@humwick/server 0.130.1 → 0.130.3

package/src/services/orchestrator-upgrade.ts

@@ -1,5 +1,7 @@
-import { getOrchestrator, setOrchestratorUpgradeState } from "../db";
-import { createCommand, getCommand, updateCommand } from "../commands-db";
+import { updateCommandAsync, createCommandAsync } from "../commands-write";
+import { setOrchestratorUpgradeStateAsync } from "../db/orchestrators-async";
+import { getOrchestrator } from "../db";
+import { getCommand } from "../commands-db";
 import { emitOrchestratorStatus } from "../sse";
 import { emitCommandEvent } from "../command-events";
 import type { ActivityEventInput } from "../types";
@@ -10,18 +12,18 @@ export const ORCH_UPGRADE_DEADLINE_MS = 5 * 60_000;
 // central provider-config rows (#465). The orchestrator reports its files via the
 // command result; the server seeds the rows (see patchCommand). Capability-gated so
 // pre-#465 orchestrators that lack the handler never get a command they'd reject.
-export function dispatchProviderConfigMigration(
+export async function dispatchProviderConfigMigration(
   orch: NonNullable<ReturnType<typeof getOrchestrator>>,
   requestedBy = "system",
-): ReturnType<typeof createCommand> | null {
+): Promise<ReturnType<typeof createCommandAsync> | null> {
   if (!orch.capabilities?.migrateProviderConfig) return null;
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "orchestrator.migrate-provider-config",
     source: "system",
     target: orch.agentId,
     ttlMs: 10 * 60_000,
     params: { orchestratorId: orch.id, requestedBy },
-  });
+  }));
   emitCommandEvent(command, "command.requested");
   return command;
 }
@@ -42,14 +44,14 @@ export async function reconcileOrchestratorUpgrade(
   // before retrying. The running process's gitSha is the artifact identity and must match too.
   if (reachedTarget && up.status === "succeeded" && up.error) {
     const { error: _previousError, ...successState } = up;
-    setOrchestratorUpgradeState(orch.id, successState);
+    (await setOrchestratorUpgradeStateAsync(orch.id, successState));
     emitOrchestratorStatus(orch.id);
     return;
   }
   if (reachedTarget && reported && (up.status === "pending" || up.status === "failed")) {
-    if (up.commandId) updateCommand(up.commandId, { status: "succeeded", result: { version: reported, ...(up.fromVersion ? { fromVersion: up.fromVersion } : {}) } });
+    if (up.commandId) (await updateCommandAsync(up.commandId, { status: "succeeded", result: { version: reported, ...(up.fromVersion ? { fromVersion: up.fromVersion } : {}) } }));
     const { error: _previousError, ...successState } = up;
-    setOrchestratorUpgradeState(orch.id, { ...successState, status: "succeeded", settledAt: Date.now() });
+    (await setOrchestratorUpgradeStateAsync(orch.id, { ...successState, status: "succeeded", settledAt: Date.now() }));
     await auditEvent({
       clientId: `server-orchestrator-upgraded-${orch.id}-${Date.now()}`,
       kind: "state",
@@ -62,12 +64,12 @@ export async function reconcileOrchestratorUpgrade(
     });
     // Upgrade settled — the orchestrator is now running new-enough code to handle
     // the provider-config migration, so seed the central rows from its local files (#465).
-    dispatchProviderConfigMigration(orch);
+    (await dispatchProviderConfigMigration(orch));
     emitOrchestratorStatus(orch.id);
   } else if (up.status === "pending" && Date.now() - up.requestedAt > ORCH_UPGRADE_DEADLINE_MS) {
     const errMsg = `upgrade timed out; orchestrator still reports ${reported ?? "unknown"} (wanted ${up.desiredVersion})`;
-    if (up.commandId) updateCommand(up.commandId, { status: "failed", error: errMsg });
-    setOrchestratorUpgradeState(orch.id, { ...up, status: "failed", settledAt: Date.now(), error: errMsg });
+    if (up.commandId) (await updateCommandAsync(up.commandId, { status: "failed", error: errMsg }));
+    (await setOrchestratorUpgradeStateAsync(orch.id, { ...up, status: "failed", settledAt: Date.now(), error: errMsg }));
     await auditEvent({
       clientId: `server-orchestrator-upgrade-failed-${orch.id}-${Date.now()}`,
       kind: "state",

