@humwick/server 0.130.2 → 0.130.4

package/src/db/lifecycle-tail-write-ops.ts

@@ -0,0 +1,62 @@
+import { createAgentControlBody, grantSelfEffortBody, type AgentControlWrite, type SelfEffortGrantWrite } from "./agent-control-write";
+import { redactCommandSecrets } from "../command-secrets";
+import { admitAgentActionBody, type AgentActionWrite } from "./agent-action-write";
+import { startBrowserBody, stopBrowserBody, type StartBrowserWrite } from "./browser-session-write";
+import { transitionBrowserSession } from "./browser-sessions";
+import { flushWorkFinalReportsFromQueue } from "./messages";
+import type { MessageWorkFinalitySource, Command } from "../types";
+import { insertOperatorDecision } from "./operator-decisions";
+import { persistAdvisoryContext } from "./lifecycle-context-write";
+import { createReviewPublishBody } from "./review-publish-write";
+import { answerOperatorDecisionBody, fileWorkflowDecisionBody } from "./operator-answer-write";
+import { observeEffortBody } from "./agent-effort-observe";
+import { recordContextResetBody, settleContextResetCarryBody } from "./context-carry-write";
+import { openRecoveryObligation, attachRecoveryCommand, type ContextResetFact } from "./context-reset-carry";
+import { clearAgentNotice, recordTerminalEvent } from "./terminal-events";
+import { recordCrashReport } from "./crash-reports";
+import { stampSpawnPrincipal } from "./agent-ownership";
+import { markSpawnRegistrationConfirmed } from "../commands-db";
+import { seedSpawnPromptMirror } from "./message-reads";
+import { resolveQueuedPolicyMessages, resolveQueuedDirectMessages } from "./delivery";
+import { resolveQueuedCoordinatorMessages } from "./coordinator-delivery";
+import { upsertManagedAgentState, updateManagedAgentState } from "../config-store";
+import { deleteWorkspace } from "./workspaces";
+import { addSubscription, removeSubscription, removeSubscriptionsForTask } from "./notification-subscriptions";
+import type { WriterOpSpec } from "./write-ops";
+
+export const LIFECYCLE_TAIL_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
+  "lifecycleTail.upsertManagedAgentState": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof upsertManagedAgentState>) => upsertManagedAgentState(...args) },
+  "agents.createControl": { offLoop: true, idempotent: false, fn: (a: AgentControlWrite, ctx) => createAgentControlBody(a, ctx.now), serializeIdempotencyResult: value => { const result = value as ReturnType<typeof createAgentControlBody>; return { ...result, ...(result.command ? { command: redactCommandSecrets(result.command) } : {}) }; } },
+  "agents.grantSelfEffort": { offLoop: true, idempotent: false, fn: (a: SelfEffortGrantWrite, ctx) => grantSelfEffortBody(a, ctx.now), serializeIdempotencyResult: value => redactCommandSecrets(value as import("../types").Command) },
+  "agents.admitAction": { offLoop: true, idempotent: false, serializeIdempotencyResult: value => { const result = value as ReturnType<typeof admitAgentActionBody>; return { ...result, command: redactCommandSecrets(result.command) }; }, fn: (args: AgentActionWrite, ctx) => admitAgentActionBody(args, ctx.now) },
+  "browser.start": { offLoop: true, idempotent: false, fn: (args: StartBrowserWrite, ctx) => startBrowserBody(args, ctx.now) },
+  "browser.stop": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof stopBrowserBody>[0], ctx) => stopBrowserBody(args, ctx.now) },
+  "browser.transition": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof transitionBrowserSession>) => transitionBrowserSession(...args) ?? null },
+  "notifications.subscriptions.addBatch": { offLoop: true, idempotent: false,
+    fn: (a: { inputs: Array<Parameters<typeof addSubscription>[0]> }, ctx) => a.inputs.map(input => addSubscription({ ...input, now: ctx.now })) },
+  "messages.flushWorkFinal": { offLoop: true, idempotent: true, fn: (a: { agentId: string; queue: number[]; source: MessageWorkFinalitySource; options: { includeStaleCompletedFinals?: boolean } }, ctx) => flushWorkFinalReportsFromQueue(a.agentId, a.queue, a.source, a.options, ctx.now) },
+  "operatorDecisions.insert": { offLoop: true, idempotent: false, fn: insertOperatorDecision },
+  "operatorDecisions.fileWorkflow": { offLoop: true, idempotent: true, fn: fileWorkflowDecisionBody },
+  "agents.persistAdvisoryContext": { offLoop: true, idempotent: true, fn: (a: Parameters<typeof persistAdvisoryContext>) => persistAdvisoryContext(...a) ?? null },
+  "commands.createReviewPublish": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof createReviewPublishBody>[0], ctx) => createReviewPublishBody(args, ctx.now) },
+  "operatorDecisions.answer": { offLoop: true, idempotent: true, fn: answerOperatorDecisionBody },
+  "agents.observeEffort": { offLoop: true, idempotent: true, fn: observeEffortBody },
+  "contextCarry.open": { offLoop: true, idempotent: true, fn: (a: { agentId: string; generation: number; now: number }) => openRecoveryObligation(a.agentId, a.generation, a.now) ?? null },
+  "contextCarry.attach": { offLoop: true, idempotent: true, fn: (a: { agentId: string; generation: number; commandId: string }) => attachRecoveryCommand(a.agentId, a.generation, a.commandId) ?? null },
+  "contextCarry.reset": { offLoop: true, idempotent: true, fn: (a: { fact: ContextResetFact }, ctx) => recordContextResetBody(a.fact, ctx.now) },
+  "contextCarry.settle": { offLoop: true, idempotent: true, fn: (a: { command: Command }, ctx) => settleContextResetCarryBody(a.command, ctx.now) },
+  "lifecycleTail.clearAgentNotice": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof clearAgentNotice>) => clearAgentNotice(...args) ?? null },
+  "lifecycleTail.recordTerminalEvent": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof recordTerminalEvent>) => recordTerminalEvent(...args) ?? null },
+  "lifecycleTail.recordCrashReport": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof recordCrashReport>) => recordCrashReport(...args) ?? null },
+  "lifecycleTail.stampSpawnPrincipal": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof stampSpawnPrincipal>) => stampSpawnPrincipal(...args) ?? null },
+  "lifecycleTail.markSpawnRegistrationConfirmed": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof markSpawnRegistrationConfirmed>) => markSpawnRegistrationConfirmed(...args) ?? null },
+  "lifecycleTail.seedSpawnPromptMirror": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof seedSpawnPromptMirror>) => seedSpawnPromptMirror(...args) ?? null },
+  "lifecycleTail.resolveQueuedPolicyMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedPolicyMessages>) => resolveQueuedPolicyMessages(...args) ?? null },
+  "lifecycleTail.resolveQueuedDirectMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedDirectMessages>) => resolveQueuedDirectMessages(...args) ?? null },
+  "lifecycleTail.resolveQueuedCoordinatorMessages": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof resolveQueuedCoordinatorMessages>) => resolveQueuedCoordinatorMessages(...args) ?? null },
+  "lifecycleTail.updateManagedAgentState": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof updateManagedAgentState>) => updateManagedAgentState(...args) ?? null },
+  "lifecycleTail.deleteWorkspace": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof deleteWorkspace>) => deleteWorkspace(...args) ?? null },
+  "lifecycleTail.addSubscription": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof addSubscription>) => addSubscription(...args) ?? null },
+  "lifecycleTail.removeSubscription": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof removeSubscription>) => removeSubscription(...args) ?? null },
+  "lifecycleTail.removeSubscriptionsForTask": { offLoop: true, idempotent: true, fn: (args: Parameters<typeof removeSubscriptionsForTask>) => removeSubscriptionsForTask(...args) ?? null },
+});

