@humwick/server 0.130.1 → 0.130.3

package/src/branch-landed.ts

@@ -1,9 +1,12 @@
+import { insertLandingReceiptAsync } from "./db/runtime-tail-async";
+import { createActivityEventAsync } from "./db/activity-async";
+import { announceVerifiedLand } from "./branch-land-notice";
 import { errMessage, isHumanAgentId, type BaseWorktreeSyncResult } from "@humwick/sdk";
 import { emitRelayEvent } from "./events";
 import { routeNotification, INFORMATIONAL_TTL_MS } from "./notification-router";
 import { stampLifecycleSignal, taskSignalKey } from "./lifecycle-signal-registry";
 import { registerDefaultAudienceRules, audiencePredicates } from "./notification-rules";
-import { createActivityEvent, getAgent, getOrchestrator, getProject, getTaskDetail, insertLandingReceipt, markWorkspaceLanded, patchWorkspaceMetadataAsync, resolveProjectForCwd, updateWorkspaceStatusAsync, markWorkspaceLandedAsync} from "./db";
+import { getAgent, getOrchestrator, getProject, getTaskDetail, markWorkspaceLanded, patchWorkspaceMetadataAsync, resolveProjectForCwd, updateWorkspaceStatusAsync, markWorkspaceLandedAsync } from "./db";
 import { renderTemplate } from "./prompt-resolver";
 import { resolveCoordinatorAgentId } from "./steward-identity";
 import { stewardFallbackTarget } from "./config";
@@ -32,6 +35,8 @@ export interface BranchLandedInput extends LandedTaskAttributionInput {
   workspace: Pick<WorkspaceRecord, "id" | "repoRoot" | "branch" | "baseRef" | "baseSha" | "ownerAgentId" | "orchestratorId">;
   /** SHA the base now points at after the land. */
   mergedSha?: string;
+  /** Landing host proof from its fresh origin ancestry check. Must match mergedSha. */
+  landVerifiedSha?: string;
   /** Original command settlement clock when recovering an older land. */
   landedAt?: number;
   /** Subject line of the landed commit, when the orchestrator reported it. */
@@ -168,7 +173,7 @@ async function landedCommitSubjects(input: BranchLandedInput, log: BranchLandedL
   }, log);
 }
 
-function resolveLandedTask(input: LandedTaskAttributionInput): {
+export function resolveLandedTask(input: LandedTaskAttributionInput): {
   taskId: number;
   taskLabel: string;
   projectId?: string;
@@ -206,9 +211,9 @@ function landedNotificationIdempotencyKey(input: BranchLandedInput, landedTask:
  * the announcement; this combined entry preserves the original all-synchronous behavior for the
  * maintenance reconcile path (reconcileLandedWorkspace) and direct callers/tests.
  */
-export function notifyBranchLanded(input: BranchLandedInput): void {
-  recordLandingReceipt(input);
-  announceBranchLanded(input);
+export async function notifyBranchLanded(input: BranchLandedInput): Promise<void> {
+  (await recordLandingReceipt(input));
+  await announceBranchLanded(input);
 }
 
 /**
@@ -219,7 +224,7 @@ export function notifyBranchLanded(input: BranchLandedInput): void {
  * row with no receipt. The branch is already landed, so a receipt failure is loud (CRITICAL log) but
  * can never unwind or mask it.
  */
-export function recordLandingReceipt(input: BranchLandedInput): void {
+export async function recordLandingReceipt(input: BranchLandedInput): Promise<void> {
   const { workspace } = input;
   // #1620 — a land that introduced ZERO commits is not a land: no receipt (see announceBranchLanded).
   if (input.landedCommitCount === 0) return;
@@ -234,7 +239,7 @@ export function recordLandingReceipt(input: BranchLandedInput): void {
     const mergedSha = cleanRef(input.mergedSha);
     const commitShas = [...new Set((input.commitShas ?? []).map(cleanRef).filter((sha): sha is string => Boolean(sha)))];
     if (commitShas.length === 0 && mergedSha) commitShas.push(mergedSha);
-    insertLandingReceipt({
+    (await insertLandingReceiptAsync({
       ...(landedTask?.projectId ?? project?.id ? { projectId: landedTask?.projectId ?? project!.id } : {}),
       repo: landedTask?.repo ?? project?.issueRepo ?? repoFromGitRemote(workspace.repoRoot) ?? workspace.repoRoot,
       ref: workspace.baseRef ?? "base",
@@ -250,7 +255,7 @@ export function recordLandingReceipt(input: BranchLandedInput): void {
       ...(landedTask?.teamId ?? worker?.teamId ? { teamId: landedTask?.teamId ?? worker!.teamId } : {}),
       ...(workspace.orchestratorId ? { orchestratorId: workspace.orchestratorId } : {}),
       ...(orchestrator?.hostname ?? worker?.machine ?? worker?.rig ? { host: orchestrator?.hostname ?? worker?.machine ?? worker!.rig } : {}),
-    });
+    }));
   } catch (error) {
     console.error(`[landing-receipt] CRITICAL: failed to persist landed branch ${workspace.id}: ${errMessage(error)}`);
   }
@@ -262,7 +267,7 @@ export function recordLandingReceipt(input: BranchLandedInput): void {
  * the issue/Task lifecycle drives. #1790 — the settle path DEFERS this off its synchronous critical
  * path; the durable receipt is recorded separately + synchronously by {@link recordLandingReceipt}.
  */
-export function announceBranchLanded(input: BranchLandedInput): void {
+export async function announceBranchLanded(input: BranchLandedInput): Promise<void> {
   const { workspace } = input;
   const base = workspace.baseRef ?? "base";
   // #1620 — a land that introduced ZERO commits is not a land. It happens when a reconciliation
@@ -348,79 +353,7 @@ export function announceBranchLanded(input: BranchLandedInput): void {
     }
   })());
 
