@humwick/server 0.130.2 → 0.130.3

package/src/services/managed-running.ts

@@ -12,13 +12,13 @@
 // Composed by `registerAgent` (HTTP + bus registration) and called directly by the
 // orchestrator-report projection in lifecycle-manager. It does NOT upsert the agent
 // row — the agent registers itself over HTTP/bus; this only reconciles managed state.
-import { createActivityEvent, resolveQueuedDirectMessages, resolveQueuedPolicyMessages } from "../db";
-import { getManagedAgentState, updateManagedAgentState } from "../config-store";
+import { createActivityEventAsync } from "../db";
+import { getManagedAgentState } from "../config-store";
 import { emitRelayEvent } from "../events";
 import { emitMessageAvailable, emitMessageDeliveryUpdated, emitNewMessage } from "../sse";
 import type { AuthContext } from "./auth-context";
 import type { ManagedAgentState, Message } from "../types";
-import { resolveQueuedCoordinatorMessages } from "../db/coordinator-delivery.ts";
+import { updateManagedAgentStateAsync, resolveQueuedDirectMessagesAsync, resolveQueuedPolicyMessagesAsync, resolveQueuedCoordinatorMessagesAsync } from "../db/lifecycle-tail-async";
 
 interface ManagedRunningInput {
   policyName?: string;
@@ -44,11 +44,11 @@ interface ManagedRunningInput {
  *  - the managed-state change emits via `emitManagedState` (source "lifecycle-manager"
  *    + an activity-feed transition row), never the source-"server" `emitManagedAgentStateChanged`.
  */
-export function markManagedAgentRunning(
+export async function markManagedAgentRunning(
   input: ManagedRunningInput,
   ctx: AuthContext,
   opts: { now?: () => number } = {},
-): void {
+): Promise<void> {
   if (!input.policyName || !input.spawnRequestId) return;
   // #1797 — the reconcile REBINDS `managed_agent_state.agent_id` (and, via
   // `updateManagedAgentState`, the retained `last_agent_id`), which `managedStewardBoundAgentId` →
@@ -88,7 +88,7 @@ export function markManagedAgentRunning(
   const now = opts.now ?? (() => Date.now());
 
   const fromState = state.status;
-  const patch: Parameters<typeof updateManagedAgentState>[1] = {
+  const patch: Parameters<typeof updateManagedAgentStateAsync>[1] = {
     status: "running",
     agentId: input.agentId || state.agentId,
     tmuxSession: input.tmuxSession ?? state.tmuxSession,
@@ -101,11 +101,11 @@ export function markManagedAgentRunning(
   };
   // #3615 — repeated roster reports still flush queued messages, without rewriting running state.
   if (Object.entries(patch).some(([key, value]) => state[key as keyof ManagedAgentState] !== value)) {
-    const next = updateManagedAgentState(input.policyName, patch);
-    if (next) emitManagedState(next, fromState);
+    const next = await updateManagedAgentStateAsync(input.policyName, patch);
+    if (next) await emitManagedState(next, fromState);
   }
 
-  const available = resolveQueuedPolicyMessages(input.policyName, input.agentId || state.agentId || "");
+  const available = await resolveQueuedPolicyMessagesAsync(input.policyName, input.agentId || state.agentId || "");
   if (available.length) {
     emitMessageAvailable(input.policyName, input.agentId || state.agentId || "", available);
     for (const message of available) {
@@ -126,31 +126,31 @@ export function markManagedAgentRunning(
 // the came-up-running op.
 let transitionSeq = 0;
 
-export function emitManagedState(
+export async function emitManagedState(
   state: ManagedAgentState,
   fromState: string | undefined,
   reason?: string,
   now: () => number = () => Date.now(),
-): void {
+): Promise<void> {
   emitRelayEvent({
     type: "policy.state.changed",
     source: "lifecycle-manager",
     subject: state.policyName,
     data: state as unknown as Record<string, unknown>,
   });
-  if (fromState !== state.status) recordManagedTransition(state, fromState, reason, now);
+  if (fromState !== state.status) await recordManagedTransition(state, fromState, reason, now);
 }
 