package/src/db/lifecycle-write-window.ts

@@ -1,3 +1,4 @@
+import { framed } from "../hub-metrics";
 import { assertMainThreadState, mainThreadRegistry } from "./main-thread-state";
 // #2111 — short-window write coalescing for the hot agent lifecycle / presence / registration writes.
 //
@@ -116,7 +117,7 @@ export function coalesceLifecycleWrite(op: WriteOp, args: unknown, options: Coal
       return;
     }
     if (!window.timer && windowMs() !== Infinity) {
-      window.timer = setTimeout(() => flushWindow(op), windowMs());
+      window.timer = setTimeout(framed("timer lifecycle-write-window", () => flushWindow(op)), windowMs());
       window.timer.unref?.();
     }
   });

package/src/db/lineage-pair-dedupe-sql.ts

@@ -1,11 +1,11 @@
-import { MSG_SELECT } from "./mappers.ts";
 import { MIRROR_LOOKBACK_ROWS, notReportSuppressedSql } from "./report-suppression.ts";
 
 // #3644 — the child→parent chat dedupe reads behind a turn-final forward (db/messages.ts). Pinned
 // to the pair index: unpinned, the planner ranges idx_msg_to_id over the parent's whole inbox
 // (600k rows for `user`) and json_extracts every payload on the main thread. Each query must keep
-// `m.from_agent = ?`, `m.to_target = ?` and `m.kind = 'chat'` (the partial index predicate).
-const PAIR_CHAT_SELECT = `${MSG_SELECT} INDEXED BY idx_msg_pair_chat
+// `m.from_agent = ?`, `m.to_target = ?`, `m.kind = 'chat'` (the partial index predicate).
+// #3617: id + body only, no read/reaction rollups per candidate row; callers hydrate the winner via getMessage.
+const PAIR_CHAT_SELECT = `SELECT m.id, m.body FROM messages m INDEXED BY idx_msg_pair_chat
     WHERE m.from_agent = ?
       AND m.to_target = ?
       AND m.kind = 'chat'`;

