@humwick/server 0.130.2 → 0.130.3

package/src/startup-context-injection.ts

@@ -1,3 +1,5 @@
+import { setConfigAsync } from "./config-store-write";
+import { createCommandAsync } from "./commands-write";
 import { contextInjectUnsupported, launchContextIsUserMessage, launchContextSurvivesCompact, launchSystemPromptAppend } from "./context-injection-channel";
 import { stripAgentCore } from "@humwick/sdk/prompt-template-defaults";
 import { renderAgentCore } from "./agent-core";
@@ -26,10 +28,10 @@ import { renderAgentCore } from "./agent-core";
 //    inputs are gathered by the shared `resolveAgentSpawnInstructionInputs` (spawn-instruction-
 //    inputs.ts), the same resolver the restart projection uses, so the two cannot drift.
 //
-//  • DELTA-GATED AT COMPACT. A native compact PRESERVES the system prompt, so an unchanged
-//    block is skipped (hashed; launch prompt read for the first boundary, like the memory
-//    seam). No skip when launch text rides user messages (OpenCode family, Codex: compaction
-//    drops them) or on `clear`. Re-injects on persistent-system-prompt providers strip the
+//  • DELTA-GATED AT CLEAR AND COMPACT. A persistent system prompt survives both a native compact
+//    and a /clear, so an unchanged block is skipped (hashed; launch prompt read, like the memory
+//    seam; #3782). No skip when launch text rides user messages (OpenCode family, Codex:
+//    compaction drops them). Re-injects on persistent-system-prompt providers strip the
 //    core (their context re-delivers it); the rest re-injects.
 //
 // PROVIDER-AGNOSTIC: delivery is an `agent.injectContext` command (declared `context.inject`); a
@@ -38,15 +40,14 @@ import { renderAgentCore } from "./agent-core";
 
 import { createHash } from "node:crypto";
 import { errMessage, isRelayInjectionCategory, stringValue } from "@humwick/sdk";
-import { createCommand, findLaunchPromptCommandForAgent } from "./commands-db";
+import { findLaunchPromptCommandForAgent } from "./commands-db";
 import { emitCommandEvent } from "./command-events";
 import { REAP_INTERVAL_MS } from "./config";
-import { getConfig, setConfig } from "./config-store";
+import { getConfig } from "./config-store";
 import { agentPrincipalUserId, findMessageByIdempotencyKey, getAgent } from "./db";
 import { resolveCanonicalHost } from "./host-identity";
 import { memorySeamForAgent } from "./memory-seam";
-import { stripMemoryPreamble } from "./memory-preamble";
-import { composeSpawnInstructionsWithEvents, stripHumwickIdentitySection, type ComposedSpawnInstructions } from "./project-instructions";
+import { composeSpawnInstructionsWithEvents, stripRelayOwnedSections, type ComposedSpawnInstructions } from "./project-instructions";
 import { resolveAgentSpawnInstructionInputs } from "./services/spawn-instruction-inputs";
 import { INJECTION_SWEEP_BACKLOG_INTERVAL_MS, pacedInjectionSweep } from "./injection-sweep-pacing";
 import { isSqliteBusyError } from "./db/connection";
@@ -106,8 +107,8 @@ export function readStartupContextInjectionState(agentId: string): StartupContex
   return getConfig<StartupContextInjectionState>(STARTUP_CONTEXT_NAMESPACE, agentId)?.value ?? null;
 }
 
-export function recordStartupContextInjectionState(agentId: string, state: StartupContextInjectionState): void {
-  setConfig(STARTUP_CONTEXT_NAMESPACE, agentId, state, "startup-context-injection");
+export async function recordStartupContextInjectionState(agentId: string, state: StartupContextInjectionState): Promise<void> {
+  (await setConfigAsync(STARTUP_CONTEXT_NAMESPACE, agentId, state, "startup-context-injection"));
 }
 
 /** #2171 — the machine this agent runs on, named the way the spawn named it (see the call site).
@@ -163,12 +164,14 @@ export function composeStartupContextForAgent(agent: AgentCard): ComposedSpawnIn
  * A prior inject rode the summarized transcript, so the recorded delivery hash proves delivery,
  * not survival — trusting it lets a summarized-away block skip forever. The launch prompt rode
  * the preserved system prompt, so only it proves the block is still there. Unresolvable ⇒ null
- * ⇒ re-inject, never skip. (Mirrors launchBakedMemoryHash/launchBakedJournalHash.)
+ * ⇒ re-inject, never skip. (Mirrors launchBakedMemoryHash/launchBakedJournalHash.) The strip must
+ * remove EVERY relay-owned section (identity, memory, journal): a leftover journal block made this
+ * hash never match a real coordinator launch, so every /clear re-injected the full charter (#3782).
  */
 function launchBakedStartupHash(agent: AgentCard): string | null {
   const prompt = launchSystemPromptAppend(findLaunchPromptCommandForAgent(agent.id, stringValue(agent.meta?.spawnRequestId)));
   if (!prompt) return null;
-  const portion = normalizeStartupBlock(stripHumwickIdentitySection(stripMemoryPreamble(prompt)));
+  const portion = normalizeStartupBlock(stripRelayOwnedSections(prompt));
   return portion ? startupBlockHash(portion) : null;
 }
 
