@humwick/server 0.130.1 → 0.130.3

package/src/operator-alarm.ts

@@ -1,4 +1,5 @@
 import { createActivityEventWithResult } from "./db";
+import { createActivityEventByClientIdAsync } from "./db/activity-async";
 import { emitRelayEvent } from "./events";
 
 export interface OperatorAlarmInput {
@@ -20,22 +21,33 @@ export interface OperatorAlarmInput {
 // done. This raises a distinct `operator.alarm` relay event (dashboard banner) plus a
 // persisted `operator`-kind activity event, so a relay with no reachable escalation target
 // is observable instead of looping forever in the dark.
-export function raiseOperatorAlarm(input: OperatorAlarmInput): boolean {
-  const { created } = createActivityEventWithResult({
-    clientId: input.clientId,
-    kind: "operator",
-    title: input.subject,
-    body: input.detail,
-    icon: "ti-alert-octagon",
-    view: input.view ?? "orchestrators",
-    metadata: { source: input.source, operatorAlarm: true, ...(input.metadata ?? {}) },
-  });
-  if (input.dedupeEvent && !created) return false;
+const alarmEvent = (input: OperatorAlarmInput) => ({
+  clientId: input.clientId,
+  kind: "operator" as const,
+  title: input.subject,
+  body: input.detail,
+  icon: "ti-alert-octagon",
+  view: input.view ?? "orchestrators",
+  metadata: { source: input.source, operatorAlarm: true, ...(input.metadata ?? {}) },
+});
+
+function emitAlarm(input: OperatorAlarmInput): void {
   emitRelayEvent({
     type: "operator.alarm",
     source: input.source,
     subject: input.subject,
     data: { subject: input.subject, detail: input.detail, ...(input.metadata ?? {}) },
   });
+}
+
+export async function raiseOperatorAlarm(input: OperatorAlarmInput): Promise<boolean> {
+  return raiseOperatorAlarmAsync(input);
+}
+
+/** Same as `raiseOperatorAlarm`, with the activity row written on the writer thread. */
+export async function raiseOperatorAlarmAsync(input: OperatorAlarmInput): Promise<boolean> {
+  const { created } = await createActivityEventByClientIdAsync(alarmEvent(input));
+  if (input.dedupeEvent && !created) return false;
+  emitAlarm(input);
   return true;
 }

package/src/project-ingest.ts

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { listProjectEntries, rootsForProject, retractProjectEntry, writeProjectEntry } from "./db";
+import { listProjectEntriesAsync, rootsForProjectAsync, retractProjectEntryAsync, writeProjectEntryAsync } from "./db";
 import { projectFileRoots, readProjectRootFile } from "./project-file-source";
 import type { ProjectEntry } from "./types";
 
@@ -117,7 +117,7 @@ export async function ingestClaudeMd(projectId: string, authorId: string): Promi
   // Index prior *ingested* entries by origin_ref (newest active wins). We only ever
   // read source:'ingested' here — manual/promoted are invisible to ingest by design.
   const byOrigin = new Map<string, ProjectEntry>();
-  for (const entry of listProjectEntries(projectId)) {
+  for (const entry of await listProjectEntriesAsync(projectId)) {
     if (entry.source !== "ingested" || !entry.originRef) continue;
     if (!byOrigin.has(entry.originRef)) byOrigin.set(entry.originRef, entry);
   }
@@ -128,7 +128,7 @@ export async function ingestClaudeMd(projectId: string, authorId: string): Promi
   let updated = 0;
   let unchanged = 0;
 
-  const registered = projectFileRoots(rootsForProject(projectId));
+  const registered = projectFileRoots(await rootsForProjectAsync(projectId));
   if (!registered.length && byOrigin.size) throw new Error(`no confirmed checkout host owns project ${projectId}`);
   for (const root of registered) {
     let filePath = join(root.rootPath, INGEST_FILENAME);
@@ -153,7 +153,7 @@ export async function ingestClaudeMd(projectId: string, authorId: string): Promi
           unchanged++;
           continue;
         }
-        writeProjectEntry({
+        await writeProjectEntryAsync({
           projectId,
           authorId,
           kind: "rule",
@@ -166,7 +166,7 @@ export async function ingestClaudeMd(projectId: string, authorId: string): Promi
         });
         updated++;
       } else {
-        writeProjectEntry({
+        await writeProjectEntryAsync({
           projectId,
           authorId,
           kind: "rule",
@@ -187,7 +187,7 @@ export async function ingestClaudeMd(projectId: string, authorId: string): Promi
   let retracted = 0;
   for (const [originRef, entry] of byOrigin) {
     if (seen.has(originRef)) continue;
-    retractProjectEntry(entry.id);
+    await retractProjectEntryAsync(entry.id);
     retracted++;
   }
 