-  const author = workspace.ownerAgentId;
-  const shaLabel = shortSha ? ` as \`${shortSha}\`` : "";
-  const subjectLabel = input.subject ? ` — "${input.subject}"` : "";
-  const payload = {
-    kind: "branch.landed",
-    workspaceId: workspace.id,
-    repoRoot: workspace.repoRoot,
-    branch: landedBranch,
-    base,
-    sha: input.mergedSha,
-    author,
-    newBranch: input.newBranch,
-    pushed: input.pushed,
-    ...landedTaskPayload,
-  };
-
-  // A local-only land (push disabled, or base has no upstream) has NOT reached the
-  // remote — say so rather than implying a published merge an agent would report as
-  // shipped (#285). `undefined` (older orchestrators) keeps the message generic.
-  const publishLabel = input.pushed === false ? ` Not yet pushed to \`origin/${base}\` — local only.` : "";
-
-  // The branch author cares most — push regardless of online (store-ahead delivers it on
-  // next poll if they've moved on, #234). A live owner continues in its worktree.
-  if (author) {
-    const branchLabel = landedBranch ? `\`${landedBranch}\`` : "Your branch";
-    const continueLabel = input.newBranch
-      ? ` You're now on \`${input.newBranch}\` — keep working there.`
-      : " Worktree reclaimed.";
-    // Durable (ttl null): the author's own branch landing must reach them even after they go
-    // offline (store-ahead #234) — not a bystander notice that goes stale.
-    const notices = routeNotification({
-      type: "branch.landed",
-      scope: { author, repoRoot: workspace.repoRoot, workspaceId: workspace.id },
-      recipients: [author],
-      ttlMs: null,
-      message: {
-        subject: "Your branch landed",
-        body: renderTemplate("notify.land.success", {
-          branch: branchLabel,
-          base,
-          sha: `${shaLabel}${subjectLabel}`,
-          publishLabel,
-          continueLabel,
-        }),
-        payload: { ...payload, notification: "landed-success" },
-        idempotencyKey,
-        replyExpected: false,
-      },
-    });
-    if (landedTask && input.mergedSha) {
-      for (const notice of notices) stampLifecycleSignal(notice.to, taskSignalKey(landedTask.taskId, "landed-on-main", input.mergedSha));
-    }
-  }
-
-  // Coordinator copy (#2837), informational. No explicit recipients: the router records the rule decision (#446).
-  const mainScope = { author, repoRoot: workspace.repoRoot, workspaceId: workspace.id, teamId: landedTask?.teamId ?? (author ? getAgent(author)?.teamId : undefined), coordinatorAgentIds: [...new Set([resolveCoordinatorAgentId(author), landedTask && resolveTaskOwnerAgentId(getTaskDetail(landedTask.taskId))].filter((id): id is string => !!id && !isHumanAgentId(id)))] };
-  const branchLabel = landedBranch ? `\`${landedBranch}\`` : "A branch";
-  const authorLabel = author ? ` by \`${author}\`` : "";
-  const notices = routeNotification({
-    type: "branch.landed",
-    scope: mainScope, ...audienceWithTaskOwnerRole("branch.landed", mainScope, landedTask?.taskId), // #2862
-    ttlMs: INFORMATIONAL_TTL_MS,
-    message: {
-      subject: `Merged to ${base}`,
-      body: `🔀 ${branchLabel}${authorLabel} merged to \`${base}\`${shaLabel}${subjectLabel}.${publishLabel}`,
-      payload: { ...payload, notification: "landed-success" },
-      idempotencyKey,
-      replyExpected: false,
-    },
-  });
-  if (landedTask && input.mergedSha) {
-    for (const notice of notices) stampLifecycleSignal(notice.to, taskSignalKey(landedTask.taskId, "landed-on-main", input.mergedSha));
-  }
+  trackLandLifecycleDrive(announceVerifiedLand(input, landedTask, idempotencyKey));
 }
 
 /**
@@ -434,10 +367,10 @@ export function announceBranchLanded(input: BranchLandedInput): void {
  * the checkout. Human WIP is never auto-clobbered; `preservedWipPaths` flags paths to merge by
  * hand rather than blind-restore.
  */
-export function notifyBaseWorktreeStrand(input: {
+export async function notifyBaseWorktreeStrand(input: {
   workspace: Pick<WorkspaceRecord, "id" | "repoRoot" | "branch" | "baseRef" | "ownerAgentId">;
   sync: BaseWorktreeSyncResult;
-}): void {
+}): Promise<void> {
   const { workspace, sync } = input;
   if (sync.reconciled) return;
   const base = workspace.baseRef ?? "base";
@@ -466,7 +399,7 @@ export function notifyBaseWorktreeStrand(input: {
 
   emitRelayEvent({ type: "workspace.base_checkout_strand", source: "server", subject: workspace.id, data: payload });
 