-function recordManagedTransition(
+async function recordManagedTransition(
   state: ManagedAgentState,
   fromState: string | undefined,
   reason: string | undefined,
   now: () => number,
-): void {
+): Promise<void> {
   const why = reason ?? state.lastError ?? undefined;
   // #1912 §4 retained: this is shared by synchronous registration, restart settlement, and
   // orchestrator-report projection. Its transition + queue flush need one future async redesign.
-  createActivityEvent({
+  await createActivityEventAsync({
     clientId: `lifecycle-${state.policyName}-${state.status}-${now()}-${++transitionSeq}`,
     kind: "state",
     title: `${state.policyName}: ${fromState ?? "—"} → ${state.status}`,
@@ -177,8 +177,8 @@ function recordManagedTransition(
  * No-op when there are no queued direct messages. Returns the flushed messages so
  * callers (e.g. the resweep safety net, #706) can report how many were recovered.
  */
-export function flushQueuedDirectMessages(agentId: string): Message[] {
-  const available = [...resolveQueuedDirectMessages(agentId), ...resolveQueuedCoordinatorMessages(agentId)];
+export async function flushQueuedDirectMessages(agentId: string): Promise<Message[]> {
+  const available = [...await resolveQueuedDirectMessagesAsync(agentId), ...await resolveQueuedCoordinatorMessagesAsync(agentId)];
   if (!available.length) return [];
   emitMessageAvailable("direct", agentId, available);
   for (const message of available) {

package/src/services/memory-areas.ts

@@ -4,7 +4,7 @@
 
 import { AREAS_FILE, SYSTEM_AREAS, SYSTEM_AREA_DESCRIPTIONS, areasAtCommit, injectsAtStartup, isSystemArea, type AreaDefinition, type AreasConfig } from "@humwick/sdk/areas";
 import { stringValue } from "@humwick/sdk";
-import { countActivePinnedEntriesInArea, getAgent, ValidationError } from "../db";
+import { countActivePinnedEntriesInAreaAsync, getAgent, ValidationError } from "../db";
 import type { Project, ProjectEntry } from "../types";
 import type { AuthContext } from "./auth-context";
 import { callerHost, callerProjectId } from "./memory-identity";
@@ -125,10 +125,10 @@ export async function resolveWriteAreas(
 /** When a written entry reaches agents, by its areas. An entry the startup block does not carry
  *  arrives when an agent first touches a path area it names (#3409, #3508). A pinned `project-wide`
  *  entry loads into every agent's startup block, so its write reports how many the cell carries. */
-export function areaDeliveryReport(entry: ProjectEntry): { deliveredOnTouch?: true; projectWideActive?: number; note?: string } {
+export async function areaDeliveryReport(entry: ProjectEntry): Promise<{ deliveredOnTouch?: true; projectWideActive?: number; note?: string }> {
   if (!injectsAtStartup(entry)) return entry.areas?.some((area) => !isSystemArea(area)) ? { deliveredOnTouch: true } : {};
   if (!entry.areas?.includes(PROJECT_WIDE)) return {};
-  const projectWideActive = countActivePinnedEntriesInArea(entry.projectId, PROJECT_WIDE);
+  const projectWideActive = await countActivePinnedEntriesInAreaAsync(entry.projectId, PROJECT_WIDE);
   return {
     projectWideActive,
     note: `${projectWideActive} active project-wide entries load into every agent's startup block; prefer a path or process area when one fits.`,

package/src/services/merge-pause.ts

@@ -1,11 +1,5 @@
-import {
-  acquireMergePause as acquireMergePauseRow,
-  getMergePause,
-  listMergePauses,
-  releaseMergePause as releaseMergePauseRow,
-  renewMergePause as renewMergePauseRow,
-  type MergePauseRecord,
-} from "../db";
+import { acquireMergePauseAsync as acquireMergePauseRowAsync, renewMergePauseAsync as renewMergePauseRowAsync, releaseMergePauseAsync as releaseMergePauseRowAsync } from "../db/runtime-tail-async";
+import { getMergePause, listMergePauses, type MergePauseRecord } from "../db";
 
 export type { MergePauseRecord };
 
@@ -17,21 +11,21 @@ export function getAutoMergePause(id: string): MergePauseRecord | null {
   return getMergePause(id);
 }
 
-export function pauseAutoMerge(input: {
+export async function pauseAutoMerge(input: {
   repoRoot: string;
   baseRef?: string;
   holder: string;
   reason?: string;
   ttlMs?: number;
   now?: number;
-}): { ok: true; pause: MergePauseRecord } | { ok: false; pause: MergePauseRecord } {
-  return acquireMergePauseRow(input);
+}): Promise<{ ok: true; pause: MergePauseRecord } | { ok: false; pause: MergePauseRecord }> {
+  return (await acquireMergePauseRowAsync(input));
 }
 
