@humwick/server 0.130.1 → 0.130.3

package/src/self-resume.ts

@@ -1,28 +1,16 @@
+import { updateContinuationObjectiveAsync, markSelfResumeContinuationIngestedAsync, ensureContinuationEnvelopeAsync } from "./db/runtime-tail-async";
+import { sendMessageAsync } from "./db/message-send";
+import { createCommandAsync } from "./commands-write";
 import { renderSelfCareState } from "./services/self-care-state";
 import { agentPrincipalSink } from "./db/agent-ownership";
 import { isRecord } from "@humwick/sdk";
-import { createCommand, listCommands, listInjectionAttempts, listPendingInjectionAttemptIds } from "./commands-db";
+import { listCommands, listInjectionAttempts, listPendingInjectionAttemptIds } from "./commands-db";
 import type { InjectionAttempt } from "./db/injection-attempts";
 import { emitCommandEvent } from "./command-events";
 import { INJECTION_SWEEP_BACKLOG_INTERVAL_MS, pacedInjectionSweep } from "./injection-sweep-pacing";
 import { MAX_BODY_BYTES, REAP_INTERVAL_MS } from "./config";
 import { getSelfResumeConfig } from "./config-store";
-import {
-  archiveAndAdvanceContinuationAsync,
-  archiveContinuationSegmentAsync,
-  ensureContinuationEnvelope,
-  findMessageByIdempotencyKey,
-  getAgent,
-  getContinuationEnvelope,
-  getMessage,
-  listUncommandedContextResets,
-  markSelfResumeContinuationIngested,
-  selfResumeContinuationIngested,
-  sendMessage,
-  updateContinuationAfterCompact,
-  updateContinuationObjective,
-  ValidationError,
-} from "./db";
+import { archiveAndAdvanceContinuationAsync, archiveContinuationSegmentAsync, findMessageByIdempotencyKey, getAgent, getContinuationEnvelope, getMessage, listUncommandedContextResets, selfResumeContinuationIngested, updateContinuationAfterCompact, ValidationError } from "./db";
 import { emitRelayEvent } from "./events";
 import { emitMessageDeliveryUpdated } from "./sse";
 import { boundaryCaptureClause } from "./memory-boundary-capture";
@@ -73,13 +61,13 @@ export async function compactAndResume(input: CompactAndResumeInput): Promise<Co
   else assertResumeSupported(agent, mode);
 
   const now = Date.now();
-  let envelope = ensureContinuationEnvelope({
+  let envelope = (await ensureContinuationEnvelopeAsync({
     agentId: agent.id,
     objective: input.objective,
     now,
-  });
+  }));
   if (input.objective !== undefined && envelope.objective !== input.objective) {
-    envelope = updateContinuationObjective({ agentId: agent.id, objective: input.objective, now });
+    envelope = (await updateContinuationObjectiveAsync({ agentId: agent.id, objective: input.objective, now }));
   }
 
   const workingState = input.workingState.trim();
@@ -101,19 +89,19 @@ export async function compactAndResume(input: CompactAndResumeInput): Promise<Co
   // half is elsewhere on purpose (src/context-advisory.ts) — it has to reach the agent while the
   // generation it asks about still exists, and no line written at this point can do that.
   const fullContinuation = renderContinuation(updated.envelope, {
-    memoryCapture: boundaryCaptureClause({ seam: "post", agentId: agent.id, now }),
+    memoryCapture: (await boundaryCaptureClause({ seam: "post", agentId: agent.id, now })),
     liveRuns: renderSelfCareState(agent.id),
   });
   // #2836: no core copy here — the startup-context seam re-injects it beside this.
-  const continuationMessage = createContinuationRecoveryMessage(agent.id, generation, fullContinuation, now);
+  const continuationMessage = (await createContinuationRecoveryMessage(agent.id, generation, fullContinuation, now));
   const continuation = insertRecoveryPointerAfterIntro(fullContinuation, continuationMessage.id);
-  openContextRecovery(agent.id, generation, now);
+  (await openContextRecovery(agent.id, generation, now));
   const command = input.restart
     ? await createSelfRestartCommandAsync(agent, generation, continuation, continuationMessage.id, input.reason ?? "manual", now)
     : mode === "native"
-      ? createNativeCompact(agent.id, generation, continuation, continuationMessage.id)
-      : createClearThenInject(agent.id, generation, continuation, continuationMessage.id);
-  attachContextRecoveryCommand(agent.id, generation, command.id);
+      ? (await createNativeCompact(agent.id, generation, continuation, continuationMessage.id))
+      : (await createClearThenInject(agent.id, generation, continuation, continuationMessage.id));
+  (await attachContextRecoveryCommand(agent.id, generation, command.id));
   emitCommandEvent(command, "command.requested");
   return {
     ok: true,
@@ -169,7 +157,7 @@ export interface ForcedResumePlan {
 // shapes, so the reactive/sweep reinjection (#1023) plus the #1998 objective-epoch render guarantees
 // apply unchanged. Returns null (→ caller falls back to a bare compact) when the provider has no
 // resume route / no re-injection channel OR the agent has no stored envelope yet.
-export function buildForcedResumePlan(agentId: string, now = Date.now()): ForcedResumePlan | null {
+export async function buildForcedResumePlan(agentId: string, now = Date.now()): Promise<ForcedResumePlan | null> {
   const agent = getAgent(agentId);
   if (!agent) return null;
   const context = agent.providerCapabilities?.context;
@@ -192,10 +180,10 @@ export function buildForcedResumePlan(agentId: string, now = Date.now()): Forced
   if (!envelope) return null;
   const generation = envelope.generation;
   const fullContinuation = renderContinuation(envelope, {
-    memoryCapture: boundaryCaptureClause({ seam: "post", agentId, now }),
+    memoryCapture: (await boundaryCaptureClause({ seam: "post", agentId, now })),
     liveRuns: renderSelfCareState(agentId),
   });
-  const continuationMessage = createContinuationRecoveryMessage(agentId, generation, fullContinuation, now);
+  const continuationMessage = (await createContinuationRecoveryMessage(agentId, generation, fullContinuation, now));
   const continuation = insertRecoveryPointerAfterIntro(fullContinuation, continuationMessage.id);
   if (useNativeCompact) {
     // Preserve the provider's in-place summary; re-inject the (possibly stale) envelope AFTER.
@@ -235,11 +223,11 @@ function insertRecoveryPointerAfterIntro(continuation: string, messageId: number
   return `${continuation.slice(0, firstNewline).trimEnd()}\n${pointer}${continuation.slice(firstNewline)}`;
 }
 
