@humwick/server 0.130.2 → 0.130.3

package/src/db/history-retention-ops.ts

@@ -0,0 +1,13 @@
+import { pruneKernelReplayResults } from "@humwick/kernel/sqlite-kernel-persistence";
+import { getDb } from "./connection";
+import { pruneTerminalCommands } from "./command-retention";
+import { pruneTokenUsage } from "./token-usage-retention";
+import type { WriterOpSpec } from "./write-ops";
+
+// One gateway call is one small transaction; never drain a backlog inside the writer job (#3619).
+const BATCH = 25;
+export const HISTORY_RETENTION_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = {
+  "historyRetention.kernel": { offLoop: true, idempotent: true, fn: (_args, ctx) => pruneKernelReplayResults(getDb(), ctx.now, BATCH) },
+  "historyRetention.tokens": { offLoop: true, idempotent: true, fn: (_args, ctx) => pruneTokenUsage(ctx.now - 90 * 24 * 60 * 60_000, BATCH) },
+  "historyRetention.commands": { offLoop: true, idempotent: true, fn: (_args, ctx) => pruneTerminalCommands(ctx.now - 30 * 24 * 60 * 60_000, 1_000, ctx.now - 60 * 60_000) },
+};

package/src/db/inbox-async.ts

@@ -9,8 +9,8 @@ import type {
   setInboxThreadState,
 } from "./inbox.ts";
 
-export function getInboxStateAsync(operatorId: string): Promise<ReturnType<typeof getInboxState>> {
-  return getGateway().read("inbox.state", { operatorId }) as unknown as Promise<ReturnType<typeof getInboxState>>;
+export function getInboxStateAsync(operatorId: string, options: { excludeOffline?: boolean } = {}): Promise<ReturnType<typeof getInboxState>> {
+  return getGateway().read("inbox.state", { operatorId, ...(options.excludeOffline ? { excludeOffline: true } : {}) }) as unknown as Promise<ReturnType<typeof getInboxState>>;
 }
 export function listChatHistoryImportsAsync(input: Parameters<typeof listChatHistoryImports>[0] = {}): Promise<ReturnType<typeof listChatHistoryImports>> {
   return getGateway().read("inbox.historyImports", input) as unknown as Promise<ReturnType<typeof listChatHistoryImports>>;

package/src/db/inbox-read-ops.ts

@@ -3,6 +3,6 @@
 import { getInboxState, listChatHistoryImports } from "./inbox.ts";
 
 export const INBOX_READ_OPS = {
-  "inbox.state": (args: { operatorId: string }) => getInboxState(args.operatorId),
+  "inbox.state": (args: { operatorId: string; excludeOffline?: boolean }) => getInboxState(args.operatorId, { excludeOffline: args.excludeOffline }),
   "inbox.historyImports": (args: Parameters<typeof listChatHistoryImports>[0]) => listChatHistoryImports(args),
 };

package/src/db/inbox.ts

@@ -10,12 +10,18 @@ import type {
   InboxThreadState,
 } from "../types";
 
-export function getInboxState(operatorId: string): InboxState {
+/**
+ * #2410 — `excludeOffline` (opt-in, the #2396 contract) keeps only peers whose agent is registered
+ * and not offline: the dashboard's "Show offline" switch hides every other thread, and the table
+ * accrues a row per agent id ever chatted with, so the full read is mostly long-dead peers.
+ */
+export function getInboxState(operatorId: string, options: { excludeOffline?: boolean } = {}): InboxState {
+  const live = options.excludeOffline ? " AND peer_id IN (SELECT id FROM agents WHERE status <> 'offline')" : "";
   const threads = (getDb().query(
-    "SELECT * FROM inbox_thread_state WHERE operator_id = ? ORDER BY updated_at DESC",
+    `SELECT * FROM inbox_thread_state WHERE operator_id = ?${live} ORDER BY updated_at DESC`,
   ).all(operatorId) as any[]).map(rowToInboxThreadState);
   const drafts = (getDb().query(
-    "SELECT * FROM inbox_drafts WHERE operator_id = ? ORDER BY updated_at DESC",
+    `SELECT * FROM inbox_drafts WHERE operator_id = ?${live} ORDER BY updated_at DESC`,
   ).all(operatorId) as any[]).map(rowToInboxDraft);
   return { operatorId, threads, drafts };
 }

package/src/db/issue-associations.ts

@@ -40,13 +40,13 @@ function cleanText(value: string | undefined, field: string, max: number): strin
   return cleaned;
 }
 
-export function associateIssue(issueRefId: string, entityType: IssueAssociationEntityType, entityId: string, relation?: IssueRefRelation): IssueAssociation {
+export function associateIssue(issueRefId: string, entityType: IssueAssociationEntityType, entityId: string, relation?: IssueRefRelation, submittedAt: number = Date.now()): IssueAssociation {
   const cleanedIssueRefId = cleanText(issueRefId, "issueRefId", 120);
   if (!getIssueRef(cleanedIssueRefId)) throw new ValidationError(`issue ref ${cleanedIssueRefId} not found`);
   const cleanedEntityType = cleanEntityType(entityType);
   const cleanedEntityId = cleanText(entityId, "entityId", 240);
   const cleanedRelation = optionalEnum(relation, "relation", ISSUE_REF_RELATIONS);
-  const now = Date.now();
+  const now = submittedAt;
   getDb().query(`
     INSERT INTO issue_associations (issue_ref_id, entity_type, entity_id, created_at, relation)
     VALUES (?, ?, ?, ?, ?)

