@humwick/server 0.130.0 → 0.130.2

package/src/db/commands-write-ops.ts

@@ -100,11 +100,13 @@ function markLandingReplay(result: unknown): unknown {
 
 export const COMMANDS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
   "commands.claimPending": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { id: string; expectedType?: string; ownerToken?: string }, ctx) =>
       claimPendingCommand(args.id, args.expectedType, args.ownerToken, ctx.now),
   },
   "commands.createAgentCleanupIfAbsent": {
+    offLoop: true,
     idempotent: false,
     fn: (args: { target: string; id: string }, ctx: WriterOpContext) => hasActiveAgentCleanup(args.target) ? null
       : createCommandInternal({ id: args.id, input: { type: "agent.cleanup", source: "system", target: args.target,
@@ -117,10 +119,12 @@ export const COMMANDS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object
     fn: (args: { command: Command }, ctx: WriterOpContext) => settleAgentCleanupWorkspaces(args.command, ctx.now),
   },
   "commands.reconcileScheduler": {
+    offLoop: true,
     idempotent: true,
     fn: (args: Parameters<typeof reconcileSchedulerCommandsBody>[0], ctx: WriterOpContext) => reconcileSchedulerCommandsBody(args, ctx.now),
   },
   "commands.createLegacyLanding": {
+    offLoop: true,
     idempotent: false,
     fn: (args: CreateLegacyLandingArgs, ctx: WriterOpContext) => createLegacyLandingBody(args, ctx.now),
     serializeIdempotencyResult: redactCreateResult,
@@ -136,61 +140,74 @@ export const COMMANDS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object
     recordIdempotencyResult: (result) => (result as { claimed?: boolean } | null)?.claimed === true,
   },
   "commands.acceptLandingProgress": {
+    offLoop: true,
     idempotent: false,
     fn: (args: AcceptLandingProgressArgs, ctx: WriterOpContext) => acceptLandingProgressBody(args, ctx.now),
   },
   "commands.acceptLandingResult": {
+    offLoop: true,
     idempotent: false,
     fn: (args: AcceptLandingResultArgs, ctx: WriterOpContext) => acceptLandingResultBody(args, ctx.now),
     replayIdempotencyResult: markLandingReplay,
   },
   "commands.resolveLegacyPublication": {
+    offLoop: true,
     idempotent: true,
     fn: (args: ResolveLegacyPublicationArgs, ctx: WriterOpContext) => resolveLegacyPublicationBody(args, ctx.now),
   },
   "commands.acquireLegacyPublishFence": {
+    offLoop: true,
     idempotent: false,
     fn: (args: AcquireLegacyPublishFenceArgs, ctx: WriterOpContext) => acquireLegacyPublishFenceBody(args, ctx.now),
   },
   "commands.acquireKernelPublishFence": {
+    offLoop: true,
     idempotent: false,
     fn: (args: AcquireKernelPublishFenceArgs, ctx: WriterOpContext) => acquireKernelPublishFenceBody(args, ctx.now),
   },
   "commands.requestLandingRetirement": {
+    offLoop: true,
     idempotent: false,
     fn: (args: RequestLandingRetirementArgs, ctx: WriterOpContext) =>
       requestLandingRetirementBody(args, ctx.now),
   },
   "commands.grantKernelDryRunOwnership": {
+    offLoop: true,
     idempotent: false,
     fn: (args: GrantKernelDryRunOwnershipArgs, ctx: WriterOpContext) =>
       grantKernelDryRunOwnershipBody(args, ctx.now),
   },
   "commands.consumeLegacyPublishPermit": {
+    offLoop: true,
     idempotent: false,
     fn: (args: ConsumeLegacyPublishPermitArgs, ctx: WriterOpContext) => consumeLegacyPublishPermitBody(args, ctx.now),
   },
   "commands.recordExecutionProof": {
+    offLoop: true,
     idempotent: false,
     fn: (args: RecordExecutionProofArgs, ctx: WriterOpContext) => recordExecutionProofBody(args, ctx.now),
     replayIdempotencyResult: markLandingReplay,
   },
   "commands.terminalizeLegacyLanding": {
+    offLoop: true,
     idempotent: false,
     fn: (args: TerminalizeLegacyLandingArgs, ctx: WriterOpContext) => terminalizeLegacyLandingBody(args, ctx.now),
     replayIdempotencyResult: markLandingReplay,
   },
   "commands.cancelPendingLegacyLandings": {
+    offLoop: true,
     idempotent: true,
     fn: (args: CancelPendingLegacyLandingsArgs, ctx: WriterOpContext) => cancelPendingLegacyLandingsBody(args, ctx.now),
   },
   // #2609 — the withdraw's legacy-lane mid-flight cancel (pending delegates to the never-started
   // path; accepted/running is a fenced status CAS + publish-permit retirement).
   "commands.cancelLegacyLandingExecution": {
+    offLoop: true,
     idempotent: false,
     fn: (args: CancelLegacyLandingExecutionArgs, ctx: WriterOpContext) => cancelLegacyLandingExecutionBody(args, ctx.now),
   },
   "commands.backfillLegacyLandingPage": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { rows: BackfillLegacyLandingRow[] }, ctx: WriterOpContext) => backfillLegacyLandingPageBody(args, ctx.now),
   },
@@ -221,6 +238,7 @@ export const COMMANDS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object
   // only when `commandUpdateHasPostCommitEffects` says there is something to do. Idempotent: the
   // terminal-event record is guarded by an existence check and the pill re-sets the same meta keys.
   "commands.applyUpdatePostCommit": {
+    offLoop: true,
     idempotent: true,
     fn: (args: ApplyCommandUpdatePostCommitOpArgs): null => {
       applyCommandUpdatePostCommit(args.previousStatus, args.command);
@@ -230,6 +248,7 @@ export const COMMANDS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object
   // Spawn reaping must not overwrite a concurrent async success settlement. The status predicate
   // lives inside this writer transaction, making the rows-changed result a real CAS winner signal.
   "commands.cancelIfStatus": {
+    offLoop: true,
     idempotent: false,
     fn: (args: CancelCommandIfStatusWriteArgs, ctx: WriterOpContext) => cancelCommandIfStatusInternal(args, ctx.now),
     serializeIdempotencyResult: redactCancelResult,
@@ -243,6 +262,7 @@ export const COMMANDS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object
   // submission recovers the SAME {command, created} from the ledger (so the emit survives an
   // indeterminate ack), while a genuine later re-drive presents a fresh id and finds `created:false`.
   "commands.createKernelIfAbsent": {
+    offLoop: true,
     idempotent: false,
     fn: (args: CreateKernelCommandIfAbsentArgs, ctx: WriterOpContext) => {
       let input = args.input;
@@ -278,6 +298,7 @@ export const COMMANDS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object
   // One caller's quota admission is all-or-nothing: the live + in-flight reads and INSERT share this
   // operation's transaction, rather than independent-caller coalescing/savepoints.
   "commands.createSpawnWithinQuota": {
+    offLoop: true,
     idempotent: false,
     fn: (args: CreateSpawnCommandWithinQuotaWriteArgs, ctx: WriterOpContext) =>
       createSpawnCommandWithinQuotaInternal(args, ctx.now),

