@humwick/server 0.130.1 → 0.130.3

package/src/db/token-standing.ts

@@ -3,7 +3,7 @@ import { participatesInSpawnDelegation, spawnDelegationState, spawnTreeStopped }
 import { getDb } from "./connection.ts";
 import type { TokenRevokeReason } from "../security.ts";
 
-export function isTokenRevoked(jti: string): boolean {
+export function isTokenRevoked(jti: string, retire?: (predecessor: string) => void): boolean {
   let row: { revoked_at: number | null; retire_jti: string | null; agent_id: string | null } | null;
   try {
     // #1245 — the same lookup names a handed-off predecessor this token has not retired yet.
@@ -24,19 +24,16 @@ export function isTokenRevoked(jti: string): boolean {
     const state = spawnDelegationState(row.agent_id);
     if (state.participating && (state.displaced || spawnTreeStopped(row.agent_id))) return true;
   }
-  if (row.retire_jti) retireHandedOffPredecessor(row.retire_jti);
+  if (row.retire_jti) retire?.(row.retire_jti);
   return false;
 }
 
 // A successor's first authentication proves its holder has it, so the predecessor it replaced (token-db.ts
 // handoffTokenInternal) is retired as a rotation. A failed write is retried by the successor's next request.
-function retireHandedOffPredecessor(jti: string): void {
-  try {
-    getDb().query("UPDATE tokens SET revoked_at = COALESCE(revoked_at, ?), revoked_reason = 'rotation' WHERE jti = ? AND (revoked_at IS NULL OR revoked_reason = 'stale')")
-      .run(Math.floor(Date.now() / 1000), jti);
-  } catch {
-    // The successor stays valid; its next authentication retries.
-  }
+export function retireHandedOffPredecessorBody(jti: string, now: number): null {
+  getDb().query("UPDATE tokens SET revoked_at = COALESCE(revoked_at, ?), revoked_reason = 'rotation' WHERE jti = ? AND (revoked_at IS NULL OR revoked_reason = 'stale')")
+    .run(Math.floor(now / 1000), jti);
+  return null;
 }
 
 // Returns undefined if the token is not revoked, otherwise its reason string
@@ -61,24 +58,28 @@ export function tokenRevocationReason(jti: string): string | null | undefined {
 /** A rotation retires one token for its successor, so it is never a lineage revocation. */
 export type LineageRevokeReason = Exclude<TokenRevokeReason, "rotation">;
 
-/** #1245 — a token and every token handed off from it (token-db.ts handoffTokenInternal) are one credential, so
- * revoking any of them revokes the whole lineage: unretired predecessors, pending successors and their renewals.
- * A hard reason also hardens stale members, so no auth, renewal or orchestrator recovery reaches the lineage. A
- * stale walk stops at stale members: what follows them is an orchestrator recovery. It never enters a `keep` token. */
-export function revokeTokenLineage(seeds: readonly string[], reason: LineageRevokeReason | null, nowSeconds: number, keep: readonly string[] = []): string[] {
-  if (seeds.length === 0) return [];
-  const rows = getDb().query(`
+// #3776 — each step must be a key lookup whatever sqlite_stat1 says: CROSS JOIN pins the join order and the unary
+// `+` keeps the predecessor index off the backward step, so stale stats cannot make the walk scan per member.
+export const TOKEN_LINEAGE_REVOKE_SQL = `
     WITH RECURSIVE kept(jti) AS (SELECT value FROM json_each(?1)),
     lineage(jti) AS (
       SELECT value FROM json_each(?2) WHERE value NOT IN kept
-      UNION SELECT t.jti FROM lineage l JOIN tokens p ON p.jti = l.jti JOIN tokens t ON t.predecessor_jti = p.jti
+      UNION SELECT t.jti FROM lineage l CROSS JOIN tokens p ON p.jti = l.jti CROSS JOIN tokens t ON t.predecessor_jti = p.jti
         WHERE t.jti NOT IN kept AND (?4 IS NOT 'stale' OR p.revoked_reason IS NOT 'stale')
-      UNION SELECT p.predecessor_jti FROM lineage l JOIN tokens p ON p.jti = l.jti
-        WHERE p.predecessor_jti IS NOT NULL AND p.predecessor_jti NOT IN kept AND (?4 IS NOT 'stale' OR p.revoked_reason IS NOT 'stale')
+      UNION SELECT p.predecessor_jti FROM lineage l CROSS JOIN tokens p ON p.jti = l.jti
+        WHERE +p.predecessor_jti IS NOT NULL AND +p.predecessor_jti NOT IN kept AND (?4 IS NOT 'stale' OR p.revoked_reason IS NOT 'stale')
     )
     UPDATE tokens SET revoked_at = COALESCE(revoked_at, ?3), revoked_reason = ?4
     WHERE jti IN lineage AND (revoked_at IS NULL OR (?4 IS NOT 'stale' AND revoked_reason = 'stale'))
     RETURNING jti
-  `).all(JSON.stringify(keep), JSON.stringify(seeds), nowSeconds, reason) as Array<{ jti: string }>;
+  `;
+
+/** #1245 — a token and every token handed off from it (token-db.ts handoffTokenInternal) are one credential, so
+ * revoking any of them revokes the whole lineage: unretired predecessors, pending successors and their renewals.
+ * A hard reason also hardens stale members, so no auth, renewal or orchestrator recovery reaches the lineage. A
+ * stale walk stops at stale members: what follows them is an orchestrator recovery. It never enters a `keep` token. */
+export function revokeTokenLineage(seeds: readonly string[], reason: LineageRevokeReason | null, nowSeconds: number, keep: readonly string[] = []): string[] {
+  if (seeds.length === 0) return [];
+  const rows = getDb().query(TOKEN_LINEAGE_REVOKE_SQL).all(JSON.stringify(keep), JSON.stringify(seeds), nowSeconds, reason) as Array<{ jti: string }>;
   return rows.map((row) => row.jti);
 }

