@humwick/server 0.130.2 → 0.130.4

package/src/task-dispatch-live.ts

@@ -5,18 +5,20 @@ import { listOrchestratorsAsync } from "./db/orchestrators-async";
 import { listHostViewsAsync } from "./db/hosts-async";
 import { providerQuotaBandsFor, advertisedProvidersFrom } from "./spawn-targets";
 import { dispatchPolicyFor } from "./routing-policy-store";
-import { providerPlacementReady } from "./spawn-placement";
+import { providerPlacementReady, spawnHostCapAdmission } from "./spawn-placement";
 import { apiOverflowContextAsync, CLAUDE_API_PROVIDER } from "./claude-api-overflow";
 import { apiExpiryPaceAsync } from "./claude-api-expiry";
 import { liveTargetAdmission } from "./dispatch-availability";
 
 /** Reader-gateway shell for production callers. The ranking core remains the pure sync function. */
-export type DispatchSnapshot = DispatchContext & Required<Pick<DispatchContext, "now" | "catalog" | "bands" | "policy" | "preferences" | "advertisedProviders" | "targetAvailable">> & { probeUncertainty: Set<string> };
+export type DispatchSnapshot = DispatchContext & Required<Pick<DispatchContext, "now" | "catalog" | "bands" | "policy" | "preferences" | "advertisedProviders" | "targetAvailable">> & { probeUncertainty: Set<string>; pinnedHostAtAgentCap?: boolean };
 
 export async function captureDispatchContext(ctx: Omit<DispatchContext, "policy" | "bands" | "catalog"> = {}): Promise<DispatchSnapshot> {
   const now = ctx.now ?? Date.now();
   const [snapshot, orchestrators, hostViews] = await Promise.all([providerQuotaRoutingSnapshotAsync(now), listOrchestratorsAsync(), listHostViewsAsync()]);
   const { targetAdmission: assess, targetUnavailableReason } = liveTargetAdmission(orchestrators, hostViews, snapshot.catalog, ctx.orchestratorId, ctx.spawnCap);
+  const pinnedHost = orchestrators.find(host => host.id === ctx.orchestratorId);
+  const pinnedView = pinnedHost && hostViews.find(view => view.id === pinnedHost.hostId);
   const probeUncertainty = new Set<string>();
   const targetAdmission = (target: Parameters<typeof assess>[0]) => {
     const result = assess(target);
@@ -42,6 +44,7 @@ export async function captureDispatchContext(ctx: Omit<DispatchContext, "policy"
     targetUnavailableReason,
     targetAdmission,
     probeUncertainty,
+    pinnedHostAtAgentCap: Boolean(pinnedView && spawnHostCapAdmission(ctx.spawnCap)(pinnedView)),
     bands,
     policy: dispatchPolicyFor(snapshot.policy),
     catalog: snapshot.catalog,

package/src/task-dispatcher.ts

@@ -1,4 +1,4 @@
-import { isOpenAiApiModel } from "@humwick/sdk";
+import { isOpenAiApiModel, ValidationError } from "@humwick/sdk";
 // #839 — the declarative task dispatcher.
 //
 // A pure function from (Task work-shape + live system state) → a concrete spawn
@@ -311,7 +311,7 @@ export function dispatchTask(shape: TaskDispatch | undefined, pin: DispatchPin =
     if (ctx.mustResolveAvailable && bandRank(bandFor(target.provider, bands)) > bandRank("normal")) warnings.push(`[CRITICAL] mustResolveAvailable: degraded to ${target.provider} (${bandFor(target.provider, bands)} band). Contention likely.`);
   }
   if (ctx.targetAvailable && !ctx.targetAvailable(target)) {
-    throw new Error(ctx.targetUnavailableReason?.(target) ?? `No eligible online host runs ${target.provider}/${target.model ?? "default"}${target.effort ? ` at effort ${target.effort}` : ""}.`);
+    throw new ValidationError(ctx.targetUnavailableReason?.(target) ?? `No eligible online host runs ${target.provider}/${target.model ?? "default"}${target.effort ? ` at effort ${target.effort}` : ""}.`);
   }
   if (factors.preferences) factors.preferences = { ...factors.preferences, excluded: preferenceExclusions(preferences, factors.ranking, (p) => eligibility(p) ?? (!advertised.has(p) ? "not-advertised" : undefined)) };
   // Record the FINAL provider's band + the chosen model's window for transparency.