package/src/project-instructions.ts

@@ -2,6 +2,7 @@ import { composeMemoryPreambleAsync } from "./memory-preamble-async";
 import { composeHostAwareness } from "./host-awareness";
 import { composeGuideIndex } from "./guides";
 import { profileInstructionBlocks } from "./profile-instruction-blocks";
+import { projectProfileInstructionBlock } from "./project-profile-instructions";
 // Spawn-time instruction sources (#557) — the relay-owned composer that assembles what a spawned
 // agent's systemPromptAppend says, from declared sources only, never from host CLAUDE.md.
 //
@@ -261,6 +262,13 @@ export function stripHumwickIdentitySection(value: string): string {
     .replace(/\n\n+$/, "");
 }
 
+/** The relay-owned marked sections a prompt carries on top of the startup blocks: identity, memory
+ *  and journal. The ONE strip every reader of a launched prompt uses, so a block added here (#3782:
+ *  the journal) cannot be forgotten by one of them. */
+export function stripRelayOwnedSections(value: string): string {
+  return stripJournalPreamble(stripMemoryPreamble(stripHumwickIdentitySection(value)));
+}
+
 export function composeSpawnInstructionsWithEvents(input: {
   /** Resolved fact from the selected profile's Project Instructions cell. Absent fails closed. */
   projectInstructionsEnabled?: boolean;
@@ -283,6 +291,7 @@ export function composeSpawnInstructionsWithEvents(input: {
    * host → project`, audience-filtered by `profile`). Absent → no memory block at all, so a
    * caller that does not know the identity produces a byte-identical pre-#1565 spawn. */
   memoryIdentity?: MemoryIdentity;
+  projectId?: string;
   profile?: Pick<AgentProfile, "instructions" | "maxSpawnedAgents" | "hostAwareness" | "roleAssets"> & { name?: string; relay?: AgentProfile["relay"] };
   spawnedBy?: string;
   /** #3045 — a workflow step agent: its step reporting block replaces the spawned-child report-up. */
@@ -475,6 +484,8 @@ export function composeSpawnInstructionsWithEvents(input: {
   const { system: profileSystem, append: profileAppend } = profileInstructionBlocks(input.profile, input.memoryIdentity?.provider);
   if (profileSystem) appendBlocks.push(profileSystem);
   appendBlocks.push(...profileAppend);
+  const projectProfile = projectProfileInstructionBlock(input.projectId ?? input.memoryIdentity?.projectId, input.profile?.name ?? input.memoryIdentity?.profile);
+  if (projectProfile) { appendBlocks.push(projectProfile.content); relayInjectionEvents.push(projectProfile.event); }
   // After the profile, so the step rule is the last word over a charter's report-to-spawner text.
   if (input.workflowRunId) {
     const instruction = renderTemplate("spawn.reportup.workflow-step", { runId: input.workflowRunId });
@@ -522,7 +533,7 @@ export function composeSpawnInstructionsWithEvents(input: {
   // strict about what it removes, so a brief that merely mentions a marker survives intact — and
   // neutralizing what survives keeps it from being read as this prompt's memory/journal block later.
   const callerSystemPromptAppend = input.callerSystemPromptAppend
-    ? neutralizeJournalMarkers(neutralizeMemoryMarkers(stripJournalPreamble(stripMemoryPreamble(stripHumwickIdentitySection(input.callerSystemPromptAppend)))))
+    ? neutralizeJournalMarkers(neutralizeMemoryMarkers(stripRelayOwnedSections(input.callerSystemPromptAppend)))
     : undefined;
   if (callerSystemPromptAppend?.trim()) {
     appendBlocks.push(callerSystemPromptAppend);

package/src/project-profile-instruction-text.ts

@@ -0,0 +1,6 @@
+import { assertNoControlBytes, ValidationError } from "@humwick/sdk";
+
+export function validateProjectProfileInstructionText(value: unknown, source: string): asserts value is string {
+  if (typeof value !== "string" || value.length > 16_000) throw new ValidationError(`${source} must be a string up to 16000 characters`);
+  assertNoControlBytes(value, source);
+}

