@humwick/server 0.130.1 → 0.130.3

package/src/services/team.ts

@@ -1,7 +1,11 @@
+import { TeamAuthError, TeamNotFoundError, type TeamClaimMode } from "../db/team-claim-policy";
+import type { claimAuthorizedTeam } from "../db/team-claim-policy";
+import { getGateway } from "../db/gateway";
+import { ensureTeamAsync, setTeamBriefAsync } from "../db/teams-async";
 import { hasScope } from "@humwick/sdk/types";
 import { errMessage } from "@humwick/sdk";
 import { MAX_TEAM_ROSTER_ENTRIES, STALE_TTL_MS } from "../config";
-import { claimTeamWithAdoption, countLiveTeamMembers, dissolveTeam, ensureTeam, getAgent, getPlanByTeam, getTaskDetail, getTeam, getTeamBusyState, getTeamMemberStats, getTeamRoster, isClaimableTeam, setTeamBrief } from "../db";
+import { claimTeamWithAdoption, countLiveTeamMembers, dissolveTeamAsync, ensureTeam, getAgent, getPlanByTeam, getTaskDetail, getTeam, getTeamBusyState, getTeamMemberStats, getTeamRoster, isClaimableTeam, setTeamBrief } from "../db";
 import { emitTaskChanged } from "../sse";
 import { emitRelayEvent } from "../events";
 import { listIssueRefsForEntity } from "./issue-associations";
@@ -12,8 +16,7 @@ import { flushQueuedDirectMessages } from "./managed-running";
 import { projectIdForAgent, seatTeamIdForProject } from "../db/team-project";
 import { AGENT_SYSTEM_TAGS, hasAgentSystemTag } from "../agent-system-tags";
 
-export class TeamAuthError extends Error {}
-export class TeamNotFoundError extends Error {}
+export { TeamAuthError, TeamNotFoundError } from "../db/team-claim-policy";
 
 /** #1304 — what a bounded team payload actually carried vs. how many members the team has, so a
  * truncated roster is visible (not a silent "these are all the members") to the caller. */
@@ -112,71 +115,19 @@ function payloadForAgent(agentId: string, channel?: string): TeamPayload {
   };
 }
 
-function lineageRootForAgent(agentId: string): string | undefined {
-  let current = getAgent(agentId);
-  const seen = new Set<string>();
-  while (current) {
-    if (seen.has(current.id)) return undefined;
-    seen.add(current.id);
-    if (!current.spawnedBy) return current.id;
-    current = getAgent(current.spawnedBy);
-  }
-  return undefined;
-}
-
-function coordinatorIsLive(team: Team): boolean {
-  if (!team.coordinatorId) return false;
-  const coordinator = getAgent(team.coordinatorId);
-  if (!coordinator || coordinator.status === "offline") return false;
-  if (coordinator.teamId === team.id) return countLiveTeamMembers(team.id, Date.now() - STALE_TTL_MS) > 0;
-  return coordinator.lastSeen > Date.now() - STALE_TTL_MS;
-}
-
-/** How a claim was authorized — carried into the audit trail so an orphan takeover is
- * distinguishable from a routine same-lineage reclaim. */
-export type TeamClaimMode = "admin" | "same-lineage" | "orphan-takeover";
-
-/**
- * Authorize a team claim and classify HOW it is authorized. The security boundary is
- * `coordinatorIsLive`: a LIVE owner's team is NEVER claimable by a peer — only the team's own
- * lineage (or an admin) may reclaim it. A cross-lineage caller may take over ONLY when the owning
- * coordinator is offline/stale past STALE_TTL_MS (#1454 orphan takeover, recovering a coordinator
- * lost to a host crash / OOM / process death). The `teams:write` scope gate on `relay_team_claim`
- * already restricts every path here to coordinator-class tokens (worker tokens have `teams:write`
- * stripped at mint), so no extra role check is needed.
- */
-function assertCanClaimTeam(admin: boolean, team: Team, callerAgentId: string): TeamClaimMode {
-  const caller = getAgent(callerAgentId);
-  const callerTeam = caller?.teamId ? getTeam(caller.teamId) : null;
-  if (!admin && callerTeam?.parentTeamId && team.id !== callerTeam.id) {
-    throw new TeamAuthError("a sub-coordinator may claim only its own private team");
-  }
-  const callerRoot = lineageRootForAgent(callerAgentId);
-  const teamRoot = team.rootCoordinatorId ?? team.coordinatorId;
-  // Same-lineage reclaim is the routine fast path (a replacement spawned under the original
-  // founder) and stays allowed regardless of owner liveness.
-  if (callerRoot && teamRoot && callerRoot === teamRoot) return "same-lineage";
-  if (admin) return "admin";
-  // #1454 orphan takeover: a replacement coordinator of a DIFFERENT lineage may adopt the team only
-  // when its owning coordinator is not live (offline, or stale past the heartbeat TTL). This is the
-  // sole security boundary for the cross-lineage path — a healthy owner is never displaced.
-  if (!coordinatorIsLive(team)) return "orphan-takeover";
-  throw new TeamAuthError(`caller ${callerAgentId} cannot claim team ${team.id}`);
-}
-
 export function getCallerTeam(ctx: AuthContext, channel?: string): TeamPayload {
   return payloadForAgent(requireCallerAgentId(ctx), channel);
 }
 
