@humwick/server 0.130.2 → 0.130.4

package/src/db/token-usage.ts

@@ -1,3 +1,4 @@
+import { isTokenUsageExpired } from "./token-usage-retention";
 // #2485 — the durable, provider-agnostic token-usage ledger ("the spine" of epic #2481). The three
 // capture seams write per-turn provider usage here through `tokenUsage.record`; the Analytics box
 // reads period/provider aggregates through `tokenUsage.aggregate`.
@@ -144,7 +145,7 @@ export function getSessionTokenUsageByDedupeKey(dedupeKey: string): SessionToken
  * the writer boundary as well as at the HTTP boundary, and never minted from the receipt clock,
  * so a genuine retry deterministically reuses the same key.
  */
-export function recordSessionTokenUsage(input: SessionTokenUsageInput): { record: SessionTokenUsageRecord; inserted: boolean } {
+export function recordSessionTokenUsage(input: SessionTokenUsageInput): { record: SessionTokenUsageRecord | null; inserted: boolean } {
   const { createdAt } = input;
   if (!Number.isSafeInteger(createdAt) || createdAt <= 0) {
     throw new ValidationError("createdAt required (positive epoch-milliseconds of the provider's observed usage time)");
@@ -160,6 +161,8 @@ export function recordSessionTokenUsage(input: SessionTokenUsageInput): { record
   const prior = getDb().query("SELECT * FROM session_token_usage WHERE dedupe_key = ?").get(dedupeKey) as
     | SessionTokenUsageRow
     | undefined;
+  // Transcript capture replays from byte zero after restart; acknowledge folded history without recreating it (#3619).
+  if (!prior && isTokenUsageExpired(createdAt)) return { record: null, inserted: false };
   // Bound once, at first attribution: a replacement reuses the row's Task, never the agent's current one.
   const taskId = prior ? (prior.task_id ?? undefined) : deliverableTaskIdForAgent(input.agentId);
   getDb().query(`

package/src/db/user-invites-async.ts

@@ -0,0 +1,13 @@
+import { randomUUID } from "node:crypto";
+import { getGateway } from "./gateway";
+import type { createUserInvite, acceptUserInvite } from "./user-invites";
+import { invalidateUserCount } from "./users";
+
+export function createUserInviteAsync(input: Parameters<typeof createUserInvite>[0]): Promise<ReturnType<typeof createUserInvite>> {
+  return getGateway().write("userInvites.create", input, { idempotencyKey: randomUUID() }) as unknown as Promise<ReturnType<typeof createUserInvite>>;
+}
+export async function acceptUserInviteAsync(input: Parameters<typeof acceptUserInvite>[0]): Promise<ReturnType<typeof acceptUserInvite>> {
+  const user = await getGateway().write("userInvites.accept", input, { idempotencyKey: randomUUID() }) as unknown as ReturnType<typeof acceptUserInvite>;
+  invalidateUserCount();
+  return user;
+}

package/src/db/user-invites.ts

@@ -4,7 +4,7 @@
 // the password identity, so a replayed or raced code can never create a second account.
 import { createHash, randomBytes } from "node:crypto";
 import { ValidationError, getDb, writeTransaction } from "./connection.ts";
-import { createUser } from "./users.ts";
+import { createUserRow } from "./users.ts";
 import { createAuthIdentity } from "./auth-identities.ts";
 import type { User, UserRole } from "../types";
 
@@ -99,8 +99,8 @@ export function acceptUserInvite(input: { code: string; userId: string; handle:
     }
     const claimed = getDb().query("UPDATE user_invites SET used_at = ? WHERE id = ? AND used_at IS NULL").run(now, row.id);
     if (claimed.changes !== 1) throw new InviteUnavailableError("invite is invalid, expired or already used");
-    const user = createUser({ id: input.userId, handle: input.handle, displayName: input.displayName || row.display_name || input.handle, role: row.role as UserRole });
-    createAuthIdentity({ userId: user.id, provider: input.provider, providerSubject: input.handle, secretHash: input.secretHash });
+    const user = createUserRow({ id: input.userId, handle: input.handle, displayName: input.displayName || row.display_name || input.handle, role: row.role as UserRole }, now);
+    createAuthIdentity({ userId: user.id, provider: input.provider, providerSubject: input.handle, secretHash: input.secretHash }, now);
     getDb().query("UPDATE user_invites SET used_by = ? WHERE id = ?").run(user.id, row.id);
     return user;
   });