package/src/db/main-connection-mode.ts

@@ -0,0 +1,11 @@
+import { relayEnv } from "@humwick/sdk/env";
+import { getDb, getDbPath } from "./connection";
+
+/** Seal the hub handle after all boot writes, immediately before bind (#1870 S8).
+ * Opt in during the soak; standalone tools and :memory: fixtures retain their own write handles. */
+export function configureMainConnectionForServing(env = process.env): boolean {
+  if (!Bun.isMainThread || getDbPath() === ":memory:" || !getDbPath()) return false;
+  if (relayEnv(env, "AGENT_RELAY_MAIN_DB_QUERY_ONLY") !== "1") return false;
+  getDb().run("PRAGMA query_only = ON");
+  return true;
+}

package/src/db/main-connection-writes.ts

@@ -1,4 +1,5 @@
 // #1870: bounded, minute-bucketed census of main-connection write attempts, including failed SQL.
+import { configureMainConnectionForServing } from "./main-connection-mode";
 const MINUTE = 60_000;
 const WINDOW_BUCKETS = 60;
 const MAX_LABELS = 512;
@@ -42,7 +43,7 @@ export function resetMainConnectionWrites(): void {
 let booting = false;
 let bootWrites = 0;
 export function beginMainWriteBootPhase(): void { booting = true; }
-export function endMainWriteBootPhase(): void { booting = false; }
+export function endMainWriteBootPhase(): void { configureMainConnectionForServing(); booting = false; }
 export function mainConnectionBootWrites(): number { return bootWrites; }
 // The first sighting of each label per process logs its caller once, so the remaining raw writers are named
 // from hub logs without a debugger. Bounded by the counter's own label cap.
@@ -52,14 +53,31 @@ function logFirstSighting(label: string): void {
   loggedLabels.add(label);
   const site = (new Error().stack ?? "").split("\n").filter((line) => line.includes(" at ") && !/connection|main-connection-writes/.test(line)).slice(0, 4)
     .map((line) => line.trim().replace(/^at /, "").replace(/\(?\/[^)]*\/(src\/[^):]+:\d+)[^)]*\)?/, "$1")).join(" < ");
-  console.log(`[relay] #1870 main-connection write: ${label} :: ${site}`);
+  // Maintenance subprocesses reserve stdout for their JSON result (#3800).
+  console.error(`[relay] #1870 main-connection write: ${label} :: ${site}`);
 }
 export function recordMainConnectionWrite(label: string | undefined): void {
   if (!Bun.isMainThread || !label) return;
   if (booting) { bootWrites++; return; }
   counter.record(label, Date.now());
+  if (forbidRawWrites) { forbiddenWriteAttempts++; throw new Error(`#1870 raw main-connection write: ${label}`); }
   logFirstSighting(label);
 }
 export function mainConnectionWrites(now: number = Date.now()): Record<string, number> {
   return counter.snapshot(now);
 }
+
+let forbidRawWrites = false;
+let forbiddenWriteAttempts = 0;
+/** Test ratchet for real service/route replay on the file-backed gateway. */
+export async function withRawMainWritesForbidden<T>(run: () => Promise<T>): Promise<T> {
+  const previous = forbidRawWrites;
+  const attempts = forbiddenWriteAttempts;
+  forbidRawWrites = true;
+  try {
+    const result = await run();
+    if (forbiddenWriteAttempts !== attempts) throw new Error("#1870 raw main-connection write was caught inside the replay");
+    return result;
+  }
+  finally { forbidRawWrites = previous; }
+}

package/src/db/maintenance-job-runs-async.ts

@@ -19,8 +19,8 @@ export const finishMaintenanceRunAsync = (args: MaintenanceRunOutcome) =>
 export async function ensureMaintenanceJobsAsync(jobs: MaintenanceJobSpec[]): Promise<void> {
   await getGateway().write("maintenanceJobs.ensure", { jobs }, { critical: true });
 }
-export async function rescheduleRunOnStartJobsAsync(): Promise<void> {
-  await getGateway().write("maintenanceJobs.rescheduleRunOnStart", {}, { critical: true });
+export async function rescheduleRunOnStartJobsAsync(now?: number): Promise<void> {
+  await getGateway().write("maintenanceJobs.rescheduleRunOnStart", { now }, { critical: true });
 }
 export async function reclaimDeadLeasesAsync(leases: DeadLease[]): Promise<void> {
   if (leases.length) await getGateway().write("maintenanceJobs.reclaimDeadLeases", { leases }, { critical: true });