package/src/db/config-store-write-ops.ts

@@ -13,14 +13,15 @@
 // `_writer_idempotency`. That result is a `ConfigEntry` whose `value` is the SAME operator data already
 // persisted verbatim in the `config` table of the SAME database file — so this introduces NO new
 // at-rest exposure class (unlike a signed token, which is never otherwise stored). We therefore keep
-// the real result in the ledger (redacting it would corrupt a keyed phantom-retry's return value) and
-// deliberately omit `serializeIdempotencyResult`.
+// the real result in the ledger, except provider credentials: the ledger is a copy outside the live row,
+// so it masks them like config_history does (#3540, #1870 S7).
 
 import {
   deleteConfigInternal,
   setConfigInternal,
 } from "../config-store.ts";
 import type { ConfigEntry } from "../types.ts";
+import { credentialFreeConfigValue } from "./provider-config-history.ts";
 import type { WriterOpContext, WriterOpSpec } from "./write-ops.ts";
 
 /** Structured-clone-safe args for `config.set` (H6: plain data only). `value` is arbitrary JSON. */
@@ -43,14 +44,20 @@ export const CONFIG_STORE_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Ob
   // retry would double-bump/duplicate. The gateway requires an idempotencyKey (the facade supplies a
   // per-submission one) and dedups on it in the SAME transaction as the write.
   "config.set": {
+    offLoop: true,
     idempotent: false,
     idempotencySnapshotKey: (args: SetConfigOpArgs) => JSON.stringify([args.namespace, args.key]),
+    serializeIdempotencyResult: (result: unknown) => {
+      const entry = result as ConfigEntry;
+      return { ...entry, value: credentialFreeConfigValue(entry) };
+    },
     fn: (args: SetConfigOpArgs, ctx: WriterOpContext): ConfigEntry =>
       setConfigInternal(args.namespace, args.key, args.value, args.updatedBy, ctx.now),
   },
   // Idempotent by construction: deleting again finds no row (`existing` null → early false) and writes
   // nothing, so re-applying converges. No key required.
   "config.delete": {
+    offLoop: true,
     idempotent: true,
     fn: (args: DeleteConfigOpArgs, ctx: WriterOpContext): boolean =>
       deleteConfigInternal(args.namespace, args.key, args.updatedBy, ctx.now),