-export function renewAutoMergePause(id: string, ttlMs?: number): MergePauseRecord | null {
-  return renewMergePauseRow(id, ttlMs);
+export async function renewAutoMergePause(id: string, ttlMs?: number): Promise<MergePauseRecord | null> {
+  return (await renewMergePauseRowAsync(id, ttlMs));
 }
 
-export function resumeAutoMerge(input: { id?: string; repoRoot?: string; baseRef?: string }): boolean {
-  return releaseMergePauseRow(input);
+export async function resumeAutoMerge(input: { id?: string; repoRoot?: string; baseRef?: string }): Promise<boolean> {
+  return (await releaseMergePauseRowAsync(input));
 }

package/src/services/operator-decisions.ts

@@ -1,17 +1,20 @@
+import { withdrawOpenOperatorDecisionAsync, updateOpenOperatorDecisionAsync } from "../db/runtime-tail-async";
+import { randomUUID } from "node:crypto";
+import { getGateway } from "../db/gateway";
+import type { answerOperatorDecisionBody } from "../db/operator-answer-write";
+import type { SendMessageInput } from "../types";
 import { workflowDecisionAnswer } from "./workflow-decision-answer";
 import { getWorkflowOperatorDecision } from "../db/operator-decisions";
 import { actingUserSinkOf } from "./auth-context";
 import { DecisionNotFoundError, authorizeDecision } from "./decision-audience";
 // #2885 — operator decisions: a coordinator files a structured question for the operator; the
 // answer goes back as ONE message to `coordinator:<teamId>`, so whoever holds the seat gets it.
-import { coordinatesActiveTeam, getAgent, getOperatorDecision, insertOperatorDecision, listOperatorDecisions, answerOpenOperatorDecision,
-  setOperatorDecisionAnswerMessage, updateOpenOperatorDecision, withdrawOpenOperatorDecision, writeTransaction, ValidationError,
-  type OperatorDecisionContent } from "../db";
+import { coordinatesActiveTeam, getAgent, getOperatorDecision, insertOperatorDecision, listOperatorDecisions, answerOpenOperatorDecision, setOperatorDecisionAnswerMessage, writeTransaction, ValidationError, type OperatorDecisionContent } from "../db";
 import { acquireCoordinatorTeam } from "./team";
 import { emitRelayEvent } from "../events";
 import { emitNotificationCreated, notificationForDecision } from "../dashboard-notifications";
 import { cleanStringArray, optionalEnum, optionalString, stringField } from "../validation";
-import { sendMessageService } from "./send-message";
+import { validateSendMessageAuthorization, emitSendResults } from "./send-message";
 import type { AuthContext } from "./auth-context";
 import { ServiceAuthError } from "./errors";
 import { OPERATOR_ACTION_DONE, OPERATOR_ACTION_NOT_DONE, OPERATOR_ACTION_OUTCOME_ID, OPERATOR_DECISION_KINDS, OPERATOR_DECISION_QUESTION_KINDS,
@@ -129,12 +132,12 @@ function emitDecisionChanged(decision: OperatorDecision): void {
 }
 
 /** The team the caller coordinates. `mint` lets a teamless coordinator-capable caller found one. */
-export function callerDecisionTeam(ctx: AuthContext, mint: boolean): string {
+export async function callerDecisionTeam(ctx: AuthContext, mint: boolean): Promise<string> {
   const agentId = ctx.callerAgentId;
   if (!agentId) throw new ServiceAuthError("relay_decision needs a single caller agent identity");
   const agent = getAgent(agentId);
   if (agent?.teamId && coordinatesActiveTeam(agentId, agent.teamId)) return agent.teamId;
-  if (mint && agent && !agent.teamId && ctx.scopes.includes("command:spawn")) return acquireCoordinatorTeam(agentId).id;
+  if (mint && agent && !agent.teamId && ctx.scopes.includes("command:spawn")) return (await acquireCoordinatorTeam(agentId)).id;
   throw new ServiceAuthError("decisions belong to a team's coordinator; you do not coordinate an active team (a replacement claims it with relay_team_claim)");
 }
 
