@humwick/server 0.130.2 → 0.130.4

package/src/services/operator-decisions.ts

@@ -1,17 +1,20 @@
+import { withdrawOpenOperatorDecisionAsync, updateOpenOperatorDecisionAsync } from "../db/runtime-tail-async";
+import { randomUUID } from "node:crypto";
+import { getGateway } from "../db/gateway";
+import type { answerOperatorDecisionBody } from "../db/operator-answer-write";
+import type { SendMessageInput } from "../types";
 import { workflowDecisionAnswer } from "./workflow-decision-answer";
 import { getWorkflowOperatorDecision } from "../db/operator-decisions";
 import { actingUserSinkOf } from "./auth-context";
 import { DecisionNotFoundError, authorizeDecision } from "./decision-audience";
 // #2885 — operator decisions: a coordinator files a structured question for the operator; the
 // answer goes back as ONE message to `coordinator:<teamId>`, so whoever holds the seat gets it.
-import { coordinatesActiveTeam, getAgent, getOperatorDecision, insertOperatorDecision, listOperatorDecisions, answerOpenOperatorDecision,
-  setOperatorDecisionAnswerMessage, updateOpenOperatorDecision, withdrawOpenOperatorDecision, writeTransaction, ValidationError,
-  type OperatorDecisionContent } from "../db";
+import { coordinatesActiveTeam, getAgent, getOperatorDecision, insertOperatorDecision, listOperatorDecisions, answerOpenOperatorDecision, setOperatorDecisionAnswerMessage, writeTransaction, ValidationError, type OperatorDecisionContent } from "../db";
 import { acquireCoordinatorTeam } from "./team";
 import { emitRelayEvent } from "../events";
 import { emitNotificationCreated, notificationForDecision } from "../dashboard-notifications";
 import { cleanStringArray, optionalEnum, optionalString, stringField } from "../validation";
-import { sendMessageService } from "./send-message";
+import { validateSendMessageAuthorization, emitSendResults } from "./send-message";
 import type { AuthContext } from "./auth-context";
 import { ServiceAuthError } from "./errors";
 import { OPERATOR_ACTION_DONE, OPERATOR_ACTION_NOT_DONE, OPERATOR_ACTION_OUTCOME_ID, OPERATOR_DECISION_KINDS, OPERATOR_DECISION_QUESTION_KINDS,
@@ -129,12 +132,12 @@ function emitDecisionChanged(decision: OperatorDecision): void {
 }
 
 /** The team the caller coordinates. `mint` lets a teamless coordinator-capable caller found one. */
-export function callerDecisionTeam(ctx: AuthContext, mint: boolean): string {
+export async function callerDecisionTeam(ctx: AuthContext, mint: boolean): Promise<string> {
   const agentId = ctx.callerAgentId;
   if (!agentId) throw new ServiceAuthError("relay_decision needs a single caller agent identity");
   const agent = getAgent(agentId);
   if (agent?.teamId && coordinatesActiveTeam(agentId, agent.teamId)) return agent.teamId;
-  if (mint && agent && !agent.teamId && ctx.scopes.includes("command:spawn")) return acquireCoordinatorTeam(agentId).id;
+  if (mint && agent && !agent.teamId && ctx.scopes.includes("command:spawn")) return (await acquireCoordinatorTeam(agentId)).id;
   throw new ServiceAuthError("decisions belong to a team's coordinator; you do not coordinate an active team (a replacement claims it with relay_team_claim)");
 }
 
@@ -144,12 +147,12 @@ export function teamDecision(teamId: string, id: number): OperatorDecision {
   return decision;
 }
 
-function insertFiledDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now: number, workflow?: OperatorDecision["workflow"], coordinatorNote?: string): OperatorDecision {
+async function prepareFiledDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now: number, workflow?: OperatorDecision["workflow"], coordinatorNote?: string): Promise<Parameters<typeof insertOperatorDecision>[0]> {
   const content = cleanDecisionContent(args, undefined, Boolean(workflow));
   // Each input keeps its own bound; appending a valid note must not reject a valid context (#3586).
   if (coordinatorNote) content.context = [content.context, `Coordinator note: ${coordinatorNote}`].filter(Boolean).join("\n\n");
-  const teamId = callerDecisionTeam(ctx, true);
-  return insertOperatorDecision({ ...content, teamId, ...(projectId ? { projectId } : {}), filedBy: ctx.callerAgentId!, now, ...(workflow ? { workflow } : {}) });
+  const teamId = (await callerDecisionTeam(ctx, true));
+  return { ...content, teamId, ...(projectId ? { projectId } : {}), filedBy: ctx.callerAgentId!, now, ...(workflow ? { workflow } : {}) };
 }
 
 function publishFiledDecision(decision: OperatorDecision): OperatorDecision {
@@ -158,22 +161,23 @@ function publishFiledDecision(decision: OperatorDecision): OperatorDecision {
   return decision;
 }
 