-export function setCallerTeamBrief(ctx: AuthContext, input: TeamBriefInput): TeamPayload {
+export async function setCallerTeamBrief(ctx: AuthContext, input: TeamBriefInput): Promise<TeamPayload> {
   const agentId = requireCallerAgentId(ctx);
-  const team = acquireCoordinatorTeam(agentId);
-  setTeamBrief({ teamId: team.id, ...input });
+  const team = (await acquireCoordinatorTeam(agentId));
+  await setTeamBriefAsync({ teamId: team.id, ...input });
   return payloadForAgent(agentId);
 }
 
-export function claimTeamForCaller(ctx: AuthContext, teamId: string, reason?: string): TeamPayload {
-  const claimed = claimTeamAs(requireCallerAgentId(ctx), teamId, hasScope(ctx.scopes, "system:admin"), reason);
+export async function claimTeamForCaller(ctx: AuthContext, teamId: string, reason?: string): Promise<TeamPayload> {
+  const claimed = (await claimTeamAs(requireCallerAgentId(ctx), teamId, hasScope(ctx.scopes, "system:admin"), reason));
   return {
     team: claimed,
     ...boundedTeamRoster(claimed.id, Date.now() - STALE_TTL_MS),
@@ -187,34 +138,16 @@ export function claimTeamForCaller(ctx: AuthContext, teamId: string, reason?: st
   };
 }
 
-function claimTeamAs(agentId: string, teamId: string, admin: boolean, reason?: string): Team {
-  // Pre-check for a precise not-found error before taking the write lock; the AUTHORITATIVE active +
-  // authorization check runs under the lock inside claimTeamWithAdoption (below), closing the claim TOCTOU.
-  // #2561 — an auto-reaped team (its coordinator died and its members went quiet) stays claimable;
-  // the claim re-activates it. An explicitly dissolved team does not.
-  const pre = getTeam(teamId);
-  if (!isClaimableTeam(pre)) throw new TeamNotFoundError(`active team ${teamId} not found`);
-  // #1454 — authorize against the team as re-read UNDER claimTeamWithAdoption's write lock, so a racing claim
-  // that already committed is visible to assertCanClaimTeam (a healthy new owner denies the loser).
-  // The mode + prior coordinator captured here come from that same locked snapshot, so the audit
-  // trail matches exactly what the compare-and-swap acted on.
-  let captured: { mode: TeamClaimMode; priorCoordinatorId: string | null } | undefined;
-  const { team: claimed, revived, adoptedTaskIds } = claimTeamWithAdoption(teamId, agentId, (lockedTeam) => {
-    captured = {
-      mode: assertCanClaimTeam(admin, lockedTeam, agentId),
-      priorCoordinatorId: lockedTeam.coordinatorId ?? null,
-    };
-  });
-  // claimTeamWithAdoption always invokes the callback before committing (or throws before returning), so this is
-  // populated on every success.
-  afterTeamClaimed(agentId, claimed, { ...captured!, revived, adoptedTaskIds, reason });
-  return claimed;
+async function claimTeamAs(agentId: string, teamId: string, admin: boolean, reason?: string): Promise<Team> {
+  const result = await getGateway().write("teams.claimAuthorized", { teamId, agentId, admin }) as unknown as ReturnType<typeof claimAuthorizedTeam>;
+  await afterTeamClaimed(agentId, result.team, { ...result, reason });
+  return result.team;
 }
 
 /** The one post-claim seam for relay_team_claim and seat acquisition: unread mail, audit, Task feeds. */
-function afterTeamClaimed(agentId: string, claimed: Team, claim: { mode: TeamClaimMode; priorCoordinatorId: string | null; revived: boolean; adoptedTaskIds: number[]; reason?: string }): void {
+async function afterTeamClaimed(agentId: string, claimed: Team, claim: { mode: TeamClaimMode; priorCoordinatorId: string | null; revived: boolean; adoptedTaskIds: number[]; reason?: string }): Promise<void> {
   const { mode, priorCoordinatorId, revived, adoptedTaskIds, reason } = claim;
-  flushQueuedDirectMessages(agentId);
+  (await flushQueuedDirectMessages(agentId));
   // Audit every ownership CHANGE (#1454) — an orphan takeover is the failover-recovery signal, but a
   // cross-lineage admin claim is equally worth a trail. A no-op reclaim (same owner) emits nothing.
   if (priorCoordinatorId !== agentId) {
@@ -245,48 +178,48 @@ function afterTeamClaimed(agentId: string, claimed: Team, claim: { mode: TeamCla
 /** #3107 — a coordinator-profile agent in project P founds P's stable seat team, or claims it under the
  * #1454 rule (same lineage, or the holder is offline). A refused claim yields a side team discovery never
  * lists; it takes the seat only by an explicit relay_team_claim. Sync, on the main thread. */
-export function acquireCoordinatorTeam(agentId: string): Team {
+export async function acquireCoordinatorTeam(agentId: string): Promise<Team> {
   const agent = getAgent(agentId);
   const current = agent?.teamId ? getTeam(agent.teamId) : null;
   if (current?.status === "active") return current;
   const projectId = agent && hasAgentSystemTag(agent, AGENT_SYSTEM_TAGS.coordinator) ? projectIdForAgent(agent) : null;
-  if (!projectId) return ensureTeam(agentId);
+  if (!projectId) return await ensureTeamAsync(agentId);
   const seatId = seatTeamIdForProject(projectId);
-  if (seatId) return claimSeatOrSideTeam(agentId, seatId);
+  if (seatId) return (await claimSeatOrSideTeam(agentId, seatId));
   try {
-    return ensureTeam(agentId, { projectId });
+    return await ensureTeamAsync(agentId, { projectId });
   } catch (e) {
     // A racing founder took the seat between the read and the insert: claim behind it, once.
     const winner = e instanceof Error && e.message.includes("teams.project_id") ? seatTeamIdForProject(projectId) : null;
     if (!winner) throw e;
-    return claimSeatOrSideTeam(agentId, winner);
+    return (await claimSeatOrSideTeam(agentId, winner));
   }
 }
 