package/src/db/token-usage-retention.ts

@@ -0,0 +1,33 @@
+import { getDb } from "./connection";
+
+export const TOKEN_USAGE_RETENTION_SCHEMA = `
+  CREATE TABLE IF NOT EXISTS retired_token_usage_totals (
+    agent_id TEXT PRIMARY KEY, tokens INTEGER NOT NULL, unknown_reports INTEGER NOT NULL);
+  CREATE TABLE IF NOT EXISTS token_usage_retention_state (
+    id INTEGER PRIMARY KEY CHECK (id = 1), expired_before INTEGER NOT NULL);
+`;
+
+/** #3619 — old retries must not resurrect reports already folded into permanent budget totals. */
+export function isTokenUsageExpired(createdAt: number): boolean {
+  const state = getDb().query("SELECT expired_before FROM token_usage_retention_state WHERE id = 1")
+    .get() as { expired_before: number } | null;
+  return state !== null && createdAt < state.expired_before;
+}
+
+/** Writer-op body: fold each deleted report into its agent's permanent spend in the SAME commit. */
+export function pruneTokenUsage(cutoff: number, limit: number): { pruned: number; moreWork: boolean } {
+  const db = getDb();
+  db.query(`INSERT INTO token_usage_retention_state VALUES (1, ?)
+    ON CONFLICT(id) DO UPDATE SET expired_before = max(expired_before, excluded.expired_before)`).run(cutoff);
+  const rows = db.query(`SELECT id, agent_id, input_tokens + output_tokens + cache_read_tokens + cache_write_tokens
+    + COALESCE(reasoning_output_tokens, 0) AS tokens, usage_status IS NOT NULL AS unknown_reports
+    FROM session_token_usage WHERE created_at < ? ORDER BY created_at, id LIMIT ?`)
+    .all(cutoff, limit) as { id: number; agent_id: string; tokens: number; unknown_reports: number }[];
+  for (const row of rows) {
+    db.query(`INSERT INTO retired_token_usage_totals VALUES (?, ?, ?)
+      ON CONFLICT(agent_id) DO UPDATE SET tokens = tokens + excluded.tokens,
+        unknown_reports = unknown_reports + excluded.unknown_reports`).run(row.agent_id, row.tokens, row.unknown_reports);
+    db.query("DELETE FROM session_token_usage WHERE id = ?").run(row.id);
+  }
+  return { pruned: rows.length, moreWork: rows.length === limit };
+}

package/src/db/token-usage-write-ops.ts

@@ -13,7 +13,7 @@ export const TOKEN_USAGE_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Obj
     idempotent: true,
     fn: (args: { input: SessionTokenUsageInput }, ctx: WriterOpContext) => {
       const result = recordSessionTokenUsage(args.input);
-      const budgetNotices = recordExhaustedSpawnBudgets(result.record.agentId, ctx.now);
+      const budgetNotices = result.record ? recordExhaustedSpawnBudgets(result.record.agentId, ctx.now) : [];
       return { ...result, budgetNotices };
     },
   },

