@humwick/server 0.130.0 → 0.130.2

package/src/services/kernel-timers-cutover-chaos-worker.ts

@@ -24,6 +24,8 @@ const releaseFile = process.env.CUTOVER_CHAOS_RELEASE_FILE;
 const resultFile = process.env.CUTOVER_CHAOS_RESULT_FILE;
 const owner = process.env.CUTOVER_CHAOS_OWNER ?? `worker-${process.pid}`;
 const leaseMs = Number(process.env.CUTOVER_CHAOS_LEASE_MS ?? "400");
+let now = Number(required("CUTOVER_CHAOS_NOW"));
+const clock = () => now;
 
 function required(name: string): string {
   const value = relayEnv(process.env, name);
@@ -60,7 +62,7 @@ function timerInput(idSuffix = String(process.pid)): CreateScheduledTimerRowInpu
     createdByKind: "system",
     createdByScopes: ["message:send"],
     deliveryFrom: "system",
-    nextRunAt: Date.now() + 100_000,
+    nextRunAt: now + 100_000,
     scheduleKind: "once",
     scheduleDef: { afterMs: 100_000 },
     body: `cutover-${idSuffix}`,
@@ -87,6 +89,7 @@ async function main(): Promise<void> {
     };
     const c = new TimerMessageCutoverCoordinator({
       ownerId: owner,
+      now: clock,
       leaseMs,
       tickMs: 25,
       quiesceTimeoutMs: 5_000,
@@ -94,7 +97,7 @@ async function main(): Promise<void> {
       faults,
     });
     await c.requestQuiesce();
-    if (boundary === "after-renewal") await Bun.sleep(Math.ceil(leaseMs * 0.75));
+    if (boundary === "after-renewal") now += Math.ceil(leaseMs * 0.75);
     await c.tick();
     await c.tick();
     await c.tick();
@@ -112,7 +115,7 @@ async function main(): Promise<void> {
     const ticks = phaseTicks[boundary];
     if (ticks === undefined) throw new Error(`unknown deadline-watch phase ${boundary}`);
     const c = new TimerMessageCutoverCoordinator({
-      ownerId: owner, leaseMs: 10_000, tickMs: 25, quiesceTimeoutMs: 8_000, worstCaseDrainTransferMs: 10_000,
+      ownerId: owner, now: clock, leaseMs: 10_000, tickMs: 25, quiesceTimeoutMs: 8_000, worstCaseDrainTransferMs: 10_000,
     });
     await c.requestQuiesce();
     for (let i = 0; i < ticks; i++) await c.tick();
@@ -124,14 +127,14 @@ async function main(): Promise<void> {
 
   if (command === "claim-bound") {
     const c = new TimerMessageCutoverCoordinator({
-      ownerId: owner, leaseMs: 1_000, tickMs: 25, quiesceTimeoutMs: 300, worstCaseDrainTransferMs: 1_000,
+      ownerId: owner, now: clock, leaseMs: 1_000, tickMs: 25, quiesceTimeoutMs: 300, worstCaseDrainTransferMs: 1_000,
     });
     await c.requestQuiesce();
     await c.tick();
     await c.tick();
     const drain = await c.tick();
     if (boundary === "held") {
-      await Bun.sleep(340);
+      now += 340;
       await c.tick();
       await c.tick();
     }
@@ -141,7 +144,7 @@ async function main(): Promise<void> {
 
   if (command === "recover") {
     const c = new TimerMessageCutoverCoordinator({
-      ownerId: owner, leaseMs, tickMs: 25, quiesceTimeoutMs: 5_000, worstCaseDrainTransferMs: 6_000,
+      ownerId: owner, now: clock, leaseMs, tickMs: 25, quiesceTimeoutMs: 5_000, worstCaseDrainTransferMs: 6_000,
     });
     const outcomes = [];
     for (let i = 0; i < 5; i++) outcomes.push(await c.tick());
@@ -152,7 +155,7 @@ async function main(): Promise<void> {
   if (command === "close-gate") {
     marker();
     const c = new TimerMessageCutoverCoordinator({
-      ownerId: owner, leaseMs: 5_000, tickMs: 25, quiesceTimeoutMs: 5_000, worstCaseDrainTransferMs: 6_000,
+      ownerId: owner, now: clock, leaseMs: 5_000, tickMs: 25, quiesceTimeoutMs: 5_000, worstCaseDrainTransferMs: 6_000,
     });
     const acquired = await c.requestQuiesce();
     const outcome = acquired ? await c.tick() : null;
@@ -207,3 +210,5 @@ async function main(): Promise<void> {
 }
 