-function createContinuationRecoveryMessage(agentId: string, generation: number, continuation: string, now: number) {
+async function createContinuationRecoveryMessage(agentId: string, generation: number, continuation: string, now: number) {
   const idempotencyKey = `self-resume-continuation:${agentId}:${generation}`;
   const existing = findMessageByIdempotencyKey("system", idempotencyKey);
   if (existing) return existing;
-  return sendMessage({
+  return (await sendMessageAsync({
     from: "system",
     to: agentId,
     kind: "system",
@@ -258,7 +246,7 @@ function createContinuationRecoveryMessage(agentId: string, generation: number,
       // provider session accepted it. The runner promotes this only after turn/start acceptance.
       delivery: { state: "stored" },
     },
-  });
+  }));
 }
 
 // #1023 — the ruledOut ledger bound (see updateContinuationAfterCompact) drops the
@@ -325,7 +313,7 @@ function continuationDeliveredInline(command: Command): boolean {
 
 /** Promote the persisted recovery artifact only from delivery evidence emitted by the runner.
  * A successful clear command or a stored chat row alone is never enough. */
-export function settleSelfResumeContinuationIngestion(command: Command): void {
+export async function settleSelfResumeContinuationIngestion(command: Command): Promise<void> {
   const result = isRecord(command.result) ? command.result : undefined;
   const provider = result && isRecord(result.providerResult) ? result.providerResult : undefined;
   let fullContextMessageId: number | undefined;
@@ -337,18 +325,18 @@ export function settleSelfResumeContinuationIngestion(command: Command): void {
     fullContextMessageId = typeof resume?.fullContextMessageId === "number" ? resume.fullContextMessageId : undefined;
   }
   if (fullContextMessageId === undefined) return;
-  const message = markSelfResumeContinuationIngested(fullContextMessageId);
+  const message = (await markSelfResumeContinuationIngestedAsync(fullContextMessageId));
   if (message) emitMessageDeliveryUpdated(message);
 }
 
 /** #2619 — a runner parks a continuation the provider refused under a usage/overload hold as a
  * message to itself (payload.selfResumeFullContextMessageId). Its delivered report is the same
  * delivery evidence an ingested injectContext result is: promote the recovery artifact. */
-export function settleParkedSelfResumeContinuation(message: Message): void {
+export async function settleParkedSelfResumeContinuation(message: Message): Promise<void> {
   const fullContextMessageId = message.payload?.selfResumeFullContextMessageId;
   if (typeof fullContextMessageId !== "number" || message.from !== message.to) return;
   if (getMessage(fullContextMessageId)?.to !== message.to) return;
-  const promoted = markSelfResumeContinuationIngested(fullContextMessageId);
+  const promoted = (await markSelfResumeContinuationIngestedAsync(fullContextMessageId));
   if (promoted) emitMessageDeliveryUpdated(promoted);
 }
 
@@ -402,38 +390,38 @@ export function isFailedClearInjectSelfResume(command: Command): boolean {
 }
 
