@humwick/server 0.130.1 → 0.130.2

package/src/services/issue-lifecycle.ts

@@ -8,9 +8,9 @@ import { listEntitiesForIssue, listIssuesForEntity } from "../db/issue-associati
 import {
   getSuccessfulIssueLifecycleAction,
   listSuccessfulCloseActionsForCommit,
-  upsertIssueLifecycleAction,
 } from "../db/issue-lifecycle";
-import { getIssueRef, resolveIssueRefByExternalKey, resolveIssueRefFromString, updateIssueRef } from "../db/issue-refs";
+import { getIssueRef } from "../db/issue-refs";
+import { resolveIssueRefByExternalKeyAsync, resolveIssueRefFromStringAsync, updateIssueRefAsync, upsertIssueLifecycleActionAsync } from "../db/issue-refs-async";
 import { associateIssue } from "../db/issue-associations";
 import { resolveIssueTrackerAdapter } from "../issue-tracker";
 import { defaultIssueRepo } from "../config";
@@ -141,42 +141,53 @@ const ISSUE_REF_AT_START_RE = /^(https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z
 const REF_SEPARATOR_RE = /^(?:\s*,\s*|\s+(?:and|&)\s+)/i;
 
 // A run of issue refs ("#1, #2 and owner/repo#3") starting at the head of `segment`.
-// Bare refs resolve against `fallbackDefaultRepo`; unresolvable ones are skipped so a
-// land never fails here.
-function collectRefRun(segment: string, fallbackDefaultRepo: string | undefined, into: IssueRef[]): void {
+function refRun(segment: string): string[] {
+  const refs: string[] = [];
   let rest = segment;
   while (rest.trim()) {
     rest = rest.trimStart();
     const refMatch = rest.match(ISSUE_REF_AT_START_RE);
     if (!refMatch) break;
-    try {
-      into.push(resolveIssueRefFromString({ ref: refMatch[1]!, defaultRepo: fallbackDefaultRepo }));
-    } catch {
-      // Invalid or bare-without-default refs are ignored; the land itself must never fail here.
-    }
+    refs.push(refMatch[1]!);
     rest = rest.slice(refMatch[0].length);
     const separator = rest.match(REF_SEPARATOR_RE);
     if (!separator) break;
     rest = rest.slice(separator[0].length);
   }
+  return refs;
 }
 
-export function parseClosingIssueRefs(text: string | undefined, fallbackDefaultRepo = defaultIssueRepo()): IssueRef[] {
-  if (!text) return [];
+// Bare refs resolve against `fallbackDefaultRepo`; unresolvable ones are skipped so a land never fails here.
+async function resolveRefRuns(segments: Iterable<string>, fallbackDefaultRepo: string | undefined): Promise<IssueRef[]> {
   const refs: IssueRef[] = [];
-  for (const match of text.matchAll(CLOSING_KEYWORD_RE)) collectRefRun(match[1] ?? "", fallbackDefaultRepo, refs);
+  for (const segment of segments) {
+    for (const ref of refRun(segment)) {
+      try {
+        refs.push(await resolveIssueRefFromStringAsync({ ref, defaultRepo: fallbackDefaultRepo }));
+      } catch {
+        // Invalid or bare-without-default refs are ignored; the land itself must never fail here.
+      }
+    }
+  }
   return issueRefMap(refs);
 }
 
+export function parseClosingIssueRefsAsync(text: string | undefined, fallbackDefaultRepo = defaultIssueRepo()): Promise<IssueRef[]> {
+  return resolveRefRuns(text ? [...text.matchAll(CLOSING_KEYWORD_RE)].map((match) => match[1] ?? "") : [], fallbackDefaultRepo);
+}
+
 // Parenthesized backlink groups: the trailing `(#NNN)` convention agents (and a squash merge)
 // stamp on a subject without a closing keyword. Non-issue parens (conventional-commit scopes
 // like `fix(tokens)`, notes like `(see also)`) carry no `#` and fall out.
 const BACKLINK_GROUP_RE = /\(([^()]*#[0-9]+[^()]*)\)/g;
 
-export function parseBacklinkIssueRefs(text: string | undefined, fallbackDefaultRepo = defaultIssueRepo()): IssueRef[] {
-  if (!text) return [];
+export function parseBacklinkIssueRefsAsync(text: string | undefined, fallbackDefaultRepo = defaultIssueRepo()): Promise<IssueRef[]> {
+  return resolveRefRuns(text ? [...text.matchAll(BACKLINK_GROUP_RE)].map((group) => group[1] ?? "") : [], fallbackDefaultRepo);
+}
+
+async function eachSubject(subjects: string[], parse: (text: string) => Promise<IssueRef[]>): Promise<IssueRef[]> {
   const refs: IssueRef[] = [];
-  for (const group of text.matchAll(BACKLINK_GROUP_RE)) collectRefRun(group[1] ?? "", fallbackDefaultRepo, refs);
+  for (const subject of subjects) refs.push(...await parse(subject));
   return issueRefMap(refs);
 }
 