 await main();
+// Off-loop timer ops start the file-DB writer thread, which keeps an idle process alive (#1870 S6a).
+process.exit(0);

package/src/services/kernel-timers-ingress.ts

@@ -322,7 +322,7 @@ export class TimerIngressRejectedError extends Error {
 }
 
 export function createTimerIngress(options: TimerIngressOptions): TimerIngress {
-  installTimerIngressSchema();
+  installTimerIngressSchema({ ifNotInstalled: true });
   const apply = options.apply;
   const ownerId = options.ownerId ?? `${process.pid}-${randomUUID()}`;
   const now = options.now ?? Date.now;

package/src/services/kernel-timers-request-key-migration-chaos-worker.ts

@@ -1,3 +1,4 @@
+import { writeSync } from "node:fs";
 import { Database } from "bun:sqlite";
 import { applyConnectionPragmas, setDb } from "../db/connection.ts";
 import { createTimerIngress, installTimerIngressSchema } from "./kernel-timers-ingress.ts";
@@ -66,7 +67,7 @@ if (command === "migrate") {
     source: { kind: "snapshot", timer: replayDecoySnapshot() },
   });
   const cancelReplay = await ingress.acceptCancel({ timerId: "timer-cancel", requestKey: rawCancelKey });
-  process.stdout.write(JSON.stringify({
+  writeSync(1, JSON.stringify({
     create: { seq: replay.seq, timerId: replay.bound.id, state: replay.state },
     cancel: { seq: cancelReplay.seq, timerId: "timer-cancel", state: cancelReplay.state },
   }));
@@ -75,3 +76,5 @@ if (command === "migrate") {
 }
 
 db.close();
+// The off-loop ingress ops start the file-DB writer thread, which keeps an idle process alive (#1870 S6a).
+process.exit(0);

package/src/services/landed-ancestry.ts

@@ -1,3 +1,5 @@
+import { repoDefaultBranch } from "@humwick/sdk/land-gates";
+import { withWorkspaceTaskOwnerRoles } from "../task-owner-notices";
 // #1713 — the coordinator's "landed" signal, derived from GIT ANCESTRY rather than a command's
 // reported status. The observed bug: a worker delivers `complete`, the merge executor stalls, and
 // the coordinator is nonetheless told the work is "complete"/"landed" while `origin/main` is
@@ -113,7 +115,8 @@ const realVerifier: AncestryVerifier = async (repoRoot, sha, targetRef) => {
   // source of truth; a fetch failure/timeout is swallowed — the checks below then run against
   // whatever refs are already local, preserving the prior fail-closed behavior exactly.
   const remoteBranch = ref.startsWith("origin/") ? ref.slice("origin/".length) : ref;
-  if (remoteBranch) await gitStatus(root, ["fetch", "--quiet", "origin", remoteBranch], GIT_FETCH_TIMEOUT_MS);
+  const fetched = remoteBranch ? await gitStatus(root, ["fetch", "--quiet", "origin", `+refs/heads/${remoteBranch}:refs/remotes/origin/${remoteBranch}`], GIT_FETCH_TIMEOUT_MS) : null;
+  if (ref.startsWith("origin/") && fetched !== 0) return "unresolvable";
   // The sha itself must resolve to a commit in this repo, else ancestry is unknowable (not a
   // negative). `--verify --quiet ^{commit}` distinguishes "sha absent" from "sha present but not
   // on the ref".
@@ -246,6 +249,18 @@ export async function verifyLandedAncestry(repoRoot: string | undefined, sha: st
   }
 }
 
+/** Notice proof requires the freshly fetched remote; a local-only main never qualifies (#3761). */
+export async function verifyPublishedLand(repoRoot: string | undefined, sha: string | undefined, baseRef?: string): Promise<LandedAncestryVerdict> {
+  if (!repoRoot || !sha?.trim()) return "unresolvable";
+  try {
+    const base = baseRef ?? await repoDefaultBranch(async args => {
+      const result = await gitOutput(repoRoot, args);
+      return { ok: result?.exitCode === 0, stdout: result?.stdout ?? "", unavailable: !result };
+    });
+    return base ? await verifyLandedAncestry(repoRoot, sha, base.startsWith("origin/") ? base : `origin/${base}`) : "unresolvable";
+  } catch { return "unresolvable"; }
+}
+
 // #2718 — the landing host's own fresh-fetch ancestry check (`landVerifiedSha`) is ref-backed proof
 // that works wherever the repo lives; the hub's check needs a checkout of the same remote on its own
 // disk. Without a matching host verdict, fall back to the hub check (an absent path never confirms).
@@ -366,6 +381,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
   const { subject, body } = landUnconfirmedText(input);
 
   const payload = {
+    verified: false,
     kind: "workspace.land-unconfirmed",
     notification: "land-unconfirmed",
     landOutcome: kind,
@@ -397,7 +413,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
     metadata: { source: "server", maintenanceJobId: "workspace-land-unconfirmed", workspaceId: workspace.id, mergeCommandId: input.commandId, landOutcome: kind },
   });
 
