-  vcsEventType: string | null;
-  vcsNumber: number | null;
-  vcsCommentId: number | null;
-  vcsAuthor: string | null;
-  vcsUrl: string | null;
-  vcsInstallationId: number | null;
-  vcsNodeId: string | null;
-  agentmailInboxId: string | null;
-  agentmailMessageId: string | null;
-  agentmailThreadId: string | null;
-  mentionMessageId: string | null;
-  mentionChannelId: string | null;
-  dir: string | null;
-  parentTaskId: string | null;
-  claudeSessionId: string | null;
-  model: string | null;
-  modelTier: string | null;
-  effort: string | null;
-  scheduleId: string | null;
-  workflowRunId: string | null;
-  workflowRunStepId: string | null;
-  outputSchema: string | null;
-  followUpConfig: string | null;
-  contextKey: string | null;
-  createdAt: string;
-  lastUpdatedAt: string;
-  finishedAt: string | null;
-  notifiedAt: string | null;
-  failureReason: string | null;
-  output: string | null;
-  progress: string | null;
-  compactionCount: number | null;
-  peakContextPercent: number | null;
-  peakContextTokens: number | null;
-  contextWindowSize: number | null;
-  was_paused: number;
-  credentialKeySuffix: string | null;
-  credentialKeyType: string | null;
-  requestedByUserId: string | null;
-  requestedByUserIdInherited: number;
-  swarmVersion: string | null;
-  provider: string | null;
-  providerMeta: string | null;
-  harnessVariant: string | null;
-  harnessVariantMeta: string | null;
-  totalCostUsd?: number | null;
-  routingAffinity: string | null;
-};
-
-function rowToAgentTask(row: AgentTaskRow): AgentTask {
-  let followUpConfig: FollowUpConfig | undefined;
-  if (row.followUpConfig) {
-    try {
-      const parsed = FollowUpConfigSchema.safeParse(JSON.parse(row.followUpConfig));
-      if (parsed.success) {
-        followUpConfig = parsed.data;
-      } else {
-        console.warn(
-          `[db] Ignoring invalid agent_tasks.followUpConfig for task ${row.id}:`,
-          parsed.error.message,
-        );
-      }
-    } catch (error) {
-      console.warn(
-        `[db] Ignoring malformed agent_tasks.followUpConfig for task ${row.id}:`,
-        error instanceof Error ? error.message : String(error),
-      );
-      followUpConfig = undefined;
-    }
-  }
-
-  let routingAffinity: RoutingAffinity | undefined;
-  let routingAffinityInvalid = false;
-  if (row.routingAffinity) {
-    try {
-      const parsed = RoutingAffinitySchema.safeParse(JSON.parse(row.routingAffinity));
-      if (parsed.success) {
-        routingAffinity = parsed.data;
-      } else {
-        routingAffinityInvalid = true;
-        console.warn(
-          `[db] Quarantining invalid agent_tasks.routingAffinity for task ${row.id}:`,
-          parsed.error.message,
-        );
-      }
-    } catch (error) {
-      routingAffinityInvalid = true;
-      console.warn(
-        `[db] Quarantining malformed agent_tasks.routingAffinity for task ${row.id}:`,
-        error instanceof Error ? error.message : String(error),
-      );
-    }
-  }
-
-  return {
-    id: row.id,
-    key: row.key,
-    agentId: row.agentId,
-    creatorAgentId: row.creatorAgentId ?? undefined,
-    task: row.task,
-    title: row.title ?? undefined,
-    status: row.status,
-    source: row.source,
-    taskType: row.taskType ?? undefined,
-    tags: row.tags ? JSON.parse(row.tags) : [],
-    priority: row.priority ?? 50,
-    dependsOn: row.dependsOn ? JSON.parse(row.dependsOn) : [],
-    offeredTo: row.offeredTo ?? undefined,
-    offeredAt: row.offeredAt ?? undefined,
-    acceptedAt: row.acceptedAt ?? undefined,
-    rejectionReason: row.rejectionReason ?? undefined,
-    slackChannelId: row.slackChannelId ?? undefined,
-    slackThreadTs: row.slackThreadTs ?? undefined,
-    slackTriggerMessageTs: row.slackTriggerMessageTs ?? undefined,
-    slackUserId: row.slackUserId ?? undefined,
-    slackReplySent: !!row.slackReplySent,
-    slackProgressMessageTs: row.slackProgressMessageTs ?? undefined,
-    slackTreeRootMessageTs: row.slackTreeRootMessageTs ?? undefined,
-    vcsProvider: (row.vcsProvider as "github" | "gitlab" | null) ?? undefined,
-    vcsRepo: row.vcsRepo ?? undefined,
-    vcsEventType: row.vcsEventType ?? undefined,
-    vcsNumber: row.vcsNumber ?? undefined,
-    vcsCommentId: row.vcsCommentId ?? undefined,
-    vcsAuthor: row.vcsAuthor ?? undefined,
-    vcsUrl: row.vcsUrl ?? undefined,
-    vcsInstallationId: row.vcsInstallationId ?? undefined,
-    vcsNodeId: row.vcsNodeId ?? undefined,
-    agentmailInboxId: row.agentmailInboxId ?? undefined,
-    agentmailMessageId: row.agentmailMessageId ?? undefined,
-    agentmailThreadId: row.agentmailThreadId ?? undefined,
-    mentionMessageId: row.mentionMessageId ?? undefined,
-    mentionChannelId: row.mentionChannelId ?? undefined,
-    dir: row.dir ?? undefined,
-    parentTaskId: row.parentTaskId ?? undefined,
-    claudeSessionId: row.claudeSessionId ?? undefined,
-    model: row.model ?? undefined,
-    modelTier: parseModelTier(row.modelTier) ?? undefined,
-    effort: ReasoningEffortSchema.safeParse(row.effort).success
-      ? (row.effort as ReasoningEffort)
-      : undefined,
-    scheduleId: row.scheduleId ?? undefined,
-    workflowRunId: row.workflowRunId ?? undefined,
-    workflowRunStepId: row.workflowRunStepId ?? undefined,
-    outputSchema: row.outputSchema ? JSON.parse(row.outputSchema) : undefined,
-    followUpConfig,
-    contextKey: row.contextKey ?? undefined,
-    compactionCount: row.compactionCount ?? undefined,
-    peakContextPercent: row.peakContextPercent ?? undefined,
-    peakContextTokens: row.peakContextTokens ?? undefined,
-    contextWindowSize: row.contextWindowSize ?? undefined,
-    createdAt: row.createdAt,
-    lastUpdatedAt: row.lastUpdatedAt,
-    finishedAt: row.finishedAt ?? undefined,
-    notifiedAt: row.notifiedAt ?? undefined,
-    failureReason: row.failureReason ?? undefined,
-    output: row.output ?? undefined,
-    progress: row.progress ?? undefined,
-    wasPaused: !!row.was_paused,
-    credentialKeySuffix: row.credentialKeySuffix ?? undefined,
-    credentialKeyType: row.credentialKeyType ?? undefined,
-    requestedByUserId: row.requestedByUserId ?? undefined,
-    swarmVersion: row.swarmVersion ?? undefined,
-    provider: (row.provider as ProviderName | null) ?? undefined,
-    providerMeta: parseProviderMeta(row.provider as ProviderName | null, row.providerMeta),
-    harnessVariant: row.harnessVariant ?? undefined,
-    harnessVariantMeta: row.harnessVariantMeta ? JSON.parse(row.harnessVariantMeta) : undefined,
-    totalCostUsd: row.totalCostUsd ?? undefined,
-    routingAffinity,
-    routingAffinityInvalid: routingAffinityInvalid || undefined,
-  };
-}
-
-/**
- * Slim list-row mapper — truncates the `task` text to a bounded preview and
- * drops completion/integration/context blobs (`output`, `failureReason`,
- * `providerMeta`, all `vcs*`/`slack*`/`agentmail*`/`credential*`/`mention*` and
- * context-window fields). The preview is long enough for pool-triage; the full
- * brief is on `get-task-details` / `GET /api/tasks/{id}`.
- */
-function rowToAgentTaskSummary(row: AgentTaskRow): AgentTaskSummary {
-  const t = rowToAgentTask(row);
-  return {
-    id: t.id,
-    key: t.key,
-    agentId: t.agentId,
-    creatorAgentId: t.creatorAgentId,
-    task: previewText(t.task, TASK_PREVIEW_LENGTH),
-    title: t.title,
-    status: t.status,
-    source: t.source,
-    taskType: t.taskType,
-    tags: t.tags,
-    priority: t.priority,
-    dependsOn: t.dependsOn,
-    offeredTo: t.offeredTo,
-    acceptedAt: t.acceptedAt,
-    parentTaskId: t.parentTaskId,
-    scheduleId: t.scheduleId,
-    model: t.model,
-    modelTier: t.modelTier,
-    effort: t.effort,
-    provider: t.provider,
-    requestedByUserId: t.requestedByUserId,
-    progress: t.progress,
-    createdAt: t.createdAt,
-    lastUpdatedAt: t.lastUpdatedAt,
-    finishedAt: t.finishedAt,
-    peakContextPercent: t.peakContextPercent,
-    totalCostUsd: t.totalCostUsd,
-  };
-}
-
-export async function createTask(
-  agentId: string,
-  task: string,
-  options?: {
-    source?: AgentTaskSource;
-    slackChannelId?: string;
-    slackThreadTs?: string;
-    slackUserId?: string;
+  updates: {
+    permalink?: string;
+    finalized?: boolean;
+    streamChunksAppended?: number;
+    conclusionKind?: SlackConclusionKind;
+    actorId?: string;
+    touchUpdatedAt?: boolean;
   },
-): Promise<AgentTask> {
-  const id = crypto.randomUUID();
-  const source = options?.source ?? "mcp";
-  const row = await getDbClient().get<AgentTaskRow>(
-    `INSERT INTO agent_tasks (id, "key", agentId, task, status, source, slackChannelId, slackThreadTs, slackUserId, swarmVersion, createdAt, lastUpdatedAt)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')) RETURNING *`,
-    [
-      id,
-      defaultAssetKey("task", id),
-      agentId,
-      task,
-      "pending",
-      source,
-      options?.slackChannelId ?? null,
-      options?.slackThreadTs ?? null,
-      options?.slackUserId ?? null,
-      pkg.version,
-    ],
-  );
-  if (!row) throw new Error("Failed to create task");
-  try {
-    await createLogEntry({
-      eventType: "task_created",
-      agentId,
-      taskId: id,
-      newValue: "pending",
-      metadata: { source },
-    });
-  } catch {}
-  return rowToAgentTask(row);
-}
-
-/**
- * In-process dedup for `task_dispatch_rejected_affinity` logging in
- * `getPendingTaskForAgent` below — that function runs on every poll tick for
- * every agent with a directly-assigned pending task, so an unresolved skip
- * (e.g. a corrupt/misassigned legacy row) would otherwise write one log row
- * per poll forever. Keyed by taskId; per-process, like `alarmActive` in
- * `queue-stall-alarm.ts` — an API restart re-arms it, which is fine since the
- * point is "don't spam," not "log exactly once ever."
- */
-const AFFINITY_DISPATCH_SKIP_LOG_COOLDOWN_MS = 5 * 60 * 1000;
-const lastAffinityDispatchSkipLoggedAt = new Map<string, number>();
-
-async function logAffinityDispatchSkip(
-  agent: Pick<Agent, "id" | "isLead" | "role">,
-  task: Pick<AgentTask, "id" | "routingAffinity" | "routingAffinityInvalid">,
-): Promise<void> {
-  const now = Date.now();
-  const lastLoggedAt = lastAffinityDispatchSkipLoggedAt.get(task.id);
-  if (lastLoggedAt !== undefined && now - lastLoggedAt < AFFINITY_DISPATCH_SKIP_LOG_COOLDOWN_MS) {
-    return;
-  }
-  lastAffinityDispatchSkipLoggedAt.set(task.id, now);
-  try {
-    await createLogEntry({
-      eventType: "task_dispatch_rejected_affinity",
-      agentId: agent.id,
-      taskId: task.id,
-      metadata: {
-        agentRole: agent.role ?? null,
-        requiredRole: task.routingAffinity?.role ?? null,
-        leadOnly: task.routingAffinity?.leadOnly === true,
-        agentIsLead: agent.isLead ?? false,
-        routingAffinityInvalid: task.routingAffinityInvalid === true,
-      },
-    });
-  } catch {}
-}
-
-export async function getPendingTaskForAgent(agentId: string): Promise<AgentTask | null> {
-  // Get all pending tasks for this agent, ordered by priority (desc) then creation time (asc)
-  const rows = await getDbClient().query<AgentTaskRow>(
-    "SELECT * FROM agent_tasks WHERE agentId = ? AND status = 'pending' ORDER BY priority DESC, createdAt ASC",
-    [agentId],
-  );
-
-  const agent = await getAgentById(agentId);
-  if (!agent) return null;
-
-  for (const row of rows) {
-    const task = rowToAgentTask(row);
-    // `task.agentId` (the WHERE clause above) is a direct-assignment decision
-    // already made by the task's creator — `createTaskExtended` enforces a
-    // caller-declared requirement at creation time (see
-    // `routingAffinityIsInheritedProvenance` there). Re-running the FULL
-    // role/capability match here re-litigates that decision using metadata
-    // that may be pure inherited PROVENANCE (e.g. a Lead-routed
-    // worker-completion follow-up that inherits the finishing worker's
-    // role/capabilities as lineage, not a requirement anyone declared) —
-    // which permanently stalls dispatch to the agent the task is already
-    // pinned to (the #1276-regression this fixes; see PR body). Mirror the
-    // convention `acceptTask`/`claimOfferedTask` already use for an
-    // established offer: only `leadOnly` (a real authorization boundary) and
-    // `routingAffinityInvalid` (quarantined corrupt data) still veto a
-    // directly-assigned task. Pool-claim paths (`claimTask`,
-    // `assignUnassignedTaskPending`) are untouched and keep the full gate —
-    // they are deciding "who gets this" from the pool, not redispatching an
-    // assignment that was already authorized (or, for provenance, never a
-    // requirement) at creation time.
-    if (task.routingAffinityInvalid) {
-      await logAffinityDispatchSkip(agent, task);
-      continue;
-    }
-    if (task.routingAffinity?.leadOnly && !isAgentEligibleForTask(agent, task)) {
-      await logAffinityDispatchSkip(agent, task);
-      continue;
-    }
-    const { ready } = await checkDependencies(task.id);
-    if (ready) return task;
-  }
-
-  return null;
-}
-
-export async function assignUnassignedTaskPending(
-  taskId: string,
-  agentId: string,
-): Promise<AgentTask | null> {
-  // This guard is always needed for lead-only tasks; the predicate itself
-  // handles the optional role/capability kill-switch.
-  {
-    const task = await getTaskById(taskId);
-    const agent = await getAgentById(agentId);
-    if (task && (!agent || !isAgentEligibleForTask(agent, task))) {
-      try {
-        await createLogEntry({
-          eventType: "task_claim_rejected_affinity",
-          agentId,
-          taskId,
-          metadata: {
-            agentRole: agent?.role ?? null,
-            requiredRole: task.routingAffinity?.role ?? null,
-            leadOnly: task.routingAffinity?.leadOnly === true,
-            agentIsLead: agent?.isLead ?? false,
-          },
-        });
-      } catch {}
-      return null;
-    }
-  }
-
-  const now = new Date().toISOString();
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks SET agentId = ?, status = 'pending', lastUpdatedAt = ?
-       WHERE id = ? AND status = 'unassigned' RETURNING *`,
-    [agentId, now, taskId],
-  );
-
-  if (row) {
-    try {
-      await createLogEntry({
-        eventType: "task_status_change",
-        agentId,
-        taskId,
-        oldValue: "unassigned",
-        newValue: "pending",
-        metadata: { pendingDispatch: true },
-      });
-    } catch {}
-  }
-
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function startTask(taskId: string): Promise<AgentTask | null> {
-  const oldTask = await getTaskById(taskId);
-  if (!oldTask) return null;
-
-  // Guard: never revive tasks that are already in a terminal state
-  if (isTerminalTaskStatus(oldTask.status)) {
-    return null;
-  }
-
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks SET status = 'in_progress', lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded') RETURNING *`,
-    [taskId],
-  );
-  if (row && oldTask) {
-    try {
-      await createLogEntry({
-        eventType: "task_status_change",
-        taskId,
-        agentId: row.agentId ?? undefined,
-        oldValue: oldTask.status,
-        newValue: "in_progress",
-      });
-    } catch {}
-  }
-  const result = row ? rowToAgentTask(row) : null;
-  // Fire-and-forget: notify lifecycle subscribers (e.g. GitHub eyes reaction)
-  if (result && oldTask.status !== "in_progress") {
-    emitTaskStarted(result);
-  }
-  return result;
-}
-
-export async function getTaskById(id: string): Promise<AgentTask | null> {
-  const row = await getDbClient().get<AgentTaskRow>("SELECT * FROM agent_tasks WHERE id = ?", [id]);
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function getSlackRenderV2ActivatedAt(): Promise<string | null> {
-  const row = await getDbClient().get<{ activated_at: string }>(
-    `SELECT activated_at FROM slack_render_v2_state WHERE id = 1`,
-  );
-  return row?.activated_at ?? null;
-}
-
-export async function ensureSlackRenderV2Activation(): Promise<string> {
-  const activatedAt = new Date().toISOString();
-  await getDbClient().run(
-    `INSERT INTO slack_render_v2_state (id, activated_at)
-     VALUES (1, ?)
-     ON CONFLICT(id) DO NOTHING`,
-    [activatedAt],
-  );
-  const persisted = await getSlackRenderV2ActivatedAt();
-  if (!persisted) throw new Error("Failed to persist Slack render v2 activation");
-  return persisted;
-}
-
-export async function getSlackDelegationActivatedAt(): Promise<string | null> {
-  const row = await getDbClient().get<{ delegation_activated_at: string | null }>(
-    `SELECT delegation_activated_at FROM slack_render_v2_state WHERE id = 1`,
-  );
-  return row?.delegation_activated_at ?? null;
-}
-
-export async function ensureSlackDelegationActivation(): Promise<string> {
-  const activatedAt = new Date().toISOString();
-  await getDbClient().run(
-    `INSERT INTO slack_render_v2_state (id, activated_at, delegation_activated_at)
-     VALUES (1, ?, ?)
-     ON CONFLICT(id) DO UPDATE SET
-       delegation_activated_at = COALESCE(slack_render_v2_state.delegation_activated_at, excluded.delegation_activated_at)`,
-    [activatedAt, activatedAt],
-  );
-  const persisted = await getSlackDelegationActivatedAt();
-  if (!persisted) throw new Error("Failed to persist Slack render v2 delegation activation");
-  return persisted;
-}
-
-export type SlackMessageKind = "tree" | "outcome" | "agent";
-export type SlackConclusionKind = "complete" | "timeout";
-
-export interface SlackMessageRecord {
-  id: string;
-  contextKey: string;
-  channelId: string;
-  threadTs: string;
-  ts: string;
-  kind: SlackMessageKind;
-  taskId?: string;
-  permalink?: string;
-  finalizedAt?: string;
-  streamChunksAppended: number;
-  conclusionKind?: SlackConclusionKind;
-  createdAt: string;
-  updatedAt: string;
-}
-
-const PENDING_SLACK_MESSAGE_TS_PREFIX = "pending:";
-
-export function isPendingSlackMessage(record: SlackMessageRecord): boolean {
-  return record.ts.startsWith(PENDING_SLACK_MESSAGE_TS_PREFIX);
-}
-
-type SlackMessageRow = {
-  id: string;
-  context_key: string;
-  channel_id: string;
-  thread_ts: string;
-  ts: string;
-  kind: SlackMessageKind;
-  task_id: string | null;
-  permalink: string | null;
-  finalized_at: string | null;
-  stream_chunks_appended: number;
-  conclusion_kind: SlackConclusionKind | null;
-  created_at: string;
-  updated_at: string;
-};
-
-function rowToSlackMessage(row: SlackMessageRow): SlackMessageRecord {
-  return {
-    id: row.id,
-    contextKey: row.context_key,
-    channelId: row.channel_id,
-    threadTs: row.thread_ts,
-    ts: row.ts,
-    kind: row.kind,
-    taskId: row.task_id ?? undefined,
-    permalink: row.permalink ?? undefined,
-    finalizedAt: row.finalized_at ?? undefined,
-    streamChunksAppended: row.stream_chunks_appended,
-    conclusionKind: row.conclusion_kind ?? undefined,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at,
-  };
-}
-
-export async function recordSlackMessage(input: {
-  contextKey: string;
-  channelId: string;
-  threadTs: string;
-  ts: string;
-  kind: SlackMessageKind;
-  taskId?: string;
-  permalink?: string;
-  finalized?: boolean;
-  streamChunksAppended?: number;
-  conclusionKind?: SlackConclusionKind;
-  actorId?: string;
-}): Promise<SlackMessageRecord> {
-  const id = crypto.randomUUID();