package/src/services/permission-decision.ts

@@ -1,6 +1,6 @@
 import { isHumanAgentId } from "@humwick/sdk";
 import { randomUUID } from "node:crypto";
-import { createCommandInternal } from "../commands-db";
+import { createAgentControlAsync } from "../db/agent-control-async";
 import { emitCommandEvent } from "../command-events";
 import { ValidationError, createActivityEventAsync, getAgent } from "../db";
 import { agentProviderState } from "../provider-state";
@@ -66,7 +66,7 @@ export async function dispatchAgentPermissionDecision(
 ): Promise<AgentPermissionDecisionResult> {
   const agent = getAgent(input.agentId);
   if (!agent) throw new PermissionDecisionTargetError(`agent ${input.agentId} not found`);
-  authorizeShutdown(ctx, { agentId: agent.id, requestedVia: input.requestedVia });
+  (await authorizeShutdown(ctx, { agentId: agent.id, requestedVia: input.requestedVia }));
   assertControlEligible(agent);
 
   const pendingApprovalId = currentApprovalId(agent);
@@ -122,7 +122,8 @@ export async function dispatchAgentPermissionDecision(
   // Audit admission precedes the durable command, matching the other service-layer agent controls.
   const event = await createActivityEventAsync(activityInput);
   revalidatePendingApproval(agent, approvalId);
-  const command = createCommandInternal({ input: commandInput, id: commandId });
+  const { command: admitted } = await createAgentControlAsync({ agent, commandInput, commandId, approvalId });
+  const command = admitted!;
   emitCommandEvent(command, "command.requested");
   emitActivityEvent(event);
   return { approvalId, decision: input.decision, command };

package/src/services/plan-ci-notice.ts

@@ -0,0 +1,57 @@
+// #3716 — workflow effects read CI episodes without depending on workflow launch or recovery.
+import { ValidationError } from "../db/connection";
+import { computeCiFailureFingerprint } from "../ci/incidents";
+import type { CiShaObservation } from "../db/ci-incidents";
+import type { StoredPlanCiBlock } from "../db/plan-ci-blocks";
+import { getGateway } from "../db/gateway";
+import { getPlanGraphProjectionAsync } from "../db/plan-graph-async";
+import { planNoticeTarget } from "../db/plan-completion";
+import { notifySystemMessage } from "../notify";
+import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
+
+/** Same watch and landed SHA, or the same failing jobs: an unrelated red main must not quiet this failure. */
+export async function correlatedCiIncidents(rows: Array<{ workflow: string; row?: CiShaObservation }>): Promise<string[]> {
+  const ids: string[] = [];
+  for (const { workflow, row } of rows) {
+    if (!row) return [];
+    const incident = await getGateway().read("ciIncidents.activeForWatch", { watchKey: row.watchKey });
+    if (!incident) return [];
+    if (incident.openedHeadSha !== row.headSha) {
+      if (!row.failingJobs?.length) return [];
+      const fingerprint = computeCiFailureFingerprint({ workflow, failingRuns: [{ id: "sha", status: "completed", jobs: row.failingJobs.map((job) => ({ id: job.name, name: job.name })) }], conclusion: "failure" });
+      if (fingerprint !== incident.fingerprint) return [];
+    }
+    ids.push(incident.id);
+  }
+  return [...new Set(ids)].sort();
+}
+
+/** Return a quiet receipt only after both the blocked attempt and the actionable plan notice are durable. */
+export async function planCiNotice(run: WorkflowRunRecord, payload: Record<string, unknown>, result = false): Promise<Record<string, unknown> | undefined> {
+  const owner = await getGateway().read("planDispatch.owner", { taskId: run.taskId });
+  if (!owner || owner.audit) return undefined;
+  let block = await getGateway().read("planDispatch.ci.block", { runId: run.id });
+  const incidentIds = Array.isArray(payload.incidentIds) ? payload.incidentIds.filter((id): id is string => typeof id === "string") : [];
+  if (!result && incidentIds.length && typeof payload.landedSha === "string") {
+    try {
+      block = await getGateway().write("planDispatch.ci.block", { planId: owner.planId, taskId: run.taskId, runId: run.id, sha: payload.landedSha, incidentIds, waitKey: run.escalation?.waitKey ?? "" }) as unknown as StoredPlanCiBlock;
+    } catch (error) {
+      // A superseded attempt must still send its normal CI notice (#3660).
+      if (error instanceof ValidationError && error.message === "CI blocker no longer owns its plan slot") return undefined;
+      throw error;
+    }
+  }
+  if (!block || (result && (block.retriedAt !== undefined || block.waitKey !== run.escalation?.waitKey)) || (!result && !incidentIds.length)) return undefined;
+  const plan = await getPlanGraphProjectionAsync({ planId: owner.planId });
+  const to = plan && planNoticeTarget(plan);
+  if (!to) return undefined;
+  for (const incidentId of block.incidentIds) {
+    await notifySystemMessage(to, {
+      subject: `Plan ${plan.title ?? plan.id}: CI blocked`,
+      body: `Plan ${plan.id}: T${run.taskId}, run ${run.id}, landed SHA ${block.sha}, is blocked by CI incident ${incidentId}. Fix the incident; Relay automatically retries each blocked run's exact landed SHA after clearance. Slots and dependents wait. relay_plan_get shows every blocked Task and run.`,
+      idempotencyKey: `plan:${plan.id}:ci:${incidentId}`, replyExpected: false,
+      payload: { kind: "plan.ci-blocked", planId: plan.id, incidentId, taskId: run.taskId, runId: run.id, landedSha: block.sha },
+    });
+  }
+  return { quiet: "plan-ci-episode", planId: owner.planId, incidentIds: block.incidentIds };
+}

