@humwick/server 0.130.1 → 0.130.3

package/src/services/plan-graph.ts

@@ -1,11 +1,14 @@
+import { resolveIssueRefFromStringAsync } from "../db/issue-refs-async";
+import { removeAssociationAsync, associateIssueAsync } from "../db/runtime-tail-async";
+import { deletePlanAsync, createPlanRowAsync } from "../db/plans-async";
 import { hasScope, isRecord } from "@humwick/sdk";
-import { addTaskDependency, createPlanRow, deletePlan, getAgent, getEntry, getPlan, getPlanAsync, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlanNodeScoped, sendMessage, sendMessageWithResultAsync, setPlanArchivedAsync, ValidationError } from "../db";
+import { sendMessageAsync, addTaskDependency, getAgent, getEntry, getPlan, getPlanAsync, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlanNodeScoped, sendMessageWithResultAsync, setPlanArchivedAsync, ValidationError } from "../db";
 // The shared #2520 patch-time source derivation lives beside the writer op body it mirrors;
 // plan-graph op bodies are imported directly (the barrel only re-exports plan-graph-async).
 import { applyPatchStatusSourceDerivation, bindPlanNodeBody } from "../db/plan-graph";
 import { writeTransaction } from "../db/connection";
-import { associateIssue, planNodeIssueEntityId, removeAssociation } from "../db/issue-associations";
-import { resolveIssueRefFromString } from "../db/issue-refs";
+import { planNodeIssueEntityId } from "../db/issue-associations";
+
 import { emitRelayEvent } from "../events";
 import { cleanString, cleanStringArray, optionalEnum } from "../validation";
 import { resolveActorIssueRepo } from "../agent-issue-repo";
@@ -84,67 +87,6 @@ function cleanOwnerRef(value: unknown): PlanOwnerRef | undefined {
   return Object.keys(out).length ? out : undefined;
 }
 
-// #220: a bare `#NNN` issueId ref needs a default repo to resolve against — issue-refs.ts
-// throws without one, contrary to its own error text advertising the bare form as accepted.
-// Resolve it the same way #533 resolves chat `#NNN` linkify: the CALLING agent's own project
-// (cwd → project → issueRepo), falling back to the single global env default. This scopes the
-// default to the actor's actual repo rather than guessing from teamId — agents have no
-// team→project FK; cwd is the only durable link (see agent-issue-repo.ts).
-// Shared with the Task issue-link path (#2214) via resolveActorIssueRepo.
-function cleanRefs(value: unknown, actor: string): PlanNode["refs"] | undefined {
-  if (value === undefined || value === null) return undefined;
-  const ref = cleanRecordRef(value, "refs");
-  if (!ref) return undefined;
-  const out: PlanNode["refs"] = {};
-  const issueId = cleanString(ref.issueId, "refs.issueId", { max: 1000 });
-  if (issueId) {
-    out.issueId = resolveIssueRefFromString({ ref: issueId, defaultRepo: resolveActorIssueRepo(actor) }).id;
-  }
-  // #836: refs.taskId is the live binding seam to a durable Task. Validate it resolves to a
-  // deliverable Task; store the canonical numeric id as a string. Once bound, the node's
-  // label/scopeBlurb/status PROJECT from the Task (see projectPlanOverTasks) — no double-keeping.
-  const taskIdRaw = ref.taskId;
-  const taskIdStr = typeof taskIdRaw === "number" ? String(taskIdRaw) : cleanString(taskIdRaw, "refs.taskId", { max: 240 });
-  if (taskIdStr) {
-    const taskId = parseTaskId(taskIdStr);
-    if (taskId === undefined) throw new ValidationError("refs.taskId must be a positive task id");
-    if (!getTaskDetail(taskId)) throw new ValidationError(`refs.taskId ${taskId} is not a deliverable task`);
-    out.taskId = String(taskId);
-  }
-  // agentId/landingRef remain populated by live binding in later slices (#838); reject here.
-  const unsupported = ["agentId", "landingRef"].filter((key) => cleanString(ref[key], `refs.${key}`, { max: 240 }));
-  if (unsupported.length > 0) throw new ValidationError("agentId/landingRef refs are populated by live binding in a later slice");
-  return Object.keys(out).length ? out : undefined;
-}
-
-function syncPlanNodeIssueAssociation(planId: string, node: PlanNode): void {
-  if (!node.refs?.issueId) return;
-  associateIssue(node.refs.issueId, "plan-node", planNodeIssueEntityId(planId, node.id));
-}
-
-function removePlanNodeIssueAssociation(planId: string, node: PlanNode): void {
-  if (!node.refs?.issueId) return;
-  removeAssociation(node.refs.issueId, "plan-node", planNodeIssueEntityId(planId, node.id));
-}
-
-function syncChangedPlanNodeIssueAssociation(planId: string, before: PlanNode | undefined, after: PlanNode): void {
-  if (before?.refs?.issueId && before.refs.issueId !== after.refs?.issueId) {
-    removeAssociation(before.refs.issueId, "plan-node", planNodeIssueEntityId(planId, before.id));
-  }
-  if (after.refs?.issueId) syncPlanNodeIssueAssociation(planId, after);
-}
-
-function cleanBlackboardRefs(value: unknown, planTeamId?: string): string[] | undefined {
-  const refs = cleanStringArray(value, "node.blackboardRefs", { itemMax: 120, maxItems: 100 });
-  if (!refs?.length) return refs;
-  if (!planTeamId) throw new ValidationError("plan has no team; cannot reference blackboard entries");
-  for (const ref of refs) {
-    const entry = getEntry(ref);
-    if (!entry || entry.teamId !== planTeamId) throw new ValidationError(`blackboard entry not found for plan team: ${ref}`);
-  }
-  return refs;
-}
-
 function cleanStatusSource(value: unknown): PlanNode["statusSource"] {
   const statusSource = optionalEnum(value, "statusSource", ["manual", "bound"] as const, "manual");
   return statusSource;
@@ -181,27 +123,6 @@ function applyBoundStatus(node: PlanNode): PlanNode {
   return { ...node, status: boundStatusForAgent(getAgent(agentId)) ?? "pending" };
 }
 