package/src/db/maintenance-job-write-ops.ts

@@ -11,7 +11,7 @@ export const MAINTENANCE_JOB_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> =
   "maintenanceJobs.heartbeat": { offLoop: true, idempotent: true, fn: (args: { id: string; runToken: string }, ctx) => heartbeatMaintenanceRun(args, ctx.now) },
   // Reconcile is a re-assertion of code-owned columns, so a replay changes nothing.
   "maintenanceJobs.ensure": { offLoop: true, idempotent: true, fn: (args: { jobs: MaintenanceJobSpec[] }, ctx) => upsertMaintenanceJobs(args.jobs, ctx.now) },
-  "maintenanceJobs.rescheduleRunOnStart": { offLoop: true, idempotent: true, fn: (_args: Record<string, never>, ctx) => rescheduleRunOnStartJobs(ctx.now) },
+  "maintenanceJobs.rescheduleRunOnStart": { offLoop: true, idempotent: true, fn: (args: { now?: number }, ctx) => rescheduleRunOnStartJobs(args.now ?? ctx.now) },
   "maintenanceJobs.reclaimDeadLeases": { offLoop: true, idempotent: true, fn: (args: { leases: DeadLease[] }, ctx) => reclaimDeadLeases(args.leases, ctx.now) },
   // A compare-and-set on the observed lease, so a replay finds nothing left to reset.
   "maintenanceJobs.resetExpiredCritical": { offLoop: true, idempotent: true, fn: (args: { now: number }) => resetExpiredCriticalMaintenanceRuns(args.now) },

package/src/db/maintenance-pauses.ts

@@ -123,8 +123,8 @@ export interface PauseMaintenanceJobInput {
 /** Acquire a pause. An existing ACTIVE pause is returned as a conflict rather than having its
  *  holder replaced — same contract as acquireMergePause, so one operator's hold plus its reason
  *  cannot be quietly overwritten by another's. A LAPSED row is replaced. */
-export function pauseMaintenanceJob(input: PauseMaintenanceJobInput): { ok: boolean; pause: MaintenanceJobPauseRecord } {
-  const now = input.now ?? Date.now();
+export function pauseMaintenanceJob(input: PauseMaintenanceJobInput, submittedAt: number = Date.now()): { ok: boolean; pause: MaintenanceJobPauseRecord } {
+  const now = input.now ?? submittedAt;
   const expiresAt = input.indefinite ? null : now + (input.ttlMs ?? DEFAULT_MAINTENANCE_PAUSE_TTL_MS);
   return writeTransaction(() => {
     const existing = getMaintenanceJobPause(input.jobId, now);

package/src/db/message-send.ts

@@ -74,3 +74,7 @@ export function sendMessagesBatchWithResultAsync(
     SendMessageResult[]
   >;
 }
+
+export async function sendMessageAsync(input: SendMessageInput) {
+  return (await sendMessageWithResultAsync(input)).message;
+}

package/src/db/messages.ts

@@ -59,9 +59,9 @@ export { runningAgentForPolicy } from "./policy-runtime.ts";
 
