@humwick/server 0.130.1 → 0.130.3

package/src/services/land-restart-retry.ts

@@ -1,4 +1,5 @@
-import { createActivityEvent, updateWorkspaceStatusAsync } from "../db";
+import { createActivityEventAsync } from "../db/activity-async";
+import { updateWorkspaceStatusAsync } from "../db";
 import { deferLandSettleSideEffect } from "../land-settle-dispatch";
 import { routeNotification } from "../notification-router";
 import { resolveCoordinatorAgentId } from "../steward-identity";
@@ -37,17 +38,17 @@ export async function settleRestartKilledLand(command: Command, workspace: Works
     ...mergeRetryEnqueuedAtPatch(mergeResult, command),
   });
   if (transitioned) {
-    deferLandSettleSideEffect("land-restart-retry", () => notifyLandRedispatching(transitioned, command, headSha));
+    deferLandSettleSideEffect("land-restart-retry", async () => await notifyLandRedispatching(transitioned, command, headSha));
   }
   return transitioned;
 }
 
-function notifyLandRedispatching(workspace: WorkspaceRecord, command: Command, headSha: string | undefined): void {
+async function notifyLandRedispatching(workspace: WorkspaceRecord, command: Command, headSha: string | undefined): Promise<void> {
   const branch = workspace.branch ?? workspace.id;
   const base = workspace.baseRef ?? "main";
   const head = headSha ? ` at \`${headSha.slice(0, 12)}\`` : "";
   const body = `\`${branch}\` → \`${base}\`: ${LAND_RESTART_RETRY_REASON}. Relay re-dispatches the same land${head} automatically and re-runs its gate. No action needed; do not re-deliver. A land result follows.`;
-  createActivityEvent({
+  (await createActivityEventAsync({
     clientId: `land-restart-retry-${command.id}`,
     kind: "state",
     title: "Land killed by restart; re-dispatching",
@@ -56,12 +57,12 @@ function notifyLandRedispatching(workspace: WorkspaceRecord, command: Command, h
     icon: "ti-refresh-alert",
     view: "orchestrators",
     metadata: { source: "server", workspaceId: workspace.id, commandId: command.id },
-  });
+  }));
   const author = workspace.ownerAgentId;
   const coordinator = resolveCoordinatorAgentId(author);
   const recipients = withWorkspaceTaskOwnerRoles([author, coordinator], workspace);
   if (!recipients.length) return;
-  routeNotification({
+  await routeNotification({
     type: "workspace.land_redispatched",
     scope: { author, parent: coordinator ?? undefined, repoRoot: workspace.repoRoot, workspaceId: workspace.id },
     recipients,

package/src/services/landed-ancestry.ts

@@ -1,3 +1,6 @@
+import { createActivityEventAsync } from "../db/activity-async";
+import { repoDefaultBranch } from "@humwick/sdk/land-gates";
+import { withWorkspaceTaskOwnerRoles } from "../task-owner-notices";
 // #1713 — the coordinator's "landed" signal, derived from GIT ANCESTRY rather than a command's
 // reported status. The observed bug: a worker delivers `complete`, the merge executor stalls, and
 // the coordinator is nonetheless told the work is "complete"/"landed" while `origin/main` is
@@ -13,7 +16,7 @@
 //                     transport error). We do NOT guess "landed" — we degrade to an actionable
 //                     "verify manually" signal that names the sha and the stalled merge command id.
 import { landFailureEventKey } from "../land-failure-event-key";
-import { createActivityEvent } from "../db";
+
 import { stewardFallbackTarget } from "../config";
 import { emitRelayEvent } from "../events";
 import { routeNotification } from "../notification-router";
@@ -113,7 +116,8 @@ const realVerifier: AncestryVerifier = async (repoRoot, sha, targetRef) => {
   // source of truth; a fetch failure/timeout is swallowed — the checks below then run against
   // whatever refs are already local, preserving the prior fail-closed behavior exactly.
   const remoteBranch = ref.startsWith("origin/") ? ref.slice("origin/".length) : ref;
-  if (remoteBranch) await gitStatus(root, ["fetch", "--quiet", "origin", remoteBranch], GIT_FETCH_TIMEOUT_MS);
+  const fetched = remoteBranch ? await gitStatus(root, ["fetch", "--quiet", "origin", `+refs/heads/${remoteBranch}:refs/remotes/origin/${remoteBranch}`], GIT_FETCH_TIMEOUT_MS) : null;
+  if (ref.startsWith("origin/") && fetched !== 0) return "unresolvable";
   // The sha itself must resolve to a commit in this repo, else ancestry is unknowable (not a
   // negative). `--verify --quiet ^{commit}` distinguishes "sha absent" from "sha present but not
   // on the ref".
@@ -246,6 +250,18 @@ export async function verifyLandedAncestry(repoRoot: string | undefined, sha: st
   }
 }
 