-  const recipients = [...new Set([owner, coordinator, fallback].filter((r): r is string => Boolean(r)))];
+  const recipients = withWorkspaceTaskOwnerRoles([owner, coordinator, fallback], workspace);
   if (recipients.length === 0) return;
   routeNotification({
     type: "workspace.land_unconfirmed",
@@ -407,7 +423,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
     forceDelivery: true,
     message: {
       subject,
-      body,
+      body: `${body} verified: false.`,
       payload,
       idempotencyKey: kind === "merge-failed" ? landFailureEventKey(workspace, input.commandId)
         : `land-unconfirmed:${workspace.id}:${input.commandId ?? "nocmd"}:${kind}`,

package/src/services/memory-areas.ts

@@ -2,15 +2,13 @@
 // (relay_project_write_entry, relay_store_memory, the project-entry REST routes) resolves the
 // vocabulary and the stored value here, so the closed vocabulary cannot drift between them.
 
-import { AREAS_FILE, SYSTEM_AREAS, SYSTEM_AREA_DESCRIPTIONS, areasAtCommit, injectsAtStartup, isSystemArea, readAreasAtDefaultBranch, type AreaDefinition, type AreasAtCommit } from "@humwick/sdk/areas";
-import { errMessage, stringValue } from "@humwick/sdk";
-import { countActivePinnedEntriesInArea, getAgent, rootsForProject, ValidationError } from "../db";
-import { localProjectGit, readHostProjectFiles } from "../project-roles";
-import { hostIsRelayHost } from "../relay-host-locality";
+import { AREAS_FILE, SYSTEM_AREAS, SYSTEM_AREA_DESCRIPTIONS, areasAtCommit, injectsAtStartup, isSystemArea, type AreaDefinition, type AreasConfig } from "@humwick/sdk/areas";
+import { stringValue } from "@humwick/sdk";
+import { countActivePinnedEntriesInArea, getAgent, ValidationError } from "../db";
 import type { Project, ProjectEntry } from "../types";
 import type { AuthContext } from "./auth-context";
 import { callerHost, callerProjectId } from "./memory-identity";
-import { resolveProjectFilesHost } from "./spawn-project-role";
+import { readProjectConfig, readProjectConfigFirst, type ConfigLookup, type ProjectCheckout } from "./project-config-read";
 
 export const MAX_ENTRY_AREAS = 4;
 const PROJECT_WIDE = "project-wide";
@@ -47,42 +45,15 @@ export function areaCallerFromCtx(ctx: AuthContext): AreaCaller {
 }
 
 /** A checkout to read areas.json from: a cwd on a host (a hostname or a registered orchestrator). */
-export interface AreasCheckout {
-  cwd: string;
-  host?: string;
-  orchestratorId?: string;
-}
-
-export type AreasLookup = AreasAtCommit | { status: "unreadable"; error: string };
+export type AreasCheckout = ProjectCheckout;
 
-const loggedProblems = new Set<string>();
+export type AreasLookup = ConfigLookup<AreasConfig>;
 
-function logProblemOnce(key: string, problem: string): void {
-  if (loggedProblems.has(key)) return;
-  if (loggedProblems.size >= 1000) loggedProblems.clear();
-  loggedProblems.add(key);
-  console.warn(`[memory-areas] ${AREAS_FILE} for ${key}: ${problem}; accepting system areas only`);
-}
+const ACCEPTING_SYSTEM_AREAS = "accepting system areas only";
 