package/src/db/issue-refs-async.ts

@@ -3,11 +3,14 @@ import { randomUUID } from "node:crypto";
 import { getGateway } from "./gateway.ts";
 import type { IssueRef } from "../types";
 import type { IssueTrackerIssueSummary } from "../issue-tracker/adapter";
-import type { ResolveIssueRefByExternalKeyInput, ResolveIssueRefFromStringInput, UpdateIssueRefInput, UpsertIssueRefInput } from "./issue-refs.ts";
+import type { ListIssueRefsOptions, ResolveIssueRefByExternalKeyInput, ResolveIssueRefFromStringInput, UpdateIssueRefInput, UpsertIssueRefInput } from "./issue-refs.ts";
 import type { IssueLifecycleActionRecord, UpsertIssueLifecycleActionInput } from "./issue-lifecycle.ts";
 
 const write = <T>(op: string, args: unknown, opts?: { idempotencyKey?: string }) => getGateway().write(op, args as never, opts) as unknown as Promise<T>;
 
+const read = <T>(op: string, args: unknown = {}) => getGateway().read(op as never, args as never) as unknown as Promise<T>;
+
+export const listIssueRefsAsync = (opts: ListIssueRefsOptions = {}) => read<IssueRef[]>("issueRefs.list", opts);
 export const upsertIssueRefAsync = (input: UpsertIssueRefInput) => write<IssueRef>("issueRefs.upsert", input);
 export const resolveIssueRefByExternalKeyAsync = (input: ResolveIssueRefByExternalKeyInput) => write<IssueRef>("issueRefs.resolveExternalKey", input);
 export const resolveIssueRefFromStringAsync = (input: ResolveIssueRefFromStringInput) => write<IssueRef>("issueRefs.resolveFromString", input);

package/src/db/issue-refs-read-ops.ts

@@ -0,0 +1,6 @@
+// #3799 — the issue-ref listing on the reader pool (it ran as a cold main-thread scan, 10 s on swap-bound I/O).
+import { listIssueRefs, type ListIssueRefsOptions } from "./issue-refs.ts";
+
+export const ISSUE_REFS_READ_OPS = {
+  "issueRefs.list": (args: ListIssueRefsOptions) => listIssueRefs(args),
+};

package/src/db/issue-refs.ts

@@ -252,7 +252,8 @@ export function resolveIssueRefFromString(input: ResolveIssueRefFromStringInput,
   }, now);
 }
 
-export function listIssueRefs(opts: ListIssueRefsOptions = {}): IssueRef[] {
+/** Listing SQL, exported so the query-plan gate pins the production statement (#3799). */
+export function buildListIssueRefsQuery(opts: ListIssueRefsOptions = {}): { sql: string; params: Array<string | number> } {
   const conditions: string[] = [];
   const params: Array<string | number> = [];
   if (opts.provider) {
@@ -271,13 +272,12 @@ export function listIssueRefs(opts: ListIssueRefsOptions = {}): IssueRef[] {
   if (!Number.isSafeInteger(limit) || limit <= 0 || limit > 500) throw new ValidationError("limit must be between 1 and 500");
   params.push(limit);
   const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
-  const rows = getDb().query(`
-    SELECT * FROM issue_refs
-    ${where}
-    ORDER BY updated_at DESC, created_at DESC, id DESC
-    LIMIT ?
-  `).all(...params) as IssueRefRow[];
-  return rows.map(rowToIssueRef);
+  return { sql: `SELECT * FROM issue_refs ${where} ORDER BY updated_at DESC, created_at DESC, id DESC LIMIT ?`, params };
+}
+
+export function listIssueRefs(opts: ListIssueRefsOptions = {}): IssueRef[] {
+  const { sql, params } = buildListIssueRefsQuery(opts);
+  return (getDb().query(sql).all(...params) as IssueRefRow[]).map(rowToIssueRef);
 }
 
 export function updateIssueRef(id: string, input: UpdateIssueRefInput, now: number = Date.now()): IssueRef | null {

package/src/db/kernel-event-log-schema.ts

@@ -1,4 +1,5 @@
 import { ensureEventLogSchema } from "@humwick/kernel/event-log";
+import { ensureKernelReplayRetentionSchema } from "@humwick/kernel/sqlite-kernel-persistence";
 import { getDb } from "./connection.ts";
 