 /** #3662 — an older generation's boundary is retired (its queued injects canceled), never delivered. */
-function retireIfSuperseded(command: Command): boolean {
+async function retireIfSuperseded(command: Command): Promise<boolean> {
   const current = supersedingGeneration(command);
   if (current === null) return false;
-  cancelSupersededInjects(listPendingInjectionAttemptIds(command.id, CONTINUATION_INJECTION_REASON), current);
+  (await cancelSupersededInjects(listPendingInjectionAttemptIds(command.id, CONTINUATION_INJECTION_REASON), current));
   return true;
 }
 
-export function enqueueContinuationInjectionAfterSelfResume(command: Command): Command | null {
+export async function enqueueContinuationInjectionAfterSelfResume(command: Command): Promise<Command | null> {
   if (command.status !== "succeeded" && !isFailedClearInjectSelfResume(command)) return null;
   const injection = extractPendingInjection(command);
-  if (!injection || retireIfSuperseded(command)) return null;
+  if (!injection || (await retireIfSuperseded(command))) return null;
   if (continuationDeliveredInline(command)) return null;
   if (injectionAttemptsFor(command, CONTINUATION_INJECTION_REASON).length) return null;
-  const inject = createCommand({
+  const inject = (await createCommandAsync({
     type: "agent.injectContext",
     source: "system",
     target: command.target,
     correlationId: command.id,
     params: buildInjectionParams(command, injection, undefined, registrationReplayEpoch(command.target)),
-  });
+  }));
   emitCommandEvent(inject, "command.requested");
   return inject;
 }
 
-export function enqueueLifecycleIdentityInjectionAfterContextCommand(command: Command): Command | null {
+export async function enqueueLifecycleIdentityInjectionAfterContextCommand(command: Command): Promise<Command | null> {
   if (command.status !== "succeeded") return null;
   if (command.type !== "agent.clearContext" && command.type !== "agent.compact") return null;
   if (extractPendingInjection(command)) return null;
   const content = identityContentForLifecycleCommand(command);
   if (!content) return null;
   if (injectionAttemptsFor(command, IDENTITY_INJECTION_REASON).length) return null;
-  const inject = createCommand({
+  const inject = (await createCommandAsync({
     type: "agent.injectContext",
     source: "system",
     target: command.target,
@@ -446,13 +434,13 @@ export function enqueueLifecycleIdentityInjectionAfterContextCommand(command: Co
         ...(command.type === "agent.compact" ? { afterCompactCommandId: command.id } : {}),
       },
     },
-  });
+  }));
   emitCommandEvent(inject, "command.requested");
   return inject;
 }
 
-export function enqueueContinuationInjectionAfterClear(command: Command): Command | null {
-  return enqueueContinuationInjectionAfterSelfResume(command);
+export async function enqueueContinuationInjectionAfterClear(command: Command): Promise<Command | null> {
+  return (await enqueueContinuationInjectionAfterSelfResume(command));
 }
 
 const CLEAR_OR_COMPACT_TYPES = ["agent.clearContext", "agent.compact"] as const;
@@ -613,7 +601,7 @@ function continuationInjectionAttemptDecision(command: Command, replayEpoch?: st
 // lost, and a redundant-but-harmless re-injection is preferable to a permanent
 // silent mind-wipe. The sweep creates only a missing initial attempt; it never retries a failed
 // attempt by itself, so an unavailable-but-still-registered provider cannot grow commands forever.
-export function sweepMissedContinuationInjections(now: number = Date.now(), signal?: AbortSignal, targetAgentId?: string, replayEpoch?: string): { enqueuedCommandIds: string[]; aborted?: true } {
+export async function sweepMissedContinuationInjections(now: number = Date.now(), signal?: AbortSignal, targetAgentId?: string, replayEpoch?: string): Promise<{ enqueuedCommandIds: string[]; aborted?: true }> {
   const enqueuedCommandIds: string[] = [];
   // #1726 — shared across every candidate this tick: the identity rebuild only depends on the
   // target agent, and every target must already exist in the (bounded) agent roster, so this
@@ -628,27 +616,27 @@ export function sweepMissedContinuationInjections(now: number = Date.now(), sign
   // between candidates simply leaves the rest for the next tick. SYNCHRONOUS job — inert on one
   // thread until this grows an await.
   for (const command of sweepableBoundaryCommands(now, signal, targetAgentId)) {
-    sweepContinuationBoundary(command, identityCache, enqueuedCommandIds, replayEpoch);
+    (await sweepContinuationBoundary(command, identityCache, enqueuedCommandIds, replayEpoch));
   }
   return { enqueuedCommandIds, ...(signal?.aborted ? { aborted: true as const } : {}) };
 }
 