package/src/project-profile-instructions.ts

@@ -0,0 +1,20 @@
+import { errMessage } from "@humwick/sdk";
+import { getProjectProfileInstructions } from "./db/project-profile-instructions";
+import { validateProjectProfileInstructionText } from "./project-profile-instruction-text";
+
+/** #3515 — one optional block at the charter seam, independent of project memory's switch. */
+export function projectProfileInstructionBlock(projectId: string | undefined, profile: string | undefined) {
+  if (!projectId || !profile) return;
+  const source = `project ${projectId} profile ${profile} instructions`;
+  try {
+    const entry = getProjectProfileInstructions({ projectId, profile });
+    validateProjectProfileInstructionText(entry.template, source);
+    const content = entry.template.trim();
+    if (!content) return;
+    return { content, event: { category: "instructions" as const,
+      summary: `injected ${source} v${entry.version}`,
+      detail: { source: "project-profile-instructions", projectId, profile, version: entry.version, content } } };
+  } catch (error) {
+    console.warn(`[launch] skipped ${source}: ${errMessage(error)}`);
+  }
+}

package/src/project-trust.ts

@@ -1,8 +1,9 @@
+import { upsertProjectTrustApprovalAsync } from "./db/runtime-tail-async";
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { shellEscape, ValidationError, type AgentProfile, type ProfileAssetCell, type ProfileProjectCells, type ProfileProjectGate, type ProfileProjectReviewMode, type ProfileProjectTrustScope, type Project } from "@humwick/sdk";
 import { rootsForProject, resolveProjectForCwd } from "./db/projects";
-import { getProjectTrustApproval, upsertProjectTrustApproval, type ProjectTrustApproval, type ProjectTrustCapability } from "./db/project-trust-approvals";
+import { getProjectTrustApproval, type ProjectTrustApproval, type ProjectTrustCapability } from "./db/project-trust-approvals";
 import { observeCapabilityReview } from "./project-trust-fingerprint";
 import { canonicalRoot } from "./services/canonical-root";
 import { isPathWithinBase } from "./utils";
@@ -35,26 +36,26 @@ function repoKeyFor(cwd: string): string {
 /** Records `approvedValue` (a `sha256:<hex>` or `commit:<sha>`, matching `mode`) as trusted for
  * this (profile, repo, capability) — the dashboard/API one-click approve action. Format-validated
  * here so a malformed value can never be written through the trust store's only public writer. */
-export function approveProjectCapabilityReview(input: {
+export async function approveProjectCapabilityReview(input: {
   profileName: string;
   repoKey: string;
   capability: ProjectCapability;
   mode: "fingerprint" | "commit";
   approvedValue: string;
   approvedBy: string;
-}): ProjectTrustApproval {
+}): Promise<ProjectTrustApproval> {
   const prefix = input.mode === "commit" ? "commit:" : "sha256:";
   if (!input.approvedValue.startsWith(prefix)) {
     throw new ValidationError(`approved value must be prefixed "${prefix}" for ${input.mode} review`);
   }
-  return upsertProjectTrustApproval({
+  return (await upsertProjectTrustApprovalAsync({
     profileName: input.profileName,
     repoKey: input.repoKey,
     capability: input.capability,
     reviewMode: input.mode,
     approvedValue: input.approvedValue,
     approvedBy: input.approvedBy,
-  });
+  }));
 }
 
 /** Stable JSON is intentionally local to this small trust seam. The hash is an
@@ -142,13 +143,13 @@ export interface ProjectCapabilityGateOpts {
   pinnedMcpCommit?: string;
 }
 