@@ -144,12 +147,12 @@ export function teamDecision(teamId: string, id: number): OperatorDecision {
   return decision;
 }
 
-function insertFiledDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now: number, workflow?: OperatorDecision["workflow"], coordinatorNote?: string): OperatorDecision {
+async function prepareFiledDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now: number, workflow?: OperatorDecision["workflow"], coordinatorNote?: string): Promise<Parameters<typeof insertOperatorDecision>[0]> {
   const content = cleanDecisionContent(args, undefined, Boolean(workflow));
   // Each input keeps its own bound; appending a valid note must not reject a valid context (#3586).
   if (coordinatorNote) content.context = [content.context, `Coordinator note: ${coordinatorNote}`].filter(Boolean).join("\n\n");
-  const teamId = callerDecisionTeam(ctx, true);
-  return insertOperatorDecision({ ...content, teamId, ...(projectId ? { projectId } : {}), filedBy: ctx.callerAgentId!, now, ...(workflow ? { workflow } : {}) });
+  const teamId = (await callerDecisionTeam(ctx, true));
+  return { ...content, teamId, ...(projectId ? { projectId } : {}), filedBy: ctx.callerAgentId!, now, ...(workflow ? { workflow } : {}) };
 }
 
 function publishFiledDecision(decision: OperatorDecision): OperatorDecision {
@@ -158,22 +161,23 @@ function publishFiledDecision(decision: OperatorDecision): OperatorDecision {
   return decision;
 }
 
-export function fileDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now = Date.now()): OperatorDecision {
-  return publishFiledDecision(insertFiledDecision(ctx, args, projectId, now));
+export async function fileDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now = Date.now()): Promise<OperatorDecision> {
+  const input = await prepareFiledDecision(ctx, args, projectId, now);
+  return publishFiledDecision(await getGateway().write("operatorDecisions.insert", input, { idempotencyKey: randomUUID() }) as unknown as OperatorDecision);
 }
 
-export function updateDecision(ctx: AuthContext, id: number, args: Record<string, unknown>, now = Date.now()): OperatorDecision {
-  const current = teamDecision(callerDecisionTeam(ctx, false), id);
+export async function updateDecision(ctx: AuthContext, id: number, args: Record<string, unknown>, now = Date.now()): Promise<OperatorDecision> {
+  const current = teamDecision((await callerDecisionTeam(ctx, false)), id);
   if (current.workflow && args.questions !== undefined) throw new ValidationError("workflow choices are frozen for this step activation");
-  if (!updateOpenOperatorDecision(id, cleanDecisionContent(args, current), now)) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
+  if (!(await updateOpenOperatorDecisionAsync(id, cleanDecisionContent(args, current), now))) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
   const updated = getOperatorDecision(id)!;
   emitDecisionChanged(updated);
   return updated;
 }
 
