@humwick/server 0.130.2 → 0.130.3

package/src/db/runtime-tail-async.ts

@@ -0,0 +1,288 @@
+import type { pruneWorkspaceOrphanAlerts, pruneOrphanedSharedWorkspaces, claimWorkspaceOrphanAlert, claimWorkspaceHumanEscalationAlert, pruneStaleWorkspaceHumanEscalationAlerts, reelectRepoSteward } from "./workspaces";
+import type { upsertProjectTrustApproval } from "./project-trust-approvals";
+import type { setProjectJournalFields } from "./project-journal";
+import type { promoteLineageCapturedResponse, markSelfResumeContinuationIngested } from "./messages";
+import type { acquireMergePause, acquireMergeLease, releaseMergeLease, releaseExpiredMergeLeases, releaseExpiredMergePauses, renewMergePause, releaseMergePause } from "./merge-lease";
+import type { ingestIntegrationEvent, upsertIntegrationRegistry } from "./integrations";
+import type { refreshPendingLandQueueLease } from "./commands-claim-admission";
+import type { writeEntry, retractEntry } from "./blackboard";
+import type { fencePublishForPush, cancelPendingCommand } from "../commands-db";
+import { randomUUID } from "node:crypto";
+import { getGateway } from "./gateway";
+import { deferLineageReport } from "./deferred-lineage-reports";
+import { applyLineageReportEffects } from "./messages";
+import { evictPendingPresence } from "./presence-buffer";
+import type { deleteOrchestratorRow } from "./orchestrators";
+import type { setUserSecret, createAuthIdentity } from "./auth-identities";
+import type { markWorkspaceCarryPending, confirmWorkspaceCarryPendingForTask } from "./carry-pending-marker";
+import type { ensureContinuationEnvelope, updateContinuationObjective } from "./continuations";
+import type { releaseDriveLease, releaseExpiredDriveLeases } from "./drive-leases";
+import type { finishIdleDigestScan, updateIdleDigestScan, startIdleDigestWindow } from "./idle-digest";
+import type { associateIssue, removeAssociation } from "./issue-associations";
+import type { insertLandGateAttestation } from "./land-gate-attestations";
+import type { insertLandingReceipt } from "./landing-receipts";
+import type { recordIssueLifecycleComment } from "./long-running-work";
+import type { pauseMaintenanceJob, resumeMaintenanceJob } from "./maintenance-pauses";
+import type { updateOpenOperatorDecision, withdrawOpenOperatorDecision } from "./operator-decisions";
+import type { deleteOrchestrator } from "./orchestrators";
+import type { upsertTemplate, resetTemplate } from "./prompt-templates";
+import type { setReviewRefFenceToken, markReviewRefPublished, markReviewRefAnnounced, markReviewRefFailed, markReviewRefClosed, recordReviewRefCleanupDispatch, deleteReviewRefCleanup } from "./review-ref-cleanups";
+import type { insertTaskEvent } from "./task-core";
+import type { clearTeamIdleEntry, setTeamIdleEntry } from "./team-idle";
+import type { updateUserProfile, updateUserAccess } from "./users";
+import type { upsertTokenProfile, updateTokenProfile, deleteTokenProfile } from "../token-db";
+
+export function setUserSecretAsync(...args: Parameters<typeof setUserSecret>): Promise<ReturnType<typeof setUserSecret>> {
+  return getGateway().write("runtimeTail.setUserSecret", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof setUserSecret>>;
+}
+
+export function createAuthIdentityAsync(...args: Parameters<typeof createAuthIdentity>): Promise<ReturnType<typeof createAuthIdentity>> {
+  return getGateway().write("runtimeTail.createAuthIdentity", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof createAuthIdentity>>;
+}
+
+export function retractEntryAsync(...args: Parameters<typeof retractEntry>): Promise<ReturnType<typeof retractEntry>> {
+  return getGateway().write("runtimeTail.retractEntry", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof retractEntry>>;
+}
+
+export function markWorkspaceCarryPendingAsync(...args: Parameters<typeof markWorkspaceCarryPending>): Promise<ReturnType<typeof markWorkspaceCarryPending>> {
+  return getGateway().write("runtimeTail.markWorkspaceCarryPending", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof markWorkspaceCarryPending>>;
+}
+
+export function confirmWorkspaceCarryPendingForTaskAsync(...args: Parameters<typeof confirmWorkspaceCarryPendingForTask>): Promise<ReturnType<typeof confirmWorkspaceCarryPendingForTask>> {
+  return getGateway().write("runtimeTail.confirmWorkspaceCarryPendingForTask", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof confirmWorkspaceCarryPendingForTask>>;
+}
+
+export function ensureContinuationEnvelopeAsync(...args: Parameters<typeof ensureContinuationEnvelope>): Promise<ReturnType<typeof ensureContinuationEnvelope>> {
+  return getGateway().write("runtimeTail.ensureContinuationEnvelope", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof ensureContinuationEnvelope>>;
+}
+
+export function updateContinuationObjectiveAsync(...args: Parameters<typeof updateContinuationObjective>): Promise<ReturnType<typeof updateContinuationObjective>> {
+  return getGateway().write("runtimeTail.updateContinuationObjective", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof updateContinuationObjective>>;
+}
+
+export function releaseDriveLeaseAsync(...args: Parameters<typeof releaseDriveLease>): Promise<ReturnType<typeof releaseDriveLease>> {
+  return getGateway().write("runtimeTail.releaseDriveLease", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof releaseDriveLease>>;
+}
+
+export function releaseExpiredDriveLeasesAsync(...args: Parameters<typeof releaseExpiredDriveLeases>): Promise<ReturnType<typeof releaseExpiredDriveLeases>> {
+  return getGateway().write("runtimeTail.releaseExpiredDriveLeases", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof releaseExpiredDriveLeases>>;
+}
+
+export function finishIdleDigestScanAsync(...args: Parameters<typeof finishIdleDigestScan>): Promise<ReturnType<typeof finishIdleDigestScan>> {
+  return getGateway().write("runtimeTail.finishIdleDigestScan", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof finishIdleDigestScan>>;
+}
+
+export function updateIdleDigestScanAsync(...args: Parameters<typeof updateIdleDigestScan>): Promise<ReturnType<typeof updateIdleDigestScan>> {
+  return getGateway().write("runtimeTail.updateIdleDigestScan", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof updateIdleDigestScan>>;
+}
+
+export function startIdleDigestWindowAsync(...args: Parameters<typeof startIdleDigestWindow>): Promise<ReturnType<typeof startIdleDigestWindow>> {
+  return getGateway().write("runtimeTail.startIdleDigestWindow", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof startIdleDigestWindow>>;
+}
+
+export function associateIssueAsync(...args: Parameters<typeof associateIssue>): Promise<ReturnType<typeof associateIssue>> {
+  return getGateway().write("runtimeTail.associateIssue", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof associateIssue>>;
+}
+
+export function removeAssociationAsync(...args: Parameters<typeof removeAssociation>): Promise<ReturnType<typeof removeAssociation>> {
+  return getGateway().write("runtimeTail.removeAssociation", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof removeAssociation>>;
+}
+
+export function insertLandGateAttestationAsync(...args: Parameters<typeof insertLandGateAttestation>): Promise<ReturnType<typeof insertLandGateAttestation>> {