-  const now = new Date().toISOString();
-  const row = await getDbClient().get<SlackMessageRow>(
-    `INSERT INTO slack_messages (
-         id, context_key, channel_id, thread_ts, ts, kind, task_id, permalink,
-         finalized_at, stream_chunks_appended, conclusion_kind, created_at, updated_at, created_by, updated_by
-       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT(channel_id, ts) DO UPDATE SET
-         context_key = excluded.context_key,
-         kind = excluded.kind,
-         task_id = COALESCE(excluded.task_id, slack_messages.task_id),
-         permalink = COALESCE(excluded.permalink, slack_messages.permalink),
-         finalized_at = COALESCE(excluded.finalized_at, slack_messages.finalized_at),
-         stream_chunks_appended = MAX(
-           excluded.stream_chunks_appended,
-           slack_messages.stream_chunks_appended
-         ),
-         conclusion_kind = COALESCE(excluded.conclusion_kind, slack_messages.conclusion_kind),
-         updated_at = excluded.updated_at,
-         updated_by = excluded.updated_by
-       RETURNING *`,
-    [
-      id,
-      input.contextKey,
-      input.channelId,
-      input.threadTs,
-      input.ts,
-      input.kind,
-      input.taskId ?? null,
-      input.permalink ?? null,
-      input.finalized ? now : null,
-      input.streamChunksAppended ?? 0,
-      input.conclusionKind ?? null,
-      now,
-      now,
-      input.actorId ?? null,
-      input.actorId ?? null,
-    ],
-  );
-  if (!row) throw new Error("Failed to record Slack message");
-  return rowToSlackMessage(row);
-}
-
-export async function reserveSlackMessage(input: {
-  contextKey: string;
-  channelId: string;
-  threadTs: string;
-  kind: "tree" | "outcome";
-  taskId?: string;
-  actorId?: string;
-}): Promise<{ record: SlackMessageRecord; created: boolean }> {
-  if (input.kind === "outcome" && !input.taskId) {
-    throw new Error("Outcome Slack message reservations require a task ID");
-  }
-
-  const id = crypto.randomUUID();
-  const now = new Date().toISOString();
-  const pendingTs = `${PENDING_SLACK_MESSAGE_TS_PREFIX}${id}`;
-  const inserted = await getDbClient().get<SlackMessageRow>(
-    `INSERT INTO slack_messages (
-         id, context_key, channel_id, thread_ts, ts, kind, task_id,
-         stream_chunks_appended, created_at, updated_at, created_by, updated_by
-       ) VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)
-       ON CONFLICT DO NOTHING
-       RETURNING *`,
-    [
-      id,
-      input.contextKey,
-      input.channelId,
-      input.threadTs,
-      pendingTs,
-      input.kind,
-      input.taskId ?? null,
-      now,
-      now,
-      input.actorId ?? null,
-      input.actorId ?? null,
-    ],
-  );
-  if (inserted) return { record: rowToSlackMessage(inserted), created: true };
-
-  const existing =
-    input.kind === "tree"
-      ? await getSlackTreeMessageByThread(input.channelId, input.threadTs)
-      : await getSlackOutcomeMessage(input.taskId!);
-  if (!existing) throw new Error("Failed to reserve Slack message");
-  return { record: existing, created: false };
-}
-
-export async function bindSlackMessageTimestamp(
-  id: string,
-  ts: string,
-  options: { streamChunksAppended?: number; renderedThrough?: string } = {},
-): Promise<SlackMessageRecord | null> {
-  const now = new Date().toISOString();
-  const row = await getDbClient().get<SlackMessageRow>(
-    `UPDATE slack_messages SET
-         ts = ?,
-         stream_chunks_appended = MAX(stream_chunks_appended, ?),
-         updated_at = COALESCE(?, ?)
-       WHERE id = ? AND ts LIKE 'pending:%'
-       RETURNING *`,
-    [ts, options.streamChunksAppended ?? 0, options.renderedThrough ?? null, now, id],
-  );
-  return row ? rowToSlackMessage(row) : null;
-}
-
-export async function updateSlackMessageRecord(
-  id: string,
-  updates: {
-    permalink?: string;
-    finalized?: boolean;
-    streamChunksAppended?: number;
-    conclusionKind?: SlackConclusionKind;
-    actorId?: string;
-    touchUpdatedAt?: boolean;
-  },
-): Promise<SlackMessageRecord | null> {
+): Promise<SlackMessageRecord | null> {
   const now = new Date().toISOString();
   const row = await getDbClient().get<SlackMessageRow>(
     `UPDATE slack_messages SET
@@ -1938,1769 +609,202 @@ export async function updateSlackMessageRecord(
          stream_chunks_appended = COALESCE(?, stream_chunks_appended),
          conclusion_kind = COALESCE(?, conclusion_kind),
          updated_at = CASE WHEN ? = 1 THEN ? ELSE updated_at END,
-         updated_by = COALESCE(?, updated_by)
-       WHERE id = ?
-       RETURNING *`,
-    [
-      updates.permalink ?? null,
-      updates.finalized ? 1 : 0,
-      now,
-      updates.streamChunksAppended ?? null,
-      updates.conclusionKind ?? null,
-      updates.touchUpdatedAt === false ? 0 : 1,
-      now,
-      updates.actorId ?? null,
-      id,
-    ],
-  );
-  return row ? rowToSlackMessage(row) : null;
-}
-
-export async function markSlackTreeRendered(
-  id: string,
-  renderedThrough: string,
-): Promise<SlackMessageRecord | null> {
-  const row = await getDbClient().get<SlackMessageRow>(
-    `UPDATE slack_messages SET updated_at = ?
-       WHERE id = ? AND kind = 'tree'
-       RETURNING *`,
-    [renderedThrough, id],
-  );
-  return row ? rowToSlackMessage(row) : null;
-}
-
-export async function deleteSlackMessageRecord(id: string): Promise<boolean> {
-  const result = await getDbClient().run(`DELETE FROM slack_messages WHERE id = ?`, [id]);
-  return result.changes > 0;
-}
-
-export async function getSlackTreeMessage(contextKey: string): Promise<SlackMessageRecord | null> {
-  const row = await getDbClient().get<SlackMessageRow>(
-    `SELECT * FROM slack_messages WHERE context_key = ? AND kind = 'tree' LIMIT 1`,
-    [contextKey],
-  );
-  return row ? rowToSlackMessage(row) : null;
-}
-
-export async function getSlackTreeMessageByThread(
-  channelId: string,
-  threadTs: string,
-): Promise<SlackMessageRecord | null> {
-  const row = await getDbClient().get<SlackMessageRow>(
-    `SELECT * FROM slack_messages
-       WHERE channel_id = ? AND thread_ts = ? AND kind = 'tree'
-       LIMIT 1`,
-    [channelId, threadTs],
-  );
-  return row ? rowToSlackMessage(row) : null;
-}
-
-export async function getSlackOutcomeMessage(taskId: string): Promise<SlackMessageRecord | null> {
-  const row = await getDbClient().get<SlackMessageRow>(
-    `SELECT * FROM slack_messages WHERE task_id = ? AND kind = 'outcome' LIMIT 1`,
-    [taskId],
-  );
-  return row ? rowToSlackMessage(row) : null;
-}
-
-export async function getSlackTreeMessages(): Promise<SlackMessageRecord[]> {
-  const rows = await getDbClient().query<SlackMessageRow>(
-    `SELECT tree.*
-       FROM slack_messages tree
-       JOIN slack_render_v2_state state ON state.id = 1
-       WHERE tree.kind = 'tree'
-       AND (
-         (tree.ts LIKE 'pending:%' AND tree.created_at >= state.activated_at)
-         OR EXISTS (
-           SELECT 1 FROM agent_tasks task
-           WHERE task.slackChannelId = tree.channel_id
-           AND task.slackThreadTs = tree.thread_ts
-           AND task.source = 'slack'
-           AND task.createdAt >= state.activated_at
-           AND task.status IN ('completed', 'failed', 'cancelled')
-           AND NOT EXISTS (
-             SELECT 1 FROM slack_messages outcome
-             WHERE outcome.kind = 'outcome'
-             AND outcome.task_id = task.id
-             AND outcome.finalized_at IS NOT NULL
-           )
-         )
-         OR
-         EXISTS (
-           SELECT 1 FROM agent_tasks task
-           WHERE task.slackChannelId = tree.channel_id
-           AND task.slackThreadTs = tree.thread_ts
-           AND task.createdAt >= state.activated_at
-           AND task.status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
-         )
-         OR EXISTS (
-           SELECT 1 FROM agent_tasks task
-           WHERE task.slackChannelId = tree.channel_id
-           AND task.slackThreadTs = tree.thread_ts
-           AND task.createdAt >= state.activated_at
-           AND task.lastUpdatedAt > tree.updated_at
-         )
-         OR EXISTS (
-           SELECT 1 FROM slack_messages outcome
-           JOIN agent_tasks task ON task.id = outcome.task_id
-           WHERE outcome.kind = 'outcome'
-           AND outcome.channel_id = tree.channel_id
-           AND outcome.thread_ts = tree.thread_ts
-           AND task.createdAt >= state.activated_at
-           AND (
-             outcome.finalized_at IS NULL
-             OR outcome.updated_at > tree.updated_at
-           )
-         )
-       )
-       ORDER BY tree.created_at ASC`,
-  );
-  return rows.map(rowToSlackMessage);
-}
-
-export async function getSlackMessageByChannelTs(
-  channelId: string,
-  ts: string,
-): Promise<SlackMessageRecord | null> {
-  const row = await getDbClient().get<SlackMessageRow>(
-    `SELECT * FROM slack_messages WHERE channel_id = ? AND ts = ? LIMIT 1`,
-    [channelId, ts],
-  );
-  return row ? rowToSlackMessage(row) : null;
-}
-
-export async function getSlackTasksInThread(
-  channelId: string,
-  threadTs: string,
-): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE slackChannelId = ? AND slackThreadTs = ?
-       ORDER BY createdAt ASC, rowid ASC`,
-    [channelId, threadTs],
-  );
-  return rows.map(rowToAgentTask);
-}
-
-export async function markTaskSlackReplySent(taskId: string): Promise<void> {
-  await getDbClient().run(`UPDATE agent_tasks SET slackReplySent = 1 WHERE id = ?`, [taskId]);
-}
-
-export async function setSlackMessageTracking(
-  taskId: string,
-  fields: {
-    slackProgressMessageTs?: string | null;
-    slackTreeRootMessageTs?: string | null;
-  },
-): Promise<void> {
-  const sets: string[] = [];
-  const args: (string | null)[] = [];
-
-  if (Object.hasOwn(fields, "slackProgressMessageTs")) {
-    sets.push("slackProgressMessageTs = ?");
-    args.push(fields.slackProgressMessageTs ?? null);
-  }
-  if (Object.hasOwn(fields, "slackTreeRootMessageTs")) {
-    sets.push("slackTreeRootMessageTs = ?");
-    args.push(fields.slackTreeRootMessageTs ?? null);
-  }
-  if (sets.length === 0) return;
-
-  args.push(taskId);
-  await getDbClient().run(`UPDATE agent_tasks SET ${sets.join(", ")} WHERE id = ?`, args);
-}
-
-export async function getChildTasks(parentTaskId: string): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT * FROM agent_tasks WHERE parentTaskId = ? ORDER BY createdAt ASC, rowid ASC`,
-    [parentTaskId],
-  );
-  return rows.map(rowToAgentTask);
-}
-
-/**
- * Returns true if `parentId` has at least one non-terminal child task with
- * `taskType = 'resume'`. Used by the heartbeat sweep as an idempotency guard:
- * if a prior sweep tick already created a resume follow-up for this parent,
- * don't create a duplicate.
- *
- * **Filters by taskType = 'resume'** specifically. A parent task can also
- * have ordinary non-terminal delegation children (`send-task` auto-defaults
- * `parentTaskId` to the caller's current task — see src/tools/send-task.ts).
- * Treating those as "already resumed" would incorrectly skip the resume
- * path for a crashed worker that had delegated subtasks (PR #594 review).
- */
-export async function hasNonTerminalResumeChild(parentId: string): Promise<boolean> {
-  const row = await getDbClient().get(
-    `SELECT 1 FROM agent_tasks
-       WHERE parentTaskId = ?
-         AND taskType = 'resume'
-         AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
-       LIMIT 1`,
-    [parentId],
-  );
-  return row !== undefined && row !== null;
-}
-
-/**
- * True when a non-terminal `reroute-decision` child exists for `parentId`.
- *
- * Mirrors {@link hasNonTerminalResumeChild} but filters on
- * `taskType = 'reroute-decision'` — the Lead-owned re-delegation decision
- * created when a pinned crash-recovery resume is never reclaimed (DES-523).
- * Makes escalation idempotent: a later heartbeat sweep must not create a second
- * decision for the same original task. We filter on the taskType marker
- * specifically (not any child) so ordinary delegation / completion follow-up
- * children of the original cannot suppress a needed decision, and nothing else
- * is mistaken for one.
- */
-export async function hasNonTerminalRerouteDecisionChild(parentId: string): Promise<boolean> {
-  const row = await getDbClient().get<Record<string, number>>(
-    `SELECT 1 FROM agent_tasks
-       WHERE parentTaskId = ?
-         AND taskType = 'reroute-decision'
-         AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
-       LIMIT 1`,
-    [parentId],
-  );
-  return row !== undefined && row !== null;
-}
-
-export async function updateTaskClaudeSessionId(
-  taskId: string,
-  claudeSessionId: string,
-  provider?: ProviderName,
-  providerMeta?: Record<string, unknown>,
-  model?: string,
-  harnessVariant?: string,
-  harnessVariantMeta?: Record<string, unknown>,
-): Promise<AgentTask | null> {
-  const setClauses = ["claudeSessionId = ?", "lastUpdatedAt = ?"];
-  const params: (string | null)[] = [claudeSessionId, new Date().toISOString()];
-
-  if (provider !== undefined) {
-    setClauses.push("provider = ?");
-    params.push(provider);
-  }
-  if (providerMeta !== undefined) {
-    setClauses.push("providerMeta = ?");
-    params.push(JSON.stringify(providerMeta));
-  }
-  if (model !== undefined) {
-    setClauses.push("model = ?");
-    params.push(model);
-  }
-  if (harnessVariant !== undefined) {
-    setClauses.push("harnessVariant = ?");
-    params.push(harnessVariant);
-  }
-  if (harnessVariantMeta !== undefined) {
-    setClauses.push("harnessVariantMeta = ?");
-    params.push(JSON.stringify(harnessVariantMeta));
-  }
-
-  params.push(taskId);
-
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks SET ${setClauses.join(", ")} WHERE id = ? RETURNING *`,
-    params,
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-/**
- * Sets or clears a task's display title (session rename). Trims the input and
- * normalizes an empty string to NULL (clear). Deliberately does NOT touch
- * `lastUpdatedAt` — a rename is not activity, and the sessions sidebar sorts
- * on chain-wide max `lastUpdatedAt`, so bumping it here would reorder the list.
- */
-export async function updateTaskTitle(
-  taskId: string,
-  title: string | null,
-): Promise<AgentTask | null> {
-  const normalized = title === null ? null : title.trim() || null;
-  const row = await getDbClient().get<AgentTaskRow>(
-    "UPDATE agent_tasks SET title = ? WHERE id = ? RETURNING *",
-    [normalized, taskId],
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function updateTaskVcs(
-  taskId: string,
-  vcs: {
-    vcsProvider: "github" | "gitlab";
-    vcsRepo: string;
-    vcsNumber: number;
-    vcsUrl: string;
-  },
-): Promise<AgentTask | null> {
-  const row = await getDbClient().transaction(async () => {
-    const updated = await getDbClient().get<AgentTaskRow>(
-      `UPDATE agent_tasks
-       SET vcsProvider = ?, vcsRepo = ?, vcsNumber = ?, vcsUrl = ?, lastUpdatedAt = ?
-       WHERE id = ? RETURNING *`,
-      [vcs.vcsProvider, vcs.vcsRepo, vcs.vcsNumber, vcs.vcsUrl, new Date().toISOString(), taskId],
-    );
-    if (updated) {
-      await reconcileTaskPullRequestAttachments(taskId, updated.agentId, [
-        updated.output,
-        vcs.vcsProvider === "github" ? vcs.vcsUrl : null,
-      ]);
-    }
-    return updated;
-  });
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function getTasksByAgentId(agentId: string): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    "SELECT * FROM agent_tasks WHERE agentId = ? ORDER BY createdAt DESC",
-    [agentId],
-  );
-  return rows.map(rowToAgentTask);
-}
-
-/**
- * Get the most recently updated in-progress task for an agent.
- * Used as a fallback when X-Source-Task-Id header is missing (e.g. lead agent HITL requests).
- *
- * Note: if agent has multiple in-progress tasks, returns the most recently
- * updated one. This is a best-effort fallback — the X-Source-Task-Id header
- * is the authoritative source when available.
- */
-export async function getAgentCurrentTask(agentId: string): Promise<AgentTask | null> {
-  const row = await getDbClient().get<AgentTaskRow>(
-    "SELECT * FROM agent_tasks WHERE agentId = ? AND status = 'in_progress' ORDER BY lastUpdatedAt DESC LIMIT 1",
-    [agentId],
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function getTasksByStatus(status: AgentTaskStatus): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    "SELECT * FROM agent_tasks WHERE status = ? ORDER BY createdAt DESC",
-    [status],
-  );
-  return rows.map(rowToAgentTask);
-}
-
-/**
- * Find a task by VCS repo and issue/PR/MR number.
- * Returns the most recent non-terminal task for this VCS entity.
- *
- * Terminal exclusion MUST stay in lock-step with `TERMINAL_TASK_STATUSES`
- * in `src/types.ts`. SQL strings can't import a TS const — if you add a
- * new terminal status, grep for `NOT IN ('completed'` across this file.
- */
-export async function findTaskByVcs(vcsRepo: string, vcsNumber: number): Promise<AgentTask | null> {
-  const row = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE vcsRepo = ? AND vcsNumber = ?
-       AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
-       ORDER BY createdAt DESC
-       LIMIT 1`,
-    [vcsRepo, vcsNumber],
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-/** @deprecated Use findTaskByVcs instead */
-export const findTaskByGitHub = findTaskByVcs;
-
-export interface TaskFilters {
-  /** Single status (back-compat) OR array of statuses (multi-status filter). */
-  status?: AgentTaskStatus | AgentTaskStatus[];
-  agentId?: string;
-  search?: string;
-  // New filters
-  unassigned?: boolean;
-  offeredTo?: string;
-  readyOnly?: boolean;
-  taskType?: string;
-  tags?: string[];
-  scheduleId?: string;
-  /** Exact canonical asset namespace. */
-  key?: string;
-  /** Canonical namespace subtree prefix. */
-  keyPrefix?: string;
-  /** Filter to tasks whose `source` is in this list. Empty/undefined → no filter. */
-  source?: AgentTaskSource[];
-  /** ISO 8601 timestamp; only return tasks where createdAt >= this. */
-  createdAfter?: string;
-  /** ISO 8601 timestamp; only return tasks where createdAt < this. */
-  createdBefore?: string;
-  /** Only return tasks requested by this canonical user. NULL rows are excluded. */
-  requestedByUserId?: string;
-  /** When set, restrict to rows where `requestedByUserId` IS NULL. Takes priority over `requestedByUserId`. */
-  requestedByUserIdIsNull?: boolean;
-  /** Sort list rows for either table freshness or timeline paging. */
-  orderBy?: "lastUpdatedAt" | "createdAt";
-  limit?: number;
-  offset?: number;
-  includeHeartbeat?: boolean;
-}
-
-export function getAllTasks(filters?: TaskFilters): Promise<AgentTask[]>;
-export function getAllTasks(
-  filters: TaskFilters | undefined,
-  opts: { slim: true },
-): Promise<AgentTaskSummary[]>;
-export async function getAllTasks(
-  filters?: TaskFilters,
-  opts?: { slim?: boolean },
-): Promise<AgentTask[] | AgentTaskSummary[]> {
-  const conditions: string[] = [];
-  const params: (string | AgentTaskStatus)[] = [];
-
-  if (filters?.status) {
-    if (Array.isArray(filters.status)) {
-      if (filters.status.length === 1) {
-        conditions.push("status = ?");
-        params.push(filters.status[0]!);
-      } else if (filters.status.length > 1) {