-function sweepContinuationBoundary(command: Command, identityCache: WhoamiIdentityCache, enqueuedCommandIds: string[], replayEpoch?: string): void {
+async function sweepContinuationBoundary(command: Command, identityCache: WhoamiIdentityCache, enqueuedCommandIds: string[], replayEpoch?: string): Promise<void> {
   const injection = extractPendingInjection(command);
-  if (!injection || retireIfSuperseded(command)) return;
+  if (!injection || (await retireIfSuperseded(command))) return;
   if (continuationDeliveredInline(command)) return;
   const agent = getAgent(command.target);
   if (!agent || agent.status === "offline") return;
   const attemptEpoch = replayEpoch ?? registrationReplayEpoch(command.target);
   const { decision } = continuationInjectionAttemptDecision(command, attemptEpoch);
   if (decision !== "enqueue") return;
-  const inject = createCommand({
+  const inject = (await createCommandAsync({
     type: "agent.injectContext",
     source: "system",
     target: command.target,
     correlationId: command.id,
     params: buildInjectionParams(command, injection, identityCache, attemptEpoch),
-  });
+  }));
   emitCommandEvent(inject, "command.requested");
   enqueuedCommandIds.push(inject.id);
 }
@@ -658,14 +646,14 @@ function sweepContinuationBoundary(command: Command, identityCache: WhoamiIdenti
 async function sweepMissedContinuationInjectionsPaced(now: number, signal?: AbortSignal): Promise<{ enqueuedCommandIds: string[]; aborted?: true; moreWork?: true }> {
   const enqueuedCommandIds: string[] = [];
   const identityCache: WhoamiIdentityCache = new Map();
-  const { moreWork } = await pacedInjectionSweep(() => sweepableBoundaryCommands(now, signal), (command) => sweepContinuationBoundary(command, identityCache, enqueuedCommandIds), signal);
+  const { moreWork } = await pacedInjectionSweep(() => sweepableBoundaryCommands(now, signal), async (command) => (await sweepContinuationBoundary(command, identityCache, enqueuedCommandIds)), signal);
   return { enqueuedCommandIds, ...(signal?.aborted ? { aborted: true as const } : {}), ...(moreWork ? { moreWork: true as const } : {}) };
 }
 
 /** Replay one parked continuation attempt for a new ready/idle or registration epoch. The epoch is
  * persisted on the inject command, making repeated observations of the same lifecycle edge inert. */
-export function replayParkedContinuationInjections(agentId: string, lifecycleEpoch: string, now = Date.now()): { enqueuedCommandIds: string[] } {
-  return sweepMissedContinuationInjections(now, undefined, agentId, lifecycleEpoch);
+export async function replayParkedContinuationInjections(agentId: string, lifecycleEpoch: string, now = Date.now()): Promise<{ enqueuedCommandIds: string[] }> {
+  return (await sweepMissedContinuationInjections(now, undefined, agentId, lifecycleEpoch));
 }
 
 export const SELF_RESUME_INJECTION_SWEEP_JOB = {
@@ -681,14 +669,14 @@ export const SELF_RESUME_INJECTION_SWEEP_JOB = {
   },
 };
 
-function notifyContinuationInjectionExhausted(command: Command, attempts: number): void {
+async function notifyContinuationInjectionExhausted(command: Command, attempts: number): Promise<void> {
   const idempotencyKey = `self-resume-injection-exhausted:${command.target}:${command.id}`;
   if (findMessageByIdempotencyKey(command.target, idempotencyKey)) return;
   const agent = getAgent(command.target);
   const payload = { kind: "agent.resume_injection_failed", agentId: command.target, commandId: command.id, attempts };
   emitRelayEvent({ type: "agent.resume_injection_failed", source: "server", subject: command.target, data: payload });
   const recipient = agent?.spawnedBy ?? agentPrincipalSink(command.target);
-  routeNotification({
+  await routeNotification({
     type: "agent.resume_injection_failed",
     scope: { agentId: command.target, parent: agent?.spawnedBy },
     recipients: [recipient],
@@ -708,7 +696,7 @@ function notifyContinuationInjectionExhausted(command: Command, attempts: number
 // silent no-op that let the #2043 runaway climb to ~750K tokens undetected. Surface it to the spawn
 // parent (and as a durable relay event) instead of swallowing it. Idempotent per command. This is
 // the ALARM; the continuation re-injection backstop (F2) is the separate recovery path.
-export function notifySelfResumeNoOp(command: Command): void {
+export async function notifySelfResumeNoOp(command: Command): Promise<void> {
   if (command.status !== "failed" && command.status !== "timed_out") return;
   if (command.type !== "agent.clearContext" && command.type !== "agent.compact") return;
   const injection = extractPendingInjection(command);
@@ -731,7 +719,7 @@ export function notifySelfResumeNoOp(command: Command): void {
   const recovery = command.type === "agent.clearContext" || command.status === "timed_out"
     ? "The relay re-injects the continuation as a backstop, but check the agent and consider a manual relay_compact_and_resume or restart."
     : "The continuation remains persisted; check the agent and retry relay_compact_and_resume once it is responsive.";
-  routeNotification({
+  await routeNotification({
     type: "agent.self_resume_noop",
     scope: { agentId: command.target, parent: agent?.spawnedBy },
     recipients: [recipient],
@@ -827,8 +815,8 @@ function assertResumeSupported(agent: AgentCard, mode: SelfResumeMode): void {
   }
 }
 