package/src/token-db.ts

@@ -324,8 +324,8 @@ export function getTokenProfile(id: string): TokenProfile | null {
   return row ? rowToProfile(row) : null;
 }
 
-export function upsertTokenProfile(input: CreateTokenProfileInput): TokenProfile {
-  const now = Date.now();
+export function upsertTokenProfile(input: CreateTokenProfileInput, submittedAt: number = Date.now()): TokenProfile {
+  const now = submittedAt;
   const id = input.id ?? slugify(input.name);
   const existing = getTokenProfile(id);
   if (existing?.builtIn) throw new Error("built-in token profiles cannot be modified");

package/src/token-usage-async.ts

@@ -5,12 +5,10 @@ import type { Message } from "./types";
 // of src/db directly (the transport-thinness ratchet, #348).
 import { getGateway } from "./db/gateway.ts";
 import type { SpawnBudgetReadback, WorkflowRunBudgetReadback } from "./db/spawn-budget.ts";
-import type { aggregateSessionTokenUsage, recordSessionTokenUsage, SessionTokenUsageAggregate, SessionTokenUsageRecord } from "./db/token-usage.ts";
+import type { aggregateSessionTokenUsage, recordSessionTokenUsage, SessionTokenUsageAggregate } from "./db/token-usage.ts";
 
 export const recordSessionTokenUsageAsync = async (input: Parameters<typeof recordSessionTokenUsage>[0]) => {
-  const { budgetNotices, ...result } = await getGateway().write("tokenUsage.record", { input }, { critical: false }) as unknown as {
-    record: SessionTokenUsageRecord;
-    inserted: boolean;
+  const { budgetNotices, ...result } = await getGateway().write("tokenUsage.record", { input }, { critical: false }) as unknown as ReturnType<typeof recordSessionTokenUsage> & {
     budgetNotices: Message[];
   };
   publishBudgetNotices(budgetNotices);

package/src/user-awaiting-reply.ts

@@ -1,7 +1,7 @@
+import { framed } from "./hub-metrics";
 import { userSinkId, canonicalHumanAgentId } from "@humwick/sdk";
 import { listUsers } from "./db/users";
-import { listPendingReplyObligationsAsync } from "./db/message-reads-async";
-import { getLatestMessageIdAsync } from "./db/message-reads-async";
+import { listPendingReplyObligationsAsync, getLatestMessageIdAsync } from "./db/message-reads-async";
 import { optedInNotificationRecipients } from "./db/notification-subscriptions";
 import { routeNotification } from "./notification-router";
 import { subscribeRelayEvents } from "./events";
@@ -12,7 +12,7 @@ export async function reconcileUserAwaitingReply(previous?: string): Promise<str
   const [pending, latestId] = await Promise.all([Promise.all(listUsers().map(user => listPendingReplyObligationsAsync(canonicalHumanAgentId(userSinkId(user.id)), 1, true))).then(rows => rows.flat()), getLatestMessageIdAsync()]);
   const signature = JSON.stringify([recipients, pending.length > 0]);
   if (signature === previous) return signature;
-  routeNotification({
+  await routeNotification({
     type: "user.awaiting_reply", scope: {}, recipients: [],
     message: {
       body: pending.length ? "The operator has an unanswered message." : "The operator has no unanswered messages.",
@@ -30,13 +30,13 @@ export function startUserAwaitingReply(): () => void {
   const unsubscribe = subscribeRelayEvents(event => {
     if (event.type.startsWith("message.") && event.data.to !== "hue:office") dirty = true;
   });
-  const timer = setInterval(() => {
+  const timer = setInterval(framed("timer user-awaiting-reply", () => {
     ticks++;
     if ((!dirty && ticks % 30 !== 0) || running) return;
     dirty = false; running = true;
     void reconcileUserAwaitingReply(signature).then(value => { signature = value; }).catch(error => {
       dirty = true; console.error("user.awaiting_reply reconciliation failed", error);
     }).finally(() => { running = false; });
-  }, 1000);
+  }), 1000);
   return () => { clearInterval(timer); unsubscribe(); };
 }

package/src/utils.ts

@@ -40,3 +40,10 @@ export function isOrchestratorLocalToRelay(orchestrator: { hostname?: string | n
   const self = hostname();
   return sameHostIdentity(orchestrator.hostname, self) || sameHostIdentity(orchestrator.id, self);
 }
+
+/** An orchestrator id from a hostname or operator input: dots and other separators become dashes. */
+export function sanitizeOrchestratorId(value: string): string {
+  const clean = value.trim().replace(/\./g, "-").replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!clean) throw new Error("--id must contain at least one letter or number");
+  return clean.slice(0, 120);
+}