package/src/db/continuation-archives-async.ts

@@ -3,6 +3,7 @@ import { getDbPath, runDbMaintenanceWorker } from "./connection.ts";
 import { purgeContinuationArchives, type ContinuationArchivePurgeInput, type ContinuationArchivePurgeResult } from "./continuation-archive-purge.ts";
 import { syncInMemoryContinuationArchiveSearchIndex, type ContinuationArchiveSearchSyncInput, type ContinuationArchiveSearchSyncResult } from "./continuation-archive-search.ts";
 import { getGateway } from "./gateway.ts";
+import type { appendContinuationArchiveRefs } from "./continuations.ts";
 import type { archiveAndAdvanceContinuation, archiveContinuationSegment, getContinuationArchiveByRef, searchContinuationArchives } from "./continuation-archives.ts";
 
 // Anything left after the budget is still removed, by the agent delete's cascade.
@@ -24,6 +25,10 @@ export function archiveAndAdvanceContinuationAsync(input: Parameters<typeof arch
   return getGateway().write("continuationArchives.compact", { input }, { idempotencyKey: requestId }) as unknown as Promise<ReturnType<typeof archiveAndAdvanceContinuation>>;
 }
 
+export function appendContinuationArchiveRefsAsync(agentId: string, refs: string[]): Promise<ReturnType<typeof appendContinuationArchiveRefs>> {
+  return getGateway().write("continuationArchives.appendRefs", { agentId, refs }) as unknown as Promise<ReturnType<typeof appendContinuationArchiveRefs>>;
+}
+
 /**
  * #3012 — catch the side FTS index up. A lock-free reader probe gates the run; the work runs in the
  * maintenance subprocess against the side file's own write lock, never on the hub's loop. An

package/src/db/continuation-archives-write-ops.ts

@@ -1,15 +1,24 @@
 import { archiveAndAdvanceContinuation, archiveContinuationSegment } from "./continuation-archives.ts";
+import { appendContinuationArchiveRefs } from "./continuations.ts";
 import type { WriterOpContext, WriterOpSpec } from "./write-ops.ts";
 
 export const CONTINUATION_ARCHIVES_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
   "continuationArchives.archive": {
+    offLoop: true,
     idempotent: false,
     fn: (args: { input: Parameters<typeof archiveContinuationSegment>[0] }, ctx: WriterOpContext) =>
       archiveContinuationSegment({ ...args.input, now: args.input.now ?? ctx.now }),
   },
   "continuationArchives.compact": {
+    offLoop: true,
     idempotent: false,
     fn: (args: { input: Parameters<typeof archiveAndAdvanceContinuation>[0] }, ctx: WriterOpContext) =>
       archiveAndAdvanceContinuation({ ...args.input, now: args.input.now ?? ctx.now }),
   },
+  // #1870 S7: the envelope's ref list is a set, so a replay converges.
+  "continuationArchives.appendRefs": {
+    offLoop: true,
+    idempotent: true,
+    fn: (args: { agentId: string; refs: string[] }, ctx: WriterOpContext) => appendContinuationArchiveRefs(args.agentId, args.refs, ctx.now),
+  },
 });

package/src/db/continuations.ts

@@ -143,7 +143,7 @@ function mergeLedger(
   return { ledger: merged.slice(start), dropped: merged.slice(0, start) };
 }
 
-export function appendContinuationArchiveRefs(agentId: string, archiveRefs: string[]): ContinuationEnvelope | null {
+export function appendContinuationArchiveRefs(agentId: string, archiveRefs: string[], now: number = Date.now()): ContinuationEnvelope | null {
   if (archiveRefs.length === 0) return getContinuationEnvelope(agentId);
   const existing = getContinuationEnvelope(agentId);
   if (!existing) return null;
@@ -155,7 +155,7 @@ export function appendContinuationArchiveRefs(agentId: string, archiveRefs: stri
     UPDATE agent_continuations
     SET archive_refs = ?, updated_at = ?
     WHERE agent_id = ?
-  `).run(JSON.stringify(refs), Date.now(), agentId);
+  `).run(JSON.stringify(refs), now, agentId);
   return getContinuationEnvelope(agentId);
 }
 

package/src/db/db-writer-worker.ts

@@ -14,12 +14,19 @@
 // It default-exports the offload task function; `createWorkerPool` invokes it via the offload
 // worker-runtime bootstrap.
 