-/** #3635 — the areas.json at the checkout's default branch (origin/<default>, fetched first), read
- *  on the checkout's host through the #3043 project-files reader. Never a working tree and never
- *  cached, so a stale checkout or an old negative answer cannot hide a file that landed. */
-export async function readAreasConfig(checkout: AreasCheckout): Promise<AreasLookup> {
-  const where = `${checkout.orchestratorId ?? checkout.host ?? "local"}:${checkout.cwd}`;
-  try {
-    const lookup = !checkout.orchestratorId && hostIsRelayHost(checkout.host)
-      ? await readAreasAtDefaultBranch(localProjectGit(checkout.cwd))
-      : areasAtCommit(await readHostProjectFiles(
-        resolveProjectFilesHost({ subject: AREAS_FILE, cwd: checkout.cwd, orchestratorId: checkout.orchestratorId, preferHost: checkout.host }),
-        checkout.cwd, { paths: [AREAS_FILE] }, AREAS_FILE,
-      ));
-    if (lookup.status === "invalid") logProblemOnce(`${where}@${lookup.sha}`, `invalid: ${lookup.error}`);
-    return lookup;
-  } catch (err) {
-    const error = errMessage(err);
-    logProblemOnce(where, `unreadable: ${error}`);
-    return { status: "unreadable", error };
-  }
+/** #3635 — the areas.json at the checkout's default branch, through the shared project-config reader. */
+export function readAreasConfig(checkout: AreasCheckout): Promise<AreasLookup> {
+  return readProjectConfig(checkout, AREAS_FILE, areasAtCommit, ACCEPTING_SYSTEM_AREAS);
 }
 
 function invalidDetail(lookup: Extract<AreasLookup, { status: "invalid" }>): string {
@@ -94,18 +65,11 @@ function invalidDetail(lookup: Extract<AreasLookup, { status: "invalid" }>): str
  *  answers. Every other cell (base/provider/host) takes system areas only, optionally. */
 export async function resolveAreaVocabulary(anchor: Project, caller: AreaCaller | undefined): Promise<AreaVocabulary> {
   if (anchor.scope !== "project") return { pathAreas: [], required: false, pathAreasMissing: "not-project" };
-  const checkouts: AreasCheckout[] = [
-    ...(caller?.cwd && caller.projectId === anchor.id ? [{ cwd: caller.cwd, host: caller.host }] : []),
-    ...rootsForProject(anchor.id).map((root) => ({ cwd: root.rootPath, ...(root.orchestratorId ? { orchestratorId: root.orchestratorId } : {}) })),
-  ];
-  const failures: string[] = [];
-  for (const checkout of checkouts) {
-    const lookup = await readAreasConfig(checkout);
-    if (lookup.status === "found") return { pathAreas: lookup.config.areas, required: true };
-    if (lookup.status === "absent") return { pathAreas: [], required: false, pathAreasMissing: "undeclared" };
-    if (lookup.status === "invalid") return { pathAreas: [], required: false, pathAreasMissing: "invalid", pathAreasDetail: invalidDetail(lookup) };
-    failures.push(lookup.error);
-  }
+  const preferred = caller?.cwd && caller.projectId === anchor.id ? [{ cwd: caller.cwd, host: caller.host }] : [];
+  const { lookup, failures } = await readProjectConfigFirst(anchor.id, preferred, AREAS_FILE, areasAtCommit, ACCEPTING_SYSTEM_AREAS);
+  if (lookup?.status === "found") return { pathAreas: lookup.config.areas, required: true };
+  if (lookup?.status === "absent") return { pathAreas: [], required: false, pathAreasMissing: "undeclared" };
+  if (lookup?.status === "invalid") return { pathAreas: [], required: false, pathAreasMissing: "invalid", pathAreasDetail: invalidDetail(lookup) };
   return { pathAreas: [], required: false, pathAreasMissing: "unreadable", pathAreasDetail: failures.join("; ") || "the project has no checkout to read it from" };
 }
 