package/src/services/plan-ci-recovery.ts

@@ -1,62 +1,9 @@
-// #3660 — correlate only known CI episodes; clearance reuses the original run's CI resume path.
-import { ValidationError } from "../db/connection";
-import { computeCiFailureFingerprint } from "../ci/incidents";
-import type { CiShaObservation } from "../db/ci-incidents";
+// #3660 — clearance reuses the original run's CI resume path.
+import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
 import type { StoredPlanCiBlock } from "../db/plan-ci-blocks";
 import { getGateway } from "../db/gateway";
-import { getPlanGraphProjectionAsync } from "../db/plan-graph-async";
-import { planNoticeTarget } from "../db/plan-completion";
-import { notifySystemMessage } from "../notify";
-import type { WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
 import { resumeWorkflowRun } from "./workflow-runs";
 
-/** Same watch and landed SHA, or the same failing jobs: an unrelated red main must not quiet this failure. */
-export async function correlatedCiIncidents(rows: Array<{ workflow: string; row?: CiShaObservation }>): Promise<string[]> {
-  const ids: string[] = [];
-  for (const { workflow, row } of rows) {
-    if (!row) return [];
-    const incident = await getGateway().read("ciIncidents.activeForWatch", { watchKey: row.watchKey });
-    if (!incident) return [];
-    if (incident.openedHeadSha !== row.headSha) {
-      if (!row.failingJobs?.length) return [];
-      const fingerprint = computeCiFailureFingerprint({ workflow, failingRuns: [{ id: "sha", status: "completed", jobs: row.failingJobs.map((job) => ({ id: job.name, name: job.name })) }], conclusion: "failure" });
-      if (fingerprint !== incident.fingerprint) return [];
-    }
-    ids.push(incident.id);
-  }
-  return [...new Set(ids)].sort();
-}
-
-/** Return a quiet receipt only after both the blocked attempt and the actionable plan notice are durable. */
-export async function planCiNotice(run: WorkflowRunRecord, payload: Record<string, unknown>, result = false): Promise<Record<string, unknown> | undefined> {
-  const owner = await getGateway().read("planDispatch.owner", { taskId: run.taskId });
-  if (!owner || owner.audit) return undefined;
-  let block = await getGateway().read("planDispatch.ci.block", { runId: run.id });
-  const incidentIds = Array.isArray(payload.incidentIds) ? payload.incidentIds.filter((id): id is string => typeof id === "string") : [];
-  if (!result && incidentIds.length && typeof payload.landedSha === "string") {
-    try {
-      block = await getGateway().write("planDispatch.ci.block", { planId: owner.planId, taskId: run.taskId, runId: run.id, sha: payload.landedSha, incidentIds, waitKey: run.escalation?.waitKey ?? "" }) as unknown as StoredPlanCiBlock;
-    } catch (error) {
-      // A superseded attempt must still send its normal CI notice (#3660).
-      if (error instanceof ValidationError && error.message === "CI blocker no longer owns its plan slot") return undefined;
-      throw error;
-    }
-  }
-  if (!block || (result && (block.retriedAt !== undefined || block.waitKey !== run.escalation?.waitKey)) || (!result && !incidentIds.length)) return undefined;
-  const plan = await getPlanGraphProjectionAsync({ planId: owner.planId });
-  const to = plan && planNoticeTarget(plan);
-  if (!to) return undefined;
-  for (const incidentId of block.incidentIds) {
-    notifySystemMessage(to, {
-      subject: `Plan ${plan.title ?? plan.id}: CI blocked`,
-      body: `Plan ${plan.id}: T${run.taskId}, run ${run.id}, landed SHA ${block.sha}, is blocked by CI incident ${incidentId}. Fix the incident; Relay automatically retries each blocked run's exact landed SHA after clearance. Slots and dependents wait. relay_plan_get shows every blocked Task and run.`,
-      idempotencyKey: `plan:${plan.id}:ci:${incidentId}`, replyExpected: false,
-      payload: { kind: "plan.ci-blocked", planId: plan.id, incidentId, taskId: run.taskId, runId: run.id, landedSha: block.sha },
-    });
-  }
-  return { quiet: "plan-ci-episode", planId: owner.planId, incidentIds: block.incidentIds };
-}
-
 /** A kernel resume note is the durable receipt if the process dies before marking the plan's row. */
 export async function recoverPlanCiBlock(run: WorkflowRunRecord): Promise<StoredPlanCiBlock | null> {
   const block = await getGateway().read("planDispatch.ci.block", { runId: run.id });