+/** Notice proof requires the freshly fetched remote; a local-only main never qualifies (#3761). */
+export async function verifyPublishedLand(repoRoot: string | undefined, sha: string | undefined, baseRef?: string): Promise<LandedAncestryVerdict> {
+  if (!repoRoot || !sha?.trim()) return "unresolvable";
+  try {
+    const base = baseRef ?? await repoDefaultBranch(async args => {
+      const result = await gitOutput(repoRoot, args);
+      return { ok: result?.exitCode === 0, stdout: result?.stdout ?? "", unavailable: !result };
+    });
+    return base ? await verifyLandedAncestry(repoRoot, sha, base.startsWith("origin/") ? base : `origin/${base}`) : "unresolvable";
+  } catch { return "unresolvable"; }
+}
+
 // #2718 — the landing host's own fresh-fetch ancestry check (`landVerifiedSha`) is ref-backed proof
 // that works wherever the repo lives; the hub's check needs a checkout of the same remote on its own
 // disk. Without a matching host verdict, fall back to the hub check (an absent path never confirms).
@@ -357,7 +373,7 @@ function landUnconfirmedText(input: LandUnconfirmedInput): { subject: string; bo
  * obligation) to the branch owner's coordinator and the fallback steward, and always leaves a
  * durable relay event + activity event so the outcome is auditable even if no one is reachable.
  */
-export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
+export async function notifyLandUnconfirmed(input: LandUnconfirmedInput): Promise<void> {
   const { workspace, kind } = input;
   const owner = workspace.ownerAgentId ?? undefined;
   const coordinator = resolveCoordinatorAgentId(owner);
@@ -366,6 +382,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
   const { subject, body } = landUnconfirmedText(input);
 
   const payload = {
+    verified: false,
     kind: "workspace.land-unconfirmed",
     notification: "land-unconfirmed",
     landOutcome: kind,
@@ -382,7 +399,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
 
   // #1912 §4 retained: command settlement schedules this through a synchronous deferred callback;
   // it cannot await without changing the settle/error contract for land completion.
-  createActivityEvent({
+  (await createActivityEventAsync({
     clientId: `workspace-land-unconfirmed-${workspace.id}-${input.commandId ?? "nocmd"}-${kind}`,
     kind: "state",
     title: kind === "not-ancestor"
@@ -395,11 +412,11 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
     icon: "ti-alert-octagon",
     view: "orchestrators",
     metadata: { source: "server", maintenanceJobId: "workspace-land-unconfirmed", workspaceId: workspace.id, mergeCommandId: input.commandId, landOutcome: kind },
-  });
+  }));
 
-  const recipients = [...new Set([owner, coordinator, fallback].filter((r): r is string => Boolean(r)))];
+  const recipients = withWorkspaceTaskOwnerRoles([owner, coordinator, fallback], workspace);
   if (recipients.length === 0) return;
-  routeNotification({
+  await routeNotification({
     type: "workspace.land_unconfirmed",
     scope: { workspaceId: workspace.id, repoRoot: workspace.repoRoot, ...(owner ? { author: owner } : {}), ...(coordinator ? { parent: coordinator } : {}) },
     recipients,
@@ -407,7 +424,7 @@ export function notifyLandUnconfirmed(input: LandUnconfirmedInput): void {
     forceDelivery: true,
     message: {
       subject,
-      body,
+      body: `${body} verified: false.`,
       payload,
       idempotencyKey: kind === "merge-failed" ? landFailureEventKey(workspace, input.commandId)
         : `land-unconfirmed:${workspace.id}:${input.commandId ?? "nocmd"}:${kind}`,

package/src/services/legacy-landing-host.ts

@@ -1,5 +1,5 @@
 import { cleanDeliveryGatePolicy, cleanLandGateRequirements } from "@humwick/sdk/land-gates";
-import type { CapturedDeliveryGateRequirement, LandGatesConfig } from "@humwick/sdk";
+import type { CapturedDeliveryGateRequirement, LandGatesConfig, WorktreeProvisionConfig } from "@humwick/sdk";
 import { errMessage, exactLandingSourceIdentity, RELAY_TOKEN_HEADER, isRecord, stringValue, type LandingContainmentMode } from "@humwick/sdk";
 import { isTrustedOrchestratorApiUrl, relayToken } from "../config";
 import { classifyLegacyLanding, type LandingLaneIdentity } from "../landing-lane-key";
@@ -14,6 +14,7 @@ export interface HostResolvedLandingIdentity extends LandingLaneIdentity {
   readonly sourceHeadSha: string;
   readonly baseHeadSha?: string;
   readonly gateRequirements?: LandGatesConfig["requirements"];
+  readonly gateDepsStrategy?: WorktreeProvisionConfig["depsStrategy"];
   readonly deliveryGate?: CapturedDeliveryGateRequirement;
   readonly landGateTimeoutBudgetMs?: number;
 }
@@ -131,6 +132,8 @@ export async function discoverLandingIdentityOnHost(
   return { ...classified.laneIdentity, sourceHeadSha: source.sourceHeadSha, ...(baseHeadSha ? { baseHeadSha } : {}),
     ...(delivery.deliveryRequire ? { deliveryGate: { command: delivery.delivery!, require: delivery.deliveryRequire } } : {}),
     ...(gateRequirements ? { gateRequirements } : {}),
+    ...(body.gateDepsStrategy === "command" || body.gateDepsStrategy === "none" || body.gateDepsStrategy === "symlink"
+      ? { gateDepsStrategy: body.gateDepsStrategy } : {}),
     ...(typeof body.landGateTimeoutBudgetMs === "number" && Number.isSafeInteger(body.landGateTimeoutBudgetMs) && body.landGateTimeoutBudgetMs >= 0
       ? { landGateTimeoutBudgetMs: body.landGateTimeoutBudgetMs } : {}) };
 }