-export function fileDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now = Date.now()): OperatorDecision {
-  return publishFiledDecision(insertFiledDecision(ctx, args, projectId, now));
+export async function fileDecision(ctx: AuthContext, args: Record<string, unknown>, projectId: string | undefined, now = Date.now()): Promise<OperatorDecision> {
+  const input = await prepareFiledDecision(ctx, args, projectId, now);
+  return publishFiledDecision(await getGateway().write("operatorDecisions.insert", input, { idempotencyKey: randomUUID() }) as unknown as OperatorDecision);
 }
 
-export function updateDecision(ctx: AuthContext, id: number, args: Record<string, unknown>, now = Date.now()): OperatorDecision {
-  const current = teamDecision(callerDecisionTeam(ctx, false), id);
+export async function updateDecision(ctx: AuthContext, id: number, args: Record<string, unknown>, now = Date.now()): Promise<OperatorDecision> {
+  const current = teamDecision((await callerDecisionTeam(ctx, false)), id);
   if (current.workflow && args.questions !== undefined) throw new ValidationError("workflow choices are frozen for this step activation");
-  if (!updateOpenOperatorDecision(id, cleanDecisionContent(args, current), now)) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
+  if (!(await updateOpenOperatorDecisionAsync(id, cleanDecisionContent(args, current), now))) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
   const updated = getOperatorDecision(id)!;
   emitDecisionChanged(updated);
   return updated;
 }
 
-export function withdrawDecision(ctx: AuthContext, id: number, now = Date.now()): OperatorDecision {
-  const current = teamDecision(callerDecisionTeam(ctx, false), id);
-  if (!withdrawOpenOperatorDecision(id, now)) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
+export async function withdrawDecision(ctx: AuthContext, id: number, now = Date.now()): Promise<OperatorDecision> {
+  const current = teamDecision((await callerDecisionTeam(ctx, false)), id);
+  if (!(await withdrawOpenOperatorDecisionAsync(id, now))) throw new DecisionConflictError(`decision #${id} is ${current.status}, not open`);
   const withdrawn = getOperatorDecision(id)!;
   emitDecisionChanged(withdrawn);
   return withdrawn;
@@ -201,7 +205,7 @@ function renderAnswerBody(decision: OperatorDecision, answers: OperatorDecisionA
  * transaction: a crash or a refused send can never leave an answered row without its message.
  * The message never expires (maxAgeSeconds null), so a seat vacant for days still receives it.
  */
-export function answerDecision(ctx: AuthContext, id: number, input: { answers: unknown; note?: unknown }, now = Date.now()): { decision: OperatorDecision; messageId: number } {
+export async function answerDecision(ctx: AuthContext, id: number, input: { answers: unknown; note?: unknown }, now = Date.now()): Promise<{ decision: OperatorDecision; messageId: number }> {
   if (ctx.callerAgentId) throw new ServiceAuthError("operator decisions are answered by the operator, not by an agent");
   const current = getOperatorDecision(id);
   if (!current) throw new DecisionNotFoundError(`decision #${id} not found`);
@@ -216,21 +220,16 @@ export function answerDecision(ctx: AuthContext, id: number, input: { answers: u
     throw new ValidationError(`note required: say why you could not do it (${OPERATOR_ACTION_NOT_DONE})`);
   }
   const answeredBy = ctx.actor.kind === "component" ? ctx.actor.id : actingUserSinkOf(ctx);
-  const sent = writeTransaction(() => {
-    if (!answerOpenOperatorDecision(id, { answers, ...(note ? { note } : {}), answeredBy, now })) {
-      throw new DecisionConflictError(`decision #${id} was answered or withdrawn meanwhile`);
-    }
-    const { message, publish } = sendMessageService({
-      from: actingUserSinkOf(ctx), to: current.teamId.startsWith("host-privacy:") || current.teamId === "vault-expiry:global" ? current.filedBy : `coordinator:${current.teamId}`, body: renderAnswerBody(current, answers, note),
-      idempotencyKey: `decision:${id}:answer`, maxAgeSeconds: null, meta: { decisionId: id },
-    }, ctx, { deferLiveEffects: true });
-    setOperatorDecisionAnswerMessage(id, message.id);
-    return { messageId: message.id, publish };
-  });
-  // Live effects only after COMMIT: a rolled-back answer must never have been delivered (#2887).
-  sent.publish?.();
-  const { messageId } = sent;
-  const decision = getOperatorDecision(id)!;
+  const message: SendMessageInput = {
+    from: actingUserSinkOf(ctx), to: current.teamId.startsWith("host-privacy:") || current.teamId === "vault-expiry:global" ? current.filedBy : `coordinator:${current.teamId}`, body: renderAnswerBody(current, answers, note),
+    idempotencyKey: `decision:${id}:answer`, maxAgeSeconds: null, meta: { decisionId: id },
+  };
+  validateSendMessageAuthorization(message, ctx);
+  const written = await getGateway().write("operatorDecisions.answer", { id, answer: { answers, ...(note ? { note } : {}), answeredBy, now }, message }, { critical: true }) as unknown as ReturnType<typeof answerOperatorDecisionBody>;
+  if (!written) throw new DecisionConflictError(`decision #${id} was answered or withdrawn meanwhile`);
+  const { decision, result } = written;
+  (await emitSendResults([result]));
+  const messageId = result.message.id;
   emitDecisionChanged(decision);
   return { decision, messageId };
 }
@@ -244,17 +243,14 @@ export function cleanWorkflowAnswers(decision: Pick<OperatorDecision, "questions
 }
 