-function cleanNode(input: PlanNodeInput, actor: string, planTeamId?: string): PlanNode {
-  if (!isRecord(input)) throw new ValidationError("node must be an object");
-  const scopeBlurb = cleanString(input.scopeBlurb, "node.scopeBlurb", { max: 2000 });
-  const ownerRef = cleanOwnerRef(input.ownerRef);
-  const lane = cleanString(input.lane, "node.lane", { max: 120 });
-  const refs = cleanRefs(input.refs, actor);
-  const blackboardRefs = cleanBlackboardRefs(input.blackboardRefs, planTeamId);
-  const statusSource = deriveStatusSource(input.statusSource, input.status, Boolean(refs?.taskId || refs?.issueId));
-  return applyBoundStatus({
-    id: cleanString(input.id, "node.id", { required: true, max: 120 })!,
-    label: cleanString(input.label, "node.label", { required: true, max: PLAN_NODE_LABEL_MAX })!,
-    ...(scopeBlurb ? { scopeBlurb } : {}),
-    ...(ownerRef ? { ownerRef } : {}),
-    ...(lane ? { lane } : {}),
-    status: optionalEnum(input.status, "node.status", PLAN_STATUSES, "pending") as PlanStatus,
-    statusSource,
-    ...(refs ? { refs } : {}),
-    ...(blackboardRefs ? { blackboardRefs } : {}),
-  });
-}
-
 // The aggregate writer owns persisted validation (issue/task/blackboard existence and bound
 // presence).  This companion only validates shape, producing clone-safe command data.
 function cleanNodeForAggregate(input: PlanNodeInput): PlanNode {
@@ -247,14 +168,6 @@ function cleanPatchForAggregate(patch: PlanNodePatch): Partial<PlanNode> {
   return out;
 }
 
-function cleanNodes(value: unknown, actor: string, planTeamId?: string): PlanNode[] {
-  if (value === undefined || value === null) return [];
-  if (!Array.isArray(value)) throw new ValidationError("nodes must be an array");
-  const nodes = value.map((item) => cleanNode(item as PlanNodeInput, actor, planTeamId));
-  assertUnique(nodes.map((node) => node.id), "node id");
-  return nodes;
-}
-
 function cleanEdge(input: unknown): PlanEdge {
   if (!isRecord(input)) throw new ValidationError("edge must be an object");
   return {
@@ -340,19 +253,19 @@ export function emitPlan(type: "plan.created" | "plan.changed" | "plan.deleted",
 
 // #1035: a plan anchors to a messages.thread_id, but a fresh coordinator has no thread yet —
 // forcing it to send a throwaway message just to mint one. When no threadId is supplied, mint the
-// thread server-side by self-threading a lightweight system message (the same sendMessage path the
+// thread server-side by self-threading a lightweight system message (the same sendMessageAsync path the
 // caller would have used). Sent AS the actor when that agent is registered, else the reserved
 // `system` sink, so the mint always passes the sender-registration gate.
-function mintPlanThread(ctx: AuthContext, channel: string | undefined): number {
+async function mintPlanThread(ctx: AuthContext, channel: string | undefined): Promise<number> {
   ensureCanMintThread(ctx);
   const actor = actorId(ctx);
   const sender = getAgent(actor) ? actor : "system";
-  const root = sendMessage({
+  const root = (await sendMessageAsync({
     from: sender,
     to: "system",
     body: "Plan thread root",
     ...(channel ? { channel } : {}),
-  });
+  }));
   return root.threadId ?? root.id;
 }
 
@@ -364,7 +277,7 @@ async function mintPlanThreadAsync(ctx: AuthContext, channel: string | undefined
   return root.threadId ?? root.id;
 }
 
-// #1043: the mint inserts a real message row through the db `sendMessage` path, which normally
+// #1043: the mint inserts a real message row through the db `sendMessageAsync` path, which normally
 // lives behind the `message:send` scope. `plans:write` alone must not be a side-door around it, so
 // gate the mint on `message:send`. Internal `system` principals (empty-scope trusted callers) and
 // full-reach `*` tokens pass through untouched — `hasScope` short-circuits `*`.
@@ -375,78 +288,16 @@ function ensureCanMintThread(ctx: AuthContext): void {
   }
 }
 