-        const placeholders = filters.status.map(() => "?").join(", ");
-        conditions.push(`status IN (${placeholders})`);
-        for (const s of filters.status) params.push(s);
-      }
-    } else {
-      conditions.push("status = ?");
-      params.push(filters.status);
-    }
-  }
-
-  if (filters?.agentId) {
-    conditions.push("agentId = ?");
-    params.push(filters.agentId);
-  }
-
-  if (filters?.search) {
-    conditions.push("(task LIKE ? OR id LIKE ?)");
-    params.push(`%${filters.search}%`, `%${filters.search}%`);
-  }
-
-  // New filters
-  if (filters?.unassigned) {
-    conditions.push("(agentId IS NULL OR status = 'unassigned')");
-  }
-
-  if (filters?.offeredTo) {
-    conditions.push("offeredTo = ?");
-    params.push(filters.offeredTo);
-  }
-
-  if (filters?.taskType) {
-    conditions.push("taskType = ?");
-    params.push(filters.taskType);
-  }
-
-  if (filters?.tags && filters.tags.length > 0) {
-    // Match any of the tags
-    const tagConditions = filters.tags.map(() => "tags LIKE ?");
-    conditions.push(`(${tagConditions.join(" OR ")})`);
-    for (const tag of filters.tags) {
-      params.push(`%"${tag}"%`);
-    }
-  }
-
-  if (filters?.scheduleId) {
-    conditions.push("scheduleId = ?");
-    params.push(filters.scheduleId);
-  }
-
-  if (filters?.key) {
-    conditions.push('"key" = ?');
-    params.push(normalizeAssetKey(filters.key));
-  } else if (filters?.keyPrefix) {
-    conditions.push(`"key" LIKE ? ESCAPE '\\'`);
-    params.push(assetKeyPrefixPattern(filters.keyPrefix));
-  }
-
-  if (filters?.source && filters.source.length > 0) {
-    const placeholders = filters.source.map(() => "?").join(", ");
-    conditions.push(`source IN (${placeholders})`);
-    for (const s of filters.source) params.push(s);
-  }
-
-  if (filters?.createdAfter) {
-    conditions.push("createdAt >= ?");
-    params.push(filters.createdAfter);
-  }
-
-  if (filters?.createdBefore) {
-    conditions.push("createdAt < ?");
-    params.push(filters.createdBefore);
-  }
-
-  if (filters?.requestedByUserIdIsNull) {
-    conditions.push("requestedByUserId IS NULL");
-  } else if (filters?.requestedByUserId) {
-    conditions.push("requestedByUserId = ?");
-    params.push(filters.requestedByUserId);
-  }
-
-  // Exclude system/heartbeat tasks by default. The flag is still called
-  // `includeHeartbeat` for backward compat with existing API callers, but we
-  // also gate boot-triage + heartbeat-checklist behind it since those are
-  // equally noisy in the dashboard task list.
-  if (!filters?.includeHeartbeat) {
-    conditions.push(
-      "(IFNULL(taskType, '') NOT IN ('heartbeat', 'heartbeat-checklist', 'boot-triage') AND tags NOT LIKE '%\"heartbeat\"%')",
-    );
-  }
-
-  const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-  const limit = filters?.limit ?? 25;
-  const offset = filters?.offset ?? 0;
-  const orderBy =
-    filters?.orderBy === "createdAt"
-      ? "createdAt DESC, rowid DESC"
-      : "lastUpdatedAt DESC, priority DESC";
-  const query = `SELECT agent_tasks.*,
-    (SELECT SUM(totalCostUsd) FROM session_costs WHERE session_costs.taskId = agent_tasks.id) AS totalCostUsd
-    FROM agent_tasks ${whereClause}
-    ORDER BY ${orderBy} LIMIT ${limit} OFFSET ${offset}`;
-
-  const rows = await getDbClient().query<AgentTaskRow>(query, params);
-
-  // Filter for ready tasks (dependencies met) if requested. Both the full and
-  // the slim row shapes carry `id` + `dependsOn`, so the same predicate works.
-  const filterReady = async <T extends { id: string; dependsOn: string[] }>(
-    items: T[],
-  ): Promise<T[]> => {
-    const readyFlags = await Promise.all(
-      items.map(async (task) => {
-        if (!task.dependsOn || task.dependsOn.length === 0) return true;
-        return (await checkDependencies(task.id)).ready;
-      }),
-    );
-    return items.filter((_, i) => readyFlags[i]);
-  };
-
-  if (opts?.slim) {
-    let tasks = rows.map(rowToAgentTaskSummary);
-    if (filters?.readyOnly) tasks = await filterReady(tasks);
-    return tasks;
-  }
-
-  let tasks = rows.map(rowToAgentTask);
-  if (filters?.readyOnly) tasks = await filterReady(tasks);
-  return tasks;
-}
-
-/**
- * Get total count of tasks matching the given filters (ignoring limit).
- * Used alongside getAllTasks to display accurate total counts in UI.
- */
-export async function getTasksCount(
-  filters?: Omit<TaskFilters, "limit" | "readyOnly">,
-): Promise<number> {
-  const conditions: string[] = [];
-  const params: (string | AgentTaskStatus)[] = [];
-
-  if (filters?.status) {
-    if (Array.isArray(filters.status)) {
-      if (filters.status.length === 1) {
-        conditions.push("status = ?");
-        params.push(filters.status[0]!);
-      } else if (filters.status.length > 1) {
-        const placeholders = filters.status.map(() => "?").join(", ");
-        conditions.push(`status IN (${placeholders})`);
-        for (const s of filters.status) params.push(s);
-      }
-    } else {
-      conditions.push("status = ?");
-      params.push(filters.status);
-    }
-  }
-
-  if (filters?.agentId) {
-    conditions.push("agentId = ?");
-    params.push(filters.agentId);
-  }
-
-  if (filters?.search) {
-    conditions.push("(task LIKE ? OR id LIKE ?)");
-    params.push(`%${filters.search}%`, `%${filters.search}%`);
-  }
-
-  if (filters?.unassigned) {
-    conditions.push("(agentId IS NULL OR status = 'unassigned')");
-  }
-
-  if (filters?.offeredTo) {
-    conditions.push("offeredTo = ?");
-    params.push(filters.offeredTo);
-  }
-
-  if (filters?.taskType) {
-    conditions.push("taskType = ?");
-    params.push(filters.taskType);
-  }
-
-  if (filters?.tags && filters.tags.length > 0) {
-    const tagConditions = filters.tags.map(() => "tags LIKE ?");
-    conditions.push(`(${tagConditions.join(" OR ")})`);
-    for (const tag of filters.tags) {
-      params.push(`%"${tag}"%`);
-    }
-  }
-
-  if (filters?.scheduleId) {
-    conditions.push("scheduleId = ?");
-    params.push(filters.scheduleId);
-  }
-
-  if (filters?.key) {
-    conditions.push('"key" = ?');
-    params.push(normalizeAssetKey(filters.key));
-  } else if (filters?.keyPrefix) {
-    conditions.push(`"key" LIKE ? ESCAPE '\\'`);
-    params.push(assetKeyPrefixPattern(filters.keyPrefix));
-  }
-
-  if (filters?.source && filters.source.length > 0) {
-    const placeholders = filters.source.map(() => "?").join(", ");
-    conditions.push(`source IN (${placeholders})`);
-    for (const s of filters.source) params.push(s);
-  }
-
-  if (filters?.createdAfter) {
-    conditions.push("createdAt >= ?");
-    params.push(filters.createdAfter);
-  }
-
-  if (filters?.createdBefore) {
-    conditions.push("createdAt < ?");
-    params.push(filters.createdBefore);
-  }
-
-  if (filters?.requestedByUserIdIsNull) {
-    conditions.push("requestedByUserId IS NULL");
-  } else if (filters?.requestedByUserId) {
-    conditions.push("requestedByUserId = ?");
-    params.push(filters.requestedByUserId);
-  }
-
-  // Exclude system/heartbeat tasks by default. The flag is still called
-  // `includeHeartbeat` for backward compat with existing API callers, but we
-  // also gate boot-triage + heartbeat-checklist behind it since those are
-  // equally noisy in the dashboard task list.
-  if (!filters?.includeHeartbeat) {
-    conditions.push(
-      "(IFNULL(taskType, '') NOT IN ('heartbeat', 'heartbeat-checklist', 'boot-triage') AND tags NOT LIKE '%\"heartbeat\"%')",
-    );
-  }
-
-  const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-  const query = `SELECT COUNT(*) as count FROM agent_tasks ${whereClause}`;
-
-  const result = await getDbClient().get<{ count: number }>(query, params);
-
-  return result?.count ?? 0;
-}
-
-/**
- * Get task statistics (counts by status) without any limit.
- * This is more efficient than fetching all tasks for stats purposes.
- */
-export async function getTaskStats(): Promise<{
-  total: number;
-  unassigned: number;
-  offered: number;
-  reviewing: number;
-  pending: number;
-  in_progress: number;
-  paused: number;
-  completed: number;
-  failed: number;
-}> {
-  const row = await getDbClient().get<{
-    total: number;
-    unassigned: number;
-    offered: number;
-    reviewing: number;
-    pending: number;
-    in_progress: number;
-    paused: number;
-    completed: number;
-    failed: number;
-  }>(
-    `SELECT
-        COUNT(*) as total,
-        SUM(CASE WHEN status = 'unassigned' THEN 1 ELSE 0 END) as unassigned,
-        SUM(CASE WHEN status = 'offered' THEN 1 ELSE 0 END) as offered,
-        SUM(CASE WHEN status = 'reviewing' THEN 1 ELSE 0 END) as reviewing,
-        SUM(CASE WHEN status = 'pending' THEN 1 ELSE 0 END) as pending,
-        SUM(CASE WHEN status = 'in_progress' THEN 1 ELSE 0 END) as in_progress,
-        SUM(CASE WHEN status = 'paused' THEN 1 ELSE 0 END) as paused,
-        SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as completed,
-        SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) as failed
-      FROM agent_tasks`,
-  );
-
-  return (
-    row ?? {
-      total: 0,
-      unassigned: 0,
-      offered: 0,
-      reviewing: 0,
-      pending: 0,
-      in_progress: 0,
-      paused: 0,
-      completed: 0,
-      failed: 0,
-    }
-  );
-}
-
-export async function getCompletedSlackTasks(): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE slackChannelId IS NOT NULL
-       AND status IN ('completed', 'failed')
-       ORDER BY lastUpdatedAt DESC
-       LIMIT 200`,
-  );
-  return rows.map(rowToAgentTask);
-}
-
-/**
- * Return terminal Slack-rooted tasks whose durable relay obligation is pending.
- * The obligation is inserted by a DB trigger in the same transaction as the
- * terminal status transition, so a process restart cannot lose the send.
- */
-export async function getPendingSlackRelayTasks(): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT task.* FROM slack_relay_obligations obligation
-       JOIN agent_tasks task ON task.id = obligation.task_id
-       WHERE obligation.delivered_at IS NULL
-       AND task.status IN ('completed', 'failed', 'cancelled')
-       ORDER BY obligation.last_attempt_at IS NOT NULL,
-                obligation.last_attempt_at ASC,
-                obligation.created_at ASC
-       LIMIT 200`,
-  );
-  return rows.map(rowToAgentTask);
-}
-
-/** Rotate attempted rows behind fresh obligations so poison rows cannot starve the queue. */
-export async function markSlackRelayAttempted(taskId: string): Promise<boolean> {
-  const now = new Date().toISOString();
-  const result = await getDbClient().run(
-    `UPDATE slack_relay_obligations
-       SET attempt_count = attempt_count + 1,
-           last_attempt_at = ?,
-           updated_at = ?
-       WHERE task_id = ? AND delivered_at IS NULL`,
-    [now, now, taskId],
-  );
-  return result.changes > 0;
-}
-
-/** Mark a relay obligation delivered only after Slack accepted the final result. */
-export async function markSlackRelayDelivered(taskId: string): Promise<boolean> {
-  const now = new Date().toISOString();
-  const result = await getDbClient().run(
-    `UPDATE slack_relay_obligations
-       SET delivered_at = ?, updated_at = ?
-       WHERE task_id = ? AND delivered_at IS NULL`,
-    [now, now, taskId],
-  );
-  return result.changes > 0;
-}
-
-/** Discharge obligations already fulfilled by renderer v2's durable outcome record. */
-export async function markFinalizedSlackRelaysDelivered(): Promise<number> {
-  const now = new Date().toISOString();
-  const result = await getDbClient().run(
-    `UPDATE slack_relay_obligations AS obligation
-       SET delivered_at = ?, updated_at = ?
-       WHERE obligation.delivered_at IS NULL
-       AND EXISTS (
-         SELECT 1 FROM slack_messages message
-         WHERE message.kind = 'outcome'
-         AND message.task_id = obligation.task_id
-         AND message.finalized_at IS NOT NULL
-       )`,
-    [now, now],
-  );
-  return result.changes;
-}
-
-/**
- * Get tasks that were recently finished (completed/failed) by workers (non-lead agents).
- * Used by leads to know when workers complete tasks.
- */
-export async function getRecentlyFinishedWorkerTasks(): Promise<AgentTask[]> {
-  // Query for finished tasks that haven't been notified yet
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT t.* FROM agent_tasks t
-       LEFT JOIN agents a ON t.agentId = a.id
-       WHERE t.status IN ('completed', 'failed')
-       AND t.finishedAt IS NOT NULL
-       AND t.notifiedAt IS NULL
-       AND (a.isLead = 0 OR a.isLead IS NULL)
-       ORDER BY t.finishedAt DESC LIMIT 50`,
-  );
-  return rows.map(rowToAgentTask);
-}
-
-/**
- * Atomically mark finished tasks as notified.
- * Sets notifiedAt timestamp to prevent returning them in future polls.
- */
-export async function markTasksNotified(taskIds: string[]): Promise<number> {
-  if (taskIds.length === 0) return 0;
-
-  const now = new Date().toISOString();
-  const placeholders = taskIds.map(() => "?").join(",");
-
-  const result = await getDbClient().run(
-    `UPDATE agent_tasks SET notifiedAt = ?
-     WHERE id IN (${placeholders}) AND notifiedAt IS NULL`,
-    [now, ...taskIds],
-  );
-
-  return result.changes;
-}
-
-/**
- * Reset notifiedAt for tasks, allowing them to be re-delivered on next poll.
- * Used when a trigger was consumed but the session that should process it failed.
- * This prevents permanent notification loss from the mark-before-process race.
- */
-export async function resetTasksNotified(taskIds: string[]): Promise<number> {
-  if (taskIds.length === 0) return 0;
-
-  const placeholders = taskIds.map(() => "?").join(",");
-
-  const result = await getDbClient().run(
-    `UPDATE agent_tasks SET notifiedAt = NULL
-     WHERE id IN (${placeholders}) AND notifiedAt IS NOT NULL`,
-    taskIds,
-  );
-
-  return result.changes;
-}
-
-export async function getInProgressSlackTasks(): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE slackChannelId IS NOT NULL
-       AND status = 'in_progress'
-       ORDER BY lastUpdatedAt DESC
-       LIMIT 200`,
-  );
-  return rows.map(rowToAgentTask);
-}
-
-export async function getSlackTasksMissingTree(): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT task.* FROM agent_tasks task
-       JOIN slack_render_v2_state state ON state.id = 1
-       WHERE task.source = 'slack'
-       AND task.slackChannelId IS NOT NULL
-       AND task.slackThreadTs IS NOT NULL
-       AND task.createdAt >= state.activated_at
-       AND task.status NOT IN ('backlog', 'unassigned', 'superseded')
-       AND NOT EXISTS (
-         SELECT 1 FROM agent_tasks earlier
-         WHERE earlier.source = 'slack'
-         AND earlier.slackChannelId = task.slackChannelId
-         AND earlier.slackThreadTs = task.slackThreadTs
-         AND earlier.createdAt < state.activated_at
-       )
-       AND NOT EXISTS (
-         SELECT 1 FROM slack_messages tree
-         WHERE tree.kind = 'tree'
-         AND tree.channel_id = task.slackChannelId
-         AND tree.thread_ts = task.slackThreadTs
-       )
-       ORDER BY task.lastUpdatedAt DESC
-       LIMIT 200`,
-  );
-  return rows.map(rowToAgentTask);
-}
-
-/**
- * Return sibling tasks for a given cross-ingress context key, optionally
- * filtered by status. The returned shape mirrors getInProgressSlackTasks for
- * consistency; callers can narrow further in TypeScript.
- *
- * See src/tasks/context-key.ts for the key schema.
- */
-export async function getInProgressTasksByContextKey(
-  contextKey: string,
-  statuses: AgentTaskStatus[] = ["pending", "in_progress", "offered", "paused"],
-): Promise<AgentTask[]> {
-  if (!contextKey || statuses.length === 0) return [];
-  const placeholders = statuses.map(() => "?").join(",");
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE contextKey = ?
-       AND status IN (${placeholders})
-       ORDER BY lastUpdatedAt DESC
-       LIMIT 200`,
-    [contextKey, ...statuses],
-  );
-  return rows.map(rowToAgentTask);
-}
-
-export type ExistingTrackerContextWorkReason = "active_task" | "linked_open_pr";
-
-export type ExistingTrackerContextWork = {
-  task: AgentTask;
-  reason: ExistingTrackerContextWorkReason;
-};
-
-const LINEAR_TRACKER_CONTEXT_KEY_PREFIX = "task:trackers:linear:";
-
-function isLinearTrackerContextKey(contextKey: string | null | undefined): contextKey is string {
-  return !!contextKey && contextKey.startsWith(LINEAR_TRACKER_CONTEXT_KEY_PREFIX);
-}
-
-/**
- * Return existing work for a Linear tracker key before creating another task.
- *
- * Active means any non-terminal task. A completed task with persisted VCS PR/MR
- * metadata is also treated as existing work because the task can be complete
- * while the PR is still awaiting review/merge.
- */
-export async function findExistingLinearTrackerContextWork(
-  contextKey: string | null | undefined,
-): Promise<ExistingTrackerContextWork | null> {
-  if (!isLinearTrackerContextKey(contextKey)) return null;
-
-  const activeRow = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE contextKey = ?
-       AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
-       ORDER BY lastUpdatedAt DESC
-       LIMIT 1`,
-    [contextKey],
-  );
-  if (activeRow) {
-    return { task: rowToAgentTask(activeRow), reason: "active_task" };
-  }
-
-  const linkedPrRow = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE contextKey = ?
-       AND status = 'completed'
-       AND vcsProvider IS NOT NULL
-       AND vcsRepo IS NOT NULL
-       AND vcsNumber IS NOT NULL
-       AND vcsUrl IS NOT NULL
-       ORDER BY lastUpdatedAt DESC
-       LIMIT 1`,
-    [contextKey],
-  );
-  if (linkedPrRow) {
-    return { task: rowToAgentTask(linkedPrRow), reason: "linked_open_pr" };
-  }
-
-  return null;
-}
-
-export async function getLatestTaskByContextKey(contextKey: string): Promise<AgentTask | null> {
-  if (!contextKey) return null;
-  const row = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE contextKey = ?
-       ORDER BY createdAt DESC
-       LIMIT 1`,
-    [contextKey],
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function getLatestScriptRunStepTaskByContextKey(
-  contextKey: string,
-): Promise<AgentTask | null> {
-  if (!contextKey) return null;
-  const row = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE contextKey = ?
-       AND taskType = 'script-run-step'
-       ORDER BY createdAt DESC, rowid DESC
-       LIMIT 1`,
-    [contextKey],
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-/**
- * Find the most recent agent associated with a specific Slack thread.
- * No status filter — returns the last agent that touched this thread regardless of task state.
- * This is intentional: follow-up messages should route to the same agent even after task completion.
- * Callers (e.g. assistant.ts) apply their own status checks (e.g. agent.status !== "offline").
- */
-export async function getAgentWorkingOnThread(
-  channelId: string,
-  threadTs: string,
-): Promise<Agent | null> {
-  const taskRow = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE source = 'slack'
-       AND slackChannelId = ?
-       AND slackThreadTs = ?
-       ORDER BY createdAt DESC
-       LIMIT 1`,
-    [channelId, threadTs],
-  );
-
-  if (taskRow?.agentId) return getAgentById(taskRow.agentId);
-
-  return null;
-}
-
-/**
- * Find the latest active (in_progress or pending) task in a specific Slack thread.