package/src/db/token-usage.ts

@@ -1,3 +1,4 @@
+import { isTokenUsageExpired } from "./token-usage-retention";
 // #2485 — the durable, provider-agnostic token-usage ledger ("the spine" of epic #2481). The three
 // capture seams write per-turn provider usage here through `tokenUsage.record`; the Analytics box
 // reads period/provider aggregates through `tokenUsage.aggregate`.
@@ -144,7 +145,7 @@ export function getSessionTokenUsageByDedupeKey(dedupeKey: string): SessionToken
  * the writer boundary as well as at the HTTP boundary, and never minted from the receipt clock,
  * so a genuine retry deterministically reuses the same key.
  */
-export function recordSessionTokenUsage(input: SessionTokenUsageInput): { record: SessionTokenUsageRecord; inserted: boolean } {
+export function recordSessionTokenUsage(input: SessionTokenUsageInput): { record: SessionTokenUsageRecord | null; inserted: boolean } {
   const { createdAt } = input;
   if (!Number.isSafeInteger(createdAt) || createdAt <= 0) {
     throw new ValidationError("createdAt required (positive epoch-milliseconds of the provider's observed usage time)");
@@ -160,6 +161,8 @@ export function recordSessionTokenUsage(input: SessionTokenUsageInput): { record
   const prior = getDb().query("SELECT * FROM session_token_usage WHERE dedupe_key = ?").get(dedupeKey) as
     | SessionTokenUsageRow
     | undefined;
+  // Transcript capture replays from byte zero after restart; acknowledge folded history without recreating it (#3619).
+  if (!prior && isTokenUsageExpired(createdAt)) return { record: null, inserted: false };
   // Bound once, at first attribution: a replacement reuses the row's Task, never the agent's current one.
   const taskId = prior ? (prior.task_id ?? undefined) : deliverableTaskIdForAgent(input.agentId);
   getDb().query(`

package/src/db/user-invites-async.ts

@@ -0,0 +1,13 @@
+import { randomUUID } from "node:crypto";
+import { getGateway } from "./gateway";
+import type { createUserInvite, acceptUserInvite } from "./user-invites";
+import { invalidateUserCount } from "./users";
+
+export function createUserInviteAsync(input: Parameters<typeof createUserInvite>[0]): Promise<ReturnType<typeof createUserInvite>> {
+  return getGateway().write("userInvites.create", input, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof createUserInvite>>;
+}
+export async function acceptUserInviteAsync(input: Parameters<typeof acceptUserInvite>[0]): Promise<ReturnType<typeof acceptUserInvite>> {
+  const user = await getGateway().write("userInvites.accept", input, { idempotencyKey: randomUUID() }) as unknown as ReturnType<typeof acceptUserInvite>;
+  invalidateUserCount();
+  return user;
+}

package/src/db/user-invites.ts

@@ -4,7 +4,7 @@
 // the password identity, so a replayed or raced code can never create a second account.
 import { createHash, randomBytes } from "node:crypto";
 import { ValidationError, getDb, writeTransaction } from "./connection.ts";
-import { createUser } from "./users.ts";
+import { createUserRow } from "./users.ts";
 import { createAuthIdentity } from "./auth-identities.ts";
 import type { User, UserRole } from "../types";
 
@@ -99,8 +99,8 @@ export function acceptUserInvite(input: { code: string; userId: string; handle:
     }
     const claimed = getDb().query("UPDATE user_invites SET used_at = ? WHERE id = ? AND used_at IS NULL").run(now, row.id);
     if (claimed.changes !== 1) throw new InviteUnavailableError("invite is invalid, expired or already used");
-    const user = createUser({ id: input.userId, handle: input.handle, displayName: input.displayName || row.display_name || input.handle, role: row.role as UserRole });
-    createAuthIdentity({ userId: user.id, provider: input.provider, providerSubject: input.handle, secretHash: input.secretHash });
+    const user = createUserRow({ id: input.userId, handle: input.handle, displayName: input.displayName || row.display_name || input.handle, role: row.role as UserRole }, now);
+    createAuthIdentity({ userId: user.id, provider: input.provider, providerSubject: input.handle, secretHash: input.secretHash }, now);
     getDb().query("UPDATE user_invites SET used_by = ? WHERE id = ?").run(user.id, row.id);
     return user;
   });

package/src/db/users.ts

@@ -91,10 +91,19 @@ export function userCount(now: number = Date.now()): number {
 }
 
