@humwick/server 0.130.1 → 0.130.3

package/src/db/lifecycle-tail-write-ops.ts

@@ -0,0 +1,62 @@
+import { createAgentControlBody, grantSelfEffortBody, type AgentControlWrite, type SelfEffortGrantWrite } from "./agent-control-write";
+import { redactCommandSecrets } from "../command-secrets";
+import { admitAgentActionBody, type AgentActionWrite } from "./agent-action-write";
+import { startBrowserBody, stopBrowserBody, type StartBrowserWrite } from "./browser-session-write";
+import { transitionBrowserSession } from "./browser-sessions";
+import { flushWorkFinalReportsFromQueue } from "./messages";
+import type { MessageWorkFinalitySource, Command } from "../types";
+import { insertOperatorDecision } from "./operator-decisions";
+import { persistAdvisoryContext } from "./lifecycle-context-write";
+import { createReviewPublishBody } from "./review-publish-write";
+import { answerOperatorDecisionBody, fileWorkflowDecisionBody } from "./operator-answer-write";
+import { observeEffortBody } from "./agent-effort-observe";
+import { recordContextResetBody, settleContextResetCarryBody } from "./context-carry-write";
+import { openRecoveryObligation, attachRecoveryCommand, type ContextResetFact } from "./context-reset-carry";
+import { clearAgentNotice, recordTerminalEvent } from "./terminal-events";
+import { recordCrashReport } from "./crash-reports";
+import { stampSpawnPrincipal } from "./agent-ownership";
+import { markSpawnRegistrationConfirmed } from "../commands-db";
+import { seedSpawnPromptMirror } from "./message-reads";
+import { resolveQueuedPolicyMessages, resolveQueuedDirectMessages } from "./delivery";
+import { resolveQueuedCoordinatorMessages } from "./coordinator-delivery";
+import { upsertManagedAgentState, updateManagedAgentState } from "../config-store";
+import { deleteWorkspace } from "./workspaces";
+import { addSubscription, removeSubscription, removeSubscriptionsForTask } from "./notification-subscriptions";
+import type { WriterOpSpec } from "./write-ops";
+
+export const LIFECYCLE_TAIL_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
+  "lifecycleTail.upsertManagedAgentState": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof upsertManagedAgentState>) => upsertManagedAgentState(...args) },
+  "agents.createControl": { offLoop: true, idempotent: false, fn: (a: AgentControlWrite, ctx) => createAgentControlBody(a, ctx.now), serializeIdempotencyResult: value => { const result = value as ReturnType<typeof createAgentControlBody>; return { ...result, ...(result.command ? { command: redactCommandSecrets(result.command) } : {}) }; } },
+  "agents.grantSelfEffort": { offLoop: true, idempotent: false, fn: (a: SelfEffortGrantWrite, ctx) => grantSelfEffortBody(a, ctx.now), serializeIdempotencyResult: value => redactCommandSecrets(value as import("../types").Command) },
+  "agents.admitAction": { offLoop: true, idempotent: false, serializeIdempotencyResult: value => { const result = value as ReturnType<typeof admitAgentActionBody>; return { ...result, command: redactCommandSecrets(result.command) }; }, fn: (args: AgentActionWrite, ctx) => admitAgentActionBody(args, ctx.now) },
+  "browser.start": { offLoop: true, idempotent: false, fn: (args: StartBrowserWrite, ctx) => startBrowserBody(args, ctx.now) },
+  "browser.stop": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof stopBrowserBody>[0], ctx) => stopBrowserBody(args, ctx.now) },
+  "browser.transition": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof transitionBrowserSession>) => transitionBrowserSession(...args) ?? null },
+  "notifications.subscriptions.addBatch": { offLoop: true, idempotent: false,
+    fn: (a: { inputs: Array<Parameters<typeof addSubscription>[0]> }, ctx) => a.inputs.map(input => addSubscription({ ...input, now: ctx.now })) },
