@humwick/server 0.130.0 → 0.130.1

package/src/db/timer-operator-write-ops.ts

@@ -39,14 +39,17 @@ import {
 export const TIMER_OPERATOR_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
   // --- Dedup-by-construction: idempotent, no key required. ------------------------------------------
   "timerOperator.acceptCommand": {
+    offLoop: true,
     idempotent: true,
     fn: (args: AcceptAuditedCommandArgs, ctx: WriterOpContext) => acceptAuditedCommandBody(args, ctx.now),
   },
   "timerOperator.ensureOperation": {
+    offLoop: true,
     idempotent: true,
     fn: (args: Omit<EnsureOperationArgs, "now">, ctx: WriterOpContext) => ensureOperationBody({ ...args, now: ctx.now }),
   },
   "timerOperator.resetTerminal": {
+    offLoop: true,
     // An occupied terminal slot deletes a row; replaying its body with `acceptAlreadyCleared: false`
     // throws. The facade therefore supplies a durable request-scoped key for retry replay.
     idempotent: false,
@@ -54,48 +57,59 @@ export const TIMER_OPERATOR_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> =
       resetTerminalOperationBody(args.requestId, args.acceptAlreadyCleared),
   },
   "timerOperator.finishAbort": {
+    offLoop: true,
     idempotent: true,
     fn: (_args: Record<string, never> | undefined, ctx: WriterOpContext) => finishAbortBody(ctx.now),
   },
   "timerOperator.pinTransferLeg": {
+    offLoop: true,
     idempotent: true,
     fn: (args: Omit<PinTransferLegArgs, "now">, ctx: WriterOpContext) => pinTransferLegBody({ ...args, now: ctx.now }),
   },
   "timerOperator.finishTransfer": {
+    offLoop: true,
     idempotent: true,
     fn: (args: Omit<FinishTransferArgs, "now">, ctx: WriterOpContext) => finishTransferBody({ ...args, now: ctx.now }),
   },
 
   // --- No in-body dedup guard: idempotent false, facade supplies a per-call key. --------------------
   "timerOperator.claimOperation": {
+    offLoop: true,
     idempotent: false,
     fn: (args: Omit<ClaimOperationArgs, "now">, ctx: WriterOpContext) => claimOperationBody({ ...args, now: ctx.now }),
   },
   "timerOperator.commitBackfillBatch": {
+    offLoop: true,
     idempotent: false,
     fn: (args: Omit<CommitBackfillBatchArgs, "at">, ctx: WriterOpContext) => commitBackfillBatchBody({ ...args, at: ctx.now }),
   },
   "timerOperator.epochRebase": {
+    offLoop: true,
     idempotent: false,
     fn: (args: Omit<EpochRebaseArgs, "at">, ctx: WriterOpContext) => epochRebaseBody({ ...args, at: ctx.now }),
   },
   "timerOperator.commitBootstrapBatch": {
+    offLoop: true,
     idempotent: false,
     fn: (args: Omit<CommitBootstrapBatchArgs, "at">, ctx: WriterOpContext) => commitBootstrapBatchBody({ ...args, at: ctx.now }),
   },
   "timerOperator.completeStage9": {
+    offLoop: true,
     idempotent: false,
     fn: (args: Omit<CompleteStage9Args, "at">, ctx: WriterOpContext) => completeStage9Body({ ...args, at: ctx.now }),
   },
   "timerOperator.beginAbort": {
+    offLoop: true,
     idempotent: false,
     fn: (args: Omit<BeginAbortArgs, "now">, ctx: WriterOpContext) => beginAbortBody({ ...args, now: ctx.now }),
   },
   "timerOperator.recordG1Transfer": {
+    offLoop: true,
     idempotent: false,
     fn: (args: Omit<RecordG1TransferArgs, "now">, ctx: WriterOpContext) => recordG1TransferBody({ ...args, now: ctx.now }),
   },
   "timerOperator.commitTransferBatch": {
+    offLoop: true,
     idempotent: false,
     fn: (args: Omit<CommitTransferBatchArgs, "at">, ctx: WriterOpContext) => commitTransferBatchBody({ ...args, at: ctx.now }),
   },

package/src/db/timer-transfer-write-ops.ts

@@ -21,18 +21,22 @@ function withNow(args: TransferArgs, ctx: WriterOpContext): TimerMessageTransfer
  * the same durable journal row or is refused; it cannot move ownership twice. */
 export const TIMER_TRANSFER_WRITE_OPS = {
   "timers.transfer.prepareForward": {
+    offLoop: true,
     idempotent: true,
     fn: (args: TransferArgs, ctx: WriterOpContext) => prepareForwardTimerMessageTransfer(withNow(args, ctx)),
   },
   "timers.transfer.prepareReverse": {
+    offLoop: true,
     idempotent: true,
     fn: (args: TransferArgs, ctx: WriterOpContext) => prepareReverseTimerMessageTransfer(withNow(args, ctx)),
   },
   "timers.transfer.commitForward": {
+    offLoop: true,
     idempotent: true,
     fn: (args: TransferArgs, ctx: WriterOpContext) => commitForwardTimerMessageTransfer(withNow(args, ctx)),
   },
   "timers.transfer.commitReverse": {
+    offLoop: true,
     idempotent: true,
     fn: (args: TransferArgs, ctx: WriterOpContext) => commitReverseTimerMessageTransfer(withNow(args, ctx)),
   },