-  createActivityEvent({
+  (await createActivityEventAsync({
     clientId: `workspace-base-strand-${workspace.id}-${Date.now()}`,
     kind: "state",
     title: "Base checkout stranded after land (mixed state)",
@@ -475,13 +408,13 @@ export function notifyBaseWorktreeStrand(input: {
     icon: "ti-alert-octagon",
     view: "orchestrators",
     metadata: { source: "server", maintenanceJobId: "workspace-base-strand", workspaceId: workspace.id, repoRoot: workspace.repoRoot, unsyncedPaths: unsynced, preservedWipPaths: preservedWip },
-  });
+  }));
 
   // Durable (ttl null) push to the owner and its coordinator — whoever works in the shared
   // checkout must learn it's stale before acting on it. Fallback steward covers a teamless land.
   const recipients = [...new Set([owner, coordinator, fallback].filter((r): r is string => Boolean(r)))];
   if (recipients.length) {
-    routeNotification({
+    await routeNotification({
       type: "workspace.base_checkout_strand",
       scope: { author: owner, parent: coordinator ?? undefined, repoRoot: workspace.repoRoot, workspaceId: workspace.id },
       recipients,
@@ -501,12 +434,12 @@ export function notifyBaseWorktreeStrand(input: {
  * steward-task/conflict pings: it tells the worker that its post-ready idle wait ended without
  * a completed land, so it can inspect/report instead of silently staying parked forever.
  */
-export function notifyBranchLandFailed(input: {
+export async function notifyBranchLandFailed(input: {
   workspace: Pick<WorkspaceRecord, "id" | "repoRoot" | "branch" | "baseRef" | "ownerAgentId">;
   commandId?: string;
   recipients?: string[];
   reason?: string;
-}): void {
+}): Promise<void> {
   const { workspace } = input;
   const base = workspace.baseRef ?? "base";
   const author = workspace.ownerAgentId;
@@ -533,7 +466,7 @@ export function notifyBranchLandFailed(input: {
   const recipients = withWorkspaceTaskOwnerRoles(input.recipients ?? [author, coordinator], workspace); // #2862
   if (!recipients.length) return;
   const branchLabel = workspace.branch ? `\`${workspace.branch}\`` : "Your branch";
-  routeNotification({
+  await routeNotification({
     type: "landed-failure",
     scope: { author, parent: coordinator ?? undefined, repoRoot: workspace.repoRoot, workspaceId: workspace.id },
     recipients,
@@ -563,7 +496,7 @@ export { notifyLandGateFailed, notifyLandGateWarnings, notifyLandGateSkipped } f
  * The steward id is the managed steward's policy name (reachable via `policy:<name>`) or an
  * elected steward's agent id, whichever the caller has in scope.
  */
-export function notifyStewardHandoff(input: {
+export async function notifyStewardHandoff(input: {
   workspace: Pick<WorkspaceRecord, "id" | "repoRoot" | "branch" | "baseRef" | "ownerAgentId">;
   /** The steward now holding the merge — managed steward policy name or elected agent id. */
   stewardId: string;
@@ -571,7 +504,7 @@ export function notifyStewardHandoff(input: {
   coordinatorAgentId?: string | null;
   /** Why it was handed over ("conflict", "merge state unknown", auto-merge back-off, …). */
   reason?: string;
-}): void {
+}): Promise<void> {
   const { workspace } = input;
   const base = workspace.baseRef ?? "base";
   const owner = workspace.ownerAgentId;
@@ -596,7 +529,7 @@ export function notifyStewardHandoff(input: {
   // thinking the branch silently failed. Durable (ttl null): the owner must learn this
   // even if it went idle. Mirror the "don't touch main" guardrail of the landed-failure wake.
   if (owner) {
-    routeNotification({
+    await routeNotification({
       type: "workspace.steward_handoff",
       scope: { author: owner, repoRoot: workspace.repoRoot, workspaceId: workspace.id },
       recipients: [owner],
@@ -619,7 +552,7 @@ export function notifyStewardHandoff(input: {
   // (it spawned the branch agent and owns the merge landing). Skip when the coordinator IS
   // the owner (no real lineage) to avoid a duplicate ping.
   if (coordinator && coordinator !== owner) {
-    routeNotification({
+    await routeNotification({
       type: "workspace.steward_handoff",
       scope: { author: owner, parent: coordinator, repoRoot: workspace.repoRoot, workspaceId: workspace.id },
       recipients: [coordinator],
@@ -682,7 +615,7 @@ const DRAINED_LAND_STRAND_BOOKKEEPING = {
  * (record the receipt, announce a real land, drain the steward/strand bookkeeping so no
  * watchdog re-wakes or re-pages a branch with nothing left to land).
  */
-export async function reconcileLandedWorkspace(ws: WorkspaceRecord, preview: WorkspaceMergePreview): Promise<LandedWorkspaceReconciliation> {
+export async function reconcileLandedWorkspace(ws: WorkspaceRecord, preview: WorkspaceMergePreview, landVerifiedSha?: string): Promise<LandedWorkspaceReconciliation> {
   const observedSha = typeof preview.prMergeSha === "string"
     ? preview.prMergeSha
     : typeof preview.landedSha === "string"
@@ -740,7 +673,7 @@ export async function reconcileLandedWorkspace(ws: WorkspaceRecord, preview: Wor
   const closure = ownerAlive
     ? `owner \`${ws.ownerAgentId}\` is still running, so the workspace stays non-terminal and usable at ${nextStatus}${nextStatus === ws.status ? "" : ` (was ${ws.status} — out of the land queue, #1662)`} (#1631); steward/strand and no-progress bookkeeping cleared`
     : `marking merged${landedCommitCount === 0 ? "; nothing was landed" : ""}`;
-  createActivityEvent({
+  (await createActivityEventAsync({
     clientId: "server-workspace-" + ws.id + "-merged-" + Date.now(),
     kind: "state",
     title: ownerAlive
@@ -751,9 +684,9 @@ export async function reconcileLandedWorkspace(ws: WorkspaceRecord, preview: Wor
     icon: "ti-git-merge",
     view: "orchestrators",
     metadata: { source: "server", maintenanceJobId: "workspace-conflict-scan", workspaceId: ws.id, fromStatus: ws.status, toStatus: nextStatus, ...(ownerAlive ? { ownerAlive: true, keptLive: true } : {}), ...(sha ? { landedSha: sha } : {}), ...(landedCommitCount === 0 ? { landedCommitCount: 0 } : {}) },
-  });
+  }));
   try {
-    notifyBranchLanded({ workspace: ws, mergedSha: sha, landedTipSha: sha, commitShas: sha ? [sha] : [], pushed: true, prLand: preview.prMerged === true, ...(landedCommitCount === 0 ? { landedCommitCount } : {}) });
+    await notifyBranchLanded({ workspace: ws, mergedSha: sha, landVerifiedSha, landedTipSha: sha, commitShas: sha ? [sha] : [], pushed: true, prLand: preview.prMerged === true, ...(landedCommitCount === 0 ? { landedCommitCount } : {}) });
   } catch {
     // Notification is best-effort; the status change + activity event still stand.
   }