-function claimSeatOrSideTeam(agentId: string, seatId: string): Team {
+async function claimSeatOrSideTeam(agentId: string, seatId: string): Promise<Team> {
   try {
-    return claimTeamAs(agentId, seatId, false, "coordinator seat acquisition");
+    return (await claimTeamAs(agentId, seatId, false, "coordinator seat acquisition"));
   } catch (e) {
     if (!(e instanceof TeamAuthError)) throw e;
-    return ensureTeam(agentId);
+    return await ensureTeamAsync(agentId);
   }
 }
 
 /** #3107 — a coordinator takes its project's seat at its ready transition, before queued mail flushes,
  * so a fresh replacement owns the topic before its first spawn. A restart keeps its team: no-op. */
-export function acquireTeamOnReady(agentId: string): void {
+export async function acquireTeamOnReady(agentId: string): Promise<void> {
   const agent = getAgent(agentId);
   if (!agent || !hasAgentSystemTag(agent, AGENT_SYSTEM_TAGS.coordinator)) return;
   if (agent.teamId && getTeam(agent.teamId)?.status === "active") return;
   try {
-    acquireCoordinatorTeam(agentId);
+    (await acquireCoordinatorTeam(agentId));
   } catch (e) {
     console.warn(`[teams] seat acquisition for ${agentId} failed: ${errMessage(e)}`);
   }
 }
 
-export function dissolveTeamById(teamId: string, input: TeamDissolveServiceInput = {}): Team {
-  const { team, unpromotedBlackboard } = dissolveTeam(teamId, input);
+export async function dissolveTeamById(teamId: string, input: TeamDissolveServiceInput = {}): Promise<Team> {
+  const { team, unpromotedBlackboard } = await dissolveTeamAsync(teamId, input);
   emitRelayEvent({
     type: "team.dissolved",
     source: "system",
@@ -304,11 +237,11 @@ export function dissolveTeamById(teamId: string, input: TeamDissolveServiceInput
   return team;
 }
 
-export function dissolveCallerTeam(ctx: AuthContext, input: TeamDissolveServiceInput): TeamPayload {
+export async function dissolveCallerTeam(ctx: AuthContext, input: TeamDissolveServiceInput): Promise<TeamPayload> {
   const agentId = requireCallerAgentId(ctx);
   const agent = getAgent(agentId);
   if (!agent?.teamId) throw new TeamNotFoundError("caller has no team");
-  const team = dissolveTeamById(agent.teamId, input);
+  const team = await dissolveTeamById(agent.teamId, input);
   return {
     team,
     ...boundedTeamRoster(team.id, Date.now() - STALE_TTL_MS),