package/src/db/timer-write-ops.ts

@@ -136,6 +136,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
    * `row.id` as that key: it is unique per logical create by construction and stable across a retry.
    */
   "timers.create": {
+    offLoop: true,
     idempotent: false,
     fn: (args: CreateTimerOpArgs, ctx: WriterOpContext) =>
       insertScheduledTimerWithinQuota(args.row, args.caps, ctx.now, QUOTA_FAULTS, args.route ?? "direct"),
@@ -143,6 +144,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
 
   /** CAS claim of a due timer. Re-applying either re-wins the same lease or returns null — idempotent. */
   "timers.claim": {
+    offLoop: true,
     idempotent: true,
     fn: (args: ClaimTimerOpArgs, ctx: WriterOpContext) =>
       claimScheduledTimer(args.id, args.owner, args.now ?? ctx.now, args.leaseMs),
@@ -155,6 +157,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
    * matching replay writes the identical row.
    */
   "timers.completeRun": {
+    offLoop: true,
     idempotent: true,
     fn: (args: CompleteTimerRunOpArgs, ctx: WriterOpContext) =>
       completeScheduledTimerRun({ timer: args.timer, messageId: args.messageId, now: args.now ?? ctx.now }),
@@ -162,6 +165,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
 
   /** Same claim-predicate shape as `completeRun`, so a replay is a no-op — idempotent. */
   "timers.recordFailure": {
+    offLoop: true,
     idempotent: true,
     fn: (args: RecordTimerFailureOpArgs, ctx: WriterOpContext) =>
       recordScheduledTimerFailure({
@@ -175,6 +179,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
 
   /** `WHERE enabled = 1` makes the second cancel a no-op that returns the same row — idempotent. */
   "timers.cancel": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { id: string; route?: TimerMessageMutationRoute }) =>
       cancelScheduledTimer(args.id, args.route ?? "direct"),
@@ -182,6 +187,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
 
   /** Unconditional UPDATE to a fixed end state — re-applying reaches the same state. */
   "timers.disable": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { id: string; reason: string }) => disableScheduledTimer(args.id, args.reason),
   },
@@ -189,6 +195,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
   /** UPDATE to a caller-supplied absolute `nextRunAt` — replaying writes the same instant, so it is
    *  the same end state. Idempotent. */
   "timers.deferRun": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { id: string; nextRunAt: number }) => deferScheduledTimerRun(args.id, args.nextRunAt),
   },
@@ -196,6 +203,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
   /** Read-modify-write of the command JSON, folded into the op. Writing the same commandId twice is
    *  the same end state — idempotent. */
   "timers.setCommandId": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { timerId: string; commandId: string }) => setScheduledTimerCommandId(args.timerId, args.commandId),
   },
@@ -203,6 +211,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
   /** Read-modify-write merge of a command patch, folded into the op. Re-merging the same patch onto
    *  the already-merged row is the same end state — idempotent. */
   "timers.updateCommand": {
+    offLoop: true,
     idempotent: true,
     fn: (args: UpdateTimerCommandOpArgs) => updateScheduledTimerCommand(args.timerId, args.patch),
   },
@@ -214,6 +223,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
    * decide the same run twice.
    */
   "timers.decideFire": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { input: Omit<DecideLegacyTimerMessageFireInput, "now">; now?: number }, ctx: WriterOpContext) =>
       decideLegacyTimerMessageFire({ ...args.input, now: args.now ?? ctx.now }, FIRE_DECISION_FAULTS),
@@ -221,6 +231,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
 
   /** Returns `already-sent` on replay rather than re-marking — idempotent. */
   "timers.markFireSent": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { timerId: string; run: number; messageId: number }, ctx: WriterOpContext) =>
       markTimerMessageFireSent(args.timerId, args.run, args.messageId, ctx.now),
@@ -232,6 +243,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
    * therefore requires a key; the facade passes one derived from the failing attempt.
    */
   "timers.recordFireSendFailure": {
+    offLoop: true,
     idempotent: false,
     fn: (args: RecordFireSendFailureOpArgs, ctx: WriterOpContext) =>
       recordTimerMessageFireSendFailure({
@@ -246,6 +258,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
 
   /** DELETE of a transient failure record — re-applying deletes nothing. Idempotent. */
   "timers.clearFireSendFailure": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { timerId: string; run: number }) => {
       clearTimerMessageFireSendFailure(args.timerId, args.run);
@@ -255,6 +268,7 @@ export const TIMER_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
 