+import { relayEnv } from "@humwick/sdk/env";
 import type { OffloadWorkerTask } from "@humwick/offload/worker";
 import { Database } from "bun:sqlite";
 import { applyConnectionPragmas, closeDb, getDbPath, setDb } from "./connection.ts";
 import { serializeDbError } from "./db-error-registry.ts";
 import { runWriterBatch, runWriterOp, type SerializedBatchEntry, type WriterJobInput, type WriterJobResult } from "./write-ops.ts";
 
+// A lock-contention test may shorten the wait; production keeps 4 s.
+function writerBusyTimeoutMs(): number {
+  const override = Number(relayEnv(process.env, "AGENT_RELAY_WRITER_BUSY_TIMEOUT_MS")?.trim() || Number.NaN);
+  return Number.isSafeInteger(override) && override >= 0 ? override : 4000;
+}
+
 /** Ensure this worker's thread-local RW connection points at `dbPath`, opening it once and reusing
  *  it across jobs. A path change (never expected in production) reopens — cheap and defensive. */
 function ensureConnection(dbPath: string): void {
@@ -33,7 +40,7 @@ function ensureConnection(dbPath: string): void {
   // per-connection pragmas before it begins executing serialized write operations.
   applyConnectionPragmas(conn, { ensureWal: false });
   // #1870: external 1.2 s holds wait here, below the gateway's 5 s deadline, never on the loop.
-  conn.run("PRAGMA busy_timeout = 4000");
+  conn.run(`PRAGMA busy_timeout = ${writerBusyTimeoutMs()}`);
   setDb(conn, dbPath);
 }
 

package/src/db/delivery-write-ops.ts

@@ -40,23 +40,27 @@ export interface ApplyDeliveryActionOpArgs {
 
 export const DELIVERY_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
   "delivery.recordChannelFanoutSuppression": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { messageId: number; channelAgentId: string; reason: string }, ctx: WriterOpContext) =>
       recordChannelFanoutSuppression(args.messageId, args.channelAgentId, args.reason, ctx.now),
   },
   "delivery.recordAttempt": {
+    offLoop: true,
     idempotent: false,
     idempotencySnapshotKey: (args: RecordDeliveryAttemptOpArgs) => String(args.messageId),
     fn: (args: RecordDeliveryAttemptOpArgs, ctx: WriterOpContext) =>
       recordMessageDeliveryAttempt(args.messageId, args.input, ctx.now),
   },
   "delivery.applyAction": {
+    offLoop: true,
     idempotent: false,
     idempotencySnapshotKey: (args: ApplyDeliveryActionOpArgs) => String(args.messageId),
     fn: (args: ApplyDeliveryActionOpArgs, ctx: WriterOpContext) =>
       applyMessageDeliveryAction(args.messageId, args.input, ctx.now),
   },
   "delivery.reevaluate": {
+    offLoop: true,
     idempotent: true,
     fn: (args: ApplyDeliveryActionOpArgs, ctx: WriterOpContext) =>
       applyMessageDeliveryAction(args.messageId, args.input, ctx.now),
@@ -66,6 +70,7 @@ export const DELIVERY_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object
   // elapsed time (chiefly tests) needs to drive it directly rather than only via real wall-clock
   // submission time. Production callers omit it and get ctx.now, per H6.
   "delivery.expireQueued": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { now?: number }, ctx: WriterOpContext) => expireQueuedMessagesWithNotices(args?.now ?? ctx.now),
   },

package/src/db/deploy-events-async.ts

@@ -25,6 +25,7 @@ export function tryBeginDeployEventAsync(input: TryBeginDeployEventInput): Promi
 export function backfillDeployEventVersionAsync(id: string, version: string): Promise<DeployEvent | null> {
   return write("deployEvents.backfillVersion", { id, version });
 }
+export function getDeployEventForCommitAsync(commitSha: string): Promise<DeployEvent | null> { return read("deployEvents.forCommit", { commitSha }); }
 export function getDeployEventAsync(id: string): Promise<DeployEvent | null> { return read("deployEvents.get", { id }); }
 export function listDeployEventsAsync(limit: number, offset: number): Promise<DeployEvent[]> {
   return read("deployEvents.list", { limit, offset });

package/src/db/deploy-events-read-ops.ts

@@ -3,7 +3,7 @@
 import {
   currentPendingDeployEvent,
   deployChangesForCommits,
-  getDeployEvent,
+  getDeployEvent, getDeployEventForCommit,
   latestFailedDeployForCommit,
   latestSuccessfulDeploy,
   listDeployEvents,
@@ -14,6 +14,7 @@ import {
 } from "./deploy-events.ts";
 