package/src/bus.ts

@@ -1,5 +1,5 @@
 import type { Server, ServerWebSocket } from "bun";
-import { ValidationError, applyAgentLifecycleUpdate, getAgent, getDb, orphanTasksForAgentAsync, recordHeartbeat, setStatus, validateAgentSession } from "./db";
+import { ValidationError, applyAgentLifecycleUpdateAsync, getAgent, getDb, orphanTasksForAgentAsync, recordHeartbeatAsync, validateAgentSession } from "./db";
 import { getOutboxCursor, hasReplayGap, replayEventsSlice, type BusEvent } from "./bus-outbox";
 import { emitAgentStatus } from "./agent-status-events";
 import { AgentStatusSubscribers, matchesSubscription, wantsAgentStatus } from "./transport-subscriptions";
@@ -11,7 +11,7 @@ import { announceSpawnedAgentReady, registerAgent } from "./services/register-ag
 import { authContextFromBus } from "./services/auth-context";
 import { commandAuthorizationResource, dispatchCommandAsync } from "./services/dispatch-command";
 import { withRelayEventDrain } from "./relay-event-drain";
-import { runAsCaller } from "./hub-metrics";
+import { framed, runAsCaller } from "./hub-metrics";
 import { auditProviderStateTransition } from "./services/provider-state-audit";
 import { agentProviderTimelineEvent, auditRunnerTimelineEvent } from "./provider-timeline-event";
 import { auditProviderTurnEmpty, auditProviderTurnWatchdog, auditReconciledProviderTurn } from "./services/turn-reconcile-audit";
@@ -19,6 +19,7 @@ import { ServiceAuthError } from "./services/errors";
 import { ShutdownAuthError, ShutdownTargetError, shutdownAgent, shutdownInputFromBusFrame } from "./services/shutdown-agent";
 import { flushQueuedDirectMessages } from "./services/managed-running";
 import { updateCommandFromBus } from "./services/bus-command-update";
+import { heartbeatFromBus } from "./services/agent-heartbeat";
 import { isAgentUnavailable, reservedAgentIdSql } from "./db/agent-predicates";
 import { messageMatchesAgent, targetMatchesAgent } from "./agent-ref";
 import { probeWorkspaceOnTurnEnd } from "./workspace-probe";
@@ -34,7 +35,7 @@ import {
   type BusFrame,
   type RegisterFrame,
 } from "@humwick/sdk/protocol";
-import { errMessage, isRecord } from "@humwick/sdk";
+import { errMessage, fireAndForget, isRecord } from "@humwick/sdk";
 import { getComponentAuth, isComponentAuthorizedFor, isAuthorized, isOriginAllowed, unauthorized } from "./security";
 import type { AgentCard, ComponentToken, ContextState, Message, ProviderCapabilities, QuotaState, RegisterAgentInput, Task } from "./types";
 
@@ -76,7 +77,7 @@ const liveBusSocketIds = new Set<string>();
 // stalls unrelated agents.
 const busFrameQueues = new Map<string, Promise<void>>();
 