 /**
@@ -11,4 +12,5 @@ import { getDb } from "./connection.ts";
  */
 export function ensureKernelEventLogSchema(): void {
   ensureEventLogSchema(getDb());
+  ensureKernelReplayRetentionSchema(getDb(), Date.now());
 }

package/src/db/land-boundaries.ts

@@ -1,7 +1,8 @@
 // #3363 — reads of the Kernel landing boundary and incident entities (kernel/landing-incident.ts) for
 // the red-main controller. Writes go through the Kernel ops (src/services/red-main-incident.ts).
 import type { LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
-import type { ShippingRedMain } from "@humwick/sdk";
+import { ciRunUrl, type ShippingFailingTest, type ShippingRedMain } from "@humwick/sdk";
+import type { BaseKnownFailure } from "@humwick/sdk/base-known-failures";
 import { getDb } from "./connection.ts";
 import { LAND_INCIDENT_TABLE, OPEN_INCIDENT_STATES } from "./land-incident-eligibility.ts";
 
@@ -81,12 +82,57 @@ export function openRedMainIncidentForRemote(remote: string): RedMainIncident |
   return row ? incident(row) : null;
 }
 
-/** The Shipping page's "lane stopped" lines: each open incident with its red sha. */
-export function openRedMainLines(): ShippingRedMain[] {
+type OpenIncidentRow = Record<string, unknown> & { redRemote: string; redSha: string };
+
+/** Open incidents with their red boundary. `i.*`: the Kernel adds a newer field's column only when the
+ *  landing module starts, so a read right after deploy must not name it (#3362 §11 failingTests). */
+function openIncidentRows(remote?: string): OpenIncidentRow[] {
   if (!tablesReady()) return [];
-  return getDb().query(`SELECT i.id AS incidentId, i.laneKey, i.state, i.mainFailurePolicy, b.remote, b.landedTipSha AS sha
+  return getDb().query(`SELECT i.*, b.remote AS redRemote, b.landedTipSha AS redSha
     FROM ${LAND_INCIDENT_TABLE} i JOIN ${BOUNDARY_TABLE} b ON b.id = i.redBoundaryId
-    WHERE i.state IN ${OPEN_STATES_SQL} ORDER BY i.openedAt, i.id`).all() as ShippingRedMain[];
+    WHERE i.state IN ${OPEN_STATES_SQL} AND (? IS NULL OR b.remote = ?) ORDER BY i.openedAt, i.id`).all(remote ?? null, remote ?? null) as OpenIncidentRow[];
+}
+
+function failingTestsOf(row: Record<string, unknown>): ShippingFailingTest[] {
+  if (typeof row.failingTests !== "string") return [];
+  try {
+    const parsed: unknown = JSON.parse(row.failingTests);
+    return Array.isArray(parsed) ? parsed.filter((entry): entry is ShippingFailingTest =>
+      typeof entry?.file === "string" && typeof entry?.name === "string") : [];
+  } catch {
+    console.warn(`[red-main] incident ${String(row.id)} has unreadable failingTests; showing none`);
+    return [];
+  }
+}
+
+function culpritTaskIds(row: Record<string, unknown>): number[] {
+  const ids = JSON.parse(String(row.culpritBoundaryIds ?? "[]")) as string[];
+  if (!ids.length) return [];
+  const rows = getDb().query(`SELECT DISTINCT taskId FROM ${BOUNDARY_TABLE} WHERE taskId IS NOT NULL AND id IN (${ids.map(() => "?").join(",")}) ORDER BY taskId`)
+    .all(...ids) as { taskId: number }[];
+  return rows.map((entry) => entry.taskId);
+}
+
+/** The Shipping page's red-main lines: each open incident with its red sha, failing cases, owners and run. */
+export function openRedMainLines(): ShippingRedMain[] {
+  return openIncidentRows().map((row) => {
+    const failingTests = failingTestsOf(row);
+    const ownerTaskIds = culpritTaskIds(row);
+    return {
+      incidentId: String(row.id), laneKey: String(row.laneKey), state: String(row.state),
+      ...(row.mainFailurePolicy ? { mainFailurePolicy: row.mainFailurePolicy as "stop" | "advisory" } : {}),
+      remote: row.redRemote, sha: row.redSha,
+      runUrl: ciRunUrl(row.redRemote, Number(row.ciRunId), Number(row.ciAttempt)),
+      ...(failingTests.length ? { failingTests } : {}),
+      ...(ownerTaskIds.length ? { ownerTaskIds } : {}),
+    };
+  });
+}
+
+/** #3362 §11: failing cases already present on `remote`'s main, which delivery gates hold out of unrelated runs. */
+export function baseKnownFailures(remote: string): BaseKnownFailure[] {
+  return openIncidentRows(remote).flatMap((row) =>
+    failingTestsOf(row).map((test) => ({ ...test, incidentId: String(row.id), sha: row.redSha })));
 }
 