-export function withdrawDecision(ctx: AuthContext, id: number, now = Date.now()): OperatorDecision {
-  const current = teamDecision(callerDecisionTeam(ctx, false), id);
-  if (!withdrawOpenOperatorDecision(id, now)) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
+export async function withdrawDecision(ctx: AuthContext, id: number, now = Date.now()): Promise<OperatorDecision> {
+  const current = teamDecision((await callerDecisionTeam(ctx, false)), id);
+  if (!(await withdrawOpenOperatorDecisionAsync(id, now))) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
   const withdrawn = getOperatorDecision(id)!;
   emitDecisionChanged(withdrawn);
   return withdrawn;
@@ -201,7 +205,7 @@ function renderAnswerBody(decision: OperatorDecision, answers: OperatorDecisionA
  * transaction: a crash or a refused send can never leave an answered row without its message.
  * The message never expires (maxAgeSeconds null), so a seat vacant for days still receives it.
  */
-export function answerDecision(ctx: AuthContext, id: number, input: { answers: unknown; note?: unknown }, now = Date.now()): { decision: OperatorDecision; messageId: number } {
+export async function answerDecision(ctx: AuthContext, id: number, input: { answers: unknown; note?: unknown }, now = Date.now()): Promise<{ decision: OperatorDecision; messageId: number }> {
   if (ctx.callerAgentId) throw new ServiceAuthError("operator decisions are answered by the operator, not by an agent");
   const current = getOperatorDecision(id);
   if (!current) throw new DecisionNotFoundError(`decision #${id} not found`);
@@ -216,21 +220,16 @@ export function answerDecision(ctx: AuthContext, id: number, input: { answers: u
     throw new ValidationError(`note required: say why you could not do it (${OPERATOR_ACTION_NOT_DONE})`);
   }
   const answeredBy = ctx.actor.kind === "component" ? ctx.actor.id : actingUserSinkOf(ctx);
-  const sent = writeTransaction(() => {
-    if (!answerOpenOperatorDecision(id, { answers, ...(note ? { note } : {}), answeredBy, now })) {
-      throw new DecisionConflictError(`decision #${id} was answered or withdrawn meanwhile`);
-    }
-    const { message, publish } = sendMessageService({
-      from: actingUserSinkOf(ctx), to: current.teamId.startsWith("host-privacy:") || current.teamId === "vault-expiry:global" ? current.filedBy : `coordinator:${current.teamId}`, body: renderAnswerBody(current, answers, note),
-      idempotencyKey: `decision:${id}:answer`, maxAgeSeconds: null, meta: { decisionId: id },
-    }, ctx, { deferLiveEffects: true });
-    setOperatorDecisionAnswerMessage(id, message.id);
-    return { messageId: message.id, publish };
-  });
-  // Live effects only after COMMIT: a rolled-back answer must never have been delivered (#2887).
-  sent.publish?.();
-  const { messageId } = sent;
-  const decision = getOperatorDecision(id)!;
+  const message: SendMessageInput = {
+    from: actingUserSinkOf(ctx), to: current.teamId.startsWith("host-privacy:") || current.teamId === "vault-expiry:global" ? current.filedBy : `coordinator:${current.teamId}`, body: renderAnswerBody(current, answers, note),
+    idempotencyKey: `decision:${id}:answer`, maxAgeSeconds: null, meta: { decisionId: id },
+  };
+  validateSendMessageAuthorization(message, ctx);
+  const written = await getGateway().write("operatorDecisions.answer", { id, answer: { answers, ...(note ? { note } : {}), answeredBy, now }, message }, { critical: true }) as unknown as ReturnType<typeof answerOperatorDecisionBody>;
+  if (!written) throw new DecisionConflictError(`decision #${id} was answered or withdrawn meanwhile`);
+  const { decision, result } = written;
+  (await emitSendResults([result]));
+  const messageId = result.message.id;
   emitDecisionChanged(decision);
   return { decision, messageId };
 }
@@ -244,17 +243,14 @@ export function cleanWorkflowAnswers(decision: Pick<OperatorDecision, "questions
 }
 
 /** The effect identity and filing share a transaction, so replay cannot create another card. */
-export function fileWorkflowDecision(ctx: AuthContext, args: Record<string, unknown>, workflow: NonNullable<OperatorDecision["workflow"]>, projectId?: string, coordinatorNote?: string): OperatorDecision {
+export async function fileWorkflowDecision(ctx: AuthContext, args: Record<string, unknown>, workflow: NonNullable<OperatorDecision["workflow"]>, projectId?: string, coordinatorNote?: string): Promise<OperatorDecision> {
   const note = optionalString(coordinatorNote, "note", MAX_TEXT);
-  const filed = writeTransaction(() => {
-    const existing = getWorkflowOperatorDecision(workflow.effectId);
-    if (existing) return { decision: existing, created: false };
-    return { decision: insertFiledDecision(ctx, args, projectId, Date.now(), workflow, note), created: true };
-  });
+  const input = await prepareFiledDecision(ctx, args, projectId, Date.now(), workflow, note);
+  const filed = await getGateway().write("operatorDecisions.fileWorkflow", input) as unknown as { decision: OperatorDecision; created: boolean };
   return filed.created ? publishFiledDecision(filed.decision) : filed.decision;
 }
 
-export function withdrawWorkflowDecision(effectId: string): void {
+export async function withdrawWorkflowDecision(effectId: string): Promise<void> {
   const decision = getWorkflowOperatorDecision(effectId);
-  if (decision && withdrawOpenOperatorDecision(decision.id, Date.now())) emitDecisionChanged(getOperatorDecision(decision.id)!);
+  if (decision && (await withdrawOpenOperatorDecisionAsync(decision.id, Date.now()))) emitDecisionChanged(getOperatorDecision(decision.id)!);
 }

package/src/services/orchestrator-registration-recovery.ts

@@ -4,9 +4,13 @@ import { recoverOrchestratorLegacyLandings } from "./orchestrator-landing-recove
 import { resumeDeferredWorkflowCleanup } from "./workflow-deferred-cleanup";
 import { workflowTaskDelivered } from "./workflow-runs";
 
