@humwick/server 0.130.1 → 0.130.2

package/src/db/agents.ts

@@ -479,28 +479,51 @@ export function applyAgentLifecycleUpdate(
   guard?: AgentSessionGuard,
   now: number = Date.now(),
 ): AgentLifecycleUpdateResult {
-  const miss: AgentLifecycleUpdateResult = { ok: false, changed: false, metaWriteBytes: 0, before: null, after: null };
-  const before = getPersistedAgentRuntimeCard(id);
-  if (!before) return miss;
-  if (!agentSessionGuardResult(before, guard).ok) return miss;
+  const seq = nextLifecycleSeq();
+  const before = prepareAgentLifecycleUpdate(id, update, guard);
+  if (!before) return { ok: false, changed: false, metaWriteBytes: 0, before: null, after: null };
+  return { ok: true, before, ...inWriteTransaction(() => applyAgentLifecycleUpdateInternal(agentLifecycleWriteArgs(before, update, seq, now))) };
+}
 
+/** The writer-op args for one lifecycle delta (#1870 S7). `seq` is taken at the caller's entry (lifecycle-seq.ts
+ *  rule 1); `expectedEpoch` fences the write to the instance `before` was read from across the writer hop. */
+export interface AgentLifecycleWriteArgs {
+  id: string;
+  update: AgentLifecycleUpdate;
+  seq: number;
+  now: number;
+  expectedEpoch: number;
+  before: { instanceId?: string; spawnRequestId: string; terminalProviderExit?: unknown };
+}
+
+export function agentLifecycleWriteArgs(before: AgentCard, update: AgentLifecycleUpdate, seq: number, now: number): AgentLifecycleWriteArgs {
+  return { id: before.id, update, seq, now, expectedEpoch: before.epoch, before: { instanceId: before.instanceId, spawnRequestId: String(before.meta?.spawnRequestId ?? ""), terminalProviderExit: before.meta?.terminalProviderExit } };
+}
+
+/** The main-thread half of a lifecycle delta: guard, `before` snapshot, transition handlers and presence
+ *  eviction (main-thread state), all before the write is submitted. Null when the guard rejects. */
+export function prepareAgentLifecycleUpdate(id: string, update: AgentLifecycleUpdate, guard?: AgentSessionGuard): AgentCard | null {
+  const before = getPersistedAgentRuntimeCard(id);
+  if (!before || !agentSessionGuardResult(before, guard).ok) return null;
   const nextStatus = update.status;
-  // Pre-transition handlers are main-thread-only state (see runBeforeAgentStatusTransitionHandlers)
-  // and must run BEFORE the write lands, exactly as `setStatus` does.
+  // Pre-transition handlers must run BEFORE the write lands, exactly as `setStatus` does.
   if (nextStatus !== undefined && nextStatus !== before.status) runBeforeAgentStatusTransitionHandlers(before, nextStatus);
   // #1468 — a terminal transition evicts any buffered beat so a coalesced advance cannot later
   // resurrect a gone agent at flush.
   if (nextStatus === "offline" || nextStatus === "stale") evictPendingPresence(id);
+  return before;
+}
 
-  // #2111 review BLOCKER 1 — raise each written column's ordinal so a lifecycle write the coalescing
-  // window deferred cannot commit afterwards and undo it. This path only ever WINS its own races (it
-  // commits synchronously, and any submission carrying a higher ordinal has not been allocated yet),
-  // but it is fenced anyway so every writer of these columns obeys one rule.
-  const seq = nextLifecycleSeq();
+/** Op body (`agents.applyLifecycleUpdate`): the fenced UPDATE, its effects, and the offline post-commit, in the
+ *  caller's transaction. #2111 review BLOCKER 1 — each written column's ordinal is raised, so a lifecycle write
+ *  the coalescing window deferred cannot commit afterwards and undo it. */
+export function applyAgentLifecycleUpdateInternal(args: AgentLifecycleWriteArgs): Omit<AgentLifecycleUpdateResult, "ok" | "before"> {
+  const { id, update, seq, now, before } = args;
+  const nextStatus = update.status;
   // Named params throughout: the fenced-column fragments repeat `$seq`, which positional `?` could
   // only express by counting placeholders across a dynamically-built SET list.
   const sets: string[] = ["last_seen = $now"];
-  const params: Record<string, unknown> = { $now: now, $seq: seq, $id: id };
+  const params: Record<string, unknown> = { $now: now, $seq: seq, $id: id, $epoch: args.expectedEpoch };
   let metaWriteBytes = 0;
   if (nextStatus !== undefined) {
     sets.push(fencedColumnSql("status", "$status", "$seq"));
@@ -558,16 +581,10 @@ export function applyAgentLifecycleUpdate(
     params.$qs = runtime?.quota ? JSON.stringify(runtime.quota) : null;
   }
 