 export function findMessageByIdempotencyKey(from: string, key: string): Message | null {
   const row = getDb()
-    .query(`${MSG_SELECT} WHERE m.from_agent = ? AND m.idempotency_key = ? LIMIT 1`)
-    .get(from, key) as any;
-  return row ? rowToMessage(row) : null;
+    .query("SELECT m.id FROM messages m WHERE m.from_agent = ? AND m.idempotency_key = ? LIMIT 1")
+    .get(from, key) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 function sessionStepId(payload: Record<string, unknown> | undefined): string | undefined {
@@ -162,7 +162,7 @@ function findRecentDuplicateReply(input: SendMessageInput, threadId: number | nu
   if (!input.replyTo || threadId === null || hasAttachments) return null;
   const kind = inferMessageKind(input);
   const row = getDb().query(`
-    ${MSG_SELECT}
+    SELECT m.id FROM messages m
     WHERE m.from_agent = ?
       AND m.to_target = ?
       AND m.kind = ?
@@ -183,8 +183,8 @@ function findRecentDuplicateReply(input: SendMessageInput, threadId: number | nu
     input.subject ?? null,
     input.channel ?? null,
     now - REPLY_DUPLICATE_WINDOW_MS,
-  ) as any;
-  return row ? rowToMessage(row) : null;
+  ) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 function sessionMeta(input: Message | SendMessageInput): Record<string, unknown> | undefined {
@@ -252,8 +252,8 @@ function findLineageReportByTurn(input: {
     lineageKey,
     `response-report:${input.from}:%:${input.turnId}`,
     input.turnId,
-  ) as any;
-  return row ? rowToMessage(row) : null;
+  ) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 function findRecentLineageReport(input: SendMessageInput, now: number): Message | null {
@@ -275,8 +275,8 @@ function findRecentLineageReport(input: SendMessageInput, now: number): Message
     if (duplicate) return duplicate;
   }
   if (responseCapture) return null;
-  const row = getDb().query(RECENT_LINEAGE_REPORT_SQL).get(from, to, input.body, now - LINEAGE_REPORT_DUPLICATE_WINDOW_MS, `response-report:${from}:%`) as any;
-  return row ? rowToMessage(row) : null;
+  const row = getDb().query(RECENT_LINEAGE_REPORT_SQL).get(from, to, input.body, now - LINEAGE_REPORT_DUPLICATE_WINDOW_MS, `response-report:${from}:%`) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 // T4458 (Edin's rule #2844 1a) — the sender's currently-open provider turn: the newest
@@ -340,10 +340,10 @@ function findSameTurnExplicitReport(input: {
     input.to,
     ...(input.turnId ? [input.from, input.turnId, fallback] : [fallback]),
     input.at + LINEAGE_REPORT_DUPLICATE_WINDOW_MS,
-  ) as any[];
+  ) as Array<{ id: number; body: string | null }>;
   for (const row of rows) {
     const explicit = normBody(String(row?.body ?? ""));
-    if (explicit.length >= SAME_TURN_MIN_CHARS && explicit.includes(body)) return rowToMessage(row);
+    if (explicit.length >= SAME_TURN_MIN_CHARS && explicit.includes(body)) return getMessage(row.id);
   }
   return null;
 }
@@ -361,9 +361,9 @@ function findTurnExplicitReport(input: {
   captureLen: number;
   captureOccurredAt: number;
 }): Message | null {
-  const row = getDb().query(TURN_EXPLICIT_REPORT_SQL).get(input.from, input.to, input.turnId, input.before) as any;
-  if (!row) return null;
-  const message = rowToMessage(row);
+  const row = getDb().query(TURN_EXPLICIT_REPORT_SQL).get(input.from, input.to, input.turnId, input.before) as { id: number } | null;
+  const message = row ? getMessage(row.id) : null;
+  if (!message) return null;
   const explicitLen = normBody(String(message.body ?? "")).length;
   if (explicitLen < SAME_TURN_MIN_CHARS || explicitLen < 0.5 * input.captureLen) return null;
   // MED-1 (r1 review): a stamp is turn inference and can go stale — t1's late final can land
@@ -409,8 +409,8 @@ function findRecentExplicitLineageDuplicate(input: {
     input.to,
     input.body,
     input.since,
-  ) as any;
-  return row ? rowToMessage(row) : null;
+  ) as { id: number } | null;
+  return row ? getMessage(row.id) : null;
 }
 
 // #1084/#3304 — reporting a definitive provider completion does not close its work window.
@@ -418,9 +418,14 @@ function findRecentExplicitLineageDuplicate(input: {
 const LINEAGE_FINAL_GROUP_RECENCY_MS = 10 * 60 * 1000;
 export { __resetDeferredLineageReports, restoreDeferredLineageReports, takeDeferredLineageReports } from "./deferred-lineage-reports.ts";
 
+export interface LineageReportResult {
+  message: Message;
+  created: boolean;
+  lifecycleSignals?: Array<{ recipient: string; subjectKey: string }>;
+}
 export interface WorkFinalFlushResult {
   /** The chat report(s) forwarded (or found already-forwarded) to the spawner, oldest first. */
-  forwarded: Array<{ message: Message; created: boolean }>;
+  forwarded: LineageReportResult[];
   /** The original session-mirror captures retroactively tagged `payload.finality` (for the
    * `message.finalized` SSE upgrade of already-rendered bubbles). */
   finalizedOriginals: Message[];
@@ -533,12 +538,11 @@ function edgeFallbackReportScore(body: string): number {
 // redundant "Task status pulse" for the same child/task is suppressed rather than double-waking.
 // #1038 — a report-up conveys "the child is progressing", so it is state-keyed to `working`: it
 // supersedes only a redundant `working` pulse, never a later distinct milestone (committed/landed/done).
-function stampReportUpLifecycleSignal(parent: string, child: AgentCard): void {
-  stampLifecycleSignal(parent, childSignalKey(child.id));
-  for (const taskId of childTaskIds(child)) stampLifecycleSignal(parent, taskSignalKey(taskId, LIFECYCLE_STATE_WORKING));
+export function applyLineageReportEffects(result: LineageReportResult | null): void {
+  for (const signal of result?.lifecycleSignals ?? []) stampLifecycleSignal(signal.recipient, signal.subjectKey);
 }
 