package/src/db/users.ts

@@ -91,10 +91,19 @@ export function userCount(now: number = Date.now()): number {
 }
 
 export function createUser(input: CreateUserInput): User {
+  const user = createUserRow(input);
+  invalidateUserCount();
+  return user;
+}
+
+export function invalidateUserCount(): void {
   assertMainThreadState("users.ts");
+  userCountCache = undefined;
+}
+
+export function createUserRow(input: CreateUserInput, now = Date.now()): User {
   if (!input.id) throw new ValidationError("user id is required");
   if (!input.handle) throw new ValidationError("user handle is required");
-  const now = Date.now();
   getDb()
     .query(
       `INSERT INTO users (id, handle, display_name, role, status, tenant_id, avatar_artifact_id, created_at, updated_at)
@@ -111,7 +120,6 @@ export function createUser(input: CreateUserInput): User {
       now,
       now,
     );
-  userCountCache = undefined;
   const created = getUser(input.id);
   if (!created) throw new ValidationError(`failed to create user ${input.id}`);
   return created;
@@ -121,7 +129,7 @@ export function updateUserProfile(input: {
   id: string;
   displayName?: string;
   avatarArtifactId?: string | null;
-}): User {
+}, submittedAt: number = Date.now()): User {
   const current = getUser(input.id);
   if (!current) throw new ValidationError("user not found");
   const updates: string[] = [];
@@ -137,17 +145,17 @@ export function updateUserProfile(input: {
   }
   if (!updates.length) return current;
   updates.push("updated_at = ?");
-  params.push(Date.now(), input.id);
+  params.push(submittedAt, input.id);
   getDb().query(`UPDATE users SET ${updates.join(", ")} WHERE id = ?`).run(...params);
   return getUser(input.id)!;
 }
 
 /** Change a user's role or account status (#3567 admin user list). */
-export function updateUserAccess(input: { id: string; role?: UserRole; status?: UserStatus }): User {
+export function updateUserAccess(input: { id: string; role?: UserRole; status?: UserStatus }, submittedAt: number = Date.now()): User {
   const current = getUser(input.id);
   if (!current) throw new ValidationError("user not found");
   getDb().query("UPDATE users SET role = ?, status = ?, updated_at = ? WHERE id = ?")
-    .run(input.role ?? current.role, input.status ?? current.status, Date.now(), input.id);
+    .run(input.role ?? current.role, input.status ?? current.status, submittedAt, input.id);
   return getUser(input.id)!;
 }
 

package/src/db/workflow-execution.ts

@@ -1,8 +1,8 @@
-// Task ownership and coordinator routing see the same execution facts for runs and item lanes.
+// Task ownership, coordinator routing and spawn admission share execution facts for runs and item lanes.
 export const WORKFLOW_EXECUTIONS_SQL = `(
-  SELECT scope, id, taskId, coordinator, status, reason, awaiting FROM kernel_entity__workflow__run
+  SELECT scope, id, taskId, coordinator, callerAgentId, status, reason, awaiting FROM kernel_entity__workflow__run
   UNION ALL
-  SELECT item.scope, item.id, owner.taskId, owner.coordinator,
+  SELECT item.scope, item.id, owner.taskId, owner.coordinator, owner.callerAgentId,
     json_extract(item.lane, '$.status') AS status, json_extract(item.lane, '$.reason') AS reason, json_extract(item.lane, '$.awaiting') AS awaiting
   FROM kernel_entity__workflow__activation item
   JOIN kernel_entity__workflow__run owner ON owner.scope = item.scope AND owner.id = item.runId

package/src/db/workspaces.ts

@@ -1,3 +1,4 @@
+import { trackRelayEvent } from "../relay-event-drain";
 import { mainThreadRegistry } from "./main-thread-state";
 import { persistWorkspace, type WorkspaceUpsertInput } from "./workspace-persistence";
 import { Database } from "bun:sqlite";
@@ -438,7 +439,7 @@ export function pruneOrphanedSharedWorkspaces(): string[] {
 // owner's branch-state badge" (#236). A hook, not a direct emit, because getDb().ts is
 // the lowest layer — sse.ts imports db, so db can't import sse without a cycle. sse
 // registers a listener at startup that re-emits the owner agent's status over SSE.
-type WorkspaceChangeListener = (workspace: WorkspaceRecord) => void;
+type WorkspaceChangeListener = (workspace: WorkspaceRecord) => unknown;
 export const workspaceChangeListeners = mainThreadRegistry("workspaces.ts:workspaceChangeListeners", new Set<WorkspaceChangeListener>());
 export function onWorkspaceChange(listener: WorkspaceChangeListener): void {
   workspaceChangeListeners.add(listener);
@@ -447,7 +448,8 @@ export function emitWorkspaceChange(workspace: WorkspaceRecord | null | undefine
   if (!workspace) return;
   for (const listener of workspaceChangeListeners) {
     try {
-      listener(workspace);
+      const result = listener(workspace);
+      if (result instanceof Promise) trackRelayEvent(result, "workspace.changed");
     } catch {
       // A badge-refresh listener must never break a workspace write.
     }
@@ -455,15 +457,16 @@ export function emitWorkspaceChange(workspace: WorkspaceRecord | null | undefine
 }
 