package/src/workspace-actions.ts

@@ -1,3 +1,6 @@
+import { prepareCommandWriteAsync, createCommandAsync, submitPreparedCommandAsync } from "./commands-write";
+import type { ReviewCleanupInput } from "./db/review-publish-write";
+import { getGateway } from "./db/gateway";
 import { recordWorkspaceAudit } from "./workspace-action-audit";
 import { WORKSPACE_MERGE_HOLD_MESSAGE } from "./db/workspace-merge-hold";
 import { stewardGenerationCanceled } from "./db/workspace-steward-fence";
@@ -14,22 +17,13 @@ import { stringValue } from "@humwick/sdk";
 // `requestWorkspaceMerge`, the core does not emit the command event; it returns
 // the Command and the caller emits via its own `emitCommand` (kept module-local).
 
-import { createCommand } from "./commands-db";
+
 import { requestWorkspaceRekey } from "./workspace-rekey";
 import { isWorkspaceSteward, workspaceStewardRefusal } from "./workspace-steward-authority";
 import { getStewardConfig } from "./config-store";
 import { cancelPendingLegacyLandingsAsync } from "./commands-landing-async";
 import { workspaceOwnerOrchestrator } from "./workspace-host";
-import {
-  getWorkspace,
-  claimWorkspaceMetadataAsync,
-  listOrchestrators,
-  patchWorkspaceMetadataAsync,
-  releaseWorkspaceClaimMetadataAsync,
-  setWorkspaceMergeHoldAsync,
-  transitionWorkspaceLandStateAsync,
-  updateWorkspaceStatusAsync,
-} from "./db";
+import { getWorkspace, claimWorkspaceMetadataAsync, listOrchestrators, patchWorkspaceMetadataAsync, releaseWorkspaceClaimMetadataAsync, setWorkspaceMergeHoldAsync, transitionWorkspaceLandStateAsync, updateWorkspaceStatusAsync, REVIEW_HOLD_REJECT_MESSAGE, workspaceLandBarrier } from "./db";
 import { isOwnerAlive, requestWorkspaceMerge } from "./workspace-merge";
 import { buildWorkspaceCleanupCommand } from "./workspace-cleanup-stale";
 // Re-export the land-strategy contract so the MCP land tool validates against the same
@@ -38,15 +32,13 @@ export { LAND_STRATEGIES } from "./workspace-merge";
 import { claimMetadataPatch, workspaceActiveClaim, workspaceStewardHandbackPending } from "./workspace-claim";
 import { DIRTY_WORKTREE_LAND_SKIP_REASON, LAND_IN_FLIGHT_STATUSES, READY_TO_LAND_STATUSES, TERMINAL_WORKSPACE_STATUSES, worktreeReapable } from "./workspace-phase";
 import { LAND_BLOCK_REJECT_MESSAGE, stripReservedWorkspaceMetadataKeys } from "./land-block";
-import { REVIEW_HOLD_REJECT_MESSAGE, workspaceLandBarrier } from "./db";
 import { CLEAR_MERGE_NO_PROGRESS, scheduleRepoMerge } from "./workspace-auto-merge";
 import { archiveLandAttempt, CLEAR_LAST_ATTEMPT_VERDICT, CLEAR_MERGE_RETRY } from "./workspace-merge-progress";
 import { fetchHostMergePreview, refreshWorkspaceGitState } from "./workspace-probe";
 import { recordLandStopped } from "./workspace-land-stopped";
 import { finishWorkspaceStewardHandoff } from "./steward-handoff";
 import { stewardHandoffIdentity } from "./steward-provenance";
-import type { Command, WorkspaceAutoMergePolicy, WorkspaceLandingPolicy, WorkspaceMergeStrategy, WorkspaceRecord, WorkspaceStatus } from "./types";
-import type { WorkspaceLandGateLevel } from "./types";
+import type { Command, WorkspaceAutoMergePolicy, WorkspaceLandingPolicy, WorkspaceMergeStrategy, WorkspaceRecord, WorkspaceStatus, WorkspaceLandGateLevel } from "./types";
 import type { WorkspaceLandGateAuth } from "./workspace-land-gate";
 