 /** The effect identity and filing share a transaction, so replay cannot create another card. */
-export function fileWorkflowDecision(ctx: AuthContext, args: Record<string, unknown>, workflow: NonNullable<OperatorDecision["workflow"]>, projectId?: string, coordinatorNote?: string): OperatorDecision {
+export async function fileWorkflowDecision(ctx: AuthContext, args: Record<string, unknown>, workflow: NonNullable<OperatorDecision["workflow"]>, projectId?: string, coordinatorNote?: string): Promise<OperatorDecision> {
   const note = optionalString(coordinatorNote, "note", MAX_TEXT);
-  const filed = writeTransaction(() => {
-    const existing = getWorkflowOperatorDecision(workflow.effectId);
-    if (existing) return { decision: existing, created: false };
-    return { decision: insertFiledDecision(ctx, args, projectId, Date.now(), workflow, note), created: true };
-  });
+  const input = await prepareFiledDecision(ctx, args, projectId, Date.now(), workflow, note);
+  const filed = await getGateway().write("operatorDecisions.fileWorkflow", input) as unknown as { decision: OperatorDecision; created: boolean };
   return filed.created ? publishFiledDecision(filed.decision) : filed.decision;
 }
 
-export function withdrawWorkflowDecision(effectId: string): void {
+export async function withdrawWorkflowDecision(effectId: string): Promise<void> {
   const decision = getWorkflowOperatorDecision(effectId);
-  if (decision && withdrawOpenOperatorDecision(decision.id, Date.now())) emitDecisionChanged(getOperatorDecision(decision.id)!);
+  if (decision && (await withdrawOpenOperatorDecisionAsync(decision.id, Date.now()))) emitDecisionChanged(getOperatorDecision(decision.id)!);
 }

package/src/services/orchestrator-registration-recovery.ts

@@ -4,9 +4,13 @@ import { recoverOrchestratorLegacyLandings } from "./orchestrator-landing-recove
 import { resumeDeferredWorkflowCleanup } from "./workflow-deferred-cleanup";
 import { workflowTaskDelivered } from "./workflow-runs";
 
+/** #3826 — the workflow follow-up waits on the supervisor queue, so it runs after the register reply. Deferred
+ *  cleanup stays durable: a failed resume is retried by the next registration or hub boot. */
 export async function recoverRegisteredOrchestrator(orchestratorId: string): Promise<void> {
   await reconcileOrchestratorSchedulerCommands(orchestratorId);
-  await resumeDeferredWorkflowCleanup(orchestratorId);
-  await workflowTaskDelivered();
+  void fireAndForget(`[orchestrator] workflow cleanup resume for ${orchestratorId}`, async () => {
+    await resumeDeferredWorkflowCleanup(orchestratorId);
+    await workflowTaskDelivered();
+  });
   void fireAndForget(`[orchestrator] legacy landing recovery for ${orchestratorId}`, () => recoverOrchestratorLegacyLandings(orchestratorId));
 }