package/src/services/terminal-provider-exit.ts

@@ -1,3 +1,4 @@
+import { clearAgentMetaKeysAsync } from "../db/agents-async";
 import { agentPrincipalSink } from "../db/agent-ownership";
 // #633 — owning service for the silent clean-exit terminal event. A runner whose provider
 // terminally exits stays alive (manual-resume hold), so neither the orchestrator tmux-gone path nor
@@ -6,7 +7,7 @@ import { agentPrincipalSink } from "../db/agent-ownership";
 // clears the hold when the provider genuinely resumes. Kept out of the bus transport so the
 // transport stays thin (transport-thinness ratchet, #348).
 import { isRecord } from "@humwick/sdk";
-import { clearAgentMetaKeys } from "../db";
+
 import { notifyAgentOffline } from "../agent-lifecycle-events";
 import { diagnoseAgentDeath } from "../agent-death-diagnosis";
 import { routeNotification } from "../notification-router";
@@ -20,9 +21,9 @@ import type { AgentCard } from "../types";
  *   a death diagnosis (also persisted as a crash report inside notifyAgentOffline). No-op for
  *   non-spawned agents (notifyAgentOffline guards on lineage) and graceful shutdowns (no marker).
  */
-export function reconcileTerminalProviderExit(agentId: string, before: AgentCard | null | undefined, after: AgentCard | null | undefined): void {
+export async function reconcileTerminalProviderExit(agentId: string, before: AgentCard | null | undefined, after: AgentCard | null | undefined): Promise<void> {
   if (after && after.status !== "offline" && before?.status === "offline" && isRecord(after.meta?.terminalProviderExit)) {
-    clearAgentMetaKeys(agentId, ["terminalProviderExit"]);
+    (await clearAgentMetaKeysAsync(agentId, ["terminalProviderExit"]));
     return;
   }
   if (!after || after.status !== "offline") return;
@@ -32,9 +33,9 @@ export function reconcileTerminalProviderExit(agentId: string, before: AgentCard
   const reasonText = typeof marker.reason === "string" ? marker.reason : "provider exited";
   const reason = `provider exited (${reasonText})`;
   const diagnosis = diagnoseAgentDeath({ agent: after, reason });
-  notifyAgentOffline(agentId, reason, diagnosis);
+  (await notifyAgentOffline(agentId, reason, diagnosis));
   if (!after.spawnedBy && reasonText.startsWith("self-resume-")) {
-    routeNotification({
+    await routeNotification({
       type: "agent.exited",
       scope: { agentId },
       recipients: [agentPrincipalSink(agentId)],

package/src/services/timer-message-fire-chaos-worker.ts

@@ -1,4 +1,5 @@
 import { initDb } from "../db";
+import { getGateway } from "../db/gateway";
 import { runDueScheduledTimers, type RunDueScheduledTimersFaults } from "./scheduler";
 
 const [dbPath, boundary, rawNow] = process.argv.slice(2);
@@ -17,9 +18,12 @@ const faults: RunDueScheduledTimersFaults = {};
 if (boundary === "after-claim") faults.afterClaim = (timer) => {
   if (!timer.command) kill();
 };
-if (boundary === "after-authority") faults.afterAuthorityCasAndFireInsert = kill;
-if (boundary === "after-projection") faults.afterLegacyProjectionUpdate = kill;
-if (boundary === "before-commit") faults.beforeCommit = kill;
+const writerBoundary = ({
+  "after-authority": "afterAuthorityCasAndFireInsert",
+  "after-projection": "afterLegacyProjectionUpdate",
+  "before-commit": "beforeCommit",
+} as Record<string, string>)[boundary];
+if (writerBoundary) await getGateway().write("seam.armFault", { name: `timers.decideFire.${writerBoundary}`, action: "kill" });
 if (boundary === "after-commit") faults.afterCommit = kill;
 if (boundary === "after-send") faults.afterSendBeforeSent = kill;
 

package/src/services/timer-message-fire-outbox.ts

@@ -147,7 +147,7 @@ export async function drainTimerMessageFireOutbox(
       // Durable-timer fire-send proceeds on the FROZEN captured identity even when the original
       // sender agent has deregistered — the outbox row already carries that identity. The relaxation
       // is scoped to THIS path only; normal live sends keep the registration guard (#362 boundary).
-      const sent = send(payload.input, authContextOf(payload), { allowUnregisteredSender: true });
+      const sent = await send(payload.input, authContextOf(payload), { allowUnregisteredSender: true });
       options.afterSendBeforeSent?.(row, sent.message.id);
       await markTimerMessageFireSentAsync(row.timerId, row.run, sent.message.id);
       await clearTimerMessageFireSendFailureAsync(row.timerId, row.run);

package/src/services/transient-agent-reaper.ts

@@ -1,9 +1,12 @@
+import { recordTerminalEventAsync } from "../db/lifecycle-tail-async";
+import { createActivityEventAsync } from "../db/activity-async";
+import { createCommandAsync } from "../commands-write";
 import { relayEnv } from "@humwick/sdk/env";
 import { notifyAgentExit } from "../agent-lifecycle-events";
 import { errMessage } from "@humwick/sdk";
-import { createCommand } from "../commands-db";
+
 import { emitRelayEvent } from "../events";
-import { agentsWithPendingOwnRelayRun, createActivityEvent, createActivityEventAsync, getAgent, hasArtifactCreatedBy, listAgents, listFinalResponseCaptureMessages, listWorkspaces, onBeforeAgentStatusTransition, recordTerminalEvent, workflowRunIdOf } from "../db";
+import { agentsWithPendingOwnRelayRun, getAgent, hasArtifactCreatedBy, listAgents, listFinalResponseCaptureMessages, listWorkspaces, onBeforeAgentStatusTransition, workflowRunIdOf } from "../db";
 import { routeNotification } from "../notification-router";
 import { isProviderBlocked } from "../provider-state";
 import { TERMINAL_WORKSPACE_STATUSES } from "../workspace-phase";
@@ -15,6 +18,7 @@ import { activeAgentKeep } from "./agent-keep";
 import { automaticDisposalBlocker } from "./automatic-disposal";
 import { agentGenerationKey } from "../db/agent-shutdown-in-flight";
 import { workflowAgentObligation } from "./workflow-agent-obligation";
+import { workflowRunPaused } from "../db/workflow-task-read-ops";
 import type { AgentCard, Command, WorkspaceRecord } from "../types";
 import { emitCommandEvent } from "../command-events";
 