- * Used for dependency chaining in additive Slack buffer.
- */
-export async function getLatestActiveTaskInThread(
-  channelId: string,
-  threadTs: string,
-): Promise<AgentTask | null> {
-  const row = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE source = 'slack'
-       AND slackChannelId = ?
-       AND slackThreadTs = ?
-       AND status IN ('in_progress', 'pending')
-       ORDER BY createdAt DESC, rowid DESC
-       LIMIT 1`,
-    [channelId, threadTs],
-  );
-
-  return row ? rowToAgentTask(row) : null;
-}
-
-/**
- * Find the latest task assigned to a lead agent in a specific Slack thread.
- * Source is deliberately restricted to Slack ingress so inherited worker-task
- * metadata cannot become the thread's steering target.
- */
-export async function getLatestLeadTaskInThread(
-  channelId: string,
-  threadTs: string,
-): Promise<AgentTask | null> {
-  const row = await getDbClient().get<AgentTaskRow>(
-    `SELECT t.*
-       FROM agent_tasks t
-       JOIN agents a ON a.id = t.agentId
-       WHERE t.source = 'slack'
-         AND t.slackChannelId = ?
-         AND t.slackThreadTs = ?
-         AND a.isLead = 1
-       ORDER BY t.createdAt DESC, t.rowid DESC
-       LIMIT 1`,
-    [channelId, threadTs],
-  );
-
-  return row ? rowToAgentTask(row) : null;
-}
-
-/**
- * Find the most recent task in a Slack thread, regardless of source or status.
- * Unlike getAgentWorkingOnThread (which filters source='slack'), this finds ALL tasks
- * including worker tasks that inherited Slack metadata via parentTaskId.
- */
-export async function getMostRecentTaskInThread(
-  channelId: string,
-  threadTs: string,
-): Promise<AgentTask | null> {
-  const row = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE slackChannelId = ?
-       AND slackThreadTs = ?
-       ORDER BY createdAt DESC
-       LIMIT 1`,
-    [channelId, threadTs],
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function findCompletedTaskInThread(
-  channelId: string,
-  threadTs: string,
-  windowMinutes: number,
-): Promise<AgentTask | null> {
-  const since = new Date(Date.now() - windowMinutes * 60 * 1000).toISOString();
-  const row = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE slackChannelId = ?
-       AND slackThreadTs = ?
-       AND status = 'completed'
-       AND lastUpdatedAt > ?
-       ORDER BY lastUpdatedAt DESC
-       LIMIT 1`,
-    [channelId, threadTs, since],
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-/**
- * Find the most recent CANCELLED task in a Slack thread. Used by the
- * follow-up re-delegation guard so a cancellation (worker SIGTERM,
- * runner-side abort, swarm-events tool-loop abort) doesn't permanently
- * jam re-dispatch when an earlier sibling task in the same thread also
- * completed.
- *
- * Matches both:
- *   - `status = 'cancelled'` (the canonical terminal state from cancelTask)
- *   - `status = 'failed'` with a failureReason that starts with "cancelled"
- *     or "exit 130" or contains "cancelled" (the codex-adapter abort path
- *     emits `failureReason: "cancelled"` and exits 130).
- */
-export async function findRecentCancelledTaskInThread(
-  channelId: string,
-  threadTs: string,
-  windowMinutes: number,
-): Promise<AgentTask | null> {
-  const since = new Date(Date.now() - windowMinutes * 60 * 1000).toISOString();
-  const row = await getDbClient().get<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE slackChannelId = ?
-       AND slackThreadTs = ?
-       AND lastUpdatedAt > ?
-       AND (
-         status = 'cancelled'
-         OR (
-           status = 'failed'
-           AND failureReason IS NOT NULL
-           AND (
-             failureReason LIKE 'cancelled%'
-             OR failureReason LIKE 'exit 130%'
-             OR failureReason LIKE '%cancelled%'
-           )
-         )
-       )
-       ORDER BY lastUpdatedAt DESC
-       LIMIT 1`,
-    [channelId, threadTs, since],
-  );
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function completeTask(id: string, output?: string): Promise<AgentTask | null> {
-  const oldTask = await getTaskById(id);
-  if (!oldTask) return null;
-
-  // Idempotency guard: don't re-complete a task already in a terminal state.
-  // Mirrors cancelTask. Prevents duplicate task.completed events, duplicate
-  // log entries, and duplicate follow-up tasks when multiple sessions race.
-  if (isTerminalTaskStatus(oldTask.status)) {
-    return null;
-  }
-
-  const row = await getDbClient().transaction(async () => {
-    const finishedAt = new Date().toISOString();
-    // The status predicate re-checks the idempotency guard atomically: the
-    // await between the guard read above and this write lets a racing
-    // terminal transition (e.g. heartbeat failTask) land first.
-    let completed = await getDbClient().get<AgentTaskRow>(
-      `UPDATE agent_tasks SET status = ?, finishedAt = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-         WHERE id = ? AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded') RETURNING *`,
-      ["completed", finishedAt, id],
-    );
-    if (!completed) return null;
-
-    if (output) {
-      completed = await getDbClient().get<AgentTaskRow>(
-        "UPDATE agent_tasks SET output = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ? RETURNING *",
-        [scrubSecrets(output), id],
-      );
-    }
-    if (completed) {
-      await reconcileTaskPullRequestAttachments(id, completed.agentId, [
-        completed.output,
-        completed.vcsProvider === "github" ? completed.vcsUrl : null,
-      ]);
-    }
-    return completed;
-  });
-  if (!row) return null;
-
-  if (row && oldTask) {
-    emitTaskLifecycleTelemetryAfterCommit(
-      "completed",
-      {
-        taskId: id,
-        source: oldTask.source,
-        ...taskContextForTelemetry(oldTask),
-        agentId: row.agentId ?? undefined,
-        durationMs: row.createdAt ? Date.now() - new Date(row.createdAt).getTime() : undefined,
-      },
-      (task) => task?.status === "completed",
-    );
-
-    try {
-      await createLogEntry({
-        eventType: "task_status_change",
-        taskId: id,
-        agentId: row.agentId ?? undefined,
-        oldValue: oldTask.status,
-        newValue: "completed",
-      });
-    } catch {}
-    getDbClient().afterCommit(() => {
-      import("../workflows/event-bus")
-        .then(({ workflowEventBus }) => {
-          workflowEventBus.emit("task.completed", {
-            taskId: id,
-            output,
-            agentId: row.agentId,
-            workflowRunId: row.workflowRunId,
-            workflowRunStepId: row.workflowRunStepId,
-          });
-        })
-        .catch((err) =>
-          console.error(
-            "[db] task.completed event not emitted:",
-            scrubSecrets(err instanceof Error ? err.message : String(err)),
-          ),
-        );
-    });
-    try {
-      await promotePendingSteeringForTask(id, "Task completed before steering was delivered");
-    } catch (error) {
-      console.error(
-        "[completeTask] pending steering promotion error:",
-        scrubSecrets(error instanceof Error ? error.message : String(error)),
-      );
-    }
-  }
-
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function failTask(id: string, reason: string): Promise<AgentTask | null> {
-  const oldTask = await getTaskById(id);
-  if (!oldTask) return null;
-
-  // Idempotency guard: don't re-fail a task already in a terminal state.
-  // Mirrors cancelTask / completeTask. Prevents duplicate task.failed events
-  // and duplicate follow-up tasks when multiple sessions race.
-  if (isTerminalTaskStatus(oldTask.status)) {
-    return null;
-  }
-
-  const finishedAt = new Date().toISOString();
-  const scrubbedReason = scrubSecrets(reason);
-  // Status predicate re-checks the idempotency guard atomically (a racing
-  // terminal transition can land during the await above).
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks SET status = 'failed', failureReason = ?, finishedAt = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded') RETURNING *`,
-    [scrubbedReason, finishedAt, id],
-  );
-  if (row && oldTask) {
-    emitTaskLifecycleTelemetryAfterCommit(
-      "failed",
-      {
-        taskId: id,
-        source: oldTask.source,
-        ...taskContextForTelemetry(oldTask),
-        agentId: row.agentId ?? undefined,
-        durationMs: row.createdAt ? Date.now() - new Date(row.createdAt).getTime() : undefined,
-      },
-      (task) => task?.status === "failed",
-    );
-
-    try {
-      await createLogEntry({
-        eventType: "task_status_change",
-        taskId: id,
-        agentId: row.agentId ?? undefined,
-        oldValue: oldTask.status,
-        newValue: "failed",
-        metadata: { reason: scrubbedReason },
-      });
-    } catch {}
-    getDbClient().afterCommit(() => {
-      import("../workflows/event-bus")
-        .then(({ workflowEventBus }) => {
-          workflowEventBus.emit("task.failed", {
-            taskId: id,
-            failureReason: reason,
-            agentId: row.agentId,
-            workflowRunId: row.workflowRunId,
-            workflowRunStepId: row.workflowRunStepId,
-          });
-        })
-        .catch((err) =>
-          console.error(
-            "[db] task.failed event not emitted:",
-            scrubSecrets(err instanceof Error ? err.message : String(err)),
-          ),
-        );
-    });
-    try {
-      await promotePendingSteeringForTask(id, "Task failed before steering was delivered");
-    } catch (error) {
-      console.error(
-        "[failTask] pending steering promotion error:",
-        scrubSecrets(error instanceof Error ? error.message : String(error)),
-      );
-    }
-
-    // Cascade-fail any non-terminal tasks that depend on this one.
-    // The cascade is recursive (transitive closure) and cycle-safe.
-    try {
-      await cascadeFailDependents(id, "failed");
-    } catch (err) {
-      console.error("[failTask] cascade-fail dependents error:", err);
-    }
-  }
-  return row ? rowToAgentTask(row) : null;
-}
-
-/**
- * Replace result text on an already-terminal task without replaying terminal
- * side effects or moving any lifecycle timestamps. Callers must opt in to
- * this narrow escape hatch; ordinary completion remains first-call-wins.
- */
-export async function overwriteTerminalTaskResultText(
-  id: string,
-  patch: { output?: string; failureReason?: string },
-): Promise<AgentTask | null> {
-  const task = await getTaskById(id);
-  if (!task || !isTerminalTaskStatus(task.status)) return null;
-
-  const output = patch.output !== undefined ? scrubSecrets(patch.output) : (task.output ?? null);
-  const failureReason =
-    patch.failureReason !== undefined
-      ? scrubSecrets(patch.failureReason)
-      : (task.failureReason ?? null);
-  const row = await getDbClient().transaction(async () => {
-    const updated =
-      (await getDbClient().get<AgentTaskRow>(
-        `UPDATE agent_tasks SET output = ?, failureReason = ?
-         WHERE id = ? AND status IN ('completed', 'failed', 'cancelled', 'superseded')
-         RETURNING *`,
-        [output, failureReason, id],
-      )) ?? null;
-    if (updated && patch.output !== undefined) {
-      await reconcileTaskPullRequestAttachments(id, updated.agentId, [
-        updated.output,
-        updated.vcsProvider === "github" ? updated.vcsUrl : null,
-      ]);
-    }
-    return updated;
-  });
-
-  return row ? rowToAgentTask(row) : task;
-}
-
-export async function cancelTask(id: string, reason?: string): Promise<AgentTask | null> {
-  const oldTask = await getTaskById(id);
-  if (!oldTask) return null;
-
-  // Only cancel tasks that are not already in a terminal state
-  if (isTerminalTaskStatus(oldTask.status)) {
-    return null;
-  }
-
-  const finishedAt = new Date().toISOString();
-  const cancelReason = reason ?? "Cancelled by user";
-  // Status predicate re-checks the idempotency guard atomically (a racing
-  // terminal transition can land during the await above).
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks SET status = 'cancelled', failureReason = ?, finishedAt = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded') RETURNING *`,
-    [cancelReason, finishedAt, id],
-  );
-
-  if (row && oldTask) {
-    emitTaskLifecycleTelemetryAfterCommit(
-      "cancelled",
-      {
-        taskId: id,
-        source: oldTask.source,
-        agentId: oldTask.agentId ?? undefined,
-        previousStatus: oldTask.status,
-        durationMs: oldTask.createdAt
-          ? Date.now() - new Date(oldTask.createdAt).getTime()
-          : undefined,
-      },
-      (task) => task?.status === "cancelled",
-    );
-
-    try {
-      await createLogEntry({
-        eventType: "task_status_change",
-        taskId: id,
-        agentId: row.agentId ?? undefined,
-        oldValue: oldTask.status,
-        newValue: "cancelled",
-        metadata: reason ? { reason } : undefined,
-      });
-    } catch {}
-    getDbClient().afterCommit(() => {
-      import("../workflows/event-bus")
-        .then(({ workflowEventBus }) => {
-          workflowEventBus.emit("task.cancelled", {
-            taskId: id,
-            agentId: row.agentId,
-            workflowRunId: row.workflowRunId,
-            workflowRunStepId: row.workflowRunStepId,
-          });
-        })
-        .catch((err) =>
-          console.error(
-            "[db] task.cancelled event not emitted:",
-            scrubSecrets(err instanceof Error ? err.message : String(err)),
-          ),
-        );
-    });
-    try {
-      await promotePendingSteeringForTask(id, "Task was cancelled before steering was delivered");
-    } catch (error) {
-      console.error(
-        "[cancelTask] pending steering promotion error:",
-        scrubSecrets(error instanceof Error ? error.message : String(error)),
-      );
-    }
-
-    try {
-      await cascadeFailDependents(id, "cancelled");
-    } catch (err) {
-      console.error("[cancelTask] cascade-fail dependents error:", err);
-    }
-  }
-
-  return row ? rowToAgentTask(row) : null;
-}
-
-/**
- * Supersede a task: mark it as `superseded` (terminal) so a fresh "resume"
- * follow-up task can pick up where it left off. Used by the graceful-shutdown
- * path and the `POST /api/tasks/:id/supersede` route. Returns null if the task
- * is already terminal (mirrors `completeTask` / `cancelTask` idempotency).
- *
- * Writes a `task_superseded` agent_log with `{ reason, resumeTaskId }` payload
- * and emits a `task.superseded` workflow event. The caller is responsible for
- * creating the resume follow-up (via `createResumeFollowUp`) and passing the
- * resulting id as `resumeTaskId`.
- */
-export async function supersedeTask(
-  id: string,
-  args: { reason: string; resumeTaskId: string | null },
-): Promise<AgentTask | null> {
-  const oldTask = await getTaskById(id);
-  if (!oldTask) return null;
-
-  // Idempotency guard: don't re-supersede a task already in a terminal state.
-  if (isTerminalTaskStatus(oldTask.status)) {
-    return null;
-  }
-
-  const finishedAt = new Date().toISOString();
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks
-       SET status = 'superseded',
-           finishedAt = ?,
-           lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
-       RETURNING *`,
-    [finishedAt, id],
-  );
-
-  if (row && oldTask) {
-    emitTaskLifecycleTelemetryAfterCommit(
-      "superseded",
-      {
-        taskId: id,
-        source: oldTask.source,
-        ...taskContextForTelemetry(oldTask),
-        agentId: row.agentId ?? undefined,
-        reason: args.reason,
-        durationMs: oldTask.createdAt
-          ? Date.now() - new Date(oldTask.createdAt).getTime()
-          : undefined,
-      },
-      (task) => task?.status === "superseded",
-    );
-
-    try {
-      await createLogEntry({
-        eventType: "task_superseded",
-        taskId: id,
-        agentId: row.agentId ?? undefined,
-        oldValue: oldTask.status,
-        newValue: "superseded",
-        metadata: { reason: args.reason, resumeTaskId: args.resumeTaskId },
-      });
-    } catch {}
-    getDbClient().afterCommit(() => {
-      import("../workflows/event-bus")
-        .then(({ workflowEventBus }) => {
-          workflowEventBus.emit("task.superseded", {
-            taskId: id,
-            reason: args.reason,
-            resumeTaskId: args.resumeTaskId,
-            agentId: row.agentId,
-            workflowRunId: row.workflowRunId,
-            workflowRunStepId: row.workflowRunStepId,
-          });
-        })
-        .catch((err) =>
-          console.error(
-            "[db] task.superseded event not emitted:",
-            scrubSecrets(err instanceof Error ? err.message : String(err)),
-          ),
-        );
-    });
-
-    try {
-      await cascadeFailDependents(id, "superseded");
-    } catch (err) {
-      console.error("[supersedeTask] cascade-fail dependents error:", err);
-    }
-  }
-
-  return row ? rowToAgentTask(row) : null;
-}
-
-export async function backfillSupersedeTaskResumeTaskId(
-  taskId: string,
-  resumeTaskId: string,
-): Promise<boolean> {
-  const row = await getDbClient().get<{ id: string; metadata: string | null }>(
-    `SELECT id, metadata
-       FROM agent_log
-       WHERE taskId = ? AND eventType = 'task_superseded'
-       ORDER BY createdAt DESC
-       LIMIT 1`,
-    [taskId],
-  );
-  if (!row) return false;
-
-  let metadata: Record<string, unknown> = {};
-  if (row.metadata) {
-    try {
-      metadata = JSON.parse(row.metadata) as Record<string, unknown>;
-    } catch {
-      metadata = {};
-    }
-  }
-  metadata.resumeTaskId = resumeTaskId;
-
-  const result = await getDbClient().run("UPDATE agent_log SET metadata = ? WHERE id = ?", [
-    JSON.stringify(metadata),
-    row.id,
-  ]);
-  return result.changes > 0;
-}
-
-/**
- * Pause a task that is currently in progress.
- * Used during graceful shutdown to allow tasks to resume after container restart.
- * Unlike failTask, paused tasks retain their agent assignment and can be resumed.
- */
-export async function pauseTask(id: string): Promise<AgentTask | null> {
-  const oldTask = await getTaskById(id);
-  if (!oldTask) return null;
-
-  // Only pause tasks that are in progress
-  if (oldTask.status !== "in_progress") {
-    return null;
-  }
-
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks
-       SET status = 'paused',
-           was_paused = 1,
-           lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? AND status = 'in_progress'
+         updated_by = COALESCE(?, updated_by)
+       WHERE id = ?
        RETURNING *`,
-    [id],
+    [
+      updates.permalink ?? null,
+      updates.finalized ? 1 : 0,
+      now,
+      updates.streamChunksAppended ?? null,
+      updates.conclusionKind ?? null,
+      updates.touchUpdatedAt === false ? 0 : 1,
+      now,
+      updates.actorId ?? null,
+      id,
+    ],
   );
-
-  if (row && oldTask) {
-    try {
-      await createLogEntry({
-        eventType: "task_status_change",
-        taskId: id,
-        agentId: row.agentId ?? undefined,
-        oldValue: oldTask.status,
-        newValue: "paused",
-        metadata: { pausedForShutdown: true },
-      });
-    } catch {}
-  }
-
-  return row ? rowToAgentTask(row) : null;
+  return row ? rowToSlackMessage(row) : null;
 }
 