package/src/services/orchestrator-upgrade.ts

@@ -1,5 +1,7 @@
-import { getOrchestrator, setOrchestratorUpgradeState } from "../db";
-import { createCommand, getCommand, updateCommand } from "../commands-db";
+import { updateCommandAsync, createCommandAsync } from "../commands-write";
+import { setOrchestratorUpgradeStateAsync } from "../db/orchestrators-async";
+import { getOrchestrator } from "../db";
+import { getCommand } from "../commands-db";
 import { emitOrchestratorStatus } from "../sse";
 import { emitCommandEvent } from "../command-events";
 import type { ActivityEventInput } from "../types";
@@ -10,18 +12,18 @@ export const ORCH_UPGRADE_DEADLINE_MS = 5 * 60_000;
 // central provider-config rows (#465). The orchestrator reports its files via the
 // command result; the server seeds the rows (see patchCommand). Capability-gated so
 // pre-#465 orchestrators that lack the handler never get a command they'd reject.
-export function dispatchProviderConfigMigration(
+export async function dispatchProviderConfigMigration(
   orch: NonNullable<ReturnType<typeof getOrchestrator>>,
   requestedBy = "system",
-): ReturnType<typeof createCommand> | null {
+): Promise<ReturnType<typeof createCommandAsync> | null> {
   if (!orch.capabilities?.migrateProviderConfig) return null;
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "orchestrator.migrate-provider-config",
     source: "system",
     target: orch.agentId,
     ttlMs: 10 * 60_000,
     params: { orchestratorId: orch.id, requestedBy },
-  });
+  }));
   emitCommandEvent(command, "command.requested");
   return command;
 }
@@ -42,14 +44,14 @@ export async function reconcileOrchestratorUpgrade(
   // before retrying. The running process's gitSha is the artifact identity and must match too.
   if (reachedTarget && up.status === "succeeded" && up.error) {
     const { error: _previousError, ...successState } = up;
-    setOrchestratorUpgradeState(orch.id, successState);
+    (await setOrchestratorUpgradeStateAsync(orch.id, successState));
     emitOrchestratorStatus(orch.id);
     return;
   }
   if (reachedTarget && reported && (up.status === "pending" || up.status === "failed")) {
-    if (up.commandId) updateCommand(up.commandId, { status: "succeeded", result: { version: reported, ...(up.fromVersion ? { fromVersion: up.fromVersion } : {}) } });
+    if (up.commandId) (await updateCommandAsync(up.commandId, { status: "succeeded", result: { version: reported, ...(up.fromVersion ? { fromVersion: up.fromVersion } : {}) } }));
     const { error: _previousError, ...successState } = up;
-    setOrchestratorUpgradeState(orch.id, { ...successState, status: "succeeded", settledAt: Date.now() });
+    (await setOrchestratorUpgradeStateAsync(orch.id, { ...successState, status: "succeeded", settledAt: Date.now() }));
     await auditEvent({
       clientId: `server-orchestrator-upgraded-${orch.id}-${Date.now()}`,
       kind: "state",
@@ -62,12 +64,12 @@ export async function reconcileOrchestratorUpgrade(
     });
     // Upgrade settled — the orchestrator is now running new-enough code to handle
     // the provider-config migration, so seed the central rows from its local files (#465).
-    dispatchProviderConfigMigration(orch);
+    (await dispatchProviderConfigMigration(orch));
     emitOrchestratorStatus(orch.id);
   } else if (up.status === "pending" && Date.now() - up.requestedAt > ORCH_UPGRADE_DEADLINE_MS) {
     const errMsg = `upgrade timed out; orchestrator still reports ${reported ?? "unknown"} (wanted ${up.desiredVersion})`;
-    if (up.commandId) updateCommand(up.commandId, { status: "failed", error: errMsg });
-    setOrchestratorUpgradeState(orch.id, { ...up, status: "failed", settledAt: Date.now(), error: errMsg });
+    if (up.commandId) (await updateCommandAsync(up.commandId, { status: "failed", error: errMsg }));
+    (await setOrchestratorUpgradeStateAsync(orch.id, { ...up, status: "failed", settledAt: Date.now(), error: errMsg }));
     await auditEvent({
       clientId: `server-orchestrator-upgrade-failed-${orch.id}-${Date.now()}`,
       kind: "state",

package/src/services/permission-decision.ts

@@ -1,6 +1,6 @@
 import { isHumanAgentId } from "@humwick/sdk";
 import { randomUUID } from "node:crypto";
-import { createCommandInternal } from "../commands-db";
+import { createAgentControlAsync } from "../db/agent-control-async";
 import { emitCommandEvent } from "../command-events";
 import { ValidationError, createActivityEventAsync, getAgent } from "../db";
 import { agentProviderState } from "../provider-state";
@@ -66,7 +66,7 @@ export async function dispatchAgentPermissionDecision(
 ): Promise<AgentPermissionDecisionResult> {
   const agent = getAgent(input.agentId);
   if (!agent) throw new PermissionDecisionTargetError(`agent ${input.agentId} not found`);
-  authorizeShutdown(ctx, { agentId: agent.id, requestedVia: input.requestedVia });
+  (await authorizeShutdown(ctx, { agentId: agent.id, requestedVia: input.requestedVia }));
   assertControlEligible(agent);
 
   const pendingApprovalId = currentApprovalId(agent);
@@ -122,7 +122,8 @@ export async function dispatchAgentPermissionDecision(
   // Audit admission precedes the durable command, matching the other service-layer agent controls.
   const event = await createActivityEventAsync(activityInput);
   revalidatePendingApproval(agent, approvalId);
-  const command = createCommandInternal({ input: commandInput, id: commandId });
+  const { command: admitted } = await createAgentControlAsync({ agent, commandInput, commandId, approvalId });
+  const command = admitted!;
   emitCommandEvent(command, "command.requested");
   emitActivityEvent(event);
   return { approvalId, decision: input.decision, command };

package/src/services/plan-ci-notice.ts

@@ -46,7 +46,7 @@ export async function planCiNotice(run: WorkflowRunRecord, payload: Record<strin
   const to = plan && planNoticeTarget(plan);
   if (!to) return undefined;
   for (const incidentId of block.incidentIds) {
-    notifySystemMessage(to, {
+    await notifySystemMessage(to, {
       subject: `Plan ${plan.title ?? plan.id}: CI blocked`,
       body: `Plan ${plan.id}: T${run.taskId}, run ${run.id}, landed SHA ${block.sha}, is blocked by CI incident ${incidentId}. Fix the incident; Relay automatically retries each blocked run's exact landed SHA after clearance. Slots and dependents wait. relay_plan_get shows every blocked Task and run.`,
       idempotencyKey: `plan:${plan.id}:ci:${incidentId}`, replyExpected: false,

package/src/services/plan-conformance.ts

@@ -71,15 +71,15 @@ function cleanVerdictItems(value: unknown): PlanConformanceItem[] {
   });
 }
 