@@ -36,25 +40,25 @@ export interface TransientShutdownOptions {
   now?: number;
 }
 
-export function requestTransientAgentShutdown(agent: AgentCard, opts: TransientShutdownOptions): Command {
+export async function requestTransientAgentShutdown(agent: AgentCard, opts: TransientShutdownOptions): Promise<Command> {
   const now = opts.now ?? Date.now();
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "agent.shutdown",
     source: "system",
     target: agent.id,
     params: { action: "shutdown", agentId: agent.id, agentGeneration: agentGenerationKey(agent), graceful: true, timeoutMs: 10_000, reason: opts.reason, requestedBy: opts.requestedBy, requestedAt: now },
-  });
+  }));
   emitCommandEvent(command, "command.requested");
   // #1084 — reaping a transient agent always follows a verified-complete land/idle-grace check
   // (the caller only reaches here once `land.complete`/gates-passed holds), so it is a genuine
   // teardown completion signal: close its work window, forwarding only the held final group.
-  markAgentWorkFinal(agent.id, "edge-fallback");
+  (await markAgentWorkFinal(agent.id, "edge-fallback"));
   // #645 — persist a clean terminal marker so the #634 heartbeat-gap watchdog reads this benign
   // completion as a terminus (not a silent death) once the reaped worker stops heartbeating.
-  recordTerminalEvent({ agentId: agent.id, reason: opts.reason, kind: "agent.exited", epoch: agent.epoch, createdAt: now });
+  (await recordTerminalEventAsync({ agentId: agent.id, reason: opts.reason, kind: "agent.exited", epoch: agent.epoch, createdAt: now }));
   // #1912 §4 retained: callers need the created command synchronously to preserve teardown
   // ordering; an async activity-only hop here would sever that command/audit contract.
-  createActivityEvent({
+  (await createActivityEventAsync({
     clientId: `transient-agent-reaped-${agent.id}-${now}`,
     kind: "state",
     title: opts.activityTitle,
@@ -64,8 +68,8 @@ export function requestTransientAgentShutdown(agent: AgentCard, opts: TransientS
     view: "agents",
     agentId: agent.id,
     metadata: { source: "server", maintenanceJobId: opts.requestedBy, commandId: command.id, reason: opts.reason, workspaceId: opts.workspaceId, landReason: opts.landReason },
-  });
-  notifyAgentExit(agent, opts.reason, undefined, { workspaceId: opts.workspaceId, workspaceStatus: opts.workspaceStatus });
+  }));
+  (await notifyAgentExit(agent, opts.reason, undefined, { workspaceId: opts.workspaceId, workspaceStatus: opts.workspaceStatus }));
   return command;
 }
 
@@ -94,9 +98,9 @@ const persistentIdleTracker = new Map<string, { firstIdleAt: number; lastFlushed
 // #1333 — the reaper owns the observed-idle settle clock, but its next poll is too late to close
 // the old window: capture B from the new turn can already displace final A in the held ring. Flush
 // synchronously inside the actual idle→busy mutation, before that write returns and B is accepted.
-onBeforeAgentStatusTransition((agent, nextStatus) => {
+onBeforeAgentStatusTransition(async (agent, nextStatus) => {
   if (agent.status !== "idle" || nextStatus !== "busy" || !persistentIdleTracker.has(agent.id)) return;
-  markAgentWorkFinal(agent.id, "edge-fallback");
+  (await markAgentWorkFinal(agent.id, "edge-fallback"));
   persistentIdleTracker.delete(agent.id);
 });
 