+  return getGateway().write("runtimeTail.insertLandGateAttestation", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof insertLandGateAttestation>>;
+}
+
+export function insertLandingReceiptAsync(...args: Parameters<typeof insertLandingReceipt>): Promise<ReturnType<typeof insertLandingReceipt>> {
+  return getGateway().write("runtimeTail.insertLandingReceipt", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof insertLandingReceipt>>;
+}
+
+export function recordIssueLifecycleCommentAsync(...args: Parameters<typeof recordIssueLifecycleComment>): Promise<ReturnType<typeof recordIssueLifecycleComment>> {
+  return getGateway().write("runtimeTail.recordIssueLifecycleComment", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof recordIssueLifecycleComment>>;
+}
+
+export function pauseMaintenanceJobAsync(...args: Parameters<typeof pauseMaintenanceJob>): Promise<ReturnType<typeof pauseMaintenanceJob>> {
+  return getGateway().write("runtimeTail.pauseMaintenanceJob", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof pauseMaintenanceJob>>;
+}
+
+export function resumeMaintenanceJobAsync(...args: Parameters<typeof resumeMaintenanceJob>): Promise<ReturnType<typeof resumeMaintenanceJob>> {
+  return getGateway().write("runtimeTail.resumeMaintenanceJob", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof resumeMaintenanceJob>>;
+}
+
+export function releaseMergeLeaseAsync(...args: Parameters<typeof releaseMergeLease>): Promise<ReturnType<typeof releaseMergeLease>> {
+  return getGateway().write("runtimeTail.releaseMergeLease", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof releaseMergeLease>>;
+}
+
+export function releaseExpiredMergeLeasesAsync(...args: Parameters<typeof releaseExpiredMergeLeases>): Promise<ReturnType<typeof releaseExpiredMergeLeases>> {
+  return getGateway().write("runtimeTail.releaseExpiredMergeLeases", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof releaseExpiredMergeLeases>>;
+}
+
+export function releaseExpiredMergePausesAsync(...args: Parameters<typeof releaseExpiredMergePauses>): Promise<ReturnType<typeof releaseExpiredMergePauses>> {
+  return getGateway().write("runtimeTail.releaseExpiredMergePauses", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof releaseExpiredMergePauses>>;
+}
+
+export function renewMergePauseAsync(...args: Parameters<typeof renewMergePause>): Promise<ReturnType<typeof renewMergePause>> {
+  return getGateway().write("runtimeTail.renewMergePause", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof renewMergePause>>;
+}
+
+export function releaseMergePauseAsync(...args: Parameters<typeof releaseMergePause>): Promise<ReturnType<typeof releaseMergePause>> {
+  return getGateway().write("runtimeTail.releaseMergePause", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof releaseMergePause>>;
+}
+
+export function markSelfResumeContinuationIngestedAsync(...args: Parameters<typeof markSelfResumeContinuationIngested>): Promise<ReturnType<typeof markSelfResumeContinuationIngested>> {
+  return getGateway().write("runtimeTail.markSelfResumeContinuationIngested", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof markSelfResumeContinuationIngested>>;
+}
+
+export function updateOpenOperatorDecisionAsync(...args: Parameters<typeof updateOpenOperatorDecision>): Promise<ReturnType<typeof updateOpenOperatorDecision>> {
+  return getGateway().write("runtimeTail.updateOpenOperatorDecision", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof updateOpenOperatorDecision>>;
+}
+
+export function withdrawOpenOperatorDecisionAsync(...args: Parameters<typeof withdrawOpenOperatorDecision>): Promise<ReturnType<typeof withdrawOpenOperatorDecision>> {
+  return getGateway().write("runtimeTail.withdrawOpenOperatorDecision", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof withdrawOpenOperatorDecision>>;
+}
+
+export async function deleteOrchestratorAsync(...args: Parameters<typeof deleteOrchestrator>): Promise<ReturnType<typeof deleteOrchestrator>> {
+  const result = await getGateway().write("runtimeTail.deleteOrchestrator", args, { idempotencyKey: randomUUID() }) as unknown as ReturnType<typeof deleteOrchestratorRow>;
+  if (result.agentId) evictPendingPresence(result.agentId);
+  return result.deleted;
+}
+
+export function upsertTemplateAsync(...args: Parameters<typeof upsertTemplate>): Promise<ReturnType<typeof upsertTemplate>> {
+  return getGateway().write("runtimeTail.upsertTemplate", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof upsertTemplate>>;
+}
+
+export function resetTemplateAsync(...args: Parameters<typeof resetTemplate>): Promise<ReturnType<typeof resetTemplate>> {
+  return getGateway().write("runtimeTail.resetTemplate", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof resetTemplate>>;
+}
+
+export function setReviewRefFenceTokenAsync(...args: Parameters<typeof setReviewRefFenceToken>): Promise<ReturnType<typeof setReviewRefFenceToken>> {
+  return getGateway().write("runtimeTail.setReviewRefFenceToken", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof setReviewRefFenceToken>>;
+}
+
+export function markReviewRefPublishedAsync(...args: Parameters<typeof markReviewRefPublished>): Promise<ReturnType<typeof markReviewRefPublished>> {
+  return getGateway().write("runtimeTail.markReviewRefPublished", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof markReviewRefPublished>>;
+}
+
+export function markReviewRefAnnouncedAsync(...args: Parameters<typeof markReviewRefAnnounced>): Promise<ReturnType<typeof markReviewRefAnnounced>> {
+  return getGateway().write("runtimeTail.markReviewRefAnnounced", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof markReviewRefAnnounced>>;
+}
+
+export function markReviewRefFailedAsync(...args: Parameters<typeof markReviewRefFailed>): Promise<ReturnType<typeof markReviewRefFailed>> {
+  return getGateway().write("runtimeTail.markReviewRefFailed", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof markReviewRefFailed>>;
+}
+
+export function markReviewRefClosedAsync(...args: Parameters<typeof markReviewRefClosed>): Promise<ReturnType<typeof markReviewRefClosed>> {
+  return getGateway().write("runtimeTail.markReviewRefClosed", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof markReviewRefClosed>>;
+}
+
+export function recordReviewRefCleanupDispatchAsync(...args: Parameters<typeof recordReviewRefCleanupDispatch>): Promise<ReturnType<typeof recordReviewRefCleanupDispatch>> {
+  return getGateway().write("runtimeTail.recordReviewRefCleanupDispatch", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof recordReviewRefCleanupDispatch>>;
+}
+
+export function deleteReviewRefCleanupAsync(...args: Parameters<typeof deleteReviewRefCleanup>): Promise<ReturnType<typeof deleteReviewRefCleanup>> {
+  return getGateway().write("runtimeTail.deleteReviewRefCleanup", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof deleteReviewRefCleanup>>;
+}
+
+export function insertTaskEventAsync(...args: Parameters<typeof insertTaskEvent>): Promise<ReturnType<typeof insertTaskEvent>> {
+  return getGateway().write("runtimeTail.insertTaskEvent", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof insertTaskEvent>>;
+}
+
+export function clearTeamIdleEntryAsync(...args: Parameters<typeof clearTeamIdleEntry>): Promise<ReturnType<typeof clearTeamIdleEntry>> {
+  return getGateway().write("runtimeTail.clearTeamIdleEntry", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof clearTeamIdleEntry>>;