-export function promoteLineageCapturedResponse(message: Message): { message: Message; created: boolean } | null {
+export function promoteLineageCapturedResponse(message: Message, deferred?: Array<{ childId: string; messageId: number }>): LineageReportResult | null {
   if (message.kind !== "session" || isReportSuppressed(message)) return null;
   const session = sessionMeta(message);
   if (!session) return null;
@@ -556,7 +560,8 @@ export function promoteLineageCapturedResponse(message: Message): { message: Mes
   // #3304 — provider completion is enough to report a turn, without declaring the Task done.
   // Keep the ring for later work-final metadata; addressed captures already have a runner reply.
   if (stream === "responses" && verbosity !== "verbose") {
-    deferLineageReport(child.id, message.id);
+    if (deferred) deferred.push({ childId: child.id, messageId: message.id });
+    else deferLineageReport(child.id, message.id);
     if (session.confidence !== "definitive" || session.endedBy !== "completed" || message.replyTo) return null;
     if (lineageDeliveryCoversCapture(message, child, parent, message.createdAt)) return null;
   }
@@ -576,7 +581,7 @@ function forwardLineageStreamCapture(
   child: AgentCard,
   parent: string,
   finality?: MessageWorkFinality,
-): { message: Message; created: boolean } | null {
+): LineageReportResult | null {
   const parentAgentId = parent;
   parent = canonicalLineageReportTarget(child, parent);
   const idempotencyKey = lineageStreamReportKey(message, session, stream);
@@ -679,7 +684,8 @@ function forwardLineageStreamCapture(
     occurredAt: message.occurredAt ?? message.createdAt,
   });
   if (stream === "responses" && result.created) {
-    stampReportUpLifecycleSignal(parentAgentId, child);
+    return { ...result, lifecycleSignals: [childSignalKey(child.id), ...childTaskIds(child).map(id => taskSignalKey(id, LIFECYCLE_STATE_WORKING))]
+      .map(subjectKey => ({ recipient: parentAgentId, subjectKey })) };
   }
   return result;
 }

package/src/db/migrations.ts

@@ -1,3 +1,6 @@
+import { COMMAND_RETENTION_SCHEMA, ensureCommandRetentionReferenceIndexes } from "./command-retention";
+import { migrateCheckoutRefreshHeads } from "./checkout-refresh-schema";
+import { TOKEN_USAGE_RETENTION_SCHEMA } from "./token-usage-retention";
 import { PLAN_DISPATCH_SCHEMA_SQL } from "./plan-dispatch-schema";
 import { PLAN_IMPORT_SCHEMA_SQL } from "./plan-import-schema";
 import { ensureDurablePayloadSchema } from "./durable-payloads"; import { redactProviderConfigHistory } from "./provider-config-history"; import { retireMemoryStorage } from "./memory-retirement";
@@ -66,6 +69,7 @@ import { migrateTeamProjectSeats } from "./team-project.ts";
 import { ensureArtifactCreatorAgentColumn } from "./artifacts.ts";
 import { rewriteEmptyToolGroupsToAbsent } from "./tool-groups-empty-migration.ts";
 import { backfillProjectMemoryToolGroup } from "./project-memory-group-migration.ts";
+import { backfillPlanToolsIntoToolIncludes } from "./plan-tools-include-migration.ts";
 import { removeLegacyProfileProjectInstructions } from "./profile-legacy-project-instructions-migration.ts";
 import { migrateProfileHostSources } from "./profile-host-sources-migration.ts";
 import { migrateProfileProjectAcks } from "./profile-project-ack-migration.ts";
@@ -169,7 +173,15 @@ export function applyMigrations(): void {
     )
   `);
   getDb().run("CREATE INDEX IF NOT EXISTS idx_issue_refs_external ON issue_refs(provider, repo, external_key)");
-  getDb().run("CREATE INDEX IF NOT EXISTS idx_issue_refs_updated ON issue_refs(updated_at DESC)");
+  // #3799 — matches the listing ORDER BY exactly, so a list is a bounded index walk with no sort; supersedes (updated_at DESC).
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_issue_refs_listing ON issue_refs(updated_at DESC, created_at DESC, id DESC)");
+  getDb().run("DROP INDEX IF EXISTS idx_issue_refs_updated");
+  // #3799 — automation_runs list/scan indexes: status+created_at supersedes the plain status index, created_at serves the
+  // unfiltered listing, and the partial index holds exactly the open task-bound runs the reconcile pass walks.
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_automation_runs_status_created ON automation_runs(status, created_at)");
+  getDb().run("DROP INDEX IF EXISTS idx_automation_runs_status");
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_automation_runs_created ON automation_runs(created_at DESC)");
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_automation_runs_open ON automation_runs(created_at) WHERE status IN ('scheduled', 'dispatching', 'waiting_agent', 'running') AND task_id IS NOT NULL");
   // #2520 — the GitHub close classification (completed|not_planned) cached beside the status so
   // plan-node terminal propagation can tell a completed close from a not-planned one. The guarded
   // ALTER converges databases created before the column existed with the CREATE above.
@@ -666,6 +678,7 @@ export function applyMigrations(): void {
   ensureIngestedMemoryIndex();
   rewriteEmptyToolGroupsToAbsent(); // #1963 N2 — persisted relay.tools.groups:[] meant ALL; honoring [] as NONE requires rewriting existing [] → absent first
   backfillProjectMemoryToolGroup(); // #2154 follow-up — stored/overridden profiles do not pick up the built-in `project-memory` group on their own
+  backfillPlanToolsIntoToolIncludes(); // #3812 — lean per-tool allowlists (coordinator) never gained relay_plan_start/import
   removeLegacyProfileProjectInstructions(); // #2133 — remove retired profile policy fields before profile override migration reads legacy rows
   backfillCustomProfileArtifacts(); // #3171 — Artifact is off by default now; keep the approved custom brainstorm exception
   migrateAgentProfileOverridesToV2(); // #1963 N10 — back up + migrate persisted override rows to the v2 matrix (D-T=off; G6/G7 leave-untouched-and-report; flag-gated rollback)
@@ -1733,6 +1746,10 @@ export function applyMigrations(): void {
   getDb().run(AGENT_EXIT_REPORT_SCHEMA);
   getDb().run(CONTEXT_RESET_SCHEMA); // #3398
   getDb().run(TASK_TOKEN_TOTALS_SCHEMA);
+  getDb().run(TOKEN_USAGE_RETENTION_SCHEMA);
+  getDb().run(COMMAND_RETENTION_SCHEMA);
+  migrateCheckoutRefreshHeads(getDb());
+  ensureCommandRetentionReferenceIndexes(getDb());
   getDb().run(SHIPPING_STATS_SCHEMA);
   getDb().run(CI_GATE_BACKFILL_SCHEMA); getDb().run(AGENT_GATE_RUNS_SCHEMA); ensureAgentGateCommandSchema(); repairRerunGateTimings(); ensureCiShaObservationsSchema();
   migrateOperatorActionsSchema();