package/src/services/plan-conformance.ts

@@ -71,15 +71,15 @@ function cleanVerdictItems(value: unknown): PlanConformanceItem[] {
   });
 }
 
-export function emitPlanTaskEvents(events: PlanGraphTaskEvent[] | undefined): void {
+export async function emitPlanTaskEvents(events: PlanGraphTaskEvent[] | undefined): Promise<void> {
   for (const event of events ?? []) {
     emitTaskChanged(event.task, event.type);
     if (event.type === "task.created") {
       // A Task is created once, so a replayed aggregate write (its gateway result re-read) notifies once (#3660).
-      emitTaskSemanticNotification({ task: event.task, transition: "created", actor: event.actor, occurrenceKey: "created" });
+      await emitTaskSemanticNotification({ task: event.task, transition: "created", actor: event.actor, occurrenceKey: "created" });
     } else {
       const transition = taskTransitionForStatus(event.task.status, event.task.blockedBy);
-      if (transition) emitTaskSemanticNotification({ task: event.task, transition, actor: event.actor, occurrenceKey: undefined });
+      if (transition) await emitTaskSemanticNotification({ task: event.task, transition, actor: event.actor, occurrenceKey: undefined });
     }
   }
 }
@@ -100,6 +100,6 @@ export async function recordPlanConformance(input: { planId?: unknown; mainSha?:
   const mainShaCheck = await checkMainSha(planId, mainSha);
   const result = await recordPlanConformanceAsync({ planId, mainSha, mainShaCheck, items, actor });
   emitRelayEvent({ type: "plan.changed", source: actor, subject: result.plan.id, data: { plan: result.plan, actor } });
-  emitPlanTaskEvents(result.taskEvents);
+  await emitPlanTaskEvents(result.taskEvents);
   return { planId: result.plan.id, version: result.plan.version, verdict: result.verdict, completion: result.plan.completion, gapTaskIds: result.gapTaskIds, ...(result.reusedGapTaskIds.length ? { reusedGapTaskIds: result.reusedGapTaskIds } : {}), conformance: result.plan.conformance };
 }

package/src/services/plan-dispatch-policy.ts

@@ -1,5 +1,5 @@
 // #3660 — plan autopilot readiness and wake policy as pure rules over durable facts (slots, Tasks, runs).
-import { planSlotOccupies, type Plan, type PlanDispatchSlot, type PlanDispatchSlotStatus, type TaskDetail, type TaskTerminalStage } from "../types";
+import { planSlotOccupies, type Plan, type PlanNode, type PlanDispatchSlot, type PlanDispatchSlotStatus, type TaskDetail, type TaskTerminalStage } from "../types";
 import { taskTerminalStage } from "../task-completion";
 
 export interface PlanMember { nodeId: string; taskId: number }
@@ -12,13 +12,13 @@ export function planMembers(plan: Pick<Plan, "nodes">): PlanMember[] {
   });
 }
 