 /** #3381 — whether any partial land happened (for `remote`, or anywhere when omitted): a boundary or a

package/src/db/land-gate-attestations.ts

@@ -110,7 +110,7 @@ export interface InsertLandGateAttestationInput extends Omit<LandGateAttestation
  * can legitimately land twice (a revert-and-reland, a retried push), and the FIRST green attestation
  * is as true as the second — so a conflict keeps the original rather than churning the row.
  */
-export function insertLandGateAttestation(input: InsertLandGateAttestationInput): LandGateAttestationRecord {
+export function insertLandGateAttestation(input: InsertLandGateAttestationInput, submittedAt: number = Date.now()): LandGateAttestationRecord {
   const record = decodeLandGateAttestationRow({
     repo: input.repo,
     tree_sha: input.treeSha,
@@ -121,7 +121,7 @@ export function insertLandGateAttestation(input: InsertLandGateAttestationInput)
     gate_names: JSON.stringify(input.gateNames),
     gates_ran: input.gatesRan,
     workspace_id: input.workspaceId ?? null,
-    attested_at: input.attestedAt ?? Date.now(),
+    attested_at: input.attestedAt ?? submittedAt,
     suite_coverage: input.suiteCoverage ?? null,
   });
   getDb().query(`

package/src/db/landing-receipts.ts

@@ -110,7 +110,7 @@ function receiptId(input: InsertLandingReceiptInput): string {
   return `landing_${createHash("sha256").update(key).digest("hex").slice(0, 24)}`;
 }
 
-export function insertLandingReceipt(input: InsertLandingReceiptInput): LandingReceipt {
+export function insertLandingReceipt(input: InsertLandingReceiptInput, submittedAt: number = Date.now()): LandingReceipt {
   const receipt: LandingReceipt = decodeLandingReceiptRow({
     id: receiptId(input),
     project_id: input.projectId ?? null,
@@ -127,7 +127,7 @@ export function insertLandingReceipt(input: InsertLandingReceiptInput): LandingR
     team_id: input.teamId ?? null,
     orchestrator_id: input.orchestratorId ?? null,
     host: input.host ?? null,
-    landed_at: input.landedAt ?? Date.now(),
+    landed_at: input.landedAt ?? submittedAt,
   });
   getDb().query(`
     INSERT INTO landing_receipts (

package/src/db/lifecycle-context-write.ts

@@ -0,0 +1,5 @@
+import { getDb } from "./connection";
+import type { ContextState } from "../types";
+export function persistAdvisoryContext(agentId: string, context: ContextState): void {
+  getDb().query("UPDATE agents SET context_state = ? WHERE id = ?").run(JSON.stringify(context), agentId);
+}