package/src/db/notification-write-ops.ts

@@ -0,0 +1,19 @@
+import { sendMessageWithResultInternal } from "./messages";
+import { insertAgentNoticeSlot, type AgentNoticeSlot } from "./terminal-events";
+import type { SendMessageInput } from "../types";
+import type { WriterOpContext, WriterOpSpec } from "./write-ops";
+
+const send = (inputs: SendMessageInput[], now: number) => inputs.map(input => sendMessageWithResultInternal(input, false, {}, now));
+export const NOTIFICATION_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
+  "notifications.route": {
+    offLoop: true, idempotent: false,
+    fn: ({ inputs }: { inputs: SendMessageInput[] }, ctx: WriterOpContext) => send(inputs, ctx.now),
+  },
+  "notifications.agentNotice": {
+    offLoop: true, idempotent: false,
+    fn: ({ slot, inputs }: { slot: AgentNoticeSlot; inputs: SendMessageInput[] }, ctx: WriterOpContext) => {
+      const created = insertAgentNoticeSlot(slot, ctx.now);
+      return { created, results: created ? send(inputs, ctx.now) : [] };
+    },
+  },
+});

package/src/db/operator-answer-write.ts

@@ -0,0 +1,19 @@
+import { answerOpenOperatorDecision, getOperatorDecision, getWorkflowOperatorDecision, insertOperatorDecision, setOperatorDecisionAnswerMessage } from "./operator-decisions";
+import { sendMessageWithResultInternal } from "./messages";
+import type { SendMessageInput } from "../types";
+export interface OperatorAnswerWrite {
+  id: number;
+  answer: Parameters<typeof answerOpenOperatorDecision>[1];
+  message: SendMessageInput;
+}
+export function answerOperatorDecisionBody({ id, answer, message }: OperatorAnswerWrite) {
+  if (!answerOpenOperatorDecision(id, answer)) return null;
+  const result = sendMessageWithResultInternal(message, false, {}, answer.now);
+  setOperatorDecisionAnswerMessage(id, result.message.id);
+  return { decision: getOperatorDecision(id)!, result };
+}
+
+export function fileWorkflowDecisionBody(input: Parameters<typeof insertOperatorDecision>[0]) {
+  const existing = getWorkflowOperatorDecision(input.workflow!.effectId);
+  return existing ? { decision: existing, created: false } : { decision: insertOperatorDecision(input), created: true };
+}

package/src/db/orchestrators.ts

@@ -11,7 +11,7 @@ import {
   type RuntimeContracts,
 } from "../contracts";
 import { STALE_TTL_MS } from "../config";
-import { deleteAgent, heartbeat, upsertAgent, upsertAgentInternal, type UpsertAgentTxResult } from "./agents.ts";
+import { deleteAgentInternal, heartbeat, upsertAgent, upsertAgentInternal, type UpsertAgentTxResult } from "./agents.ts";
 import { evictPendingPresence } from "./presence-buffer.ts";
 import { getDb, writeTransaction } from "./connection.ts";
 import { fencedColumnSql, nextLifecycleSeq } from "./lifecycle-seq.ts";
@@ -386,11 +386,17 @@ export function reportOrchestratorRosterRow(id: string, agents: ManagedAgent[],
 }
 