-/**
- * Resume a paused task - transitions it back to in_progress.
- * Called when worker restarts and picks up paused work.
- */
-export async function resumeTask(taskId: string): Promise<AgentTask | null> {
-  const oldTask = await getTaskById(taskId);
-  if (!oldTask || oldTask.status !== "paused") return null;
-
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks
-       SET status = 'in_progress',
-           was_paused = 1,
-           lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? AND status = 'paused'
+export async function markSlackTreeRendered(
+  id: string,
+  renderedThrough: string,
+): Promise<SlackMessageRecord | null> {
+  const row = await getDbClient().get<SlackMessageRow>(
+    `UPDATE slack_messages SET updated_at = ?
+       WHERE id = ? AND kind = 'tree'
        RETURNING *`,
-    [taskId],
+    [renderedThrough, id],
   );
+  return row ? rowToSlackMessage(row) : null;
+}
 
-  if (row && oldTask) {
-    try {
-      await createLogEntry({
-        eventType: "task_status_change",
-        taskId,
-        agentId: row.agentId ?? undefined,
-        oldValue: "paused",
-        newValue: "in_progress",
-        metadata: { resumed: true },
-      });
-    } catch {}
-  }
+export async function deleteSlackMessageRecord(id: string): Promise<boolean> {
+  const result = await getDbClient().run(`DELETE FROM slack_messages WHERE id = ?`, [id]);
+  return result.changes > 0;
+}
 