 // Single source of truth for the action verb set. The route's `optionalEnum` and
@@ -326,7 +318,7 @@ export async function applyWorkspaceAction(workspace: WorkspaceRecord, input: Ap
       return { ok: false, httpStatus: 422, error: `workspace ${workspace.id} has no isolated worktree to refresh` };
     }
     const checkOnly = input.checkOnly === true;
-    const built = buildWorkspaceDepsRefreshCommand(workspace, agentId ?? "agent", checkOnly);
+    const built = (await buildWorkspaceDepsRefreshCommand(workspace, agentId ?? "agent", checkOnly));
     if (!built.ok) return { ok: false, httpStatus: built.status, error: built.error };
     await recordWorkspaceAudit({
       action,
@@ -416,11 +408,11 @@ export async function applyWorkspaceAction(workspace: WorkspaceRecord, input: Ap
         error: `workspace ${workspace.id} cannot be cleaned up safely: ${safety.error}; pass force:true with a detail reason only if intentionally discarding work`,
       };
     }
-    const built = buildWorkspaceCleanupCommand(workspace, agentId ?? "dashboard", {
+    const built = (await buildWorkspaceCleanupCommand(workspace, agentId ?? "dashboard", {
       force: input.force === true,
       reason: detail,
       autoReclaim: input.autoReclaim,
-    });
+    }));
     if (!built.ok) return { ok: false, httpStatus: built.status, error: built.error };
     command = built.command;
   }
@@ -496,17 +488,17 @@ export async function applyWorkspaceAction(workspace: WorkspaceRecord, input: Ap
 // captured delivered `sha`. #1452 round-5 H4: the relay deliberately does NOT derive or return a
 // ref — the AUTHORITATIVE ref is whatever the HOST reports back on the command result (the host may
 // run a different sanitizer version), and the ledger records it only after that settlement.
-export function buildWorkspacePublishReviewCommand(
+export async function buildWorkspacePublishReviewCommand(
   workspace: WorkspaceRecord,
   requestedBy: string,
-  opts: { taskId?: number; sha?: string; reviewRef?: string } = {},
-): { ok: true; command: Command } | { ok: false; status: number; error: string } {
+  opts: { taskId?: number; sha?: string; reviewRef?: string; cleanup?: ReviewCleanupInput } = {},
+): Promise<{ ok: true; command: Command } | { ok: false; status: number; error: string }> {
   if (workspace.mode !== "isolated" || !workspace.worktreePath) {
     return { ok: false, status: 422, error: `workspace ${workspace.id} has no worktree to publish for review` };
   }
   const owner = workspaceOwnerOrchestrator(workspace, listOrchestrators(), { onlineOnly: false });
   if (!owner) return { ok: false, status: 409, error: "no orchestrator owns this workspace path" };
-  const command = createCommand({
+  const prepared = await prepareCommandWriteAsync({
     type: "workspace.publish-review",
     source: "system",
     target: owner.agentId,
@@ -527,6 +519,9 @@ export function buildWorkspacePublishReviewCommand(
       queued: owner.status !== "online",
     },
   });
+  const command = opts.cleanup
+    ? await getGateway().write("commands.createReviewPublish", { command: prepared, cleanup: opts.cleanup }) as unknown as Command
+    : await submitPreparedCommandAsync(prepared);
   return { ok: true, command };
 }
 
@@ -537,10 +532,10 @@ export function buildWorkspacePublishReviewCommand(
 // caller passes the EXACT host-confirmed `ref` from the ledger and the host deletes THAT ref verbatim
 // (after asserting it is under refs/review/*) — it no longer re-derives the target from branch/
 // workspaceId, which could diverge across a relay/host sanitizer skew and leak the real ref.
-export function buildReviewRefUnpublishCommandFromFields(
+export async function buildReviewRefUnpublishCommandFromFields(
   fields: { workspaceId: string; repoRoot: string; worktreePath?: string; branch?: string; orchestratorId?: string; ref?: string },
   requestedBy: string,
-): { ok: true; command: Command } | { ok: false; status: number; error: string } {
+): Promise<{ ok: true; command: Command } | { ok: false; status: number; error: string }> {
   const synthetic = {
     orchestratorId: fields.orchestratorId,
     sourceCwd: fields.repoRoot,
@@ -550,7 +545,7 @@ export function buildReviewRefUnpublishCommandFromFields(
   } as unknown as WorkspaceRecord;
   const owner = workspaceOwnerOrchestrator(synthetic, listOrchestrators(), { onlineOnly: false });
   if (!owner) return { ok: false, status: 409, error: "no orchestrator owns this repo path" };
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "workspace.unpublish-review",
     source: "system",
     target: owner.agentId,
@@ -566,20 +561,20 @@ export function buildReviewRefUnpublishCommandFromFields(
       requestedAt: Date.now(),
       queued: owner.status !== "online",
     },
-  });
+  }));
   return { ok: true, command };
 }
 