@@ -180,7 +183,7 @@ function launchBakedStartupHash(agent: AgentCard): string | null {
  * outcome (unchanged block, provider cannot inject, nothing composable, nothing to inject), always
  * reported in a `relay-injection` event rather than inferred from silence.
  */
-export function enqueueStartupContextInjectionAfterContextCommand(command: Command, now: number = Date.now()): Command | null {
+export async function enqueueStartupContextInjectionAfterContextCommand(command: Command, now: number = Date.now()): Promise<Command | null> {
   // A lifecycle command's status is the runner's confirmation verdict, not proof that the
   // destructive boundary did not happen. In particular, a clear-inject that cannot confirm its
   // `/clear` may have committed and is deliberately settled failed so the continuation beside this
@@ -197,28 +200,29 @@ export function enqueueStartupContextInjectionAfterContextCommand(command: Comma
   const composed = composeStartupContextForAgent(agent);
 
   if (contextInjectUnsupported(agent)) {
-    emitStartupSkip(agent, event, "inject-unsupported", command, now);
+    (await emitStartupSkip(agent, event, "inject-unsupported", command, now));
     return null;
   }
   if (!composed) {
     // No profile prompt to recompose (not a spawn provider). Reported once so an operator can tell
     // it apart from a broken seam.
-    emitStartupSkip(agent, event, "not-composable", command, now);
+    (await emitStartupSkip(agent, event, "not-composable", command, now));
     return null;
   }
 
   const block = composed.systemPromptAppend?.trim() ? composed.systemPromptAppend : "";
   const hash = startupBlockHash(block);
   if (!block) {
-    emitStartupSkip(agent, event, "nothing-to-inject", command, now);
+    (await emitStartupSkip(agent, event, "nothing-to-inject", command, now));
     return null;
   }
 
-  // A native compact preserves a real system prompt, but not launch text parts. An unchanged block is already there. A clear
-  // destroys the context — nothing survives it to be unchanged. User-message launch providers keep neither reliably
-  // (Codex keeps only recent user messages), so compact always re-injects for them, like the summarizable family.
-  if (event === "compact" && launchContextSurvivesCompact(agent) && launchBakedStartupHash(agent) === hash) {
-    emitStartupSkip(agent, event, "unchanged", command, now);
+  // #3782 — a persistent system prompt (Claude's --append-system-prompt) survives BOTH a native
+  // compact and a /clear, so a block still equal to the launch-baked one is already above: skip.
+  // A changed charter (hash differs), an unresolvable launch prompt, or a provider whose launch
+  // text rides summarizable parts / user messages (OpenCode, Codex) re-injects at either boundary.
+  if (launchContextSurvivesCompact(agent) && launchBakedStartupHash(agent) === hash) {
+    (await emitStartupSkip(agent, event, "unchanged", command, now));
     return null;
   }
 
@@ -233,7 +237,7 @@ export function enqueueStartupContextInjectionAfterContextCommand(command: Comma
   // Delivered WITH the superseding note; hashed and gated on the canonical block (note excluded), so
   // the gate cannot loop.
   const content = `${STARTUP_CONTEXT_SUPERSEDE_NOTICE}\n\n${injectBlock}`;
-  const inject = createCommand({
+  const inject = (await createCommandAsync({
     type: "agent.injectContext",
     source: "system",
     target: command.target,
@@ -252,13 +256,13 @@ export function enqueueStartupContextInjectionAfterContextCommand(command: Comma
         ...(command.type === "agent.clearContext" ? { afterClearCommandId: command.id } : { afterCompactCommandId: command.id }),
       },
     },
-  });
+  }));
   emitCommandEvent(inject, "command.requested");
 