package/src/services/legacy-landing-recovery.ts

@@ -1,5 +1,7 @@
-import { commandExecutorConfirmedGone, getCommandClaimOwnerToken, updateCommand } from "../commands-db.ts";
-import { releaseMergeLease } from "../db/merge-lease.ts";
+import { releaseMergeLeaseAsync } from "../db/runtime-tail-async";
+import { updateCommandAsync } from "../commands-write";
+import { commandExecutorConfirmedGone, getCommandClaimOwnerToken } from "../commands-db.ts";
+
 import { recordExecutionProofAsync, terminalizeLegacyLandingAsync } from "../commands-landing-async.ts";
 import { resolveCommandExecutorOwner } from "../merge-drain.ts";
 import type { Command, Orchestrator } from "../types.ts";
@@ -30,9 +32,9 @@ export async function reconcileLegacyLandingExecution(
       && commandExecutorConfirmedGone(command, getCommandClaimOwnerToken(command.id),
         resolveCommandExecutorOwner(command, orchestrators), now);
     if (!pastLease && !ownerGone) return null;
-    const terminal = updateCommand(command.id, { status: "timed_out", error: ownerGone
-      ? LEGACY_UNFENCED_RESTART_ERROR : "command timed out" }, { executor: true });
-    if (terminal) releaseMergeLease({ commandId: terminal.id });
+    const terminal = (await updateCommandAsync(command.id, { status: "timed_out", error: ownerGone
+      ? LEGACY_UNFENCED_RESTART_ERROR : "command timed out" }, { executor: true }));
+    if (terminal) (await releaseMergeLeaseAsync({ commandId: terminal.id }));
     return terminal;
   }
   if (command.landingContainmentMode !== "cgroup-v2-close-v1") return null;
@@ -82,7 +84,7 @@ export async function reconcileLegacyLandingExecution(
   const ownerState = resolveCommandExecutorOwner(command, orchestrators);
   if (!commandExecutorConfirmedGone(command, claimOwnerToken, ownerState, now)) {
     if (typeof command.expiresAt === "number" && command.expiresAt <= now && ownerState?.status !== "online") {
-      alertUnprovenLandLaneHolder(command);
+      await alertUnprovenLandLaneHolder(command);
     }
     return null;
   }

package/src/services/managed-running.ts

@@ -12,13 +12,13 @@
 // Composed by `registerAgent` (HTTP + bus registration) and called directly by the
 // orchestrator-report projection in lifecycle-manager. It does NOT upsert the agent
 // row — the agent registers itself over HTTP/bus; this only reconciles managed state.
-import { createActivityEvent, resolveQueuedDirectMessages, resolveQueuedPolicyMessages } from "../db";
-import { getManagedAgentState, updateManagedAgentState } from "../config-store";
+import { createActivityEventAsync } from "../db";
+import { getManagedAgentState } from "../config-store";
 import { emitRelayEvent } from "../events";
 import { emitMessageAvailable, emitMessageDeliveryUpdated, emitNewMessage } from "../sse";
 import type { AuthContext } from "./auth-context";
 import type { ManagedAgentState, Message } from "../types";
-import { resolveQueuedCoordinatorMessages } from "../db/coordinator-delivery.ts";
+import { updateManagedAgentStateAsync, resolveQueuedDirectMessagesAsync, resolveQueuedPolicyMessagesAsync, resolveQueuedCoordinatorMessagesAsync } from "../db/lifecycle-tail-async";
 
 interface ManagedRunningInput {
   policyName?: string;
@@ -44,11 +44,11 @@ interface ManagedRunningInput {
  *  - the managed-state change emits via `emitManagedState` (source "lifecycle-manager"
  *    + an activity-feed transition row), never the source-"server" `emitManagedAgentStateChanged`.
  */
-export function markManagedAgentRunning(
+export async function markManagedAgentRunning(
   input: ManagedRunningInput,
   ctx: AuthContext,
   opts: { now?: () => number } = {},
-): void {
+): Promise<void> {
   if (!input.policyName || !input.spawnRequestId) return;
   // #1797 — the reconcile REBINDS `managed_agent_state.agent_id` (and, via
   // `updateManagedAgentState`, the retained `last_agent_id`), which `managedStewardBoundAgentId` →
@@ -88,7 +88,7 @@ export function markManagedAgentRunning(
   const now = opts.now ?? (() => Date.now());
 
   const fromState = state.status;
-  const patch: Parameters<typeof updateManagedAgentState>[1] = {
+  const patch: Parameters<typeof updateManagedAgentStateAsync>[1] = {
     status: "running",
     agentId: input.agentId || state.agentId,
     tmuxSession: input.tmuxSession ?? state.tmuxSession,
@@ -101,11 +101,11 @@ export function markManagedAgentRunning(
   };
   // #3615 — repeated roster reports still flush queued messages, without rewriting running state.
   if (Object.entries(patch).some(([key, value]) => state[key as keyof ManagedAgentState] !== value)) {
-    const next = updateManagedAgentState(input.policyName, patch);
-    if (next) emitManagedState(next, fromState);
+    const next = await updateManagedAgentStateAsync(input.policyName, patch);
+    if (next) await emitManagedState(next, fromState);
   }
 