 // Build a `workspace.deps-refresh` command for a worktree's owning orchestrator
 // (issue #51). checkOnly just reports staleness. Same owner-resolution as cleanup.
-function buildWorkspaceDepsRefreshCommand(
+async function buildWorkspaceDepsRefreshCommand(
   workspace: WorkspaceRecord,
   requestedBy: string,
   checkOnly: boolean,
-): { ok: true; command: Command } | { ok: false; status: number; error: string } {
+): Promise<{ ok: true; command: Command } | { ok: false; status: number; error: string }> {
   const owner = workspaceOwnerOrchestrator(workspace, listOrchestrators(), { onlineOnly: false });
   if (!owner) return { ok: false, status: 409, error: "no online orchestrator owns this workspace path" };
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "workspace.deps-refresh",
     source: "system",
     target: owner.agentId,
@@ -594,7 +589,7 @@ function buildWorkspaceDepsRefreshCommand(
       requestedAt: Date.now(),
       queued: owner.status !== "online",
     },
-  });
+  }));
   return { ok: true, command };
 }
 

package/src/workspace-auto-merge.ts

@@ -1,3 +1,5 @@
+import { workspaceLandRefused } from "./workspace-land-refusal";
+import { refreshPendingLandQueueLeaseAsync } from "./db/runtime-tail-async";
 // Event-driven workspace merge-back engine (#237).
 //
 // The branch merge-back used to be driven entirely by a 2-min maintenance poll, so an
@@ -30,8 +32,8 @@ import {
   patchWorkspaceMetadataAsync,
   updateWorkspaceStatus,
   workspaceLandBarrier, updateWorkspaceStatusAsync} from "./db";
-import { findLatestCommandByCorrelation } from "./commands-db";
-import { refreshPendingLandQueueLease } from "./db/commands-claim-admission";
+import { findLatestCommandByCorrelationAsync } from "./commands-write";
+
 import { notifyBranchLandFailed } from "./branch-landed";
 import { resolveStewardIdentity } from "./steward-identity";
 import { emitCommandEvent } from "./command-events";
@@ -144,14 +146,14 @@ async function escalateNoProgressMerge(ws: WorkspaceRecord, _tip?: string): Prom
   const payload = { kind: "workspace.auto-merge-stuck", workspaceId: ws.id, repoRoot: ws.repoRoot, branch: ws.branch, baseRef: ws.baseRef, attempts: MAX_NO_PROGRESS_MERGE_ATTEMPTS, reason: mergeError };
   let escalated = false;
   if (recipients.length) {
-    notifyBranchLandFailed({ workspace: ws,
+    await notifyBranchLandFailed({ workspace: ws,
       commandId: typeof meta.mergeCommandId === "string" ? meta.mergeCommandId : undefined,
       recipients,
       reason: `auto-merge backed off after ${MAX_NO_PROGRESS_MERGE_ATTEMPTS} no-progress attempts (${mergeError})`,
     });
     escalated = true;
   } else {
-    const human = notifyWorkspaceHumanEscalation({ subject, body, payload, source: "workspace-auto-merge" });
+    const human = (await notifyWorkspaceHumanEscalation({ subject, body, payload, source: "workspace-auto-merge" }));
     escalated = human.accepted;
     if (!human.accepted) {
       console.warn(`[workspace-auto-merge] no-progress escalation for ${ws.id} had zero agent recipients and no human channel: ${human.reason ?? "unknown reason"}`);
@@ -180,7 +182,7 @@ async function notifyProtectedTipRestore(ws: WorkspaceRecord, preview: Workspace
   // whose delivered tip was discarded CANNOT reach landed-on-main by any land path until the carry is
   // explicitly confirmed. Returns ok=false if it could NOT durably record the obligation — the caller
   // fails closed on that (withholds the steward hand-off) rather than risk a silent divergent land.
-  const carry = markWorkspaceTasksCarryPending(ws, discardedHead);
+  const carry = await markWorkspaceTasksCarryPending(ws, discardedHead);
   const body = `Workspace \`${ws.branch ?? ws.id}\` restored protected tip \`${preview.protectedTip?.slice(0, 12) ?? "unknown"}\`; discarded HEAD \`${discardedHead.slice(0, 12)}\` was preserved at \`${discardedRef}\`.`;
   await createActivityEventAsync({
     clientId: `workspace-protected-tip-restore-${ws.id}-${Date.now()}`,
@@ -198,7 +200,7 @@ async function notifyProtectedTipRestore(ws: WorkspaceRecord, preview: Workspace
   const { coordinatorAgentId } = resolveStewardIdentity(current);
   const recipients = [...new Set([coordinatorAgentId, current.ownerAgentId].filter((r): r is string => Boolean(r)))];
   if (recipients.length) {
-    routeNotification({
+    await routeNotification({
       type: "workspace.land_gate_warning",
       scope: { workspaceId: current.id, repoRoot: current.repoRoot, author: current.ownerAgentId, parent: coordinatorAgentId ?? undefined },
       recipients,
@@ -492,7 +494,7 @@ async function landCandidates(
         }
       }
       if (p.conflict === true || protectedTipRestored) {
-        emitWorkspaceTaskSemanticNotifications({
+        await emitWorkspaceTaskSemanticNotifications({
           workspace: ws,
           transition: "land-conflict",
           actor: "workspace-auto-merge",
@@ -616,7 +618,7 @@ function landableWorkspaces(repoRoot?: string, baseRef?: string): WorkspaceRecor
       // `review_requested` with NO authorization; after the coordinator's clear the flag is off
       // and the promoted delivery lands normally). Covers all three sweep triggers (event,
       // backstop, watchdog) and the conflict→steward hand-off at this single selection filter.
-      && !workspaceLandBarrier(ws).blocked
+      && !workspaceLandBarrier(ws).blocked && !workspaceLandRefused(ws)
       // #1473 — nor is a workspace bound to a deliverable Task that has NOT authorized a land: a pushed
       // `agent/*` branch in a ready-to-land status is not, by itself, a land authorization (a "HOLD" is
       // coordinator convention only). Excluding it here keeps it out of BOTH the auto-land dispatch and
@@ -761,9 +763,9 @@ function commandIsTerminal(command: Command | null): boolean {
   return Boolean(command && TERMINAL_COMMAND_STATUSES.has(command.status));
 }
 