@@ -245,7 +249,7 @@ async function notifyTransientHeld(agentId: string, workspaceId: string | undefi
   // the live card, never from the pre-await snapshot used only to describe this hold event.
   const parent = getAgent(agentId)?.spawnedBy;
   if (parent) {
-    routeNotification({
+    await routeNotification({
       type: "agent.transient_land_hold",
       scope: { agentId, parent, workspaceId },
       recipients: [parent],
@@ -315,7 +319,7 @@ export async function reapTransientAgents(context: { signal?: AbortSignal } = {}
       const persistentIdleForMs = now - persistentEntry.firstIdleAt;
       if (persistentIdleForMs < persistentGrace || persistentEntry.lastFlushedAt) continue;
       persistentEntry.lastFlushedAt = now;
-      markAgentWorkFinal(agent.id, "edge-fallback");
+      (await markAgentWorkFinal(agent.id, "edge-fallback"));
       persistentFinalsFlushed.push(agent.id);
       continue;
     }
@@ -339,7 +343,7 @@ export async function reapTransientAgents(context: { signal?: AbortSignal } = {}
         // A graceful runner shutdown flushes its session outbox immediately before it reports
         // offline. That final capture can therefore arrive after the initial reap closed the
         // work window; close it once more at the terminal edge before dropping the tracker (#1139).
-        markAgentWorkFinal(agent.id, "edge-fallback");
+        (await markAgentWorkFinal(agent.id, "edge-fallback"));
         if (priorEntry.workspaceId) {
           const reconciled = await reconcileReapedWorkspace(priorEntry.workspaceId);
           if (!reconciled) continue;                              // retain tracker → retry next scan
@@ -356,7 +360,8 @@ export async function reapTransientAgents(context: { signal?: AbortSignal } = {}
     if (completedProviderTurns(agent) === 0) { transientTracker.delete(agent.id); waiting.push(agent.id); continue; }
     // #3234 — an empty branch is not completion while the workflow still awaits this agent's delivery.
     const runId = workflowRunIdOf(agent);
-    if (runId && await workflowAgentObligation(runId, agent.id)) { transientTracker.delete(agent.id); waiting.push(agent.id); continue; }
+    // #3757 — a paused run keeps all its step agents.
+    if (runId && (workflowRunPaused(runId) || await workflowAgentObligation(runId, agent.id))) { transientTracker.delete(agent.id); waiting.push(agent.id); continue; }
     const entry = transientTracker.get(agent.id) ?? { firstIdleAt: now };
     transientTracker.set(agent.id, entry);
     const idleForMs = now - entry.firstIdleAt;
@@ -377,7 +382,7 @@ export async function reapTransientAgents(context: { signal?: AbortSignal } = {}
           // #2124 — a worker stuck at held-pending-land (wedged workspace) hits none of the other
           // finality anchors (workspace-ready, task->done, teardown-reap). Close its work window here,
           // once, so its turn-final report isn't stranded in the ring for the duration of the hold.
-          markAgentWorkFinal(agent.id, "edge-fallback");
+          (await markAgentWorkFinal(agent.id, "edge-fallback"));
         }
       } else waiting.push(agent.id);
       continue;
@@ -385,7 +390,7 @@ export async function reapTransientAgents(context: { signal?: AbortSignal } = {}
     if (entry.lastReapAt) continue;
     entry.lastReapAt = now;
     entry.workspaceId = land.workspaceId;
-    requestTransientAgentShutdown(agent, {
+    (await requestTransientAgentShutdown(agent, {
       reason: "transient-complete",
       requestedBy: "transient-agent-reaper",
       workspaceId: land.workspaceId,
@@ -394,11 +399,11 @@ export async function reapTransientAgents(context: { signal?: AbortSignal } = {}
       activityBody: "Agent idle grace elapsed and transient work is complete; shutdown requested",
       landReason: land.reason,
       now,
-    });
+    }));
     // #889 — finalize any bound task whose doneWhen is "agent-exit" (auto-scaffolded ephemeral
     // tasks that produce no deliverable and would otherwise hang in_progress forever).
     const spawnRequestId = typeof agent.meta?.spawnRequestId === "string" ? agent.meta.spawnRequestId : undefined;
-    finalizeEphemeralTasksOnReap(agent.id, { spawnRequestId, reason: "transient-complete", producedWork: land.producedWork, evidence: land.reason });
+    await finalizeEphemeralTasksOnReap(agent.id, { spawnRequestId, reason: "transient-complete", producedWork: land.producedWork, evidence: land.reason });
     reaped.push(agent.id);
   }
   // #1819 — only sweep on a COMPLETE pass. An abort truncates `seen`/`seenPersistent`, and dropping a