-export function emitPlanTaskEvents(events: PlanGraphTaskEvent[] | undefined): void {
+export async function emitPlanTaskEvents(events: PlanGraphTaskEvent[] | undefined): Promise<void> {
   for (const event of events ?? []) {
     emitTaskChanged(event.task, event.type);
     if (event.type === "task.created") {
       // A Task is created once, so a replayed aggregate write (its gateway result re-read) notifies once (#3660).
-      emitTaskSemanticNotification({ task: event.task, transition: "created", actor: event.actor, occurrenceKey: "created" });
+      await emitTaskSemanticNotification({ task: event.task, transition: "created", actor: event.actor, occurrenceKey: "created" });
     } else {
       const transition = taskTransitionForStatus(event.task.status, event.task.blockedBy);
-      if (transition) emitTaskSemanticNotification({ task: event.task, transition, actor: event.actor, occurrenceKey: undefined });
+      if (transition) await emitTaskSemanticNotification({ task: event.task, transition, actor: event.actor, occurrenceKey: undefined });
     }
   }
 }
@@ -100,6 +100,6 @@ export async function recordPlanConformance(input: { planId?: unknown; mainSha?:
   const mainShaCheck = await checkMainSha(planId, mainSha);
   const result = await recordPlanConformanceAsync({ planId, mainSha, mainShaCheck, items, actor });
   emitRelayEvent({ type: "plan.changed", source: actor, subject: result.plan.id, data: { plan: result.plan, actor } });
-  emitPlanTaskEvents(result.taskEvents);
+  await emitPlanTaskEvents(result.taskEvents);
   return { planId: result.plan.id, version: result.plan.version, verdict: result.verdict, completion: result.plan.completion, gapTaskIds: result.gapTaskIds, ...(result.reusedGapTaskIds.length ? { reusedGapTaskIds: result.reusedGapTaskIds } : {}), conformance: result.plan.conformance };
 }

package/src/services/plan-dispatch-policy.ts

@@ -1,5 +1,5 @@
 // #3660 — plan autopilot readiness and wake policy as pure rules over durable facts (slots, Tasks, runs).
-import { planSlotOccupies, type Plan, type PlanDispatchSlot, type PlanDispatchSlotStatus, type TaskDetail, type TaskTerminalStage } from "../types";
+import { planSlotOccupies, type Plan, type PlanNode, type PlanDispatchSlot, type PlanDispatchSlotStatus, type TaskDetail, type TaskTerminalStage } from "../types";
 import { taskTerminalStage } from "../task-completion";
 
 export interface PlanMember { nodeId: string; taskId: number }
@@ -12,13 +12,13 @@ export function planMembers(plan: Pick<Plan, "nodes">): PlanMember[] {
   });
 }
 
-/** Why a plan cannot be started, per node; empty when every node is a bound Task the dispatcher can run. */
+/** Only unfinished automatic work needs a Task; settled facts and manual gates are valid (#3819). */
 export function unsupportedPlanShape(plan: Pick<Plan, "nodes" | "acceptance">): string[] {
   const problems: string[] = [];
   if (!plan.acceptance?.length) problems.push("PLAN_ACCEPTANCE_REQUIRED: the auditor checks the plan's acceptance; add acceptance items");
   if (!plan.nodes.length) problems.push("UNSUPPORTED_PLAN_SHAPE: the plan has no nodes");
   const members = new Set(planMembers(plan).map((member) => member.nodeId));
-  const unbound = plan.nodes.filter((node) => !members.has(node.id)).map((node) => node.id);
+  const unbound = plan.nodes.filter((node) => node.status !== "landed" && node.statusSource !== "manual" && !members.has(node.id)).map((node) => node.id);
   if (unbound.length) problems.push(`UNSUPPORTED_PLAN_SHAPE: nodes ${unbound.join(", ")} are not bound to a Task (status-pinned or unbound nodes cannot be dispatched; create them with relay_task_create plan:{...})`);
   return problems;
 }
@@ -48,6 +48,13 @@ export function taskSucceeded(task: PrerequisiteTask | null, slot: Pick<PlanDisp
   return prerequisiteState(task, requiredStage).state === "satisfied";
 }
 
+/** Existing settled nodes are facts; a dispatched run still needs its verified result, including CI. */
+export function planNodeSettled(node: PlanNode, task: PrerequisiteTask | null, slot?: PlanDispatchSlot, requiredStage?: TaskTerminalStage): boolean {
+  if (node.statusSource === "manual") return node.status === "landed";
+  if (slot) return taskSucceeded(task, slot, requiredStage);
+  return node.status === "landed" || task?.status === "done" || task?.status === "canceled";
+}
+
 /** The stage an edge requires of its prerequisite; unnamed edges keep the original landed-on-main rule. */
 export function dependencyStage(task: Pick<TaskDetail, "dependsOnStages">, prerequisiteId: number): TaskTerminalStage {
   return task.dependsOnStages?.[String(prerequisiteId)] ?? "landed-on-main";