   /** Monotone fence advance (`applied_fence < fence` guard) — re-applying is a no-op. Idempotent. */
   "timers.markAuthorityApplied": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { timerId: string; fence: number }, ctx: WriterOpContext) => {
       markLegacyMessageAuthorityApplied(args.timerId, args.fence, ctx.now);

package/src/db/token-db-write-ops.ts

@@ -67,12 +67,14 @@ function stripHandoffToken(result: unknown): unknown {
 export const TOKEN_DB_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
   // Non-idempotent (mints a new row each apply); the facade supplies `jti` as the ledger key.
   "tokens.create": {
+    offLoop: true,
     idempotent: false,
     fn: (args: CreateTokenOpArgs, ctx: WriterOpContext) => createTokenInternal(args.input, args.jti, ctx.now),
     serializeIdempotencyResult: stripCreateToken,
   },
   // Non-idempotent (mints and links a successor); folds the eligibility read (ADR §3.4).
   "tokens.handoff": {
+    offLoop: true,
     idempotent: false,
     fn: (args: HandoffTokenOpArgs, ctx: WriterOpContext) => handoffTokenInternal(args.input, args.newJti, ctx.now),
     serializeIdempotencyResult: stripHandoffToken,
@@ -80,11 +82,13 @@ export const TOKEN_DB_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object
   // Idempotent by construction (the `revoked_at IS NULL` guard makes a re-apply a no-op). No key, no
   // secret in the boolean result.
   "tokens.revoke": {
+    offLoop: true,
     idempotent: true,
     fn: (args: RevokeTokenOpArgs, ctx: WriterOpContext) => revokeTokenInternal(args.jti, args.reason, ctx.now),
   },
   // Idempotent (deleting an already-reaped row is a no-op). Returns pruned jtis — not secret.
   "tokens.pruneExpired": {
+    offLoop: true,
     idempotent: true,
     fn: (args: PruneExpiredTokensOpArgs, ctx: WriterOpContext) =>
       pruneExpiredTokenRecordsInternal(args.input, ctx.now),

package/src/db/user-settings-write-ops.ts

@@ -36,6 +36,7 @@ export const USER_SETTINGS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = O
   },
   // Idempotent by construction: deleting again finds no row (`existing` null → early false).
   "userSettings.delete": {
+    offLoop: true,
     idempotent: true,
     fn: (args: DeleteUserSettingOpArgs) => deleteUserSetting(getDb(), args.userId, args.namespace, args.key),
   },

package/src/db/vault-backup.ts

@@ -54,6 +54,6 @@ export function syncVaultBackupWarning(args: { kind: VaultBackupWarning | null;
 }
 
 export const VAULT_BACKUP_WRITE_OPS = {
-  "secretsVault.backup.record": { idempotent: true, fn: recordVaultBackup },
-  "secretsVault.backup.warn": { idempotent: true, fn: syncVaultBackupWarning },
+  "secretsVault.backup.record": { offLoop: true, idempotent: true, fn: recordVaultBackup },
+  "secretsVault.backup.warn": { offLoop: true, idempotent: true, fn: syncVaultBackupWarning },
 };

package/src/db/vault-expiry.ts

@@ -66,6 +66,6 @@ export function prepareVaultExpiryNotices(args: { now: number }) {
 }
 
 export const VAULT_EXPIRY_WRITE_OPS = {
-  "secretsVault.expiry.prepare": { idempotent: true, fn: prepareVaultExpiryNotices },
-  "secretsVault.expiry.sent": { idempotent: true, fn: (args: { id: number }) => { getDb().query("UPDATE vault_expiry_notices SET notified=1 WHERE decision_id=?").run(args.id); } },
+  "secretsVault.expiry.prepare": { offLoop: true, idempotent: true, fn: prepareVaultExpiryNotices },
+  "secretsVault.expiry.sent": { offLoop: true, idempotent: true, fn: (args: { id: number }) => { getDb().query("UPDATE vault_expiry_notices SET notified=1 WHERE decision_id=?").run(args.id); } },
 };

package/src/db/vault-health.ts

@@ -85,9 +85,9 @@ export function logPage(args: { profile?: string; before?: { at: number; id: num
 }
 
 export const VAULT_HEALTH_WRITE_OPS: Record<string, WriterOpSpec> = {
-  "vaultHealth.host": { idempotent: true, fn: (host: ServiceAccessHostHealth, ctx: WriterOpContext) => { writeState("host", host, ctx.now); return null; } },
-  "vaultHealth.collect": { idempotent: true, fn: (input: VaultLogCollect, ctx: WriterOpContext) => collectVaultLogs(input, ctx.now) },
-  "vaultHealth.prune": { idempotent: true, fn: (args: { now: number }) => pruneVaultLogs(args.now) },
+  "vaultHealth.host": { offLoop: true, idempotent: true, fn: (host: ServiceAccessHostHealth, ctx: WriterOpContext) => { writeState("host", host, ctx.now); return null; } },
+  "vaultHealth.collect": { offLoop: true, idempotent: true, fn: (input: VaultLogCollect, ctx: WriterOpContext) => collectVaultLogs(input, ctx.now) },
+  "vaultHealth.prune": { offLoop: true, idempotent: true, fn: (args: { now: number }) => pruneVaultLogs(args.now) },
 };
 