+  "messages.flushWorkFinal": { offLoop: true, idempotent: true, fn: (a: { agentId: string; queue: number[]; source: MessageWorkFinalitySource; options: { includeStaleCompletedFinals?: boolean } }, ctx) => flushWorkFinalReportsFromQueue(a.agentId, a.queue, a.source, a.options, ctx.now) },
+  "operatorDecisions.insert": { offLoop: true, idempotent: false, fn: insertOperatorDecision },
+  "operatorDecisions.fileWorkflow": { offLoop: true, idempotent: true, fn: fileWorkflowDecisionBody },
+  "agents.persistAdvisoryContext": { offLoop: true, idempotent: true, fn: (a: Parameters<typeof persistAdvisoryContext>) => persistAdvisoryContext(...a) ?? null },
+  "commands.createReviewPublish": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof createReviewPublishBody>[0], ctx) => createReviewPublishBody(args, ctx.now) },
+  "operatorDecisions.answer": { offLoop: true, idempotent: true, fn: answerOperatorDecisionBody },
+  "agents.observeEffort": { offLoop: true, idempotent: true, fn: observeEffortBody },
+  "contextCarry.open": { offLoop: true, idempotent: true, fn: (a: { agentId: string; generation: number; now: number }) => openRecoveryObligation(a.agentId, a.generation, a.now) ?? null },
+  "contextCarry.attach": { offLoop: true, idempotent: true, fn: (a: { agentId: string; generation: number; commandId: string }) => attachRecoveryCommand(a.agentId, a.generation, a.commandId) ?? null },
+  "contextCarry.reset": { offLoop: true, idempotent: true, fn: (a: { fact: ContextResetFact }, ctx) => recordContextResetBody(a.fact, ctx.now) },
+  "contextCarry.settle": { offLoop: true, idempotent: true, fn: (a: { command: Command }, ctx) => settleContextResetCarryBody(a.command, ctx.now) },
+  "lifecycleTail.clearAgentNotice": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof clearAgentNotice>) => clearAgentNotice(...args) ?? null },
+  "lifecycleTail.recordTerminalEvent": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof recordTerminalEvent>) => recordTerminalEvent(...args) ?? null },
+  "lifecycleTail.recordCrashReport": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof recordCrashReport>) => recordCrashReport(...args) ?? null },
+  "lifecycleTail.stampSpawnPrincipal": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof stampSpawnPrincipal>) => stampSpawnPrincipal(...args) ?? null },
+  "lifecycleTail.markSpawnRegistrationConfirmed": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof markSpawnRegistrationConfirmed>) => markSpawnRegistrationConfirmed(...args) ?? null },
+  "lifecycleTail.seedSpawnPromptMirror": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof seedSpawnPromptMirror>) => seedSpawnPromptMirror(...args) ?? null },
+  "lifecycleTail.resolveQueuedPolicyMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedPolicyMessages>) => resolveQueuedPolicyMessages(...args) ?? null },
+  "lifecycleTail.resolveQueuedDirectMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedDirectMessages>) => resolveQueuedDirectMessages(...args) ?? null },
+  "lifecycleTail.resolveQueuedCoordinatorMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedCoordinatorMessages>) => resolveQueuedCoordinatorMessages(...args) ?? null },
+  "lifecycleTail.updateManagedAgentState": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof updateManagedAgentState>) => updateManagedAgentState(...args) ?? null },
+  "lifecycleTail.deleteWorkspace": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof deleteWorkspace>) => deleteWorkspace(...args) ?? null },
+  "lifecycleTail.addSubscription": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof addSubscription>) => addSubscription(...args) ?? null },
+  "lifecycleTail.removeSubscription": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof removeSubscription>) => removeSubscription(...args) ?? null },
+  "lifecycleTail.removeSubscriptionsForTask": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof removeSubscriptionsForTask>) => removeSubscriptionsForTask(...args) ?? null },
+});