-export function projectCapabilityGate(
+export async function projectCapabilityGate(
   profile: AgentProfile,
   capability: ProjectCapability,
   cwd: string,
   registeredProject?: Project | null,
   opts?: ProjectCapabilityGateOpts,
-): ProfileProjectGate {
+): Promise<ProfileProjectGate> {
   const project = profile.sources?.project;
   const cell = capabilityCell(profile, capability);
   if (!project || !cell?.enabled) {
@@ -238,7 +239,7 @@ export function projectCapabilityGate(
       // approved instead of failing closed, so shipping G3 does not instantly regress every
       // already-trusted profile. Only a SUBSEQUENT change (a different observed value) fails
       // closed from here on.
-      upsertProjectTrustApproval({ profileName: profile.name, repoKey, capability, reviewMode: mode, approvedValue: observed, approvedBy: "system:grandfathered" });
+      (await upsertProjectTrustApprovalAsync({ profileName: profile.name, repoKey, capability, reviewMode: mode, approvedValue: observed, approvedBy: "system:grandfathered" }));
       return { allowed: true, reason: "allowed", detail: gateDetail(capability, `${scopeDetail} (grandfathered ${observed})`), observed, repoKey, reviewMode: mode };
     }
     // `commit` review has no grandfather: it is the stricter opt-in mode, so first encounter
@@ -254,9 +255,9 @@ export function projectCapabilityGate(
 /** Stamp the server's per-spawn decisions onto a cloned profile. The source cells
  * remain visible for truthful projection; the runner consumes only these decisions
  * for filesystem materialization. */
-export function applyProjectCapabilityGates(profile: AgentProfile, cwd: string, registeredProject?: Project | null, opts?: ProjectCapabilityGateOpts): AgentProfile {
+export async function applyProjectCapabilityGates(profile: AgentProfile, cwd: string, registeredProject?: Project | null, opts?: ProjectCapabilityGateOpts): Promise<AgentProfile> {
   if (!profile.sources?.project) return profile;
-  const hooks = projectCapabilityGate(profile, "hooks", cwd, registeredProject, opts);
-  const mcp = projectCapabilityGate(profile, "mcp", cwd, registeredProject, opts);
+  const hooks = (await projectCapabilityGate(profile, "hooks", cwd, registeredProject, opts));
+  const mcp = (await projectCapabilityGate(profile, "mcp", cwd, registeredProject, opts));
   return { ...profile, projectGates: { hooks, mcp } };
 }

package/src/prompt-resolver.ts

@@ -250,7 +250,7 @@ const DEFAULT_PROMPT_TEMPLATES = [
       "{{context}}",
       "Acceptance — done when:",
       "{{doneWhen}}",
-      "",
+      "{{afterLand}}",
       "Linked issue spec (resolved server-side once — do NOT re-read GitHub):",
       "{{issues}}",
       "",
@@ -275,7 +275,7 @@ const DEFAULT_PROMPT_TEMPLATES = [
       "{{context}}",
       "Acceptance — done when:",
       "{{doneWhen}}",
-      "",
+      "{{afterLand}}",
       "Linked issue spec (resolved server-side once — do NOT re-read GitHub):",
       "{{issues}}",
       "",
@@ -288,7 +288,7 @@ const DEFAULT_PROMPT_TEMPLATES = [
       "Latest steer (act on this now):",
       "{{steer}}",
     ),
-    variables: ["taskId", "title", "status", "stage", "owner", "intent", "context", "doneWhen", "issues", "decisions", "history", "memory", "steer"],
+    variables: ["taskId", "title", "status", "stage", "owner", "intent", "context", "doneWhen", "afterLand", "issues", "decisions", "history", "memory", "steer"],
   },
   {
     slug: "context.advisory.warn",

package/src/provider-catalog-store.ts

@@ -1,7 +1,7 @@
 import {
   deriveProviderDisabledState,
   disabledProviderSet,
-  providerCatalogList,
+  providerMetadataList,
   type ProviderCatalogEntry,
   type ProviderContextThreshold,
   type ProviderEnablementSetting,
@@ -44,7 +44,7 @@ export interface ProviderModelOverrideInput {
 
 function listProviderModelOverrides(): ProviderModelOverride[] {
   const rows = getDb()
-    .query("SELECT * FROM provider_model_overrides ORDER BY provider ASC, alias ASC")
+    .query("SELECT * FROM provider_model_overrides ORDER BY provider ASC, rowid ASC")
     .all() as ProviderModelOverrideRow[];
   return rows.map(rowToOverride).filter((entry): entry is ProviderModelOverride => Boolean(entry));
 }
@@ -120,7 +120,7 @@ export function setProviderDefaultModel(provider: SpawnProvider, alias: string,
 }
 