package/src/db/lifecycle-tail-async.ts

@@ -0,0 +1,76 @@
+import { randomUUID } from "node:crypto";
+import { getGateway } from "./gateway";
+import type { clearAgentNotice, recordTerminalEvent } from "./terminal-events";
+import type { recordCrashReport } from "./crash-reports";
+import type { stampSpawnPrincipal } from "./agent-ownership";
+import type { markSpawnRegistrationConfirmed } from "../commands-db";
+import type { seedSpawnPromptMirror } from "./message-reads";
+import type { resolveQueuedPolicyMessages, resolveQueuedDirectMessages } from "./delivery";
+import type { resolveQueuedCoordinatorMessages } from "./coordinator-delivery";
+import type { updateManagedAgentState } from "../config-store";
+import type { deleteWorkspace } from "./workspaces";
+import type { addSubscription, removeSubscription, removeSubscriptionsForTask } from "./notification-subscriptions";
+
+export function clearAgentNoticeAsync(...args: Parameters<typeof clearAgentNotice>): Promise<ReturnType<typeof clearAgentNotice>> {
+  return getGateway().write("lifecycleTail.clearAgentNotice", args) as unknown as Promise<ReturnType<typeof clearAgentNotice>>;
+}
+
+export function recordTerminalEventAsync(...args: Parameters<typeof recordTerminalEvent>): Promise<ReturnType<typeof recordTerminalEvent>> {
+  return getGateway().write("lifecycleTail.recordTerminalEvent", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof recordTerminalEvent>>;
+}
+
+export function recordCrashReportAsync(...args: Parameters<typeof recordCrashReport>): Promise<ReturnType<typeof recordCrashReport>> {
+  return getGateway().write("lifecycleTail.recordCrashReport", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof recordCrashReport>>;
+}
+
+export function stampSpawnPrincipalAsync(...args: Parameters<typeof stampSpawnPrincipal>): Promise<ReturnType<typeof stampSpawnPrincipal>> {
+  return getGateway().write("lifecycleTail.stampSpawnPrincipal", args) as unknown as Promise<ReturnType<typeof stampSpawnPrincipal>>;
+}
+
+export function markSpawnRegistrationConfirmedAsync(...args: Parameters<typeof markSpawnRegistrationConfirmed>): Promise<ReturnType<typeof markSpawnRegistrationConfirmed>> {
+  return getGateway().write("lifecycleTail.markSpawnRegistrationConfirmed", args) as unknown as Promise<ReturnType<typeof markSpawnRegistrationConfirmed>>;
+}
+
+export function seedSpawnPromptMirrorAsync(...args: Parameters<typeof seedSpawnPromptMirror>): Promise<ReturnType<typeof seedSpawnPromptMirror>> {
+  return getGateway().write("lifecycleTail.seedSpawnPromptMirror", args) as unknown as Promise<ReturnType<typeof seedSpawnPromptMirror>>;
+}
+
+export function resolveQueuedPolicyMessagesAsync(...args: Parameters<typeof resolveQueuedPolicyMessages>): Promise<ReturnType<typeof resolveQueuedPolicyMessages>> {
+  return getGateway().write("lifecycleTail.resolveQueuedPolicyMessages", args) as unknown as Promise<ReturnType<typeof resolveQueuedPolicyMessages>>;
+}
+
+export function resolveQueuedDirectMessagesAsync(...args: Parameters<typeof resolveQueuedDirectMessages>): Promise<ReturnType<typeof resolveQueuedDirectMessages>> {
+  return getGateway().write("lifecycleTail.resolveQueuedDirectMessages", args) as unknown as Promise<ReturnType<typeof resolveQueuedDirectMessages>>;
+}
+
+export function resolveQueuedCoordinatorMessagesAsync(...args: Parameters<typeof resolveQueuedCoordinatorMessages>): Promise<ReturnType<typeof resolveQueuedCoordinatorMessages>> {
+  return getGateway().write("lifecycleTail.resolveQueuedCoordinatorMessages", args) as unknown as Promise<ReturnType<typeof resolveQueuedCoordinatorMessages>>;
+}
+
+export function updateManagedAgentStateAsync(...args: Parameters<typeof updateManagedAgentState>): Promise<ReturnType<typeof updateManagedAgentState>> {
+  return getGateway().write("lifecycleTail.updateManagedAgentState", args) as unknown as Promise<ReturnType<typeof updateManagedAgentState>>;
+}
+
+export function deleteWorkspaceAsync(...args: Parameters<typeof deleteWorkspace>): Promise<ReturnType<typeof deleteWorkspace>> {
+  return getGateway().write("lifecycleTail.deleteWorkspace", args) as unknown as Promise<ReturnType<typeof deleteWorkspace>>;
+}
+
+export function addSubscriptionAsync(...args: Parameters<typeof addSubscription>): Promise<ReturnType<typeof addSubscription>> {
+  return getGateway().write("lifecycleTail.addSubscription", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof addSubscription>>;
+}
+
+export function removeSubscriptionAsync(...args: Parameters<typeof removeSubscription>): Promise<ReturnType<typeof removeSubscription>> {
+  return getGateway().write("lifecycleTail.removeSubscription", args) as unknown as Promise<ReturnType<typeof removeSubscription>>;
+}
+
+export function removeSubscriptionsForTaskAsync(...args: Parameters<typeof removeSubscriptionsForTask>): Promise<ReturnType<typeof removeSubscriptionsForTask>> {
+  return getGateway().write("lifecycleTail.removeSubscriptionsForTask", args) as unknown as Promise<ReturnType<typeof removeSubscriptionsForTask>>;
+}
+
+export function addSubscriptionsAsync(inputs: Array<Parameters<typeof addSubscription>[0]>): Promise<Array<ReturnType<typeof addSubscription>>> {
+  return getGateway().write("notifications.subscriptions.addBatch", { inputs }, { idempotencyKey: randomUUID() }) as unknown as Promise<Array<ReturnType<typeof addSubscription>>>;
+}
+
+export function upsertManagedAgentStateAsync(...args: Parameters<typeof import("../config-store").upsertManagedAgentState>): Promise<ReturnType<typeof import("../config-store").upsertManagedAgentState>> {
+  return getGateway().write("lifecycleTail.upsertManagedAgentState", args) as unknown as Promise<ReturnType<typeof import("../config-store").upsertManagedAgentState>>;
+}