-export function createPlan(input: PlanCreateInput, ctx: AuthContext): Plan {
-  const channel = cleanString(input.channel, "channel", { max: 120 });
-  const actor = actorId(ctx);
-  const explicitTeamId = cleanString(input.teamId, "teamId", { max: 120 });
-  const teamId = explicitTeamId ?? (input.teamId === undefined || input.teamId === null ? getAgent(actor)?.teamId : undefined);
-  const nodes = cleanNodes(input.nodes, actor, teamId);
-  const edges = cleanEdges(input.edges);
-  validateEdges(nodes, edges);
-  const title = cleanString(input.title, "title", { max: 240 });
-  const objective = cleanString(input.objective, "objective", { max: 4000 });
-  const acceptance = cleanPlanAcceptance(input.acceptance);
-  // Resolve the thread only AFTER the payload validates (#1043): auto-minting first left an orphan
-  // 'Plan thread root' row behind on every rejected create.
-  const threadId = input.threadId === undefined || input.threadId === null
-    ? mintPlanThread(ctx, channel)
-    : cleanThreadId(input.threadId);
-  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
-  const plan = createPlanRow({
-    threadId,
-    teamId,
-    channel,
-    title,
-    objective,
-    nodes,
-    edges,
-    acceptance,
-    createdBy: actor,
-  });
-  for (const node of plan.nodes) syncPlanNodeIssueAssociation(plan.id, node);
-  emitPlan("plan.created", plan, actor);
-  return plan;
+export async function createPlan(input: PlanCreateInput, ctx: AuthContext): Promise<Plan> {
+  return createPlanAsync(input, ctx);
 }
 
-export function addPlanNode(planId: string, nodeInput: PlanNodeInput, ctx: AuthContext): Plan {
-  const actor = actorId(ctx);
-  // S6 #2079: fence behind the version-CAS; re-derive the node on the freshest snapshot each attempt.
-  let node!: PlanNode;
-  const updated = replacePlanNodeScoped(planId, (plan) => {
-    node = cleanNode(nodeInput, actor, plan.teamId);
-    if (plan.nodes.some((item) => item.id === node.id)) throw new ValidationError(`node ${node.id} already exists`);
-    return { ...plan, nodes: [...plan.nodes, node] };
-  }, actor);
-  syncPlanNodeIssueAssociation(updated.id, node); emitPlan("plan.changed", updated, actor);
-  return updated;
-}
-
-export function updatePlanNode(planId: string, nodeId: string, patch: PlanNodePatch, ctx: AuthContext): Plan {
-  const actor = actorId(ctx);
-  // S6 #2079: re-apply the patch onto the latest node map (by nodeId); a distinct-node edit survives.
-  let existing!: PlanNode; let next!: PlanNode;
-  const updated = replacePlanNodeScoped(planId, (plan) => {
-    const current = plan.nodes.find((node) => node.id === nodeId);
-    if (!current) throw new ValidationError(`node ${nodeId} not found`); existing = current;
-    const statusSource = patch.statusSource !== undefined ? cleanStatusSource(patch.statusSource) : current.statusSource;
-    const base: PlanNode = {
-      ...current,
-      ...(patch.label !== undefined ? { label: cleanString(patch.label, "label", { required: true, max: PLAN_NODE_LABEL_MAX })! } : {}),
-      ...(patch.scopeBlurb !== undefined ? optionalProp("scopeBlurb", cleanString(patch.scopeBlurb, "scopeBlurb", { max: 2000 })) : {}),
-      ...(patch.ownerRef !== undefined ? optionalProp("ownerRef", cleanOwnerRef(patch.ownerRef)) : {}),
-      ...(patch.lane !== undefined ? optionalProp("lane", cleanString(patch.lane, "lane", { max: 120 })) : {}),
-      ...(patch.status !== undefined ? { status: optionalEnum(patch.status, "status", PLAN_STATUSES) as PlanStatus } : {}),
-      ...(patch.refs !== undefined ? optionalProp("refs", cleanRefs(patch.refs, actor)) : {}),
-      ...(patch.blackboardRefs !== undefined ? optionalProp("blackboardRefs", cleanBlackboardRefs(patch.blackboardRefs, plan.teamId)) : {}),
-      statusSource,
-    };
-    // #2520 RESOLUTION — the ONE shared patch-time source derivation (lives beside the writer op
-    // body it mirrors; see applyPatchStatusSourceDerivation in db/plan-graph.ts).
-    next = applyBoundStatus(applyPatchStatusSourceDerivation(patch, current, base));
-    return { ...plan, nodes: plan.nodes.map((node) => node.id === nodeId ? next : node) };
-  }, actor);
-  syncChangedPlanNodeIssueAssociation(updated.id, existing, next); emitPlan("plan.changed", updated, actor);
-  return updated;
+export async function addPlanNode(planId: string, nodeInput: PlanNodeInput, ctx: AuthContext): Promise<Plan> {
+  return addPlanNodeAsync(planId, nodeInput, ctx);
+}
+
+export async function updatePlanNode(planId: string, nodeId: string, patch: PlanNodePatch, ctx: AuthContext): Promise<Plan> {
+  return updatePlanNodeAsync(planId, nodeId, patch, ctx);
 }
 
 function optionalProp<K extends keyof PlanNode>(key: K, value: PlanNode[K] | undefined): Partial<PlanNode> {
@@ -470,72 +321,20 @@ function assertEdgeKeepsAcyclic(plan: Plan, edge: PlanEdge): void {
   validateEdges(projected.nodes, dedupeEdges([...projected.edges, edge]));
 }
 