 export const DEPLOY_EVENTS_READ_OPS = {
+  "deployEvents.forCommit": (args: { commitSha: string }): DeployEvent | null => getDeployEventForCommit(args.commitSha),
   "deployEvents.get": (args: { id: string }): DeployEvent | null => getDeployEvent(args.id),
   "deployEvents.list": (args: { limit: number; offset: number }): DeployEvent[] => listDeployEvents(args.limit, args.offset),
   "deployEvents.needingChanges": (args: { limit: number }): DeployEvent[] => listDeployEventsNeedingChanges(args.limit),

package/src/db/deploy-events.ts

@@ -1,14 +1,16 @@
+import { defaultTaskIssueRelation } from "./task-issue-relation";
+import { parseJson, type TaskDispatch } from "@humwick/sdk";
 import { randomUUID } from "node:crypto";
 import { getDb, writeTransaction } from "./connection.ts";
 import { setTaskStageBody } from "./task-entity.ts";
 import { insertTaskEvent } from "./task-core.ts";
 import { listIssuesForEntity } from "./issue-associations.ts";
-import type { IssueRef } from "../types";
+import type { IssueRef, IssueRefRelation } from "../types";
 
 export type DeployStatus = "pending" | "succeeded" | "failed" | "rolled-back";
 export type DeployHost = { id: string; fromVersion?: string; toVersion?: string; status: string; reason?: string };
 export type DeployCommit = { sha: string; subject: string };
-export type DeployTaskChange = { id: number; label: string; issues: IssueRef[] };
+export type DeployTaskChange = { id: number; label: string; issues: Array<IssueRef & { relation?: IssueRefRelation }>; onDeploy?: string };
 export type DeployChangesSummary = {
   range: { previousSha?: string; commitSha: string };
   tasks: DeployTaskChange[];
@@ -219,6 +221,24 @@ export function getDeployEvent(id: string): DeployEvent | null {
   return row ? rowToDeployEvent(row) : null;
 }
 
+/** The running artifact may boot while its deploy ledger is still pending (#3761). */
+export function getDeployEventForCommit(commitSha: string): DeployEvent | null {
+  const row = getDb().query("SELECT * FROM deploy_events WHERE commit_sha = ? ORDER BY started_at DESC LIMIT 1").get(commitSha);
+  const event = row ? rowToDeployEvent(row) : null;
+  if (event?.changes?.state === "ready" && event.changes.tasks.length) {
+    const notes = getDb().query("SELECT id, on_deploy, dispatch, owner_agent_id FROM tasks WHERE id IN (SELECT value FROM json_each(?))")
+      .all(JSON.stringify(event.changes.tasks.map(task => task.id))) as Array<{ id: number; on_deploy: string | null; dispatch: string | null; owner_agent_id: string | null }>;
+    const byId = new Map(notes.map(task => [task.id, task]));
+    event.changes.tasks = event.changes.tasks.map(task => {
+      const { onDeploy, ...snapshot } = task;
+      const current = byId.get(task.id);
+      const note = current ? current.on_deploy : onDeploy;
+      return { ...snapshot, ...(current ? { issues: deployTaskIssues(task.id, current.dispatch, current.owner_agent_id) } : {}), ...(note ? { onDeploy: note } : {}) };
+    });
+  }
+  return event;
+}
+
 /** Newest-first page of the deploy ledger for the dashboard timeline (#1327). */
 export function listDeployEvents(limit: number, offset: number): DeployEvent[] {
   const rows = getDb()
@@ -250,6 +270,11 @@ export function listDeployEventsNeedingChanges(limit: number): DeployEvent[] {
   return rows.map(rowToDeployEvent);
 }
 