 export const VAULT_HEALTH_READ_OPS = {

package/src/db/vault-token-ops.ts

@@ -3,12 +3,12 @@ import { settleVaultToken, revokeVaultTokens, recordOrphanVaultToken, pruneVault
 import type { WriterOpContext, WriterOpSpec } from "./write-ops";
 
 export const VAULT_TOKEN_WRITE_OPS: Record<string, WriterOpSpec> = {
-  "vaultTokens.orphan": { idempotent: true, fn: (row: VaultTokenRow) => recordOrphanVaultToken(row) },
-  "vaultTokens.prune": { idempotent: true, fn: (args: { now: number }) => pruneVaultTokens(args.now) },
-  "vaultTokens.begin": { idempotent: false, fn: (row: VaultTokenRow) => beginVaultToken(row) },
-  "vaultTokens.activate": { idempotent: true, fn: (args: { id: string; sessionId: string; expiresAt: number }, ctx: WriterOpContext) => activateVaultToken(args.id, args.sessionId, args.expiresAt, ctx.now) },
-  "vaultTokens.renew": { idempotent: true, fn: (args: { id: string; sessionId: string; expiresAt: number }, ctx: WriterOpContext) => renewVaultToken(args.id, args.sessionId, args.expiresAt, ctx.now) },
-  "vaultTokens.check": { idempotent: true, fn: (args: { id: string; now: number }) => checkVaultToken(args.id, args.now) ?? null },
-  "vaultTokens.settle": { idempotent: false, fn: (args: { id: string; error?: string }, ctx: WriterOpContext) => { settleVaultToken(args.id, ctx.now, args.error); return null; } },
-  "vaultTokens.revoke": { idempotent: true, fn: (args: { agentId: string; instanceId: string; spawnRequestId: string; launchId: string }, ctx: WriterOpContext) => { revokeVaultTokens(args.agentId, ctx.now, "runner_release", args.instanceId, args.spawnRequestId, args.launchId); return null; } },
+  "vaultTokens.orphan": { offLoop: true, idempotent: true, fn: (row: VaultTokenRow) => recordOrphanVaultToken(row) },
+  "vaultTokens.prune": { offLoop: true, idempotent: true, fn: (args: { now: number }) => pruneVaultTokens(args.now) },
+  "vaultTokens.begin": { offLoop: true, idempotent: false, fn: (row: VaultTokenRow) => beginVaultToken(row) },
+  "vaultTokens.activate": { offLoop: true, idempotent: true, fn: (args: { id: string; sessionId: string; expiresAt: number }, ctx: WriterOpContext) => activateVaultToken(args.id, args.sessionId, args.expiresAt, ctx.now) },
+  "vaultTokens.renew": { offLoop: true, idempotent: true, fn: (args: { id: string; sessionId: string; expiresAt: number }, ctx: WriterOpContext) => renewVaultToken(args.id, args.sessionId, args.expiresAt, ctx.now) },
+  "vaultTokens.check": { offLoop: true, idempotent: true, fn: (args: { id: string; now: number }) => checkVaultToken(args.id, args.now) ?? null },
+  "vaultTokens.settle": { offLoop: true, idempotent: false, fn: (args: { id: string; error?: string }, ctx: WriterOpContext) => { settleVaultToken(args.id, ctx.now, args.error); return null; } },
+  "vaultTokens.revoke": { offLoop: true, idempotent: true, fn: (args: { agentId: string; instanceId: string; spawnRequestId: string; launchId: string }, ctx: WriterOpContext) => { revokeVaultTokens(args.agentId, ctx.now, "runner_release", args.instanceId, args.spawnRequestId, args.launchId); return null; } },
 };

package/src/db/web-tool-call-ops.ts

@@ -9,7 +9,7 @@ export const WEB_TOOL_CALL_READ_OPS = {
 };
 
 export const WEB_TOOL_CALL_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = {
-  "webSearch.reserveBrave": { idempotent: false, fn: (args: { month: string }) => reserveBraveSearch(args.month) },
-  "webToolCalls.record": { idempotent: true, fn: (call: WebToolCall) => { recordWebToolCall(call); return null; } },
-  "webToolCalls.prune": { idempotent: true, fn: (args: { before: number }) => pruneWebToolCalls(args.before) },
+  "webSearch.reserveBrave": { offLoop: true, idempotent: false, fn: (args: { month: string }) => reserveBraveSearch(args.month) },
+  "webToolCalls.record": { offLoop: true, idempotent: true, fn: (call: WebToolCall) => { recordWebToolCall(call); return null; } },
+  "webToolCalls.prune": { offLoop: true, idempotent: true, fn: (args: { before: number }) => pruneWebToolCalls(args.before) },
 };