-/** Why a plan cannot be started, per node; empty when every node is a bound Task the dispatcher can run. */
+/** Only unfinished automatic work needs a Task; settled facts and manual gates are valid (#3819). */
 export function unsupportedPlanShape(plan: Pick<Plan, "nodes" | "acceptance">): string[] {
   const problems: string[] = [];
   if (!plan.acceptance?.length) problems.push("PLAN_ACCEPTANCE_REQUIRED: the auditor checks the plan's acceptance; add acceptance items");
   if (!plan.nodes.length) problems.push("UNSUPPORTED_PLAN_SHAPE: the plan has no nodes");
   const members = new Set(planMembers(plan).map((member) => member.nodeId));
-  const unbound = plan.nodes.filter((node) => !members.has(node.id)).map((node) => node.id);
+  const unbound = plan.nodes.filter((node) => node.status !== "landed" && node.statusSource !== "manual" && !members.has(node.id)).map((node) => node.id);
   if (unbound.length) problems.push(`UNSUPPORTED_PLAN_SHAPE: nodes ${unbound.join(", ")} are not bound to a Task (status-pinned or unbound nodes cannot be dispatched; create them with relay_task_create plan:{...})`);
   return problems;
 }
@@ -48,6 +48,13 @@ export function taskSucceeded(task: PrerequisiteTask | null, slot: Pick<PlanDisp
   return prerequisiteState(task, requiredStage).state === "satisfied";
 }
 
+/** Existing settled nodes are facts; a dispatched run still needs its verified result, including CI. */
+export function planNodeSettled(node: PlanNode, task: PrerequisiteTask | null, slot?: PlanDispatchSlot, requiredStage?: TaskTerminalStage): boolean {
+  if (node.statusSource === "manual") return node.status === "landed";
+  if (slot) return taskSucceeded(task, slot, requiredStage);
+  return node.status === "landed" || task?.status === "done" || task?.status === "canceled";
+}
+
 /** The stage an edge requires of its prerequisite; unnamed edges keep the original landed-on-main rule. */
 export function dependencyStage(task: Pick<TaskDetail, "dependsOnStages">, prerequisiteId: number): TaskTerminalStage {
   return task.dependsOnStages?.[String(prerequisiteId)] ?? "landed-on-main";

package/src/services/plan-dispatch.ts

@@ -18,7 +18,7 @@ import { launchWorkflowRun, prepareWorkflowRun } from "./workflow-runs";
 import { ensureSupervisor, invoke, type Supervisor } from "./workflow-supervisor";
 import { stampPins } from "./workflow-pins";
 import { emitPlan } from "./plan-graph";
-import { dependencyStage, memberReady, occupiedSlots, planMembers, prerequisiteState, slotFromRun, taskSucceeded, unsupportedPlanShape } from "./plan-dispatch-policy";
+import { dependencyStage, memberReady, occupiedSlots, planMembers, planNodeSettled, prerequisiteState, slotFromRun, taskSucceeded, unsupportedPlanShape } from "./plan-dispatch-policy";
 import type { AuthContext } from "./auth-context";
 import { planSlotOccupies, type Plan, type PlanDispatch, type PlanDispatchSlot, type TaskDetail } from "../types";
 