+function deployTaskIssues(id: number, dispatch: string | null, ownerAgentId: string | null): DeployTaskChange["issues"] {
+  const relation = defaultTaskIssueRelation(parseJson<TaskDispatch | undefined>(dispatch, undefined), ownerAgentId ?? undefined);
+  return listIssuesForEntity("task", String(id)).map(item => ({ ...item.issueRef, relation: item.association.relation ?? relation }));
+}
+
 /**
  * Match a deploy's ordered commit list to every durable Task with an exact stored
  * commit SHA. This CD-only query loads the task commit payload once; the HTTP
@@ -258,7 +283,7 @@ export function listDeployEventsNeedingChanges(limit: number): DeployEvent[] {
 export function deployChangesForCommits(commits: DeployCommit[]): Pick<DeployChangesSummary, "tasks" | "unmatchedCommits"> {
   const rangeShas = new Set(commits.map((commit) => commit.sha));
   const matchedShas = new Set<string>();
-  const rows = getDb().query("SELECT id, title, commits FROM tasks WHERE kind = 'deliverable' AND commits IS NOT NULL ORDER BY id ASC").all() as any[];
+  const rows = getDb().query("SELECT id, title, commits, on_deploy, dispatch, owner_agent_id FROM tasks WHERE kind = 'deliverable' AND commits IS NOT NULL ORDER BY id ASC").all() as any[];
   const tasks: DeployTaskChange[] = [];
   for (const row of rows) {
     let taskCommits: Array<{ sha?: unknown }>;
@@ -268,7 +293,8 @@ export function deployChangesForCommits(commits: DeployCommit[]): Pick<DeployCha
     tasks.push({
       id: Number(row.id),
       label: String(row.title),
-      issues: listIssuesForEntity("task", String(row.id)).map((item) => item.issueRef),
+      issues: deployTaskIssues(Number(row.id), row.dispatch, row.owner_agent_id),
+      ...(row.on_deploy ? { onDeploy: String(row.on_deploy) } : {}),
     });
   }
   return { tasks, unmatchedCommits: commits.filter((commit) => !matchedShas.has(commit.sha)) };
@@ -316,6 +342,11 @@ export function renewDeployEventLease(input: { id: string; now?: number }): bool
   return writeTransaction(() => renewDeployEventLeaseBody(input, input.now ?? Date.now()));
 }
 
+/** Migration progress shares the existing deploy row and dashboard surface (#3470). */
+export function recordDeployEventHosts(id: string, hosts: DeployHost[]): boolean {
+  return getDb().query("UPDATE deploy_events SET hosts = ? WHERE id = ? AND status = 'pending'").run(JSON.stringify(hosts), id).changes > 0;
+}
+
 /**
  * Emergency operator recovery for a genuinely stranded deploy owner:
  * `bun run scripts/release.ts --clear-deploy-lease <event-id>` (→ `failed`), or

package/src/db/hosts-registration.ts

@@ -139,8 +139,16 @@ export type HardwareReconciliation =
 
 /** Capacity is an observed, runtime-varying property, not host identity. WSL2 in particular can
  * report less RAM after a reboot, and swap may appear/disappear with zram configuration. Keep the
- * latest value for placement without making a legitimate capacity change an anti-spoof conflict. */
-const TOLERANT_CAPACITY_HARDWARE_FIELDS = new Set(["totalMemMb", "totalStorageMb", "totalSwapMb"]);
+ * latest value for placement without making a legitimate capacity change an anti-spoof conflict.
+ * `osVersion` (the kernel string) changes on every OS patch; it is not hardware identity (#3770). */
+const TOLERANT_CAPACITY_HARDWARE_FIELDS = new Set(["totalMemMb", "totalStorageMb", "totalSwapMb", "osVersion"]);
+
+/** The identity-defining keys present on both sides with different values: what a conflict notice names. */
+export function conflictingHardwareFields(stored: HostHardware, reported: HostHardware): string[] {
+  const a = stored as unknown as Record<string, unknown>;
+  const b = reported as unknown as Record<string, unknown>;
+  return Object.keys(a).filter((key) => !TOLERANT_CAPACITY_HARDWARE_FIELDS.has(key) && a[key] !== undefined && b[key] !== undefined && a[key] !== b[key]).sort();
+}
 
 export function reconcileHardwareFields(stored: HostHardware, reported: HostHardware): HardwareReconciliation {
   const storedRec = stored as unknown as Record<string, unknown>;