package/src/db/lifecycle-write-window.ts

@@ -1,3 +1,4 @@
+import { framed } from "../hub-metrics";
 import { assertMainThreadState, mainThreadRegistry } from "./main-thread-state";
 // #2111 — short-window write coalescing for the hot agent lifecycle / presence / registration writes.
 //
@@ -116,7 +117,7 @@ export function coalesceLifecycleWrite(op: WriteOp, args: unknown, options: Coal
       return;
     }
     if (!window.timer && windowMs() !== Infinity) {
-      window.timer = setTimeout(() => flushWindow(op), windowMs());
+      window.timer = setTimeout(framed("timer lifecycle-write-window", () => flushWindow(op)), windowMs());
       window.timer.unref?.();
     }
   });

package/src/db/lineage-pair-dedupe-sql.ts

@@ -1,11 +1,11 @@
-import { MSG_SELECT } from "./mappers.ts";
 import { MIRROR_LOOKBACK_ROWS, notReportSuppressedSql } from "./report-suppression.ts";
 
 // #3644 — the child→parent chat dedupe reads behind a turn-final forward (db/messages.ts). Pinned
 // to the pair index: unpinned, the planner ranges idx_msg_to_id over the parent's whole inbox
 // (600k rows for `user`) and json_extracts every payload on the main thread. Each query must keep
-// `m.from_agent = ?`, `m.to_target = ?` and `m.kind = 'chat'` (the partial index predicate).
-const PAIR_CHAT_SELECT = `${MSG_SELECT} INDEXED BY idx_msg_pair_chat
+// `m.from_agent = ?`, `m.to_target = ?`, `m.kind = 'chat'` (the partial index predicate).
+// #3617: id + body only, no read/reaction rollups per candidate row; callers hydrate the winner via getMessage.
+const PAIR_CHAT_SELECT = `SELECT m.id, m.body FROM messages m INDEXED BY idx_msg_pair_chat
     WHERE m.from_agent = ?
       AND m.to_target = ?
       AND m.kind = 'chat'`;

package/src/db/long-running-work.ts

@@ -49,10 +49,10 @@ export function settlePendingIssueClose(args: PendingIssueCloseKey & { finished:
   else getDb().query("UPDATE pending_issue_closes SET updated_at = ? WHERE issue_ref_id = ? AND land_key = ?").run(now, args.issueRefId, args.landKey);
 }
 
-export function putIssueHierarchy(issueRefId: string, children: IssueTrackerIssueSummary[]): void {
+export function putIssueHierarchy(issueRefId: string, children: IssueTrackerIssueSummary[], now: number = Date.now()): void {
   getDb().query(`INSERT INTO issue_hierarchy_snapshots(issue_ref_id, children, updated_at) VALUES (?, ?, ?)
     ON CONFLICT(issue_ref_id) DO UPDATE SET children = excluded.children, updated_at = excluded.updated_at`)
-    .run(issueRefId, JSON.stringify(children), Date.now());
+    .run(issueRefId, JSON.stringify(children), now);
 }
 
 export function getIssueHierarchy(issueRefId: string): IssueTrackerIssueSummary[] | undefined {

package/src/db/main-connection-mode.ts

@@ -0,0 +1,11 @@
+import { relayEnv } from "@humwick/sdk/env";
+import { getDb, getDbPath } from "./connection";
+
+/** Seal the hub handle after all boot writes, immediately before bind (#1870 S8).
+ * Opt in during the soak; standalone tools and :memory: fixtures retain their own write handles. */
+export function configureMainConnectionForServing(env = process.env): boolean {
+  if (!Bun.isMainThread || getDbPath() === ":memory:" || !getDbPath()) return false;
+  if (relayEnv(env, "AGENT_RELAY_MAIN_DB_QUERY_ONLY") !== "1") return false;
+  getDb().run("PRAGMA query_only = ON");
+  return true;
+}

package/src/db/main-connection-writes.ts

@@ -1,4 +1,5 @@
 // #1870: bounded, minute-bucketed census of main-connection write attempts, including failed SQL.
+import { configureMainConnectionForServing } from "./main-connection-mode";
 const MINUTE = 60_000;
 const WINDOW_BUCKETS = 60;
 const MAX_LABELS = 512;
@@ -34,11 +35,49 @@ export class MainConnectionWriteCounter {
 }
 let counter = new MainConnectionWriteCounter();
 export function resetMainConnectionWrites(): void {
-  if (Bun.isMainThread) counter = new MainConnectionWriteCounter();
+  if (Bun.isMainThread) { counter = new MainConnectionWriteCounter(); bootWrites = 0; loggedLabels.clear(); }
+}
+// #1870 S7: schema, migrations, seeds and pre-bind reconciles write on the main connection before the
+// server binds. That is the documented boot exception (S8 flips query_only after it), so it is tallied
+// apart and never enters the 1 h label window. Only `startServer` opens the phase; tests count from zero.
+let booting = false;
+let bootWrites = 0;
+export function beginMainWriteBootPhase(): void { booting = true; }
+export function endMainWriteBootPhase(): void { configureMainConnectionForServing(); booting = false; }
+export function mainConnectionBootWrites(): number { return bootWrites; }
+// The first sighting of each label per process logs its caller once, so the remaining raw writers are named
+// from hub logs without a debugger. Bounded by the counter's own label cap.
+const loggedLabels = new Set<string>();
+function logFirstSighting(label: string): void {
+  if (process.env.NODE_ENV === "test" || loggedLabels.has(label) || loggedLabels.size >= MAX_LABELS) return;
+  loggedLabels.add(label);
+  const site = (new Error().stack ?? "").split("\n").filter((line) => line.includes(" at ") && !/connection|main-connection-writes/.test(line)).slice(0, 4)
+    .map((line) => line.trim().replace(/^at /, "").replace(/\(?\/[^)]*\/(src\/[^):]+:\d+)[^)]*\)?/, "$1")).join(" < ");
+  // Maintenance subprocesses reserve stdout for their JSON result (#3800).
+  console.error(`[relay] #1870 main-connection write: ${label} :: ${site}`);
 }
 export function recordMainConnectionWrite(label: string | undefined): void {
-  if (Bun.isMainThread && label) counter.record(label, Date.now());
+  if (!Bun.isMainThread || !label) return;
+  if (booting) { bootWrites++; return; }
+  counter.record(label, Date.now());
+  if (forbidRawWrites) { forbiddenWriteAttempts++; throw new Error(`#1870 raw main-connection write: ${label}`); }
+  logFirstSighting(label);
 }
 export function mainConnectionWrites(now: number = Date.now()): Record<string, number> {
   return counter.snapshot(now);
 }
+
+let forbidRawWrites = false;
+let forbiddenWriteAttempts = 0;
+/** Test ratchet for real service/route replay on the file-backed gateway. */
+export async function withRawMainWritesForbidden<T>(run: () => Promise<T>): Promise<T> {
+  const previous = forbidRawWrites;
+  const attempts = forbiddenWriteAttempts;
+  forbidRawWrites = true;
+  try {
+    const result = await run();
+    if (forbiddenWriteAttempts !== attempts) throw new Error("#1870 raw main-connection write was caught inside the replay");
+    return result;
+  }
+  finally { forbidRawWrites = previous; }
+}