-  // BEGIN IMMEDIATE (#1428/#1431) so busy_timeout governs contention, joining an ambient writer-op
-  // transaction rather than nesting when this body is reached through the gateway.
-  const changed = inWriteTransaction(() => {
-    const applied = getDb().query(`UPDATE agents SET ${sets.join(", ")} WHERE id = $id`).run(params as never).changes > 0;
-    const terminalLaunch = terminalProviderLaunchId(update.meta?.terminalProviderExit ?? before.meta?.terminalProviderExit);
-    if (applied && nextStatus === "offline" && terminalLaunch) revokeVaultTokens(id, now, "provider_terminal_exit", before.instanceId, String(before.meta?.spawnRequestId ?? ""), terminalLaunch);
-    if (applied && contextState) recordContextSnapshot(id, contextState, now);
-    return applied;
-  });
-
+  const changed = getDb().query(`UPDATE agents SET ${sets.join(", ")} WHERE id = $id AND epoch = $epoch`).run(params as never).changes > 0;
+  const terminalLaunch = terminalProviderLaunchId(update.meta?.terminalProviderExit ?? before.terminalProviderExit);
+  if (changed && nextStatus === "offline" && terminalLaunch) revokeVaultTokens(id, now, "provider_terminal_exit", before.instanceId, before.spawnRequestId, terminalLaunch);
+  if (changed && contextState) recordContextSnapshot(id, contextState, now);
   // NOTE (from setStatus): `offline` is a LIVENESS observation, not a confirmed death — it re-elects
   // stewards and closes pairs but must NOT release a steward's workspace claim (#1789 part 2, F2).
   // Gated on the requested status, not on a status CHANGE, matching setStatus's own condition.
@@ -575,7 +592,7 @@ export function applyAgentLifecycleUpdate(
     closeOpenPairsForAgent(id, now);
     electWorkspaceStewards();
   }
-  return { ok: true, changed, metaWriteBytes, before, after: getPersistedAgentRuntimeCard(id) };
+  return { changed, metaWriteBytes, after: getPersistedAgentRuntimeCard(id) };
 }
 
 export function mergeAgentMeta(id: string, meta: Record<string, unknown>, guard?: AgentSessionGuard, now: number = Date.now()): boolean {
@@ -828,21 +845,27 @@ export function heartbeat(
 // withBufferedPresence / bufferedLiveAgentIds) live in the leaf module ./presence-buffer.ts so every
 // liveness reader can fold in the buffer without an import cycle (agents.ts imports channels.ts).
 
+/** Heartbeat: buffers the steady-state liveness advance (flushed by `flushPresence`), writes presence-critical
+ * transitions at once. False if the session guard rejects or the agent is gone. Sync twin for tests; the
+ * transports use `recordHeartbeatAsync`, which writes the bypass on the writer thread (#1870 S7). */
+export function recordHeartbeat(id: string, opts: HeartbeatInput = {}): boolean {
+  const beat = bufferOrBypassHeartbeat(id, opts);
+  return typeof beat === "boolean" ? beat : applyAgentLifecycleUpdate(id, beat, opts.guard, opts.now ?? Date.now()).changed;
+}
+
+export interface HeartbeatInput {
+  guard?: AgentSessionGuard;
+  /** Semantic status reported by the beat (bus path); undefined for the runtime-less API path. */
+  status?: AgentCard["status"];
+  runtime?: { providerCapabilities?: ProviderCapabilities; context?: ContextState; quota?: QuotaState };
+  now?: number;
+}
+
 /**
- * Hot-path heartbeat entry point for the bus/API transports. Coalesces the steady-state liveness
- * advance into the in-memory buffer (flushed by `flushPresence`), but writes synchronously for
- * presence-critical transitions. Returns false if the session guard rejects or the agent is gone.
+ * The shared decision of `recordHeartbeat` and `recordHeartbeatAsync`: buffer a steady-state beat (returns
+ * the result) or hand back the lifecycle delta a presence-critical beat must write now.
  */
-export function recordHeartbeat(
-  id: string,
-  opts: {
-    guard?: AgentSessionGuard;
-    /** Semantic status reported by the beat (bus path); undefined for the runtime-less API path. */
-    status?: AgentCard["status"];
-    runtime?: { providerCapabilities?: ProviderCapabilities; context?: ContextState; quota?: QuotaState };
-    now?: number;
-  } = {},
-): boolean {
+export function bufferOrBypassHeartbeat(id: string, opts: HeartbeatInput): boolean | AgentLifecycleUpdate {
   if (!validateAgentSession(id, opts.guard).ok) return false;
   const current = getAgent(id);
   if (!current) return false;
@@ -861,9 +884,9 @@ export function recordHeartbeat(
     opts.runtime.context.lifecycleState !== current.context?.lifecycleState;
   const prev = pendingPresence.get(id);
   if (resurrection || statusChanged || lifecycleTransition) {
-    // Merge any buffered-but-unflushed runtime cols into this synchronous write so the bypass never
-    // DISCARDS a coalesced advance (a beat that carried context but was buffered, then a status
-    // change arrives carrying none). Per column: this beat wins, else the pending value.
+    // Merge any buffered-but-unflushed runtime cols into this write so the bypass never DISCARDS a
+    // coalesced advance (a beat that carried context but was buffered, then a status change arrives
+    // carrying none). Per column: this beat wins, else the pending value.
     const runtime = prev
       ? {
           providerCapabilities: opts.runtime?.providerCapabilities ?? prev.providerCapabilities,
@@ -871,16 +894,10 @@ export function recordHeartbeat(
           quota: opts.runtime?.quota ?? prev.quota,
         }
       : opts.runtime;
-    pendingPresence.delete(id); // this synchronous write supersedes any buffered advance
-    // #2111 — was `heartbeat()` (one UPDATE) followed by `setStatus()` (a second UPDATE of the SAME
-    // row inside its own BEGIN IMMEDIATE). One consolidated update now carries both; the explicit
-    // status overrides the resurrection CASE exactly as the second write used to.
-    return applyAgentLifecycleUpdate(
-      id,
-      { status: statusChanged ? opts.status : undefined, resurrectOnBeat: true, runtime },
-      opts.guard,
-      now,
-    ).changed;
+    pendingPresence.delete(id); // this write supersedes any buffered advance
+    // #2111 — one consolidated update carries both the beat and the explicit status, which overrides
+    // the resurrection CASE.
+    return { status: statusChanged ? opts.status : undefined, resurrectOnBeat: true, runtime };
   }
 