-export function addPlanEdge(planId: string, edgeInput: unknown, ctx: AuthContext): Plan {
-  const plan = existingPlan(planId);
-  const edge = cleanEdge(edgeInput);
-  assertEdgeKeepsAcyclic(plan, edge);
-  // #836: when BOTH endpoints are Task-bound, the canonical edge store is task_dependencies,
-  // not the plan JSON. Plan edge {from,to} means `to` depends on `from`. The combined-graph
-  // pre-check above already rejected cross-store cycles; the edge surfaces back via projection.
-  const fromTask = boundTaskId(plan, edge.from);
-  const toTask = boundTaskId(plan, edge.to);
-  if (fromTask !== undefined && toTask !== undefined) {
-    addTaskDependency(toTask, fromTask, actorId(ctx));
-    const projected = projectPlanOverTasks(existingPlan(planId));
-    emitPlan("plan.changed", projected, actorId(ctx));
-    return projected;
-  }
-  // S6 #2079: fence behind the version-CAS; re-append + re-check acyclicity on the fresh snapshot.
-  const updated = replacePlanNodeScoped(planId, (fresh) => {
-    assertEdgeKeepsAcyclic(fresh, edge);
-    return { ...fresh, edges: dedupeEdges([...fresh.edges, edge]) };
-  }, actorId(ctx));
-  emitPlan("plan.changed", updated, actorId(ctx)); return updated;
+export async function addPlanEdge(planId: string, edgeInput: unknown, ctx: AuthContext): Promise<Plan> {
+  return addPlanEdgeAsync(planId, edgeInput, ctx);
 }
 
-export function removePlanNode(planId: string, nodeId: string, ctx: AuthContext): Plan {
-  const actor = actorId(ctx);
-  // S6 #2079: fence the removal behind the version-CAS; re-resolve the node on the fresh snapshot.
-  let removed!: PlanNode;
-  const updated = replacePlanNodeScoped(planId, (plan) => {
-    const current = plan.nodes.find((node) => node.id === nodeId);
-    if (!current) throw new ValidationError(`node ${nodeId} not found`); removed = current;
-    return {
-      ...plan,
-      nodes: plan.nodes.filter((node) => node.id !== nodeId),
-      edges: plan.edges.filter((edge) => edge.from !== nodeId && edge.to !== nodeId),
-    };
-  }, actor);
-  removePlanNodeIssueAssociation(updated.id, removed); emitPlan("plan.changed", updated, actor);
-  return updated;
-}
-
-export function removePlanEdge(planId: string, edgeInput: unknown, ctx: AuthContext): Plan {
-  const plan = existingPlan(planId);
-  const edge = cleanEdge(edgeInput);
-  // A bound-pair edge can live in BOTH task_dependencies and the plan JSON, and projection unions
-  // them: clear both stores or the edge reappears (#2877).
-  const fromTask = boundTaskId(plan, edge.from);
-  const toTask = boundTaskId(plan, edge.to);
-  const depRemoved = fromTask !== undefined && toTask !== undefined && removeTaskDependency(toTask, fromTask, actorId(ctx));
-  // S6 #2079: fence behind the version-CAS; re-resolve the edge (and its not-found check) on fresh.
-  const updated = replacePlanNodeScoped(planId, (fresh) => {
-    const edges = fresh.edges.filter((item) => item.from !== edge.from || item.to !== edge.to);
-    if (!depRemoved && edges.length === fresh.edges.length) throw new ValidationError(`edge ${edge.from}->${edge.to} not found`);
-    return { ...fresh, edges };
-  }, actorId(ctx));
-  const projected = projectPlanOverTasks(updated);
-  emitPlan("plan.changed", projected, actorId(ctx));
-  return projected;
-}
-
-export function deletePlanGraph(planId: string, ctx: AuthContext): { id: string; deleted: true } {
-  const plan = existingPlan(planId);
-  const actor = actorId(ctx);
-  deletePlan(plan.id, actor);
-  for (const node of plan.nodes) removePlanNodeIssueAssociation(plan.id, node);
-  emitPlan("plan.deleted", plan, actor);
-  return { id: plan.id, deleted: true };
+export async function removePlanNode(planId: string, nodeId: string, ctx: AuthContext): Promise<Plan> {
+  return (await removePlanNodeAsync(planId, nodeId, ctx)).plan;
+}
+
+export async function removePlanEdge(planId: string, edgeInput: unknown, ctx: AuthContext): Promise<Plan> {
+  return removePlanEdgeAsync(planId, edgeInput, ctx);
+}
+
+export async function deletePlanGraph(planId: string, ctx: AuthContext): Promise<{ id: string; deleted: true }> {
+  return deletePlanGraphAsync(planId, ctx);
 }
 
 export async function archivePlanGraphAsync(planId: string, archived: boolean, ctx: AuthContext): Promise<Plan> {
@@ -547,29 +346,12 @@ export async function archivePlanGraphAsync(planId: string, archived: boolean, c
 