-  const available = resolveQueuedPolicyMessages(input.policyName, input.agentId || state.agentId || "");
+  const available = await resolveQueuedPolicyMessagesAsync(input.policyName, input.agentId || state.agentId || "");
   if (available.length) {
     emitMessageAvailable(input.policyName, input.agentId || state.agentId || "", available);
     for (const message of available) {
@@ -126,31 +126,31 @@ export function markManagedAgentRunning(
 // the came-up-running op.
 let transitionSeq = 0;
 
-export function emitManagedState(
+export async function emitManagedState(
   state: ManagedAgentState,
   fromState: string | undefined,
   reason?: string,
   now: () => number = () => Date.now(),
-): void {
+): Promise<void> {
   emitRelayEvent({
     type: "policy.state.changed",
     source: "lifecycle-manager",
     subject: state.policyName,
     data: state as unknown as Record<string, unknown>,
   });
-  if (fromState !== state.status) recordManagedTransition(state, fromState, reason, now);
+  if (fromState !== state.status) await recordManagedTransition(state, fromState, reason, now);
 }
 
-function recordManagedTransition(
+async function recordManagedTransition(
   state: ManagedAgentState,
   fromState: string | undefined,
   reason: string | undefined,
   now: () => number,
-): void {
+): Promise<void> {
   const why = reason ?? state.lastError ?? undefined;
   // #1912 §4 retained: this is shared by synchronous registration, restart settlement, and
   // orchestrator-report projection. Its transition + queue flush need one future async redesign.
-  createActivityEvent({
+  await createActivityEventAsync({
     clientId: `lifecycle-${state.policyName}-${state.status}-${now()}-${++transitionSeq}`,
     kind: "state",
     title: `${state.policyName}: ${fromState ?? "—"} → ${state.status}`,
@@ -177,8 +177,8 @@ function recordManagedTransition(
  * No-op when there are no queued direct messages. Returns the flushed messages so
  * callers (e.g. the resweep safety net, #706) can report how many were recovered.
  */
-export function flushQueuedDirectMessages(agentId: string): Message[] {
-  const available = [...resolveQueuedDirectMessages(agentId), ...resolveQueuedCoordinatorMessages(agentId)];
+export async function flushQueuedDirectMessages(agentId: string): Promise<Message[]> {
+  const available = [...await resolveQueuedDirectMessagesAsync(agentId), ...await resolveQueuedCoordinatorMessagesAsync(agentId)];
   if (!available.length) return [];
   emitMessageAvailable("direct", agentId, available);
   for (const message of available) {

package/src/services/memory-areas.ts

@@ -2,15 +2,13 @@
 // (relay_project_write_entry, relay_store_memory, the project-entry REST routes) resolves the
 // vocabulary and the stored value here, so the closed vocabulary cannot drift between them.
 
-import { AREAS_FILE, SYSTEM_AREAS, SYSTEM_AREA_DESCRIPTIONS, areasAtCommit, injectsAtStartup, isSystemArea, readAreasAtDefaultBranch, type AreaDefinition, type AreasAtCommit } from "@humwick/sdk/areas";
-import { errMessage, stringValue } from "@humwick/sdk";
-import { countActivePinnedEntriesInArea, getAgent, rootsForProject, ValidationError } from "../db";
-import { localProjectGit, readHostProjectFiles } from "../project-roles";
-import { hostIsRelayHost } from "../relay-host-locality";
+import { AREAS_FILE, SYSTEM_AREAS, SYSTEM_AREA_DESCRIPTIONS, areasAtCommit, injectsAtStartup, isSystemArea, type AreaDefinition, type AreasConfig } from "@humwick/sdk/areas";
+import { stringValue } from "@humwick/sdk";
+import { countActivePinnedEntriesInAreaAsync, getAgent, ValidationError } from "../db";
 import type { Project, ProjectEntry } from "../types";
 import type { AuthContext } from "./auth-context";
 import { callerHost, callerProjectId } from "./memory-identity";
-import { resolveProjectFilesHost } from "./spawn-project-role";
+import { readProjectConfig, readProjectConfigFirst, type ConfigLookup, type ProjectCheckout } from "./project-config-read";
 
 export const MAX_ENTRY_AREAS = 4;
 const PROJECT_WIDE = "project-wide";
@@ -47,42 +45,15 @@ export function areaCallerFromCtx(ctx: AuthContext): AreaCaller {
 }
 
 /** A checkout to read areas.json from: a cwd on a host (a hostname or a registered orchestrator). */
-export interface AreasCheckout {
-  cwd: string;
-  host?: string;
-  orchestratorId?: string;
-}
-
-export type AreasLookup = AreasAtCommit | { status: "unreadable"; error: string };
+export type AreasCheckout = ProjectCheckout;
 
-const loggedProblems = new Set<string>();
+export type AreasLookup = ConfigLookup<AreasConfig>;
 