package/src/db/lifecycle-tail-write-ops.ts

@@ -0,0 +1,62 @@
+import { createAgentControlBody, grantSelfEffortBody, type AgentControlWrite, type SelfEffortGrantWrite } from "./agent-control-write";
+import { redactCommandSecrets } from "../command-secrets";
+import { admitAgentActionBody, type AgentActionWrite } from "./agent-action-write";
+import { startBrowserBody, stopBrowserBody, type StartBrowserWrite } from "./browser-session-write";
+import { transitionBrowserSession } from "./browser-sessions";
+import { flushWorkFinalReportsFromQueue } from "./messages";
+import type { MessageWorkFinalitySource, Command } from "../types";
+import { insertOperatorDecision } from "./operator-decisions";
+import { persistAdvisoryContext } from "./lifecycle-context-write";
+import { createReviewPublishBody } from "./review-publish-write";
+import { answerOperatorDecisionBody, fileWorkflowDecisionBody } from "./operator-answer-write";
+import { observeEffortBody } from "./agent-effort-observe";
+import { recordContextResetBody, settleContextResetCarryBody } from "./context-carry-write";
+import { openRecoveryObligation, attachRecoveryCommand, type ContextResetFact } from "./context-reset-carry";
+import { clearAgentNotice, recordTerminalEvent } from "./terminal-events";
+import { recordCrashReport } from "./crash-reports";
+import { stampSpawnPrincipal } from "./agent-ownership";
+import { markSpawnRegistrationConfirmed } from "../commands-db";
+import { seedSpawnPromptMirror } from "./message-reads";
+import { resolveQueuedPolicyMessages, resolveQueuedDirectMessages } from "./delivery";
+import { resolveQueuedCoordinatorMessages } from "./coordinator-delivery";
+import { upsertManagedAgentState, updateManagedAgentState } from "../config-store";
+import { deleteWorkspace } from "./workspaces";
+import { addSubscription, removeSubscription, removeSubscriptionsForTask } from "./notification-subscriptions";
+import type { WriterOpSpec } from "./write-ops";
+
+export const LIFECYCLE_TAIL_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
+  "lifecycleTail.upsertManagedAgentState": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof upsertManagedAgentState>) => upsertManagedAgentState(...args) },
+  "agents.createControl": { offLoop: true, idempotent: false, fn: (a: AgentControlWrite, ctx) => createAgentControlBody(a, ctx.now), serializeIdempotencyResult: value => { const result = value as ReturnType<typeof createAgentControlBody>; return { ...result, ...(result.command ? { command: redactCommandSecrets(result.command) } : {}) }; } },
+  "agents.grantSelfEffort": { offLoop: true, idempotent: false, fn: (a: SelfEffortGrantWrite, ctx) => grantSelfEffortBody(a, ctx.now), serializeIdempotencyResult: value => redactCommandSecrets(value as import("../types").Command) },
+  "agents.admitAction": { offLoop: true, idempotent: false, serializeIdempotencyResult: value => { const result = value as ReturnType<typeof admitAgentActionBody>; return { ...result, command: redactCommandSecrets(result.command) }; }, fn: (args: AgentActionWrite, ctx) => admitAgentActionBody(args, ctx.now) },
+  "browser.start": { offLoop: true, idempotent: false, fn: (args: StartBrowserWrite, ctx) => startBrowserBody(args, ctx.now) },
+  "browser.stop": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof stopBrowserBody>[0], ctx) => stopBrowserBody(args, ctx.now) },
+  "browser.transition": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof transitionBrowserSession>) => transitionBrowserSession(...args) ?? null },
+  "notifications.subscriptions.addBatch": { offLoop: true, idempotent: false,
+    fn: (a: { inputs: Array<Parameters<typeof addSubscription>[0]> }, ctx) => a.inputs.map(input => addSubscription({ ...input, now: ctx.now })) },
+  "messages.flushWorkFinal": { offLoop: true, idempotent: true, fn: (a: { agentId: string; queue: number[]; source: MessageWorkFinalitySource; options: { includeStaleCompletedFinals?: boolean } }, ctx) => flushWorkFinalReportsFromQueue(a.agentId, a.queue, a.source, a.options, ctx.now) },
+  "operatorDecisions.insert": { offLoop: true, idempotent: false, fn: insertOperatorDecision },
+  "operatorDecisions.fileWorkflow": { offLoop: true, idempotent: true, fn: fileWorkflowDecisionBody },
+  "agents.persistAdvisoryContext": { offLoop: true, idempotent: true, fn: (a: Parameters<typeof persistAdvisoryContext>) => persistAdvisoryContext(...a) ?? null },
+  "commands.createReviewPublish": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof createReviewPublishBody>[0], ctx) => createReviewPublishBody(args, ctx.now) },
+  "operatorDecisions.answer": { offLoop: true, idempotent: true, fn: answerOperatorDecisionBody },
+  "agents.observeEffort": { offLoop: true, idempotent: true, fn: observeEffortBody },
+  "contextCarry.open": { offLoop: true, idempotent: true, fn: (a: { agentId: string; generation: number; now: number }) => openRecoveryObligation(a.agentId, a.generation, a.now) ?? null },
+  "contextCarry.attach": { offLoop: true, idempotent: true, fn: (a: { agentId: string; generation: number; commandId: string }) => attachRecoveryCommand(a.agentId, a.generation, a.commandId) ?? null },
+  "contextCarry.reset": { offLoop: true, idempotent: true, fn: (a: { fact: ContextResetFact }, ctx) => recordContextResetBody(a.fact, ctx.now) },
+  "contextCarry.settle": { offLoop: true, idempotent: true, fn: (a: { command: Command }, ctx) => settleContextResetCarryBody(a.command, ctx.now) },
+  "lifecycleTail.clearAgentNotice": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof clearAgentNotice>) => clearAgentNotice(...args) ?? null },
+  "lifecycleTail.recordTerminalEvent": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof recordTerminalEvent>) => recordTerminalEvent(...args) ?? null },
+  "lifecycleTail.recordCrashReport": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof recordCrashReport>) => recordCrashReport(...args) ?? null },
+  "lifecycleTail.stampSpawnPrincipal": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof stampSpawnPrincipal>) => stampSpawnPrincipal(...args) ?? null },
+  "lifecycleTail.markSpawnRegistrationConfirmed": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof markSpawnRegistrationConfirmed>) => markSpawnRegistrationConfirmed(...args) ?? null },
+  "lifecycleTail.seedSpawnPromptMirror": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof seedSpawnPromptMirror>) => seedSpawnPromptMirror(...args) ?? null },
+  "lifecycleTail.resolveQueuedPolicyMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedPolicyMessages>) => resolveQueuedPolicyMessages(...args) ?? null },
+  "lifecycleTail.resolveQueuedDirectMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedDirectMessages>) => resolveQueuedDirectMessages(...args) ?? null },
+  "lifecycleTail.resolveQueuedCoordinatorMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedCoordinatorMessages>) => resolveQueuedCoordinatorMessages(...args) ?? null },
+  "lifecycleTail.updateManagedAgentState": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof updateManagedAgentState>) => updateManagedAgentState(...args) ?? null },
+  "lifecycleTail.deleteWorkspace": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof deleteWorkspace>) => deleteWorkspace(...args) ?? null },
+  "lifecycleTail.addSubscription": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof addSubscription>) => addSubscription(...args) ?? null },
+  "lifecycleTail.removeSubscription": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof removeSubscription>) => removeSubscription(...args) ?? null },
+  "lifecycleTail.removeSubscriptionsForTask": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof removeSubscriptionsForTask>) => removeSubscriptionsForTask(...args) ?? null },
+});