 // In-process (legacy/unit-test) sibling of the gateway-backed applyBoundOwnersAsync path (production
 // never takes this branch). S6 #2079: fence each write behind the version-CAS; re-derive on fresh.
-export function updateBoundPlanNodesForAgent(agentId: string, status: PlanStatus, actor = "server"): Plan[] {
-  const boundFlip = (node: PlanNode): boolean =>
-    node.statusSource === "bound" && node.ownerRef?.agentId === agentId && node.status !== "landed" && node.status !== status;
-  const updated: Plan[] = [];
-  for (const plan of listPlansWithBoundOwner(agentId)) {
-    // Skip-no-op on the initial snapshot: don't even fence a write when there's nothing to flip.
-    if (!plan.nodes.some(boundFlip)) continue;
-    // Preserve that contract THROUGH a CAS-conflict retry: if a re-read snapshot no longer needs a
-    // flip (a concurrent writer already applied it), return null so no version bump / event fires.
-    let wrote = false;
-    const next = replacePlanNodeScoped(plan.id, (fresh) => {
-      wrote = fresh.nodes.some(boundFlip);
-      return wrote ? { ...fresh, nodes: fresh.nodes.map((node) => (boundFlip(node) ? { ...node, status } : node)) } : null;
-    }, actor);
-    if (!wrote) continue; // the retry resolved to a no-op — nothing was written, so don't emit/collect
-    emitPlan("plan.changed", next, actor); updated.push(next);
-  }
-  return updated;
+export async function updateBoundPlanNodesForAgent(agentId: string, status: PlanStatus, actor = "server"): Promise<Plan[]> {
+  return updateBoundPlanNodesForAgentAsync(agentId, status, actor);
 }
 
-export function updateBoundPlanNodesFromAgent(agentId: string, actor = "server"): Plan[] {
-  const status = boundStatusForAgent(getAgent(agentId));
-  return status ? updateBoundPlanNodesForAgent(agentId, status, actor) : [];
+export async function updateBoundPlanNodesFromAgent(agentId: string, actor = "server"): Promise<Plan[]> {
+  return updateBoundPlanNodesFromAgentAsync(agentId, boundStatusForAgent(getAgent(agentId)), actor);
 }
 
 /** Gateway-only live-binding path. The read precheck avoids submitting a no-op writer job. */
@@ -581,7 +363,7 @@ export async function updateBoundPlanNodesForAgentAsync(agentId: string, status:
 }
 
 export async function updateBoundPlanNodesFromAgentAsync(agentId: string, status: PlanStatus | undefined, actor = "server"): Promise<Plan[]> {
-  return status ? updateBoundPlanNodesForAgentAsync(agentId, status, actor) : [];
+  return status ? (await updateBoundPlanNodesForAgentAsync(agentId, status, actor)) : [];
 }
 
 // #836: `view: "tasks"` returns the pure task-backed DAG synthesized from a team's deliverable
@@ -623,12 +405,8 @@ export interface BindPlanNodeInput {
   taskId?: number;
 }
 
-export function bindPlanNodeToTask(planId: string, nodeId: string, input: BindPlanNodeInput, ctx: AuthContext): { plan: Plan; taskId: number } {
-  const actor = actorId(ctx);
-  const result = writeTransaction(() => bindPlanNodeBody({ planId, nodeId, taskId: input.taskId, actor }, Date.now()));
-  emitPlan("plan.changed", result.plan, actor);
-  emitPlanTaskEvents(result.taskEvents);
-  return { plan: result.plan, taskId: result.taskId! };
+export async function bindPlanNodeToTask(planId: string, nodeId: string, input: BindPlanNodeInput, ctx: AuthContext): Promise<{ plan: Plan; taskId: number }> {
+  return bindPlanNodeToTaskAsync(planId, nodeId, input, ctx);
 }
 
 // HTTP and MCP can await. Keep the synchronous entry points above for the event reducers and
@@ -698,6 +476,6 @@ export async function bindPlanNodeToTaskAsync(planId: string, nodeId: string, in
   // The aggregate ack is after COMMIT. Emit every consumer-facing task intent only here,
   // never from the worker, so failed aggregate writes are observably silent.
   emitPlan("plan.changed", result.plan, actor);
-  emitPlanTaskEvents(result.taskEvents);
+  await emitPlanTaskEvents(result.taskEvents);
   return { plan: result.plan, taskId: result.taskId! };
 }