 export function createUser(input: CreateUserInput): User {
+  const user = createUserRow(input);
+  invalidateUserCount();
+  return user;
+}
+
+export function invalidateUserCount(): void {
   assertMainThreadState("users.ts");
+  userCountCache = undefined;
+}
+
+export function createUserRow(input: CreateUserInput, now = Date.now()): User {
   if (!input.id) throw new ValidationError("user id is required");
   if (!input.handle) throw new ValidationError("user handle is required");
-  const now = Date.now();
   getDb()
     .query(
       `INSERT INTO users (id, handle, display_name, role, status, tenant_id, avatar_artifact_id, created_at, updated_at)
@@ -111,7 +120,6 @@ export function createUser(input: CreateUserInput): User {
       now,
       now,
     );
-  userCountCache = undefined;
   const created = getUser(input.id);
   if (!created) throw new ValidationError(`failed to create user ${input.id}`);
   return created;
@@ -121,7 +129,7 @@ export function updateUserProfile(input: {
   id: string;
   displayName?: string;
   avatarArtifactId?: string | null;
-}): User {
+}, submittedAt: number = Date.now()): User {
   const current = getUser(input.id);
   if (!current) throw new ValidationError("user not found");
   const updates: string[] = [];
@@ -137,17 +145,17 @@ export function updateUserProfile(input: {
   }
   if (!updates.length) return current;
   updates.push("updated_at = ?");
-  params.push(Date.now(), input.id);
+  params.push(submittedAt, input.id);
   getDb().query(`UPDATE users SET ${updates.join(", ")} WHERE id = ?`).run(...params);
   return getUser(input.id)!;
 }
 
 /** Change a user's role or account status (#3567 admin user list). */
-export function updateUserAccess(input: { id: string; role?: UserRole; status?: UserStatus }): User {
+export function updateUserAccess(input: { id: string; role?: UserRole; status?: UserStatus }, submittedAt: number = Date.now()): User {
   const current = getUser(input.id);
   if (!current) throw new ValidationError("user not found");
   getDb().query("UPDATE users SET role = ?, status = ?, updated_at = ? WHERE id = ?")
-    .run(input.role ?? current.role, input.status ?? current.status, Date.now(), input.id);
+    .run(input.role ?? current.role, input.status ?? current.status, submittedAt, input.id);
   return getUser(input.id)!;
 }
 

package/src/db/workflow-contact.ts

@@ -20,7 +20,7 @@ export interface WorkflowHeldContact { runId: string; reason: WorkflowContactRea
 
 /** Notices that bypass the step-contact hold: the run's own coordinator notices (including GO awaiting an external
  *  hold's release), and a step agent held on a provider block, which waits until someone acts (#3647). */
-const COORDINATOR_NOTICE_KINDS = new Set(["workflow.started", "workflow.landed", "workflow.escalated", "workflow.result", "workflow.review-passed", "agent.spawn_failed", "agent.spawn_recovered", "delegation.budget_exhausted", "agent.provider_blocked", "agent.provider_still_held"]);
+const COORDINATOR_NOTICE_KINDS = new Set(["workflow.started", "workflow.landed", "workflow.escalated", "workflow.result", "workflow.review-passed", "workflow.paused", "workflow.unpaused", "agent.spawn_failed", "agent.spawn_recovered", "delegation.budget_exhausted", "agent.provider_blocked", "agent.provider_still_held"]);
 export const WORKFLOW_SCOPE = "local";
 export const WORKFLOW_RUN_TABLE = "kernel_entity__workflow__run";
 const LINK_TABLE = "kernel_entity__workflow__link";