+}
+
+export function setTeamIdleEntryAsync(...args: Parameters<typeof setTeamIdleEntry>): Promise<ReturnType<typeof setTeamIdleEntry>> {
+  return getGateway().write("runtimeTail.setTeamIdleEntry", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof setTeamIdleEntry>>;
+}
+
+export function updateUserProfileAsync(...args: Parameters<typeof updateUserProfile>): Promise<ReturnType<typeof updateUserProfile>> {
+  return getGateway().write("runtimeTail.updateUserProfile", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof updateUserProfile>>;
+}
+
+export function updateUserAccessAsync(...args: Parameters<typeof updateUserAccess>): Promise<ReturnType<typeof updateUserAccess>> {
+  return getGateway().write("runtimeTail.updateUserAccess", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof updateUserAccess>>;
+}
+
+export function claimWorkspaceOrphanAlertAsync(...args: Parameters<typeof claimWorkspaceOrphanAlert>): Promise<ReturnType<typeof claimWorkspaceOrphanAlert>> {
+  return getGateway().write("runtimeTail.claimWorkspaceOrphanAlert", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof claimWorkspaceOrphanAlert>>;
+}
+
+export function claimWorkspaceHumanEscalationAlertAsync(...args: Parameters<typeof claimWorkspaceHumanEscalationAlert>): Promise<ReturnType<typeof claimWorkspaceHumanEscalationAlert>> {
+  return getGateway().write("runtimeTail.claimWorkspaceHumanEscalationAlert", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof claimWorkspaceHumanEscalationAlert>>;
+}
+
+export function pruneStaleWorkspaceHumanEscalationAlertsAsync(...args: Parameters<typeof pruneStaleWorkspaceHumanEscalationAlerts>): Promise<ReturnType<typeof pruneStaleWorkspaceHumanEscalationAlerts>> {
+  return getGateway().write("runtimeTail.pruneStaleWorkspaceHumanEscalationAlerts", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof pruneStaleWorkspaceHumanEscalationAlerts>>;
+}
+
+export function reelectRepoStewardAsync(...args: Parameters<typeof reelectRepoSteward>): Promise<ReturnType<typeof reelectRepoSteward>> {
+  return getGateway().write("runtimeTail.reelectRepoSteward", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof reelectRepoSteward>>;
+}
+
+export function upsertTokenProfileAsync(...args: Parameters<typeof upsertTokenProfile>): Promise<ReturnType<typeof upsertTokenProfile>> {
+  return getGateway().write("runtimeTail.upsertTokenProfile", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof upsertTokenProfile>>;
+}
+
+export function updateTokenProfileAsync(...args: Parameters<typeof updateTokenProfile>): Promise<ReturnType<typeof updateTokenProfile>> {
+  return getGateway().write("runtimeTail.updateTokenProfile", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof updateTokenProfile>>;
+}
+
+export function deleteTokenProfileAsync(...args: Parameters<typeof deleteTokenProfile>): Promise<ReturnType<typeof deleteTokenProfile>> {
+  return getGateway().write("runtimeTail.deleteTokenProfile", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof deleteTokenProfile>>;
+}
+
+export function cancelPendingCommandAsync(...args: Parameters<typeof cancelPendingCommand>): Promise<ReturnType<typeof cancelPendingCommand>> {
+  return getGateway().write("runtimeTail.cancelPendingCommand", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof cancelPendingCommand>>;
+}
+
+export function fencePublishForPushAsync(...args: Parameters<typeof fencePublishForPush>): Promise<ReturnType<typeof fencePublishForPush>> {
+  return getGateway().write("runtimeTail.fencePublishForPush", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof fencePublishForPush>>;
+}
+
+export function writeEntryAsync(...args: Parameters<typeof writeEntry>): Promise<ReturnType<typeof writeEntry>> {
+  return getGateway().write("runtimeTail.writeEntry", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof writeEntry>>;
+}
+
+export function refreshPendingLandQueueLeaseAsync(...args: Parameters<typeof refreshPendingLandQueueLease>): Promise<ReturnType<typeof refreshPendingLandQueueLease>> {
+  return getGateway().write("runtimeTail.refreshPendingLandQueueLease", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof refreshPendingLandQueueLease>>;
+}
+
+export function upsertIntegrationRegistryAsync(...args: Parameters<typeof upsertIntegrationRegistry>): Promise<ReturnType<typeof upsertIntegrationRegistry>> {
+  return getGateway().write("runtimeTail.upsertIntegrationRegistry", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof upsertIntegrationRegistry>>;
+}
+
+export function ingestIntegrationEventAsync(...args: Parameters<typeof ingestIntegrationEvent>): Promise<ReturnType<typeof ingestIntegrationEvent>> {
+  return getGateway().write("runtimeTail.ingestIntegrationEvent", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof ingestIntegrationEvent>>;
+}
+
+export function acquireMergeLeaseAsync(...args: Parameters<typeof acquireMergeLease>): Promise<ReturnType<typeof acquireMergeLease>> {
+  return getGateway().write("runtimeTail.acquireMergeLease", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof acquireMergeLease>>;
+}
+
+export function acquireMergePauseAsync(...args: Parameters<typeof acquireMergePause>): Promise<ReturnType<typeof acquireMergePause>> {
+  return getGateway().write("runtimeTail.acquireMergePause", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof acquireMergePause>>;
+}
+
+export async function promoteLineageCapturedResponseAsync(message: Parameters<typeof promoteLineageCapturedResponse>[0]): Promise<ReturnType<typeof promoteLineageCapturedResponse>> {
+  const value = await getGateway().write("runtimeTail.promoteLineageCapturedResponse", [message], { idempotencyKey: randomUUID() }) as unknown as {
+    result: ReturnType<typeof promoteLineageCapturedResponse>; deferred: Array<{ childId: string; messageId: number }>;
+  };
+  for (const effect of value.deferred) deferLineageReport(effect.childId, effect.messageId);
+  applyLineageReportEffects(value.result);
+  return value.result;
+}
+
+export function setProjectJournalFieldsAsync(...args: Parameters<typeof setProjectJournalFields>): Promise<ReturnType<typeof setProjectJournalFields>> {
+  return getGateway().write("runtimeTail.setProjectJournalFields", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof setProjectJournalFields>>;
+}
+
+export function upsertProjectTrustApprovalAsync(...args: Parameters<typeof upsertProjectTrustApproval>): Promise<ReturnType<typeof upsertProjectTrustApproval>> {
+  return getGateway().write("runtimeTail.upsertProjectTrustApproval", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof upsertProjectTrustApproval>>;
+}
+
+export function pruneOrphanedSharedWorkspacesAsync(...args: Parameters<typeof pruneOrphanedSharedWorkspaces>): Promise<ReturnType<typeof pruneOrphanedSharedWorkspaces>> {
+  return getGateway().write("runtimeTail.pruneOrphanedSharedWorkspaces", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof pruneOrphanedSharedWorkspaces>>;
+}
+
+export function pruneWorkspaceOrphanAlertsAsync(...args: Parameters<typeof pruneWorkspaceOrphanAlerts>): Promise<ReturnType<typeof pruneWorkspaceOrphanAlerts>> {
+  return getGateway().write("runtimeTail.pruneWorkspaceOrphanAlerts", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof pruneWorkspaceOrphanAlerts>>;
+}