 // #1870 — workspace-create effects stay on main; index.ts registers the issue activity handler.
-type WorkspaceCreateListener = (workspace: WorkspaceRecord) => void;
+type WorkspaceCreateListener = (workspace: WorkspaceRecord) => void | Promise<void>;
 const workspaceCreateListeners = mainThreadRegistry("workspaces.ts:workspaceCreateListeners", new Set<WorkspaceCreateListener>());
 export function onWorkspaceCreate(listener: WorkspaceCreateListener): void {
   workspaceCreateListeners.add(listener);
 }
-function emitWorkspaceCreate(workspace: WorkspaceRecord): void {
+export function emitWorkspaceCreate(workspace: WorkspaceRecord): void {
   for (const listener of workspaceCreateListeners) {
     try {
-      listener(workspace);
+      const result = listener(workspace);
+      if (result) trackRelayEvent(result, "workspace.created");
     } catch {
       // A create listener must never break a workspace write.
     }

package/src/db/write-ops.ts

@@ -1,3 +1,10 @@
+import { TIMER_CUTOVER_COORDINATOR_WRITE_OPS } from "./timer-cutover-bodies";
+import { RUNTIME_ADMIN_WRITE_OPS } from "./runtime-admin-write-ops";
+import { AUTOMATION_WRITE_OPS } from "./automation-write-ops";
+import { RUNTIME_TAIL_WRITE_OPS } from "./runtime-tail-write-ops";
+import { LIFECYCLE_TAIL_WRITE_OPS } from "./lifecycle-tail-write-ops";
+import { NOTIFICATION_WRITE_OPS } from "./notification-write-ops";
+import { HISTORY_RETENTION_WRITE_OPS } from "./history-retention-ops";
 import { INTEGRATIONS_WRITE_OPS } from "./integrations-ops.ts";
 import { bufferedLastSeen, type PresenceSnapshot } from "./presence-buffer";
 import { ensureDurablePayloadSchema, readRetryReceipt, storeDurablePayload } from "./durable-payloads";
@@ -42,6 +49,7 @@ import { CLAUDE_API_BUDGET_WRITE_OPS } from "./claude-api-budget-ops";
 // file is the seam they plug into, not the final op set.
 
 import type { Database } from "bun:sqlite";
+import { WRITER_FAULT_TEST_OPS } from "./writer-fault-test-ops";
 import { ValidationError } from "@humwick/sdk";
 import { getDb, inWriteTransaction } from "./connection.ts";
 import type { SerializedDbError } from "./db-error-registry.ts";
@@ -93,6 +101,7 @@ import { PLANS_WRITE_OPS } from "./plans-write-ops.ts";
 import { CONTINUATION_ARCHIVES_WRITE_OPS } from "./continuation-archives-write-ops.ts";
 import { WORKFLOW_JOURNAL_WRITE_OPS } from "./workflow-journal-write-ops.ts";
 import { WORKFLOW_STEP_TASK_WRITE_OPS } from "./workflow-step-tasks.ts";
+import { PROJECT_ENTRIES_WRITE_OPS } from "./project-entries-write-ops";
 import { PROJECTS_WRITE_OPS } from "./projects-write-ops.ts";
 import { CHANNELS_WRITE_OPS } from "./channels-write-ops.ts";
 import { CI_INCIDENTS_WRITE_OPS } from "./ci-incidents-write-ops.ts";
@@ -199,6 +208,10 @@ export interface WriterOpSpec {
   /** This complete operation has no main-thread effects and may use the file-backed writer. */
   readonly offLoop?: boolean;
   readonly idempotent: boolean;
+  /** #3614 — a non-idempotent op whose keyless callers never resubmit: it runs without a key and
+   * writes no ledger row, and a lost acknowledgement stays indeterminate for that caller. A caller
+   * that does retry still passes a key and gets the ledger's exactly-once dedup. */
+  readonly atMostOnce?: true;
   readonly fn: WriterOp;
   /** Sanitizes a result before it enters the durable retry ledger. Results can include a newly-created
    * command's caller-visible plaintext env, while the ledger is readable as raw DB state. */
@@ -234,14 +247,7 @@ const PROBE_DDL = `
 // durable across a worker death (the phantom-failure case), because it lives in the DB, not in memory.
 export { WRITER_IDEMPOTENCY_RETENTION_MS };
 