package/src/services/plan-import.ts

@@ -60,7 +60,7 @@ export async function importPlan(input: Record<string, unknown>, ctx: AuthContex
   const { dryRun, ...args } = preparePlanImport(input, ctx);
   if (dryRun) return await getGateway().read("planGraph.import.preview", args) as unknown as PlanImportResult;
   const result = await getGateway().write("planGraph.import", args) as unknown as PlanImportWriteResult;
-  emitPlanTaskEvents(result.taskEvents);
+  await emitPlanTaskEvents(result.taskEvents);
   if (result.plan) emitPlan(args.expectedVersion === 0 ? "plan.created" : "plan.changed", result.plan, args.actor);
   return result.receipt;
 }

package/src/services/plan-live-bindings.ts

@@ -1,8 +1,9 @@
-import { getTeam, getTeamAsync } from "../db";
-import { getGateway } from "../db/gateway";
+import { updateBoundPlanNodesFromAgentAsync, updateBoundPlanNodesForAgentAsync } from "./plan-graph";
+import { getTeamAsync } from "../db";
+import { trackRelayEvent } from "../relay-event-drain";
 import { subscribeRelayEvents, type RelayEvent } from "../events";
 import { routeNotification } from "../notification-router";
-import { updateBoundPlanNodesForAgent, updateBoundPlanNodesForAgentAsync, updateBoundPlanNodesFromAgent, updateBoundPlanNodesFromAgentAsync } from "./plan-graph";
+
 
 let unsubscribe: (() => void) | undefined;
 
@@ -48,7 +49,7 @@ async function notifyBoundExit(event: RelayEvent, updatedPlans: Awaited<ReturnTy
     const target = team?.coordinatorId ?? `team:${plan.teamId}`;
     const blockedNodes = plan.nodes.filter((node) => node.statusSource === "bound" && node.ownerRef?.agentId === agentId && node.status === "blocked");
     if (blockedNodes.length === 0) continue;
-    routeNotification({
+    await routeNotification({
       type: "plan.bound_agent_exited",
       scope: { agentId, planId: plan.id, teamId: plan.teamId },
       recipients: [target],
@@ -92,39 +93,9 @@ async function handlePlanBindingEventAsync(event: RelayEvent): Promise<void> {
 }
 
 function handlePlanBindingEvent(event: RelayEvent): void {
-  // The in-process backend exists only for legacy/unit tests. Keep its old synchronous reducer
-  // contract so these tests do not accidentally test scheduling; worker-backed production never
-  // takes this branch and has no event-loop SQLite access.
-  if (getGateway().stats.backend === "in-process") {
-    if (event.type === "agent.status") {
-      const agentId = agentIdFromEvent(event);
-      if (agentId) updateBoundPlanNodesFromAgent(agentId, event.source || "server");
-      return;
-    }
-    if (event.type === "branch.landed") {
-      const agentId = stringField(event.data.author);
-      if (agentId) updateBoundPlanNodesForAgent(agentId, "landed", event.source || "server");
-      return;
-    }
-    if (event.type === "agent.exited") {
-      const agentId = agentIdFromEvent(event);
-      if (!agentId || isGracefulExitReason(stringField(event.data.reason))) return;
-      const updated = updateBoundPlanNodesForAgent(agentId, "blocked", event.source || "server");
-      const reason = stringField(event.data.reason);
-      for (const plan of updated) {
-        if (!plan.teamId) continue;
-        const team = getTeam(plan.teamId);
-        const nodes = plan.nodes.filter((node) => node.statusSource === "bound" && node.ownerRef?.agentId === agentId && node.status === "blocked");
-        if (nodes.length) routeNotification({ type: "plan.bound_agent_exited", scope: { agentId, planId: plan.id, teamId: plan.teamId }, recipients: [team?.coordinatorId ?? `team:${plan.teamId}`], message: { subject: "Bound plan node blocked", body: `Agent \`${agentId}\` exited${reason ? ` (${reason})` : ""}; blocked plan node(s) ${nodes.map((node) => `\`${node.id}\``).join(", ")} in \`${plan.id}\`.`, payload: { kind: "plan.bound_agent_exited", planId: plan.id, agentId, nodeIds: nodes.map((node) => node.id), reason }, replyExpected: false } });
-      }
-      return;
-    }
-  }
-  // Event listeners are synchronous. Serialize the asynchronous aggregate submissions so an
-  // agent's rapid status sequence reaches the FIFO writer in event order.
-  pending = pending.then(() => handlePlanBindingEventAsync(event)).catch((error) => {
-    console.error("plan live binding update failed", error);
-  });
+  const run = pending.then(() => handlePlanBindingEventAsync(event));
+  pending = run.catch(() => {});
+  trackRelayEvent(run, "plan.live-binding");
 }
 
 export function startPlanLiveBindings(): void {

package/src/services/plan-task-create.ts

@@ -72,7 +72,7 @@ export async function createPlanTaskAsync(input: CreateTaskEntityInput, extras:
   };
   // The caller's key makes a retry return the first result instead of a second Task or node.
   const result = await getGateway().write("planGraph.task.create", args, { idempotencyKey: options.idempotencyKey ?? randomUUID() }) as unknown as CreatePlanTaskResult;
-  emitPlanTaskEvents(result.taskEvents);
+  await emitPlanTaskEvents(result.taskEvents);
   if (result.plan) emitPlan("plan.changed", result.plan, createdBy);
   // A replay returns the first write's result; the receipt reads the Task as it is now.
   const task = await getTaskDetailAsync(result.task.id) ?? result.task;