@@ -190,13 +201,13 @@ async function resolveIssueRefsForLand(input: LandedIssueLifecycleInput, links:
   const associated = issueRefMap(links.flatMap((link) => link.issues.filter((issue) => issue.relation === "delivers").map((issue) => issue.ref)));
   const fallbackDefaultRepo = await landDefaultRepo(input.workspace);
   const subjects = landedSubjectTexts(input);
-  const keyworded = issueRefMap(subjects.flatMap((subject) => parseClosingIssueRefs(subject, fallbackDefaultRepo)));
+  const keyworded = await eachSubject(subjects, (subject) => parseClosingIssueRefsAsync(subject, fallbackDefaultRepo));
   // A commit declaration is authored at the change boundary, unlike a Task association
   // which can legitimately be historical or span several work items. It is the sole close
   // target when present (#1694).
   if (keyworded.length > 0) return { source: "commit", refs: keyworded, declared: keyworded };
   if (!input.prLand && links.some((link) => link.buildLike)) {
-    const backlinks = issueRefMap(subjects.flatMap((subject) => parseBacklinkIssueRefs(subject, fallbackDefaultRepo)))
+    const backlinks = (await eachSubject(subjects, (subject) => parseBacklinkIssueRefsAsync(subject, fallbackDefaultRepo)))
       .filter((ref) => canCloseBacklink(ref, links));
     if (backlinks.length) return { source: "backlink", refs: backlinks, declared: backlinks };
   }
@@ -348,7 +359,7 @@ async function reconcileClosedIssueRefBeforeSkip(issueRef: IssueRef, opts: Issue
       // LOW-4 (#2520 review) — thread the live closeReason through: a completed close observed
       // here was dropped, so the cached ref stayed reason-less and could never count as a
       // completed close. updateIssueRef preserves the cached reason when live carries none.
-      issueRef: updateIssueRef(issueRef.id, { status, title: live.title, closeReason: live.closeReason, statusSyncedAt: Date.now() }) ?? issueRef,
+      issueRef: await updateIssueRefAsync(issueRef.id, { status, title: live.title, closeReason: live.closeReason, statusSyncedAt: Date.now() }) ?? issueRef,
       liveStatus: live.status,
     };
   } catch (error) {
@@ -406,7 +417,7 @@ export async function closeIssueRefForLand(
         logFailure(opts, `issue lifecycle epic-guard title lookup returned no title for ${latest.id} on ${key}`);
         return { issueRef: latest, action: "skipped", reason: "title-unavailable", landKey: key };
       }
-      latest = updateIssueRef(latest.id, { title, statusSyncedAt: Date.now() }) ?? latest;
+      latest = await updateIssueRefAsync(latest.id, { title, statusSyncedAt: Date.now() }) ?? latest;
     } catch (error) {
       logFailure(opts, `issue lifecycle epic-guard title lookup failed for ${latest.id} on ${key}: ${errMessage(error)}`);
       return { issueRef: latest, action: "skipped", reason: "title-unavailable", landKey: key };
@@ -423,22 +434,25 @@ export async function closeIssueRefForLand(
     return { issueRef: latest, action: "skipped", reason: "epic-issue", landKey: key };
   }
 
+  const closeAction = {
+    issueRefId: latest.id,
+    action: "close" as const,
+    landKey: key,
+    workspaceId: input.workspace.id,
+    branch: input.workspace.branch,
+    baseRef: input.workspace.baseRef ?? "main",
+    commitSha: input.mergedSha,
+    commitSubject: input.subject,
+    agentId: input.workspace.ownerAgentId,
+    source,
+  };
   let openSubIssues: IssueTrackerIssueSummary[];
   try {
     openSubIssues = await listOpenSubIssuesForLand(latest, opts);
   } catch (error) {
     const message = `sub-issue lookup failed: ${errMessage(error)}`;
-    upsertIssueLifecycleAction({
-      issueRefId: latest.id,
-      action: "close",
-      landKey: key,
-      workspaceId: input.workspace.id,
-      branch: input.workspace.branch,
-      baseRef: input.workspace.baseRef ?? "main",
-      commitSha: input.mergedSha,
-      commitSubject: input.subject,
-      agentId: input.workspace.ownerAgentId,
-      source,
+    await upsertIssueLifecycleActionAsync({
+      ...closeAction,
       status: "failed",
       error: message,
     });
@@ -458,18 +472,9 @@ export async function closeIssueRefForLand(
   const comment = closeAuditComment(input);
   try {
     await adapterFor(latest, opts).close(latest, { comment, labels: ["fixed"], closeReason: "completed" });
-    const closed = updateIssueRef(latest.id, { status: "closed", closeReason: "completed", statusSyncedAt: Date.now() }) ?? latest;
-    upsertIssueLifecycleAction({
-      issueRefId: latest.id,
-      action: "close",
-      landKey: key,
-      workspaceId: input.workspace.id,
-      branch: input.workspace.branch,
-      baseRef: input.workspace.baseRef ?? "main",
-      commitSha: input.mergedSha,
-      commitSubject: input.subject,
-      agentId: input.workspace.ownerAgentId,
-      source,
+    const closed = await updateIssueRefAsync(latest.id, { status: "closed", closeReason: "completed", statusSyncedAt: Date.now() }) ?? latest;
+    await upsertIssueLifecycleActionAsync({
+      ...closeAction,
       comment,
       status: "succeeded",
     });
@@ -494,17 +499,8 @@ export async function closeIssueRefForLand(
     return { issueRef: closed, action: "closed", source, landKey: key };
   } catch (error) {
     const message = errMessage(error);
-    upsertIssueLifecycleAction({
-      issueRefId: latest.id,
-      action: "close",
-      landKey: key,
-      workspaceId: input.workspace.id,
-      branch: input.workspace.branch,
-      baseRef: input.workspace.baseRef ?? "main",
-      commitSha: input.mergedSha,
-      commitSubject: input.subject,
-      agentId: input.workspace.ownerAgentId,
-      source,
+    await upsertIssueLifecycleActionAsync({
+      ...closeAction,
       comment,
       status: "failed",
       error: message,
@@ -564,15 +560,15 @@ export async function handleLandedIssueLifecycle(input: LandedIssueLifecycleInpu
   return { source: resolved.source, closed, reopened, skipped: [], mismatches };
 }
 