package/src/db/runtime-tail-write-ops.ts

@@ -0,0 +1,97 @@
+import { redactCommandSecrets } from "../command-secrets";
+import { pruneWorkspaceOrphanAlerts, pruneOrphanedSharedWorkspaces, claimWorkspaceOrphanAlert, claimWorkspaceHumanEscalationAlert, pruneStaleWorkspaceHumanEscalationAlerts, reelectRepoSteward } from "./workspaces";
+import { upsertProjectTrustApproval } from "./project-trust-approvals";
+import { setProjectJournalFields } from "./project-journal";
+import { promoteLineageCapturedResponse, markSelfResumeContinuationIngested } from "./messages";
+import { acquireMergePause, acquireMergeLease, releaseMergeLease, releaseExpiredMergeLeases, releaseExpiredMergePauses, renewMergePause, releaseMergePause } from "./merge-lease";
+import { ingestIntegrationEvent, upsertIntegrationRegistry } from "./integrations";
+import { refreshPendingLandQueueLease } from "./commands-claim-admission";
+import { writeEntry, retractEntry } from "./blackboard";
+import { fencePublishForPush, cancelPendingCommand } from "../commands-db";
+import { setUserSecret, createAuthIdentity } from "./auth-identities";
+import { markWorkspaceCarryPending, confirmWorkspaceCarryPendingForTask } from "./carry-pending-marker";
+import { ensureContinuationEnvelope, updateContinuationObjective } from "./continuations";
+import { releaseDriveLease, releaseExpiredDriveLeases } from "./drive-leases";
+import { finishIdleDigestScan, updateIdleDigestScan, startIdleDigestWindow } from "./idle-digest";
+import { associateIssue, removeAssociation } from "./issue-associations";
+import { insertLandGateAttestation } from "./land-gate-attestations";
+import { insertLandingReceipt } from "./landing-receipts";
+import { recordIssueLifecycleComment } from "./long-running-work";
+import { pauseMaintenanceJob, resumeMaintenanceJob } from "./maintenance-pauses";
+import { updateOpenOperatorDecision, withdrawOpenOperatorDecision } from "./operator-decisions";
+import { deleteOrchestratorRow } from "./orchestrators";
+import { upsertTemplate, resetTemplate } from "./prompt-templates";
+import { setReviewRefFenceToken, markReviewRefPublished, markReviewRefAnnounced, markReviewRefFailed, markReviewRefClosed, recordReviewRefCleanupDispatch, deleteReviewRefCleanup } from "./review-ref-cleanups";
+import { insertTaskEvent } from "./task-core";
+import { clearTeamIdleEntry, setTeamIdleEntry } from "./team-idle";
+import { updateUserProfile, updateUserAccess } from "./users";
+import { upsertTokenProfile, updateTokenProfile, deleteTokenProfile } from "../token-db";
+import type { WriterOpSpec } from "./write-ops";
+
+export const RUNTIME_TAIL_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
+  "runtimeTail.setUserSecret": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof setUserSecret>) => setUserSecret(...args) ?? null },
+  "runtimeTail.createAuthIdentity": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof createAuthIdentity>, ctx) => { const values: Parameters<typeof createAuthIdentity> = [...args]; values[1] ??= ctx.now; return createAuthIdentity(...values) ?? null; } },
+  "runtimeTail.retractEntry": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof retractEntry>, ctx) => { const values: Parameters<typeof retractEntry> = [...args]; values[1] ??= ctx.now; return retractEntry(...values) ?? null; } },
+  "runtimeTail.markWorkspaceCarryPending": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof markWorkspaceCarryPending>) => markWorkspaceCarryPending(...args) ?? null },
+  "runtimeTail.confirmWorkspaceCarryPendingForTask": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof confirmWorkspaceCarryPendingForTask>) => confirmWorkspaceCarryPendingForTask(...args) ?? null },
+  "runtimeTail.ensureContinuationEnvelope": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof ensureContinuationEnvelope>, ctx) => { const values: Parameters<typeof ensureContinuationEnvelope> = [...args]; values[1] ??= ctx.now; return ensureContinuationEnvelope(...values) ?? null; } },
+  "runtimeTail.updateContinuationObjective": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof updateContinuationObjective>, ctx) => { const values: Parameters<typeof updateContinuationObjective> = [...args]; values[1] ??= ctx.now; return updateContinuationObjective(...values) ?? null; } },
+  "runtimeTail.releaseDriveLease": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof releaseDriveLease>) => releaseDriveLease(...args) ?? null },
+  "runtimeTail.releaseExpiredDriveLeases": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof releaseExpiredDriveLeases>, ctx) => { const values: Parameters<typeof releaseExpiredDriveLeases> = [...args]; values[0] ??= ctx.now; return releaseExpiredDriveLeases(...values) ?? null; } },
+  "runtimeTail.finishIdleDigestScan": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof finishIdleDigestScan>) => finishIdleDigestScan(...args) ?? null },
+  "runtimeTail.updateIdleDigestScan": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof updateIdleDigestScan>) => updateIdleDigestScan(...args) ?? null },
+  "runtimeTail.startIdleDigestWindow": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof startIdleDigestWindow>) => startIdleDigestWindow(...args) ?? null },
+  "runtimeTail.associateIssue": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof associateIssue>, ctx) => { const values: Parameters<typeof associateIssue> = [...args]; values[4] ??= ctx.now; return associateIssue(...values) ?? null; } },
+  "runtimeTail.removeAssociation": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof removeAssociation>) => removeAssociation(...args) ?? null },