-function createNativeCompact(agentId: string, generation: number, continuation: string, fullContextMessageId: number): Command {
-  return createCommand({
+async function createNativeCompact(agentId: string, generation: number, continuation: string, fullContextMessageId: number): Promise<Command> {
+  return (await createCommandAsync({
     type: "agent.compact",
     source: "system",
     target: agentId,
@@ -837,16 +825,16 @@ function createNativeCompact(agentId: string, generation: number, continuation:
       instructions: continuation,
       selfResume: { generation, mode: "native", continuation, fullContextMessageId },
     },
-  });
+  }));
 }
 
-function createClearThenInject(agentId: string, generation: number, continuation: string, fullContextMessageId: number): Command {
+async function createClearThenInject(agentId: string, generation: number, continuation: string, fullContextMessageId: number): Promise<Command> {
   // #1588 — store the fully-built (identity-augmented) continuation in the clear command's params so
   // the runner can deliver it inline as a coupled unit, race-free, while preserving the #1206 identity
   // re-injection that the separate reactive inject used to add via buildInjectionParams. The backstop
   // path re-augments idempotently, so embedding it here causes no drift.
   const coupledContinuation = augmentContinuationWithIdentity(agentId, continuation);
-  return createCommand({
+  return (await createCommandAsync({
     type: "agent.clearContext",
     source: "system",
     target: agentId,
@@ -854,7 +842,7 @@ function createClearThenInject(agentId: string, generation: number, continuation
       reason: "self-resume",
       selfResume: { generation, mode: "clear-inject", continuation: coupledContinuation, fullContextMessageId },
     },
-  });
+  }));
 }
 
 function parseRuledOut(value: unknown, generation: number, now: number): ContinuationLedgerEntry[] {

package/src/server-background.ts

@@ -9,7 +9,7 @@ import { notifyCdDeployLive } from "./cd-deploy-notify";
 import { isEphemeralMode } from "./execution-mode";
 import { startClaudeAppOAuth } from "./claude-app/oauth-http";
 
-export function startServerBackgroundJobs(): void {
+export async function startServerBackgroundJobs(): Promise<void> {
   startPostBindJobs([
     { name: "claude-app-oauth", start: startClaudeAppOAuth },
     { name: "user-awaiting-reply", start: () => { startUserAwaitingReply(); } },
@@ -19,6 +19,6 @@ export function startServerBackgroundJobs(): void {
     { name: "connectors", start: startConnectorStatusPoller },
     { name: "maintenance", start: startMaintenanceScheduler },
     { name: "steward-rekey-notices", start: async () => (await import("./workspace-rekey")).drainStewardRekeyNotices() },
-    { name: "deploy-notice", start: () => { if (!isEphemeralMode()) notifyCdDeployLive(); } },
+    { name: "deploy-notice", start: async () => { if (!isEphemeralMode()) await notifyCdDeployLive(); } },
   ]);
 }