-  return row ? rowToAgentTask(row) : null;
+export async function getSlackTreeMessage(contextKey: string): Promise<SlackMessageRecord | null> {
+  const row = await getDbClient().get<SlackMessageRow>(
+    `SELECT * FROM slack_messages WHERE context_key = ? AND kind = 'tree' LIMIT 1`,
+    [contextKey],
+  );
+  return row ? rowToSlackMessage(row) : null;
 }
 
-/**
- * Get paused tasks for a specific agent.
- * Used on startup to resume tasks that were interrupted by deployment.
- * Returns tasks ordered by creation time (oldest first for FIFO).
- */
-export async function getPausedTasksForAgent(agentId: string): Promise<AgentTask[]> {
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT * FROM agent_tasks
-       WHERE agentId = ? AND status = 'paused'
-       ORDER BY createdAt ASC, rowid ASC`,
-    [agentId],
+export async function getSlackTreeMessageByThread(
+  channelId: string,
+  threadTs: string,
+): Promise<SlackMessageRecord | null> {
+  const row = await getDbClient().get<SlackMessageRow>(
+    `SELECT * FROM slack_messages
+       WHERE channel_id = ? AND thread_ts = ? AND kind = 'tree'
+       LIMIT 1`,
+    [channelId, threadTs],
   );
-  return rows.map(rowToAgentTask);
+  return row ? rowToSlackMessage(row) : null;
 }
 