package/src/services/turn-reconcile-audit.ts

@@ -38,11 +38,11 @@ function describeAge(ageMs: number | undefined): string {
  * ("idle at its prompt now") is precisely what live work contradicts. Operator-reported false
  * positive, 2026-09-27 (`dogfood-first-ship`), cost: a coordinator re-sending the work.
  */
-export function auditReconciledProviderTurn(
+export async function auditReconciledProviderTurn(
   agentId: string,
   after: AgentCard | null | undefined,
   timelineEvent: ProviderTimelineEvent | null,
-): void {
+): Promise<void> {
   if (!timelineEvent || timelineEvent.status !== RECONCILED_TURN_TIMELINE_STATUS) return;
   const metadata = timelineEvent.metadata ?? {};
   if (metadata.source !== "runner") return;
@@ -51,7 +51,7 @@ export function auditReconciledProviderTurn(
   const reason = stringValue(metadata.reconcileReason);
   const label = after?.label ?? after?.name ?? agentId;
   try {
-    routeNotification({
+    await routeNotification({
       type: "agent.turn_interrupted",
       scope: { agentId, parent: after?.spawnedBy, teamId: after?.teamId },
       message: {
@@ -86,12 +86,12 @@ export function auditReconciledProviderTurn(
  * No liveness verdict means there is no stall evidence; the activity row still records the hold.
  * Transport heartbeats alone do not count as provider progress.
  */
-export function auditProviderTurnWatchdog(
+export async function auditProviderTurnWatchdog(
   agentId: string,
   after: AgentCard | null | undefined,
   timelineEvent: ProviderTimelineEvent | null,
   now?: number,
-): void {
+): Promise<void> {
   if (!timelineEvent || timelineEvent.status !== PROVIDER_TURN_WATCHDOG_TIMELINE_STATUS) return;
   const metadata = timelineEvent.metadata ?? {};
   if (metadata.source !== "runner") return;
@@ -114,7 +114,7 @@ export function auditProviderTurnWatchdog(
   const reason = stringValue(metadata.watchdogReason);
   const label = after?.label ?? after?.name ?? agentId;
   try {
-    routeNotification({
+    await routeNotification({
       type: "agent.turn_watchdog",
       scope: { agentId, parent: after?.spawnedBy, teamId: after?.teamId },
       message: {
@@ -175,11 +175,11 @@ export function auditProviderTurnWatchdog(
  * one here, and only `EmptyTurnLedger.escalateOnTimeout` deferring to "retry" on tracked live work can
  * tell them apart — see `answers()`.
  */
-export function auditProviderTurnEmpty(
+export async function auditProviderTurnEmpty(
   agentId: string,
   after: AgentCard | null | undefined,
   timelineEvent: ProviderTimelineEvent | null,
-): void {
+): Promise<void> {
   if (!timelineEvent || timelineEvent.status !== PROVIDER_TURN_EMPTY_TIMELINE_STATUS) return;
   const metadata = timelineEvent.metadata ?? {};
   if (metadata.source !== "runner") return;
@@ -199,7 +199,7 @@ export function auditProviderTurnEmpty(
   const stalled = stringValue(metadata.emptyKind) === "input-stalled";
   const label = after?.label ?? after?.name ?? agentId;
   try {
-    routeNotification({
+    await routeNotification({
       type: "agent.turn_empty",
       scope: { agentId, parent: after?.spawnedBy, teamId: after?.teamId },
       message: {

package/src/services/user-onboarding.ts

@@ -1,7 +1,9 @@
+import { createUserInviteAsync, acceptUserInviteAsync } from "../db/user-invites-async";
+import { updateUserAccessAsync, setUserSecretAsync } from "../db/runtime-tail-async";
 // User onboarding (#3567 D2): the invites flag, invite acceptance and password setup. The admin
 // sets their own password with the admin token, then invites users with single-use links.
 import { DEFAULT_USER_ID, userSinkId, type User, type UserRole, type UserStatus } from "@humwick/sdk";
-import { ValidationError, acceptUserInvite, reassignAgentOwnershipAsync, createUserInvite, getAgent, getUser, listAuthIdentitiesForUser, setUserSecret, updateUserAccess, type UserInvite } from "../db";
+import { ValidationError, reassignAgentOwnershipAsync, getAgent, getUser, listAuthIdentitiesForUser, type UserInvite } from "../db";
 import { liveTokenJtisForSub } from "../token-db";
 import { revokeTokenAsync } from "../token-db-write";
 import { getConfig } from "../config-store";
@@ -32,8 +34,8 @@ function cleanPassword(raw: unknown): string {
 }
 
 /** Create a single-use invite; the plaintext code is returned once and never stored. */
-export function createInvite(input: { role: UserRole; displayName?: string; createdBy: string }): { invite: UserInvite; code: string } {
-  return createUserInvite(input);
+export async function createInvite(input: { role: UserRole; displayName?: string; createdBy: string }): Promise<{ invite: UserInvite; code: string }> {
+  return (await createUserInviteAsync(input));
 }
 
 /** Accept an invite: hash the password, then create the user and their login in one write. */
@@ -41,7 +43,7 @@ export async function acceptInvite(input: { code: unknown; handle: unknown; pass
   if (typeof input.code !== "string" || !input.code) throw new ValidationError("code required");
   const handle = cleanHandle(input.handle);
   const secretHash = await hashPassword(cleanPassword(input.password));
-  return acceptUserInvite({ code: input.code, userId: handle, handle, displayName: input.displayName, provider: PASSWORD_PROVIDER_ID, secretHash });
+  return (await acceptUserInviteAsync({ code: input.code, userId: handle, handle, displayName: input.displayName, provider: PASSWORD_PROVIDER_ID, secretHash }));
 }
 
 /** True once the user has a password login (the dashboard offers "Set your password" until then). */
@@ -62,7 +64,7 @@ export async function setPassword(input: { userId: string; password: unknown; cu
     const current = typeof input.currentPassword === "string" ? input.currentPassword : "";
     if (!(await verifyPassword(current, existing.secretHash))) throw new ValidationError("current password is wrong");
   }
-  setUserSecret({ userId: user.id, provider: PASSWORD_PROVIDER_ID, providerSubject: user.handle, secretHash: await hashPassword(password) });
+  (await setUserSecretAsync({ userId: user.id, provider: PASSWORD_PROVIDER_ID, providerSubject: user.handle, secretHash: await hashPassword(password) }));
 }
 