package/src/db/write-ops.ts

@@ -260,6 +260,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // Delete all probe rows — a test reset. Deleting again reaches the same end state, so re-applying is
   // safe: idempotent, no key required.
   "seam.reset": {
+    offLoop: true,
     idempotent: true,
     fn: () => {
       const before = (getDb().query("SELECT COUNT(*) AS n FROM _writer_seam_probe").get() as { n: number }).n;
@@ -286,6 +287,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // must NOT enter the retry ledger — the retry re-evaluates fresh and can succeed once the blocker
   // clears — while an applied outcome dedups exactly-once as usual.
   "seam.claimLike": {
+    offLoop: true,
     idempotent: false,
     fn: (args: { tag: string; refuse?: boolean }, ctx) => {
       if (args.refuse) return { applied: false };
@@ -301,6 +303,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // single transaction (or savepoint), the first insert MUST roll back — the atomic-multi-statement
   // proof across the boundary (§3.4). Inserts rows — NON-idempotent, key required.
   "seam.txPair": {
+    offLoop: true,
     idempotent: false,
     fn: (args: { a: string; b: string; failSecond?: boolean }, ctx) => {
       const first = getDb()
@@ -318,6 +321,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // the main thread as a real `ValidationError` (instanceof true), not a bare `Error`. No state change,
   // so re-applying is safe: idempotent, no key required.
   "seam.throwValidation": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { message?: string }) => {
       throw new ValidationError(args.message ?? "seam.throwValidation");
@@ -327,6 +331,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // Insert-once keyed by `idem_key` in its OWN args — dedups by construction (`ON CONFLICT DO
   // NOTHING`), so it is idempotent and needs no gateway key.
   "seam.idempotent": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { key: string; value?: string }, ctx) => {
       const inserted = getDb()
@@ -347,6 +352,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // marshaling seam (H1) clones args before the op and clones the result after, so the caller's object
   // is NEVER mutated and the caller sees only the cloned result — as across a real worker boundary.
   "seam.mutateArg": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { n: number }) => {
       args.n += 1000;
@@ -358,6 +364,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // integration suite to force a writer-job deadline (H4 wedged-writer): Atomics.wait on a private
   // buffer is a true synchronous sleep the gateway deadline fires behind. No write, so idempotent.
   "seam.sleep": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { ms: number }) => {
       Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.max(0, args.ms));
@@ -368,6 +375,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // A writer-side read of committed state, for tests to verify persistence without a reader gateway
   // (the writer reading its own connection trivially sees its own writes — §3.5). Read-only: idempotent.
   "seam.snapshot": {
+    offLoop: true,
     idempotent: true,
     fn: () => {
       const rows = getDb().query("SELECT id, tag, value, idem_key FROM _writer_seam_probe ORDER BY id").all();
@@ -450,7 +458,7 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
   ...VAULT_WRITE_OPS,
   ...VAULT_EXPIRY_WRITE_OPS,
   ...VAULT_BACKUP_WRITE_OPS,
-  "secretsVault.import": { idempotent: false, fn: importVaultRows },
+  "secretsVault.import": { offLoop: true, idempotent: false, fn: importVaultRows },
   ...MACOS_PRIVACY_WRITE_OPS,
     ...PROVIDER_FLAP_MESSAGES_WRITE_OPS,
     ...PROVIDER_CATALOG_WRITE_OPS,

package/src/db/writer-fault-seam.ts

@@ -1,4 +1,3 @@
-import { mainThreadRegistry } from "./main-thread-state";
 // The writer-side fault-injection seam for relocated db ops (ADR 0001 §3.1 H6, S3 leaf L-C #1899).
 //
 // WHY THIS EXISTS. Several timer ops carry test-only crash hooks that must fire INSIDE the op's
@@ -37,7 +36,11 @@ interface ArmedWriterFault {
   readonly threadId: number;
 }
 
-const armed = mainThreadRegistry("writer fault callbacks", new Map<string, ArmedWriterFault>());
+// Deliberately NOT a mainThreadRegistry (#1870 S6a): off-loop op bodies call `writerFault`, and on the
+// writer thread this map is empty, so the lookup is a harmless no-op there. Delivery is kept honest at
+// dispatch: while a fault is armed the in-process backend runs off-loop ops on the arming thread
+// (writer-gateway `dispatchEntry`), and arming refuses under the worker backend.
+const armed = new Map<string, ArmedWriterFault>();
 