-function resolveReopenRef(input: ReopenIssueLifecycleInput): IssueRef {
+async function resolveReopenRef(input: ReopenIssueLifecycleInput): Promise<IssueRef> {
   if (input.issueRefId) {
     const issueRef = getIssueRef(input.issueRefId);
     if (!issueRef) throw new Error(`issue ref ${input.issueRefId} not found`);
     return issueRef;
   }
-  if (input.ref) return resolveIssueRefFromString({ ref: input.ref, defaultRepo: input.defaultRepo ?? input.repo, provider: input.provider, title: input.title });
+  if (input.ref) return resolveIssueRefFromStringAsync({ ref: input.ref, defaultRepo: input.defaultRepo ?? input.repo, provider: input.provider, title: input.title });
   if (input.provider && input.repo && input.externalKey) {
-    return resolveIssueRefByExternalKey({
+    return resolveIssueRefByExternalKeyAsync({
       provider: input.provider,
       repo: input.repo,
       externalKey: input.externalKey,
@@ -584,14 +580,14 @@ function resolveReopenRef(input: ReopenIssueLifecycleInput): IssueRef {
 }
 
 export async function reopenIssueLifecycle(input: ReopenIssueLifecycleInput, opts: IssueLifecycleOptions = {}): Promise<ReopenIssueLifecycleResult> {
-  const issueRef = resolveReopenRef(input);
+  const issueRef = await resolveReopenRef(input);
   const key = manualReopenKey(issueRef);
   if (issueRef.status === "open") return { issueRef, action: "skipped", reason: "already-open", landKey: key };
   const comment = input.comment ?? "Reopened by Humwick issue lifecycle.";
   try {
     await adapterFor(issueRef, opts).reopen(issueRef, { comment });
-    const opened = updateIssueRef(issueRef.id, { status: "open", statusSyncedAt: Date.now() }) ?? issueRef;
-    upsertIssueLifecycleAction({
+    const opened = await updateIssueRefAsync(issueRef.id, { status: "open", statusSyncedAt: Date.now() }) ?? issueRef;
+    await upsertIssueLifecycleActionAsync({
       issueRefId: issueRef.id,
       action: "reopen",
       landKey: key,
@@ -604,7 +600,7 @@ export async function reopenIssueLifecycle(input: ReopenIssueLifecycleInput, opt
     return { issueRef: opened, action: "reopened", landKey: key };
   } catch (error) {
     const message = errMessage(error);
-    upsertIssueLifecycleAction({
+    await upsertIssueLifecycleActionAsync({
       issueRefId: issueRef.id,
       action: "reopen",
       landKey: key,

package/src/services/issue-refs.ts

@@ -1,11 +1,7 @@
+import { deleteIssueRefAsync, resolveIssueRefByExternalKeyAsync, resolveIssueRefFromStringAsync, updateIssueRefAsync, upsertIssueRefAsync } from "../db/issue-refs-async";
 import {
-  deleteIssueRef,
   getIssueRef,
   listIssueRefs,
-  resolveIssueRefByExternalKey,
-  resolveIssueRefFromString,
-  updateIssueRef,
-  upsertIssueRef,
   type ListIssueRefsOptions,
   type ResolveIssueRefByExternalKeyInput,
   type ResolveIssueRefFromStringInput,
@@ -15,20 +11,20 @@ import {
 
 export { getIssueRef, listIssueRefs, type ListIssueRefsOptions };
 
-export function upsertIssueRefMapping(input: UpsertIssueRefInput) {
-  return upsertIssueRef(input);
+export function upsertIssueRefMappingAsync(input: UpsertIssueRefInput) {
+  return upsertIssueRefAsync(input);
 }
 