   // Steady state: buffer. Merge context advisory markers now (matches heartbeat()'s per-beat merge),
@@ -1192,6 +1209,10 @@ export function deleteAgent(id: string): { ok: boolean; error?: string } {
   return deleted ? { ok: true } : { ok: false, error: "agent not found" };
 }
 
+export type OrphanedTokenRevocation = { agentId: string; jtis: string[] };
+/** One page of the orphan sweep: agents after `afterId` in id order, up to `limit` (#3776: one short write each). */
+export type OrphanedTokenPage = { revoked: OrphanedTokenRevocation[]; nextAfterId: string | null };
+
 // #1057(1) — close the orphan-token window #1051 left open. A dead runner with no replacement
 // used to keep its token valid until the 24h offline prune (~720× the pre-#1051 ~2min horizon).
 // This sweep revokes ("stale", re-mintable — #484) the runtime tokens of agents whose process the
@@ -1204,12 +1225,18 @@ export function deleteAgent(id: string): { ok: boolean; error?: string } {
 // `lagGraceMs` mirrors the stale reaper's #1048/#1055 discipline: while the relay's own event
 // loop was stalled, a live claimant's heartbeats may not have been processed yet, so the window
 // widens by the observed lag rather than misreading the backlog as post-mortem silence.
-export function revokeOrphanedRuntimeTokens(graceMs: number = STALE_TTL_MS, lagGraceMs = 0, now = Date.now()): Array<{ agentId: string; jtis: string[] }> {
+export function revokeOrphanedRuntimeTokens(
+  graceMs: number = STALE_TTL_MS,
+  lagGraceMs = 0,
+  now = Date.now(),
+  page: { afterId?: string; limit?: number } = {},
+): OrphanedTokenPage {
   const cutoff = now - graceMs - Math.max(0, lagGraceMs);
+  const limit = page.limit ?? -1;
   const rows = getDb()
-    .query(`SELECT id, meta, last_seen FROM agents WHERE status = 'offline' AND meta LIKE '%lastExitReceivedAt%' AND NOT ${reservedAgentIdSql()}`)
-    .all() as Array<{ id: string; meta: string | null; last_seen: number }>;
-  const revoked: Array<{ agentId: string; jtis: string[] }> = [];
+    .query(`SELECT id, meta, last_seen FROM agents WHERE status = 'offline' AND meta LIKE '%lastExitReceivedAt%' AND NOT ${reservedAgentIdSql()} AND id > ? ORDER BY id LIMIT ?`)
+    .all(page.afterId ?? "", limit) as Array<{ id: string; meta: string | null; last_seen: number }>;
+  const revoked: OrphanedTokenRevocation[] = [];
   for (const row of rows) {
     const meta = parseJson<Record<string, unknown>>(row.meta ?? "{}", {});
     const receivedAt = typeof meta.lastExitReceivedAt === "number" ? meta.lastExitReceivedAt : undefined;
@@ -1218,7 +1245,7 @@ export function revokeOrphanedRuntimeTokens(graceMs: number = STALE_TTL_MS, lagG
     const jtis = revokeProviderRuntimeTokensByJti(runtimeTokenJtisFromMeta(meta), "stale", now);
     if (jtis.length > 0) revoked.push({ agentId: row.id, jtis });
   }
-  return revoked;
+  return { revoked, nextAfterId: limit > 0 && rows.length === limit ? rows[rows.length - 1]!.id : null };
 }
 
 // #484: `reason` is stamped on each revocation so a stale-on-restart revocation

package/src/db/ci-incidents-async.ts

@@ -35,15 +35,15 @@ const write = <T>(op: string, args: unknown, idempotencyKey?: string): Promise<T
 export function upsertWatchStateAsync(input: Parameters<typeof upsertWatchState>[0]): Promise<ReturnType<typeof upsertWatchState>> {
   return write("ciIncidents.watch.upsert", input);
 }
-/** One gateway writer transaction for the complete watch + incident lifecycle decision. */
-export function ingestCiObservationTransitionAsync(input: CiObservationTransitionInput): Promise<CiObservationTransitionResult> {
-  return write("ciIncidents.observation.ingest", input);
+/** One gateway writer transaction for the complete watch + incident lifecycle decision. `now` pins a test clock. */
+export function ingestCiObservationTransitionAsync(input: CiObservationTransitionInput, now?: number): Promise<CiObservationTransitionResult> {
+  return write("ciIncidents.observation.ingest", now === undefined ? input : { ...input, now });
 }
 export function markCiWatchNeverMatchedNotifiedAsync(watchKey: string): Promise<ReturnType<typeof markCiWatchNeverMatchedNotified>> {
   return write("ciIncidents.watch.markNeverMatched", { watchKey });
 }
-export function markCiRootMissingNotifiedAsync(repository: string): Promise<ReturnType<typeof markCiRootMissingNotified>> {
-  return write("ciIncidents.root.markMissing", { repository });
+export function markCiRootMissingNotifiedAsync(repository: string, now?: number): Promise<ReturnType<typeof markCiRootMissingNotified>> {
+  return write("ciIncidents.root.markMissing", now === undefined ? { repository } : { repository, now });
 }
 export function openOrDedupeIncidentAsync(input: Parameters<typeof openOrDedupeIncident>[0]): Promise<ReturnType<typeof openOrDedupeIncident>> {
   return write("ciIncidents.openOrDedupe", input);