-function logProblemOnce(key: string, problem: string): void {
-  if (loggedProblems.has(key)) return;
-  if (loggedProblems.size >= 1000) loggedProblems.clear();
-  loggedProblems.add(key);
-  console.warn(`[memory-areas] ${AREAS_FILE} for ${key}: ${problem}; accepting system areas only`);
-}
+const ACCEPTING_SYSTEM_AREAS = "accepting system areas only";
 
-/** #3635 — the areas.json at the checkout's default branch (origin/<default>, fetched first), read
- *  on the checkout's host through the #3043 project-files reader. Never a working tree and never
- *  cached, so a stale checkout or an old negative answer cannot hide a file that landed. */
-export async function readAreasConfig(checkout: AreasCheckout): Promise<AreasLookup> {
-  const where = `${checkout.orchestratorId ?? checkout.host ?? "local"}:${checkout.cwd}`;
-  try {
-    const lookup = !checkout.orchestratorId && hostIsRelayHost(checkout.host)
-      ? await readAreasAtDefaultBranch(localProjectGit(checkout.cwd))
-      : areasAtCommit(await readHostProjectFiles(
-        resolveProjectFilesHost({ subject: AREAS_FILE, cwd: checkout.cwd, orchestratorId: checkout.orchestratorId, preferHost: checkout.host }),
-        checkout.cwd, { paths: [AREAS_FILE] }, AREAS_FILE,
-      ));
-    if (lookup.status === "invalid") logProblemOnce(`${where}@${lookup.sha}`, `invalid: ${lookup.error}`);
-    return lookup;
-  } catch (err) {
-    const error = errMessage(err);
-    logProblemOnce(where, `unreadable: ${error}`);
-    return { status: "unreadable", error };
-  }
+/** #3635 — the areas.json at the checkout's default branch, through the shared project-config reader. */
+export function readAreasConfig(checkout: AreasCheckout): Promise<AreasLookup> {
+  return readProjectConfig(checkout, AREAS_FILE, areasAtCommit, ACCEPTING_SYSTEM_AREAS);
 }
 
 function invalidDetail(lookup: Extract<AreasLookup, { status: "invalid" }>): string {
@@ -94,18 +65,11 @@ function invalidDetail(lookup: Extract<AreasLookup, { status: "invalid" }>): str
  *  answers. Every other cell (base/provider/host) takes system areas only, optionally. */
 export async function resolveAreaVocabulary(anchor: Project, caller: AreaCaller | undefined): Promise<AreaVocabulary> {
   if (anchor.scope !== "project") return { pathAreas: [], required: false, pathAreasMissing: "not-project" };
-  const checkouts: AreasCheckout[] = [
-    ...(caller?.cwd && caller.projectId === anchor.id ? [{ cwd: caller.cwd, host: caller.host }] : []),
-    ...rootsForProject(anchor.id).map((root) => ({ cwd: root.rootPath, ...(root.orchestratorId ? { orchestratorId: root.orchestratorId } : {}) })),
-  ];
-  const failures: string[] = [];
-  for (const checkout of checkouts) {
-    const lookup = await readAreasConfig(checkout);
-    if (lookup.status === "found") return { pathAreas: lookup.config.areas, required: true };
-    if (lookup.status === "absent") return { pathAreas: [], required: false, pathAreasMissing: "undeclared" };
-    if (lookup.status === "invalid") return { pathAreas: [], required: false, pathAreasMissing: "invalid", pathAreasDetail: invalidDetail(lookup) };
-    failures.push(lookup.error);
-  }
+  const preferred = caller?.cwd && caller.projectId === anchor.id ? [{ cwd: caller.cwd, host: caller.host }] : [];
+  const { lookup, failures } = await readProjectConfigFirst(anchor.id, preferred, AREAS_FILE, areasAtCommit, ACCEPTING_SYSTEM_AREAS);
+  if (lookup?.status === "found") return { pathAreas: lookup.config.areas, required: true };
+  if (lookup?.status === "absent") return { pathAreas: [], required: false, pathAreasMissing: "undeclared" };
+  if (lookup?.status === "invalid") return { pathAreas: [], required: false, pathAreasMissing: "invalid", pathAreasDetail: invalidDetail(lookup) };
   return { pathAreas: [], required: false, pathAreasMissing: "unreadable", pathAreasDetail: failures.join("; ") || "the project has no checkout to read it from" };
 }
 
@@ -161,10 +125,10 @@ export async function resolveWriteAreas(
 /** When a written entry reaches agents, by its areas. An entry the startup block does not carry
  *  arrives when an agent first touches a path area it names (#3409, #3508). A pinned `project-wide`
  *  entry loads into every agent's startup block, so its write reports how many the cell carries. */
-export function areaDeliveryReport(entry: ProjectEntry): { deliveredOnTouch?: true; projectWideActive?: number; note?: string } {
+export async function areaDeliveryReport(entry: ProjectEntry): Promise<{ deliveredOnTouch?: true; projectWideActive?: number; note?: string }> {
   if (!injectsAtStartup(entry)) return entry.areas?.some((area) => !isSystemArea(area)) ? { deliveredOnTouch: true } : {};
   if (!entry.areas?.includes(PROJECT_WIDE)) return {};
-  const projectWideActive = countActivePinnedEntriesInArea(entry.projectId, PROJECT_WIDE);
+  const projectWideActive = await countActivePinnedEntriesInAreaAsync(entry.projectId, PROJECT_WIDE);
   return {
     projectWideActive,
     note: `${projectWideActive} active project-wide entries load into every agent's startup block; prefer a path or process area when one fits.`,