-export async function getOrphanedInProgressTasksForAgent(
-  agentId: string,
-  minAgeSeconds = 60,
-): Promise<AgentTask[]> {
-  const cutoff = new Date(Date.now() - minAgeSeconds * 1000).toISOString();
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `SELECT t.* FROM agent_tasks t
-       LEFT JOIN active_sessions s ON s.taskId = t.id
-       WHERE t.agentId = ?
-         AND t.status = 'in_progress'
-         AND t.claudeSessionId IS NULL
-         AND t.lastUpdatedAt < ?
-         AND s.id IS NULL
-         AND t.finishedAt IS NULL
-       ORDER BY t.createdAt ASC, t.rowid ASC`,
-    [agentId, cutoff],
+export async function getSlackOutcomeMessage(taskId: string): Promise<SlackMessageRecord | null> {
+  const row = await getDbClient().get<SlackMessageRow>(
+    `SELECT * FROM slack_messages WHERE task_id = ? AND kind = 'outcome' LIMIT 1`,
+    [taskId],
   );
-  return rows.map(rowToAgentTask);
+  return row ? rowToSlackMessage(row) : null;
 }
 
-export async function resetOrphanedInProgressTasksForAgent(
-  agentId: string,
-  minAgeSeconds = 60,
-): Promise<AgentTask[]> {
-  const cutoff = new Date(Date.now() - minAgeSeconds * 1000).toISOString();
-  const rows = await getDbClient().query<AgentTaskRow>(
-    `UPDATE agent_tasks
-       SET status = 'pending',
-           lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id IN (
-         SELECT t.id FROM agent_tasks t
-         LEFT JOIN active_sessions s ON s.taskId = t.id
-         WHERE t.agentId = ?
-           AND t.status = 'in_progress'
-           AND t.claudeSessionId IS NULL
-           AND t.lastUpdatedAt < ?
-           AND s.id IS NULL
-           AND t.finishedAt IS NULL
+export async function getSlackTreeMessages(): Promise<SlackMessageRecord[]> {
+  const rows = await getDbClient().query<SlackMessageRow>(
+    `SELECT tree.*
+       FROM slack_messages tree
+       JOIN slack_render_v2_state state ON state.id = 1
+       WHERE tree.kind = 'tree'
+       AND (
+         (tree.ts LIKE 'pending:%' AND tree.created_at >= state.activated_at)
+         OR EXISTS (
+           SELECT 1 FROM agent_tasks task
+           WHERE task.slackChannelId = tree.channel_id
+           AND task.slackThreadTs = tree.thread_ts
+           AND task.source = 'slack'
+           AND task.createdAt >= state.activated_at
+           AND task.status IN ('completed', 'failed', 'cancelled')
+           AND NOT EXISTS (
+             SELECT 1 FROM slack_messages outcome
+             WHERE outcome.kind = 'outcome'
+             AND outcome.task_id = task.id
+             AND outcome.finalized_at IS NOT NULL
+           )
+         )
+         OR
+         EXISTS (
+           SELECT 1 FROM agent_tasks task
+           WHERE task.slackChannelId = tree.channel_id
+           AND task.slackThreadTs = tree.thread_ts
+           AND task.createdAt >= state.activated_at
+           AND task.status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
+         )
+         OR EXISTS (
+           SELECT 1 FROM agent_tasks task
+           WHERE task.slackChannelId = tree.channel_id
+           AND task.slackThreadTs = tree.thread_ts
+           AND task.createdAt >= state.activated_at
+           AND task.lastUpdatedAt > tree.updated_at
+         )
+         OR EXISTS (
+           SELECT 1 FROM slack_messages outcome
+           JOIN agent_tasks task ON task.id = outcome.task_id
+           WHERE outcome.kind = 'outcome'
+           AND outcome.channel_id = tree.channel_id
+           AND outcome.thread_ts = tree.thread_ts
+           AND task.createdAt >= state.activated_at
+           AND (
+             outcome.finalized_at IS NULL
+             OR outcome.updated_at > tree.updated_at
+           )
+         )
        )
-       RETURNING *`,
-    [agentId, cutoff],
+       ORDER BY tree.created_at ASC`,
   );
+  return rows.map(rowToSlackMessage);
+}
 
-  for (const row of rows) {
-    try {
-      await createLogEntry({
-        eventType: "task_status_change",
-        taskId: row.id,
-        agentId,
-        oldValue: "in_progress",
-        newValue: "pending",
-        metadata: { orphanedInProgressRecovery: true },
-      });
-    } catch {}
-  }
-
-  return rows.map(rowToAgentTask);
+export async function getSlackMessageByChannelTs(
+  channelId: string,
+  ts: string,
+): Promise<SlackMessageRecord | null> {
+  const row = await getDbClient().get<SlackMessageRow>(
+    `SELECT * FROM slack_messages WHERE channel_id = ? AND ts = ? LIMIT 1`,
+    [channelId, ts],
+  );
+  return row ? rowToSlackMessage(row) : null;
 }
 