package/src/db/lifecycle-write-window.ts

@@ -1,3 +1,4 @@
+import { framed } from "../hub-metrics";
 import { assertMainThreadState, mainThreadRegistry } from "./main-thread-state";
 // #2111 — short-window write coalescing for the hot agent lifecycle / presence / registration writes.
 //
@@ -116,7 +117,7 @@ export function coalesceLifecycleWrite(op: WriteOp, args: unknown, options: Coal
       return;
     }
     if (!window.timer && windowMs() !== Infinity) {
-      window.timer = setTimeout(() => flushWindow(op), windowMs());
+      window.timer = setTimeout(framed("timer lifecycle-write-window", () => flushWindow(op)), windowMs());
       window.timer.unref?.();
     }
   });

package/src/db/lineage-pair-dedupe-sql.ts

@@ -1,11 +1,11 @@
-import { MSG_SELECT } from "./mappers.ts";
 import { MIRROR_LOOKBACK_ROWS, notReportSuppressedSql } from "./report-suppression.ts";
 
 // #3644 — the child→parent chat dedupe reads behind a turn-final forward (db/messages.ts). Pinned
 // to the pair index: unpinned, the planner ranges idx_msg_to_id over the parent's whole inbox
 // (600k rows for `user`) and json_extracts every payload on the main thread. Each query must keep
-// `m.from_agent = ?`, `m.to_target = ?` and `m.kind = 'chat'` (the partial index predicate).
-const PAIR_CHAT_SELECT = `${MSG_SELECT} INDEXED BY idx_msg_pair_chat
+// `m.from_agent = ?`, `m.to_target = ?`, `m.kind = 'chat'` (the partial index predicate).
+// #3617: id + body only, no read/reaction rollups per candidate row; callers hydrate the winner via getMessage.
+const PAIR_CHAT_SELECT = `SELECT m.id, m.body FROM messages m INDEXED BY idx_msg_pair_chat
     WHERE m.from_agent = ?
       AND m.to_target = ?
       AND m.kind = 'chat'`;

package/src/db/main-connection-mode.ts

@@ -0,0 +1,11 @@
+import { relayEnv } from "@humwick/sdk/env";
+import { getDb, getDbPath } from "./connection";
+
+/** Seal the hub handle after all boot writes, immediately before bind (#1870 S8).
+ * Opt in during the soak; standalone tools and :memory: fixtures retain their own write handles. */
+export function configureMainConnectionForServing(env = process.env): boolean {
+  if (!Bun.isMainThread || getDbPath() === ":memory:" || !getDbPath()) return false;
+  if (relayEnv(env, "AGENT_RELAY_MAIN_DB_QUERY_ONLY") !== "1") return false;
+  getDb().run("PRAGMA query_only = ON");
+  return true;
+}

package/src/db/main-connection-writes.ts

@@ -1,4 +1,5 @@
 // #1870: bounded, minute-bucketed census of main-connection write attempts, including failed SQL.
+import { configureMainConnectionForServing } from "./main-connection-mode";
 const MINUTE = 60_000;
 const WINDOW_BUCKETS = 60;
 const MAX_LABELS = 512;
@@ -42,7 +43,7 @@ export function resetMainConnectionWrites(): void {
 let booting = false;
 let bootWrites = 0;
 export function beginMainWriteBootPhase(): void { booting = true; }
-export function endMainWriteBootPhase(): void { booting = false; }
+export function endMainWriteBootPhase(): void { configureMainConnectionForServing(); booting = false; }
 export function mainConnectionBootWrites(): number { return bootWrites; }
 // The first sighting of each label per process logs its caller once, so the remaining raw writers are named
 // from hub logs without a debugger. Bounded by the counter's own label cap.
@@ -52,14 +53,31 @@ function logFirstSighting(label: string): void {
   loggedLabels.add(label);
   const site = (new Error().stack ?? "").split("\n").filter((line) => line.includes(" at ") && !/connection|main-connection-writes/.test(line)).slice(0, 4)
     .map((line) => line.trim().replace(/^at /, "").replace(/\(?\/[^)]*\/(src\/[^):]+:\d+)[^)]*\)?/, "$1")).join(" < ");
-  console.log(`[relay] #1870 main-connection write: ${label} :: ${site}`);
+  // Maintenance subprocesses reserve stdout for their JSON result (#3800).
+  console.error(`[relay] #1870 main-connection write: ${label} :: ${site}`);
 }
 export function recordMainConnectionWrite(label: string | undefined): void {
   if (!Bun.isMainThread || !label) return;
   if (booting) { bootWrites++; return; }
   counter.record(label, Date.now());
+  if (forbidRawWrites) { forbiddenWriteAttempts++; throw new Error(`#1870 raw main-connection write: ${label}`); }
   logFirstSighting(label);
 }
 export function mainConnectionWrites(now: number = Date.now()): Record<string, number> {
   return counter.snapshot(now);
 }
+
+let forbidRawWrites = false;
+let forbiddenWriteAttempts = 0;
+/** Test ratchet for real service/route replay on the file-backed gateway. */
+export async function withRawMainWritesForbidden<T>(run: () => Promise<T>): Promise<T> {
+  const previous = forbidRawWrites;
+  const attempts = forbiddenWriteAttempts;
+  forbidRawWrites = true;
+  try {
+    const result = await run();
+    if (forbiddenWriteAttempts !== attempts) throw new Error("#1870 raw main-connection write was caught inside the replay");
+    return result;
+  }
+  finally { forbidRawWrites = previous; }
+}