package/src/db/maintenance-job-reconcile.ts

@@ -0,0 +1,61 @@
+import { getDb } from "./connection.ts";
+
+// #1870 S7 — the maintenance job-table reconcile, run-on-start rescheduling and dead-lease reclaim.
+// The scheduler runs the reconcile on every tick, so these were its largest raw main-connection writes.
+
+export interface MaintenanceJobSpec {
+  id: string;
+  title: string;
+  description: string;
+  intervalMs: number;
+  deadlineMs: number;
+  enabled: boolean;
+  critical: boolean;
+  runOnStart: boolean;
+}
+
+/** #1645: `enabled` is code-owned and re-asserted on every reconcile; operator stops live in `maintenance_job_pauses`.
+ *  PRECONDITION: convertManualJobDisablesToPauses() (migrations.ts) ran first. Runs inside the caller's write transaction. */
+export function upsertMaintenanceJobs(jobs: readonly MaintenanceJobSpec[], now: number): void {
+  const stmt = getDb().query(`
+    INSERT INTO maintenance_jobs (id, title, description, interval_ms, timeout_ms, enabled, critical, run_on_start, next_run_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      title = excluded.title,
+      description = excluded.description,
+      interval_ms = excluded.interval_ms,
+      timeout_ms = excluded.timeout_ms,
+      run_on_start = excluded.run_on_start,
+      enabled = excluded.enabled, -- #1645: code-owned, see the note above this query
+      critical = excluded.critical,
+      next_run_at = COALESCE(maintenance_jobs.next_run_at, excluded.next_run_at),
+      updated_at = excluded.updated_at
+  `);
+  // The DB column stays `timeout_ms` (#1728): a rename is a migration. Code-side it is `deadlineMs`.
+  for (const job of jobs) {
+    stmt.run(job.id, job.title, job.description, job.intervalMs, job.deadlineMs, job.enabled ? 1 : 0, job.critical ? 1 : 0, job.runOnStart ? 1 : 0,
+      job.runOnStart ? now : now + job.intervalMs, now);
+  }
+}
+
+/** `runOnStart` means every process start; this is boot-only, never part of the periodic reconcile. */
+export function rescheduleRunOnStartJobs(now: number): void {
+  getDb().query(`
+    UPDATE maintenance_jobs
+    SET next_run_at = ?, updated_at = ?
+    WHERE enabled = 1 AND run_on_start = 1
+  `).run(now, now);
+}
+
+export interface DeadLease { id: string; owner: string; pid: number }
+
+/** #1493/#3645: a confirmed-dead owner is a crash, not a job failure — no failure streak bump, no last_error overwrite. */
+export function reclaimDeadLeases(leases: readonly DeadLease[], now: number): void {
+  const stmt = getDb().query(`
+    UPDATE maintenance_jobs
+    SET lease_owner = NULL, lease_until = NULL, last_status = 'failed',
+        last_error = COALESCE(last_error, ?), run_token = NULL, last_progress_at = ?, updated_at = ?
+    WHERE id = ? AND lease_owner = ?
+  `);
+  for (const lease of leases) stmt.run(`reclaimed stale lease at startup: owner pid ${lease.pid} is confirmed dead`, now, now, lease.id, lease.owner);
+}

package/src/db/maintenance-job-runs-async.ts

@@ -1,4 +1,6 @@
 import { getGateway } from "./gateway.ts";
+import type { ResetCriticalMaintenanceRun } from "./maintenance-health.ts";
+import type { DeadLease, MaintenanceJobSpec } from "./maintenance-job-reconcile.ts";
 import type { MaintenanceRunClaim, MaintenanceRunOutcome } from "./maintenance-job-runs.ts";
 