@@ -44,9 +44,13 @@ export async function startPlanDispatch(input: { planId?: unknown; expectedVersi
   if (plan.archived) throw new ValidationError(`plan ${plan.id} is archived`);
   const problems = unsupportedPlanShape(plan);
   if (problems.length) throw new ValidationError(problems.join("; "));
-  const members = planMembers(plan);
-  const tasks = await Promise.all(members.map((member) => getTaskDetailAsync(member.taskId)));
-  const memberIds = new Set(members.map((member) => member.taskId));
+  const nodes = new Map(plan.nodes.map((node) => [node.id, node]));
+  const allMembers = planMembers(plan);
+  const allTasks = await Promise.all(allMembers.map((member) => getTaskDetailAsync(member.taskId)));
+  const unfinished = allMembers.flatMap((member, index) => planNodeSettled(nodes.get(member.nodeId)!, allTasks[index]!) ? [] : [{ member, task: allTasks[index]! }]);
+  const members = unfinished.map(({ member }) => member);
+  const tasks = unfinished.map(({ task }) => task);
+  const memberIds = new Set(plan.nodes.map((node) => Number(node.refs?.taskId)));
   for (const member of tasks) {
     for (const id of member?.dependsOn ?? []) {
       if (memberIds.has(id)) continue;
@@ -55,7 +59,7 @@ export async function startPlanDispatch(input: { planId?: unknown; expectedVersi
     }
   }
   const repos = new Set(tasks.map((task) => task?.repo).filter(Boolean));
-  if (repos.size !== 1) throw new ValidationError(`UNSUPPORTED_PLAN_SHAPE: slice 1a dispatches one repo; the plan's Tasks name ${repos.size ? [...repos].join(", ") : "no repo"}`);
+  if (tasks.length && repos.size !== 1) throw new ValidationError(`UNSUPPORTED_PLAN_SHAPE: slice 1a dispatches one repo; the plan's Tasks name ${repos.size ? [...repos].join(", ") : "no repo"}`);
   let cwd: string | undefined;
   for (const [index, task] of tasks.entries()) {
     if (!task || task.status === "canceled") throw new ValidationError(`UNSUPPORTED_PLAN_SHAPE: T${members[index]!.taskId} is missing or canceled`);
@@ -115,6 +119,8 @@ function ensureListening(): void {
     if (event.type === "task.stage" || event.type === "task.status" || event.type === "task.updated") {
       const plans = watched.get(Number(event.data.id ?? event.subject));
       if (plans?.size) void fireAndForget("[plan-dispatch] reconcile", () => requestReconcile(plans));
+    } else if (event.type === "plan.changed" && event.subject && dispatching.has(event.subject)) {
+      void fireAndForget("[plan-dispatch] reconcile", () => requestReconcile([event.subject!]));
     } else if (dispatching.size && (event.type === "workflow.changed" || event.type === "branch.landed" || event.type === "ci.status")) {
       void fireAndForget("[plan-dispatch] reconcile", () => requestReconcile());
     }
@@ -184,9 +190,22 @@ async function reconcilePlan(planId: string): Promise<void> {
     changed ||= next !== slot;
     slots.set(slot.taskId, next);
   }
+  const nodes = new Map(plan.nodes.map((node) => [node.id, node]));
+  const nodesForTask = new Map(plan.nodes.filter((node) => node.refs?.taskId).map((node) => [Number(node.refs!.taskId), node]));
+  const prerequisites = new Map<string, string[]>();
+  for (const edge of plan.edges) {
+    if (!prerequisites.has(edge.to)) prerequisites.set(edge.to, []);
+    prerequisites.get(edge.to)!.push(edge.from);
+  }
+  const settledNode = async (nodeId: string, requiredStage?: Parameters<typeof taskSucceeded>[2]) => {
+    const node = nodes.get(nodeId)!;
+    const id = Number(node.refs?.taskId);
+    return planNodeSettled(node, Number.isSafeInteger(id) && id > 0 ? await task(id) : null, slots.get(id), requiredStage);
+  };
   if (dispatch.state === "active") {
     for (const { nodeId, taskId } of members) {
       const slot = slots.get(taskId);
+      if (!slot && await settledNode(nodeId)) continue;
       if (slot && (slot.status !== "launch-failed" && slot.status !== "failed" && slot.status !== "cancelled")) {
         const dispatched = planSlotOccupies(slot.status) ? await task(taskId) : null;
         if (dispatched) await escalateRegressions(plan, nodeId, dispatched, memberTaskIds, task);
@@ -207,14 +226,16 @@ async function reconcilePlan(planId: string): Promise<void> {
       for (const id of member.dependsOn) {