-function latestWorkspaceCommand(ws: WorkspaceRecord): Command | null {
+async function latestWorkspaceCommand(ws: WorkspaceRecord): Promise<Command | null> {
   const type = LAND_IN_FLIGHT_STATUSES.has(ws.status) ? "workspace.merge" : "workspace.cleanup";
-  return findLatestCommandByCorrelation(type, ws.id);
+  return findLatestCommandByCorrelationAsync(type, ws.id);
 }
 
 async function recoverAgedInFlightWorkspaces(now: number, signal?: AbortSignal): Promise<Record<string, unknown>> {
@@ -803,9 +805,9 @@ async function recoverAgedInFlightWorkspaces(now: number, signal?: AbortSignal):
     // young merge_planned row the 20-min age gate would otherwise skip. Only a merge_planned row can be
     // executor-orphaned, so a young cleanup_requested/non-merge row still pays NO command lookup (the
     // pre-#2094 cost) — fetch only when the row is old enough for the existing recovery OR could be an orphan.
-    let command = (LAND_IN_FLIGHT_STATUSES.has(ws.status) || oldEnough(ws)) ? latestWorkspaceCommand(ws) : null;
+    let command = (LAND_IN_FLIGHT_STATUSES.has(ws.status) || oldEnough(ws)) ? await latestWorkspaceCommand(ws) : null;
     if (command?.status === "pending" && command.type === "workspace.merge") {
-      if (refreshPendingLandQueueLease(command.id, now)) {
+      if ((await refreshPendingLandQueueLeaseAsync(command.id, now))) {
         stillActive.push(ws.id);
         continue;
       }

package/src/workspace-changed-paths-client.ts

@@ -1,6 +1,7 @@
 import type { ChangedPathDiff } from "@humwick/sdk";
 import { decideDiffGate, type DiffGateDecision } from "./services/diff-gate";
 import { fetchOwningHostJson } from "./workspace-host-client";
+import { workspaceHeadAlreadyOnBase } from "./services/task-nothing-to-land";
 import type { WorkspaceRecord } from "./types";
 