package/src/db/ci-incidents-write-ops.ts

@@ -27,7 +27,7 @@ export const CI_INCIDENTS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Ob
   "ciIncidents.observation.ingest": {
     offLoop: true,
     idempotent: true,
-    fn: (a: Parameters<typeof applyCiObservationTransitionInternal>[0], ctx) => applyCiObservationTransitionInternal(a, ctx.now),
+    fn: (a: Parameters<typeof applyCiObservationTransitionInternal>[0] & { now?: number }, ctx) => applyCiObservationTransitionInternal(a, a.now ?? ctx.now),
   },
   "ciIncidents.gateRun.record": { offLoop: true, idempotent: true, fn: (a: Parameters<typeof recordCiGateRuns>[0]) => recordCiGateRuns(a) },
   "ciIncidents.gateBackfill.start": { offLoop: true, idempotent: true, fn: (a: Parameters<typeof startCiGateBackfill>[0]) => startCiGateBackfill(a) },
@@ -36,7 +36,7 @@ export const CI_INCIDENTS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Ob
   "ciIncidents.sha.prune": { offLoop: true, idempotent: true, fn: (_a: { now: number }, ctx) => pruneCiShaObservations(ctx.now) },
   "ciIncidents.watch.upsert": { offLoop: true, idempotent: true, fn: (a: Parameters<typeof upsertWatchState>[0], ctx) => upsertWatchState(a, ctx.now) },
   "ciIncidents.watch.markNeverMatched": { offLoop: true, idempotent: true, fn: (a: { watchKey: string }, ctx) => markCiWatchNeverMatchedNotified(a.watchKey, ctx.now) },
-  "ciIncidents.root.markMissing": { offLoop: true, idempotent: true, fn: (a: { repository: string }, ctx) => markCiRootMissingNotified(a.repository, ctx.now) },
+  "ciIncidents.root.markMissing": { offLoop: true, idempotent: true, fn: (a: { repository: string; now?: number }, ctx) => markCiRootMissingNotified(a.repository, a.now ?? ctx.now) },
   "ciIncidents.openOrDedupe": { offLoop: true, idempotent: true, fn: (a: Parameters<typeof openOrDedupeIncidentInternal>[0], ctx) => openOrDedupeIncidentInternal(a, ctx.now, false) },
   // Guarded transitions throw after they have advanced; use the durable retry ledger rather than
   // misclassifying that as safe replay. Distinct steward attempts carry distinct request ids.

package/src/db/command-row.ts

@@ -41,13 +41,15 @@ export interface CommandRow {
 }
 
 
-export function rowToCommand(row: CommandRow): Command {
+/** `slim` (#3391): listings omit `params.agentProfile` (~0.5 MB per spawn row) instead of hydrating it;
+ *  `GET /api/commands/:id` returns the full row. */
+export function rowToCommand(row: CommandRow, options: { slim?: boolean } = {}): Command {
   return {
     id: row.id,
     type: row.type,
     source: row.source,
     target: row.target,
-    params: hydrateCommandAgentProfile(parseObject(row.params), row.agent_profile_hash),
+    params: options.slim ? withoutAgentProfile(parseObject(row.params)) : hydrateCommandAgentProfile(parseObject(row.params), row.agent_profile_hash),
     status: row.status,
     result: row.result ? parseObject(row.result) : undefined,
     error: row.error ?? undefined,
@@ -78,6 +80,12 @@ export function rowToCommand(row: CommandRow): Command {
   };
 }
 
+function withoutAgentProfile(params: Record<string, unknown>): Record<string, unknown> {
+  if (!("agentProfile" in params)) return params;
+  const { agentProfile: _omitted, ...rest } = params;
+  return rest;
+}
+
 function parseObject(raw: string): Record<string, unknown> {
   try {
     const parsed = JSON.parse(raw);

package/src/db/commands-list-query.ts

@@ -9,6 +9,8 @@ export interface CommandFilters {
   dispatchableOnly?: boolean;
   /** #2663 — oldest-first for the executor DISPATCH feed, whose window is capped. See `getCommands`. */
   oldestFirst?: boolean;
+  /** #3391 — omit `params.agentProfile` from rows (listing views; fetch the row by id for the profile). */
+  slim?: boolean;
 }
 
 export function buildListCommandsQuery(filters: CommandFilters = {}): { sql: string; params: unknown[] } {

package/src/db/commands-spawn-read.ts

@@ -29,5 +29,5 @@ export const IN_FLIGHT_SPAWNS_BY_PARENT_SQL = `SELECT * FROM commands INDEXED BY
 /** One parent's agent.spawn commands still in flight, newest first. */
 export function listInFlightSpawnCommands(parentId: string, limit = 500): Command[] {
   const rows = getDb().query(IN_FLIGHT_SPAWNS_BY_PARENT_SQL).all(...SPAWN_IN_FLIGHT_STATUSES, parentId, limit) as CommandRow[];
-  return rows.map(rowToCommand);
+  return rows.map((row) => rowToCommand(row));
 }

package/src/db/config-store-write-ops.ts

@@ -13,14 +13,15 @@
 // `_writer_idempotency`. That result is a `ConfigEntry` whose `value` is the SAME operator data already
 // persisted verbatim in the `config` table of the SAME database file — so this introduces NO new
 // at-rest exposure class (unlike a signed token, which is never otherwise stored). We therefore keep
-// the real result in the ledger (redacting it would corrupt a keyed phantom-retry's return value) and
-// deliberately omit `serializeIdempotencyResult`.
+// the real result in the ledger, except provider credentials: the ledger is a copy outside the live row,
+// so it masks them like config_history does (#3540, #1870 S7).
 