+  "runtimeTail.insertLandGateAttestation": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof insertLandGateAttestation>, ctx) => { const values: Parameters<typeof insertLandGateAttestation> = [...args]; values[1] ??= ctx.now; return insertLandGateAttestation(...values) ?? null; } },
+  "runtimeTail.insertLandingReceipt": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof insertLandingReceipt>, ctx) => { const values: Parameters<typeof insertLandingReceipt> = [...args]; values[1] ??= ctx.now; return insertLandingReceipt(...values) ?? null; } },
+  "runtimeTail.recordIssueLifecycleComment": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof recordIssueLifecycleComment>) => recordIssueLifecycleComment(...args) ?? null },
+  "runtimeTail.pauseMaintenanceJob": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof pauseMaintenanceJob>, ctx) => { const values: Parameters<typeof pauseMaintenanceJob> = [...args]; values[1] ??= ctx.now; return pauseMaintenanceJob(...values) ?? null; } },
+  "runtimeTail.resumeMaintenanceJob": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof resumeMaintenanceJob>) => resumeMaintenanceJob(...args) ?? null },
+  "runtimeTail.releaseMergeLease": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof releaseMergeLease>) => releaseMergeLease(...args) ?? null },
+  "runtimeTail.releaseExpiredMergeLeases": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof releaseExpiredMergeLeases>, ctx) => { const values: Parameters<typeof releaseExpiredMergeLeases> = [...args]; values[0] ??= ctx.now; return releaseExpiredMergeLeases(...values) ?? null; } },
+  "runtimeTail.releaseExpiredMergePauses": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof releaseExpiredMergePauses>, ctx) => { const values: Parameters<typeof releaseExpiredMergePauses> = [...args]; values[0] ??= ctx.now; return releaseExpiredMergePauses(...values) ?? null; } },
+  "runtimeTail.renewMergePause": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof renewMergePause>, ctx) => { const values: Parameters<typeof renewMergePause> = [...args]; values[2] ??= ctx.now; return renewMergePause(...values) ?? null; } },
+  "runtimeTail.releaseMergePause": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof releaseMergePause>) => releaseMergePause(...args) ?? null },
+  "runtimeTail.markSelfResumeContinuationIngested": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof markSelfResumeContinuationIngested>, ctx) => { const values: Parameters<typeof markSelfResumeContinuationIngested> = [...args]; values[1] ??= ctx.now; return markSelfResumeContinuationIngested(...values) ?? null; } },
+  "runtimeTail.updateOpenOperatorDecision": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof updateOpenOperatorDecision>, ctx) => { const values: Parameters<typeof updateOpenOperatorDecision> = [...args]; values[2] ??= ctx.now; return updateOpenOperatorDecision(...values) ?? null; } },
+  "runtimeTail.withdrawOpenOperatorDecision": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof withdrawOpenOperatorDecision>, ctx) => { const values: Parameters<typeof withdrawOpenOperatorDecision> = [...args]; values[1] ??= ctx.now; return withdrawOpenOperatorDecision(...values) ?? null; } },
+  "runtimeTail.deleteOrchestrator": { offLoop: true, idempotent: false, fn: (args: [string], ctx) => deleteOrchestratorRow(args[0], ctx.now) },
+  "runtimeTail.upsertTemplate": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof upsertTemplate>, ctx) => { const values: Parameters<typeof upsertTemplate> = [...args]; values[2] ??= ctx.now; return upsertTemplate(...values) ?? null; } },
+  "runtimeTail.resetTemplate": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof resetTemplate>, ctx) => { const values: Parameters<typeof resetTemplate> = [...args]; values[1] ??= ctx.now; return resetTemplate(...values) ?? null; } },
+  "runtimeTail.setReviewRefFenceToken": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof setReviewRefFenceToken>, ctx) => { const values: Parameters<typeof setReviewRefFenceToken> = [...args]; values[2] ??= ctx.now; return setReviewRefFenceToken(...values) ?? null; } },
+  "runtimeTail.markReviewRefPublished": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof markReviewRefPublished>, ctx) => { const values: Parameters<typeof markReviewRefPublished> = [...args]; values[2] ??= ctx.now; return markReviewRefPublished(...values) ?? null; } },
+  "runtimeTail.markReviewRefAnnounced": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof markReviewRefAnnounced>, ctx) => { const values: Parameters<typeof markReviewRefAnnounced> = [...args]; values[1] ??= ctx.now; return markReviewRefAnnounced(...values) ?? null; } },
+  "runtimeTail.markReviewRefFailed": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof markReviewRefFailed>, ctx) => { const values: Parameters<typeof markReviewRefFailed> = [...args]; values[1] ??= ctx.now; return markReviewRefFailed(...values) ?? null; } },
+  "runtimeTail.markReviewRefClosed": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof markReviewRefClosed>, ctx) => { const values: Parameters<typeof markReviewRefClosed> = [...args]; values[1] ??= ctx.now; return markReviewRefClosed(...values) ?? null; } },
+  "runtimeTail.recordReviewRefCleanupDispatch": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof recordReviewRefCleanupDispatch>, ctx) => { const values: Parameters<typeof recordReviewRefCleanupDispatch> = [...args]; values[3] ??= ctx.now; return recordReviewRefCleanupDispatch(...values) ?? null; } },
+  "runtimeTail.deleteReviewRefCleanup": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof deleteReviewRefCleanup>) => deleteReviewRefCleanup(...args) ?? null },