-/**
- * Create the seam-probe + dedup schema. This models real schema bootstrap (§4, the allowlisted
- * bootstrap layer): DDL runs ONCE at startup as its own committed statement, NOT lazily inside an op —
- * a rolled back op must never undo the schema it ran against. Ops below therefore assume the tables
- * exist, just as relocated real ops assume the migrated catalog exists (H6/§3.1). Idempotent
- * (`IF NOT EXISTS`), so it is safe to call on both the in-process connection and, at bootstrap, on the
- * file that the worker later opens (WAL makes the committed tables visible cross-connection, §3.5).
- */
+// Probe tables are installed at bootstrap, outside writer transactions.
 export function ensureSeamProbeSchema(db: Database = getDb()): void {
   if (db.inTransaction) throw new Error("ensureSeamProbeSchema must run at bootstrap, not inside a transaction");
   db.run(PROBE_DDL);
@@ -277,6 +283,7 @@ export const WRITER_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze(
   // call inserts a NEW row — NON-idempotent: a retry without dedup would double-apply, so the gateway
   // requires an idempotencyKey and the executor dedups on it.
   "seam.append": {
+    offLoop: true,
     idempotent: false,
     fn: (args: { tag: string; value?: string }, ctx) => {
       const row = getDb()
@@ -396,11 +403,17 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
   if (!mergedWriterOps) {
     mergedWriterOps = Object.freeze({
       ...WRITER_OPS,
+      ...WRITER_FAULT_TEST_OPS,
       ...VAULT_TOKEN_WRITE_OPS,
       ...VAULT_HEALTH_WRITE_OPS,
       ...WORKSPACE_REKEY_WRITE_OPS,
       ...PAIRS_WRITE_OPS,
       ...MESSAGE_WRITE_OPS,
+    ...NOTIFICATION_WRITE_OPS,
+    ...LIFECYCLE_TAIL_WRITE_OPS,
+    ...RUNTIME_TAIL_WRITE_OPS,
+    ...AUTOMATION_WRITE_OPS,
+    ...RUNTIME_ADMIN_WRITE_OPS,
       ...COMMANDS_WRITE_OPS,
       ...RESTART_EPOCH_WRITE_OPS,
       ...BUS_OUTBOX_WRITE_OPS,
@@ -416,6 +429,7 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
       ...TIMER_INGRESS_WRITE_OPS,
       ...TIMER_TRANSFER_WRITE_OPS,
       ...TIMER_CUTOVER_WRITE_OPS,
+    ...TIMER_CUTOVER_COORDINATOR_WRITE_OPS,
       ...TASK_WRITE_OPS,
       ...AGENTS_WRITE_OPS,
       ...AGENT_LIFECYCLE_WRITE_OPS,
@@ -443,6 +457,7 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
     ...WORKFLOW_STEP_TASK_WRITE_OPS,
     ...SPAWN_TREE_CLEANUP_WRITE_OPS,
     ...PROJECTS_WRITE_OPS,
+    ...PROJECT_ENTRIES_WRITE_OPS,
     ...CHANNELS_WRITE_OPS,
     ...INTEGRATIONS_WRITE_OPS,
     ...CI_INCIDENTS_WRITE_OPS,
@@ -476,6 +491,7 @@ export function allWriterOps(): Readonly<Record<string, WriterOpSpec>> {
     ...ISSUE_REFS_WRITE_OPS,
     ...WORKSPACE_WRITE_OPS,
     ...WEB_TOOL_CALL_WRITE_OPS,
+    ...HISTORY_RETENTION_WRITE_OPS,
     ...CLAUDE_API_BUDGET_WRITE_OPS,
   ...CLAUDE_APP_OAUTH_WRITE_OPS,
     });
@@ -487,10 +503,12 @@ export function isKnownWriterOp(op: string): boolean {
   return Object.prototype.hasOwnProperty.call(allWriterOps(), op);
 }
 