 import {
   deleteConfigInternal,
   setConfigInternal,
 } from "../config-store.ts";
 import type { ConfigEntry } from "../types.ts";
+import { credentialFreeConfigValue } from "./provider-config-history.ts";
 import type { WriterOpContext, WriterOpSpec } from "./write-ops.ts";
 
 /** Structured-clone-safe args for `config.set` (H6: plain data only). `value` is arbitrary JSON. */
@@ -46,6 +47,10 @@ export const CONFIG_STORE_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Ob
     offLoop: true,
     idempotent: false,
     idempotencySnapshotKey: (args: SetConfigOpArgs) => JSON.stringify([args.namespace, args.key]),
+    serializeIdempotencyResult: (result: unknown) => {
+      const entry = result as ConfigEntry;
+      return { ...entry, value: credentialFreeConfigValue(entry) };
+    },
     fn: (args: SetConfigOpArgs, ctx: WriterOpContext): ConfigEntry =>
       setConfigInternal(args.namespace, args.key, args.value, args.updatedBy, ctx.now),
   },

package/src/db/continuation-archives-async.ts

@@ -3,6 +3,7 @@ import { getDbPath, runDbMaintenanceWorker } from "./connection.ts";
 import { purgeContinuationArchives, type ContinuationArchivePurgeInput, type ContinuationArchivePurgeResult } from "./continuation-archive-purge.ts";
 import { syncInMemoryContinuationArchiveSearchIndex, type ContinuationArchiveSearchSyncInput, type ContinuationArchiveSearchSyncResult } from "./continuation-archive-search.ts";
 import { getGateway } from "./gateway.ts";
+import type { appendContinuationArchiveRefs } from "./continuations.ts";
 import type { archiveAndAdvanceContinuation, archiveContinuationSegment, getContinuationArchiveByRef, searchContinuationArchives } from "./continuation-archives.ts";
 
 // Anything left after the budget is still removed, by the agent delete's cascade.
@@ -24,6 +25,10 @@ export function archiveAndAdvanceContinuationAsync(input: Parameters<typeof arch
   return getGateway().write("continuationArchives.compact", { input }, { idempotencyKey: requestId }) as unknown as Promise<ReturnType<typeof archiveAndAdvanceContinuation>>;
 }
 
+export function appendContinuationArchiveRefsAsync(agentId: string, refs: string[]): Promise<ReturnType<typeof appendContinuationArchiveRefs>> {
+  return getGateway().write("continuationArchives.appendRefs", { agentId, refs }) as unknown as Promise<ReturnType<typeof appendContinuationArchiveRefs>>;
+}
+
 /**
  * #3012 — catch the side FTS index up. A lock-free reader probe gates the run; the work runs in the
  * maintenance subprocess against the side file's own write lock, never on the hub's loop. An

package/src/db/continuation-archives-write-ops.ts

@@ -1,4 +1,5 @@
 import { archiveAndAdvanceContinuation, archiveContinuationSegment } from "./continuation-archives.ts";
+import { appendContinuationArchiveRefs } from "./continuations.ts";
 import type { WriterOpContext, WriterOpSpec } from "./write-ops.ts";
 
 export const CONTINUATION_ARCHIVES_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
@@ -14,4 +15,10 @@ export const CONTINUATION_ARCHIVES_WRITE_OPS: Readonly<Record<string, WriterOpSp
     fn: (args: { input: Parameters<typeof archiveAndAdvanceContinuation>[0] }, ctx: WriterOpContext) =>
       archiveAndAdvanceContinuation({ ...args.input, now: args.input.now ?? ctx.now }),
   },
+  // #1870 S7: the envelope's ref list is a set, so a replay converges.
+  "continuationArchives.appendRefs": {
+    offLoop: true,
+    idempotent: true,
+    fn: (args: { agentId: string; refs: string[] }, ctx: WriterOpContext) => appendContinuationArchiveRefs(args.agentId, args.refs, ctx.now),
+  },
 });

package/src/db/continuations.ts

@@ -143,7 +143,7 @@ function mergeLedger(
   return { ledger: merged.slice(start), dropped: merged.slice(0, start) };
 }
 
-export function appendContinuationArchiveRefs(agentId: string, archiveRefs: string[]): ContinuationEnvelope | null {
+export function appendContinuationArchiveRefs(agentId: string, archiveRefs: string[], now: number = Date.now()): ContinuationEnvelope | null {
   if (archiveRefs.length === 0) return getContinuationEnvelope(agentId);
   const existing = getContinuationEnvelope(agentId);
   if (!existing) return null;
@@ -155,7 +155,7 @@ export function appendContinuationArchiveRefs(agentId: string, archiveRefs: stri
     UPDATE agent_continuations
     SET archive_refs = ?, updated_at = ?
     WHERE agent_id = ?
-  `).run(JSON.stringify(refs), Date.now(), agentId);
+  `).run(JSON.stringify(refs), now, agentId);
   return getContinuationEnvelope(agentId);
 }
 

package/src/db/db-writer-worker.ts

@@ -14,12 +14,19 @@
 // It default-exports the offload task function; `createWorkerPool` invokes it via the offload
 // worker-runtime bootstrap.
 