 /**
@@ -74,7 +76,7 @@ export async function changeUserAccess(input: { actorUserId: string; userId: str
   if (input.userId === input.actorUserId) throw new ValidationError("you cannot change your own role or status; ask another admin");
   const before = getUser(input.userId);
   if (!before) throw new ValidationError("user not found");
-  const user = updateUserAccess({ id: input.userId, role: input.role, status: input.status });
+  const user = (await updateUserAccessAsync({ id: input.userId, role: input.role, status: input.status }));
   if (user.role !== before.role || user.status !== before.status) await revokeUserSessions(user.id);
   return user;
 }

package/src/services/user-profile.ts

@@ -1,16 +1,13 @@
-import {
-  deleteArtifactLinksForEntityAsync,
-  linkArtifactAsync,
-  updateUserProfile,
-} from "../db";
+import { updateUserProfileAsync } from "../db/runtime-tail-async";
+import { deleteArtifactLinksForEntityAsync, linkArtifactAsync } from "../db";
 import { normalizeDigest } from "../artifact-storage";
 import { storeArtifactWithReference } from "./artifact-write";
 import { bytesToStream } from "../http-body";
 import { emitRelayEvent } from "../events";
 import type { Artifact, User } from "../types";
 
-export function updateUserDisplayName(input: { userId: string; displayName: string }): User {
-  const user = updateUserProfile({ id: input.userId, displayName: input.displayName });
+export async function updateUserDisplayName(input: { userId: string; displayName: string }): Promise<User> {
+  const user = (await updateUserProfileAsync({ id: input.userId, displayName: input.displayName }));
   emitRelayEvent({ type: "user.updated", source: "server", subject: user.id, data: { user } });
   return user;
 }
@@ -44,14 +41,14 @@ export async function storeUserAvatar(input: {
     title: input.filename ?? "avatar",
     createdBy: input.actor,
   });
-  const user = updateUserProfile({ id: input.userId, avatarArtifactId: artifact.id });
+  const user = (await updateUserProfileAsync({ id: input.userId, avatarArtifactId: artifact.id }));
   emitRelayEvent({ type: "user.avatar.updated", source: "server", subject: user.id, data: { user, artifact } });
   return { user, artifact };
 }
 
 export async function removeUserAvatar(input: { userId: string }): Promise<User> {
   await deleteArtifactLinksForEntityAsync("user", input.userId);
-  const user = updateUserProfile({ id: input.userId, avatarArtifactId: null });
+  const user = (await updateUserProfileAsync({ id: input.userId, avatarArtifactId: null }));
   emitRelayEvent({ type: "user.avatar.removed", source: "server", subject: user.id, data: { user } });
   return user;
 }

package/src/services/work-finality.ts

@@ -1,3 +1,5 @@
+import { getGateway } from "../db/gateway";
+import { takeDeferredLineageReports, restoreDeferredLineageReports } from "../db/deferred-lineage-reports";
 // #1084 (Part D of #1079) — the work-window finality service. A "work-final" is a RELAY-LEVEL
 // mark anchored to explicit completion signals the platform already owns: `relay_workspace_ready`
 // (src/mcp/tools-workspace.ts), a task's execution status reaching `done` (src/services/task-entity.ts),
@@ -12,22 +14,32 @@
 // the original already-rendered session captures as `message.finalized` (so a bubble the dashboard
 // showed as ordinary mid-turn narration can be retroactively upgraded once its window closes).
 import type { MessageWorkFinalitySource } from "@humwick/sdk";
-import { flushWorkFinalReports, type WorkFinalFlushResult } from "../db/messages.ts";
+import { applyLineageReportEffects, type WorkFinalFlushResult } from "../db/messages.ts";
 import { emitMessageFinalized, emitNewMessages } from "../sse.ts";
 
-export function markAgentWorkFinal(
+export async function markAgentWorkFinal(
   agentId: string | undefined | null,
   source: MessageWorkFinalitySource,
   options: { includeStaleCompletedFinals?: boolean } = {},
-): WorkFinalFlushResult {
+): Promise<WorkFinalFlushResult> {
   if (!agentId) return { forwarded: [], finalizedOriginals: [] };
-  const result = flushWorkFinalReports(agentId, source, options);
+  const queues = takeDeferredLineageReports([agentId]);
+  const queue = queues[agentId];
+  if (!queue?.length) return { forwarded: [], finalizedOriginals: [] };
+  let result: WorkFinalFlushResult;
+  try {
+    result = await getGateway().write("messages.flushWorkFinal", { agentId, queue, source, options }) as unknown as WorkFinalFlushResult;
+  } catch (error) {
+    restoreDeferredLineageReports(queues);
+    throw error;
+  }
   emitWorkFinalityResult(result);
   return result;
 }
 
 /** Publish finality only after its synchronous or gateway-routed DB mutation commits. */
 export function emitWorkFinalityResult(result: WorkFinalFlushResult): void {
+  for (const report of result.forwarded) applyLineageReportEffects(report);
   const created = result.forwarded.filter((entry) => entry.created).map((entry) => entry.message);
   if (created.length > 0) emitNewMessages(created);
   for (const original of result.finalizedOriginals) emitMessageFinalized(original);