-export function resolveIssueRefMapping(input: ResolveIssueRefByExternalKeyInput | ResolveIssueRefFromStringInput) {
-  return "ref" in input ? resolveIssueRefFromString(input) : resolveIssueRefByExternalKey(input);
+export function resolveIssueRefMappingAsync(input: ResolveIssueRefByExternalKeyInput | ResolveIssueRefFromStringInput) {
+  return "ref" in input ? resolveIssueRefFromStringAsync(input) : resolveIssueRefByExternalKeyAsync(input);
 }
 
-export function patchIssueRefMapping(id: string, input: UpdateIssueRefInput) {
-  return updateIssueRef(id, input);
+export function patchIssueRefMappingAsync(id: string, input: UpdateIssueRefInput) {
+  return updateIssueRefAsync(id, input);
 }
 
-export function deleteIssueRefMapping(id: string) {
-  return deleteIssueRef(id);
+export function deleteIssueRefMappingAsync(id: string) {
+  return deleteIssueRefAsync(id);
 }
 
 // --- Caller-supplied issue-ref normalization (#2214/#1930) ---------------------------------

package/src/services/kernel-timers-cutover-chaos-worker.ts

@@ -24,6 +24,8 @@ const releaseFile = process.env.CUTOVER_CHAOS_RELEASE_FILE;
 const resultFile = process.env.CUTOVER_CHAOS_RESULT_FILE;
 const owner = process.env.CUTOVER_CHAOS_OWNER ?? `worker-${process.pid}`;
 const leaseMs = Number(process.env.CUTOVER_CHAOS_LEASE_MS ?? "400");
+let now = Number(required("CUTOVER_CHAOS_NOW"));
+const clock = () => now;
 
 function required(name: string): string {
   const value = relayEnv(process.env, name);
@@ -60,7 +62,7 @@ function timerInput(idSuffix = String(process.pid)): CreateScheduledTimerRowInpu
     createdByKind: "system",
     createdByScopes: ["message:send"],
     deliveryFrom: "system",
-    nextRunAt: Date.now() + 100_000,
+    nextRunAt: now + 100_000,
     scheduleKind: "once",
     scheduleDef: { afterMs: 100_000 },
     body: `cutover-${idSuffix}`,
@@ -87,6 +89,7 @@ async function main(): Promise<void> {
     };
     const c = new TimerMessageCutoverCoordinator({
       ownerId: owner,
+      now: clock,
       leaseMs,
       tickMs: 25,
       quiesceTimeoutMs: 5_000,
@@ -94,7 +97,7 @@ async function main(): Promise<void> {
       faults,
     });
     await c.requestQuiesce();
-    if (boundary === "after-renewal") await Bun.sleep(Math.ceil(leaseMs * 0.75));
+    if (boundary === "after-renewal") now += Math.ceil(leaseMs * 0.75);
     await c.tick();
     await c.tick();
     await c.tick();
@@ -112,7 +115,7 @@ async function main(): Promise<void> {
     const ticks = phaseTicks[boundary];
     if (ticks === undefined) throw new Error(`unknown deadline-watch phase ${boundary}`);
     const c = new TimerMessageCutoverCoordinator({
-      ownerId: owner, leaseMs: 10_000, tickMs: 25, quiesceTimeoutMs: 8_000, worstCaseDrainTransferMs: 10_000,
+      ownerId: owner, now: clock, leaseMs: 10_000, tickMs: 25, quiesceTimeoutMs: 8_000, worstCaseDrainTransferMs: 10_000,
     });
     await c.requestQuiesce();
     for (let i = 0; i < ticks; i++) await c.tick();
@@ -124,14 +127,14 @@ async function main(): Promise<void> {
 
   if (command === "claim-bound") {
     const c = new TimerMessageCutoverCoordinator({
-      ownerId: owner, leaseMs: 1_000, tickMs: 25, quiesceTimeoutMs: 300, worstCaseDrainTransferMs: 1_000,
+      ownerId: owner, now: clock, leaseMs: 1_000, tickMs: 25, quiesceTimeoutMs: 300, worstCaseDrainTransferMs: 1_000,
     });
     await c.requestQuiesce();
     await c.tick();
     await c.tick();
     const drain = await c.tick();
     if (boundary === "held") {
-      await Bun.sleep(340);
+      now += 340;
       await c.tick();
       await c.tick();
     }
@@ -141,7 +144,7 @@ async function main(): Promise<void> {
 
   if (command === "recover") {
     const c = new TimerMessageCutoverCoordinator({
-      ownerId: owner, leaseMs, tickMs: 25, quiesceTimeoutMs: 5_000, worstCaseDrainTransferMs: 6_000,
+      ownerId: owner, now: clock, leaseMs, tickMs: 25, quiesceTimeoutMs: 5_000, worstCaseDrainTransferMs: 6_000,
     });
     const outcomes = [];
     for (let i = 0; i < 5; i++) outcomes.push(await c.tick());
@@ -152,7 +155,7 @@ async function main(): Promise<void> {
   if (command === "close-gate") {
     marker();
     const c = new TimerMessageCutoverCoordinator({
-      ownerId: owner, leaseMs: 5_000, tickMs: 25, quiesceTimeoutMs: 5_000, worstCaseDrainTransferMs: 6_000,
+      ownerId: owner, now: clock, leaseMs: 5_000, tickMs: 25, quiesceTimeoutMs: 5_000, worstCaseDrainTransferMs: 6_000,
     });
     const acquired = await c.requestQuiesce();
     const outcome = acquired ? await c.tick() : null;