package/src/services/merge-pause.ts

@@ -1,11 +1,5 @@
-import {
-  acquireMergePause as acquireMergePauseRow,
-  getMergePause,
-  listMergePauses,
-  releaseMergePause as releaseMergePauseRow,
-  renewMergePause as renewMergePauseRow,
-  type MergePauseRecord,
-} from "../db";
+import { acquireMergePauseAsync as acquireMergePauseRowAsync, renewMergePauseAsync as renewMergePauseRowAsync, releaseMergePauseAsync as releaseMergePauseRowAsync } from "../db/runtime-tail-async";
+import { getMergePause, listMergePauses, type MergePauseRecord } from "../db";
 
 export type { MergePauseRecord };
 
@@ -17,21 +11,21 @@ export function getAutoMergePause(id: string): MergePauseRecord | null {
   return getMergePause(id);
 }
 
-export function pauseAutoMerge(input: {
+export async function pauseAutoMerge(input: {
   repoRoot: string;
   baseRef?: string;
   holder: string;
   reason?: string;
   ttlMs?: number;
   now?: number;
-}): { ok: true; pause: MergePauseRecord } | { ok: false; pause: MergePauseRecord } {
-  return acquireMergePauseRow(input);
+}): Promise<{ ok: true; pause: MergePauseRecord } | { ok: false; pause: MergePauseRecord }> {
+  return (await acquireMergePauseRowAsync(input));
 }
 
-export function renewAutoMergePause(id: string, ttlMs?: number): MergePauseRecord | null {
-  return renewMergePauseRow(id, ttlMs);
+export async function renewAutoMergePause(id: string, ttlMs?: number): Promise<MergePauseRecord | null> {
+  return (await renewMergePauseRowAsync(id, ttlMs));
 }
 
-export function resumeAutoMerge(input: { id?: string; repoRoot?: string; baseRef?: string }): boolean {
-  return releaseMergePauseRow(input);
+export async function resumeAutoMerge(input: { id?: string; repoRoot?: string; baseRef?: string }): Promise<boolean> {
+  return (await releaseMergePauseRowAsync(input));
 }

package/src/services/operator-decisions.ts

@@ -1,17 +1,20 @@
+import { withdrawOpenOperatorDecisionAsync, updateOpenOperatorDecisionAsync } from "../db/runtime-tail-async";
+import { randomUUID } from "node:crypto";
+import { getGateway } from "../db/gateway";
+import type { answerOperatorDecisionBody } from "../db/operator-answer-write";
+import type { SendMessageInput } from "../types";
 import { workflowDecisionAnswer } from "./workflow-decision-answer";
 import { getWorkflowOperatorDecision } from "../db/operator-decisions";
 import { actingUserSinkOf } from "./auth-context";
 import { DecisionNotFoundError, authorizeDecision } from "./decision-audience";
 // #2885 — operator decisions: a coordinator files a structured question for the operator; the
 // answer goes back as ONE message to `coordinator:<teamId>`, so whoever holds the seat gets it.
-import { coordinatesActiveTeam, getAgent, getOperatorDecision, insertOperatorDecision, listOperatorDecisions, answerOpenOperatorDecision,
-  setOperatorDecisionAnswerMessage, updateOpenOperatorDecision, withdrawOpenOperatorDecision, writeTransaction, ValidationError,
-  type OperatorDecisionContent } from "../db";
+import { coordinatesActiveTeam, getAgent, getOperatorDecision, insertOperatorDecision, listOperatorDecisions, answerOpenOperatorDecision, setOperatorDecisionAnswerMessage, writeTransaction, ValidationError, type OperatorDecisionContent } from "../db";
 import { acquireCoordinatorTeam } from "./team";
 import { emitRelayEvent } from "../events";
 import { emitNotificationCreated, notificationForDecision } from "../dashboard-notifications";
 import { cleanStringArray, optionalEnum, optionalString, stringField } from "../validation";
-import { sendMessageService } from "./send-message";
+import { validateSendMessageAuthorization, emitSendResults } from "./send-message";
 import type { AuthContext } from "./auth-context";
 import { ServiceAuthError } from "./errors";
 import { OPERATOR_ACTION_DONE, OPERATOR_ACTION_NOT_DONE, OPERATOR_ACTION_OUTCOME_ID, OPERATOR_DECISION_KINDS, OPERATOR_DECISION_QUESTION_KINDS,
@@ -129,12 +132,12 @@ function emitDecisionChanged(decision: OperatorDecision): void {
 }
 