 /**
  * Whether a main-thread fault closure can still reach an op body. False once the gateway stands up

package/src/db/writer-gateway.ts

@@ -43,6 +43,7 @@ import { WriterDrain } from "./writer-drain";
 import { errMessage } from "@humwick/sdk";
 import { createWorkerPool, type WorkerPool } from "@humwick/offload";
 import { getDbGeneration, getDbPath } from "./connection.ts";
+import { armedWriterFaultCount } from "./writer-fault-seam.ts";
 import { onLoopWriteTransaction } from "./on-loop-write-transaction.ts";
 // On-loop-block attribution (#1882 / ADR §5). `resolveLoopCallsite` pins the effective callsite onto a
 // submission in the CALLER's context; `captureSyncFrame` times the op body where it actually runs — in
@@ -551,7 +552,9 @@ async function dispatchEntry(entry: Submission): Promise<void> {
     back.busy = true;
     try {
       const path = getDbPath();
-      if (path && path !== ":memory:" && isOffLoopWriterOp(entry.op)) {
+      // An armed crash seam is a closure on THIS thread, so while one is armed the op runs here instead
+      // of on the file-DB worker (tests only; production never arms). Otherwise the fault would never fire.
+      if (path && path !== ":memory:" && isOffLoopWriterOp(entry.op) && armedWriterFaultCount() === 0) {
         if (back.offLoop && back.offLoopGeneration !== getDbGeneration()) {
           await back.offLoop.pool.destroy();
           back.offLoop = undefined;

package/src/mcp-host-tools.ts

@@ -35,7 +35,7 @@ export const HOST_TOOLS: ToolDefinition[] = [{
       landSlots: { anyOf: [{ type: "integer", minimum: 1, maximum: 1000 }, { type: "null" }] },
       validationSlots: { anyOf: [{ type: "integer", minimum: 1, maximum: 1000 }, { type: "null" }] },
       runCpus: { anyOf: [{ type: "number", minimum: 0.01, maximum: 1000 }, { type: "null" }] },
-      runMemory: { anyOf: [{ type: "integer", minimum: 1 }, { type: "null" }], description: "Per-run memory cap in bytes" },
+      runMemory: { anyOf: [{ type: "integer", minimum: 1 }, { type: "null" }], description: "Soft per-run memory, bytes" },
       projectGateReservations: { anyOf: [{ type: "object", additionalProperties: { type: "integer", minimum: 1, maximum: 1000 } }, { type: "null" }] },
     },
   },

package/src/package-pack.ts

@@ -131,6 +131,42 @@ export function privateWorkspaceDependencies(packageDir: string): string[] {
   return privateDeps;
 }
 
+type DependencyMap = Record<string, string>;
+export type ConsumerManifest = {
+  dependencies?: DependencyMap;
+  optionalDependencies?: DependencyMap;
+  bundleDependencies?: string[];
+};
+export type VendoredManifest = {
+  version?: string;
+  dependencies?: DependencyMap;
+  optionalDependencies?: DependencyMap;
+  peerDependencies?: DependencyMap;
+};
+
+// Pin and bundle a vendored private dep on its consumer (bundleDependencies keeps the nested copy
+// across reinstall/prune, #1772), and move the dep's own dependencies onto the consumer. npm counts
+// every dependency a bundled package declares as bundled too and never extracts it, so a global
+// install left @humwick/sdk, hono, zod … as empty folders (#3301). The vendored code still resolves
+// them by walking up node_modules.
+export function bundleVendoredDependency(consumer: ConsumerManifest, depName: string, vendored: VendoredManifest): void {
+  delete consumer.optionalDependencies?.[depName];
+  consumer.dependencies ??= {};
+  consumer.dependencies[depName] = vendored.version ?? "0.0.0";
+  consumer.bundleDependencies ??= [];
+  if (!consumer.bundleDependencies.includes(depName)) consumer.bundleDependencies.push(depName);
+  for (const field of ["dependencies", "optionalDependencies", "peerDependencies"] as const) {
+    for (const [name, spec] of Object.entries(vendored[field] ?? {})) {
+      const declared = consumer.dependencies[name] ?? consumer.optionalDependencies?.[name];
+      if (declared !== undefined && declared !== spec) {
+        fail(`package-pack: bundled ${depName} needs ${name}@${spec} but its consumer declares ${name}@${declared}; align the two specs`);
+      }
+      if (declared === undefined) consumer.dependencies[name] = spec;
+    }
+    delete vendored[field];
+  }
+}
+
 // Vendor a PRIVATE (unpublished, `workspace:*`) workspace dependency into the packed
 // tarball as a nested `node_modules/<dep>` package, pin its bundled version in
 // the packed manifest, and merge its own runtime dependencies up into the consumer so
@@ -148,31 +184,19 @@ async function bundlePrivateWorkspaceDeps(cwd: string, packageDir: string, tarba
   try {
     tar(["-xzf", tarball, "-C", stage]);
     const pkgRoot = join(stage, "package");
-    const packed = JSON.parse(readFileSync(join(pkgRoot, "package.json"), "utf8")) as {
-      dependencies?: Record<string, string>;
-      optionalDependencies?: Record<string, string>;
-      bundleDependencies?: string[];
-    };
+    const packed = JSON.parse(readFileSync(join(pkgRoot, "package.json"), "utf8")) as ConsumerManifest;
 
     for (const depName of privateDeps) {
       const depDir = dirByName.get(depName);
       if (!depDir) fail(`package-pack: private workspace dep ${depName} not found in root workspaces`);
       const depSrc = resolve(cwd, depDir);
-      const depManifest = JSON.parse(readFileSync(join(depSrc, "package.json"), "utf8")) as {
-        version?: string;
-        dependencies?: Record<string, string>;
-      };
 