 // #1870 S3 — lease and outcome writes are critical: a shed claim skips a due job and a shed outcome
@@ -13,3 +15,15 @@ export async function heartbeatMaintenanceRunAsync(args: { id: string; runToken:
 
 export const finishMaintenanceRunAsync = (args: MaintenanceRunOutcome) =>
   getGateway().write("maintenanceJobs.finish", args, { critical: true }) as unknown as Promise<boolean>;
+
+export async function ensureMaintenanceJobsAsync(jobs: MaintenanceJobSpec[]): Promise<void> {
+  await getGateway().write("maintenanceJobs.ensure", { jobs }, { critical: true });
+}
+export async function rescheduleRunOnStartJobsAsync(now?: number): Promise<void> {
+  await getGateway().write("maintenanceJobs.rescheduleRunOnStart", { now }, { critical: true });
+}
+export async function reclaimDeadLeasesAsync(leases: DeadLease[]): Promise<void> {
+  if (leases.length) await getGateway().write("maintenanceJobs.reclaimDeadLeases", { leases }, { critical: true });
+}
+export const resetExpiredCriticalRunsAsync = (now: number) =>
+  getGateway().write("maintenanceJobs.resetExpiredCritical", { now }, { critical: true }) as unknown as Promise<ResetCriticalMaintenanceRun[]>;

package/src/db/maintenance-job-write-ops.ts

@@ -1,10 +1,19 @@
 import { claimMaintenanceRun, finishMaintenanceRun, heartbeatMaintenanceRun } from "./maintenance-job-runs.ts";
 import type { MaintenanceRunClaim, MaintenanceRunOutcome } from "./maintenance-job-runs.ts";
+import { resetExpiredCriticalMaintenanceRuns } from "./maintenance-health.ts";
+import { reclaimDeadLeases, rescheduleRunOnStartJobs, upsertMaintenanceJobs } from "./maintenance-job-reconcile.ts";
+import type { DeadLease, MaintenanceJobSpec } from "./maintenance-job-reconcile.ts";
 import type { WriterOpSpec } from "./write-ops.ts";
 
 // #1870 S3 — each op is a compare-and-set on the run's own owner/token, so a replay changes nothing.
 export const MAINTENANCE_JOB_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
   "maintenanceJobs.claim": { offLoop: true, idempotent: true, fn: (args: MaintenanceRunClaim) => claimMaintenanceRun(args) },
   "maintenanceJobs.heartbeat": { offLoop: true, idempotent: true, fn: (args: { id: string; runToken: string }, ctx) => heartbeatMaintenanceRun(args, ctx.now) },
+  // Reconcile is a re-assertion of code-owned columns, so a replay changes nothing.
+  "maintenanceJobs.ensure": { offLoop: true, idempotent: true, fn: (args: { jobs: MaintenanceJobSpec[] }, ctx) => upsertMaintenanceJobs(args.jobs, ctx.now) },
+  "maintenanceJobs.rescheduleRunOnStart": { offLoop: true, idempotent: true, fn: (args: { now?: number }, ctx) => rescheduleRunOnStartJobs(args.now ?? ctx.now) },
+  "maintenanceJobs.reclaimDeadLeases": { offLoop: true, idempotent: true, fn: (args: { leases: DeadLease[] }, ctx) => reclaimDeadLeases(args.leases, ctx.now) },
+  // A compare-and-set on the observed lease, so a replay finds nothing left to reset.
+  "maintenanceJobs.resetExpiredCritical": { offLoop: true, idempotent: true, fn: (args: { now: number }) => resetExpiredCriticalMaintenanceRuns(args.now) },
   "maintenanceJobs.finish": { offLoop: true, idempotent: true, fn: (args: MaintenanceRunOutcome) => finishMaintenanceRun(args) },
 });