package/src/services/plan-dispatch.ts

@@ -18,7 +18,7 @@ import { launchWorkflowRun, prepareWorkflowRun } from "./workflow-runs";
 import { ensureSupervisor, invoke, type Supervisor } from "./workflow-supervisor";
 import { stampPins } from "./workflow-pins";
 import { emitPlan } from "./plan-graph";
-import { dependencyStage, memberReady, occupiedSlots, planMembers, prerequisiteState, slotFromRun, taskSucceeded, unsupportedPlanShape } from "./plan-dispatch-policy";
+import { dependencyStage, memberReady, occupiedSlots, planMembers, planNodeSettled, prerequisiteState, slotFromRun, taskSucceeded, unsupportedPlanShape } from "./plan-dispatch-policy";
 import type { AuthContext } from "./auth-context";
 import { planSlotOccupies, type Plan, type PlanDispatch, type PlanDispatchSlot, type TaskDetail } from "../types";
 
@@ -44,9 +44,13 @@ export async function startPlanDispatch(input: { planId?: unknown; expectedVersi
   if (plan.archived) throw new ValidationError(`plan ${plan.id} is archived`);
   const problems = unsupportedPlanShape(plan);
   if (problems.length) throw new ValidationError(problems.join("; "));
-  const members = planMembers(plan);
-  const tasks = await Promise.all(members.map((member) => getTaskDetailAsync(member.taskId)));
-  const memberIds = new Set(members.map((member) => member.taskId));
+  const nodes = new Map(plan.nodes.map((node) => [node.id, node]));
+  const allMembers = planMembers(plan);
+  const allTasks = await Promise.all(allMembers.map((member) => getTaskDetailAsync(member.taskId)));
+  const unfinished = allMembers.flatMap((member, index) => planNodeSettled(nodes.get(member.nodeId)!, allTasks[index]!) ? [] : [{ member, task: allTasks[index]! }]);
+  const members = unfinished.map(({ member }) => member);
+  const tasks = unfinished.map(({ task }) => task);
+  const memberIds = new Set(plan.nodes.map((node) => Number(node.refs?.taskId)));
   for (const member of tasks) {
     for (const id of member?.dependsOn ?? []) {
       if (memberIds.has(id)) continue;
@@ -55,7 +59,7 @@ export async function startPlanDispatch(input: { planId?: unknown; expectedVersi
     }
   }
   const repos = new Set(tasks.map((task) => task?.repo).filter(Boolean));
-  if (repos.size !== 1) throw new ValidationError(`UNSUPPORTED_PLAN_SHAPE: slice 1a dispatches one repo; the plan's Tasks name ${repos.size ? [...repos].join(", ") : "no repo"}`);
+  if (tasks.length && repos.size !== 1) throw new ValidationError(`UNSUPPORTED_PLAN_SHAPE: slice 1a dispatches one repo; the plan's Tasks name ${repos.size ? [...repos].join(", ") : "no repo"}`);
   let cwd: string | undefined;
   for (const [index, task] of tasks.entries()) {
     if (!task || task.status === "canceled") throw new ValidationError(`UNSUPPORTED_PLAN_SHAPE: T${members[index]!.taskId} is missing or canceled`);
@@ -115,6 +119,8 @@ function ensureListening(): void {
     if (event.type === "task.stage" || event.type === "task.status" || event.type === "task.updated") {
       const plans = watched.get(Number(event.data.id ?? event.subject));
       if (plans?.size) void fireAndForget("[plan-dispatch] reconcile", () => requestReconcile(plans));
+    } else if (event.type === "plan.changed" && event.subject && dispatching.has(event.subject)) {
+      void fireAndForget("[plan-dispatch] reconcile", () => requestReconcile([event.subject!]));
     } else if (dispatching.size && (event.type === "workflow.changed" || event.type === "branch.landed" || event.type === "ci.status")) {
       void fireAndForget("[plan-dispatch] reconcile", () => requestReconcile());
     }
@@ -184,9 +190,22 @@ async function reconcilePlan(planId: string): Promise<void> {
     changed ||= next !== slot;
     slots.set(slot.taskId, next);
   }
+  const nodes = new Map(plan.nodes.map((node) => [node.id, node]));
+  const nodesForTask = new Map(plan.nodes.filter((node) => node.refs?.taskId).map((node) => [Number(node.refs!.taskId), node]));
+  const prerequisites = new Map<string, string[]>();
+  for (const edge of plan.edges) {
+    if (!prerequisites.has(edge.to)) prerequisites.set(edge.to, []);
+    prerequisites.get(edge.to)!.push(edge.from);
+  }
+  const settledNode = async (nodeId: string, requiredStage?: Parameters<typeof taskSucceeded>[2]) => {
+    const node = nodes.get(nodeId)!;
+    const id = Number(node.refs?.taskId);
+    return planNodeSettled(node, Number.isSafeInteger(id) && id > 0 ? await task(id) : null, slots.get(id), requiredStage);
+  };
   if (dispatch.state === "active") {
     for (const { nodeId, taskId } of members) {
       const slot = slots.get(taskId);
+      if (!slot && await settledNode(nodeId)) continue;