       // Vendor the private package's REAL published file set by packing it exactly as it would be
       // published — `npm pack` honors the dep's own `files`/`exports` and runs its `prepack` build —
       // then extract the packed `package/` into node_modules/<dep>. Copying only flat root *.ts (the
       // pre-#1838 behavior) silently shipped a package.json-ONLY stub for any dep whose entrypoint is
-      // a BUILT dist or lives in a nested dir: @humwick/offload's `main` is ./dist/index.js with
-      // source under src/, so the vendored copy carried no dist and the installed consumer crashed at
-      // import with "Cannot find package '@humwick/offload'". Packing is the canonical publish
-      // representation and works for BOTH a raw-.ts dep (@humwick/kernel, exports ./index.ts) and a
-      // built-dist dep (@humwick/offload) — and for any future published-package offload adopter
-      // (orchestrator #1807, later waves) with no per-dep special-casing here.
+      // a BUILT dist or lives in a nested dir (@humwick/offload's `main` is ./dist/index.js). Packing
+      // works for BOTH a raw-.ts dep (@humwick/kernel) and a built-dist dep with no special-casing.
       const vendorDir = join(pkgRoot, "node_modules", depName);
       const depStage = mkdtempSync(join(packDir, "dep-pack-"));
       try {
@@ -186,30 +210,9 @@ async function bundlePrivateWorkspaceDeps(cwd: string, packageDir: string, tarba
       } finally {
         rmSync(depStage, { recursive: true, force: true });
       }
-
-      // Replace the unresolvable workspace:* spec with the vendored version AND declare the
-      // dep as a bundleDependency. This is the canonical npm/bun representation of a bundled
-      // package: the nested node_modules/<dep> is treated as an intentional, protected part of
-      // the tarball — preserved on install, never fetched from the registry (bundled wins over
-      // the pinned version), and — critically — never pruned as "extraneous" on a second
-      // `npm install` / `npm ci` / dedupe / prune pass. Merely DROPPING the workspace:* spec
-      // (the pre-#1772 behavior) let the FIRST install keep the vendored copy but any later
-      // tree reconciliation deleted node_modules/<dep> entirely, breaking every
-      // `<dep>/<subpath>` import at runtime (e.g. @humwick/kernel/workflow-journal-codec
-      // → CLI crash at startup). See #1772.
-      for (const field of ["dependencies", "optionalDependencies"] as const) {
-        if (packed[field]) delete packed[field][depName];
-      }
-      packed.dependencies ??= {};
-      packed.dependencies[depName] = depManifest.version ?? "0.0.0";
-      packed.bundleDependencies ??= [];
-      if (!packed.bundleDependencies.includes(depName)) packed.bundleDependencies.push(depName);
-
-      // Hoist the private dep's own runtime deps so the clean-env install resolves them from
-      // the registry (kernel imports zod/hono/…).
-      for (const [name, spec] of Object.entries(depManifest.dependencies ?? {})) {
-        packed.dependencies[name] ??= spec;
-      }
+      const vendored = JSON.parse(readFileSync(join(vendorDir, "package.json"), "utf8")) as VendoredManifest;
+      bundleVendoredDependency(packed, depName, vendored);
+      writeFileSync(join(vendorDir, "package.json"), JSON.stringify(vendored, null, 2) + "\n");
     }
 
     writeFileSync(join(pkgRoot, "package.json"), JSON.stringify(packed, null, 2) + "\n");

package/src/routes/host-resource-control.ts

@@ -38,7 +38,10 @@ export function cleanHostResourceControl(value: unknown): HostGateResourceContro
   })) as Partial<Record<HostGateKind, HostGateKindStatus>> : undefined;
   return { ...(kinds && HOST_GATE_KINDS.every(name => kinds[name]) ? { kinds: kinds as Record<HostGateKind, HostGateKindStatus> } : {}),
     ...(count(value.iterateOverflow) ? { iterateOverflow: value.iterateOverflow as number } : {}),
-    ...(typeof value.gateMemoryBytes === "number" && Number.isFinite(value.gateMemoryBytes) && value.gateMemoryBytes > 0 ? { gateMemoryBytes: value.gateMemoryBytes } : {}), ...(gateLimits ? { gateLimits } : {}), ...(reservations ? { projectGateReservations: reservations } : {}), ...(work ? { work, workTruncated: value.workTruncated === true || (value.work as unknown[]).length > 50 } : {}),
+    ...Object.fromEntries((["gateMemoryBytes", "gateMemoryUsedBytes", "runMemoryBytes"] as const).flatMap(key => {
+      const bytes = value[key];
+      return typeof bytes === "number" && Number.isSafeInteger(bytes) && bytes >= 0 ? [[key, bytes]] : [];
+    })), ...(gateLimits ? { gateLimits } : {}), ...(reservations ? { projectGateReservations: reservations } : {}), ...(work ? { work, workTruncated: value.workTruncated === true || (value.work as unknown[]).length > 50 } : {}),
     ...mechanism, usableCpus: usableCpus as number, gateCpus: gateCpus as number,
     memoryBytes: memoryBytes as number, slots: slots as number, held: held as number, waiters: waiters as number,
     ...(paths ? { paths } : {}) };