package/src/db/hosts-write-ops.ts

@@ -27,6 +27,7 @@ export const HOSTS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
   // Idempotent by construction (re-registration converges; conflict/join tags flip only on the
   // transition), so no idempotencyKey is required.
   "hosts.upsertFromRegistration": {
+    offLoop: true,
     idempotent: true,
     fn: (a: HostRegistrationInput, ctx) => upsertHostFromRegistrationInternal(a, ctx.now),
   },
@@ -36,42 +37,52 @@ export const HOSTS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
   // the gateway's bounded-queue shedding policy, dropping a utilization update is the correct
   // outcome, because the next beat supersedes it 30 s later (§8).
   "hosts.recordUtilization": {
+    offLoop: true,
     idempotent: true,
     fn: (a: Parameters<typeof recordHostUtilizationInternal>[0]) => recordHostUtilizationInternal(a),
   },
   "hosts.setLabel": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string; label: string }) => setHostLabelInternal(a.id, a.label),
   },
   "hosts.setTags": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string; tags: string[] }) => setHostTagsInternal(a.id, a.tags),
   },
   "hosts.acceptHardware": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string }) => acceptHostHardwareInternal(a.id),
   },
   "hosts.setEnabled": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string; enabled: boolean }) => setHostEnabledInternal(a.id, a.enabled),
   },
   "hosts.setLandingPlacement": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string; noLandingWorkspaces: boolean | null }) => setHostLandingPlacementInternal(a.id, a.noLandingWorkspaces),
   },
   "hosts.setAgentCap": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string; maxAgents: number | null }) => setHostPlacementPolicyInternal(a.id, "maxAgents", a.maxAgents),
   },
   "hosts.setLandingCap": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string; maxLandingSlots: number | null }) => setHostPlacementPolicyInternal(a.id, "maxLandingSlots", a.maxLandingSlots),
   },
   "hosts.setGateBudget": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string } & HostGatePolicyPatch) => { const { id, ...patch } = a; return setHostGatePolicyInternal(id, patch); },
   },
   "hosts.setAdmission": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string; flags: Pick<HostPolicy, "spawnEnabled" | "gatesEnabled"> }, ctx) => {
       const host = setHostAdmissionInternal(a.id, a.flags);
@@ -80,14 +91,17 @@ export const HOSTS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.fr
     },
   },
   "hosts.setPolicy": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { id: string; policy: HostPolicy }) => setHostPolicyInternal(a.id, a.policy),
   },
   "hosts.claimAlias": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { hostId: string; alias: string; source: string }, ctx) => claimHostAliasInternal(a.hostId, a.alias, a.source, ctx.now),
   },
   "hosts.releaseAlias": {
+    offLoop: true,
     idempotent: true,
     fn: (a: { alias: string }) => releaseHostAliasInternal(a.alias),
   },

package/src/db/hosts.ts

@@ -9,6 +9,7 @@ import type { Host, HostDaemonSample, HostHardware, HostMachineSample, HostPolic
 import { normalizeHostToken, parseJson } from "../utils";
 import { getDb } from "./connection.ts";
 import { primeHostAliases, type HostAliasRecord } from "../host/identity.ts";
+import { settleDiskWatch, type DiskAlert } from "../host/disk-alert.ts";
 import { settleGateArming, type GateCapacityAlert } from "../host/gate-capacity-alert.ts";
 
 function rowToHost(row: any): Host {
@@ -99,18 +100,20 @@ function storedSample<T extends { at: number }>(table: "hosts" | "orchestrators"
  */
 export function recordHostUtilizationInternal(
   input: { hostId: string; orchestratorId: string; machine: HostMachineSample; daemon: HostDaemonSample },
-): { hostUpdated: boolean; generationUpdated: boolean; gateAlert?: GateCapacityAlert; hostLabel?: string } {
+): { hostUpdated: boolean; generationUpdated: boolean; gateAlert?: GateCapacityAlert; diskAlert?: DiskAlert; hostLabel?: string } {
   // `last_seen_at` is deliberately NOT touched here: it is the Host's freshness clock and the §3.5
   // seam already bumps it on every beat with the RELAY's clock. `machine.at` is the PRODUCER's wall
   // clock, so writing it here would let a skewed daemon move a Host's liveness backwards.
   const prevHost = storedSample<HostMachineSample>("hosts", input.hostId);
   let hostUpdated = false;
   let gateAlert: GateCapacityAlert | undefined;
+  let diskAlert: DiskAlert | undefined;
   if (!prevHost || input.machine.at > prevHost.at) {
-    // #2822 — settled inside this single-writer read-modify-write, so each transition alerts once.
-    const settled = settleGateArming(prevHost ?? undefined, input.machine);
+    // #2822 / #3762 — settled inside this single-writer read-modify-write, so each transition alerts once.
+    const gate = settleGateArming(prevHost ?? undefined, input.machine);
+    const settled = settleDiskWatch(prevHost ?? undefined, gate.machine);
     hostUpdated = getDb().query("UPDATE hosts SET utilization = ? WHERE id = ?").run(JSON.stringify(settled.machine), input.hostId).changes > 0;
-    if (hostUpdated) gateAlert = settled.alert;
+    if (hostUpdated) { gateAlert = gate.alert; diskAlert = settled.alert; }
   }
 
   const generationAt = storedSample<HostDaemonSample>("orchestrators", input.orchestratorId)?.at ?? null;
@@ -118,9 +121,9 @@ export function recordHostUtilizationInternal(
     ? false
     : getDb().query("UPDATE orchestrators SET utilization = ? WHERE id = ?").run(JSON.stringify(input.daemon), input.orchestratorId).changes > 0;
 