package/src/server.ts

@@ -1,3 +1,5 @@
+import { framed } from "./hub-metrics";
+import { setConfigAsync } from "./config-store-write";
 import { drainWriterOnShutdown } from "./db/writer-gateway";
 import { relayHeaderConflict, errMessage, reapEphemeralSelf, startArtifactCheckoutLease, startEphemeralWatchdogFromEnv } from "@humwick/sdk";
 import { authorityDenied } from "./authority-audit";
@@ -7,10 +9,12 @@ import { inviteLinkRedirect } from "./invite-link";
 import { claudeAppBoundary, CLAUDE_APP_PATH, isClaudeAppPath } from "./claude-app-auth";
 import { handleClaudeApp } from "./claude-app-gateway";
 import { handleClaudeAppOAuth } from "./claude-app/oauth-http";
+import { installTimerIngressSchema } from "./db/timer-ingress";
+import { beginMainWriteBootPhase, endMainWriteBootPhase } from "./db/main-connection-writes";
 import { markServerBound, timePostBindPhase } from "./post-bind-startup";
 import type { ServerWebSocket } from "bun";
 import { beginStartupPhase, enableStartupTiming, timeStartupPhase } from "./startup-timing";
-import { initDb, getOrchestrator, startPresenceFlushLoop, primeHostAliasMemoFromDb } from "./db";
+import { initDb, getOrchestrator, startPresenceFlushLoop, primeHostAliasMemoFromDb, onWorkspaceCreate } from "./db";
 import { initGateway, shutdownGatewayReader } from "./db/gateway";
 import { flushRelayEvents } from "./relay-event-drain";
 import { startWalCheckpointer } from "./db/wal-checkpointer";
@@ -23,8 +27,7 @@ import { emitRelayEvent } from "./events";
 import { reconcileAutomationRuns, runDueAutomationsAsync, type AutomationDispatchResult, type AutomationReconcileResult } from "./automations";
 import { getLifecycleManager } from "./lifecycle-manager";
 import { reconcileStewardPolicyModels } from "./steward-policy-model-reconcile";
-import { getConfig, setConfig } from "./config-store";
-import { reconcileProviderModelSeed } from "./provider-model-seed";
+import { getConfig } from "./config-store";
 export { reconcileProviderModelSeed } from "./provider-model-seed";
 import { ensureEscalationChannelRegistered } from "./connectors";
 import { installNotificationSubscriptionRule } from "./notification-subscription-rules";
@@ -32,7 +35,6 @@ import { startPlanLiveBindings } from "./services/plan-live-bindings";
 import { startEventLoopLagSampler } from "./event-loop-lag";
 import { installLoopBlockRegressionAlarm } from "./loop-block-regression-alarm";
 import { recordWorkspaceIssueActivity } from "./services/spawn-issue-activity";
-import { onWorkspaceCreate } from "./db";
 import { warnIfNoHumanReachableEscalationTarget } from "./workspace-human-escalation";
 import { isTerminalSessionRequestAuthorized } from "./terminal-authz";
 import { resolveBrowserStream } from "./routes/browser";
@@ -83,16 +85,16 @@ import type { Command } from "./types";
 //
 // `relay-version` is still tracked for observability/telemetry, but it no longer
 // triggers restarts.
-export function reconcileRelayVersion(): void {
+export async function reconcileRelayVersion(): Promise<void> {
   const storedVersion = getConfig<string>("system", "relay-version")?.value;
-  if (storedVersion !== VERSION) setConfig("system", "relay-version", VERSION, "server-startup");
+  if (storedVersion !== VERSION) (await setConfigAsync("system", "relay-version", VERSION, "server-startup"));
 
   const storedProtocol = getConfig<string>("system", "runner-protocol-version")?.value;
   const currentProtocol = String(CONTRACT_VERSIONS.runnerProtocol);
   if (storedProtocol === currentProtocol) return;
   // Skip the very first run (no stored protocol yet) — that's initial bootstrap, not an upgrade.
   if (storedProtocol) getLifecycleManager().onRelayUpdated(VERSION);
-  setConfig("system", "runner-protocol-version", currentProtocol, "server-startup");
+  (await setConfigAsync("system", "runner-protocol-version", currentProtocol, "server-startup"));
 }
 
 export function runServerStartupRecoveries(): ReturnType<typeof sweepDeferredLineageReportsOnStartup> {
@@ -111,12 +113,11 @@ export async function startServer(): Promise<void> {
   startArtifactCheckoutLease();
 
   assertSafeNetworkConfig(HOST);
+  beginMainWriteBootPhase();
   timeStartupPhase("server.database", () => initDb(DB_PATH));
   // #1960 T2 — stand the gateway up EXPLICITLY here rather than leaving it to the lazy self-init
   // (`getGateway()` on first call, gateway.ts), which would race the rest of this boot sequence.
-  // Reader backend is env-gated (AGENT_RELAY_GATEWAY_READER_BACKEND, default "in-process" — Phase R,
-  // ADR 0001 §7 Phase 1); the writer is deliberately left at its in-process default — Phase W (a
-  // worker writer surrendering the sole RW connection) remains the #1870 migration.
+  // File-backed reads and writes default off-loop; memory fixtures retain local connections (#3339).
   timeStartupPhase("server.gateway", () => initGateway({ readerBackend: gatewayReaderBackendFromEnv() }));
   onShutdown("gateway-reader", shutdownGatewayReader);
   onShutdown("gateway-writer", drainWriterOnShutdown, "drain");
@@ -135,12 +136,11 @@ export async function startServer(): Promise<void> {
   const finishServices = beginStartupPhase("server.services");
   installNotificationSubscriptionRule();
   startPlanLiveBindings();
-  reconcileRelayVersion();
-  if (!isEphemeralMode()) reconcileProviderModelSeed();
+  (await reconcileRelayVersion());
   // Register the ntfy escalation channel row from persisted connector config BEFORE the
   // warning check, so a correctly-configured relay doesn't spuriously warn while the async
   // channels-host connect is still in flight (#1510).
-  ensureEscalationChannelRegistered();
+  (await ensureEscalationChannelRegistered());
   warnIfNoHumanReachableEscalationTarget();
   startEventLoopLagSampler();
   // #1882 (S5, ADR 0001 §5) — per-callsite on-loop-block attribution + the >50ms regression alarm.
@@ -166,15 +166,17 @@ export async function startServer(): Promise<void> {
       },
     });
   } else {
-    setInterval(() => {
+    setInterval(framed("timer automations", () => {
       void timePostBindPhase("automations.reconcile", reconcileAutomationRuns)
         .then(emitAutomationReconciliations)
         .catch((e) => console.error(`[automations] reconcile failed: ${errMessage(e)}`));
       void timePostBindPhase("automations.dispatch", runDueAutomationsAsync).then(emitAutomationDispatches).catch((e) => console.error(`[automations] dispatch failed: ${errMessage(e)}`));
-    }, AUTOMATION_INTERVAL_MS);
+    }), AUTOMATION_INTERVAL_MS);
   }
 