         const prerequisite = await task(id);
         const required = dependencyStage(member, id);
-        if (taskSucceeded(prerequisite, slots.get(id), required)) succeeded.add(id);
+        const node = nodesForTask.get(id);
+        if (node ? await settledNode(node.id, required) : taskSucceeded(prerequisite, slots.get(id), required)) succeeded.add(id);
         else {
           const state = prerequisiteState(prerequisite, required);
           if (state.state === "unreachable") {
-            notifyPlan(plan, `T${taskId} prerequisite unreachable`, `Plan ${plan.id}, node ${nodeId} (T${taskId}) waits on T${id}, which is ${state.reason}. Replace the edge with relay_task_remove_dependency then relay_task_add_dependency, cancel the node, or wait for T${id} to be reopened. The dependent keeps waiting.`, `plan:${plan.id}:prereq:T${id}:${state.reason}`, { kind: "plan.prerequisite-unreachable", planId, nodeId, taskId, prerequisiteTaskId: id, reason: state.reason, nextActions: ["replace-edge", "cancel-node", "wait-for-reopen"] });
+            await notifyPlan(plan, `T${taskId} prerequisite unreachable`, `Plan ${plan.id}, node ${nodeId} (T${taskId}) waits on T${id}, which is ${state.reason}. Replace the edge with relay_task_remove_dependency then relay_task_add_dependency, cancel the node, or wait for T${id} to be reopened. The dependent keeps waiting.`, `plan:${plan.id}:prereq:T${id}:${state.reason}`, { kind: "plan.prerequisite-unreachable", planId, nodeId, taskId, prerequisiteTaskId: id, reason: state.reason, nextActions: ["replace-edge", "cancel-node", "wait-for-reopen"] });
           }
         }
       }
+      if (!(await Promise.all((prerequisites.get(nodeId) ?? []).map((id) => settledNode(id)))).every(Boolean)) continue;
       if (!memberReady(member, undefined, (id) => succeeded.has(id))) continue;
       if (occupiedSlots(slots.values()) >= dispatch.concurrency) continue;
       const claimed = await write<{ slot?: PlanDispatchSlot; reserved: boolean }>("planDispatch.slot.reserve", { planId, taskId, nodeId });
@@ -223,7 +244,7 @@ async function reconcilePlan(planId: string): Promise<void> {
       if (fault === "after-reserve") { halted = true; throw new Error("plan dispatch test fault: the process stopped after reserving a slot"); }
       slots.set(taskId, await launch(plan, claimed.slot));
     }
-    const settled = await Promise.all(members.map(async ({ taskId }) => taskSucceeded(await task(taskId), slots.get(taskId))));
+    const settled = await Promise.all(plan.nodes.map((node) => settledNode(node.id)));
     if (settled.every(Boolean)) {
       await openAudit(plan, dispatch, members.map(({ taskId }) => tasks.get(taskId)).find(Boolean) ?? null);
       changed = true;
@@ -245,7 +266,7 @@ async function escalateRegressions(plan: Plan, nodeId: string, member: TaskDetai
     const state = prerequisiteState(prerequisite, required);
     if (state.state === "satisfied") continue;
     const now = prerequisite ? `status ${prerequisite.status}, stage ${prerequisite.deliverableStage ?? "none"}${state.state === "unreachable" ? `, ${state.reason}` : ""}` : "missing";
-    notifyPlan(plan, `T${member.id} prerequisite regressed`, `Plan ${plan.id}, node ${nodeId} (T${member.id}) was dispatched on T${id} reaching ${required}, which no longer holds (${now}). The run continues; check whether its work is still valid, or cancel the node.`, `plan:${plan.id}:prereq:T${id}:regressed`, { kind: "plan.prerequisite-unreachable", planId: plan.id, nodeId, taskId: member.id, prerequisiteTaskId: id, reason: "regressed", requiredStage: required, nextActions: ["check-run", "cancel-node", "wait-for-recovery"] });
+    await notifyPlan(plan, `T${member.id} prerequisite regressed`, `Plan ${plan.id}, node ${nodeId} (T${member.id}) was dispatched on T${id} reaching ${required}, which no longer holds (${now}). The run continues; check whether its work is still valid, or cancel the node.`, `plan:${plan.id}:prereq:T${id}:regressed`, { kind: "plan.prerequisite-unreachable", planId: plan.id, nodeId, taskId: member.id, prerequisiteTaskId: id, reason: "regressed", requiredStage: required, nextActions: ["check-run", "cancel-node", "wait-for-recovery"] });
   }
 }
 