+/** #3826 — the workflow follow-up waits on the supervisor queue, so it runs after the register reply. Deferred
+ *  cleanup stays durable: a failed resume is retried by the next registration or hub boot. */
 export async function recoverRegisteredOrchestrator(orchestratorId: string): Promise<void> {
   await reconcileOrchestratorSchedulerCommands(orchestratorId);
-  await resumeDeferredWorkflowCleanup(orchestratorId);
-  await workflowTaskDelivered();
+  void fireAndForget(`[orchestrator] workflow cleanup resume for ${orchestratorId}`, async () => {
+    await resumeDeferredWorkflowCleanup(orchestratorId);
+    await workflowTaskDelivered();
+  });
   void fireAndForget(`[orchestrator] legacy landing recovery for ${orchestratorId}`, () => recoverOrchestratorLegacyLandings(orchestratorId));
 }

package/src/services/orchestrator-upgrade.ts

@@ -1,5 +1,7 @@
-import { getOrchestrator, setOrchestratorUpgradeState } from "../db";
-import { createCommand, getCommand, updateCommand } from "../commands-db";
+import { updateCommandAsync, createCommandAsync } from "../commands-write";
+import { setOrchestratorUpgradeStateAsync } from "../db/orchestrators-async";
+import { getOrchestrator } from "../db";
+import { getCommand } from "../commands-db";
 import { emitOrchestratorStatus } from "../sse";
 import { emitCommandEvent } from "../command-events";
 import type { ActivityEventInput } from "../types";
@@ -10,18 +12,18 @@ export const ORCH_UPGRADE_DEADLINE_MS = 5 * 60_000;
 // central provider-config rows (#465). The orchestrator reports its files via the
 // command result; the server seeds the rows (see patchCommand). Capability-gated so
 // pre-#465 orchestrators that lack the handler never get a command they'd reject.
-export function dispatchProviderConfigMigration(
+export async function dispatchProviderConfigMigration(
   orch: NonNullable<ReturnType<typeof getOrchestrator>>,
   requestedBy = "system",
-): ReturnType<typeof createCommand> | null {
+): Promise<ReturnType<typeof createCommandAsync> | null> {
   if (!orch.capabilities?.migrateProviderConfig) return null;
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "orchestrator.migrate-provider-config",
     source: "system",
     target: orch.agentId,
     ttlMs: 10 * 60_000,
     params: { orchestratorId: orch.id, requestedBy },
-  });
+  }));
   emitCommandEvent(command, "command.requested");
   return command;
 }
@@ -42,14 +44,14 @@ export async function reconcileOrchestratorUpgrade(
   // before retrying. The running process's gitSha is the artifact identity and must match too.
   if (reachedTarget && up.status === "succeeded" && up.error) {
     const { error: _previousError, ...successState } = up;
-    setOrchestratorUpgradeState(orch.id, successState);
+    (await setOrchestratorUpgradeStateAsync(orch.id, successState));
     emitOrchestratorStatus(orch.id);
     return;
   }
   if (reachedTarget && reported && (up.status === "pending" || up.status === "failed")) {
-    if (up.commandId) updateCommand(up.commandId, { status: "succeeded", result: { version: reported, ...(up.fromVersion ? { fromVersion: up.fromVersion } : {}) } });
+    if (up.commandId) (await updateCommandAsync(up.commandId, { status: "succeeded", result: { version: reported, ...(up.fromVersion ? { fromVersion: up.fromVersion } : {}) } }));
     const { error: _previousError, ...successState } = up;
-    setOrchestratorUpgradeState(orch.id, { ...successState, status: "succeeded", settledAt: Date.now() });
+    (await setOrchestratorUpgradeStateAsync(orch.id, { ...successState, status: "succeeded", settledAt: Date.now() }));
     await auditEvent({
       clientId: `server-orchestrator-upgraded-${orch.id}-${Date.now()}`,
       kind: "state",
@@ -62,12 +64,12 @@ export async function reconcileOrchestratorUpgrade(
     });
     // Upgrade settled — the orchestrator is now running new-enough code to handle
     // the provider-config migration, so seed the central rows from its local files (#465).
-    dispatchProviderConfigMigration(orch);
+    (await dispatchProviderConfigMigration(orch));
     emitOrchestratorStatus(orch.id);
   } else if (up.status === "pending" && Date.now() - up.requestedAt > ORCH_UPGRADE_DEADLINE_MS) {
     const errMsg = `upgrade timed out; orchestrator still reports ${reported ?? "unknown"} (wanted ${up.desiredVersion})`;
-    if (up.commandId) updateCommand(up.commandId, { status: "failed", error: errMsg });
-    setOrchestratorUpgradeState(orch.id, { ...up, status: "failed", settledAt: Date.now(), error: errMsg });
+    if (up.commandId) (await updateCommandAsync(up.commandId, { status: "failed", error: errMsg }));
+    (await setOrchestratorUpgradeStateAsync(orch.id, { ...up, status: "failed", settledAt: Date.now(), error: errMsg }));
     await auditEvent({
       clientId: `server-orchestrator-upgrade-failed-${orch.id}-${Date.now()}`,
       kind: "state",