+import { relayEnv } from "@humwick/sdk/env";
 import type { OffloadWorkerTask } from "@humwick/offload/worker";
 import { Database } from "bun:sqlite";
 import { applyConnectionPragmas, closeDb, getDbPath, setDb } from "./connection.ts";
 import { serializeDbError } from "./db-error-registry.ts";
 import { runWriterBatch, runWriterOp, type SerializedBatchEntry, type WriterJobInput, type WriterJobResult } from "./write-ops.ts";
 
+// A lock-contention test may shorten the wait; production keeps 4 s.
+function writerBusyTimeoutMs(): number {
+  const override = Number(relayEnv(process.env, "AGENT_RELAY_WRITER_BUSY_TIMEOUT_MS")?.trim() || Number.NaN);
+  return Number.isSafeInteger(override) && override >= 0 ? override : 4000;
+}
+
 /** Ensure this worker's thread-local RW connection points at `dbPath`, opening it once and reusing
  *  it across jobs. A path change (never expected in production) reopens — cheap and defensive. */
 function ensureConnection(dbPath: string): void {
@@ -33,7 +40,7 @@ function ensureConnection(dbPath: string): void {
   // per-connection pragmas before it begins executing serialized write operations.
   applyConnectionPragmas(conn, { ensureWal: false });
   // #1870: external 1.2 s holds wait here, below the gateway's 5 s deadline, never on the loop.
-  conn.run("PRAGMA busy_timeout = 4000");
+  conn.run(`PRAGMA busy_timeout = ${writerBusyTimeoutMs()}`);
   setDb(conn, dbPath);
 }
 

package/src/db/deploy-events-async.ts

@@ -25,6 +25,7 @@ export function tryBeginDeployEventAsync(input: TryBeginDeployEventInput): Promi
 export function backfillDeployEventVersionAsync(id: string, version: string): Promise<DeployEvent | null> {
   return write("deployEvents.backfillVersion", { id, version });
 }
+export function getDeployEventForCommitAsync(commitSha: string): Promise<DeployEvent | null> { return read("deployEvents.forCommit", { commitSha }); }
 export function getDeployEventAsync(id: string): Promise<DeployEvent | null> { return read("deployEvents.get", { id }); }
 export function listDeployEventsAsync(limit: number, offset: number): Promise<DeployEvent[]> {
   return read("deployEvents.list", { limit, offset });

package/src/db/deploy-events-read-ops.ts

@@ -3,7 +3,7 @@
 import {
   currentPendingDeployEvent,
   deployChangesForCommits,
-  getDeployEvent,
+  getDeployEvent, getDeployEventForCommit,
   latestFailedDeployForCommit,
   latestSuccessfulDeploy,
   listDeployEvents,
@@ -14,6 +14,7 @@ import {
 } from "./deploy-events.ts";
 
 export const DEPLOY_EVENTS_READ_OPS = {
+  "deployEvents.forCommit": (args: { commitSha: string }): DeployEvent | null => getDeployEventForCommit(args.commitSha),
   "deployEvents.get": (args: { id: string }): DeployEvent | null => getDeployEvent(args.id),
   "deployEvents.list": (args: { limit: number; offset: number }): DeployEvent[] => listDeployEvents(args.limit, args.offset),
   "deployEvents.needingChanges": (args: { limit: number }): DeployEvent[] => listDeployEventsNeedingChanges(args.limit),

package/src/db/deploy-events.ts

@@ -1,14 +1,16 @@
+import { defaultTaskIssueRelation } from "./task-issue-relation";
+import { parseJson, type TaskDispatch } from "@humwick/sdk";
 import { randomUUID } from "node:crypto";
 import { getDb, writeTransaction } from "./connection.ts";
 import { setTaskStageBody } from "./task-entity.ts";
 import { insertTaskEvent } from "./task-core.ts";
 import { listIssuesForEntity } from "./issue-associations.ts";
-import type { IssueRef } from "../types";
+import type { IssueRef, IssueRefRelation } from "../types";
 
 export type DeployStatus = "pending" | "succeeded" | "failed" | "rolled-back";
 export type DeployHost = { id: string; fromVersion?: string; toVersion?: string; status: string; reason?: string };
 export type DeployCommit = { sha: string; subject: string };
-export type DeployTaskChange = { id: number; label: string; issues: IssueRef[] };
+export type DeployTaskChange = { id: number; label: string; issues: Array<IssueRef & { relation?: IssueRefRelation }>; onDeploy?: string };
 export type DeployChangesSummary = {
   range: { previousSha?: string; commitSha: string };
   tasks: DeployTaskChange[];
@@ -219,6 +221,24 @@ export function getDeployEvent(id: string): DeployEvent | null {
   return row ? rowToDeployEvent(row) : null;
 }
 