   // Anti-lie: queueing a command is not injecting a charter. The detailed per-block "injected"
   // events move to settleStartupContextInjectionCommand, where the runner has reported success.
   // This one row makes pending work visible without claiming the provider has it already.
-  emitRelayInjectionEvent({
+  (await emitRelayInjectionEvent({
     agentId: agent.id,
     category: "context",
     summary: `startup context re-injection queued after ${event}`,
@@ -273,7 +277,7 @@ export function enqueueStartupContextInjectionAfterContextCommand(command: Comma
     },
     timestamp: now,
     idempotencyKey: `startup-context-injection-queued:${agent.id}:${inject.id}`,
-  });
+  }));
   return inject;
 }
 
@@ -283,45 +287,45 @@ export function enqueueStartupContextInjectionAfterContextCommand(command: Comma
  * ownership and cwd→project resolution, so a throw here must NOT take the rest of the settle chain
  * down with it; it is reported on the agent's timeline instead.
  */
-export function settleStartupContextInjectionAfterContextCommand(command: Command, now: number = Date.now()): Command | null {
+export async function settleStartupContextInjectionAfterContextCommand(command: Command, now: number = Date.now()): Promise<Command | null> {
   try {
-    const inject = enqueueStartupContextInjectionAfterContextCommand(command, now);
-    settleStartupContextInjectionCommand(command, now);
+    const inject = (await enqueueStartupContextInjectionAfterContextCommand(command, now));
+    (await settleStartupContextInjectionCommand(command, now));
     return inject;
   } catch (error) {
-    emitRelayInjectionEvent({
+    (await emitRelayInjectionEvent({
       agentId: command.target,
       category: "context",
       summary: `startup-context re-injection failed to compose after ${command.type === "agent.compact" ? "compact" : command.type === "agent.clearContext" ? "clear" : command.type}: ${errMessage(error)}`,
       detail: { source: "startup-context", agentId: command.target, commandId: command.id, failed: true },
       timestamp: now,
       idempotencyKey: `startup-context-injection-error:${command.target}:${command.id}`,
-    });
+    }));
     return null;
   }
 }
 
-function emitStartupSkip(
+async function emitStartupSkip(
   agent: AgentCard,
   event: StartupContextInjectionEvent,
   skipped: StartupContextInjectionSkip,
   command: Command,
   now: number,
-): void {
+): Promise<void> {
   const summaries: Record<StartupContextInjectionSkip, string> = {
     unchanged: `startup context unchanged after ${event} — re-injection skipped`,
     "inject-unsupported": `startup context NOT re-injected after ${event}: provider declares context.inject:false (spawn-time block only)`,
     "nothing-to-inject": `startup context resolved nothing to inject after ${event}`,
     "not-composable": `startup context not recomposable after ${event}: agent has no spawn-provider profile prompt`,
   };
-  emitRelayInjectionEvent({
+  (await emitRelayInjectionEvent({
     agentId: agent.id,
     category: "context",
     summary: summaries[skipped],
     detail: { source: "startup-context", event, agentId: agent.id, skipped, commandId: command.id },
     timestamp: now,
     idempotencyKey: `startup-context-injection-skip:${agent.id}:${command.id}`,
-  });
+  }));
 }
 
 /**
@@ -331,7 +335,7 @@ function emitStartupSkip(
  * Recording on success makes the gate self-healing — a failed delivery leaves the previous hash and
  * the next boundary retries.
  */
-export function settleStartupContextInjectionCommand(command: Command, now: number = Date.now()): void {
+export async function settleStartupContextInjectionCommand(command: Command, now: number = Date.now()): Promise<void> {
   if (command.type !== "agent.injectContext" || command.status !== "succeeded") return;
   if (command.params.reason !== STARTUP_CONTEXT_INJECTION_REASON) return;
   const startup = command.params.startupContext;
@@ -339,12 +343,12 @@ export function settleStartupContextInjectionCommand(command: Command, now: numb
   const record = startup as Record<string, unknown>;
   const hash = typeof record.hash === "string" ? record.hash : undefined;
   if (hash === undefined) return;
-  recordStartupContextInjectionState(command.target, {
+  (await recordStartupContextInjectionState(command.target, {
     hash,
     event: record.event === "clear" ? "clear" : "compact",
     at: now,
-  });
-  emitStartupContextDeliveredEvents(command, record, now);
+  }));
+  (await emitStartupContextDeliveredEvents(command, record, now));
 }
 
 /** Preserve only enough of the composition for the success-side audit event. The actual charter
@@ -379,12 +383,12 @@ function queuedStartupBlockEvents(record: Record<string, unknown>): Array<{ cate
   });
 }
 