package/src/services/permission-decision.ts

@@ -1,6 +1,6 @@
 import { isHumanAgentId } from "@humwick/sdk";
 import { randomUUID } from "node:crypto";
-import { createCommandInternal } from "../commands-db";
+import { createAgentControlAsync } from "../db/agent-control-async";
 import { emitCommandEvent } from "../command-events";
 import { ValidationError, createActivityEventAsync, getAgent } from "../db";
 import { agentProviderState } from "../provider-state";
@@ -66,7 +66,7 @@ export async function dispatchAgentPermissionDecision(
 ): Promise<AgentPermissionDecisionResult> {
   const agent = getAgent(input.agentId);
   if (!agent) throw new PermissionDecisionTargetError(`agent ${input.agentId} not found`);
-  authorizeShutdown(ctx, { agentId: agent.id, requestedVia: input.requestedVia });
+  (await authorizeShutdown(ctx, { agentId: agent.id, requestedVia: input.requestedVia }));
   assertControlEligible(agent);
 
   const pendingApprovalId = currentApprovalId(agent);
@@ -122,7 +122,8 @@ export async function dispatchAgentPermissionDecision(
   // Audit admission precedes the durable command, matching the other service-layer agent controls.
   const event = await createActivityEventAsync(activityInput);
   revalidatePendingApproval(agent, approvalId);
-  const command = createCommandInternal({ input: commandInput, id: commandId });
+  const { command: admitted } = await createAgentControlAsync({ agent, commandInput, commandId, approvalId });
+  const command = admitted!;
   emitCommandEvent(command, "command.requested");
   emitActivityEvent(event);
   return { approvalId, decision: input.decision, command };

package/src/services/plan-ci-notice.ts

@@ -46,7 +46,7 @@ export async function planCiNotice(run: WorkflowRunRecord, payload: Record<strin
   const to = plan && planNoticeTarget(plan);
   if (!to) return undefined;
   for (const incidentId of block.incidentIds) {
-    notifySystemMessage(to, {
+    await notifySystemMessage(to, {
       subject: `Plan ${plan.title ?? plan.id}: CI blocked`,
       body: `Plan ${plan.id}: T${run.taskId}, run ${run.id}, landed SHA ${block.sha}, is blocked by CI incident ${incidentId}. Fix the incident; Relay automatically retries each blocked run's exact landed SHA after clearance. Slots and dependents wait. relay_plan_get shows every blocked Task and run.`,
       idempotencyKey: `plan:${plan.id}:ci:${incidentId}`, replyExpected: false,

package/src/services/plan-conformance.ts

@@ -71,15 +71,15 @@ function cleanVerdictItems(value: unknown): PlanConformanceItem[] {
   });
 }
 