-/** Whether a registered op is safe to re-apply without an idempotency key (H5 §3.7.1). Throws for an
- *  unknown op so a typo cannot silently pass the gateway's keyless-write gate. */
-export function isIdempotentWriterOp(op: string): boolean {
-  return resolveOp(op).idempotent;
+/** Whether a registered op may be submitted without an idempotency key (H5 §3.7.1): it is safe to
+ *  re-apply, or it is at-most-once. Throws for an unknown op so a typo cannot silently pass the
+ *  gateway's keyless-write gate. */
+export function writerOpAllowsKeyless(op: string): boolean {
+  const spec = resolveOp(op);
+  return spec.idempotent || spec.atMostOnce === true;
 }
 
 export function isOffLoopWriterOp(op: string): boolean {
@@ -512,6 +530,7 @@ function resolveOp(op: string): WriterOpSpec {
  */
 function applyOnce(op: string, spec: WriterOpSpec, args: unknown, ctx: WriterOpContext, key: string | undefined): unknown {
   if (spec.idempotent) return spec.fn(args, ctx); // safe to re-apply, no key needed
+  if (key === undefined && spec.atMostOnce) return spec.fn(args, ctx); // no retry, so nothing to dedup
   // STRUCTURAL enforcement at the executor (H5 §3.7.1): a non-idempotent op MUST carry a key here, so
   // the invariant holds even for a direct executor caller that bypassed the gateway guard. Rejecting
   // BEFORE spec.fn means zero rows are written, so a keyless non-idempotent write can never duplicate.

package/src/db/writer-fault-seam.ts

@@ -24,10 +24,6 @@
 // `threadId` is still recorded and checked as belt-and-braces for an exotic case where a fault is
 // armed on a thread that later dispatches ops elsewhere.
 //
-// This is deliverable under the IN-PROCESS backend, which is the gateway default (`initGateway`
-// chooses in-process even for a file DB) and therefore what the whole default suite and every
-// existing chaos-worker subprocess run — so no existing crash seam loses its injection.
-
 import { threadId } from "node:worker_threads";
 
 interface ArmedWriterFault {
@@ -36,10 +32,7 @@ interface ArmedWriterFault {
   readonly threadId: number;
 }
 
-// Deliberately NOT a mainThreadRegistry (#1870 S6a): off-loop op bodies call `writerFault`, and on the
-// writer thread this map is empty, so the lookup is a harmless no-op there. Delivery is kept honest at
-// dispatch: while a fault is armed the in-process backend runs off-loop ops on the arming thread
-// (writer-gateway `dispatchEntry`), and arming refuses under the worker backend.
+// Each writer thread owns its fault registry. File-backed tests arm named actions on that thread.
 const armed = new Map<string, ArmedWriterFault>();
 
 /**
@@ -67,7 +60,7 @@ export function armWriterFault(name: string, fn: () => void): () => void {
     throw new Error(
       `writer fault '${name}' cannot be armed: the gateway writer backend is 'worker', so this ` +
         `main-thread closure can never run inside the writer op's transaction and the crash would ` +
-        `not be injected at all. Arm faults against the in-process backend (the gateway default), ` +
+        `not be injected at all. Use :memory: for closure faults, arm a named seam.armFault action on the writer, ` +
         `or assert the behaviour without an in-transaction crash seam.`,
     );
   }

package/src/db/writer-fault-test-ops.ts

@@ -0,0 +1,18 @@
+import { armWriterFault } from "./writer-fault-seam";
+import type { WriterOpSpec } from "./write-ops";
+
+// Named actions cross the worker seam; main-thread closures cannot (#1870 S8).
+export const WRITER_FAULT_TEST_OPS = {
+  "seam.armFault": {
+    offLoop: true,
+    idempotent: true,
+    fn: (args: { name: string; action: "kill" | "throw" }) => {
+      if (args.action !== "kill" && args.action !== "throw") throw new Error("unknown writer test fault");
+      armWriterFault(args.name, () => {
+        if (args.action === "kill") process.kill(process.pid, "SIGKILL");
+        throw new Error(`injected writer fault: ${args.name}`);
+      });
+      return null;
+    },
+  },
+} satisfies Record<string, WriterOpSpec>;

package/src/db/writer-gateway.ts

@@ -42,17 +42,16 @@ import { WriterDrain } from "./writer-drain";
 