package/src/db/workflow-task-read-ops.ts

@@ -185,3 +185,33 @@ export function openWorkflowRunHolders(): { teamIds: Set<string>; coordinatorIds
   }
   return holders;
 }
+
+/** #3757 — a running run a coordinator paused, with its input Task's team; `pause` is the stored JSON. */
+export interface PausedWorkflowRunRow {
+  runId: string; taskId: number; taskTitle: string | null; coordinator: string; callerAgentId: string | null;
+  teamId: string | null; owner: string | null; pause: string;
+}
+
+let pauseColumnOn: unknown;
+/** The column appears when the workflow module first registers after #3757; until then nothing is paused. */
+function pauseColumnReady(): boolean {
+  const db = getDb();
+  if (pauseColumnOn === db) return true;
+  const ready = (db.query(`PRAGMA table_info(${WORKFLOW_RUN_TABLE})`).all() as Array<{ name: string }>).some((column) => column.name === "pause");
+  if (ready) pauseColumnOn = db;
+  return ready;
+}
+
+export function pausedWorkflowRuns(): PausedWorkflowRunRow[] {
+  if (!workflowTablesReady() || !pauseColumnReady()) return [];
+  return getDb().query(`SELECT run.id AS runId, run.taskId AS taskId, task.title AS taskTitle, run.coordinator AS coordinator, run.callerAgentId AS callerAgentId,
+      task.team_id AS teamId, task.owner AS owner, run.pause AS pause
+    FROM ${WORKFLOW_RUN_TABLE} run LEFT JOIN tasks task ON task.id = run.taskId
+    WHERE run.scope = ? AND run.status = 'running' AND run.pause IS NOT NULL ORDER BY run.id`).all(WORKFLOW_SCOPE) as PausedWorkflowRunRow[];
+}
+
+/** #3757 — a paused run keeps its idle step agents: the idle reapers leave them alone until it is unpaused. */
+export function workflowRunPaused(runId: string): boolean {
+  if (!workflowTablesReady() || !pauseColumnReady()) return false;
+  return Boolean(getDb().query(`SELECT 1 FROM ${WORKFLOW_RUN_TABLE} WHERE scope = ? AND id = ? AND status = 'running' AND pause IS NOT NULL`).get(WORKFLOW_SCOPE, runId));
+}

package/src/db/workspaces.ts

@@ -1,3 +1,4 @@
+import { trackRelayEvent } from "../relay-event-drain";
 import { mainThreadRegistry } from "./main-thread-state";
 import { persistWorkspace, type WorkspaceUpsertInput } from "./workspace-persistence";
 import { Database } from "bun:sqlite";
@@ -438,7 +439,7 @@ export function pruneOrphanedSharedWorkspaces(): string[] {
 // owner's branch-state badge" (#236). A hook, not a direct emit, because getDb().ts is
 // the lowest layer — sse.ts imports db, so db can't import sse without a cycle. sse
 // registers a listener at startup that re-emits the owner agent's status over SSE.
-type WorkspaceChangeListener = (workspace: WorkspaceRecord) => void;
+type WorkspaceChangeListener = (workspace: WorkspaceRecord) => unknown;
 export const workspaceChangeListeners = mainThreadRegistry("workspaces.ts:workspaceChangeListeners", new Set<WorkspaceChangeListener>());
 export function onWorkspaceChange(listener: WorkspaceChangeListener): void {
   workspaceChangeListeners.add(listener);
@@ -447,7 +448,8 @@ export function emitWorkspaceChange(workspace: WorkspaceRecord | null | undefine
   if (!workspace) return;
   for (const listener of workspaceChangeListeners) {
     try {
-      listener(workspace);
+      const result = listener(workspace);
+      if (result instanceof Promise) trackRelayEvent(result, "workspace.changed");
     } catch {
       // A badge-refresh listener must never break a workspace write.
     }
@@ -455,15 +457,16 @@ export function emitWorkspaceChange(workspace: WorkspaceRecord | null | undefine
 }
 
 // #1870 — workspace-create effects stay on main; index.ts registers the issue activity handler.
-type WorkspaceCreateListener = (workspace: WorkspaceRecord) => void;
+type WorkspaceCreateListener = (workspace: WorkspaceRecord) => void | Promise<void>;
 const workspaceCreateListeners = mainThreadRegistry("workspaces.ts:workspaceCreateListeners", new Set<WorkspaceCreateListener>());
 export function onWorkspaceCreate(listener: WorkspaceCreateListener): void {
   workspaceCreateListeners.add(listener);
 }
-function emitWorkspaceCreate(workspace: WorkspaceRecord): void {
+export function emitWorkspaceCreate(workspace: WorkspaceRecord): void {
   for (const listener of workspaceCreateListeners) {
     try {
-      listener(workspace);
+      const result = listener(workspace);
+      if (result) trackRelayEvent(result, "workspace.created");
     } catch {
       // A create listener must never break a workspace write.
     }