-subscribeRelayEvents((event) => broadcastRelayEvent(event));
+subscribeRelayEvents(broadcastRelayEvent);
 
 export function handleBusUpgrade(req: Request, server: Server<BusSocketData>): Response | undefined {
   if (!isOriginAllowed(req)) {
@@ -95,11 +96,11 @@ export function handleBusUpgrade(req: Request, server: Server<BusSocketData>): R
   return undefined;
 }
 
-export function busHandleOpen(ws: BusWebSocket): void {
+export const busHandleOpen = framed("WS open", (ws: BusWebSocket): void => {
   liveBusSocketIds.add(ws.data.id);
   // Registration is explicit. The socket is not visible to projections until
   // a valid register frame establishes identity and subscriptions.
-}
+});
 
 export function busHandleMessage(ws: BusWebSocket, data: string | Buffer): void {
   if (!liveBusSocketIds.has(ws.data.id)) return;
@@ -127,7 +128,7 @@ export function busHandleMessage(ws: BusWebSocket, data: string | Buffer): void
   busFrameQueues.set(ws.data.id, queued);
 }
 
-export function busHandleClose(ws: BusWebSocket): void {
+export const busHandleClose = framed("WS close", (ws: BusWebSocket): void => {
   liveBusSocketIds.delete(ws.data.id);
   busFrameQueues.delete(ws.data.id);
   const conn = busConnections.get(ws.data.id);
@@ -138,11 +139,14 @@ export function busHandleClose(ws: BusWebSocket): void {
     // on the establishing socket id, so a foreign socket's close cannot evict the owner's binding and a stale
     // close cannot evict a newer register's binding).
     if (!conn.transportReconnect) {
-      setStatus(conn.agentId, "stale", { instanceId: conn.instanceId, epoch: conn.epoch });
-      queueAgentStatusEvent(conn.agentId);
+      const agentId = conn.agentId;
+      void fireAndForget(`[bus] mark ${agentId} stale on close`, async () => {
+        await applyAgentLifecycleUpdateAsync(agentId, { status: "stale" }, { instanceId: conn.instanceId, epoch: conn.epoch });
+        queueAgentStatusEvent(agentId);
+      });
     }
   }
-}
+});
 