package/src/services/plan-terminal-refs.ts

@@ -68,16 +68,6 @@ export async function advanceTerminalPlanRefsAsync(trigger: TerminalRefTrigger):
  * (replacePlanNodeScoped), and a residual failure degrades to warn-and-continue exactly like the
  * async twin — a propagation failure must never fail the durable status/stage write.
  */
-export function advanceTerminalPlanRefs(trigger: TerminalRefTrigger): Plan[] {
-  const { taskIds, issueRefIds, actor } = normalize(trigger);
-  if (taskIds.length === 0 && issueRefIds.length === 0) return [];
-  try {
-    const results = applyTerminalPlanRefsBody({ taskIds, issueRefIds, actor }, Date.now());
-    const plans = results.map((result) => result.plan);
-    emitChanged(plans, actor);
-    return plans;
-  } catch (error) {
-    console.warn(`plan-terminal-refs propagation failed (${trigger.taskId !== undefined ? `task ${trigger.taskId}` : trigger.issueRefId !== undefined ? `issue ${trigger.issueRefId}` : "trigger"}): ${errMessage(error)}`);
-    return [];
-  }
+export async function advanceTerminalPlanRefs(trigger: TerminalRefTrigger): Promise<Plan[]> {
+  return advanceTerminalPlanRefsAsync(trigger);
 }

package/src/services/plan-wake-digest.ts

@@ -11,7 +11,7 @@ export const PLAN_WAKE_DIGEST_MAX_BYTES = 1024;
 const INTRO = "Open team Plans: keep plans current and drive acceptance; relay_decision only when really blocked. In-progress age = plan update age.";
 const MORE = "More plans/nodes: relay_plan_list; relay_plan_get mode=resume.";
 
-function compactText(value: string, maxBytes: number): string {
+export function compactText(value: string, maxBytes: number): string {
   const text = value.slice(0, maxBytes).replace(/\s+/g, " ").trim();
   if (Buffer.byteLength(value) <= maxBytes) return text;
   let result = "";
@@ -42,9 +42,14 @@ function refsDone(node: PlanNode): boolean {
   return true;
 }
 
-function planLine(stored: Plan, now: number): string {
+/** The one node classification both the wake digest and the ready-node notice read (#3660). */
+export function liveFrontier(stored: Plan) {
   const plan = projectPlanOverTasks(stored);
-  const frontier = planResumeFrontier(plan);
+  return { plan, frontier: planResumeFrontier(plan) };
+}
+
+function planLine(stored: Plan, now: number): string {
+  const { plan, frontier } = liveFrontier(stored);
   const parts: string[] = [];
   if (frontier.ready.length) parts.push(`ready: ${nodeList(frontier.ready)}`);
   if (frontier.inProgress.length) {
@@ -70,6 +75,7 @@ export function renderPlanWakeDigest(agentId: string, now = Date.now()): string
     do {
       const page = listPlansByTeam(teamId, { limit: 8, cursor });
       for (const summary of page.plans) {
+        if (!summary.nodeCount) continue;
         const plan = getPlan(summary.id);
         if (!plan) continue;
         const line = planLine(plan, now);

package/src/services/profile-trust.ts

@@ -1,7 +1,8 @@
 // #3636 — project trust edits without the dashboard: set a profile's review mode, acknowledge its
 // project hooks/MCP, approve an observed value. One seam for the HTTP routes and the MCP tool.
 import { ValidationError, type AgentProfile, type ProfileProjectReviewMode } from "@humwick/sdk";
-import { getAgentProfile, setAgentProfile, validateAgentProfile } from "../config-store";
+import { getAgentProfile, validateAgentProfile } from "../config-store";
+import { setAgentProfileAsync } from "../config-store-write";
 import type { ConfigEntry } from "../types";
 import type { ProjectTrustApproval, ProjectTrustCapability } from "../db/project-trust-approvals";
 import { approveProjectCapabilityReview, projectCellsHash } from "../project-trust";
@@ -38,17 +39,17 @@ export function withProjectTrust(profile: AgentProfile, update: ProjectTrustUpda
   return validated;
 }
 
-export function updateProfileProjectTrust(name: string, update: ProjectTrustUpdate, by: string): ConfigEntry<AgentProfile> {
+export async function updateProfileProjectTrustAsync(name: string, update: ProjectTrustUpdate, by: string): Promise<ConfigEntry<AgentProfile>> {
   if (!update.review && !update.ack?.length) throw new ValidationError("nothing to update: pass review and/or ack");
-  const saved = setAgentProfile(withProjectTrust(existingProfile(name).value, update, by), by, { overrideBuiltIn: true });
+  const saved = await setAgentProfileAsync(withProjectTrust(existingProfile(name).value, update, by), by, { overrideBuiltIn: true });
   emitConfigChanged(saved.namespace, saved.key, saved.version);
   return saved;
 }
 