-/**
- * Get recently cancelled tasks for an agent.
- * Used by hooks to detect task cancellation and stop the worker loop.
- * Returns tasks cancelled within the last 5 minutes.
- */
-export async function getRecentlyCancelledTasksForAgent(agentId: string): Promise<AgentTask[]> {
-  const fiveMinutesAgo = new Date(Date.now() - 5 * 60 * 1000).toISOString();
+export async function getSlackTasksInThread(
+  channelId: string,
+  threadTs: string,
+): Promise<AgentTask[]> {
   const rows = await getDbClient().query<AgentTaskRow>(
     `SELECT * FROM agent_tasks
-       WHERE agentId = ?
-       AND status = 'cancelled'
-       AND finishedAt > ?
-       ORDER BY finishedAt DESC`,
-    [agentId, fiveMinutesAgo],
+       WHERE slackChannelId = ? AND slackThreadTs = ?
+       ORDER BY createdAt ASC, rowid ASC`,
+    [channelId, threadTs],
   );
   return rows.map(rowToAgentTask);
 }
 
-export async function deleteTask(id: string): Promise<boolean> {
-  const result = await getDbClient().run("DELETE FROM agent_tasks WHERE id = ?", [id]);
-  return result.changes > 0;
+export async function markTaskSlackReplySent(taskId: string): Promise<void> {
+  await getDbClient().run(`UPDATE agent_tasks SET slackReplySent = 1 WHERE id = ?`, [taskId]);
 }
 
-export async function updateTaskProgress(id: string, progress: string): Promise<AgentTask | null> {
-  const scrubbedProgress = scrubSecrets(progress);
-  const row = await getDbClient().get<AgentTaskRow>(
-    `UPDATE agent_tasks SET progress = ?,
-       status = CASE WHEN status IN ('completed', 'failed', 'cancelled', 'superseded') THEN status ELSE 'in_progress' END,
-       lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? RETURNING *`,
-    [scrubbedProgress, id],
-  );
-  if (row) {
-    try {
-      await createLogEntry({
-        eventType: "task_progress",
-        taskId: id,
-        agentId: row.agentId ?? undefined,
-        newValue: scrubbedProgress,
-      });
-    } catch {}
-    getDbClient().afterCommit(() => {
-      import("../workflows/event-bus")
-        .then(({ workflowEventBus }) => {
-          workflowEventBus.emit("task.progress", {
-            taskId: id,
-            progress: scrubbedProgress,
-            agentId: row.agentId,
-          });
-        })
-        .catch((err) =>
-          console.error(
-            "[db] task.progress event not emitted:",
-            scrubSecrets(err instanceof Error ? err.message : String(err)),
-          ),
-        );
-    });
+export async function setSlackMessageTracking(
+  taskId: string,
+  fields: {
+    slackProgressMessageTs?: string | null;
+    slackTreeRootMessageTs?: string | null;
+  },
+): Promise<void> {
+  const sets: string[] = [];
+  const args: (string | null)[] = [];
+
+  if (Object.hasOwn(fields, "slackProgressMessageTs")) {
+    sets.push("slackProgressMessageTs = ?");
+    args.push(fields.slackProgressMessageTs ?? null);
+  }
+  if (Object.hasOwn(fields, "slackTreeRootMessageTs")) {
+    sets.push("slackTreeRootMessageTs = ?");
+    args.push(fields.slackTreeRootMessageTs ?? null);
   }
+  if (sets.length === 0) return;
+
+  args.push(taskId);
+  await getDbClient().run(`UPDATE agent_tasks SET ${sets.join(", ")} WHERE id = ?`, args);
+}
+
+export async function updateTaskVcs(
+  taskId: string,
+  vcs: {
+    vcsProvider: "github" | "gitlab";
+    vcsRepo: string;
+    vcsNumber: number;
+    vcsUrl: string;
+  },
+): Promise<AgentTask | null> {
+  const row = await getDbClient().transaction(async () => {
+    const updated = await getDbClient().get<AgentTaskRow>(
+      `UPDATE agent_tasks
+       SET vcsProvider = ?, vcsRepo = ?, vcsNumber = ?, vcsUrl = ?, lastUpdatedAt = ?
+       WHERE id = ? RETURNING *`,
+      [vcs.vcsProvider, vcs.vcsRepo, vcs.vcsNumber, vcs.vcsUrl, new Date().toISOString(), taskId],
+    );
+    if (updated) {
+      await reconcileTaskPullRequestAttachments(taskId, updated.agentId, [
+        updated.output,
+        vcs.vcsProvider === "github" ? vcs.vcsUrl : null,
+      ]);
+    }
+    return updated;
+  });
   return row ? rowToAgentTask(row) : null;
 }
 
@@ -5709,6 +2813,18 @@ export async function promoteDraftTask(taskId: string): Promise<AgentTask | null
   return row ? rowToAgentTask(row) : null;
 }
 
+/**
+ * Mark a draft as still being worked on, so `promoteAbandonedDraftTasks`
+ * (which goes by `lastUpdatedAt`) doesn't promote it while an upload batch
+ * that outlasts the sweep window is still running. No-op once promoted.
+ */
+export async function refreshDraftTaskLease(taskId: string): Promise<void> {
+  await getDbClient().run(
+    "UPDATE agent_tasks SET lastUpdatedAt = ? WHERE id = ? AND status = 'draft'",
+    [new Date().toISOString(), taskId],
+  );
+}
+
 /**
  * Heartbeat sweep: promote drafts abandoned mid-upload (tab closed, network
  * dropped) instead of leaving them permanently dispatch-ineligible — the
@@ -6040,6 +3156,12 @@ export async function updateAgentProfile(
     avatar?: AgentAvatar | null;
   },
   meta?: VersionMeta,
+  guard?: {
+    /** Per-field compare-and-set token; see {@link ProfileExpectedHashes}. */
+    expectedHashes?: ProfileExpectedHashes;
+    /** Called once per field dropped because its expected hash was stale. */
+    onConflict?: (conflict: ProfileSyncConflict) => void;
+  },
 ): Promise<Agent | null> {
   return await getDbClient().transaction(async (tx) => {
     // Get current agent state for version comparison
@@ -6078,8 +3200,39 @@ export async function updateAgentProfile(
       }
     }
 
+    // Compare-and-set. A writer that edits a copy of a field (a session's
+    // materialized CLAUDE.md) sends the hash that copy was based on. If the DB
+    // moved since — a sibling session's sync, an `update-profile` — the copy is
+    // stale and writing it would revert the newer value, so the field is dropped
+    // (no version, no column write). An edit on top of the current value applies,
+    // including a deliberate revert to an earlier version. Without a token the
+    // write is unconditional, as before.
+    //
+    // Runs BEFORE the budget check: a stale copy of an older, longer value must be
+    // dropped, not rejected — a budget rejection throws and would also roll back
+    // the other fields of the same update.
+    const writable = { ...updates };
+    for (const field of VERSIONABLE_FIELDS) {
+      const expectedHash = guard?.expectedHashes?.[field];
+      if (expectedHash === undefined) continue;
+      if (writable[field] === undefined || writable[field] === null) continue;
+
+      const currentHash = computeContentHash(current[field] ?? "");
+      if (currentHash === expectedHash) continue;
+
+      console.warn(
+        `[profile-sync] agent ${id}: ${field} dropped — based on ${expectedHash.slice(0, 12)}, DB is at ${currentHash.slice(0, 12)}`,
+      );
+      delete writable[field];
+      guard?.onConflict?.({ field, expectedHash, currentHash });
+    }
+
+    if (writable.heartbeatMd !== undefined) {
+      validateHeartbeatExpiry(current.heartbeatMd ?? "", writable.heartbeatMd);
+    }
+
     for (const field of BUDGETED_IDENTITY_FIELDS) {
-      const nextValue = updates[field];
+      const nextValue = writable[field];
       if (nextValue === undefined) continue;
 
       const result = checkIdentityFieldBudget({
@@ -6104,9 +3257,9 @@ export async function updateAgentProfile(
       if (existingAgent) throw new Error("Agent name already exists");
     }
 
-    // Create context versions for changed fields
+    // Create context versions for changed fields (stale copies already dropped)
     for (const field of VERSIONABLE_FIELDS) {
-      const newValue = updates[field];
+      const newValue = writable[field];
       if (newValue === undefined || newValue === null) continue;
 
       const currentValue = current[field] ?? "";
@@ -6163,12 +3316,12 @@ export async function updateAgentProfile(
         updates.description ?? null,
         updates.role ?? null,
         updates.capabilities ? JSON.stringify(updates.capabilities) : null,
-        updates.claudeMd ?? null,
-        updates.soulMd ?? null,
-        updates.identityMd ?? null,
-        updates.setupScript ?? null,
-        updates.toolsMd ?? null,
-        updates.heartbeatMd ?? null,
+        writable.claudeMd ?? null,
+        writable.soulMd ?? null,
+        writable.identityMd ?? null,
+        writable.setupScript ?? null,
+        writable.toolsMd ?? null,
+        writable.heartbeatMd ?? null,
         avatarProvided ? 1 : 0,
         avatarJson,
         now,
@@ -8188,6 +5341,7 @@ type ScheduledTaskRow = {
   lastRunAt: string | null;
   nextRunAt: string | null;
   createdByAgentId: string | null;
+  parentTaskId: string | null;
   timezone: string;
   consecutiveErrors: number | null;
   lastErrorAt: string | null;
@@ -8214,9 +5368,6 @@ type ScheduledTaskRow = {
 // while keeping list payloads small.
 /** Preview length for a schedule's `taskTemplate`. */
 const SCHEDULE_TEMPLATE_PREVIEW_LENGTH = 280;
-/** Preview length for a task's `task` text (pool-triage needs to read it). */
-const TASK_PREVIEW_LENGTH = 300;
-
 /** Truncate text for a list-row preview. Appends an ellipsis when clipped. */
 function previewText(text: string | null | undefined, maxChars: number): string {
   const s = text ?? "";
@@ -8240,6 +5391,7 @@ function rowToScheduledTask(row: ScheduledTaskRow): ScheduledTask {
     lastRunAt: normalizeDate(row.lastRunAt) ?? undefined,
     nextRunAt: normalizeDate(row.nextRunAt) ?? undefined,
     createdByAgentId: row.createdByAgentId ?? undefined,
+    parentTaskId: row.parentTaskId ?? undefined,
     timezone: row.timezone,
     consecutiveErrors: row.consecutiveErrors ?? 0,
     lastErrorAt: normalizeDate(row.lastErrorAt) ?? undefined,
@@ -8389,6 +5541,8 @@ export interface CreateScheduledTaskData {
   enabled?: boolean;
   nextRunAt?: string;
   createdByAgentId?: string;
+  /** Only `defer-task` sets this — the task the schedule's run continues. */
+  parentTaskId?: string;
   timezone?: string;
   model?: string;
   modelTier?: ModelTier;
@@ -8411,11 +5565,11 @@ export async function createScheduledTask(data: CreateScheduledTaskData): Promis
     `INSERT INTO scheduled_tasks (
         id, "key", name, description, cronExpression, intervalMs, taskTemplate,
         taskType, tags, priority, targetAgentId, enabled, nextRunAt,
-        createdByAgentId, timezone, model, modelTier, scheduleType, targetType,
-        workflowId, scriptName, scriptArgs, params, requiredParams, requires,
+        createdByAgentId, parentTaskId, timezone, model, modelTier, scheduleType,
+        targetType, workflowId, scriptName, scriptArgs, params, requiredParams, requires,
         createdAt, lastUpdatedAt,
         created_by, updated_by
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
     [
       id,
       normalizeAssetKey(data.key ?? defaultAssetKey("schedule", id)),
@@ -8431,6 +5585,7 @@ export async function createScheduledTask(data: CreateScheduledTaskData): Promis
       data.enabled !== false ? 1 : 0,
       data.nextRunAt ?? null,
       data.createdByAgentId ?? null,
+      data.parentTaskId ?? null,
       data.timezone ?? "UTC",
       data.model ?? null,
       data.modelTier ?? null,
@@ -8867,7 +6022,7 @@ export async function getInjectableGlobalConfigs(): Promise<SwarmConfig[]> {
   const rows = await getDbClient().query<SwarmConfigRow>(
     `SELECT * FROM swarm_config
        WHERE scope = 'global'
-         AND UPPER(key) NOT IN ('API_KEY', 'SECRETS_ENCRYPTION_KEY')
+         AND UPPER(key) NOT IN ('API_KEY', 'SECRETS_ENCRYPTION_KEY', 'CORS_ALLOW_ANY_ORIGIN')
        ORDER BY key ASC`,
   );
   return rows.map(rowToSwarmConfig);