 export function effectiveProviderCatalogList(now = Date.now()): ProviderCatalogEntry[] {
-  const catalog = mergeProviderCatalog(providerCatalogList(), listProviderModelOverrides());
+  const catalog = mergeProviderCatalog(providerMetadataList(), listProviderModelOverrides());
   const defaults = getDb().query("SELECT provider, alias FROM provider_model_defaults").all() as Array<{ provider: string; alias: string }>;
   for (const { provider, alias } of defaults) {
     const entry = catalog.find((item) => item.provider === provider);
@@ -215,9 +215,6 @@ function normalizeOverrideInput(input: ProviderModelOverrideInput): ProviderMode
   if (limits) entry.limits = limits;
   else delete entry.limits;
   delete entry.disabled;
-  // #368 — unavailable is a static catalog fact (provider-side suspension), not an operator toggle;
-  // strip it from DB overrides so an admin can't accidentally clear a catalog-level suspension.
-  delete entry.unavailable;
   // #2598 — `deleted` is a row-level tombstone column, never part of a stored entry blob.
   delete (entry as unknown as Record<string, unknown>).deleted;
   return {
@@ -288,49 +285,6 @@ function allowlistedLimitConfidence(value: unknown): ProviderModelLimitWindow["c
     : "declared";
 }
 
-/**
- * #2598 — additive, idempotent backfill of every static-catalog model into `provider_model_overrides`,
- * so the whole catalogue is uniformly DB-backed and operator-editable. Rules:
- *   - INSERT-ONLY-IF-ABSENT (`ON CONFLICT DO NOTHING`): an existing row — a prior seed OR an operator
- *     edit OR an operator delete-tombstone — is never touched, so operator edits ALWAYS win and a
- *     deleted static model is never resurrected. Re-runnable; a re-run inserts only genuinely NEW
- *     static models (e.g. added by a later release).
- *   - SKIP disabled/unavailable static models: materializing them would strip those flags at the
- *     write chokepoint (#368/#643) and resurrect a suspended model as spawnable. They stay
- *     static-only until an operator explicitly adds them.
- * Stamped `updated_by = <stamp>` (e.g. `seed:<version>`) purely for provenance; precedence is decided
- * by row EXISTENCE, not by parsing the stamp.
- */
-export function seedProviderModelOverrides(stamp: string, now = Date.now()): { inserted: number } {
-  const db = getDb();
-  const existing = new Map<string, Set<string>>();
-  for (const row of db.query("SELECT provider, alias FROM provider_model_overrides").all() as Array<{ provider: string; alias: string }>) {
-    let aliases = existing.get(row.provider);
-    if (!aliases) existing.set(row.provider, (aliases = new Set()));
-    aliases.add(row.alias);
-  }
-  let inserted = 0;
-  const insert = db.query(`
-    INSERT INTO provider_model_overrides (provider, alias, entry, deleted, disabled, updated_at, updated_by)
-    VALUES (?, ?, ?, 0, 0, ?, ?)
-    ON CONFLICT(provider, alias) DO NOTHING
-  `);
-  const seed = db.transaction(() => {
-    for (const providerEntry of providerCatalogList()) {
-      const seen = existing.get(providerEntry.provider);
-      for (const model of providerEntry.models) {
-        if (model.disabled || model.unavailable) continue;
-        if (seen?.has(model.alias)) continue;
-        const normalized = normalizeOverrideInput({ provider: providerEntry.provider, alias: model.alias, entry: model, updatedBy: stamp });
-        const result = insert.run(normalized.provider, normalized.alias, JSON.stringify(normalized.entry), now, normalized.updatedBy ?? null);
-        if (result.changes > 0) inserted++;
-      }
-    }
-  });
-  seed();
-  return { inserted };
-}
-
 function rowToOverride(row: ProviderModelOverrideRow): ProviderModelOverride | undefined {
   const parsed = parseJson<ProviderModelCatalogEntry | undefined>(row.entry, undefined);
   if (!parsed || typeof parsed.alias !== "string") return undefined;

package/src/provider-config-store.ts

@@ -4,7 +4,8 @@ import { hostname } from "node:os";
 import { join } from "node:path";
 import { ValidationError, listOrchestrators } from "./db";
 import { isSecretEnvKey } from "./db/provider-config-secrets";
-import { getConfig, listConfig, setConfig } from "./config-store";
+import { getConfig, listConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
 import { localOrchestratorIdFromEnv, providerConfigHomeFromEnv } from "./config";
 import { cleanString, cleanStringArray, optionalEnum } from "./validation";
 import { emitConfigChanged } from "./sse";
@@ -90,11 +91,11 @@ export function listProviderConfigEntries(host = defaultProviderConfigHost()): R
   ) as Record<SpawnProvider, ProviderConfigEntry>;
 }
 