 export function getBusConnectionCount(): number {
   return busConnections.size;
@@ -162,7 +166,7 @@ export async function expireStaleBusAgents(graceMs = busStaleGraceMs(), lagGrace
     // but do NOT revoke the token — a reconnect accepts the EXISTING token and re-marks
     // live. The #484 restart-strand revoke now fires on instance takeover in registerAgent
     // (a fresh instanceId → epoch bump), never on a heartbeat lapse.
-    setStatus(row.id, "offline");
+    await applyAgentLifecycleUpdateAsync(row.id, { status: "offline" });
     await emitAgentStatus(row.id);
     const tasks = await orphanTasksForAgentAsync(row.id);
     for (const task of tasks) {
@@ -187,7 +191,7 @@ async function handleFrame(ws: BusWebSocket, frame: ReturnType<typeof validateCl
       await handleRegister(ws, frame);
       return;
     case "heartbeat":
-      await withRegistered(ws, frame, (conn) => {
+      await withRegistered(ws, frame, async (conn) => {
         if (conn.agentId) {
           // #633 — a runner whose provider terminally exited stays alive and keeps sending idle
           // keepalives (semanticStatus is never "offline"). Those must NOT resurrect an agent the
@@ -199,16 +203,15 @@ async function handleFrame(ws: BusWebSocket, frame: ReturnType<typeof validateCl
           if (!heldOffline) {
             const wasUnavailable = current ? isAgentUnavailable(current) : false;
             const runtime = runtimeFromMeta(frame.payload.meta);
-            // #1468 — coalesce the steady-state liveness write; recordHeartbeat writes through
-            // synchronously only on a status change / resurrection (and persists last_seen + runtime
-            // then). This replaces the old heartbeat()+setStatus() pair that rewrote the row twice
-            // per beat even when nothing changed.
-            recordHeartbeat(conn.agentId, { guard: { instanceId: conn.instanceId, epoch: conn.epoch }, status: frame.payload.status, runtime });
+            // #1468 — coalesce the steady-state liveness write; only a status change / resurrection
+            // writes (last_seen + runtime), on the writer thread (#1870 S7). This replaces the old
+            // heartbeat()+setStatus() pair that rewrote the row twice per beat even when nothing changed.
+            await recordHeartbeatAsync(conn.agentId, { guard: { instanceId: conn.instanceId, epoch: conn.epoch }, status: frame.payload.status, runtime });
             queueAgentStatusEvent(conn.agentId);
             // #416 — flush queued messages if the agent transitioned from unavailable to available.
             if (wasUnavailable) {
               const after = getAgent(conn.agentId);
-              if (after && !isAgentUnavailable(after)) flushQueuedDirectMessages(conn.agentId);
+              if (after && !isAgentUnavailable(after)) (await flushQueuedDirectMessages(conn.agentId));
             }
           }
         }
@@ -225,19 +228,16 @@ async function handleFrame(ws: BusWebSocket, frame: ReturnType<typeof validateCl
       await withRegistered(ws, frame, async (conn) => {
         if (!conn.agentId) return sendError(ws, frame.id, "AGENT_REQUIRED", "status frames require an agent registration");
         const guard = { instanceId: conn.instanceId, epoch: conn.epoch };
-        // #1895 (S3.2 L10 review, D2) — DELIBERATELY left on the sync write path: this is the
-        // per-status-frame hot WS seam (every heartbeat/status update from every live agent), not the
-        // cold/admin lifecycle surface that leaf migrates. `withRegistered`'s callback runs with no
-        // thread hop mid-frame, so routing these writes through their async facades would not move
-        // them off-loop — it would only add a round-trip.
-        // #2111 — but the three writes ARE now one. This used to be getAgent(before) + setStatus
+        // #1870 S7 — the per-status-frame write runs on the writer thread; this socket's FIFO frame
+        // queue keeps its frames ordered across the hop, and the lifecycle ordinal fences it against
+        // every other lifecycle writer. #2111 — the three writes are one. This used to be getAgent(before) + setStatus
         // (guard read + before read + UPDATE in its own BEGIN IMMEDIATE) + markReady (guard read +
         // UPDATE) + mergeAgentMeta (two reads + UPDATE) + getAgent(after): ~7 row reads and 3 UPDATEs
         // of one row per frame. `applyAgentLifecycleUpdate` does one guard read, one UPDATE and hands
         // back the before/after cards the audit calls below need. The flap ledger is different: it is
         // a cold durable history and must stay ordered with its status edge, so await it within this
         // socket's existing FIFO frame queue.
-        const applied = applyAgentLifecycleUpdate(
+        const applied = await applyAgentLifecycleUpdateAsync(
           conn.agentId,
           { status: frame.payload.agentStatus, ready: frame.payload.ready, meta: frame.payload.meta },
           guard,
@@ -250,27 +250,27 @@ async function handleFrame(ws: BusWebSocket, frame: ReturnType<typeof validateCl
         const after = applied.after;
         await auditProviderStateTransition(conn.agentId, before, after);
         const timelineEvent = agentProviderTimelineEvent(after);
-        auditRunnerTimelineEvent(conn.agentId, timelineEvent);
+        (await auditRunnerTimelineEvent(conn.agentId, timelineEvent));
         // #1621 — a turn the runner proved was cancelled out of band is a real state change the
         // waiting coordinator has to hear about, not just an activity-feed row.
-        auditReconciledProviderTurn(conn.agentId, after, timelineEvent);
+        await auditReconciledProviderTurn(conn.agentId, after, timelineEvent);
         // #1980 — the busy backstop is HOLDING a long turn it can't prove idle (not cancelling);
         // tell the waiting coordinator the turn is still live rather than leaving it to guess.
         // #2010 — but only when there's no positive busy evidence already saying so (see the
         // busy-health gate inside auditProviderTurnWatchdog); a demonstrably working agent needs
         // no wake.
-        auditProviderTurnWatchdog(conn.agentId, after, timelineEvent);
+        await auditProviderTurnWatchdog(conn.agentId, after, timelineEvent);
         // #2389 — a turn that ended clean and produced nothing is the least visible failure of the
         // three: the card reads healthy and idle. Tell the parent once the runner's own nudge has
         // failed to recover it.
-        auditProviderTurnEmpty(conn.agentId, after, timelineEvent);
+        await auditProviderTurnEmpty(conn.agentId, after, timelineEvent);
         // #2432 — a first ready that arrives over a status frame (children whose register kept the
         // row not-ready, e.g. ox/opencode builders) must stamp readiness exactly like the HTTP and
         // registration seams, or the child later reaps as a false `agent.spawn_failed`.
-        if (readyTransition) announceSpawnedAgentReady(conn.agentId, "bus-ready");
+        if (readyTransition) await announceSpawnedAgentReady(conn.agentId, "bus-ready");
         // A parked continuation consumes one retry on a genuine ready/idle transition only.
         const replayEpoch = continuationReplayEpoch(conn, before, after);
-        if (replayEpoch) replayParkedContinuationInjections(conn.agentId, replayEpoch);
+        if (replayEpoch) (await replayParkedContinuationInjections(conn.agentId, replayEpoch));
         // A real PreCompact/SessionStart hook arrives as a timelineEvent in the
         // merged meta — clears any pending stall watch (stale events ignored).
         noteAgentTimelineEvent(conn.agentId, timelineEvent);
@@ -280,7 +280,7 @@ async function handleFrame(ws: BusWebSocket, frame: ReturnType<typeof validateCl
         // #633 — silent clean-exit: a runner that stays alive after its provider terminally exited
         // marks the offline edge with `terminalProviderExit`; the owning service turns that into a
         // terminal event + #636 diagnosis (and clears the hold on a genuine resume).
-        reconcileTerminalProviderExit(conn.agentId, before, after);
+        await reconcileTerminalProviderExit(conn.agentId, before, after);
       });
       return;
     case "ack":
@@ -306,8 +306,9 @@ async function handleCommandFrame(
   target: string,
   params: Record<string, unknown>,
 ): Promise<void> {
+  if (commandType === "agent.heartbeat") return withRelayEventDrain(() => heartbeatFromBus(conn, target, params)).then((o) => sendCommandResult(ws, frameId, o.status, o.result, o.error));
   if (commandType === "command.update") {
-    return withRelayEventDrain(() => updateCommandFromBus({ target, params, componentAuth: conn.componentAuth }))
+    return withRelayEventDrain(async () => (await updateCommandFromBus({ target, params, componentAuth: conn.componentAuth })))
       .then((result) => sendCommandResult(ws, frameId, result.status, result.result, result.error))
       .catch((error) => sendError(ws, frameId, "FRAME_FAILED", errMessage(error)));
   }
@@ -334,10 +335,10 @@ async function handleCommandFrame(
   // busCommandAuthorized gate), createCommand, and the "command.requested" emit. The bus
   // adapter only translates the typed ServiceAuthError into a rejected result frame.
   try {
-    const command = await withRelayEventDrain(() => dispatchCommandAsync(
+    const command = await withRelayEventDrain(async () => (await dispatchCommandAsync(
       { type: commandType, source: conn.agentId ?? conn.componentId, target, params },
       authContextFromBus(conn.componentAuth),
-    ));
+    )));
     sendCommandResult(ws, frameId, "succeeded", { command });
   } catch (e) {
     if (e instanceof ServiceAuthError) {
@@ -378,7 +379,7 @@ async function handleRegister(ws: BusWebSocket, frame: RegisterFrame): Promise<v
       machine: payload.machine,
       capabilities: payload.capabilities,
       status: runnerManaged ? "idle" : "online",
-      ready: true,
+      ready: !runnerManaged,
       instanceId: payload.instanceId,
       ...(providerCapabilities ? { providerCapabilities } : {}),
       ...(context ? { context } : {}),
@@ -386,7 +387,7 @@ async function handleRegister(ws: BusWebSocket, frame: RegisterFrame): Promise<v
       ...(lifecycle === "transient" || lifecycle === "persistent" ? { lifecycle } : {}),
       meta: payload.meta,
     };
-    const agent = registerAgent(input, authContextFromBus(ws.data.componentAuth), { emitStatus: false });
+    const agent = await registerAgent(input, authContextFromBus(ws.data.componentAuth), { emitStatus: false });
     epoch = agent.epoch;
   }
 