package/src/db/maintenance-pauses.ts

@@ -123,8 +123,8 @@ export interface PauseMaintenanceJobInput {
 /** Acquire a pause. An existing ACTIVE pause is returned as a conflict rather than having its
  *  holder replaced — same contract as acquireMergePause, so one operator's hold plus its reason
  *  cannot be quietly overwritten by another's. A LAPSED row is replaced. */
-export function pauseMaintenanceJob(input: PauseMaintenanceJobInput): { ok: boolean; pause: MaintenanceJobPauseRecord } {
-  const now = input.now ?? Date.now();
+export function pauseMaintenanceJob(input: PauseMaintenanceJobInput, submittedAt: number = Date.now()): { ok: boolean; pause: MaintenanceJobPauseRecord } {
+  const now = input.now ?? submittedAt;
   const expiresAt = input.indefinite ? null : now + (input.ttlMs ?? DEFAULT_MAINTENANCE_PAUSE_TTL_MS);
   return writeTransaction(() => {
     const existing = getMaintenanceJobPause(input.jobId, now);

package/src/db/mappers.ts

@@ -1,17 +1,4 @@
-import { randomUUID } from "node:crypto";
-import { isRecord, stringValue, isMechanicalMessageKind } from "@humwick/sdk";
-import { ORCHESTRATOR_PROTOCOL_VERSION, VERSION } from "../config.ts";
 import { parseJson } from "../utils";
-import { isLiveIsolatedWorkspace } from "../workspace-phase";
-import {
-  CONTRACT_REQUIREMENTS,
-  contractCompatibility,
-  parseRuntimeCapabilities,
-  parseRuntimeContracts,
-  parseRuntimePackage,
-  type RuntimeContracts,
-} from "../contracts";
-import { STALE_TTL_MS, DAY_MS, CLAIM_LEASE_MS, POOL_CLAIM_LEASE_MS, WORKSPACE_MERGE_LEASE_MS } from "../config";
 import { parseStringArray } from "./shared.ts";
 import type {
   AgentCard,
@@ -291,12 +278,14 @@ export function rowToTask(row: any): Task {
     ...(row.dispatch != null ? { dispatch: parseJson(row.dispatch, {}) } : {}),
     ...(row.reaped_at != null ? { reapedAt: row.reaped_at } : {}),
     ...(row.tags != null ? { tags: parseStringArray(row.tags) } : {}),
+    ...(row.paths != null ? { paths: parseStringArray(row.paths) } : {}),
     ...(row.priority != null ? { priority: row.priority as Task["priority"] } : {}),
     ...(row.parent_task_id != null ? { parentTaskId: row.parent_task_id } : {}),
     ...(row.backlog_state != null ? { backlogState: row.backlog_state as Task["backlogState"] } : {}),
     // #2518 — omit false on the wire so legacy payload shapes stay byte-identical for unheld Tasks.
     ...(row.validation_items != null ? { validationItems: parseJson(row.validation_items, []) } : {}),
     ...(row.completed_at != null ? { completedAt: row.completed_at } : {}),
+    ...(row.on_deploy ? { onDeploy: row.on_deploy } : {}),
     ...(row.terminal_stage != null ? { terminalStage: row.terminal_stage as Task["terminalStage"] } : {}),
     ...(row.stale_owner_gone === 1 ? { staleOwnerGone: true } : {}),
     ...(row.review_hold === 1 ? { reviewHold: true } : {}),
@@ -406,7 +395,6 @@ export function rowToActivityEvent(row: any): ActivityEvent {
   };
 }
 
-
 export const MSG_SELECT = `SELECT m.*, (
   SELECT json_group_array(agent_id) FROM message_reads WHERE message_id = m.id
 ) AS read_by_agents, (

package/src/db/merge-lease.ts

@@ -1,19 +1,5 @@
-import { Database } from "bun:sqlite";
 import { randomUUID } from "node:crypto";
-import { isRecord, stringValue, isMechanicalMessageKind } from "@humwick/sdk";
-import { ORCHESTRATOR_PROTOCOL_VERSION, VERSION } from "../config.ts";
-import { parseJson } from "../utils";
-import { isLiveIsolatedWorkspace } from "../workspace-phase";
-import {
-  CONTRACT_REQUIREMENTS,
-  contractCompatibility,
-  parseRuntimeCapabilities,
-  parseRuntimeContracts,
-  parseRuntimePackage,
-  type RuntimeContracts,
-} from "../contracts";
-import { STALE_TTL_MS, DAY_MS, CLAIM_LEASE_MS, POOL_CLAIM_LEASE_MS, WORKSPACE_MERGE_LEASE_MS, MAIN_MERGE_PAUSE_TTL_MS } from "../config";
-import { matchAgents } from "../agent-ref";
+import { WORKSPACE_MERGE_LEASE_MS, MAIN_MERGE_PAUSE_TTL_MS } from "../config";
 import { incidentEligibleSql } from "./land-incident-eligibility";
 import { getDb, writeTransaction } from "./connection.ts";
 