+  "runtimeTail.insertTaskEvent": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof insertTaskEvent>, ctx) => { const values: Parameters<typeof insertTaskEvent> = [...args]; values[2] ??= ctx.now; return insertTaskEvent(...values) ?? null; } },
+  "runtimeTail.clearTeamIdleEntry": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof clearTeamIdleEntry>) => clearTeamIdleEntry(...args) ?? null },
+  "runtimeTail.setTeamIdleEntry": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof setTeamIdleEntry>) => setTeamIdleEntry(...args) ?? null },
+  "runtimeTail.updateUserProfile": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof updateUserProfile>, ctx) => { const values: Parameters<typeof updateUserProfile> = [...args]; values[1] ??= ctx.now; return updateUserProfile(...values) ?? null; } },
+  "runtimeTail.updateUserAccess": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof updateUserAccess>, ctx) => { const values: Parameters<typeof updateUserAccess> = [...args]; values[1] ??= ctx.now; return updateUserAccess(...values) ?? null; } },
+  "runtimeTail.claimWorkspaceOrphanAlert": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof claimWorkspaceOrphanAlert>, ctx) => { const values: Parameters<typeof claimWorkspaceOrphanAlert> = [...args]; values[2] ??= ctx.now; return claimWorkspaceOrphanAlert(...values) ?? null; } },
+  "runtimeTail.claimWorkspaceHumanEscalationAlert": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof claimWorkspaceHumanEscalationAlert>, ctx) => { const values: Parameters<typeof claimWorkspaceHumanEscalationAlert> = [...args]; values[1] ??= ctx.now; return claimWorkspaceHumanEscalationAlert(...values) ?? null; } },
+  "runtimeTail.pruneStaleWorkspaceHumanEscalationAlerts": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof pruneStaleWorkspaceHumanEscalationAlerts>, ctx) => { const values: Parameters<typeof pruneStaleWorkspaceHumanEscalationAlerts> = [...args]; values[0] ??= ctx.now; return pruneStaleWorkspaceHumanEscalationAlerts(...values) ?? null; } },
+  "runtimeTail.reelectRepoSteward": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof reelectRepoSteward>) => reelectRepoSteward(...args) ?? null },
+  "runtimeTail.upsertTokenProfile": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof upsertTokenProfile>, ctx) => { const values: Parameters<typeof upsertTokenProfile> = [...args]; values[1] ??= ctx.now; return upsertTokenProfile(...values) ?? null; } },
+  "runtimeTail.updateTokenProfile": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof updateTokenProfile>) => updateTokenProfile(...args) ?? null },
+  "runtimeTail.deleteTokenProfile": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof deleteTokenProfile>) => deleteTokenProfile(...args) ?? null },
+  "runtimeTail.cancelPendingCommand": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof cancelPendingCommand>, ctx) => { const values: Parameters<typeof cancelPendingCommand> = [...args]; values[3] ??= ctx.now; return cancelPendingCommand(...values) ?? null; } },
+  "runtimeTail.fencePublishForPush": { offLoop: true, idempotent: false, serializeIdempotencyResult: value => value ? redactCommandSecrets(value as import("../types").Command) : null, fn: (args: Parameters<typeof fencePublishForPush>) => fencePublishForPush(...args) ?? null },
+  "runtimeTail.writeEntry": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof writeEntry>) => writeEntry(...args) ?? null },
+  "runtimeTail.refreshPendingLandQueueLease": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof refreshPendingLandQueueLease>, ctx) => { const values: Parameters<typeof refreshPendingLandQueueLease> = [...args]; values[1] ??= ctx.now; return refreshPendingLandQueueLease(...values) ?? null; } },
+  "runtimeTail.upsertIntegrationRegistry": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof upsertIntegrationRegistry>, ctx) => { const values: Parameters<typeof upsertIntegrationRegistry> = [...args]; values[1] ??= ctx.now; return upsertIntegrationRegistry(...values) ?? null; } },
+  "runtimeTail.ingestIntegrationEvent": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof ingestIntegrationEvent>) => ingestIntegrationEvent(...args) ?? null },
+  "runtimeTail.acquireMergeLease": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof acquireMergeLease>) => acquireMergeLease(...args) ?? null },
+  "runtimeTail.acquireMergePause": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof acquireMergePause>) => acquireMergePause(...args) ?? null },
+  "runtimeTail.promoteLineageCapturedResponse": { offLoop: true, idempotent: false, fn: (args: [Parameters<typeof promoteLineageCapturedResponse>[0]]) => {
+    const deferred: NonNullable<Parameters<typeof promoteLineageCapturedResponse>[1]> = [];
+    return { result: promoteLineageCapturedResponse(args[0], deferred), deferred };
+  } },
+  "runtimeTail.setProjectJournalFields": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof setProjectJournalFields>, ctx) => { const values: Parameters<typeof setProjectJournalFields> = [...args]; values[1] ??= ctx.now; return setProjectJournalFields(...values) ?? null; } },
+  "runtimeTail.upsertProjectTrustApproval": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof upsertProjectTrustApproval>, ctx) => { const values: Parameters<typeof upsertProjectTrustApproval> = [...args]; values[1] ??= ctx.now; return upsertProjectTrustApproval(...values) ?? null; } },
+  "runtimeTail.pruneOrphanedSharedWorkspaces": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof pruneOrphanedSharedWorkspaces>) => pruneOrphanedSharedWorkspaces(...args) ?? null },
+  "runtimeTail.pruneWorkspaceOrphanAlerts": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof pruneWorkspaceOrphanAlerts>) => pruneWorkspaceOrphanAlerts(...args) ?? null },
+});