 import { errMessage } from "@humwick/sdk";
 import { createWorkerPool, type WorkerPool } from "@humwick/offload";
-import { getDbGeneration, getDbPath } from "./connection.ts";
-import { armedWriterFaultCount } from "./writer-fault-seam.ts";
-import { onLoopWriteTransaction } from "./on-loop-write-transaction.ts";
+import { getDbPath } from "./connection.ts";
 // On-loop-block attribution (#1882 / ADR §5). `resolveLoopCallsite` pins the effective callsite onto a
 // submission in the CALLER's context; `captureSyncFrame` times the op body where it actually runs — in
 // the in-process drain microtask, NOT the synchronous enqueue. One-way import (loop-block-attribution
 // imports only event-loop-lag + config), so no cycle.
 import { captureSyncFrame, resolveLoopCallsite } from "../loop-block-attribution.ts";
+import { markCallerResume } from "../hub-metrics.ts";
 import { reconstructDbError, serializeDbError } from "./db-error-registry.ts";
 import {
-  isIdempotentWriterOp,
+  writerOpAllowsKeyless,
   isOffLoopWriterOp,
   runWriterBatch,
   runWriterOp,
@@ -110,7 +109,7 @@ export class WriteIndeterminateError extends Error {
 // ── Options & per-call opts ───────────────────────────────────────────────────────────────────────
 
 export interface InitWriterOptions {
-  /** Overrides the path from `getDbPath()`; `:memory:`/undefined selects the in-process backend. */
+  /** File path to attach. A live file DB always uses its worker, including legacy :memory: requests. */
   path?: string;
   /** Soft high-water mark on the writer queue; past it, non-critical writes shed (§3.6). */
   queueHighWater?: number;
@@ -183,6 +182,9 @@ export interface WriterStats {
    * the observable signal that write convoys are long enough to need the throttle.
    */
   drainYields: number;
+  /** #3798 — writes executed since boot on the main thread and on a writer thread (a batch counts its entries). */
+  onLoopOps: number;
+  writerThreadOps: number;
 }
 
 // ── Backend state ─────────────────────────────────────────────────────────────────────────────────
@@ -243,8 +245,6 @@ interface InProcessBackend {
   kind: "in-process";
   stop: AbortController;
   busy: boolean;
-  offLoop?: WorkerBackend;
-  offLoopGeneration?: number;
 }
 type Backend = WorkerBackend | InProcessBackend;
 
@@ -256,6 +256,8 @@ let writerTimeoutMs = DEFAULT_WRITER_TIMEOUT_MS;
 let drainSliceMs = DEFAULT_DRAIN_SLICE_MS;
 // Monotonic across re-inits (like any counter): a test that wants a delta reads it before and after.
 let drainYields = 0;
+let onLoopOps = 0;
+let writerThreadOps = 0;
 // Set while a writer job has blown its gateway deadline and the sole writer is stalled holding the
 // lock (§3.6.1). Cleared when that in-flight job finally settles (the op completed and released the
 // lock), which re-kicks the FIFO drain. Worker backend only — an in-process op runs synchronously on
@@ -265,17 +267,17 @@ let wedgedOp: { op: string; startedAt: number } | undefined;
 // Test-only fault injection for the precise H5 window: the op has COMMITTED, but its
 // acknowledgement is lost before the caller observes the result. One-shot by design so a retry
 // exercises the persisted idempotency ledger rather than repeatedly failing at the transport edge.
-let postCommitAckLossForTests: { op: string; remaining: number } | undefined;
+let postCommitAckLossForTests: { op: string } | undefined;
 
 export function rejectNextWriterAckAfterCommitForTests(op: string): void {
-  postCommitAckLossForTests = { op, remaining: 1 };
+  postCommitAckLossForTests = { op };
 }
 
-function losePostCommitAckForTests(op: string): boolean {
-  if (!postCommitAckLossForTests || postCommitAckLossForTests.op !== op) return false;
-  postCommitAckLossForTests.remaining -= 1;
-  if (postCommitAckLossForTests.remaining <= 0) postCommitAckLossForTests = undefined;
-  return true;
+function resolveWriterOp(entry: Extract<Submission, { kind: "op" }>, result: unknown): void {
+  if (postCommitAckLossForTests?.op === entry.op) {
+    postCommitAckLossForTests = undefined;
+    entry.reject(new WriteIndeterminateError(entry.op, new Error("injected post-commit lost acknowledgement"), entry.opts?.idempotencyKey));
+  } else entry.resolve(result);
 }
 