-function emitStartupContextDeliveredEvents(command: Command, record: Record<string, unknown>, now: number): void {
+async function emitStartupContextDeliveredEvents(command: Command, record: Record<string, unknown>, now: number): Promise<void> {
   const event: StartupContextInjectionEvent = record.event === "clear" ? "clear" : "compact";
   const boundaryCommandId = stringValue(record.afterClearCommandId) ?? stringValue(record.afterCompactCommandId) ?? command.correlationId;
   for (const [index, blockEvent] of queuedStartupBlockEvents(record).entries()) {
     const source = stringValue(blockEvent.detail.source) ?? "startup-context";
-    emitRelayInjectionEvent({
+    (await emitRelayInjectionEvent({
       agentId: command.target,
       category: blockEvent.category,
       summary: `re-injected after ${event}: ${blockEvent.summary}`,
@@ -397,26 +401,26 @@ function emitStartupContextDeliveredEvents(command: Command, record: Record<stri
       },
       timestamp: now,
       idempotencyKey: `startup-context-injection-delivered:${command.target}:${command.id}:${source}:${index}`,
-    });
+    }));
   }
 }
 
 /** A failed startup-context composer must not make a maintenance tick throw or block every later
  * candidate. The reactive settle has the same containment in its public wrapper. */
-function containedStartupContextInjection(command: Command, now: number): { inject: Command | null; composeFailed: boolean } {
+async function containedStartupContextInjection(command: Command, now: number): Promise<{ inject: Command | null; composeFailed: boolean }> {
   try {
-    return { inject: enqueueStartupContextInjectionAfterContextCommand(command, now), composeFailed: false };
+    return { inject: (await enqueueStartupContextInjectionAfterContextCommand(command, now)), composeFailed: false };
   } catch (error) {
     // #2712 — a held write lock is contention, not a compose failure: defer, never count it.
     if (isSqliteBusyError(error)) throw error;
-    emitRelayInjectionEvent({
+    (await emitRelayInjectionEvent({
       agentId: command.target,
       category: "context",
       summary: `startup-context re-injection failed to compose after ${command.type === "agent.compact" ? "compact" : "clear"}: ${errMessage(error)}`,
       detail: { source: "startup-context", agentId: command.target, commandId: command.id, failed: true },
       timestamp: now,
       idempotencyKey: `startup-context-injection-error:${command.target}:${command.id}`,
-    });
+    }));
     return { inject: null, composeFailed: true };
   }
 }
@@ -428,11 +432,11 @@ function containedStartupContextInjection(command: Command, now: number): { inje
  * prompt's context; collapsing the two would silently strand the clear's charter recovery. The
  * shared attempt ledger is keyed by boundary correlation id, so it is both the idempotency fence
  * and the retry state — there is no second per-agent collapse to keep in sync with it. */
-export function sweepMissedStartupContextInjections(now: number = Date.now(), signal?: AbortSignal): { enqueuedCommandIds: string[]; aborted?: true } {
+export async function sweepMissedStartupContextInjections(now: number = Date.now(), signal?: AbortSignal): Promise<{ enqueuedCommandIds: string[]; aborted?: true }> {
   const enqueuedCommandIds: string[] = [];
   for (const command of sweepableBoundaryCommands(now, signal)) {
     if (signal?.aborted) break;
-    sweepStartupBoundary(command, now, enqueuedCommandIds);
+    (await sweepStartupBoundary(command, now, enqueuedCommandIds));
   }
   return { enqueuedCommandIds, ...(signal?.aborted ? { aborted: true as const } : {}) };
 }
@@ -441,24 +445,24 @@ export function sweepMissedStartupContextInjections(now: number = Date.now(), si
  *  macrotask each. */
 async function sweepMissedStartupContextInjectionsPaced(now: number, signal?: AbortSignal): Promise<{ enqueuedCommandIds: string[]; aborted?: true; moreWork?: true }> {
   const enqueuedCommandIds: string[] = [];
-  const { moreWork } = await pacedInjectionSweep(() => sweepableBoundaryCommands(now, signal), (command) => sweepStartupBoundary(command, now, enqueuedCommandIds), signal);
+  const { moreWork } = await pacedInjectionSweep(() => sweepableBoundaryCommands(now, signal), async (command) => (await sweepStartupBoundary(command, now, enqueuedCommandIds)), signal);
   return { enqueuedCommandIds, ...(signal?.aborted ? { aborted: true as const } : {}), ...(moreWork ? { moreWork: true as const } : {}) };
 }
 