@@ -400,7 +401,7 @@ async function handleRegister(ws: BusWebSocket, frame: RegisterFrame): Promise<v
   // newly registered agent stale. Fence the install on liveness and clean up the provisional
   // registration with the same instance/epoch guard used by an established connection's close.
   if (!liveBusSocketIds.has(ws.data.id)) {
-    if (payload.agentId && setStatus(payload.agentId, "stale", { instanceId: payload.instanceId, epoch })) {
+    if (payload.agentId && (await applyAgentLifecycleUpdateAsync(payload.agentId, { status: "stale" }, { instanceId: payload.instanceId, epoch })).changed) {
       queueAgentStatusEvent(payload.agentId);
     }
     return;
@@ -430,7 +431,7 @@ async function handleRegister(ws: BusWebSocket, frame: RegisterFrame): Promise<v
       epoch,
       cursor: getOutboxCursor(),
       sessionId: ws.data.id,
-      features: { heartbeatAck: true },
+      features: { heartbeatAck: true, liveness: true },
     },
   });
 }

package/src/cd-deploy-notify.ts

@@ -1,3 +1,7 @@
+import { resolve } from "node:path";
+import { getDeployEventForCommitAsync, deployChangesForCommitsAsync } from "./db/deploy-events-async";
+import type { DeployChanges } from "./db/deploy-events";
+import { runGit } from "./services/git-process";
 import { VERSION } from "./config";
 import { reportedGitSha } from "./git-sha";
 import { routeNotification } from "./notification-router";
@@ -17,6 +21,7 @@ registerDefaultAudienceRules("cd.deploy_live", [audiencePredicates.persistentCoo
 export interface CdDeployLiveInput {
   /** Defaults to this process's package version. */
   version?: string;
+  repoRoot?: string;
   /** Defaults to the running process's attested commit sha (undefined on an npm install). */
   gitSha?: string;
 }
@@ -32,28 +37,51 @@ export interface CdDeployLiveInput {
  * there is no stable identity to key the one-per-deploy dedup on, and this notice is specifically
  * about the CD-deploy restart glitch that only that deployment model produces.
  */
-export function notifyCdDeployLive(input: CdDeployLiveInput = {}): void {
+export async function notifyCdDeployLive(input: CdDeployLiveInput = {}): Promise<void> {
   const version = input.version ?? VERSION;
   const gitSha = input.gitSha ?? reportedGitSha();
   if (!gitSha) {
-    routeNotification({ type: "cd.deploy_live", scope: {}, recipients: [], message: {
+    await routeNotification({ type: "cd.deploy_live", scope: {}, recipients: [], message: {
       body: `Humwick v${version} is now running.`, payload: { kind: "cd.deploy-live", version },
       idempotencyKey: `release-deploy-live:${version}`, replyExpected: false,
     } });
     return;
   }
   const shortSha = gitSha.slice(0, 12);
+  const contents = await deployNoticeContents(gitSha, input.repoRoot ?? resolve(import.meta.dir, ".."));
 