+/** The running artifact may boot while its deploy ledger is still pending (#3761). */
+export function getDeployEventForCommit(commitSha: string): DeployEvent | null {
+  const row = getDb().query("SELECT * FROM deploy_events WHERE commit_sha = ? ORDER BY started_at DESC LIMIT 1").get(commitSha);
+  const event = row ? rowToDeployEvent(row) : null;
+  if (event?.changes?.state === "ready" && event.changes.tasks.length) {
+    const notes = getDb().query("SELECT id, on_deploy, dispatch, owner_agent_id FROM tasks WHERE id IN (SELECT value FROM json_each(?))")
+      .all(JSON.stringify(event.changes.tasks.map(task => task.id))) as Array<{ id: number; on_deploy: string | null; dispatch: string | null; owner_agent_id: string | null }>;
+    const byId = new Map(notes.map(task => [task.id, task]));
+    event.changes.tasks = event.changes.tasks.map(task => {
+      const { onDeploy, ...snapshot } = task;
+      const current = byId.get(task.id);
+      const note = current ? current.on_deploy : onDeploy;
+      return { ...snapshot, ...(current ? { issues: deployTaskIssues(task.id, current.dispatch, current.owner_agent_id) } : {}), ...(note ? { onDeploy: note } : {}) };
+    });
+  }
+  return event;
+}
+
 /** Newest-first page of the deploy ledger for the dashboard timeline (#1327). */
 export function listDeployEvents(limit: number, offset: number): DeployEvent[] {
   const rows = getDb()
@@ -250,6 +270,11 @@ export function listDeployEventsNeedingChanges(limit: number): DeployEvent[] {
   return rows.map(rowToDeployEvent);
 }
 
+function deployTaskIssues(id: number, dispatch: string | null, ownerAgentId: string | null): DeployTaskChange["issues"] {
+  const relation = defaultTaskIssueRelation(parseJson<TaskDispatch | undefined>(dispatch, undefined), ownerAgentId ?? undefined);
+  return listIssuesForEntity("task", String(id)).map(item => ({ ...item.issueRef, relation: item.association.relation ?? relation }));
+}
+
 /**
  * Match a deploy's ordered commit list to every durable Task with an exact stored
  * commit SHA. This CD-only query loads the task commit payload once; the HTTP
@@ -258,7 +283,7 @@ export function listDeployEventsNeedingChanges(limit: number): DeployEvent[] {
 export function deployChangesForCommits(commits: DeployCommit[]): Pick<DeployChangesSummary, "tasks" | "unmatchedCommits"> {
   const rangeShas = new Set(commits.map((commit) => commit.sha));
   const matchedShas = new Set<string>();
-  const rows = getDb().query("SELECT id, title, commits FROM tasks WHERE kind = 'deliverable' AND commits IS NOT NULL ORDER BY id ASC").all() as any[];
+  const rows = getDb().query("SELECT id, title, commits, on_deploy, dispatch, owner_agent_id FROM tasks WHERE kind = 'deliverable' AND commits IS NOT NULL ORDER BY id ASC").all() as any[];
   const tasks: DeployTaskChange[] = [];
   for (const row of rows) {
     let taskCommits: Array<{ sha?: unknown }>;
@@ -268,7 +293,8 @@ export function deployChangesForCommits(commits: DeployCommit[]): Pick<DeployCha
     tasks.push({
       id: Number(row.id),
       label: String(row.title),
-      issues: listIssuesForEntity("task", String(row.id)).map((item) => item.issueRef),
+      issues: deployTaskIssues(Number(row.id), row.dispatch, row.owner_agent_id),
+      ...(row.on_deploy ? { onDeploy: String(row.on_deploy) } : {}),
     });
   }
   return { tasks, unmatchedCommits: commits.filter((commit) => !matchedShas.has(commit.sha)) };
@@ -316,6 +342,11 @@ export function renewDeployEventLease(input: { id: string; now?: number }): bool
   return writeTransaction(() => renewDeployEventLeaseBody(input, input.now ?? Date.now()));
 }
 
+/** Migration progress shares the existing deploy row and dashboard surface (#3470). */
+export function recordDeployEventHosts(id: string, hosts: DeployHost[]): boolean {
+  return getDb().query("UPDATE deploy_events SET hosts = ? WHERE id = ? AND status = 'pending'").run(JSON.stringify(hosts), id).changes > 0;
+}
+
 /**
  * Emergency operator recovery for a genuinely stranded deploy owner:
  * `bun run scripts/release.ts --clear-deploy-lease <event-id>` (→ `failed`), or

package/src/db/hosts-registration.ts

@@ -139,8 +139,16 @@ export type HardwareReconciliation =
 
 /** Capacity is an observed, runtime-varying property, not host identity. WSL2 in particular can
  * report less RAM after a reboot, and swap may appear/disappear with zram configuration. Keep the
- * latest value for placement without making a legitimate capacity change an anti-spoof conflict. */
-const TOLERANT_CAPACITY_HARDWARE_FIELDS = new Set(["totalMemMb", "totalStorageMb", "totalSwapMb"]);
+ * latest value for placement without making a legitimate capacity change an anti-spoof conflict.
+ * `osVersion` (the kernel string) changes on every OS patch; it is not hardware identity (#3770). */
+const TOLERANT_CAPACITY_HARDWARE_FIELDS = new Set(["totalMemMb", "totalStorageMb", "totalSwapMb", "osVersion"]);
+
+/** The identity-defining keys present on both sides with different values: what a conflict notice names. */
+export function conflictingHardwareFields(stored: HostHardware, reported: HostHardware): string[] {
+  const a = stored as unknown as Record<string, unknown>;
+  const b = reported as unknown as Record<string, unknown>;
+  return Object.keys(a).filter((key) => !TOLERANT_CAPACITY_HARDWARE_FIELDS.has(key) && a[key] !== undefined && b[key] !== undefined && a[key] !== b[key]).sort();
+}
 