package/src/db/write-ops.ts

@@ -1,3 +1,11 @@
+import { TIMER_CUTOVER_COORDINATOR_WRITE_OPS } from "./timer-cutover-bodies";
+import { RUNTIME_ADMIN_WRITE_OPS } from "./runtime-admin-write-ops";
+import { AUTOMATION_WRITE_OPS } from "./automation-write-ops";
+import { RUNTIME_TAIL_WRITE_OPS } from "./runtime-tail-write-ops";
+import { LIFECYCLE_TAIL_WRITE_OPS } from "./lifecycle-tail-write-ops";
+import { NOTIFICATION_WRITE_OPS } from "./notification-write-ops";
+import { HISTORY_RETENTION_WRITE_OPS } from "./history-retention-ops";
+import { INTEGRATIONS_WRITE_OPS } from "./integrations-ops.ts";
 import { bufferedLastSeen, type PresenceSnapshot } from "./presence-buffer";
 import { ensureDurablePayloadSchema, readRetryReceipt, storeDurablePayload } from "./durable-payloads";
 import { ledgerSlotPredicate, ledgerSlots, WRITER_IDEMPOTENCY_RETENTION_MS } from "./writer-ledger";
@@ -5,6 +13,7 @@ import { workspaceChangeListeners } from "./workspaces";
 import { withWriterOpState } from "./main-thread-state";
 import { importVaultRows } from "./secrets-vault-import";
 import { PROMPT_VERSION_WRITE_OPS } from "./prompt-versions-ops";
+import { PROJECT_PROFILE_INSTRUCTION_WRITE_OPS } from "./project-profile-instructions";
 import { VAULT_WRITE_OPS } from "./secrets-vault-write";
 import { VAULT_EXPIRY_WRITE_OPS } from "./vault-expiry";
 import { VAULT_BACKUP_WRITE_OPS } from "./vault-backup";
@@ -40,6 +49,7 @@ import { CLAUDE_API_BUDGET_WRITE_OPS } from "./claude-api-budget-ops";
 // file is the seam they plug into, not the final op set.
 
 import type { Database } from "bun:sqlite";
+import { WRITER_FAULT_TEST_OPS } from "./writer-fault-test-ops";
 import { ValidationError } from "@humwick/sdk";
 import { getDb, inWriteTransaction } from "./connection.ts";
 import type { SerializedDbError } from "./db-error-registry.ts";
@@ -91,6 +101,7 @@ import { PLANS_WRITE_OPS } from "./plans-write-ops.ts";
 import { CONTINUATION_ARCHIVES_WRITE_OPS } from "./continuation-archives-write-ops.ts";
 import { WORKFLOW_JOURNAL_WRITE_OPS } from "./workflow-journal-write-ops.ts";
 import { WORKFLOW_STEP_TASK_WRITE_OPS } from "./workflow-step-tasks.ts";
+import { PROJECT_ENTRIES_WRITE_OPS } from "./project-entries-write-ops";
 import { PROJECTS_WRITE_OPS } from "./projects-write-ops.ts";
 import { CHANNELS_WRITE_OPS } from "./channels-write-ops.ts";
 import { CI_INCIDENTS_WRITE_OPS } from "./ci-incidents-write-ops.ts";
@@ -117,6 +128,7 @@ import { RESTART_EPOCH_WRITE_OPS } from "./restart-epoch-write-ops.ts";
 import { TOKEN_USAGE_WRITE_OPS } from "./token-usage-write-ops.ts";
 // #1870 S3 — the 1 s raw writers: maintenance leases/runs, pending issue closes, workspace lifecycle.
 import { MAINTENANCE_JOB_WRITE_OPS } from "./maintenance-job-write-ops.ts";
+import { ISSUE_REFS_WRITE_OPS } from "./issue-refs-write-ops.ts";
 import { LONG_RUNNING_WORK_WRITE_OPS } from "./long-running-work-write-ops.ts";
 import { WORKSPACE_WRITE_OPS } from "./workspace-write-ops.ts";
 
@@ -196,6 +208,10 @@ export interface WriterOpSpec {
   /** This complete operation has no main-thread effects and may use the file-backed writer. */
   readonly offLoop?: boolean;
   readonly idempotent: boolean;
+  /** #3614 — a non-idempotent op whose keyless callers never resubmit: it runs without a key and
+   * writes no ledger row, and a lost acknowledgement stays indeterminate for that caller. A caller
+   * that does retry still passes a key and gets the ledger's exactly-once dedup. */
+  readonly atMostOnce?: true;
   readonly fn: WriterOp;
   /** Sanitizes a result before it enters the durable retry ledger. Results can include a newly-created
    * command's caller-visible plaintext env, while the ledger is readable as raw DB state. */
@@ -231,14 +247,7 @@ const PROBE_DDL = `
 // durable across a worker death (the phantom-failure case), because it lives in the DB, not in memory.
 export { WRITER_IDEMPOTENCY_RETENTION_MS };
 