package/src/db/schema.ts

@@ -1,3 +1,5 @@
+import { COMMAND_RETENTION_SCHEMA } from "./command-retention";
+import { TOKEN_USAGE_RETENTION_SCHEMA } from "./token-usage-retention";
 import { DURABLE_PAYLOAD_SCHEMA } from "./durable-payloads"; import { PLAN_IMPORT_SCHEMA_SQL } from "./plan-import-schema";
 import { PROJECT_ROOTS_SCHEMA } from "./project-root-schema";
 import { seedBuiltInTokenProfiles } from "../token-db";
@@ -964,7 +966,6 @@ export function initDb(path: string = "agent-relay.db"): Database {
       shutdown_requested_at INTEGER
     );
     CREATE INDEX IF NOT EXISTS idx_automation_runs_automation ON automation_runs(automation_id, created_at);
-    CREATE INDEX IF NOT EXISTS idx_automation_runs_status ON automation_runs(status);
     CREATE INDEX IF NOT EXISTS idx_automation_runs_task ON automation_runs(task_id);
 
     CREATE TABLE IF NOT EXISTS task_events (
@@ -1264,6 +1265,8 @@ export function initDb(path: string = "agent-relay.db"): Database {
     ${PLAN_IMPORT_SCHEMA_SQL};
     ${IDLE_DIGEST_SCHEMA_SQL};
     ${TASK_TOKEN_TOTALS_SCHEMA};
+    ${TOKEN_USAGE_RETENTION_SCHEMA};
+    ${COMMAND_RETENTION_SCHEMA};
     ${LONG_RUNNING_WORK_SCHEMA};
     ${SHIPPING_STATS_SCHEMA};
     ${OPERATOR_ACTIONS_SCHEMA};

package/src/db/spawn-budget.ts

@@ -45,6 +45,11 @@ function observedTokens(agentIds: string[]): ObservedSubtreeSpend {
     COALESCE(SUM(usage_status IS NOT NULL), 0) AS unknownReports
     FROM session_token_usage WHERE agent_id IN (SELECT value FROM json_each(?))`)
     .get(ids) as { tokens: number; unknownReports: number };
+  const retired = getDb().query(`SELECT COALESCE(SUM(tokens), 0) AS tokens,
+    COALESCE(SUM(unknown_reports), 0) AS unknownReports FROM retired_token_usage_totals
+    WHERE agent_id IN (SELECT value FROM json_each(?))`).get(ids) as { tokens: number; unknownReports: number };
+  row.tokens += retired.tokens;
+  row.unknownReports += retired.unknownReports;
   const live = getDb().query(`SELECT COALESCE(SUM(status = 'busy'), 0) AS busyAgents,
     COALESCE(SUM(CASE WHEN json_valid(meta) THEN MAX(0, COALESCE(json_extract(meta, '$.unreportedTokenUsage'), 0)) ELSE 0 END), 0) AS unreportedReports
     FROM agents WHERE id IN (SELECT value FROM json_each(?))`)

package/src/db/spawn-delegation.ts

@@ -5,8 +5,6 @@ import { getPersistedAgentRuntimeCard as getAgent } from "./agent-card-read";
 import { getDb, ValidationError } from "./connection";
 import { runnerSpawnGrantForAgent } from "../runtime-grant";
 import { optionalNonNegativeInt } from "../validation";
-import { sameHostIdentity } from "../utils";
-import { getOrchestrator } from "./orchestrators";
 import { stringValue } from "@humwick/sdk";
 import type { CreateCommandInput } from "../types";
 import { getLaunchFact } from "./launch-facts";
@@ -37,15 +35,7 @@ export function assertDelegatedSpawnTarget(input: CreateCommandInput) {
     return !agent || agent.status === "offline" || agent.meta?.lifecycleAction === "shutting-down";
   })) throw new ValidationError("SPAWN_SUBTREE_STOPPING: caller or ancestor has stopped");
   const projectId = delegatedProjectTarget(input, state);
-  const parentHost = stringValue(getAgent(parentId)?.machine);
-  const targetHost = stringValue(input.params?.orchestratorId);
-  if (parentHost && targetHost) {
-    // #3650: machine is the raw os.hostname() ("WBOX"); orchestrator identity is configured ("wbox"/"wbox-1").
-    const target = getOrchestrator(targetHost);
-    const sameHost = sameHostIdentity(parentHost, targetHost)
-      || (target && [target.id, target.hostname, target.agentId].some(identity => sameHostIdentity(identity, parentHost)));
-    if (!sameHost) throw new ValidationError("SPAWN_PROJECT_MISMATCH: delegated launches stay on their parent's host");
-  }
+  // #3769 — placement owns the host; delegatedProjectTarget checks its registered project checkout.
   if (state.depth === 1 && profile === "sub-coordinator") throw new ValidationError("SPAWN_DEPTH_EXCEEDED: sub-coordinators cannot delegate another coordinator");
   const workflow = Boolean(input.params?.workflowRunId);
   const grant = runnerSpawnGrantForAgent(parentId);

package/src/db/sql-audit-indexes.ts

@@ -44,6 +44,9 @@ export const SQL_AUDIT_INDEXES = [
   `CREATE INDEX IF NOT EXISTS idx_task_events_land_workspace ON task_events(json_extract(metadata, '$.workspaceId'))
     WHERE type = 'deliverable' AND json_extract(metadata, '$.land.requested') = 1`,
   LAND_WITHDRAWN_INDEX_SQL,
+  // #3779 spawnRequestId -> Task resolution (every register/land/deliver auth check): a full task_events scan blocked the loop.
+  `CREATE INDEX IF NOT EXISTS idx_task_events_spawn_request ON task_events(json_extract(metadata, '$.spawnRequestId'))
+    WHERE type = 'agent.spawn_requested'`,
   `CREATE INDEX IF NOT EXISTS idx_task_events_land_bound_workspace ON task_events(${LAND_WORKSPACE_EXPRESSION})
     WHERE type = 'deliverable' AND json_extract(metadata, '$.land.requested') = 1`,
   `CREATE INDEX IF NOT EXISTS idx_task_events_deliverable_workspace ON task_events(${LAND_WORKSPACE_EXPRESSION}, task_id)

package/src/db/stats-async.ts

@@ -117,7 +117,9 @@ export function buildDbGatewayCheck(stats: DbGatewayStats): HealthCheck {
   const detail = [
     `writer=${stats.writerBackend}`,
     `reader=${stats.readerBackend}`,
-    `onLoopOps=${specs.length - offLoop}; writerThreadOps=${offLoop}`,
+    // #3798 — the op split counts executed writes; the registered op definitions are named as such.
+    `onLoopOps=${stats.writer.onLoopOps}; writerThreadOps=${stats.writer.writerThreadOps}`,
+    `opDefinitions onLoop=${specs.length - offLoop} offLoop=${offLoop}`,
     `mainConnectionWrites1h=${JSON.stringify(writes)}`,
     ...(wedged ? [`writer wedged: op ${wedged.op} running ${Math.round(wedged.runningMs / 1000)}s`] : []),
     ...(shedCount > 0 ? [`${shedCount} reader shed(s)`] : []),
@@ -128,8 +130,8 @@ export function buildDbGatewayCheck(stats: DbGatewayStats): HealthCheck {
     deployRole: "load",
     detail,
     metrics: {
-      onLoopOps: specs.length - offLoop,
-      writerThreadOps: offLoop,
+      onLoopOps: stats.writer.onLoopOps,
+      writerThreadOps: stats.writer.writerThreadOps,
       mainConnectionWrites1h: Object.values(writes).reduce((sum, count) => sum + count, 0),
       mainConnectionBootWrites: mainConnectionBootWrites(),
       writerQueued: stats.writer.queued,