+  installTimerIngressSchema();
   finishServices();
+  endMainWriteBootPhase();
   timeStartupPhase("server.bind", () => Bun.serve<RelaySocketData>({
     port: PORT,
     hostname: HOST,
@@ -183,7 +185,7 @@ export async function startServer(): Promise<void> {
     websocket: createWebSocketHandlers(),
   }));
   markServerBound();
-  startServerBackgroundJobs();
+  await startServerBackgroundJobs();
   finishStartup();
   console.log(`humwick ${VERSION} running on http://${HOST}:${PORT}`);
 
@@ -277,12 +279,12 @@ export function createFetchHandler(
     const terminalStreamMatch = url.pathname.match(/^\/api\/orchestrators\/([^/]+)\/terminal\/([^/]+)\/stream$/);
     if (req.method === "GET" && terminalStreamMatch) {
       if (!server) return new Response("WebSocket upgrade unavailable", { status: 400 });
-      if (!isOriginAllowed(req)) return authorityDenied(req, "origin not allowed", 403);
-      if (!isAuthorized(req)) return applyCors(req, authorityDenied(req, "unauthorized", 401));
+      if (!isOriginAllowed(req)) return (await authorityDenied(req, "origin not allowed", 403));
+      if (!isAuthorized(req)) return applyCors(req, (await authorityDenied(req, "unauthorized", 401)));
       const orchestratorId = decodeURIComponent(terminalStreamMatch[1]!);
       const session = decodeURIComponent(terminalStreamMatch[2]!);
       if (!isTerminalSessionRequestAuthorized(req, orchestratorId, session, "read")) {
-        return applyCors(req, authorityDenied(req, "forbidden"));
+        return applyCors(req, (await authorityDenied(req, "forbidden")));
       }
       const writeAuthorized = isTerminalSessionRequestAuthorized(req, orchestratorId, session, "write");
       const orch = getOrchestrator(orchestratorId);
@@ -309,7 +311,7 @@ export function createFetchHandler(
     }
     const matched = matchRoute(req.method, url.pathname);
     if (!isOriginAllowed(req) && !(req.headers.get("origin") === "null" && matched?.handler === postSecretUpload)) {
-      return authorityDenied(req, "origin not allowed", 403);
+      return (await authorityDenied(req, "origin not allowed", 403));
     }
 
     // KAPI-1 §4.2 — the live `/api/kernel` control mount. Handled as a dedicated subtree (not through
@@ -319,7 +321,7 @@ export function createFetchHandler(
     // default-denies. A request that fails the coarse gate 403s here (matching the resolver's own 403 for
     // a missing/invalid/non-component credential), including `GET /api/kernel/openapi.json`.
     if (isKernelControlPath(url.pathname)) {
-      if (!isKernelControlRequestAuthorized(req)) return applyCors(req, authorityDenied(req, "forbidden"));
+      if (!isKernelControlRequestAuthorized(req)) return applyCors(req, (await authorityDenied(req, "forbidden")));
       const response = await handleKernelControlRequest(req);
       applyCors(req, response);
       if (logRequests) console.log(`${req.method} ${url.pathname} → ${response.status}`);
@@ -364,11 +366,11 @@ export function createFetchHandler(
             // full server scope), so it stays the authoritative reject for a revoked/
             // invalid session token — it just answers in the caller's protocol.
             if (url.pathname === "/api/mcp") return unauthorizedMcp(req);
-            return applyCors(req, authorityDenied(req, "unauthorized", 401));
+            return applyCors(req, (await authorityDenied(req, "unauthorized", 401)));
           }
-          if (!handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return applyCors(req, authorityDenied(req, "forbidden"));
+          if (!handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return applyCors(req, (await authorityDenied(req, "forbidden")));
         }
-        if (componentAuth && !handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return applyCors(req, authorityDenied(req, "forbidden"));
+        if (componentAuth && !handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return applyCors(req, (await authorityDenied(req, "forbidden")));
       }
       const response = await runMatchedRoute(matched, req, (body) => maybeCompressApiResponse(req, url, body));
       applyCors(req, response);