package/src/services/plan-ci-notice.ts

@@ -0,0 +1,57 @@
+// #3716 — workflow effects read CI episodes without depending on workflow launch or recovery.
+import { ValidationError } from "../db/connection";
+import { computeCiFailureFingerprint } from "../ci/incidents";
+import type { CiShaObservation } from "../db/ci-incidents";
+import type { StoredPlanCiBlock } from "../db/plan-ci-blocks";
+import { getGateway } from "../db/gateway";
+import { getPlanGraphProjectionAsync } from "../db/plan-graph-async";
+import { planNoticeTarget } from "../db/plan-completion";
+import { notifySystemMessage } from "../notify";
+import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
+
+/** Same watch and landed SHA, or the same failing jobs: an unrelated red main must not quiet this failure. */
+export async function correlatedCiIncidents(rows: Array<{ workflow: string; row?: CiShaObservation }>): Promise<string[]> {
+  const ids: string[] = [];
+  for (const { workflow, row } of rows) {
+    if (!row) return [];
+    const incident = await getGateway().read("ciIncidents.activeForWatch", { watchKey: row.watchKey });
+    if (!incident) return [];
+    if (incident.openedHeadSha !== row.headSha) {
+      if (!row.failingJobs?.length) return [];
+      const fingerprint = computeCiFailureFingerprint({ workflow, failingRuns: [{ id: "sha", status: "completed", jobs: row.failingJobs.map((job) => ({ id: job.name, name: job.name })) }], conclusion: "failure" });
+      if (fingerprint !== incident.fingerprint) return [];
+    }
+    ids.push(incident.id);
+  }
+  return [...new Set(ids)].sort();
+}
+
+/** Return a quiet receipt only after both the blocked attempt and the actionable plan notice are durable. */
+export async function planCiNotice(run: WorkflowRunRecord, payload: Record<string, unknown>, result = false): Promise<Record<string, unknown> | undefined> {
+  const owner = await getGateway().read("planDispatch.owner", { taskId: run.taskId });
+  if (!owner || owner.audit) return undefined;
+  let block = await getGateway().read("planDispatch.ci.block", { runId: run.id });
+  const incidentIds = Array.isArray(payload.incidentIds) ? payload.incidentIds.filter((id): id is string => typeof id === "string") : [];
+  if (!result && incidentIds.length && typeof payload.landedSha === "string") {
+    try {
+      block = await getGateway().write("planDispatch.ci.block", { planId: owner.planId, taskId: run.taskId, runId: run.id, sha: payload.landedSha, incidentIds, waitKey: run.escalation?.waitKey ?? "" }) as unknown as StoredPlanCiBlock;
+    } catch (error) {
+      // A superseded attempt must still send its normal CI notice (#3660).
+      if (error instanceof ValidationError && error.message === "CI blocker no longer owns its plan slot") return undefined;
+      throw error;
+    }
+  }
+  if (!block || (result && (block.retriedAt !== undefined || block.waitKey !== run.escalation?.waitKey)) || (!result && !incidentIds.length)) return undefined;
+  const plan = await getPlanGraphProjectionAsync({ planId: owner.planId });
+  const to = plan && planNoticeTarget(plan);
+  if (!to) return undefined;
+  for (const incidentId of block.incidentIds) {
+    notifySystemMessage(to, {
+      subject: `Plan ${plan.title ?? plan.id}: CI blocked`,
+      body: `Plan ${plan.id}: T${run.taskId}, run ${run.id}, landed SHA ${block.sha}, is blocked by CI incident ${incidentId}. Fix the incident; Relay automatically retries each blocked run's exact landed SHA after clearance. Slots and dependents wait. relay_plan_get shows every blocked Task and run.`,
+      idempotencyKey: `plan:${plan.id}:ci:${incidentId}`, replyExpected: false,
+      payload: { kind: "plan.ci-blocked", planId: plan.id, incidentId, taskId: run.taskId, runId: run.id, landedSha: block.sha },
+    });
+  }
+  return { quiet: "plan-ci-episode", planId: owner.planId, incidentIds: block.incidentIds };
+}

package/src/services/plan-ci-recovery.ts

@@ -1,62 +1,9 @@
-// #3660 — correlate only known CI episodes; clearance reuses the original run's CI resume path.
-import { ValidationError } from "../db/connection";
-import { computeCiFailureFingerprint } from "../ci/incidents";
-import type { CiShaObservation } from "../db/ci-incidents";
+// #3660 — clearance reuses the original run's CI resume path.
+import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
 import type { StoredPlanCiBlock } from "../db/plan-ci-blocks";
 import { getGateway } from "../db/gateway";
-import { getPlanGraphProjectionAsync } from "../db/plan-graph-async";
-import { planNoticeTarget } from "../db/plan-completion";
-import { notifySystemMessage } from "../notify";
-import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
 import { resumeWorkflowRun } from "./workflow-runs";
 