-export function emitPlanTaskEvents(events: PlanGraphTaskEvent[] | undefined): void {
+export async function emitPlanTaskEvents(events: PlanGraphTaskEvent[] | undefined): Promise<void> {
   for (const event of events ?? []) {
     emitTaskChanged(event.task, event.type);
     if (event.type === "task.created") {
       // A Task is created once, so a replayed aggregate write (its gateway result re-read) notifies once (#3660).
-      emitTaskSemanticNotification({ task: event.task, transition: "created", actor: event.actor, occurrenceKey: "created" });
+      await emitTaskSemanticNotification({ task: event.task, transition: "created", actor: event.actor, occurrenceKey: "created" });
     } else {
       const transition = taskTransitionForStatus(event.task.status, event.task.blockedBy);
-      if (transition) emitTaskSemanticNotification({ task: event.task, transition, actor: event.actor, occurrenceKey: undefined });
+      if (transition) await emitTaskSemanticNotification({ task: event.task, transition, actor: event.actor, occurrenceKey: undefined });
     }
   }
 }
@@ -100,6 +100,6 @@ export async function recordPlanConformance(input: { planId?: unknown; mainSha?:
   const mainShaCheck = await checkMainSha(planId, mainSha);
   const result = await recordPlanConformanceAsync({ planId, mainSha, mainShaCheck, items, actor });
   emitRelayEvent({ type: "plan.changed", source: actor, subject: result.plan.id, data: { plan: result.plan, actor } });
-  emitPlanTaskEvents(result.taskEvents);
+  await emitPlanTaskEvents(result.taskEvents);
   return { planId: result.plan.id, version: result.plan.version, verdict: result.verdict, completion: result.plan.completion, gapTaskIds: result.gapTaskIds, ...(result.reusedGapTaskIds.length ? { reusedGapTaskIds: result.reusedGapTaskIds } : {}), conformance: result.plan.conformance };
 }

package/src/services/plan-dispatch-policy.ts

@@ -1,5 +1,5 @@
 // #3660 — plan autopilot readiness and wake policy as pure rules over durable facts (slots, Tasks, runs).
-import { planSlotOccupies, type Plan, type PlanDispatchSlot, type PlanDispatchSlotStatus, type TaskDetail, type TaskTerminalStage } from "../types";
+import { planSlotOccupies, type Plan, type PlanNode, type PlanDispatchSlot, type PlanDispatchSlotStatus, type TaskDetail, type TaskTerminalStage } from "../types";
 import { taskTerminalStage } from "../task-completion";
 
 export interface PlanMember { nodeId: string; taskId: number }
@@ -12,13 +12,13 @@ export function planMembers(plan: Pick<Plan, "nodes">): PlanMember[] {
   });
 }
 
-/** Why a plan cannot be started, per node; empty when every node is a bound Task the dispatcher can run. */
+/** Only unfinished automatic work needs a Task; settled facts and manual gates are valid (#3819). */
 export function unsupportedPlanShape(plan: Pick<Plan, "nodes" | "acceptance">): string[] {
   const problems: string[] = [];
   if (!plan.acceptance?.length) problems.push("PLAN_ACCEPTANCE_REQUIRED: the auditor checks the plan's acceptance; add acceptance items");
   if (!plan.nodes.length) problems.push("UNSUPPORTED_PLAN_SHAPE: the plan has no nodes");
   const members = new Set(planMembers(plan).map((member) => member.nodeId));
-  const unbound = plan.nodes.filter((node) => !members.has(node.id)).map((node) => node.id);
+  const unbound = plan.nodes.filter((node) => node.status !== "landed" && node.statusSource !== "manual" && !members.has(node.id)).map((node) => node.id);
   if (unbound.length) problems.push(`UNSUPPORTED_PLAN_SHAPE: nodes ${unbound.join(", ")} are not bound to a Task (status-pinned or unbound nodes cannot be dispatched; create them with relay_task_create plan:{...})`);
   return problems;
 }
@@ -48,6 +48,13 @@ export function taskSucceeded(task: PrerequisiteTask | null, slot: Pick<PlanDisp
   return prerequisiteState(task, requiredStage).state === "satisfied";
 }
 
+/** Existing settled nodes are facts; a dispatched run still needs its verified result, including CI. */
+export function planNodeSettled(node: PlanNode, task: PrerequisiteTask | null, slot?: PlanDispatchSlot, requiredStage?: TaskTerminalStage): boolean {
+  if (node.statusSource === "manual") return node.status === "landed";
+  if (slot) return taskSucceeded(task, slot, requiredStage);
+  return node.status === "landed" || task?.status === "done" || task?.status === "canceled";
+}
+
 /** The stage an edge requires of its prerequisite; unnamed edges keep the original landed-on-main rule. */
 export function dependencyStage(task: Pick<TaskDetail, "dependsOnStages">, prerequisiteId: number): TaskTerminalStage {
   return task.dependsOnStages?.[String(prerequisiteId)] ?? "landed-on-main";