-  routeNotification({
+  await routeNotification({
     type: "cd.deploy_live",
     scope: {},
     ttlMs: null,
     message: {
       subject: `Humwick ${version} is now running`,
-      body: `Humwick v${version} (\`${shortSha}\`) is now running after a restart. Any tool-call failures in the last ~1-2 min were the deploy, not an incident — you're good now; retry anything that failed.`,
+      body: `Humwick v${version} (\`${shortSha}\`) is now running after a restart. Interrupted tool calls were the deploy, not an incident; retry them.${contents}`,
       payload: { kind: "cd.deploy-live", version, gitSha },
       idempotencyKey: `cd-deploy-live:${gitSha}`,
       replyExpected: false,
     },
   });
 }
+
+async function deployNoticeContents(gitSha: string, repoRoot: string): Promise<string> {
+  const event = await getDeployEventForCommitAsync(gitSha);
+  if (!event) return "";
+  let changes: DeployChanges | undefined = event.changes;
+  if (changes?.state !== "ready") {
+    if (!event.previousSha) return "\nContents unavailable: no previous deployed SHA.";
+    const result = await runGit(["-C", repoRoot, "log", "--format=%H%x00%s", `${event.previousSha}..${gitSha}`, "--"], 5000, 1024 * 1024);
+    if (result.unavailable || result.exitCode !== 0) return "\nContents unavailable: deploy range could not be read.";
+    const commits = result.stdout.trim().split("\n").filter(Boolean).map(line => {
+      const [sha, ...subject] = line.split("\x00");
+      return { sha: sha!, subject: subject.join("\x00") };
+    });
+    changes = { state: "ready", ...await deployChangesForCommitsAsync(commits) };
+  }
+  const lines = changes.tasks.flatMap(task => [
+    `T${task.id} ${task.label.replace(/\s+/g, " ")}${task.issues.length ? ` — ${task.issues.map(issue => `${issue.repo}#${issue.externalKey} (${issue.relation ?? "references"})`).join(", ")}` : ""}`,
+    ...(task.onDeploy ? [`  onDeploy: ${task.onDeploy.replace(/\s+/g, " ")}`] : []),
+  ]);
+  lines.push(`${changes.unmatchedCommits.length} non-Task commit(s).`);
+  return `\n${lines.join("\n")}`;
+}

package/src/cd-host-lag-notify.ts

@@ -1,9 +1,10 @@
 import { resolveCdFleetAllowlist } from "../scripts/cd-config.ts";
 import { isCdFleetHostAllowlisted } from "../scripts/cd-fleet-membership.ts";
-import { getConfig, setConfig } from "./config-store.ts";
-import { createActivityEvent } from "./db/activity.ts";
+import { getConfig } from "./config-store.ts";
+import { setConfigAsync } from "./config-store-write.ts";
+import { createActivityEventAsync } from "./db/activity-async.ts";
 import { computeFleetConvergenceAsync, type FleetConvergence } from "./fleet-convergence.ts";
-import { raiseOperatorAlarm } from "./operator-alarm.ts";
+import { raiseOperatorAlarmAsync } from "./operator-alarm.ts";
 import { listOrchestratorsAsync } from "./db/orchestrators-async.ts";
 
 /** Server-side: a durable alarm per lag episode, and a recovery record when it clears. */
@@ -17,7 +18,7 @@ export async function notifyCdHostLag(convergence?: FleetConvergence, allowlist
     // Keep the episode's identity while targets advance, until this Host catches up.
     const since = previous[host.id] ?? host.lag.since;
     current[host.id] = since;
-    raiseOperatorAlarm({ clientId: `cd-host-lag:${host.id}:${since}`, source: "cd-host-lag", view: "deploys",
+    await raiseOperatorAlarmAsync({ clientId: `cd-host-lag:${host.id}:${since}`, source: "cd-host-lag", view: "deploys",
       subject: `CD deploy lag on ${host.id}`, dedupeEvent: true,
       detail: `${host.id} is ${Math.floor(host.lag.ageMs / 60_000)} minutes behind ${status.targetSha.slice(0, 12)}: ${host.deferred?.reason ?? host.reason}`,
       metadata: { orchestratorId: host.id, since, targetSha: status.targetSha, deferred: host.deferred } });
@@ -29,8 +30,8 @@ export async function notifyCdHostLag(convergence?: FleetConvergence, allowlist
     if (!host || !isCdFleetHostAllowlisted(host, allowlist)) { delete current[id]; continue; }
     if (!status.targetSha || host.gitSha !== status.targetSha) { current[id] = since; continue; }
     delete current[id];
-    createActivityEvent({ clientId: `cd-host-lag-resolved:${id}:${since}`, kind: "state", view: "deploys",
+    await createActivityEventAsync({ clientId: `cd-host-lag-resolved:${id}:${since}`, kind: "state", view: "deploys",
       title: `CD deploy lag cleared on ${id}`, metadata: { source: "cd-host-lag", orchestratorId: id, since, resolved: true } });
   }
-  if (JSON.stringify(current) !== JSON.stringify(previous)) setConfig("cd-host-lag", "alarms", current);
+  if (JSON.stringify(current) !== JSON.stringify(previous)) await setConfigAsync("cd-host-lag", "alarms", current);
 }