-/** Same watch and landed SHA, or the same failing jobs: an unrelated red main must not quiet this failure. */
-export async function correlatedCiIncidents(rows: Array<{ workflow: string; row?: CiShaObservation }>): Promise<string[]> {
-  const ids: string[] = [];
-  for (const { workflow, row } of rows) {
-    if (!row) return [];
-    const incident = await getGateway().read("ciIncidents.activeForWatch", { watchKey: row.watchKey });
-    if (!incident) return [];
-    if (incident.openedHeadSha !== row.headSha) {
-      if (!row.failingJobs?.length) return [];
-      const fingerprint = computeCiFailureFingerprint({ workflow, failingRuns: [{ id: "sha", status: "completed", jobs: row.failingJobs.map((job) => ({ id: job.name, name: job.name })) }], conclusion: "failure" });
-      if (fingerprint !== incident.fingerprint) return [];
-    }
-    ids.push(incident.id);
-  }
-  return [...new Set(ids)].sort();
-}
-
-/** Return a quiet receipt only after both the blocked attempt and the actionable plan notice are durable. */
-export async function planCiNotice(run: WorkflowRunRecord, payload: Record<string, unknown>, result = false): Promise<Record<string, unknown> | undefined> {
-  const owner = await getGateway().read("planDispatch.owner", { taskId: run.taskId });
-  if (!owner || owner.audit) return undefined;
-  let block = await getGateway().read("planDispatch.ci.block", { runId: run.id });
-  const incidentIds = Array.isArray(payload.incidentIds) ? payload.incidentIds.filter((id): id is string => typeof id === "string") : [];
-  if (!result && incidentIds.length && typeof payload.landedSha === "string") {
-    try {
-      block = await getGateway().write("planDispatch.ci.block", { planId: owner.planId, taskId: run.taskId, runId: run.id, sha: payload.landedSha, incidentIds, waitKey: run.escalation?.waitKey ?? "" }) as unknown as StoredPlanCiBlock;
-    } catch (error) {
-      // A superseded attempt must still send its normal CI notice (#3660).
-      if (error instanceof ValidationError && error.message === "CI blocker no longer owns its plan slot") return undefined;
-      throw error;
-    }
-  }
-  if (!block || (result && (block.retriedAt !== undefined || block.waitKey !== run.escalation?.waitKey)) || (!result && !incidentIds.length)) return undefined;
-  const plan = await getPlanGraphProjectionAsync({ planId: owner.planId });
-  const to = plan && planNoticeTarget(plan);
-  if (!to) return undefined;
-  for (const incidentId of block.incidentIds) {
-    notifySystemMessage(to, {
-      subject: `Plan ${plan.title ?? plan.id}: CI blocked`,
-      body: `Plan ${plan.id}: T${run.taskId}, run ${run.id}, landed SHA ${block.sha}, is blocked by CI incident ${incidentId}. Fix the incident; Relay automatically retries each blocked run's exact landed SHA after clearance. Slots and dependents wait. relay_plan_get shows every blocked Task and run.`,
-      idempotencyKey: `plan:${plan.id}:ci:${incidentId}`, replyExpected: false,
-      payload: { kind: "plan.ci-blocked", planId: plan.id, incidentId, taskId: run.taskId, runId: run.id, landedSha: block.sha },
-    });
-  }
-  return { quiet: "plan-ci-episode", planId: owner.planId, incidentIds: block.incidentIds };
-}
-
 /** A kernel resume note is the durable receipt if the process dies before marking the plan's row. */
 export async function recoverPlanCiBlock(run: WorkflowRunRecord): Promise<StoredPlanCiBlock | null> {
   const block = await getGateway().read("planDispatch.ci.block", { runId: run.id });

package/src/services/plan-wake-digest.ts

@@ -70,6 +70,7 @@ export function renderPlanWakeDigest(agentId: string, now = Date.now()): string
     do {
       const page = listPlansByTeam(teamId, { limit: 8, cursor });
       for (const summary of page.plans) {
+        if (!summary.nodeCount) continue;
         const plan = getPlan(summary.id);
         if (!plan) continue;
         const line = planLine(plan, now);

package/src/services/profile-trust.ts

@@ -1,7 +1,8 @@
 // #3636 — project trust edits without the dashboard: set a profile's review mode, acknowledge its
 // project hooks/MCP, approve an observed value. One seam for the HTTP routes and the MCP tool.
 import { ValidationError, type AgentProfile, type ProfileProjectReviewMode } from "@humwick/sdk";
-import { getAgentProfile, setAgentProfile, validateAgentProfile } from "../config-store";
+import { getAgentProfile, validateAgentProfile } from "../config-store";
+import { setAgentProfileAsync } from "../config-store-write";
 import type { ConfigEntry } from "../types";
 import type { ProjectTrustApproval, ProjectTrustCapability } from "../db/project-trust-approvals";
 import { approveProjectCapabilityReview, projectCellsHash } from "../project-trust";
@@ -38,9 +39,9 @@ export function withProjectTrust(profile: AgentProfile, update: ProjectTrustUpda
   return validated;
 }
 