-export function setProviderConfig(
+export async function setProviderConfigAsync(
   provider: string,
   value: unknown,
   opts: { host?: string; updatedBy?: string } = {},
-): ProviderConfigEntry {
+): Promise<ProviderConfigEntry> {
   const cleanProvider = normalizeProviderConfigProvider(provider);
   const host = normalizeProviderConfigHost(opts.host ?? defaultProviderConfigHost());
   const normalized = cleanProviderConfig(cleanProvider, resolveMaskedEnvSentinels(value, host, cleanProvider));
@@ -102,7 +103,7 @@ export function setProviderConfig(
   ensureProviderConfigDescriptors([key]);
   const validation = validateSettingValue(PROVIDER_CONFIG_NAMESPACE, key, normalized);
   if (!validation.valid) throw new ValidationError(validation.errors.join("; "));
-  return setConfig(PROVIDER_CONFIG_NAMESPACE, key, normalized, opts.updatedBy) as ProviderConfigEntry;
+  return await setConfigAsync(PROVIDER_CONFIG_NAMESPACE, key, normalized, opts.updatedBy) as ProviderConfigEntry;
 }
 
 export function providerConfigPublic(entry: ProviderConfigEntry, opts: { maskEnv?: boolean } = {}): Record<string, unknown> {
@@ -138,11 +139,11 @@ export function providerConfigPublic(entry: ProviderConfigEntry, opts: { maskEnv
  * This is the server-authority write path: callers are in-process (local migration
  * or the orchestrator command-bus result handler), so no HTTP scope is required.
  */
-export function seedProviderConfigs(
+export async function seedProviderConfigsAsync(
   host: string,
   rawByProvider: Record<string, unknown>,
   opts: { legacyHost?: string } = {},
-): ProviderConfigEntry[] {
+): Promise<ProviderConfigEntry[]> {
   const seeded: ProviderConfigEntry[] = [];
   const cleanHost = normalizeProviderConfigHost(host);
   const legacyHost = opts.legacyHost ? normalizeProviderConfigHost(opts.legacyHost) : undefined;
@@ -159,7 +160,7 @@ export function seedProviderConfigs(
     // still validates; the relay owns the schema, the reporter stays dumb.
     const value = legacy?.value ?? { ...providerConfigDefaults(provider), ...(isRecord(raw) ? raw : {}) };
     try {
-      const entry = setProviderConfig(provider, value, { host: cleanHost, updatedBy: `migration:${cleanHost}` });
+      const entry = await setProviderConfigAsync(provider, value, { host: cleanHost, updatedBy: `migration:${cleanHost}` });
       emitConfigChanged(entry.namespace, entry.key, entry.version);
       seeded.push(entry);
     } catch {
@@ -174,16 +175,16 @@ export function seedProviderConfigs(
  * owns the stable-id/legacy-hostname resolution together so command routes do
  * not re-parse or accidentally bypass the migration authority rules.
  */
-export function seedMigratedProviderConfigs(result: unknown): { host: string; seeded: ProviderConfigEntry[] } | null {
+export async function seedMigratedProviderConfigsAsync(result: unknown): Promise<{ host: string; seeded: ProviderConfigEntry[] } | null> {
   if (!isRecord(result)) return null;
   const host = cleanString(result.host, "result.host", { max: 120 });
   const hostname = cleanString(result.hostname, "result.hostname", { max: 120 });
   const configs = isRecord(result.configs) ? result.configs : undefined;
   if (!host || !configs) return null;
-  return { host, seeded: seedProviderConfigs(host, configs, { legacyHost: hostname }) };
+  return { host, seeded: await seedProviderConfigsAsync(host, configs, { legacyHost: hostname }) };
 }
 