package/src/db/message-send.ts

@@ -74,3 +74,7 @@ export function sendMessagesBatchWithResultAsync(
     SendMessageResult[]
   >;
 }
+
+export async function sendMessageAsync(input: SendMessageInput) {
+  return (await sendMessageWithResultAsync(input)).message;
+}

package/src/db/messages.ts

@@ -59,9 +59,9 @@ export { runningAgentForPolicy } from "./policy-runtime.ts";
 
 export function findMessageByIdempotencyKey(from: string, key: string): Message | null {
   const row = getDb()
-    .query(`${MSG_SELECT} WHERE m.from_agent = ? AND m.idempotency_key = ? LIMIT 1`)
-    .get(from, key) as any;
-  return row ? rowToMessage(row) : null;
+    .query("SELECT m.id FROM messages m WHERE m.from_agent = ? AND m.idempotency_key = ? LIMIT 1")
+    .get(from, key) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 function sessionStepId(payload: Record<string, unknown> | undefined): string | undefined {
@@ -162,7 +162,7 @@ function findRecentDuplicateReply(input: SendMessageInput, threadId: number | nu
   if (!input.replyTo || threadId === null || hasAttachments) return null;
   const kind = inferMessageKind(input);
   const row = getDb().query(`
-    ${MSG_SELECT}
+    SELECT m.id FROM messages m
     WHERE m.from_agent = ?
       AND m.to_target = ?
       AND m.kind = ?
@@ -183,8 +183,8 @@ function findRecentDuplicateReply(input: SendMessageInput, threadId: number | nu
     input.subject ?? null,
     input.channel ?? null,
     now - REPLY_DUPLICATE_WINDOW_MS,
-  ) as any;
-  return row ? rowToMessage(row) : null;
+  ) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 function sessionMeta(input: Message | SendMessageInput): Record<string, unknown> | undefined {
@@ -252,8 +252,8 @@ function findLineageReportByTurn(input: {
     lineageKey,
     `response-report:${input.from}:%:${input.turnId}`,
     input.turnId,
-  ) as any;
-  return row ? rowToMessage(row) : null;
+  ) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 function findRecentLineageReport(input: SendMessageInput, now: number): Message | null {
@@ -275,8 +275,8 @@ function findRecentLineageReport(input: SendMessageInput, now: number): Message
     if (duplicate) return duplicate;
   }
   if (responseCapture) return null;
-  const row = getDb().query(RECENT_LINEAGE_REPORT_SQL).get(from, to, input.body, now - LINEAGE_REPORT_DUPLICATE_WINDOW_MS, `response-report:${from}:%`) as any;
-  return row ? rowToMessage(row) : null;
+  const row = getDb().query(RECENT_LINEAGE_REPORT_SQL).get(from, to, input.body, now - LINEAGE_REPORT_DUPLICATE_WINDOW_MS, `response-report:${from}:%`) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 // T4458 (Edin's rule #2844 1a) — the sender's currently-open provider turn: the newest
@@ -340,10 +340,10 @@ function findSameTurnExplicitReport(input: {
     input.to,
     ...(input.turnId ? [input.from, input.turnId, fallback] : [fallback]),
     input.at + LINEAGE_REPORT_DUPLICATE_WINDOW_MS,
-  ) as any[];
+  ) as Array<{ id: number; body: string | null }>;
   for (const row of rows) {
     const explicit = normBody(String(row?.body ?? ""));
-    if (explicit.length >= SAME_TURN_MIN_CHARS && explicit.includes(body)) return rowToMessage(row);
+    if (explicit.length >= SAME_TURN_MIN_CHARS && explicit.includes(body)) return getMessage(row.id);
   }
   return null;
 }
@@ -361,9 +361,9 @@ function findTurnExplicitReport(input: {
   captureLen: number;
   captureOccurredAt: number;
 }): Message | null {
-  const row = getDb().query(TURN_EXPLICIT_REPORT_SQL).get(input.from, input.to, input.turnId, input.before) as any;
-  if (!row) return null;
-  const message = rowToMessage(row);
+  const row = getDb().query(TURN_EXPLICIT_REPORT_SQL).get(input.from, input.to, input.turnId, input.before) as { id: number } | null;
+  const message = row ? getMessage(row.id) : null;
+  if (!message) return null;
   const explicitLen = normBody(String(message.body ?? "")).length;
   if (explicitLen < SAME_TURN_MIN_CHARS || explicitLen < 0.5 * input.captureLen) return null;
   // MED-1 (r1 review): a stamp is turn inference and can go stale — t1's late final can land
@@ -409,8 +409,8 @@ function findRecentExplicitLineageDuplicate(input: {
     input.to,
     input.body,
     input.since,
-  ) as any;
-  return row ? rowToMessage(row) : null;
+  ) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 // #1084/#3304 — reporting a definitive provider completion does not close its work window.
@@ -418,9 +418,14 @@ function findRecentExplicitLineageDuplicate(input: {
 const LINEAGE_FINAL_GROUP_RECENCY_MS = 10 * 60 * 1000;
 export { __resetDeferredLineageReports, restoreDeferredLineageReports, takeDeferredLineageReports } from "./deferred-lineage-reports.ts";
 