package/src/services/kernel-timers-ingress.ts

@@ -322,7 +322,7 @@ export class TimerIngressRejectedError extends Error {
 }
 
 export function createTimerIngress(options: TimerIngressOptions): TimerIngress {
-  installTimerIngressSchema();
+  installTimerIngressSchema({ ifNotInstalled: true });
   const apply = options.apply;
   const ownerId = options.ownerId ?? `${process.pid}-${randomUUID()}`;
   const now = options.now ?? Date.now;

package/src/services/landed-ancestry.ts

@@ -1,3 +1,5 @@
+import { repoDefaultBranch } from "@humwick/sdk/land-gates";
+import { withWorkspaceTaskOwnerRoles } from "../task-owner-notices";
 // #1713 — the coordinator's "landed" signal, derived from GIT ANCESTRY rather than a command's
 // reported status. The observed bug: a worker delivers `complete`, the merge executor stalls, and
 // the coordinator is nonetheless told the work is "complete"/"landed" while `origin/main` is
@@ -113,7 +115,8 @@ const realVerifier: AncestryVerifier = async (repoRoot, sha, targetRef) => {
   // source of truth; a fetch failure/timeout is swallowed — the checks below then run against
   // whatever refs are already local, preserving the prior fail-closed behavior exactly.
   const remoteBranch = ref.startsWith("origin/") ? ref.slice("origin/".length) : ref;
-  if (remoteBranch) await gitStatus(root, ["fetch", "--quiet", "origin", remoteBranch], GIT_FETCH_TIMEOUT_MS);
+  const fetched = remoteBranch ? await gitStatus(root, ["fetch", "--quiet", "origin", `+refs/heads/${remoteBranch}:refs/remotes/origin/${remoteBranch}`], GIT_FETCH_TIMEOUT_MS) : null;
+  if (ref.startsWith("origin/") && fetched !== 0) return "unresolvable";
   // The sha itself must resolve to a commit in this repo, else ancestry is unknowable (not a
   // negative). `--verify --quiet ^{commit}` distinguishes "sha absent" from "sha present but not
   // on the ref".
@@ -246,6 +249,18 @@ export async function verifyLandedAncestry(repoRoot: string | undefined, sha: st
   }
 }
 
+/** Notice proof requires the freshly fetched remote; a local-only main never qualifies (#3761). */
+export async function verifyPublishedLand(repoRoot: string | undefined, sha: string | undefined, baseRef?: string): Promise<LandedAncestryVerdict> {
+  if (!repoRoot || !sha?.trim()) return "unresolvable";
+  try {
+    const base = baseRef ?? await repoDefaultBranch(async args => {
+      const result = await gitOutput(repoRoot, args);
+      return { ok: result?.exitCode === 0, stdout: result?.stdout ?? "", unavailable: !result };
+    });
+    return base ? await verifyLandedAncestry(repoRoot, sha, base.startsWith("origin/") ? base : `origin/${base}`) : "unresolvable";
+  } catch { return "unresolvable"; }
+}
+
 // #2718 — the landing host's own fresh-fetch ancestry check (`landVerifiedSha`) is ref-backed proof
 // that works wherever the repo lives; the hub's check needs a checkout of the same remote on its own
 // disk. Without a matching host verdict, fall back to the hub check (an absent path never confirms).
@@ -366,6 +381,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
   const { subject, body } = landUnconfirmedText(input);
 
   const payload = {
+    verified: false,
     kind: "workspace.land-unconfirmed",
     notification: "land-unconfirmed",
     landOutcome: kind,
@@ -397,7 +413,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
     metadata: { source: "server", maintenanceJobId: "workspace-land-unconfirmed", workspaceId: workspace.id, mergeCommandId: input.commandId, landOutcome: kind },
   });
 
-  const recipients = [...new Set([owner, coordinator, fallback].filter((r): r is string => Boolean(r)))];
+  const recipients = withWorkspaceTaskOwnerRoles([owner, coordinator, fallback], workspace);
   if (recipients.length === 0) return;
   routeNotification({
     type: "workspace.land_unconfirmed",
@@ -407,7 +423,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
     forceDelivery: true,
     message: {
       subject,
-      body,
+      body: `${body} verified: false.`,
       payload,
       idempotencyKey: kind === "merge-failed" ? landFailureEventKey(workspace, input.commandId)
         : `land-unconfirmed:${workspace.id}:${input.commandId ?? "nocmd"}:${kind}`,

package/src/services/memory-areas.ts

@@ -2,15 +2,13 @@
 // (relay_project_write_entry, relay_store_memory, the project-entry REST routes) resolves the
 // vocabulary and the stored value here, so the closed vocabulary cannot drift between them.
 