 /** The team the caller coordinates. `mint` lets a teamless coordinator-capable caller found one. */
-export function callerDecisionTeam(ctx: AuthContext, mint: boolean): string {
+export async function callerDecisionTeam(ctx: AuthContext, mint: boolean): Promise<string> {
   const agentId = ctx.callerAgentId;
   if (!agentId) throw new ServiceAuthError("relay_decision needs a single caller agent identity");
   const agent = getAgent(agentId);
   if (agent?.teamId && coordinatesActiveTeam(agentId, agent.teamId)) return agent.teamId;
-  if (mint && agent && !agent.teamId && ctx.scopes.includes("command:spawn")) return acquireCoordinatorTeam(agentId).id;
+  if (mint && agent && !agent.teamId && ctx.scopes.includes("command:spawn")) return (await acquireCoordinatorTeam(agentId)).id;
   throw new ServiceAuthError("decisions belong to a team's coordinator; you do not coordinate an active team (a replacement claims it with relay_team_claim)");
 }
 
@@ -144,12 +147,12 @@ export function teamDecision(teamId: string, id: number): OperatorDecision {
   return decision;
 }
 
-function insertFiledDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now: number, workflow?: OperatorDecision["workflow"], coordinatorNote?: string): OperatorDecision {
+async function prepareFiledDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now: number, workflow?: OperatorDecision["workflow"], coordinatorNote?: string): Promise<Parameters<typeof insertOperatorDecision>[0]> {
   const content = cleanDecisionContent(args, undefined, Boolean(workflow));
   // Each input keeps its own bound; appending a valid note must not reject a valid context (#3586).
   if (coordinatorNote) content.context = [content.context, `Coordinator note: ${coordinatorNote}`].filter(Boolean).join("\n\n");
-  const teamId = callerDecisionTeam(ctx, true);
-  return insertOperatorDecision({ ...content, teamId, ...(projectId ? { projectId } : {}), filedBy: ctx.callerAgentId!, now, ...(workflow ? { workflow } : {}) });
+  const teamId = (await callerDecisionTeam(ctx, true));
+  return { ...content, teamId, ...(projectId ? { projectId } : {}), filedBy: ctx.callerAgentId!, now, ...(workflow ? { workflow } : {}) };
 }
 
 function publishFiledDecision(decision: OperatorDecision): OperatorDecision {
@@ -158,22 +161,23 @@ function publishFiledDecision(decision: OperatorDecision): OperatorDecision {
   return decision;
 }
 
-export function fileDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now = Date.now()): OperatorDecision {
-  return publishFiledDecision(insertFiledDecision(ctx, args, projectId, now));
+export async function fileDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now = Date.now()): Promise<OperatorDecision> {
+  const input = await prepareFiledDecision(ctx, args, projectId, now);
+  return publishFiledDecision(await getGateway().write("operatorDecisions.insert", input, { idempotencyKey: randomUUID() }) as unknown as OperatorDecision);
 }
 
-export function updateDecision(ctx: AuthContext, id: number, args: Record<string, unknown>, now = Date.now()): OperatorDecision {
-  const current = teamDecision(callerDecisionTeam(ctx, false), id);
+export async function updateDecision(ctx: AuthContext, id: number, args: Record<string, unknown>, now = Date.now()): Promise<OperatorDecision> {
+  const current = teamDecision((await callerDecisionTeam(ctx, false)), id);
   if (current.workflow && args.questions !== undefined) throw new ValidationError("workflow choices are frozen for this step activation");
-  if (!updateOpenOperatorDecision(id, cleanDecisionContent(args, current), now)) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
+  if (!(await updateOpenOperatorDecisionAsync(id, cleanDecisionContent(args, current), now))) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
   const updated = getOperatorDecision(id)!;
   emitDecisionChanged(updated);
   return updated;
 }
 