-function sweepStartupBoundary(command: Command, now: number, enqueuedCommandIds: string[]): void {
+async function sweepStartupBoundary(command: Command, now: number, enqueuedCommandIds: string[]): Promise<void> {
   const { decision, attempts } = injectionAttemptDecision(command, STARTUP_CONTEXT_INJECTION_REASON);
   if (decision === "in-flight") return;
   if (decision === "exhausted") {
-    notifyStartupContextInjectionExhausted(command, attempts, now);
+    (await notifyStartupContextInjectionExhausted(command, attempts, now));
     return;
   }
   if (attempts === 0 && (startupSweepAlreadyDecided(command) || startupBoundaryAlreadyDecided(command))) return;
-  const { inject, composeFailed } = containedStartupContextInjection(command, now);
+  const { inject, composeFailed } = (await containedStartupContextInjection(command, now));
   if (inject) {
     enqueuedCommandIds.push(inject.id);
     return;
   }
-  rememberStartupSweepDecision(command, composeFailed, now);
+  (await rememberStartupSweepDecision(command, composeFailed, now));
 }
 
 /**
@@ -477,32 +481,32 @@ function startupSweepAlreadyDecided(command: Command): boolean {
   return sweptStartupBoundaryDecisions.get(command.id)?.done ?? false;
 }
 
-function rememberStartupSweepDecision(command: Command, composeFailed: boolean, now: number): void {
+async function rememberStartupSweepDecision(command: Command, composeFailed: boolean, now: number): Promise<void> {
   const held = sweptStartupBoundaryDecisions.get(command.id);
   const composeFailures = (held?.composeFailures ?? 0) + (composeFailed ? 1 : 0);
   const done = !composeFailed || composeFailures >= MAX_INJECTION_ATTEMPTS;
   if (sweptStartupBoundaryDecisions.size >= MAX_SWEPT_STARTUP_DECISIONS && !held) sweptStartupBoundaryDecisions.clear();
   sweptStartupBoundaryDecisions.set(command.id, { composeFailures, done });
-  if (composeFailed && done) notifyStartupContextInjectionExhausted(command, composeFailures, now, "compose");
+  if (composeFailed && done) (await notifyStartupContextInjectionExhausted(command, composeFailures, now, "compose"));
 }
 
 function startupBoundaryAlreadyDecided(command: Command): boolean {
   return findMessageByIdempotencyKey(command.target, `startup-context-injection-skip:${command.target}:${command.id}`) !== null;
 }
 
-function notifyStartupContextInjectionExhausted(command: Command, attempts: number, now: number, kind: "delivery" | "compose" = "delivery"): void {
+async function notifyStartupContextInjectionExhausted(command: Command, attempts: number, now: number, kind: "delivery" | "compose" = "delivery"): Promise<void> {
   const idempotencyKey = `startup-context-injection-exhausted${kind === "compose" ? "-compose" : ""}:${command.target}:${command.id}`;
   if (findMessageByIdempotencyKey(command.target, idempotencyKey)) return;
   const event = command.type === "agent.compact" ? "compact" : "clear";
   const what = kind === "compose" ? "failed to compose" : "could not be delivered";
-  emitRelayInjectionEvent({
+  (await emitRelayInjectionEvent({
     agentId: command.target,
     category: "context",
     summary: `startup-context re-injection gave up after ${attempts} attempt(s) at a ${event} boundary — it ${what}, so this agent may be running without its current profile charter`,
     detail: { source: "startup-context", agentId: command.target, commandId: command.id, event, attempts, exhausted: kind },
     timestamp: now,
     idempotencyKey,
-  });
+  }));
 }
 
 export const STARTUP_CONTEXT_INJECTION_SWEEP_JOB = {

package/src/steward-handoff.ts

@@ -1,6 +1,7 @@
+import { mergeAgentMetaAsync } from "./db/agents-async";
 import { stringValue } from "@humwick/sdk";
 import { getManagedAgentState, getSpawnPolicy } from "./config-store";
-import { getAgent, getWorkspace, listWorkspaces, mergeAgentMeta, patchWorkspaceMetadataAsync } from "./db";
+import { getAgent, getWorkspace, listWorkspaces, patchWorkspaceMetadataAsync } from "./db";
 import { agentGenerationKey } from "./db/agent-shutdown-in-flight";
 import { getLifecycleManager } from "./lifecycle-manager";
 import { isProvenStewardAgent, stewardHandoffReleased } from "./steward-provenance";
@@ -23,6 +24,6 @@ export async function finishWorkspaceStewardHandoff(workspace: WorkspaceRecord):
   if (!boundAgent && !boundSpawn && claimant !== agent.id) return;
   await patchWorkspaceMetadataAsync(workspace.id, { stewardClaim: null, stewardHandoffEndedAt: Date.now() });
   if (listWorkspaces().some(ws => ws.id !== workspace.id && workspaceActiveClaim(ws)?.by === agent.id)) return;
-  const command = getLifecycleManager().stopAgent(policy, true, "steward-handoff-ended");
-  if (command) mergeAgentMeta(agent.id, { stewardReleasedGeneration: agentGenerationKey(agent) }, { instanceId: agent.instanceId, epoch: agent.epoch });
+  const command = await getLifecycleManager().stopAgent(policy, true, "steward-handoff-ended");
+  if (command) (await mergeAgentMetaAsync(agent.id, { stewardReleasedGeneration: agentGenerationKey(agent) }, { instanceId: agent.instanceId, epoch: agent.epoch }));
 }