 /** Approve an observed `sha256:…` (fingerprint) or `commit:…` value; the mode follows the prefix. */
-export function approveProfileProjectTrust(input: { name: string; capability: ProjectTrustCapability; repoKey: string; value: string; by: string }): ProjectTrustApproval {
+export async function approveProfileProjectTrust(input: { name: string; capability: ProjectTrustCapability; repoKey: string; value: string; by: string }): Promise<ProjectTrustApproval> {
   const profileName = existingProfile(input.name).value.name;
   const mode = input.value.startsWith("commit:") ? "commit" : input.value.startsWith("sha256:") ? "fingerprint" : undefined;
   if (!mode) throw new ValidationError(`approved value must start with "sha256:" or "commit:", as shown in the refusal`);
-  return approveProjectCapabilityReview({ profileName, repoKey: input.repoKey, capability: input.capability, mode, approvedValue: input.value, approvedBy: input.by });
+  return (await approveProjectCapabilityReview({ profileName, repoKey: input.repoKey, capability: input.capability, mode, approvedValue: input.value, approvedBy: input.by }));
 }

package/src/services/project-config-read.ts

@@ -0,0 +1,70 @@
+// #3635/#3736 — one reader for `.agent-relay/*.json` project config (areas.json, spawn-policy.json): the
+// file at the checkout's default branch (origin/<default>, fetched first), read on the checkout's host
+// through the #3043 project-files reader. Never a working tree and never cached, so a stale checkout or
+// an old negative answer cannot hide a file that landed.
+import { readProjectFiles } from "@humwick/sdk";
+import type { ConfigAtCommit } from "@humwick/sdk/repo-config-file";
+import { errMessage } from "@humwick/sdk";
+import { rootsForProject } from "../db";
+import { localProjectGit, readHostProjectFiles } from "../project-roles";
+import { hostIsRelayHost } from "../relay-host-locality";
+import { resolveProjectFilesHost } from "./spawn-project-role";
+
+/** A checkout to read from: a cwd on a host (a hostname or a registered orchestrator). */
+export interface ProjectCheckout {
+  cwd: string;
+  host?: string;
+  orchestratorId?: string;
+}
+
+export type ConfigLookup<T> = ConfigAtCommit<T> | { status: "unreadable"; error: string };
+
+type Snapshot = { ref: string; sha: string; files: Record<string, string | null> };
+
+const warned = new Set<string>();
+
+/** One warning per distinct problem, so a broken file does not flood the log on every read. */
+export function warnConfigOnce(key: string, message: string): void {
+  if (warned.has(key)) return;
+  if (warned.size >= 1000) warned.clear();
+  warned.add(key);
+  console.warn(message);
+}
+
+/** `file` at the checkout's default branch; a read failure is `unreadable`, never a throw. Invalid and
+ *  unreadable outcomes warn once, naming `file`, the checkout and why, with `consequence` appended. */
+export async function readProjectConfig<T>(checkout: ProjectCheckout, file: string, parse: (snapshot: Snapshot) => ConfigAtCommit<T>, consequence: string): Promise<ConfigLookup<T>> {
+  const where = `${checkout.orchestratorId ?? checkout.host ?? "local"}:${checkout.cwd}`;
+  try {
+    const snapshot = !checkout.orchestratorId && hostIsRelayHost(checkout.host)
+      ? await readProjectFiles({ paths: [file] }, localProjectGit(checkout.cwd))
+      : await readHostProjectFiles(
+        resolveProjectFilesHost({ subject: file, cwd: checkout.cwd, orchestratorId: checkout.orchestratorId, preferHost: checkout.host }),
+        checkout.cwd, { paths: [file] }, file,
+      );
+    const lookup = parse(snapshot);
+    if (lookup.status === "invalid") warnConfigOnce(`${file}@${where}@${lookup.sha}`, `[project-config] ${file} for ${where} at ${lookup.sha.slice(0, 12)} is invalid: ${lookup.error}; ${consequence}`);
+    return lookup;
+  } catch (err) {
+    const error = errMessage(err);
+    warnConfigOnce(`${file}@${where}`, `[project-config] ${file} for ${where}: unreadable: ${error}; ${consequence}`);
+    return { status: "unreadable", error };
+  }
+}
+
+/** The first checkout that can be read answers: the preferred ones, then each registered root of the project. */
+export async function readProjectConfigFirst<T>(
+  projectId: string | undefined, preferred: readonly ProjectCheckout[], file: string, parse: (snapshot: Snapshot) => ConfigAtCommit<T>, consequence: string,
+): Promise<{ lookup?: ConfigAtCommit<T>; failures: string[] }> {
+  const checkouts: ProjectCheckout[] = [
+    ...preferred,
+    ...(projectId ? rootsForProject(projectId).map((root) => ({ cwd: root.rootPath, ...(root.orchestratorId ? { orchestratorId: root.orchestratorId } : {}) })) : []),
+  ];
+  const failures: string[] = [];
+  for (const checkout of checkouts) {
+    const lookup = await readProjectConfig(checkout, file, parse, consequence);
+    if (lookup.status !== "unreadable") return { lookup, failures };
+    failures.push(lookup.error);
+  }
+  return { failures };
+}