-/**
- * Create the seam-probe + dedup schema. This models real schema bootstrap (§4, the allowlisted
- * bootstrap layer): DDL runs ONCE at startup as its own committed statement, NOT lazily inside an op —
- * a rolled back op must never undo the schema it ran against. Ops below therefore assume the tables
- * exist, just as relocated real ops assume the migrated catalog exists (H6/§3.1). Idempotent
- * (`IF NOT EXISTS`), so it is safe to call on both the in-process connection and, at bootstrap, on the
- * file that the worker later opens (WAL makes the committed tables visible cross-connection, §3.5).
- */
+// Probe tables are installed at bootstrap, outside writer transactions.
 export function ensureSeamProbeSchema(db: Database = getDb()): void {
   if (db.inTransaction) throw new Error("ensureSeamProbeSchema must run at bootstrap, not inside a transaction");
   db.run(PROBE_DDL);
@@ -274,6 +283,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // call inserts a NEW row — NON-idempotent: a retry without dedup would double-apply, so the gateway
   // requires an idempotencyKey and the executor dedups on it.
   "seam.append": {
+    offLoop: true,
     idempotent: false,
     fn: (args: { tag: string; value?: string }, ctx) => {
       const row = getDb()
@@ -393,11 +403,17 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
   if (!mergedWriterOps) {
     mergedWriterOps = Object.freeze({
       ...WRITER_OPS,
+      ...WRITER_FAULT_TEST_OPS,
       ...VAULT_TOKEN_WRITE_OPS,
       ...VAULT_HEALTH_WRITE_OPS,
       ...WORKSPACE_REKEY_WRITE_OPS,
       ...PAIRS_WRITE_OPS,
       ...MESSAGE_WRITE_OPS,
+    ...NOTIFICATION_WRITE_OPS,
+    ...LIFECYCLE_TAIL_WRITE_OPS,
+    ...RUNTIME_TAIL_WRITE_OPS,
+    ...AUTOMATION_WRITE_OPS,
+    ...RUNTIME_ADMIN_WRITE_OPS,
       ...COMMANDS_WRITE_OPS,
       ...RESTART_EPOCH_WRITE_OPS,
       ...BUS_OUTBOX_WRITE_OPS,
@@ -406,12 +422,14 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
   ...ROUTING_POLICY_WRITE_OPS,
       ...USER_SETTINGS_WRITE_OPS,
   ...PROMPT_VERSION_WRITE_OPS,
+  ...PROJECT_PROFILE_INSTRUCTION_WRITE_OPS,
       ...TOKEN_DB_WRITE_OPS,
       ...DELIVERY_WRITE_OPS,
       ...TIMER_WRITE_OPS,
       ...TIMER_INGRESS_WRITE_OPS,
       ...TIMER_TRANSFER_WRITE_OPS,
       ...TIMER_CUTOVER_WRITE_OPS,
+    ...TIMER_CUTOVER_COORDINATOR_WRITE_OPS,
       ...TASK_WRITE_OPS,
       ...AGENTS_WRITE_OPS,
       ...AGENT_LIFECYCLE_WRITE_OPS,
@@ -439,7 +457,9 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
     ...WORKFLOW_STEP_TASK_WRITE_OPS,
     ...SPAWN_TREE_CLEANUP_WRITE_OPS,
     ...PROJECTS_WRITE_OPS,
+    ...PROJECT_ENTRIES_WRITE_OPS,
     ...CHANNELS_WRITE_OPS,
+    ...INTEGRATIONS_WRITE_OPS,
     ...CI_INCIDENTS_WRITE_OPS,
     ...TEAMS_WRITE_OPS,
     ...TEAM_SPAWN_DELEGATION_WRITE_OPS,
@@ -468,8 +488,10 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
     ...TOKEN_USAGE_WRITE_OPS,
     ...MAINTENANCE_JOB_WRITE_OPS,
     ...LONG_RUNNING_WORK_WRITE_OPS,
+    ...ISSUE_REFS_WRITE_OPS,
     ...WORKSPACE_WRITE_OPS,
     ...WEB_TOOL_CALL_WRITE_OPS,
+    ...HISTORY_RETENTION_WRITE_OPS,
     ...CLAUDE_API_BUDGET_WRITE_OPS,
   ...CLAUDE_APP_OAUTH_WRITE_OPS,
     });
@@ -481,10 +503,12 @@ export function isKnownWriterOp(op: string): boolean {
   return Object.prototype.hasOwnProperty.call(allWriterOps(), op);
 }
 