package/src/db/maintenance-job-runs-async.ts

@@ -19,8 +19,8 @@ export const finishMaintenanceRunAsync = (args: MaintenanceRunOutcome) =>
 export async function ensureMaintenanceJobsAsync(jobs: MaintenanceJobSpec[]): Promise<void> {
   await getGateway().write("maintenanceJobs.ensure", { jobs }, { critical: true });
 }
-export async function rescheduleRunOnStartJobsAsync(): Promise<void> {
-  await getGateway().write("maintenanceJobs.rescheduleRunOnStart", {}, { critical: true });
+export async function rescheduleRunOnStartJobsAsync(now?: number): Promise<void> {
+  await getGateway().write("maintenanceJobs.rescheduleRunOnStart", { now }, { critical: true });
 }
 export async function reclaimDeadLeasesAsync(leases: DeadLease[]): Promise<void> {
   if (leases.length) await getGateway().write("maintenanceJobs.reclaimDeadLeases", { leases }, { critical: true });

package/src/db/maintenance-job-write-ops.ts

@@ -11,7 +11,7 @@ export const MAINTENANCE_JOB_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> =
   "maintenanceJobs.heartbeat": { offLoop: true, idempotent: true, fn: (args: { id: string; runToken: string }, ctx) => heartbeatMaintenanceRun(args, ctx.now) },
   // Reconcile is a re-assertion of code-owned columns, so a replay changes nothing.
   "maintenanceJobs.ensure": { offLoop: true, idempotent: true, fn: (args: { jobs: MaintenanceJobSpec[] }, ctx) => upsertMaintenanceJobs(args.jobs, ctx.now) },
-  "maintenanceJobs.rescheduleRunOnStart": { offLoop: true, idempotent: true, fn: (_args: Record<string, never>, ctx) => rescheduleRunOnStartJobs(ctx.now) },
+  "maintenanceJobs.rescheduleRunOnStart": { offLoop: true, idempotent: true, fn: (args: { now?: number }, ctx) => rescheduleRunOnStartJobs(args.now ?? ctx.now) },
   "maintenanceJobs.reclaimDeadLeases": { offLoop: true, idempotent: true, fn: (args: { leases: DeadLease[] }, ctx) => reclaimDeadLeases(args.leases, ctx.now) },
   // A compare-and-set on the observed lease, so a replay finds nothing left to reset.
   "maintenanceJobs.resetExpiredCritical": { offLoop: true, idempotent: true, fn: (args: { now: number }) => resetExpiredCriticalMaintenanceRuns(args.now) },

package/src/db/maintenance-pauses.ts

@@ -123,8 +123,8 @@ export interface PauseMaintenanceJobInput {
 /** Acquire a pause. An existing ACTIVE pause is returned as a conflict rather than having its
  *  holder replaced — same contract as acquireMergePause, so one operator's hold plus its reason
  *  cannot be quietly overwritten by another's. A LAPSED row is replaced. */
-export function pauseMaintenanceJob(input: PauseMaintenanceJobInput): { ok: boolean; pause: MaintenanceJobPauseRecord } {
-  const now = input.now ?? Date.now();
+export function pauseMaintenanceJob(input: PauseMaintenanceJobInput, submittedAt: number = Date.now()): { ok: boolean; pause: MaintenanceJobPauseRecord } {
+  const now = input.now ?? submittedAt;
   const expiresAt = input.indefinite ? null : now + (input.ttlMs ?? DEFAULT_MAINTENANCE_PAUSE_TTL_MS);
   return writeTransaction(() => {
     const existing = getMaintenanceJobPause(input.jobId, now);

package/src/db/message-send.ts

@@ -74,3 +74,7 @@ export function sendMessagesBatchWithResultAsync(
     SendMessageResult[]
   >;
 }
+
+export async function sendMessageAsync(input: SendMessageInput) {
+  return (await sendMessageWithResultAsync(input)).message;
+}