-import { AREAS_FILE, SYSTEM_AREAS, SYSTEM_AREA_DESCRIPTIONS, areasAtCommit, injectsAtStartup, isSystemArea, readAreasAtDefaultBranch, type AreaDefinition, type AreasAtCommit } from "@humwick/sdk/areas";
-import { errMessage, stringValue } from "@humwick/sdk";
-import { countActivePinnedEntriesInArea, getAgent, rootsForProject, ValidationError } from "../db";
-import { localProjectGit, readHostProjectFiles } from "../project-roles";
-import { hostIsRelayHost } from "../relay-host-locality";
+import { AREAS_FILE, SYSTEM_AREAS, SYSTEM_AREA_DESCRIPTIONS, areasAtCommit, injectsAtStartup, isSystemArea, type AreaDefinition, type AreasConfig } from "@humwick/sdk/areas";
+import { stringValue } from "@humwick/sdk";
+import { countActivePinnedEntriesInArea, getAgent, ValidationError } from "../db";
 import type { Project, ProjectEntry } from "../types";
 import type { AuthContext } from "./auth-context";
 import { callerHost, callerProjectId } from "./memory-identity";
-import { resolveProjectFilesHost } from "./spawn-project-role";
+import { readProjectConfig, readProjectConfigFirst, type ConfigLookup, type ProjectCheckout } from "./project-config-read";
 
 export const MAX_ENTRY_AREAS = 4;
 const PROJECT_WIDE = "project-wide";
@@ -47,42 +45,15 @@ export function areaCallerFromCtx(ctx: AuthContext): AreaCaller {
 }
 
 /** A checkout to read areas.json from: a cwd on a host (a hostname or a registered orchestrator). */
-export interface AreasCheckout {
-  cwd: string;
-  host?: string;
-  orchestratorId?: string;
-}
-
-export type AreasLookup = AreasAtCommit | { status: "unreadable"; error: string };
+export type AreasCheckout = ProjectCheckout;
 
-const loggedProblems = new Set<string>();
+export type AreasLookup = ConfigLookup<AreasConfig>;
 
-function logProblemOnce(key: string, problem: string): void {
-  if (loggedProblems.has(key)) return;
-  if (loggedProblems.size >= 1000) loggedProblems.clear();
-  loggedProblems.add(key);
-  console.warn(`[memory-areas] ${AREAS_FILE} for ${key}: ${problem}; accepting system areas only`);
-}
+const ACCEPTING_SYSTEM_AREAS = "accepting system areas only";
 
-/** #3635 — the areas.json at the checkout's default branch (origin/<default>, fetched first), read
- *  on the checkout's host through the #3043 project-files reader. Never a working tree and never
- *  cached, so a stale checkout or an old negative answer cannot hide a file that landed. */
-export async function readAreasConfig(checkout: AreasCheckout): Promise<AreasLookup> {
-  const where = `${checkout.orchestratorId ?? checkout.host ?? "local"}:${checkout.cwd}`;
-  try {
-    const lookup = !checkout.orchestratorId && hostIsRelayHost(checkout.host)
-      ? await readAreasAtDefaultBranch(localProjectGit(checkout.cwd))
-      : areasAtCommit(await readHostProjectFiles(
-        resolveProjectFilesHost({ subject: AREAS_FILE, cwd: checkout.cwd, orchestratorId: checkout.orchestratorId, preferHost: checkout.host }),
-        checkout.cwd, { paths: [AREAS_FILE] }, AREAS_FILE,
-      ));
-    if (lookup.status === "invalid") logProblemOnce(`${where}@${lookup.sha}`, `invalid: ${lookup.error}`);
-    return lookup;
-  } catch (err) {
-    const error = errMessage(err);
-    logProblemOnce(where, `unreadable: ${error}`);
-    return { status: "unreadable", error };
-  }
+/** #3635 — the areas.json at the checkout's default branch, through the shared project-config reader. */
+export function readAreasConfig(checkout: AreasCheckout): Promise<AreasLookup> {
+  return readProjectConfig(checkout, AREAS_FILE, areasAtCommit, ACCEPTING_SYSTEM_AREAS);
 }
 