-export function migrateLocalProviderConfigs(home = humwickHome(), host = defaultProviderConfigHost()): ProviderConfigEntry[] {
+export async function migrateLocalProviderConfigsAsync(home = humwickHome(), host = defaultProviderConfigHost()): Promise<ProviderConfigEntry[]> {
   const dir = join(home, "providers");
   if (!existsSync(dir)) return [];
   const raw: Record<string, unknown> = {};
@@ -192,7 +193,7 @@ export function migrateLocalProviderConfigs(home = humwickHome(), host = default
     if (!VALID_PROVIDER_CONFIGS.includes(provider as SpawnProvider)) continue;
     raw[provider] = loadLocalProviderConfig(provider, home);
   }
-  return seedProviderConfigs(host, raw);
+  return seedProviderConfigsAsync(host, raw);
 }
 
 function normalizeProviderConfigHost(host: string): string {

package/src/provider-model-seed.ts

@@ -1,18 +1 @@
-import { getConfig, setConfig } from "./config-store";
-import { seedProviderModelOverrides } from "./provider-catalog-store";
-import { reconcileClaudeCatalogSeeds } from "./db/claude-catalog-reconcile";
-import { VERSION } from "./config";
-import { errMessage } from "@humwick/sdk";
-
-// Stamp only after the transactional seed succeeds so a failure retries next boot.
-export function reconcileProviderModelSeed(): void {
-  try {
-    reconcileClaudeCatalogSeeds();
-    const stamp = `seed:${VERSION}`;
-    if (getConfig<string>("system", "provider-model-seed-version")?.value === stamp) return;
-    seedProviderModelOverrides(stamp);
-    setConfig("system", "provider-model-seed-version", stamp, "server-startup");
-  } catch (err) {
-    console.warn(`[provider-model-seed] skipped: ${errMessage(err)}`);
-  }
-}
+export { reconcileProviderModelSeed, seedProviderModelOverrides } from "./db/provider-model-seed";

package/src/provider-quota-async.ts

@@ -51,27 +51,25 @@ export async function upsertProviderQuotaAsync(
  * Synchronous in-process compatibility wrapper for direct callers and existing tests. Runs the writer
  * body directly (no gateway hop) and fires the returned effects synchronously.
  */
-export function upsertProviderQuota(input: ProviderQuotaUpdateInput, now = Date.now()): ProviderQuotaRecord {
-  const result = upsertProviderQuotaInTx(input, now);
-  invalidateProviderQuotaMatrixCache();
+export async function upsertProviderQuota(input: ProviderQuotaUpdateInput, now = Date.now()): Promise<ProviderQuotaRecord> {
+  const result = await upsertProviderQuotaAsync(input, { now });
   if (result.outcome.kind !== "stored") throw new Error("provider quota lease not held");
-  deliverProviderQuotaEffects(result, { isolate: false });
   return result.outcome.record;
 }
 
 /** Fire each event+notification pair in production order; `isolate` logs (not throws) per-pair faults. */
-function deliverProviderQuotaEffects(result: ProviderQuotaUpsertOpResult, options: { isolate: boolean }): void {
+async function deliverProviderQuotaEffects(result: ProviderQuotaUpsertOpResult, options: { isolate: boolean }): Promise<void> {
   for (const effect of result.advisory?.effects ?? []) {
     if (options.isolate) {
       try {
         emitRelayEvent(effect.event);
-        if (effect.notification) routeNotification(effect.notification);
+        if (effect.notification) await routeNotification(effect.notification);
       } catch (error) {
         console.error("provider quota post-commit effect failed", error);
       }
     } else {
       emitRelayEvent(effect.event);
-      if (effect.notification) routeNotification(effect.notification);
+      if (effect.notification) await routeNotification(effect.notification);
     }
   }
 }

package/src/provider-quota-config-store.ts

@@ -9,7 +9,8 @@
 // provider *spawn* config (provider-config-store.ts) by design — different scope,
 // different cardinality.
 import { ValidationError } from "./db";
-import { getConfig, listConfig, setConfig } from "./config-store";
+import { getConfig, listConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
 import { emitConfigChanged } from "./sse";
 import {
   DEFAULT_PROVIDER_QUOTA_CONFIG,
@@ -47,14 +48,14 @@ export function listProviderQuotaConfigs(): ProviderQuotaConfigMap {
  * clamped to 5m–15m, unset fields defaulted), so a partial body still validates.
  * Emits `config.changed` so the orchestrator + dashboard pick it up live.
  */
-export function setProviderQuotaConfig(
+export async function setProviderQuotaConfigAsync(
   provider: string,
   value: unknown,
   opts: { updatedBy?: string } = {},
-): ProviderQuotaConfig {
+): Promise<ProviderQuotaConfig> {
   const clean = assertValidProvider(provider);
   const normalized = normalizeProviderQuotaConfig(value);
-  const entry = setConfig(PROVIDER_QUOTA_CONFIG_NAMESPACE, clean, normalized, opts.updatedBy);
+  const entry = await setConfigAsync(PROVIDER_QUOTA_CONFIG_NAMESPACE, clean, normalized, opts.updatedBy);
   emitConfigChanged(entry.namespace, entry.key, entry.version);
   return normalized;
 }

package/src/provider-secrets.test-fixture.ts

@@ -1,5 +1,5 @@
 import { getDb } from "./db";
-import { setProviderConfig } from "./provider-config-store";
+import { setProviderConfigAsync } from "./provider-config-store";
 