       if (slot && (slot.status !== "launch-failed" && slot.status !== "failed" && slot.status !== "cancelled")) {
         const dispatched = planSlotOccupies(slot.status) ? await task(taskId) : null;
         if (dispatched) await escalateRegressions(plan, nodeId, dispatched, memberTaskIds, task);
@@ -207,14 +226,16 @@ async function reconcilePlan(planId: string): Promise<void> {
       for (const id of member.dependsOn) {
         const prerequisite = await task(id);
         const required = dependencyStage(member, id);
-        if (taskSucceeded(prerequisite, slots.get(id), required)) succeeded.add(id);
+        const node = nodesForTask.get(id);
+        if (node ? await settledNode(node.id, required) : taskSucceeded(prerequisite, slots.get(id), required)) succeeded.add(id);
         else {
           const state = prerequisiteState(prerequisite, required);
           if (state.state === "unreachable") {
-            notifyPlan(plan, `T${taskId} prerequisite unreachable`, `Plan ${plan.id}, node ${nodeId} (T${taskId}) waits on T${id}, which is ${state.reason}. Replace the edge with relay_task_remove_dependency then relay_task_add_dependency, cancel the node, or wait for T${id} to be reopened. The dependent keeps waiting.`, `plan:${plan.id}:prereq:T${id}:${state.reason}`, { kind: "plan.prerequisite-unreachable", planId, nodeId, taskId, prerequisiteTaskId: id, reason: state.reason, nextActions: ["replace-edge", "cancel-node", "wait-for-reopen"] });
+            await notifyPlan(plan, `T${taskId} prerequisite unreachable`, `Plan ${plan.id}, node ${nodeId} (T${taskId}) waits on T${id}, which is ${state.reason}. Replace the edge with relay_task_remove_dependency then relay_task_add_dependency, cancel the node, or wait for T${id} to be reopened. The dependent keeps waiting.`, `plan:${plan.id}:prereq:T${id}:${state.reason}`, { kind: "plan.prerequisite-unreachable", planId, nodeId, taskId, prerequisiteTaskId: id, reason: state.reason, nextActions: ["replace-edge", "cancel-node", "wait-for-reopen"] });
           }
         }
       }
+      if (!(await Promise.all((prerequisites.get(nodeId) ?? []).map((id) => settledNode(id)))).every(Boolean)) continue;
       if (!memberReady(member, undefined, (id) => succeeded.has(id))) continue;
       if (occupiedSlots(slots.values()) >= dispatch.concurrency) continue;
       const claimed = await write<{ slot?: PlanDispatchSlot; reserved: boolean }>("planDispatch.slot.reserve", { planId, taskId, nodeId });
@@ -223,7 +244,7 @@ async function reconcilePlan(planId: string): Promise<void> {
       if (fault === "after-reserve") { halted = true; throw new Error("plan dispatch test fault: the process stopped after reserving a slot"); }
       slots.set(taskId, await launch(plan, claimed.slot));
     }
-    const settled = await Promise.all(members.map(async ({ taskId }) => taskSucceeded(await task(taskId), slots.get(taskId))));
+    const settled = await Promise.all(plan.nodes.map((node) => settledNode(node.id)));
     if (settled.every(Boolean)) {
       await openAudit(plan, dispatch, members.map(({ taskId }) => tasks.get(taskId)).find(Boolean) ?? null);
       changed = true;
@@ -245,7 +266,7 @@ async function escalateRegressions(plan: Plan, nodeId: string, member: TaskDetai
     const state = prerequisiteState(prerequisite, required);
     if (state.state === "satisfied") continue;
     const now = prerequisite ? `status ${prerequisite.status}, stage ${prerequisite.deliverableStage ?? "none"}${state.state === "unreachable" ? `, ${state.reason}` : ""}` : "missing";
-    notifyPlan(plan, `T${member.id} prerequisite regressed`, `Plan ${plan.id}, node ${nodeId} (T${member.id}) was dispatched on T${id} reaching ${required}, which no longer holds (${now}). The run continues; check whether its work is still valid, or cancel the node.`, `plan:${plan.id}:prereq:T${id}:regressed`, { kind: "plan.prerequisite-unreachable", planId: plan.id, nodeId, taskId: member.id, prerequisiteTaskId: id, reason: "regressed", requiredStage: required, nextActions: ["check-run", "cancel-node", "wait-for-recovery"] });
+    await notifyPlan(plan, `T${member.id} prerequisite regressed`, `Plan ${plan.id}, node ${nodeId} (T${member.id}) was dispatched on T${id} reaching ${required}, which no longer holds (${now}). The run continues; check whether its work is still valid, or cancel the node.`, `plan:${plan.id}:prereq:T${id}:regressed`, { kind: "plan.prerequisite-unreachable", planId: plan.id, nodeId, taskId: member.id, prerequisiteTaskId: id, reason: "regressed", requiredStage: required, nextActions: ["check-run", "cancel-node", "wait-for-recovery"] });
   }
 }
 