package/src/routes/orchestrator-bootstrap.ts

@@ -6,7 +6,7 @@ import { authorizeRoute, cleanSafeNumber, error, json, parseBody, type Handler }
 import { cleanString, cleanStringArray } from "../validation";
 import { createTokenAsync, revokeTokenAsync } from "../token-db-write";
 import { getComponentAuth } from "../security";
-import { issueOrchestratorRuntimeToken } from "../runtime-tokens";
+import { issueOrchestratorRuntimeTokenAsync } from "../runtime-tokens";
 import { type SpawnProvider } from "../types";
 
 export const postOrchestratorBootstrap: Handler = async (req) => {
@@ -80,7 +80,7 @@ export const postOrchestratorBootstrapExchange: Handler = async (req) => {
     if (denied) return denied;
     const auth = getComponentAuth(req);
     if (!auth || auth.role !== "orchestrator-bootstrap") return error("bootstrap token required", 403);
-    const runtimeToken = issueOrchestratorRuntimeToken({
+    const runtimeToken = await issueOrchestratorRuntimeTokenAsync({
       orchestratorId: id,
       baseDir,
       createdBy: auth.jti ? `bootstrap:${auth.jti}` : "bootstrap",

package/src/routes/orchestrator.ts

@@ -18,7 +18,7 @@ import { cleanMeta, cleanString, cleanStringArray, cleanWorkspaceMetadata, optio
 import { createCommandAsync } from "../commands-write";
 import { emitAgentStatus, emitOrchestratorStatus } from "../sse";
 import { getLifecycleManager } from "../lifecycle-manager";
-import { issueOrchestratorRuntimeToken } from "../runtime-tokens";
+import { issueOrchestratorRuntimeTokenAsync } from "../runtime-tokens";
 import { authContextFromRequest } from "../services/auth-context";
 import { serializeCommandForRead } from "../services/dispatch-command";
 import { isOrchestratorRegistrationAuthorized } from "../security";
@@ -198,7 +198,7 @@ export const postOrchestrator: Handler = async (req) => {
 	      metadata: { orchestratorId: id, providers: orch.providers, ...authAuditMetadata(req) },
 	    });
     const runtimeToken = isRootCredentialRequest(req)
-      ? issueOrchestratorRuntimeToken({ orchestratorId: id, baseDir, createdBy: `orchestrator:${id}` })
+      ? await issueOrchestratorRuntimeTokenAsync({ orchestratorId: id, baseDir, createdBy: `orchestrator:${id}` })
       : undefined;
     const hostProviders = await hostProviderSync(id, envProviders);
     return json({ ...orch, ...(runtimeToken ? { runtimeToken } : {}), hostProviders, gateBudget: gateBudgetForOrchestrator(id) }, 201);

package/src/routes/provider-config.ts

@@ -3,7 +3,8 @@ import { ValidationError, effectiveProviderCatalogListAsync, listOrchestrators,
 import { chooseProviderDefaultModel } from "../services/provider-catalog";
 import { applyCommandToRecipe } from "../recipe-runner";
 import { cleanString, cleanStringArray, optionalEnum } from "../validation";
-import { deleteCommand, getCommand } from "../commands-db";
+import { getCommand } from "../commands-db";
+import { deleteCommandAsync } from "../commands-write";
 import { emitCommand, error, json, parseBody, type Handler } from "./_shared";
 import { getProviderConfigEntry, listProviderConfigEntries, migrateLocalProviderConfigs, providerConfigPublic, setProviderConfig, VALID_PROVIDER_CONFIGS } from "../provider-config-store";
 import { cleanProviderModelLimits } from "../provider-catalog-store";
@@ -222,7 +223,7 @@ function optionalFraction(value: unknown, field: string): number | undefined {
 }
 
 export const deleteCommandById: Handler = async (_req, params) => {
-  if (!deleteCommand(params.id!)) return error("command not found or cannot be canceled", 404);
+  if (!await deleteCommandAsync(params.id!)) return error("command not found or cannot be canceled", 404);
   const command = getCommand(params.id!);
   if (command) {
     await applyCommandToRecipe(command);