 function invalidDetail(lookup: Extract<AreasLookup, { status: "invalid" }>): string {
@@ -94,18 +65,11 @@ function invalidDetail(lookup: Extract<AreasLookup, { status: "invalid" }>): str
  *  answers. Every other cell (base/provider/host) takes system areas only, optionally. */
 export async function resolveAreaVocabulary(anchor: Project, caller: AreaCaller | undefined): Promise<AreaVocabulary> {
   if (anchor.scope !== "project") return { pathAreas: [], required: false, pathAreasMissing: "not-project" };
-  const checkouts: AreasCheckout[] = [
-    ...(caller?.cwd && caller.projectId === anchor.id ? [{ cwd: caller.cwd, host: caller.host }] : []),
-    ...rootsForProject(anchor.id).map((root) => ({ cwd: root.rootPath, ...(root.orchestratorId ? { orchestratorId: root.orchestratorId } : {}) })),
-  ];
-  const failures: string[] = [];
-  for (const checkout of checkouts) {
-    const lookup = await readAreasConfig(checkout);
-    if (lookup.status === "found") return { pathAreas: lookup.config.areas, required: true };
-    if (lookup.status === "absent") return { pathAreas: [], required: false, pathAreasMissing: "undeclared" };
-    if (lookup.status === "invalid") return { pathAreas: [], required: false, pathAreasMissing: "invalid", pathAreasDetail: invalidDetail(lookup) };
-    failures.push(lookup.error);
-  }
+  const preferred = caller?.cwd && caller.projectId === anchor.id ? [{ cwd: caller.cwd, host: caller.host }] : [];
+  const { lookup, failures } = await readProjectConfigFirst(anchor.id, preferred, AREAS_FILE, areasAtCommit, ACCEPTING_SYSTEM_AREAS);
+  if (lookup?.status === "found") return { pathAreas: lookup.config.areas, required: true };
+  if (lookup?.status === "absent") return { pathAreas: [], required: false, pathAreasMissing: "undeclared" };
+  if (lookup?.status === "invalid") return { pathAreas: [], required: false, pathAreasMissing: "invalid", pathAreasDetail: invalidDetail(lookup) };
   return { pathAreas: [], required: false, pathAreasMissing: "unreadable", pathAreasDetail: failures.join("; ") || "the project has no checkout to read it from" };
 }
 

package/src/services/plan-ci-notice.ts

@@ -0,0 +1,57 @@
+// #3716 — workflow effects read CI episodes without depending on workflow launch or recovery.
+import { ValidationError } from "../db/connection";
+import { computeCiFailureFingerprint } from "../ci/incidents";
+import type { CiShaObservation } from "../db/ci-incidents";
+import type { StoredPlanCiBlock } from "../db/plan-ci-blocks";
+import { getGateway } from "../db/gateway";
+import { getPlanGraphProjectionAsync } from "../db/plan-graph-async";
+import { planNoticeTarget } from "../db/plan-completion";
+import { notifySystemMessage } from "../notify";
+import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
+
+/** Same watch and landed SHA, or the same failing jobs: an unrelated red main must not quiet this failure. */
+export async function correlatedCiIncidents(rows: Array<{ workflow: string; row?: CiShaObservation }>): Promise<string[]> {
+  const ids: string[] = [];
+  for (const { workflow, row } of rows) {
+    if (!row) return [];
+    const incident = await getGateway().read("ciIncidents.activeForWatch", { watchKey: row.watchKey });
+    if (!incident) return [];
+    if (incident.openedHeadSha !== row.headSha) {
+      if (!row.failingJobs?.length) return [];
+      const fingerprint = computeCiFailureFingerprint({ workflow, failingRuns: [{ id: "sha", status: "completed", jobs: row.failingJobs.map((job) => ({ id: job.name, name: job.name })) }], conclusion: "failure" });
+      if (fingerprint !== incident.fingerprint) return [];
+    }
+    ids.push(incident.id);
+  }
+  return [...new Set(ids)].sort();
+}
+
+/** Return a quiet receipt only after both the blocked attempt and the actionable plan notice are durable. */
+export async function planCiNotice(run: WorkflowRunRecord, payload: Record<string, unknown>, result = false): Promise<Record<string, unknown> | undefined> {
+  const owner = await getGateway().read("planDispatch.owner", { taskId: run.taskId });
+  if (!owner || owner.audit) return undefined;
+  let block = await getGateway().read("planDispatch.ci.block", { runId: run.id });
+  const incidentIds = Array.isArray(payload.incidentIds) ? payload.incidentIds.filter((id): id is string => typeof id === "string") : [];
+  if (!result && incidentIds.length && typeof payload.landedSha === "string") {
+    try {
+      block = await getGateway().write("planDispatch.ci.block", { planId: owner.planId, taskId: run.taskId, runId: run.id, sha: payload.landedSha, incidentIds, waitKey: run.escalation?.waitKey ?? "" }) as unknown as StoredPlanCiBlock;
+    } catch (error) {
+      // A superseded attempt must still send its normal CI notice (#3660).
+      if (error instanceof ValidationError && error.message === "CI blocker no longer owns its plan slot") return undefined;
+      throw error;
+    }
+  }
+  if (!block || (result && (block.retriedAt !== undefined || block.waitKey !== run.escalation?.waitKey)) || (!result && !incidentIds.length)) return undefined;
+  const plan = await getPlanGraphProjectionAsync({ planId: owner.planId });
+  const to = plan && planNoticeTarget(plan);
+  if (!to) return undefined;
+  for (const incidentId of block.incidentIds) {
+    notifySystemMessage(to, {
+      subject: `Plan ${plan.title ?? plan.id}: CI blocked`,
+      body: `Plan ${plan.id}: T${run.taskId}, run ${run.id}, landed SHA ${block.sha}, is blocked by CI incident ${incidentId}. Fix the incident; Relay automatically retries each blocked run's exact landed SHA after clearance. Slots and dependents wait. relay_plan_get shows every blocked Task and run.`,
+      idempotencyKey: `plan:${plan.id}:ci:${incidentId}`, replyExpected: false,
+      payload: { kind: "plan.ci-blocked", planId: plan.id, incidentId, taskId: run.taskId, runId: run.id, landedSha: block.sha },
+    });
+  }
+  return { quiet: "plan-ci-episode", planId: owner.planId, incidentIds: block.incidentIds };
+}