 export function deleteOrchestrator(id: string): boolean {
+  const result = deleteOrchestratorRow(id, Date.now());
+  if (result.agentId) evictPendingPresence(result.agentId);
+  return result.deleted;
+}
+
+export function deleteOrchestratorRow(id: string, now: number): { deleted: boolean; agentId?: string } {
   const orch = getOrchestrator(id);
-  if (!orch) return false;
+  if (!orch) return { deleted: false };
   getDb().query("DELETE FROM orchestrators WHERE id = ?").run(id);
-  deleteAgent(orch.agentId);
-  return true;
+  deleteAgentInternal(orch.agentId, now);
+  return { deleted: true, agentId: orch.agentId };
 }
 
 export function hasStaleOrchestrator(cutoff: number): boolean {

package/src/db/pairs-async.ts

@@ -1,5 +1,6 @@
+import { randomUUID } from "node:crypto";
+import type { createPair, acceptPair, rejectPair, endPair, sendPairMessage, getPair, listPairs } from "./pairs";
 import { getGateway } from "./gateway";
-import type { getPair, listPairs } from "./pairs";
 
 export function getPairAsync(id: string): Promise<ReturnType<typeof getPair>> {
   return getGateway().write("pairs.getCurrent", { id }) as Promise<ReturnType<typeof getPair>>;
@@ -8,3 +9,23 @@ export function getPairAsync(id: string): Promise<ReturnType<typeof getPair>> {
 export function listPairsAsync(filter?: Parameters<typeof listPairs>[0]): Promise<ReturnType<typeof listPairs>> {
   return getGateway().write("pairs.listCurrent", filter) as unknown as Promise<ReturnType<typeof listPairs>>;
 }
+
+export function createPairAsync(...args: Parameters<typeof createPair>): Promise<ReturnType<typeof createPair>> {
+  return getGateway().write("pairs.createPair", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof createPair>>;
+}
+
+export function acceptPairAsync(...args: Parameters<typeof acceptPair>): Promise<ReturnType<typeof acceptPair>> {
+  return getGateway().write("pairs.acceptPair", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof acceptPair>>;
+}
+
+export function rejectPairAsync(...args: Parameters<typeof rejectPair>): Promise<ReturnType<typeof rejectPair>> {
+  return getGateway().write("pairs.rejectPair", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof rejectPair>>;
+}
+
+export function endPairAsync(...args: Parameters<typeof endPair>): Promise<ReturnType<typeof endPair>> {
+  return getGateway().write("pairs.endPair", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof endPair>>;
+}
+
+export function sendPairMessageAsync(...args: Parameters<typeof sendPairMessage>): Promise<ReturnType<typeof sendPairMessage>> {
+  return getGateway().write("pairs.sendPairMessage", args, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof sendPairMessage>>;
+}

package/src/db/pairs-write-ops.ts

@@ -1,8 +1,13 @@
-import { getPair, listPairs } from "./pairs";
+import { createPair, acceptPair, rejectPair, endPair, sendPairMessage, getPair, listPairs } from "./pairs";
 import type { WriterOpSpec } from "./write-ops";
 
 // Pair reads settle expired requests before returning the current view.
 export const PAIRS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = {
-  "pairs.getCurrent": { idempotent: true, offLoop: true, fn: (args: { id: string }) => getPair(args.id) },
-  "pairs.listCurrent": { idempotent: true, offLoop: true, fn: (args: Parameters<typeof listPairs>[0]) => listPairs(args) },
+  "pairs.getCurrent": { idempotent: true, offLoop: true, fn: (args: { id: string }, ctx) => getPair(args.id, ctx.now) },
+  "pairs.listCurrent": { idempotent: true, offLoop: true, fn: (args: Parameters<typeof listPairs>[0], ctx) => listPairs(args, ctx.now) },
+  "pairs.createPair": { offLoop: true, idempotent: false, fn: (a: Parameters<typeof createPair>, ctx) => createPair(a[0], a[1] ?? ctx.now) },
+  "pairs.acceptPair": { offLoop: true, idempotent: false, fn: (a: Parameters<typeof acceptPair>, ctx) => acceptPair(a[0], a[1], a[2] ?? ctx.now) },
+  "pairs.rejectPair": { offLoop: true, idempotent: false, fn: (a: Parameters<typeof rejectPair>, ctx) => rejectPair(a[0], a[1], a[2] ?? ctx.now) },
+  "pairs.endPair": { offLoop: true, idempotent: false, fn: (a: Parameters<typeof endPair>, ctx) => endPair(a[0], a[1], a[2] ?? ctx.now) },
+  "pairs.sendPairMessage": { offLoop: true, idempotent: false, fn: (a: Parameters<typeof sendPairMessage>, ctx) => sendPairMessage(a[0], a[1], a[2] ?? ctx.now) },
 };