package/src/steward-policy-cleanup.ts

@@ -1,3 +1,4 @@
+import { setConfigAsync, deleteConfigAsync } from "./config-store-write";
 // #1955 — ONE-SHOT, IDEMPOTENT cleanup of the steward spawn-policy rows a live relay accumulated
 // before #1623/#1953/#1955. Pure planning here; `scripts/steward-policy-cleanup.ts` is the operator
 // CLI (DRY RUN by default). Nothing in the running relay calls this — it is deliberately manual,
@@ -21,7 +22,7 @@
 // so a second run over the applied state plans nothing. Safe to re-run.
 
 import { canonicalRepoRoot, legacyStewardPolicyNames, repoStewardPolicyName } from "./steward-identity";
-import { deleteConfig, getSpawnPolicy, listSpawnPolicies, setConfig } from "./config-store";
+import { getSpawnPolicy, listSpawnPolicies } from "./config-store";
 import { listWorkspaces } from "./db";
 import { basename } from "node:path";
 import type { SpawnPolicy } from "./types";
@@ -151,10 +152,10 @@ export interface StewardPolicyCleanupResult {
  * precondition, so a plan built against a state the live relay has since changed degrades to a skip
  * rather than clobbering the newer row.
  */
-export function applyStewardPolicyCleanup(
+export async function applyStewardPolicyCleanup(
   plan: StewardPolicyCleanupPlan,
   opts: { dryRun: boolean; updatedBy?: string },
-): StewardPolicyCleanupResult {
+): Promise<StewardPolicyCleanupResult> {
   const updatedBy = opts.updatedBy ?? "steward-policy-cleanup-1955";
   const log: string[] = [];
   let applied = 0;
@@ -184,9 +185,9 @@ export function applyStewardPolicyCleanup(
         // A stop recorded on EITHER half survives the merge — never lift an operator's stop (same
         // rule as the provision-time collapse in steward.ts).
         if (action.carriesStop && into.enabled !== false) {
-          setConfig("spawn-policy", into.name, { ...into, enabled: false }, updatedBy);
+          (await setConfigAsync("spawn-policy", into.name, { ...into, enabled: false }, updatedBy));
         }
-        deleteConfig("spawn-policy", action.policy, updatedBy);
+        (await deleteConfigAsync("spawn-policy", action.policy, updatedBy));
         applied++;
       }
       continue;
@@ -199,8 +200,8 @@ export function applyStewardPolicyCleanup(
       }
       log.push(`RENAME  ${action.policy} -> ${action.into} (cwd ${action.cwdFrom} -> ${action.cwdTo})`);
       if (!opts.dryRun) {
-        setConfig("spawn-policy", action.into, { ...current, name: action.into, ...repoDerivedFields(action.repoRoot) }, updatedBy);
-        deleteConfig("spawn-policy", action.policy, updatedBy);
+        (await setConfigAsync("spawn-policy", action.into, { ...current, name: action.into, ...repoDerivedFields(action.repoRoot) }, updatedBy));
+        (await deleteConfigAsync("spawn-policy", action.policy, updatedBy));
         applied++;
       }
       continue;
@@ -213,7 +214,7 @@ export function applyStewardPolicyCleanup(
     }
     log.push(`CWD     ${action.policy}: ${action.cwdFrom} -> ${action.cwdTo}`);
     if (!opts.dryRun) {
-      setConfig("spawn-policy", action.policy, { ...current, ...repoDerivedFields(action.repoRoot) }, updatedBy);
+      (await setConfigAsync("spawn-policy", action.policy, { ...current, ...repoDerivedFields(action.repoRoot) }, updatedBy));
       applied++;
     }
   }