package/src/services/plan-ci-recovery.ts

@@ -1,62 +1,9 @@
-// #3660 — correlate only known CI episodes; clearance reuses the original run's CI resume path.
-import { ValidationError } from "../db/connection";
-import { computeCiFailureFingerprint } from "../ci/incidents";
-import type { CiShaObservation } from "../db/ci-incidents";
+// #3660 — clearance reuses the original run's CI resume path.
+import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
 import type { StoredPlanCiBlock } from "../db/plan-ci-blocks";
 import { getGateway } from "../db/gateway";
-import { getPlanGraphProjectionAsync } from "../db/plan-graph-async";
-import { planNoticeTarget } from "../db/plan-completion";
-import { notifySystemMessage } from "../notify";
-import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
 import { resumeWorkflowRun } from "./workflow-runs";
 
-/** Same watch and landed SHA, or the same failing jobs: an unrelated red main must not quiet this failure. */
-export async function correlatedCiIncidents(rows: Array<{ workflow: string; row?: CiShaObservation }>): Promise<string[]> {
-  const ids: string[] = [];
-  for (const { workflow, row } of rows) {
-    if (!row) return [];
-    const incident = await getGateway().read("ciIncidents.activeForWatch", { watchKey: row.watchKey });
-    if (!incident) return [];
-    if (incident.openedHeadSha !== row.headSha) {
-      if (!row.failingJobs?.length) return [];
-      const fingerprint = computeCiFailureFingerprint({ workflow, failingRuns: [{ id: "sha", status: "completed", jobs: row.failingJobs.map((job) => ({ id: job.name, name: job.name })) }], conclusion: "failure" });
-      if (fingerprint !== incident.fingerprint) return [];
-    }
-    ids.push(incident.id);
-  }
-  return [...new Set(ids)].sort();
-}
-
-/** Return a quiet receipt only after both the blocked attempt and the actionable plan notice are durable. */
-export async function planCiNotice(run: WorkflowRunRecord, payload: Record<string, unknown>, result = false): Promise<Record<string, unknown> | undefined> {
-  const owner = await getGateway().read("planDispatch.owner", { taskId: run.taskId });
-  if (!owner || owner.audit) return undefined;
-  let block = await getGateway().read("planDispatch.ci.block", { runId: run.id });
-  const incidentIds = Array.isArray(payload.incidentIds) ? payload.incidentIds.filter((id): id is string => typeof id === "string") : [];
-  if (!result && incidentIds.length && typeof payload.landedSha === "string") {
-    try {
-      block = await getGateway().write("planDispatch.ci.block", { planId: owner.planId, taskId: run.taskId, runId: run.id, sha: payload.landedSha, incidentIds, waitKey: run.escalation?.waitKey ?? "" }) as unknown as StoredPlanCiBlock;
-    } catch (error) {
-      // A superseded attempt must still send its normal CI notice (#3660).
-      if (error instanceof ValidationError && error.message === "CI blocker no longer owns its plan slot") return undefined;
-      throw error;
-    }
-  }
-  if (!block || (result && (block.retriedAt !== undefined || block.waitKey !== run.escalation?.waitKey)) || (!result && !incidentIds.length)) return undefined;
-  const plan = await getPlanGraphProjectionAsync({ planId: owner.planId });
-  const to = plan && planNoticeTarget(plan);
-  if (!to) return undefined;
-  for (const incidentId of block.incidentIds) {
-    notifySystemMessage(to, {
-      subject: `Plan ${plan.title ?? plan.id}: CI blocked`,
-      body: `Plan ${plan.id}: T${run.taskId}, run ${run.id}, landed SHA ${block.sha}, is blocked by CI incident ${incidentId}. Fix the incident; Relay automatically retries each blocked run's exact landed SHA after clearance. Slots and dependents wait. relay_plan_get shows every blocked Task and run.`,
-      idempotencyKey: `plan:${plan.id}:ci:${incidentId}`, replyExpected: false,
-      payload: { kind: "plan.ci-blocked", planId: plan.id, incidentId, taskId: run.taskId, runId: run.id, landedSha: block.sha },
-    });
-  }
-  return { quiet: "plan-ci-episode", planId: owner.planId, incidentIds: block.incidentIds };
-}
-
 /** A kernel resume note is the durable receipt if the process dies before marking the plan's row. */
 export async function recoverPlanCiBlock(run: WorkflowRunRecord): Promise<StoredPlanCiBlock | null> {
   const block = await getGateway().read("planDispatch.ci.block", { runId: run.id });