-export function withdrawDecision(ctx: AuthContext, id: number, now = Date.now()): OperatorDecision {
-  const current = teamDecision(callerDecisionTeam(ctx, false), id);
-  if (!withdrawOpenOperatorDecision(id, now)) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
+export async function withdrawDecision(ctx: AuthContext, id: number, now = Date.now()): Promise<OperatorDecision> {
+  const current = teamDecision((await callerDecisionTeam(ctx, false)), id);
+  if (!(await withdrawOpenOperatorDecisionAsync(id, now))) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
   const withdrawn = getOperatorDecision(id)!;
   emitDecisionChanged(withdrawn);
   return withdrawn;
@@ -201,7 +205,7 @@ function renderAnswerBody(decision: OperatorDecision, answers: OperatorDecisionA
  * transaction: a crash or a refused send can never leave an answered row without its message.
  * The message never expires (maxAgeSeconds null), so a seat vacant for days still receives it.
  */
-export function answerDecision(ctx: AuthContext, id: number, input: { answers: unknown; note?: unknown }, now = Date.now()): { decision: OperatorDecision; messageId: number } {
+export async function answerDecision(ctx: AuthContext, id: number, input: { answers: unknown; note?: unknown }, now = Date.now()): Promise<{ decision: OperatorDecision; messageId: number }> {
   if (ctx.callerAgentId) throw new ServiceAuthError("operator decisions are answered by the operator, not by an agent");
   const current = getOperatorDecision(id);
   if (!current) throw new DecisionNotFoundError(`decision #${id} not found`);
@@ -216,21 +220,16 @@ export function answerDecision(ctx: AuthContext, id: number, input: { answers: u
     throw new ValidationError(`note required: say why you could not do it (${OPERATOR_ACTION_NOT_DONE})`);
   }
   const answeredBy = ctx.actor.kind === "component" ? ctx.actor.id : actingUserSinkOf(ctx);
-  const sent = writeTransaction(() => {
-    if (!answerOpenOperatorDecision(id, { answers, ...(note ? { note } : {}), answeredBy, now })) {
-      throw new DecisionConflictError(`decision #${id} was answered or withdrawn meanwhile`);
-    }
-    const { message, publish } = sendMessageService({
-      from: actingUserSinkOf(ctx), to: current.teamId.startsWith("host-privacy:") || current.teamId === "vault-expiry:global" ? current.filedBy : `coordinator:${current.teamId}`, body: renderAnswerBody(current, answers, note),
-      idempotencyKey: `decision:${id}:answer`, maxAgeSeconds: null, meta: { decisionId: id },
-    }, ctx, { deferLiveEffects: true });
-    setOperatorDecisionAnswerMessage(id, message.id);
-    return { messageId: message.id, publish };
-  });
-  // Live effects only after COMMIT: a rolled-back answer must never have been delivered (#2887).
-  sent.publish?.();
-  const { messageId } = sent;
-  const decision = getOperatorDecision(id)!;
+  const message: SendMessageInput = {
+    from: actingUserSinkOf(ctx), to: current.teamId.startsWith("host-privacy:") || current.teamId === "vault-expiry:global" ? current.filedBy : `coordinator:${current.teamId}`, body: renderAnswerBody(current, answers, note),
+    idempotencyKey: `decision:${id}:answer`, maxAgeSeconds: null, meta: { decisionId: id },
+  };
+  validateSendMessageAuthorization(message, ctx);
+  const written = await getGateway().write("operatorDecisions.answer", { id, answer: { answers, ...(note ? { note } : {}), answeredBy, now }, message }, { critical: true }) as unknown as ReturnType<typeof answerOperatorDecisionBody>;
+  if (!written) throw new DecisionConflictError(`decision #${id} was answered or withdrawn meanwhile`);
+  const { decision, result } = written;
+  (await emitSendResults([result]));
+  const messageId = result.message.id;
   emitDecisionChanged(decision);
   return { decision, messageId };
 }
@@ -244,17 +243,14 @@ export function cleanWorkflowAnswers(decision: Pick<OperatorDecision, "questions
 }
 
 /** The effect identity and filing share a transaction, so replay cannot create another card. */
-export function fileWorkflowDecision(ctx: AuthContext, args: Record<string, unknown>, workflow: NonNullable<OperatorDecision["workflow"]>, projectId?: string, coordinatorNote?: string): OperatorDecision {
+export async function fileWorkflowDecision(ctx: AuthContext, args: Record<string, unknown>, workflow: NonNullable<OperatorDecision["workflow"]>, projectId?: string, coordinatorNote?: string): Promise<OperatorDecision> {
   const note = optionalString(coordinatorNote, "note", MAX_TEXT);
-  const filed = writeTransaction(() => {
-    const existing = getWorkflowOperatorDecision(workflow.effectId);
-    if (existing) return { decision: existing, created: false };
-    return { decision: insertFiledDecision(ctx, args, projectId, Date.now(), workflow, note), created: true };
-  });
+  const input = await prepareFiledDecision(ctx, args, projectId, Date.now(), workflow, note);
+  const filed = await getGateway().write("operatorDecisions.fileWorkflow", input) as unknown as { decision: OperatorDecision; created: boolean };
   return filed.created ? publishFiledDecision(filed.decision) : filed.decision;
 }
 
-export function withdrawWorkflowDecision(effectId: string): void {
+export async function withdrawWorkflowDecision(effectId: string): Promise<void> {
   const decision = getWorkflowOperatorDecision(effectId);
-  if (decision && withdrawOpenOperatorDecision(decision.id, Date.now())) emitDecisionChanged(getOperatorDecision(decision.id)!);
+  if (decision && (await withdrawOpenOperatorDecisionAsync(decision.id, Date.now()))) emitDecisionChanged(getOperatorDecision(decision.id)!);
 }

package/src/services/orchestrator-registration-recovery.ts

@@ -4,9 +4,13 @@ import { recoverOrchestratorLegacyLandings } from "./orchestrator-landing-recove
 import { resumeDeferredWorkflowCleanup } from "./workflow-deferred-cleanup";
 import { workflowTaskDelivered } from "./workflow-runs";
 
+/** #3826 — the workflow follow-up waits on the supervisor queue, so it runs after the register reply. Deferred
+ *  cleanup stays durable: a failed resume is retried by the next registration or hub boot. */
 export async function recoverRegisteredOrchestrator(orchestratorId: string): Promise<void> {
   await reconcileOrchestratorSchedulerCommands(orchestratorId);
-  await resumeDeferredWorkflowCleanup(orchestratorId);
-  await workflowTaskDelivered();
+  void fireAndForget(`[orchestrator] workflow cleanup resume for ${orchestratorId}`, async () => {
+    await resumeDeferredWorkflowCleanup(orchestratorId);
+    await workflowTaskDelivered();
+  });
   void fireAndForget(`[orchestrator] legacy landing recovery for ${orchestratorId}`, () => recoverOrchestratorLegacyLandings(orchestratorId));
 }