package/src/services/agent-action.ts

@@ -1,9 +1,11 @@
+import { getGateway } from "../db/gateway";
+import type { admitAgentActionBody } from "../db/agent-action-write";
 import { isHumanAgentId } from "@humwick/sdk";
 import { randomUUID } from "node:crypto";
-import { createCommandInternal, getCommand } from "../commands-db";
-import { admitDesiredEffortInternal, getAgentEffortState } from "../db/agent-effort-state";
+import { getCommand } from "../commands-db";
+import { getAgentEffortState } from "../db/agent-effort-state";
 import { emitEffortState } from "./agent-effort";
-import { ValidationError, createActivityEventAsync, getAgent, sendMessage, writeTransaction } from "../db";
+import { ValidationError, createActivityEventAsync, getAgent } from "../db";
 import { emitCommandEvent } from "../command-events";
 import { emitActivityEvent, emitNewMessage } from "../sse";
 import { effectiveProviderCatalogList } from "../provider-catalog-store";
@@ -112,15 +114,6 @@ function catalogEffort(agent: AgentCard, effort: string | undefined): { level: s
   return { level, efforts: known?.efforts };
 }
 
-function sessionMessageForInject(agentId: string, ctx: AuthContext, body: string) {
-  const from = ctx.callerAgentId && getAgent(ctx.callerAgentId) ? ctx.callerAgentId : "system";
-  return sendMessage({
-    from,
-    to: agentId,
-    kind: "session",
-    body,
-  });
-}
 
 export function revalidateAgentInstance(snapshot: AgentCard): AgentCard {
   const current = getAgent(snapshot.id);
@@ -136,7 +129,7 @@ export async function dispatchAgentAction(input: AgentActionInput, ctx: AuthCont
 
   // #2950 — an agent may change its own effort (only that), gated by its spawn's selfEffort ceiling below.
   const self = input.action === "effort" && Boolean(ctx.callerAgentId) && ctx.callerAgentId === agent.id;
-  if (!self) authorizeShutdown(ctx, { agentId: input.agentId, requestedVia: input.requestedVia }, input.action);
+  if (!self) (await authorizeShutdown(ctx, { agentId: input.agentId, requestedVia: input.requestedVia }, input.action));
   const requestId = input.action === "effort" ? input.requestId?.trim() || undefined : undefined;
   if (requestId && !REQUEST_ID.test(requestId)) throw new ValidationError("requestId must be a UUID");
   const retried = admittedEffortRequest(agent.id, requestId);
@@ -210,24 +203,12 @@ export async function dispatchAgentAction(input: AgentActionInput, ctx: AuthCont
   // a stale command built from the predecessor's capabilities/session data.
   const event = await createActivityEventAsync(activityInput);
   const current = revalidateAgentInstance(agent);
-  const sessionMessage = body ? sessionMessageForInject(current.id, ctx, body) : undefined;
-  // #2664 — the runner keeps the original sender on a prompt it has to park.
-  if (sessionMessage) Object.assign(commandInput.params, { messageId: sessionMessage.id, from: sessionMessage.from });
-  let admitted: ReturnType<typeof admitDesiredEffortInternal> | undefined;
-  let raced: AgentActionResult | undefined;
-  const command = writeTransaction(() => {
-    // A concurrent retry of the same request committed first.
-    if ((raced = admittedEffortRequest(current.id, requestId))) return raced.command;
-    // #2966 — a revoke committed during the audit await wins: recheck where the command is inserted.
-    if (selfPolicy) assertSelfEffortAllowed(current, requested!.level, requested!.efforts);
-    if (effort) {
-      // #2984 — the desired version is the change; the command is its audit row, never executed.
-      admitted = admitDesiredEffortInternal({ agentId: current.id, effort, role: requestedByRole, commandId, now: Date.now() });
-      commandInput.params.effortVersion = admitted.state.desiredVersion;
-    }
-    return createCommandInternal({ input: commandInput, id: commandId });
-  });
-  if (raced) return raced;
+  const from = ctx.callerAgentId && getAgent(ctx.callerAgentId) ? ctx.callerAgentId : "system";
+  const result = await getGateway().write("agents.admitAction", { agent: current, commandId, commandInput, requestId, effort, role: requestedByRole,
+    ...(selfPolicy ? { selfEffort: requested } : {}), ...(body ? { message: { from, to: current.id, kind: "session", body } } : {}) }, { idempotencyKey: commandId }) as unknown as ReturnType<typeof admitAgentActionBody>;
+  const { command } = result;
+  if (result.raced) return { action: input.action, command, effortState: result.effortState };
+  const { admitted, sessionMessage } = result;
   if (sessionMessage) emitNewMessage(sessionMessage);
   for (const id of admitted?.superseded ?? []) { const canceled = getCommand(id); if (canceled) emitCommandEvent(canceled, "command.canceled"); }
   // No `command.requested` for effort: nothing executes the audit row. `command.pending` only tells the target runner to reconcile.