@@ -279,7 +300,7 @@ async function launch(plan: Plan, slot: PlanDispatchSlot): Promise<PlanDispatchS
     const started = await launchWorkflowRun(prepared, { ...(inputs ? { inputs } : {}), ...(pins ? { pins } : {}), requestKey: `plan:${plan.id}:T${task.id}:a${slot.attempt}` }, AUTOPILOT_CTX);
     return (await write<PlanDispatchSlot | undefined>("planDispatch.slot.update", { taskId: slot.taskId, attempt: slot.attempt, runId: String(started.runId), status: String(started.status) })) ?? slot;
   } catch (error) {
-    notifyPlan(plan, `T${slot.taskId} could not start`, `Plan ${plan.id} could not start T${slot.taskId}'s workflow: ${errMessage(error)}. Its slot is free and its dependents wait. Fix the cause, then start its workflow by hand (relay_workflow_start); the plan adopts that run.`, `plan:${plan.id}:launch-failed:T${slot.taskId}:a${slot.attempt}`, { kind: "plan.dispatch-failed", planId: plan.id, taskId: slot.taskId });
+    await notifyPlan(plan, `T${slot.taskId} could not start`, `Plan ${plan.id} could not start T${slot.taskId}'s workflow: ${errMessage(error)}. Its slot is free and its dependents wait. Fix the cause, then start its workflow by hand (relay_workflow_start); the plan adopts that run.`, `plan:${plan.id}:launch-failed:T${slot.taskId}:a${slot.attempt}`, { kind: "plan.dispatch-failed", planId: plan.id, taskId: slot.taskId });
     return (await write<PlanDispatchSlot | undefined>("planDispatch.slot.update", { taskId: slot.taskId, attempt: slot.attempt, status: "launch-failed", error: errMessage(error).slice(0, 2000) })) ?? slot;
   }
 }
@@ -310,7 +331,7 @@ async function driveAudit(sup: Supervisor, plan: Plan): Promise<boolean> {
       const started = await launchWorkflowRun(prepared, { requestKey: `plan:${plan.id}:audit` }, AUTOPILOT_CTX);
       await write("planDispatch.audit.update", { planId: plan.id, runId: String(started.runId), status: String(started.status) });
     } catch (error) {
-      notifyPlan(plan, "audit could not start", `Plan ${plan.id}: every node landed, but its conformance audit (T${audit.taskId}) could not start: ${errMessage(error)}. Start ${PLAN_CONFORMANCE_WORKFLOW} on T${audit.taskId} by hand, or audit and record relay_plan_conformance yourself.`, `plan:${plan.id}:audit-failed`, { kind: "plan.dispatch-failed", planId: plan.id, taskId: audit.taskId });
+      await notifyPlan(plan, "audit could not start", `Plan ${plan.id}: every node landed, but its conformance audit (T${audit.taskId}) could not start: ${errMessage(error)}. Start ${PLAN_CONFORMANCE_WORKFLOW} on T${audit.taskId} by hand, or audit and record relay_plan_conformance yourself.`, `plan:${plan.id}:audit-failed`, { kind: "plan.dispatch-failed", planId: plan.id, taskId: audit.taskId });
       await write("planDispatch.audit.update", { planId: plan.id, status: "launch-failed" });
     }
     return true;
@@ -324,14 +345,14 @@ async function driveAudit(sup: Supervisor, plan: Plan): Promise<boolean> {
     dispatching.delete(plan.id);
     watchPlan(plan.id, new Set());
     const slots = plan.dispatch!.slots.map((slot) => `${slot.nodeId} T${slot.taskId} ${slot.runId ?? "no run"} ${slot.landedSha?.slice(0, 12) ?? ""}`.trim());
-    notifyPlan(plan, "done", [`Plan ${plan.id}${plan.title ? ` "${plan.title}"` : ""} is done: conformance passed on ${audit.mainSha} at version ${plan.version}.`, ...slots, `Audit T${audit.taskId} run ${audit.runId}.`].join("\n"), `plan:${plan.id}:result:v${plan.version}`, { kind: "plan.result", planId: plan.id, planVersion: plan.version, mainSha: audit.mainSha });
+    await notifyPlan(plan, "done", [`Plan ${plan.id}${plan.title ? ` "${plan.title}"` : ""} is done: conformance passed on ${audit.mainSha} at version ${plan.version}.`, ...slots, `Audit T${audit.taskId} run ${audit.runId}.`].join("\n"), `plan:${plan.id}:result:v${plan.version}`, { kind: "plan.result", planId: plan.id, planVersion: plan.version, mainSha: audit.mainSha });
   }
   return true;
 }
 
-function notifyPlan(plan: Plan, subject: string, body: string, idempotencyKey: string, payload: Json): void {
+async function notifyPlan(plan: Plan, subject: string, body: string, idempotencyKey: string, payload: Json): Promise<void> {
   const to = planNoticeTarget(plan);
-  if (to) notifySystemMessage(to, { subject: `Plan ${plan.title ?? plan.id}: ${subject}`, body, idempotencyKey, replyExpected: false, payload });
+  if (to) await notifySystemMessage(to, { subject: `Plan ${plan.title ?? plan.id}: ${subject}`, body, idempotencyKey, replyExpected: false, payload });
 }
 
 // --- serving ---------------------------------------------------------------------------------------