package/src/steward.ts

@@ -153,7 +153,7 @@ async function collapseLegacyStewardPolicies(canonicalName: string, repoRoot: st
     }
     if (legacy.enabled === false) inheritedEnabled = false;
     await deleteConfigAsync("spawn-policy", legacyName, "steward-legacy-collapse");
-    getLifecycleManager().onConfigChanged("spawn-policy", legacyName);
+    (await getLifecycleManager().onConfigChanged("spawn-policy", legacyName));
     console.warn(`[steward] collapsed legacy steward policy '${legacyName}' into '${canonicalName}' (#1955)`);
   }
   return inheritedEnabled;
@@ -195,6 +195,6 @@ export async function ensureRepoStewardAsync(repoRoot: string, owningOrchestrato
   if (existing && !stewardPolicyDiffers(existing.value, desired)) return name;
 
   await setConfigAsync("spawn-policy", name, desired, "steward-autoprovision");
-  getLifecycleManager().onConfigChanged("spawn-policy", name);
+  (await getLifecycleManager().onConfigChanged("spawn-policy", name));
   return name;
 }

package/src/task-dispatch-live.ts

@@ -5,18 +5,20 @@ import { listOrchestratorsAsync } from "./db/orchestrators-async";
 import { listHostViewsAsync } from "./db/hosts-async";
 import { providerQuotaBandsFor, advertisedProvidersFrom } from "./spawn-targets";
 import { dispatchPolicyFor } from "./routing-policy-store";
-import { providerPlacementReady } from "./spawn-placement";
+import { providerPlacementReady, spawnHostCapAdmission } from "./spawn-placement";
 import { apiOverflowContextAsync, CLAUDE_API_PROVIDER } from "./claude-api-overflow";
 import { apiExpiryPaceAsync } from "./claude-api-expiry";
 import { liveTargetAdmission } from "./dispatch-availability";
 
 /** Reader-gateway shell for production callers. The ranking core remains the pure sync function. */
-export type DispatchSnapshot = DispatchContext & Required<Pick<DispatchContext, "now" | "catalog" | "bands" | "policy" | "preferences" | "advertisedProviders" | "targetAvailable">> & { probeUncertainty: Set<string> };
+export type DispatchSnapshot = DispatchContext & Required<Pick<DispatchContext, "now" | "catalog" | "bands" | "policy" | "preferences" | "advertisedProviders" | "targetAvailable">> & { probeUncertainty: Set<string>; pinnedHostAtAgentCap?: boolean };
 
 export async function captureDispatchContext(ctx: Omit<DispatchContext, "policy" | "bands" | "catalog"> = {}): Promise<DispatchSnapshot> {
   const now = ctx.now ?? Date.now();
   const [snapshot, orchestrators, hostViews] = await Promise.all([providerQuotaRoutingSnapshotAsync(now), listOrchestratorsAsync(), listHostViewsAsync()]);
   const { targetAdmission: assess, targetUnavailableReason } = liveTargetAdmission(orchestrators, hostViews, snapshot.catalog, ctx.orchestratorId, ctx.spawnCap);
+  const pinnedHost = orchestrators.find(host => host.id === ctx.orchestratorId);
+  const pinnedView = pinnedHost && hostViews.find(view => view.id === pinnedHost.hostId);
   const probeUncertainty = new Set<string>();
   const targetAdmission = (target: Parameters<typeof assess>[0]) => {
     const result = assess(target);
@@ -42,6 +44,7 @@ export async function captureDispatchContext(ctx: Omit<DispatchContext, "policy"
     targetUnavailableReason,
     targetAdmission,
     probeUncertainty,
+    pinnedHostAtAgentCap: Boolean(pinnedView && spawnHostCapAdmission(ctx.spawnCap)(pinnedView)),
     bands,
     policy: dispatchPolicyFor(snapshot.policy),
     catalog: snapshot.catalog,

package/src/task-dispatcher.ts

@@ -1,4 +1,4 @@
-import { isOpenAiApiModel } from "@humwick/sdk";
+import { isOpenAiApiModel, ValidationError } from "@humwick/sdk";
 // #839 — the declarative task dispatcher.
 //
 // A pure function from (Task work-shape + live system state) → a concrete spawn
@@ -311,7 +311,7 @@ export function dispatchTask(shape: TaskDispatch | undefined, pin: DispatchPin =
     if (ctx.mustResolveAvailable && bandRank(bandFor(target.provider, bands)) > bandRank("normal")) warnings.push(`[CRITICAL] mustResolveAvailable: degraded to ${target.provider} (${bandFor(target.provider, bands)} band). Contention likely.`);
   }
   if (ctx.targetAvailable && !ctx.targetAvailable(target)) {
-    throw new Error(ctx.targetUnavailableReason?.(target) ?? `No eligible online host runs ${target.provider}/${target.model ?? "default"}${target.effort ? ` at effort ${target.effort}` : ""}.`);
+    throw new ValidationError(ctx.targetUnavailableReason?.(target) ?? `No eligible online host runs ${target.provider}/${target.model ?? "default"}${target.effort ? ` at effort ${target.effort}` : ""}.`);
   }
   if (factors.preferences) factors.preferences = { ...factors.preferences, excluded: preferenceExclusions(preferences, factors.ranking, (p) => eligibility(p) ?? (!advertised.has(p) ? "not-advertised" : undefined)) };
   // Record the FINAL provider's band + the chosen model's window for transparency.