-  if (!gateAlert) return { hostUpdated, generationUpdated };
+  if (!gateAlert && !diskAlert) return { hostUpdated, generationUpdated };
   const label = (getDb().query("SELECT label FROM hosts WHERE id = ?").get(input.hostId) as { label: string } | null)?.label;
-  return { hostUpdated, generationUpdated, gateAlert, hostLabel: label ?? input.hostId };
+  return { hostUpdated, generationUpdated, ...(gateAlert ? { gateAlert } : {}), ...(diskAlert ? { diskAlert } : {}), hostLabel: label ?? input.hostId };
 }
 
 export function setHostLabelInternal(id: string, label: string): Host | null {

package/src/db/inbox-write-ops.ts

@@ -4,20 +4,24 @@ import type { WriterOpContext, WriterOpSpec } from "./write-ops.ts";
 
 export const INBOX_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
   "inbox.setThreadState": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { input: Parameters<typeof setInboxThreadState>[0] }, ctx: WriterOpContext) =>
       setInboxThreadState(args.input, ctx.now),
   },
   "inbox.setDraft": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { input: Parameters<typeof setInboxDraft>[0] }, ctx: WriterOpContext) =>
       setInboxDraft(args.input, ctx.now, false),
   },
   "inbox.deleteDraft": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { operatorId: string; peerId: string }) => deleteInboxDraft(args.operatorId, args.peerId),
   },
   "inbox.createHistoryImport": {
+    offLoop: true,
     idempotent: true,
     fn: (args: { input: Parameters<typeof createChatHistoryImport>[0] }, ctx: WriterOpContext) =>
       createChatHistoryImport(args.input, ctx.now, false),

package/src/db/inbox.ts

@@ -1,18 +1,4 @@
 import { randomUUID } from "node:crypto";
-import { isRecord, stringValue, isMechanicalMessageKind } from "@humwick/sdk";
-import { ORCHESTRATOR_PROTOCOL_VERSION, VERSION } from "../config.ts";
-import { parseJson } from "../utils";
-import { isLiveIsolatedWorkspace } from "../workspace-phase";
-import {
-  CONTRACT_REQUIREMENTS,
-  contractCompatibility,
-  parseRuntimeCapabilities,
-  parseRuntimeContracts,
-  parseRuntimePackage,
-  type RuntimeContracts,
-} from "../contracts";
-import { STALE_TTL_MS, DAY_MS, CLAIM_LEASE_MS, POOL_CLAIM_LEASE_MS, WORKSPACE_MERGE_LEASE_MS } from "../config";
-import { matchAgents } from "../agent-ref";
 import { ValidationError, getDb, writeTransaction } from "./connection.ts";
 import { rowToChatHistoryImport, rowToChatHistoryImportEntry, rowToInboxDraft, rowToInboxThreadState } from "./mappers.ts";
 import { getMessage } from "./messages.ts";

package/src/db/index.ts

@@ -44,6 +44,7 @@ export * from "./task-comment-through-async.ts";
 export * from "./deploy-events.ts";
 export * from "./deploy-events-async.ts";
 export * from "./integrations.ts";
+export * from "./integrations-async.ts";
 export * from "./pairs.ts";
 export * from "./artifacts.ts";
 export * from "./artifact-browse.ts";
@@ -75,6 +76,7 @@ export * from "./orchestrators-async.ts";
 export * from "./hosts.ts";
 export * from "./hosts-async.ts";
 export type { HostRegistrationEvent, HostRegistrationInput, HostRegistrationResult } from "./hosts-registration.ts";
+export { conflictingHardwareFields } from "./hosts-registration.ts";
 export * from "./workspaces.ts";
 export * from "./workspace-writes.ts";
 export * from "./workspace-writes-async.ts";

package/src/db/insights-write-ops.ts

@@ -7,6 +7,7 @@ import type { WriterOpContext, WriterOpSpec } from "./write-ops.ts";
 
 export const INSIGHTS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
   "insights.observations.record": {
+    offLoop: true,
     // An observation is append-only; callers must provide the per-request key carried by the facade.
     idempotent: false,
     fn: (args: { input: Parameters<typeof recordObservation>[1] }, ctx: WriterOpContext) =>

package/src/db/integrations-async.ts

@@ -0,0 +1,8 @@
+import { getGateway } from "./gateway.ts";
+import type { IntegrationRegistryInput, reconcileIntegrationRegistry } from "./integrations.ts";
+
+export const listIntegrationTaskStatsAsync = () => getGateway().read("integrations.taskStats", undefined);
+
+export async function reconcileIntegrationRegistryAsync(configured: IntegrationRegistryInput[], observedSources: string[]): Promise<ReturnType<typeof reconcileIntegrationRegistry>> {
+  return await getGateway().write("integrations.reconcileRegistry", { configured, observedSources }) as unknown as ReturnType<typeof reconcileIntegrationRegistry>;
+}