 export function reconcileHardwareFields(stored: HostHardware, reported: HostHardware): HardwareReconciliation {
   const storedRec = stored as unknown as Record<string, unknown>;

package/src/db/hosts.ts

@@ -9,6 +9,7 @@ import type { Host, HostDaemonSample, HostHardware, HostMachineSample, HostPolic
 import { normalizeHostToken, parseJson } from "../utils";
 import { getDb } from "./connection.ts";
 import { primeHostAliases, type HostAliasRecord } from "../host/identity.ts";
+import { settleDiskWatch, type DiskAlert } from "../host/disk-alert.ts";
 import { settleGateArming, type GateCapacityAlert } from "../host/gate-capacity-alert.ts";
 
 function rowToHost(row: any): Host {
@@ -99,18 +100,20 @@ function storedSample<T extends { at: number }>(table: "hosts" | "orchestrators"
  */
 export function recordHostUtilizationInternal(
   input: { hostId: string; orchestratorId: string; machine: HostMachineSample; daemon: HostDaemonSample },
-): { hostUpdated: boolean; generationUpdated: boolean; gateAlert?: GateCapacityAlert; hostLabel?: string } {
+): { hostUpdated: boolean; generationUpdated: boolean; gateAlert?: GateCapacityAlert; diskAlert?: DiskAlert; hostLabel?: string } {
   // `last_seen_at` is deliberately NOT touched here: it is the Host's freshness clock and the §3.5
   // seam already bumps it on every beat with the RELAY's clock. `machine.at` is the PRODUCER's wall
   // clock, so writing it here would let a skewed daemon move a Host's liveness backwards.
   const prevHost = storedSample<HostMachineSample>("hosts", input.hostId);
   let hostUpdated = false;
   let gateAlert: GateCapacityAlert | undefined;
+  let diskAlert: DiskAlert | undefined;
   if (!prevHost || input.machine.at > prevHost.at) {
-    // #2822 — settled inside this single-writer read-modify-write, so each transition alerts once.
-    const settled = settleGateArming(prevHost ?? undefined, input.machine);
+    // #2822 / #3762 — settled inside this single-writer read-modify-write, so each transition alerts once.
+    const gate = settleGateArming(prevHost ?? undefined, input.machine);
+    const settled = settleDiskWatch(prevHost ?? undefined, gate.machine);
     hostUpdated = getDb().query("UPDATE hosts SET utilization = ? WHERE id = ?").run(JSON.stringify(settled.machine), input.hostId).changes > 0;
-    if (hostUpdated) gateAlert = settled.alert;
+    if (hostUpdated) { gateAlert = gate.alert; diskAlert = settled.alert; }
   }
 
   const generationAt = storedSample<HostDaemonSample>("orchestrators", input.orchestratorId)?.at ?? null;
@@ -118,9 +121,9 @@ export function recordHostUtilizationInternal(
     ? false
     : getDb().query("UPDATE orchestrators SET utilization = ? WHERE id = ?").run(JSON.stringify(input.daemon), input.orchestratorId).changes > 0;
 
-  if (!gateAlert) return { hostUpdated, generationUpdated };
+  if (!gateAlert && !diskAlert) return { hostUpdated, generationUpdated };
   const label = (getDb().query("SELECT label FROM hosts WHERE id = ?").get(input.hostId) as { label: string } | null)?.label;
-  return { hostUpdated, generationUpdated, gateAlert, hostLabel: label ?? input.hostId };
+  return { hostUpdated, generationUpdated, ...(gateAlert ? { gateAlert } : {}), ...(diskAlert ? { diskAlert } : {}), hostLabel: label ?? input.hostId };
 }
 
 export function setHostLabelInternal(id: string, label: string): Host | null {

package/src/db/inbox.ts

@@ -1,18 +1,4 @@
 import { randomUUID } from "node:crypto";
-import { isRecord, stringValue, isMechanicalMessageKind } from "@humwick/sdk";
-import { ORCHESTRATOR_PROTOCOL_VERSION, VERSION } from "../config.ts";
-import { parseJson } from "../utils";
-import { isLiveIsolatedWorkspace } from "../workspace-phase";
-import {
-  CONTRACT_REQUIREMENTS,
-  contractCompatibility,
-  parseRuntimeCapabilities,
-  parseRuntimeContracts,
-  parseRuntimePackage,
-  type RuntimeContracts,
-} from "../contracts";
-import { STALE_TTL_MS, DAY_MS, CLAIM_LEASE_MS, POOL_CLAIM_LEASE_MS, WORKSPACE_MERGE_LEASE_MS } from "../config";
-import { matchAgents } from "../agent-ref";
 import { ValidationError, getDb, writeTransaction } from "./connection.ts";
 import { rowToChatHistoryImport, rowToChatHistoryImportEntry, rowToInboxDraft, rowToInboxThreadState } from "./mappers.ts";
 import { getMessage } from "./messages.ts";