-export function updateProfileProjectTrust(name: string, update: ProjectTrustUpdate, by: string): ConfigEntry<AgentProfile> {
+export async function updateProfileProjectTrustAsync(name: string, update: ProjectTrustUpdate, by: string): Promise<ConfigEntry<AgentProfile>> {
   if (!update.review && !update.ack?.length) throw new ValidationError("nothing to update: pass review and/or ack");
-  const saved = setAgentProfile(withProjectTrust(existingProfile(name).value, update, by), by, { overrideBuiltIn: true });
+  const saved = await setAgentProfileAsync(withProjectTrust(existingProfile(name).value, update, by), by, { overrideBuiltIn: true });
   emitConfigChanged(saved.namespace, saved.key, saved.version);
   return saved;
 }

package/src/services/project-config-read.ts

@@ -0,0 +1,70 @@
+// #3635/#3736 — one reader for `.agent-relay/*.json` project config (areas.json, spawn-policy.json): the
+// file at the checkout's default branch (origin/<default>, fetched first), read on the checkout's host
+// through the #3043 project-files reader. Never a working tree and never cached, so a stale checkout or
+// an old negative answer cannot hide a file that landed.
+import { readProjectFiles } from "@humwick/sdk";
+import type { ConfigAtCommit } from "@humwick/sdk/repo-config-file";
+import { errMessage } from "@humwick/sdk";
+import { rootsForProject } from "../db";
+import { localProjectGit, readHostProjectFiles } from "../project-roles";
+import { hostIsRelayHost } from "../relay-host-locality";
+import { resolveProjectFilesHost } from "./spawn-project-role";
+
+/** A checkout to read from: a cwd on a host (a hostname or a registered orchestrator). */
+export interface ProjectCheckout {
+  cwd: string;
+  host?: string;
+  orchestratorId?: string;
+}
+
+export type ConfigLookup<T> = ConfigAtCommit<T> | { status: "unreadable"; error: string };
+
+type Snapshot = { ref: string; sha: string; files: Record<string, string | null> };
+
+const warned = new Set<string>();
+
+/** One warning per distinct problem, so a broken file does not flood the log on every read. */
+export function warnConfigOnce(key: string, message: string): void {
+  if (warned.has(key)) return;
+  if (warned.size >= 1000) warned.clear();
+  warned.add(key);
+  console.warn(message);
+}
+
+/** `file` at the checkout's default branch; a read failure is `unreadable`, never a throw. Invalid and
+ *  unreadable outcomes warn once, naming `file`, the checkout and why, with `consequence` appended. */
+export async function readProjectConfig<T>(checkout: ProjectCheckout, file: string, parse: (snapshot: Snapshot) => ConfigAtCommit<T>, consequence: string): Promise<ConfigLookup<T>> {
+  const where = `${checkout.orchestratorId ?? checkout.host ?? "local"}:${checkout.cwd}`;
+  try {
+    const snapshot = !checkout.orchestratorId && hostIsRelayHost(checkout.host)
+      ? await readProjectFiles({ paths: [file] }, localProjectGit(checkout.cwd))
+      : await readHostProjectFiles(
+        resolveProjectFilesHost({ subject: file, cwd: checkout.cwd, orchestratorId: checkout.orchestratorId, preferHost: checkout.host }),
+        checkout.cwd, { paths: [file] }, file,
+      );
+    const lookup = parse(snapshot);
+    if (lookup.status === "invalid") warnConfigOnce(`${file}@${where}@${lookup.sha}`, `[project-config] ${file} for ${where} at ${lookup.sha.slice(0, 12)} is invalid: ${lookup.error}; ${consequence}`);
+    return lookup;
+  } catch (err) {
+    const error = errMessage(err);
+    warnConfigOnce(`${file}@${where}`, `[project-config] ${file} for ${where}: unreadable: ${error}; ${consequence}`);
+    return { status: "unreadable", error };
+  }
+}
+
+/** The first checkout that can be read answers: the preferred ones, then each registered root of the project. */
+export async function readProjectConfigFirst<T>(
+  projectId: string | undefined, preferred: readonly ProjectCheckout[], file: string, parse: (snapshot: Snapshot) => ConfigAtCommit<T>, consequence: string,
+): Promise<{ lookup?: ConfigAtCommit<T>; failures: string[] }> {
+  const checkouts: ProjectCheckout[] = [
+    ...preferred,
+    ...(projectId ? rootsForProject(projectId).map((root) => ({ cwd: root.rootPath, ...(root.orchestratorId ? { orchestratorId: root.orchestratorId } : {}) })) : []),
+  ];
+  const failures: string[] = [];
+  for (const checkout of checkouts) {
+    const lookup = await readProjectConfig(checkout, file, parse, consequence);
+    if (lookup.status !== "unreadable") return { lookup, failures };
+    failures.push(lookup.error);
+  }
+  return { failures };
+}