@@ -279,7 +300,7 @@ async function launch(plan: Plan, slot: PlanDispatchSlot): Promise<PlanDispatchS
     const started = await launchWorkflowRun(prepared, { ...(inputs ? { inputs } : {}), ...(pins ? { pins } : {}), requestKey: `plan:${plan.id}:T${task.id}:a${slot.attempt}` }, AUTOPILOT_CTX);
     return (await write<PlanDispatchSlot | undefined>("planDispatch.slot.update", { taskId: slot.taskId, attempt: slot.attempt, runId: String(started.runId), status: String(started.status) })) ?? slot;
   } catch (error) {
-    notifyPlan(plan, `T${slot.taskId} could not start`, `Plan ${plan.id} could not start T${slot.taskId}'s workflow: ${errMessage(error)}. Its slot is free and its dependents wait. Fix the cause, then start its workflow by hand (relay_workflow_start); the plan adopts that run.`, `plan:${plan.id}:launch-failed:T${slot.taskId}:a${slot.attempt}`, { kind: "plan.dispatch-failed", planId: plan.id, taskId: slot.taskId });
+    await notifyPlan(plan, `T${slot.taskId} could not start`, `Plan ${plan.id} could not start T${slot.taskId}'s workflow: ${errMessage(error)}. Its slot is free and its dependents wait. Fix the cause, then start its workflow by hand (relay_workflow_start); the plan adopts that run.`, `plan:${plan.id}:launch-failed:T${slot.taskId}:a${slot.attempt}`, { kind: "plan.dispatch-failed", planId: plan.id, taskId: slot.taskId });
     return (await write<PlanDispatchSlot | undefined>("planDispatch.slot.update", { taskId: slot.taskId, attempt: slot.attempt, status: "launch-failed", error: errMessage(error).slice(0, 2000) })) ?? slot;
   }
 }
@@ -310,7 +331,7 @@ async function driveAudit(sup: Supervisor, plan: Plan): Promise<boolean> {
       const started = await launchWorkflowRun(prepared, { requestKey: `plan:${plan.id}:audit` }, AUTOPILOT_CTX);
       await write("planDispatch.audit.update", { planId: plan.id, runId: String(started.runId), status: String(started.status) });
     } catch (error) {
-      notifyPlan(plan, "audit could not start", `Plan ${plan.id}: every node landed, but its conformance audit (T${audit.taskId}) could not start: ${errMessage(error)}. Start ${PLAN_CONFORMANCE_WORKFLOW} on T${audit.taskId} by hand, or audit and record relay_plan_conformance yourself.`, `plan:${plan.id}:audit-failed`, { kind: "plan.dispatch-failed", planId: plan.id, taskId: audit.taskId });
+      await notifyPlan(plan, "audit could not start", `Plan ${plan.id}: every node landed, but its conformance audit (T${audit.taskId}) could not start: ${errMessage(error)}. Start ${PLAN_CONFORMANCE_WORKFLOW} on T${audit.taskId} by hand, or audit and record relay_plan_conformance yourself.`, `plan:${plan.id}:audit-failed`, { kind: "plan.dispatch-failed", planId: plan.id, taskId: audit.taskId });
       await write("planDispatch.audit.update", { planId: plan.id, status: "launch-failed" });
     }
     return true;
@@ -324,14 +345,14 @@ async function driveAudit(sup: Supervisor, plan: Plan): Promise<boolean> {
     dispatching.delete(plan.id);
     watchPlan(plan.id, new Set());
     const slots = plan.dispatch!.slots.map((slot) => `${slot.nodeId} T${slot.taskId} ${slot.runId ?? "no run"} ${slot.landedSha?.slice(0, 12) ?? ""}`.trim());
-    notifyPlan(plan, "done", [`Plan ${plan.id}${plan.title ? ` "${plan.title}"` : ""} is done: conformance passed on ${audit.mainSha} at version ${plan.version}.`, ...slots, `Audit T${audit.taskId} run ${audit.runId}.`].join("\n"), `plan:${plan.id}:result:v${plan.version}`, { kind: "plan.result", planId: plan.id, planVersion: plan.version, mainSha: audit.mainSha });
+    await notifyPlan(plan, "done", [`Plan ${plan.id}${plan.title ? ` "${plan.title}"` : ""} is done: conformance passed on ${audit.mainSha} at version ${plan.version}.`, ...slots, `Audit T${audit.taskId} run ${audit.runId}.`].join("\n"), `plan:${plan.id}:result:v${plan.version}`, { kind: "plan.result", planId: plan.id, planVersion: plan.version, mainSha: audit.mainSha });
   }
   return true;
 }
 
-function notifyPlan(plan: Plan, subject: string, body: string, idempotencyKey: string, payload: Json): void {
+async function notifyPlan(plan: Plan, subject: string, body: string, idempotencyKey: string, payload: Json): Promise<void> {
   const to = planNoticeTarget(plan);
-  if (to) notifySystemMessage(to, { subject: `Plan ${plan.title ?? plan.id}: ${subject}`, body, idempotencyKey, replyExpected: false, payload });
+  if (to) await notifySystemMessage(to, { subject: `Plan ${plan.title ?? plan.id}: ${subject}`, body, idempotencyKey, replyExpected: false, payload });
 }
 
 // --- serving ---------------------------------------------------------------------------------------