package/src/db/task-entity.ts

@@ -1085,14 +1085,15 @@ export function deliverableTaskIdsByOwnerAgent(agentId: string): number[] {
 // event (recorded BEFORE the child registers) carries the spawnRequestId. The landing worker's
 // `meta.spawnRequestId` resolves back through it to the Task. Returns every matching task id so a
 // reused spawnRequestId can't silently drop a link.
+export const TASK_IDS_BY_SPAWN_REQUEST_SQL = `SELECT DISTINCT te.task_id AS id FROM task_events te INDEXED BY idx_task_events_spawn_request
+            JOIN tasks t ON t.id = te.task_id AND t.kind = '${DELIVERABLE_TASK_KIND}'
+            WHERE te.type = 'agent.spawn_requested' AND json_extract(te.metadata, '$.spawnRequestId') = ?
+            ORDER BY te.task_id ASC`;
 export function deliverableTaskIdsBySpawnRequestId(spawnRequestId: string): number[] {
   const cleaned = spawnRequestId?.trim();
   if (!cleaned) return [];
   return (getDb()
-    .query(`SELECT DISTINCT te.task_id AS id FROM task_events te
-            JOIN tasks t ON t.id = te.task_id AND t.kind = '${DELIVERABLE_TASK_KIND}'
-            WHERE te.type = 'agent.spawn_requested' AND json_extract(te.metadata, '$.spawnRequestId') = ?
-            ORDER BY te.task_id ASC`)
+    .query(TASK_IDS_BY_SPAWN_REQUEST_SQL)
     .all(cleaned) as Array<{ id: number }>)
     .map((r) => r.id);
 }

package/src/db/team-claim-policy.ts

@@ -0,0 +1,60 @@
+import { STALE_TTL_MS } from "../config";
+import { getAgent } from "./agents";
+import { countLiveTeamMembers, getTeam, claimTeamWithAdoption, isClaimableTeam } from "./teams";
+import type { Team } from "../types";
+export class TeamAuthError extends Error {}
+export class TeamNotFoundError extends Error {}
+function lineageRootForAgent(agentId: string): string | undefined {
+  let current = getAgent(agentId);
+  const seen = new Set<string>();
+  while (current) {
+    if (seen.has(current.id)) return undefined;
+    seen.add(current.id);
+    if (!current.spawnedBy) return current.id;
+    current = getAgent(current.spawnedBy);
+  }
+  return undefined;
+}
+
+function coordinatorIsLive(team: Team): boolean {
+  if (!team.coordinatorId) return false;
+  const coordinator = getAgent(team.coordinatorId);
+  if (!coordinator || coordinator.status === "offline") return false;
+  if (coordinator.teamId === team.id) return countLiveTeamMembers(team.id, Date.now() - STALE_TTL_MS) > 0;
+  return coordinator.lastSeen > Date.now() - STALE_TTL_MS;
+}
+
+/** How a claim was authorized — carried into the audit trail so an orphan takeover is
+ * distinguishable from a routine same-lineage reclaim. */
+export type TeamClaimMode = "admin" | "same-lineage" | "orphan-takeover";
+
+// #1454 — live owners require same-lineage authority; dead owners permit orphan takeover.
+
+function assertCanClaimTeam(admin: boolean, team: Team, callerAgentId: string): TeamClaimMode {
+  const caller = getAgent(callerAgentId);
+  const callerTeam = caller?.teamId ? getTeam(caller.teamId) : null;
+  if (!admin && callerTeam?.parentTeamId && team.id !== callerTeam.id) {
+    throw new TeamAuthError("a sub-coordinator may claim only its own private team");
+  }
+  const callerRoot = lineageRootForAgent(callerAgentId);
+  const teamRoot = team.rootCoordinatorId ?? team.coordinatorId;
+  // Same-lineage reclaim is the routine fast path (a replacement spawned under the original
+  // founder) and stays allowed regardless of owner liveness.
+  if (callerRoot && teamRoot && callerRoot === teamRoot) return "same-lineage";
+  if (admin) return "admin";
+  // #1454 orphan takeover: a replacement coordinator of a DIFFERENT lineage may adopt the team only
+  // when its owning coordinator is not live (offline, or stale past the heartbeat TTL). This is the
+  // sole security boundary for the cross-lineage path — a healthy owner is never displaced.
+  if (!coordinatorIsLive(team)) return "orphan-takeover";
+  throw new TeamAuthError(`caller ${callerAgentId} cannot claim team ${team.id}`);
+}
+
+
+export function claimAuthorizedTeam(teamId: string, agentId: string, admin: boolean) {
+  if (!isClaimableTeam(getTeam(teamId))) throw new TeamNotFoundError(`active team ${teamId} not found`);
+  let captured: { mode: TeamClaimMode; priorCoordinatorId: string | null } | undefined;
+  const result = claimTeamWithAdoption(teamId, agentId, team => {
+    captured = { mode: assertCanClaimTeam(admin, team, agentId), priorCoordinatorId: team.coordinatorId ?? null };
+  });
+  return { ...result, ...captured! };
+}

package/src/db/teams-async.ts

@@ -56,3 +56,7 @@ export function setTeamBriefAsync(input: Parameters<typeof setTeamBrief>[0]): Pr
 export function dissolveTeamAsync(teamId: string, input?: Parameters<typeof dissolveTeam>[1], requestId: string = randomUUID()): Promise<ReturnType<typeof dissolveTeam>> {
   return getGateway().write("teams.dissolve", { teamId, input }, { idempotencyKey: requestId }) as unknown as Promise<ReturnType<typeof dissolveTeam>>;
 }
+
+export function ensureTeamAsync(agentId: string, opts: { projectId?: string } = {}): Promise<NonNullable<ReturnType<typeof getTeam>>> {
+  return write("teams.ensure", { agentId, id: `team_${randomUUID()}`, ...opts });
+}

package/src/db/teams-write-ops.ts

@@ -1,3 +1,5 @@
+import { claimAuthorizedTeam } from "./team-claim-policy";
+import { ensureTeamInternal } from "./teams";
 // Team writer operations. Guards that were formerly adjacent sync statements now execute inside
 // the writer transaction; async callers submit a main-thread generated id and never rely on worker
 // process-local state.
@@ -10,6 +12,8 @@ import {
 import type { WriterOpContext, WriterOpSpec } from "./write-ops.ts";
 
 export const TEAMS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
+  "teams.ensure": { offLoop: true, idempotent: true, fn: (a: { agentId: string; id: string; projectId?: string }, ctx) => ensureTeamInternal(a.agentId, a.id, ctx.now, false, a.projectId ?? null) },
+  "teams.claimAuthorized": { offLoop: true, idempotent: true, fn: (a: { teamId: string; agentId: string; admin: boolean }) => claimAuthorizedTeam(a.teamId, a.agentId, a.admin) },
   "teams.zeroMembers.set": { offLoop: true, idempotent: true, fn: (a: { teamId: string; ts: number }) => setTeamZeroMembersSince(a.teamId, a.ts) },
   "teams.zeroMembers.clear": { offLoop: true, idempotent: true, fn: (a: { teamId: string }, ctx) => clearTeamZeroMembersSince(a.teamId, ctx.now) },
   "teams.brief.set": { offLoop: true, idempotent: true, fn: (a: Parameters<typeof setTeamBrief>[0], ctx) => setTeamBrief(a, ctx.now) },