+export interface LineageReportResult {
+  message: Message;
+  created: boolean;
+  lifecycleSignals?: Array<{ recipient: string; subjectKey: string }>;
+}
 export interface WorkFinalFlushResult {
   /** The chat report(s) forwarded (or found already-forwarded) to the spawner, oldest first. */
-  forwarded: Array<{ message: Message; created: boolean }>;
+  forwarded: LineageReportResult[];
   /** The original session-mirror captures retroactively tagged `payload.finality` (for the
    * `message.finalized` SSE upgrade of already-rendered bubbles). */
   finalizedOriginals: Message[];
@@ -533,12 +538,11 @@ function edgeFallbackReportScore(body: string): number {
 // redundant "Task status pulse" for the same child/task is suppressed rather than double-waking.
 // #1038 — a report-up conveys "the child is progressing", so it is state-keyed to `working`: it
 // supersedes only a redundant `working` pulse, never a later distinct milestone (committed/landed/done).
-function stampReportUpLifecycleSignal(parent: string, child: AgentCard): void {
-  stampLifecycleSignal(parent, childSignalKey(child.id));
-  for (const taskId of childTaskIds(child)) stampLifecycleSignal(parent, taskSignalKey(taskId, LIFECYCLE_STATE_WORKING));
+export function applyLineageReportEffects(result: LineageReportResult | null): void {
+  for (const signal of result?.lifecycleSignals ?? []) stampLifecycleSignal(signal.recipient, signal.subjectKey);
 }
 
-export function promoteLineageCapturedResponse(message: Message): { message: Message; created: boolean } | null {
+export function promoteLineageCapturedResponse(message: Message, deferred?: Array<{ childId: string; messageId: number }>): LineageReportResult | null {
   if (message.kind !== "session" || isReportSuppressed(message)) return null;
   const session = sessionMeta(message);
   if (!session) return null;
@@ -556,7 +560,8 @@ export function promoteLineageCapturedResponse(message: Message): { message: Mes
   // #3304 — provider completion is enough to report a turn, without declaring the Task done.
   // Keep the ring for later work-final metadata; addressed captures already have a runner reply.
   if (stream === "responses" && verbosity !== "verbose") {
-    deferLineageReport(child.id, message.id);
+    if (deferred) deferred.push({ childId: child.id, messageId: message.id });
+    else deferLineageReport(child.id, message.id);
     if (session.confidence !== "definitive" || session.endedBy !== "completed" || message.replyTo) return null;
     if (lineageDeliveryCoversCapture(message, child, parent, message.createdAt)) return null;
   }
@@ -576,7 +581,7 @@ function forwardLineageStreamCapture(
   child: AgentCard,
   parent: string,
   finality?: MessageWorkFinality,
-): { message: Message; created: boolean } | null {
+): LineageReportResult | null {
   const parentAgentId = parent;
   parent = canonicalLineageReportTarget(child, parent);
   const idempotencyKey = lineageStreamReportKey(message, session, stream);
@@ -679,7 +684,8 @@ function forwardLineageStreamCapture(
     occurredAt: message.occurredAt ?? message.createdAt,
   });
   if (stream === "responses" && result.created) {
-    stampReportUpLifecycleSignal(parentAgentId, child);
+    return { ...result, lifecycleSignals: [childSignalKey(child.id), ...childTaskIds(child).map(id => taskSignalKey(id, LIFECYCLE_STATE_WORKING))]
+      .map(subjectKey => ({ recipient: parentAgentId, subjectKey })) };
   }
   return result;
 }