 /**
@@ -284,7 +286,8 @@ function losePostCommitAckForTests(op: string): boolean {
  * size-1 writer pool.
  */
 export function initWriter(options: InitWriterOptions = {}): void {
-  const path = options.path ?? getDbPath();
+  // A file-backed main handle never executes writer bodies, even when an old caller requests memory.
+  const path = options.path && options.path !== ":memory:" ? options.path : getDbPath() ?? options.path;
   // EVERY caller-supplied number is validated BEFORE any of them is assigned: a RangeError thrown
   // after an earlier field was already written would leave the module in a half-applied config the
   // caller never asked for.
@@ -371,7 +374,6 @@ export async function shutdownWriter(): Promise<void> {
   }
   if (current?.kind === "in-process") current.stop.abort(new Error("writer gateway shut down"));
   if (current?.kind === "worker") await current.pool.destroy();
-  if (current?.kind === "in-process") await current.offLoop?.pool.destroy();
 }
 
 /** Whether the gateway is initialized (some callers guard bootstrap ordering on this). */
@@ -380,13 +382,14 @@ export function isWriterInitialized(): boolean {
 }
 
 export function writerStats(): WriterStats {
-  if (!backend) return { backend: "uninitialized", queued: 0, busy: 0, highWater: queueHighWater, wedged: null, drainYields };
+  const ops = { drainYields, onLoopOps, writerThreadOps };
+  if (!backend) return { backend: "uninitialized", queued: 0, busy: 0, highWater: queueHighWater, wedged: null, ...ops };
   const wedged = wedgedOp ? { op: wedgedOp.op, runningMs: Math.round(performance.now() - wedgedOp.startedAt) } : null;
   if (backend.kind === "in-process") {
-    return { backend: "in-process", queued: pendingWriteDepth(), busy: inFlightWrites(), highWater: queueHighWater, wedged, drainYields };
+    return { backend: "in-process", queued: pendingWriteDepth(), busy: inFlightWrites(), highWater: queueHighWater, wedged, ...ops };
   }
   const stats = backend.pool.stats;
-  return { backend: "worker", queued: pendingWriteDepth(), busy: stats.busy, highWater: queueHighWater, wedged, drainYields };
+  return { backend: "worker", queued: pendingWriteDepth(), busy: stats.busy, highWater: queueHighWater, wedged, ...ops };
 }
 
 function requireBackend(): Backend {
@@ -450,7 +453,7 @@ function pendingWriteDepth(): number {
 
 /** Includes an in-process writer waiting asynchronously for BEGIN. */
 function inFlightWrites(): number {
-  return backend?.kind === "worker" ? backend.pool.stats.busy : Math.max(Number(backend?.busy ?? false), backend?.offLoop?.pool.stats.busy ?? 0);
+  return backend?.kind === "worker" ? backend.pool.stats.busy : Number(backend?.busy ?? false);
 }
 
 /** Reject every caller attached to a submission (used for teardown / dispatch-time backend loss). */
@@ -463,7 +466,7 @@ function rejectEntry(entry: Submission, error: unknown): void {
  *  before the write is ever submitted, so a keyless non-idempotent write can never be retried into a
  *  duplicate. `key` is the per-write key (the batch/coalesce paths pass each entry's own key). */
 function guardIdempotency(op: string, key: string | undefined): void {
-  if (key === undefined && !isIdempotentWriterOp(op)) throw new WriteRetrySafetyError(op);
+  if (key === undefined && !writerOpAllowsKeyless(op)) throw new WriteRetrySafetyError(op);
 }
 
 /** Backpressure admission (§3.6/§3.6.1). `count` is the number of writes this submission would ADD (1
@@ -553,19 +556,9 @@ async function dispatchEntry(entry: Submission): Promise<void> {
   if (back.kind === "in-process") {
     back.busy = true;
     try {
-      const path = getDbPath();
-      // An armed crash seam is a closure on THIS thread, so while one is armed the op runs here instead
-      // of on the file-DB worker (tests only; production never arms). Otherwise the fault would never fire.
-      if (path && path !== ":memory:" && isOffLoopWriterOp(entry.op) && armedWriterFaultCount() === 0) {
-        if (back.offLoop && back.offLoopGeneration !== getDbGeneration()) {
-          await back.offLoop.pool.destroy();
-          back.offLoop = undefined;
-        }
-        back.stop.signal.throwIfAborted();
-        back.offLoop ??= createFileWriter(path);
-        back.offLoopGeneration = getDbGeneration();
-        await dispatchWorker(entry, back.offLoop);
-      } else await dispatchInProcess(entry, back.stop.signal);
+      back.stop.signal.throwIfAborted();
+      onLoopOps += entryWrites(entry);
+      await dispatchInProcess(entry);
     } catch (error) { rejectEntry(entry, error); }
     finally { back.busy = false; }
     return;
@@ -573,6 +566,10 @@ async function dispatchEntry(entry: Submission): Promise<void> {
   await dispatchWorker(entry, back);
 }
 