 // #3402 — fake values under every key name the hub's central provider config holds, plus one no masking
 // list knows, so a test proves masking follows the configured values rather than key names.
@@ -25,9 +25,9 @@ export function leakedProviderSecrets(text: string): string[] {
 }
 
 /** Seeds the central provider config of `host` and returns its rows the way `sqlite3 ... select` prints them. */
-export function seedProviderSecrets(host: string): string {
+export async function seedProviderSecrets(host: string): Promise<string> {
   for (const [provider, env] of Object.entries(PROVIDER_SECRET_ENV)) {
-    setProviderConfig(provider, { command: provider, env: { ...env, OPENCODE_CONFIG: "/srv/opencode.json" } }, { host });
+    await setProviderConfigAsync(provider, { command: provider, env: { ...env, OPENCODE_CONFIG: "/srv/opencode.json" } }, { host });
   }
   return (getDb().query("SELECT namespace, key, value FROM config WHERE namespace = 'provider-config'").all() as Array<Record<string, string>>)
     .map((row) => `${row.namespace}|${row.key}|${row.value}`).join("\n");

package/src/provider-timeline-event.ts

@@ -1,5 +1,5 @@
 import { isRecord, stringValue } from "@humwick/sdk";
-import { createActivityEventWithResult } from "./db";
+import { createActivityEventByClientIdAsync } from "./db/activity-async";
 import { emitRelayEvent } from "./events";
 
 interface HasMeta {
@@ -28,7 +28,7 @@ function numberValue(value: unknown): number | undefined {
   return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
 
-export function auditRunnerTimelineEvent(agentId: string, timelineEvent: ProviderTimelineEvent | null): void {
+export async function auditRunnerTimelineEvent(agentId: string, timelineEvent: ProviderTimelineEvent | null): Promise<void> {
   if (!timelineEvent) return;
   const metadata = isRecord(timelineEvent.metadata) ? timelineEvent.metadata : {};
   if (metadata.source !== "runner") return;
@@ -41,10 +41,7 @@ export function auditRunnerTimelineEvent(agentId: string, timelineEvent: Provide
   const body = stringValue(timelineEvent.body);
   const icon = stringValue(timelineEvent.icon) ?? "ti-activity";
   try {
-    // #1912 §4 retained: this runs inside the synchronous bus status-frame callback. Turning this
-    // into an unawaited gateway write would reorder/drop the audit relative to the frame; moving
-    // the whole hot status ingress is the later owner.
-    const result = createActivityEventWithResult({
+    const result = (await createActivityEventByClientIdAsync({
       clientId: `runner-timeline-${agentId}-${id}`,
       kind: "state",
       title,
@@ -60,7 +57,7 @@ export function auditRunnerTimelineEvent(agentId: string, timelineEvent: Provide
         timelineId: id,
         timelineTimestamp: timestamp,
       },
-    });
+    }));
     // A repeated frame may still carry the same event during reconnect/retry. The durable activity
     // clientId dedup is authoritative; only a newly inserted row owns an activity.created edge.
     if (!result.created) return;

package/src/quota-band-delivery.ts

@@ -6,8 +6,8 @@ import { getSpawnCapableAgentIds } from "./routing-policy-push";
 import { renderBandTransition } from "./quota-band-transition";
 import type { ProviderBandWindow, QuotaBand } from "./quota-band-projection";
 
-export function deliverBandTransition(input: { provider: string; window: ProviderBandWindow; previousBand: QuotaBand; recommendedAction: string; now: number }): void {
+export async function deliverBandTransition(input: { provider: string; window: ProviderBandWindow; previousBand: QuotaBand; recommendedAction: string; now: number }): Promise<void> {
   const effect = renderBandTransition(input, getSpawnCapableAgentIds());
   emitRelayEvent(effect.event);
-  if (effect.notification) routeNotification(effect.notification);
+  if (effect.notification) await routeNotification(effect.notification);
 }