 /**
@@ -87,11 +88,21 @@ export async function resolveDeliveryDiffDecision(
         ...(reprobe.ok ? { headSha: reprobe.headSha } : {}),
       };
     }
-    return { decision: decideDiffGate(reprobe), ...(reprobe.headSha ? { headSha: reprobe.headSha } : {}) };
+    return await classify(workspace, reprobe);
   }
+  return await classify(workspace, probe);
+}
+
+/** A head the owning host proves is already on the freshly fetched base lands nothing, so no
+ * gate can protect anything: accept it without one (#3214). Probed only on the would-gate path. */
+async function classify(workspace: WorkspaceRecord, probe: ChangedPathDiff): Promise<DeliveryDiffEvidence> {
   const decision = decideDiffGate(probe);
-  return {
-    decision,
-    ...(probe.ok && probe.headSha ? { headSha: probe.headSha } : {}),
-  };
+  if (!probe.ok || !probe.headSha) return { decision };
+  if (decision.requireGates && await workspaceHeadAlreadyOnBase(workspace, probe.headSha)) {
+    return {
+      decision: { requireGates: false, reason: `delivered head ${probe.headSha.slice(0, 12)} is already on ${workspace.baseRef ?? "main"}: nothing lands`, paths: probe.paths },
+      headSha: probe.headSha,
+    };
+  }
+  return { decision, headSha: probe.headSha };
 }

package/src/workspace-cleanup-stale.ts

@@ -1,3 +1,4 @@
+import { createCommandAsync } from "./commands-write";
 // Cleanup-stale workspace reconciliation: builds the `workspace.cleanup` command and runs the
 // `workspace cleanup-stale --check/--execute` sweep (#208/#965/#1066). Kept as a standalone leaf
 // module (no workspace-auto-merge.ts dependency) so the transient-agent reap lifecycle (#1477)
@@ -7,7 +8,7 @@
 
 import { statSync } from "node:fs";
 import { emitCommandEvent } from "./command-events";
-import { createCommand } from "./commands-db";
+
 import { getAgent, listWorkspaces, updateWorkspaceStatusAsync } from "./db";
 import { fetchWorkspaceGitState } from "./workspace-git-state-client";
 import { workspaceOwnerOrchestrator } from "./workspace-host";
@@ -15,15 +16,15 @@ import { workspaceActiveClaim } from "./workspace-claim";
 import { isOwnerAlive, isOwnerProcessConfirmedGone, liveAgentCwds, worktreeInUseByLiveAgent } from "./workspace-merge";
 import { refResolvesInRepo, verifyLandedOrEquivalentContent } from "./services/landed-ancestry";
 import { TERMINAL_WORKSPACE_STATUSES } from "./workspace-phase";
-import type { Command, WorkspaceRecord } from "./types";
+import type { Command, WorkspaceRecord, WorkspaceOrphan } from "./types";
 
 // Build a `workspace.cleanup` command for the worktree's owning orchestrator.
 // Moved here (from routes.ts) so the MCP surface reaches it without importing routes.
-export function buildWorkspaceCleanupCommand(
+export async function buildWorkspaceCleanupCommand(
   workspace: WorkspaceRecord,
   requestedBy: string,
   opts: { force?: boolean; reason?: string; autoReclaim?: "origin-captured" } = {},
-): { ok: true; command: Command } | { ok: false; status: number; error: string } {
+): Promise<{ ok: true; command: Command } | { ok: false; status: number; error: string }> {
   if (
     opts.force !== true &&
     workspace.mode === "isolated" &&
@@ -38,7 +39,7 @@ export function buildWorkspaceCleanupCommand(
   }
   const owner = workspaceOwnerOrchestrator(workspace);
   if (!owner) return { ok: false, status: 409, error: "no online orchestrator owns this workspace path; retry when the host is online or use DELETE /api/workspaces/:id to purge the record" };
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "workspace.cleanup",
     source: "system",
     target: owner.agentId,
@@ -58,7 +59,7 @@ export function buildWorkspaceCleanupCommand(
       ...(opts.autoReclaim === "origin-captured" ? { autoReclaim: "origin-captured" } : {}),
       queued: false,
     },
-  });
+  }));
   return { ok: true, command };
 }
 