package/src/token-db.ts

@@ -324,8 +324,8 @@ export function getTokenProfile(id: string): TokenProfile | null {
   return row ? rowToProfile(row) : null;
 }
 
-export function upsertTokenProfile(input: CreateTokenProfileInput): TokenProfile {
-  const now = Date.now();
+export function upsertTokenProfile(input: CreateTokenProfileInput, submittedAt: number = Date.now()): TokenProfile {
+  const now = submittedAt;
   const id = input.id ?? slugify(input.name);
   const existing = getTokenProfile(id);
   if (existing?.builtIn) throw new Error("built-in token profiles cannot be modified");

package/src/token-usage-async.ts

@@ -5,12 +5,10 @@ import type { Message } from "./types";
 // of src/db directly (the transport-thinness ratchet, #348).
 import { getGateway } from "./db/gateway.ts";
 import type { SpawnBudgetReadback, WorkflowRunBudgetReadback } from "./db/spawn-budget.ts";
-import type { aggregateSessionTokenUsage, recordSessionTokenUsage, SessionTokenUsageAggregate, SessionTokenUsageRecord } from "./db/token-usage.ts";
+import type { aggregateSessionTokenUsage, recordSessionTokenUsage, SessionTokenUsageAggregate } from "./db/token-usage.ts";
 
 export const recordSessionTokenUsageAsync = async (input: Parameters<typeof recordSessionTokenUsage>[0]) => {
-  const { budgetNotices, ...result } = await getGateway().write("tokenUsage.record", { input }, { critical: false }) as unknown as {
-    record: SessionTokenUsageRecord;
-    inserted: boolean;
+  const { budgetNotices, ...result } = await getGateway().write("tokenUsage.record", { input }, { critical: false }) as unknown as ReturnType<typeof recordSessionTokenUsage> & {
     budgetNotices: Message[];
   };
   publishBudgetNotices(budgetNotices);

package/src/user-awaiting-reply.ts

@@ -1,7 +1,7 @@
+import { framed } from "./hub-metrics";
 import { userSinkId, canonicalHumanAgentId } from "@humwick/sdk";
 import { listUsers } from "./db/users";
-import { listPendingReplyObligationsAsync } from "./db/message-reads-async";
-import { getLatestMessageIdAsync } from "./db/message-reads-async";
+import { listPendingReplyObligationsAsync, getLatestMessageIdAsync } from "./db/message-reads-async";
 import { optedInNotificationRecipients } from "./db/notification-subscriptions";
 import { routeNotification } from "./notification-router";
 import { subscribeRelayEvents } from "./events";
@@ -12,7 +12,7 @@ export async function reconcileUserAwaitingReply(previous?: string): Promise<str
   const [pending, latestId] = await Promise.all([Promise.all(listUsers().map(user => listPendingReplyObligationsAsync(canonicalHumanAgentId(userSinkId(user.id)), 1, true))).then(rows => rows.flat()), getLatestMessageIdAsync()]);
   const signature = JSON.stringify([recipients, pending.length > 0]);
   if (signature === previous) return signature;
-  routeNotification({
+  await routeNotification({
     type: "user.awaiting_reply", scope: {}, recipients: [],
     message: {
       body: pending.length ? "The operator has an unanswered message." : "The operator has no unanswered messages.",
@@ -30,13 +30,13 @@ export function startUserAwaitingReply(): () => void {
   const unsubscribe = subscribeRelayEvents(event => {
     if (event.type.startsWith("message.") && event.data.to !== "hue:office") dirty = true;
   });
-  const timer = setInterval(() => {
+  const timer = setInterval(framed("timer user-awaiting-reply", () => {
     ticks++;
     if ((!dirty && ticks % 30 !== 0) || running) return;
     dirty = false; running = true;
     void reconcileUserAwaitingReply(signature).then(value => { signature = value; }).catch(error => {
       dirty = true; console.error("user.awaiting_reply reconciliation failed", error);
     }).finally(() => { running = false; });
-  }, 1000);
+  }), 1000);
   return () => { clearInterval(timer); unsubscribe(); };
 }