-/** Whether a registered op is safe to re-apply without an idempotency key (H5 §3.7.1). Throws for an
- *  unknown op so a typo cannot silently pass the gateway's keyless-write gate. */
-export function isIdempotentWriterOp(op: string): boolean {
-  return resolveOp(op).idempotent;
+/** Whether a registered op may be submitted without an idempotency key (H5 §3.7.1): it is safe to
+ *  re-apply, or it is at-most-once. Throws for an unknown op so a typo cannot silently pass the
+ *  gateway's keyless-write gate. */
+export function writerOpAllowsKeyless(op: string): boolean {
+  const spec = resolveOp(op);
+  return spec.idempotent || spec.atMostOnce === true;
 }
 
 export function isOffLoopWriterOp(op: string): boolean {
@@ -506,6 +530,7 @@ function resolveOp(op: string): WriterOpSpec {
  */
 function applyOnce(op: string, spec: WriterOpSpec, args: unknown, ctx: WriterOpContext, key: string | undefined): unknown {
   if (spec.idempotent) return spec.fn(args, ctx); // safe to re-apply, no key needed
+  if (key === undefined && spec.atMostOnce) return spec.fn(args, ctx); // no retry, so nothing to dedup
   // STRUCTURAL enforcement at the executor (H5 §3.7.1): a non-idempotent op MUST carry a key here, so
   // the invariant holds even for a direct executor caller that bypassed the gateway guard. Rejecting
   // BEFORE spec.fn means zero rows are written, so a keyless non-idempotent write can never duplicate.

package/src/db/writer-fault-seam.ts

@@ -24,10 +24,6 @@
 // `threadId` is still recorded and checked as belt-and-braces for an exotic case where a fault is
 // armed on a thread that later dispatches ops elsewhere.
 //
-// This is deliverable under the IN-PROCESS backend, which is the gateway default (`initGateway`
-// chooses in-process even for a file DB) and therefore what the whole default suite and every
-// existing chaos-worker subprocess run — so no existing crash seam loses its injection.
-
 import { threadId } from "node:worker_threads";
 
 interface ArmedWriterFault {
@@ -36,10 +32,7 @@ interface ArmedWriterFault {
   readonly threadId: number;
 }
 
-// Deliberately NOT a mainThreadRegistry (#1870 S6a): off-loop op bodies call `writerFault`, and on the
-// writer thread this map is empty, so the lookup is a harmless no-op there. Delivery is kept honest at
-// dispatch: while a fault is armed the in-process backend runs off-loop ops on the arming thread
-// (writer-gateway `dispatchEntry`), and arming refuses under the worker backend.
+// Each writer thread owns its fault registry. File-backed tests arm named actions on that thread.
 const armed = new Map<string, ArmedWriterFault>();
 
 /**
@@ -67,7 +60,7 @@ export function armWriterFault(name: string, fn: () => void): () => void {
     throw new Error(
       `writer fault '${name}' cannot be armed: the gateway writer backend is 'worker', so this ` +
         `main-thread closure can never run inside the writer op's transaction and the crash would ` +
-        `not be injected at all. Arm faults against the in-process backend (the gateway default), ` +
+        `not be injected at all. Use :memory: for closure faults, arm a named seam.armFault action on the writer, ` +
         `or assert the behaviour without an in-transaction crash seam.`,
     );
   }

package/src/db/writer-fault-test-ops.ts

@@ -0,0 +1,18 @@
+import { armWriterFault } from "./writer-fault-seam";
+import type { WriterOpSpec } from "./write-ops";
+
+// Named actions cross the worker seam; main-thread closures cannot (#1870 S8).
+export const WRITER_FAULT_TEST_OPS = {
+  "seam.armFault": {
+    offLoop: true,
+    idempotent: true,
+    fn: (args: { name: string; action: "kill" | "throw" }) => {
+      if (args.action !== "kill" && args.action !== "throw") throw new Error("unknown writer test fault");
+      armWriterFault(args.name, () => {
+        if (args.action === "kill") process.kill(process.pid, "SIGKILL");
+        throw new Error(`injected writer fault: ${args.name}`);
+      });
+      return null;
+    },
+  },
+} satisfies Record<string, WriterOpSpec>;