+function entryWrites(entry: Submission): number {
+  return entry.kind === "op" ? 1 : entry.argsList.length;
+}
+
 /**
  * The per-entry dedup keys for a batch/coalesce job (H5 §3.7.1). A dbWriteBatch carries ONE key for
  * the whole call and derives a stable per-entry key `${key}#${i}`, so a blind retry of the same batch
@@ -600,18 +597,12 @@ function entryKeys(entry: Extract<Submission, { kind: "batch" | "coalesce" }>):
  * (`dispatchWorker`) is deliberately NOT wrapped: its op body runs off-thread, so there is no on-loop
  * block to attribute (only the sub-floor enqueue, which the record floor drops).
  */
-async function dispatchInProcess(entry: Submission, signal: AbortSignal): Promise<void> {
-  const execute = <T>(fn: () => T) => onLoopWriteTransaction(
-    fn, (attempt) => captureSyncFrame({ op: entry.op, callsite: entry.callsite }, attempt), writerTimeoutMs, signal,
-  );
+async function dispatchInProcess(entry: Submission): Promise<void> {
+  const execute = <T>(fn: () => T) => captureSyncFrame({ op: entry.op, callsite: entry.callsite }, fn);
   if (entry.kind === "op") {
     try {
-      const result = cloneIn(await execute(() => runWriterOp(entry.op, cloneIn(entry.args), { now: entry.now, presence: cloneIn(entry.presence) }, entry.opts?.idempotencyKey)));
-      if (losePostCommitAckForTests(entry.op)) {
-        entry.reject(new WriteIndeterminateError(entry.op, new Error("injected post-commit lost acknowledgement"), entry.opts?.idempotencyKey));
-        return;
-      }
-      entry.resolve(result);
+      const result = cloneIn(execute(() => runWriterOp(entry.op, cloneIn(entry.args), { now: entry.now, presence: cloneIn(entry.presence) }, entry.opts?.idempotencyKey)));
+      resolveWriterOp(entry, result);
     } catch (error) {
       entry.reject(reconstructInProcess(error));
     }
@@ -620,7 +611,7 @@ async function dispatchInProcess(entry: Submission, signal: AbortSignal): Promis
   // batch + coalesce share the SAVEPOINT-per-caller executor; only the fan-out differs.
   let coalesced: CoalescedEntry[];
   try {
-    const entries: BatchEntry[] = await execute(() => runWriterBatch(
+    const entries: BatchEntry[] = execute(() => runWriterBatch(
       entry.op,
       entry.argsList.map((a) => cloneIn(a)),
       entryKeys(entry),
@@ -653,6 +644,10 @@ async function dispatchWorker(entry: Submission, back: WorkerBackend): Promise<v
   // retrySafe stays false (default): a write must NEVER be auto-re-dispatched (it would repeat its
   // effect). No pool timeout is armed — the deadline is the gateway's own (§3.6.1).
   const startedAt = performance.now();
+  // #3798 — the drain runs outside any caller, so its dispatch and result handling are charged to the
+  // caller that submitted this entry (the reader pool does the same per read).
+  markCallerResume(entry.callsite);
+  writerThreadOps += entryWrites(entry);
   const poolPromise = back.pool.run<WriterJobInput, WriterJobResult>(WRITER_TASK_NAME, input, { labels });
 
   let timer: ReturnType<typeof setTimeout> | undefined;
@@ -663,6 +658,7 @@ async function dispatchWorker(entry: Submission, back: WorkerBackend): Promise<v
     }),
   ]);
   if (timer) clearTimeout(timer);
+  markCallerResume(entry.callsite);
 
   if (raced.done === "timeout") {
     // WEDGED (§3.6.1). The op is still running and still holds the lock; do NOT replace the worker.
@@ -707,7 +703,7 @@ function fanOutWorker(entry: Submission, result: WriterJobResult): void {
       entry.reject(new Error(`writer worker returned a ${result.kind} result for a single op`));
       return;
     }
-    if (result.ok) entry.resolve(result.result);
+    if (result.ok) resolveWriterOp(entry, result.result);
     else entry.reject(reconstructDbError(result.error));
     return;
   }