package/src/services/project-profile-instructions.ts

@@ -0,0 +1,54 @@
+import { randomUUID } from "node:crypto";
+import { hasScope, isRecord } from "@humwick/sdk";
+import type { ProjectProfileInstructions } from "../types";
+import { listAgentProfiles, resolveAgentProfileKey } from "../config-store";
+import { getGateway } from "../db/gateway";
+import { ValidationError } from "../db/connection";
+import { promptActorFromContext, promptVersionNumber } from "./prompt-version-writer";
+import type { AuthContext } from "./auth-context";
+import { cleanString } from "../validation";
+import { emitConfigChanged } from "../sse";
+
+export async function projectProfileInstructionKey(projectId: string, profile: string) {
+  const canonical = resolveAgentProfileKey(profile);
+  if (!canonical) throw new ValidationError("profile not found");
+  if (!await getGateway().read("projects.get", { id: projectId })) throw new ValidationError("project not found");
+  return { projectId, profile: canonical };
+}
+
+export async function readProjectProfileInstructions(projectId: string, profile: string) {
+  return getGateway().read("projectProfileInstructions.get", await projectProfileInstructionKey(projectId, profile));
+}
+
+export async function projectProfileInstructionHistory(projectId: string, profile: string) {
+  return { versions: await getGateway().read("projectProfileInstructions.history", await projectProfileInstructionKey(projectId, profile)) };
+}
+
+export async function listProjectProfileInstructions(filter: { projectId?: string; profile?: string }) {
+  const gateway = getGateway();
+  const profile = filter.profile ? resolveAgentProfileKey(filter.profile) : undefined;
+  if (filter.profile && !profile) throw new ValidationError("profile not found");
+  if (filter.projectId && !await gateway.read("projects.get", { id: filter.projectId })) throw new ValidationError("project not found");
+  if (!filter.projectId && !profile) throw new ValidationError("projectId or profile required");
+  const stored = await gateway.read("projectProfileInstructions.list", { projectId: filter.projectId, profile });
+  const byKey = new Map(stored.map(entry => [JSON.stringify([entry.projectId, entry.profile]), entry]));
+  const entry = (projectId: string, profile: string): ProjectProfileInstructions => byKey.get(JSON.stringify([projectId, profile])) ?? { projectId, profile, template: "", version: 0, updatedAt: 0 };
+  return { instructions: filter.projectId
+    ? listAgentProfiles().filter(item => !profile || item.key === profile).map(item => entry(filter.projectId!, item.key))
+    : (await gateway.read("projects.list", { includeArchived: true })).map(project => ({ ...entry(project.id, profile!), projectTitle: project.title, projectSlug: project.slug })) };
+}
+
+export async function mutateProjectProfileInstructions(ctx: AuthContext, projectId: string, profile: string, input: unknown, restore = false) {
+  if (ctx.actor.kind !== "system" && !hasScope(ctx.scopes, "agent:write")) throw new ValidationError("agent:write scope required");
+  const key = await projectProfileInstructionKey(projectId, profile);
+  if (!isRecord(input)) throw new ValidationError("JSON object body required");
+  if (!Number.isSafeInteger(input.expectedVersion) || (input.expectedVersion as number) < 0) throw new ValidationError("expectedVersion must be a non-negative integer");
+  const result = await getGateway().write("projectProfileInstructions.write", {
+    ...key, expectedVersion: input.expectedVersion as number,
+    template: restore ? undefined : input.template as string,
+    restoreVersion: restore ? promptVersionNumber(input.version, "version") : undefined,
+    actor: promptActorFromContext(ctx), reason: cleanString(input.reason, "reason", { max: 2000 }),
+  }, { idempotencyKey: randomUUID() }) as unknown as ProjectProfileInstructions;
+  emitConfigChanged("project-profile-instructions", `${key.projectId}:${key.profile}`, result.version);
+  return result;
+}

package/src/services/provisioning-harness/budget-baseline.json

@@ -19,7 +19,7 @@
           "unknown": 0
         },
         "mcp:relay-schemas": {
-          "residentKnown": 24523,
+          "residentKnown": 24574,
           "onDemandAvailable": 0,
           "unknown": 0
         },
@@ -114,7 +114,7 @@
           "unknown": 0
         },
         "mcp:relay-schemas": {
-          "residentKnown": 24523,
+          "residentKnown": 24574,
           "onDemandAvailable": 0,
           "unknown": 0
         },
@@ -364,11 +364,11 @@
     "reviewer:codex": 11221,
     "sec-ops:claude": 11610,
     "sec-ops:codex": 10644,
-    "ops-assistant:claude": 25307,
+    "ops-assistant:claude": 25390,
     "ops-assistant:codex": 25562,
     "sub-coordinator:claude": 20137,
     "sub-coordinator:codex": 20392,
-    "coordinator:claude": 26501,
+    "coordinator:claude": 26584,
     "coordinator:codex": 26622,
     "isolated-research:claude": 2852,
     "isolated-research:codex": 2790,