@@ -190,7 +191,7 @@ export async function cleanupStaleWorkspaces(opts: CleanupStaleWorkspacesOptions
       } else {
         // Owner re-confirmed offline just above; force past buildWorkspaceCleanupCommand's
         // live-owner guard and carry a reason so the host records an intentional force-discard.
-        const built = buildWorkspaceCleanupCommand(ws, "cleanup-stale", forced ? { force: true, reason: "operator force-discard: abandoned branch, owner offline" } : {});
+        const built = (await buildWorkspaceCleanupCommand(ws, "cleanup-stale", forced ? { force: true, reason: "operator force-discard: abandoned branch, owner offline" } : {}));
         if (built.ok) {
           await updateWorkspaceStatusAsync(ws.id, "cleanup_requested", { lastWorkspaceAction: "cleanup-stale", lastWorkspaceActionAt: Date.now(), cleanupProof: { ...proof, forced } });
           emitCommandEvent(built.command, "command.requested");
@@ -229,3 +230,25 @@ export async function cleanupStaleWorkspaces(opts: CleanupStaleWorkspacesOptions
   }
   return { dryRun, landedOnly, force, repoRoot, ...(workspaceId ? { workspaceId } : {}), ...(workspaceIds ? { workspaceIds } : {}), scanned: candidates.length, eligible: rows.filter((r) => r.discardable).length, cleaned, candidates: rows };
 }
+
+export async function dispatchOrphanCleanup(targetAgentId: string, orphan: WorkspaceOrphan): Promise<string> {
+  const command = (await createCommandAsync({
+    type: "workspace.cleanup",
+    source: "system",
+    target: targetAgentId,
+    params: {
+      action: "cleanup",
+      worktreePath: orphan.worktreePath,
+      repoRoot: orphan.repoRoot,
+      branch: orphan.branch,
+      baseRef: orphan.baseRef,
+      baseSha: orphan.baseSha,
+      deleteBranch: true,
+      reclaim: true,
+      requestedBy: "workspace-orphan-reaper",
+      requestedAt: Date.now(),
+    },
+  }));
+  emitCommandEvent(command, `command.${command.status}`);
+  return command.id;
+}

package/src/workspace-command-settle.ts

@@ -1,9 +1,12 @@
+import { DELEGATED_LAND_REFUSAL_CODE } from "@humwick/sdk/worktree-config";
+import { refuseWorkspaceLand } from "./workspace-land-refusal";
+import { releaseMergeLeaseAsync, insertLandGateAttestationAsync } from "./db/runtime-tail-async";
 import { commandFailureReason, settleWorkspaceCleanupCommand, type WorkspaceCommandSettleResult } from "./workspace-cleanup-settle";
 export { type WorkspaceCommandSettleResult } from "./workspace-cleanup-settle";
 import { fireAndForget, isRecord, sanitizeFsName, stringValue, type LandGateAttestation, type LandGateRunResult } from "@humwick/sdk";
 import { storeTextArtifact } from "./artifact-text";
 import { announceBranchLanded, notifyBaseWorktreeStrand, notifyBranchLandFailed, notifyLandGateFailed, notifyLandGateSkipped, notifyLandGateWarnings, recordLandingReceipt } from "./branch-landed";
-import { getWorkspace, getArtifactAsync, insertLandGateAttestation, listOrchestrators, markWorkspaceLanded, patchWorkspaceMetadataAsync, releaseMergeLease, setWorkspaceBranchAsync, updateWorkspaceStatusAsync, markWorkspaceLandedAsync} from "./db";
+import { getWorkspace, getArtifactAsync, listOrchestrators, markWorkspaceLanded, patchWorkspaceMetadataAsync, setWorkspaceBranchAsync, updateWorkspaceStatusAsync, markWorkspaceLandedAsync } from "./db";
 import { parseOwnerRepoFromRemote, repoFromGitRemote } from "./services/git-remote";
 import { deferLandSettleSideEffect } from "./land-settle-dispatch";
 import { recordConfirmedLandBoundary } from "./services/land-boundary-settle";
@@ -205,7 +208,7 @@ export async function settleWorkspaceMergeCommand(command: Command, opts: Worksp
     command = proven;
   }
   const terminalSettled = WORKSPACE_MERGE_SETTLED_STATUSES.has(command.status);
-  if (terminalSettled && command.landingContainmentMode === "legacy-unfenced-v0") releaseMergeLease({ commandId: command.id });
+  if (terminalSettled && command.landingContainmentMode === "legacy-unfenced-v0") (await releaseMergeLeaseAsync({ commandId: command.id }));
   const settledRepoRoot = typeof command.params.repoRoot === "string" ? command.params.repoRoot : undefined;
   const settledBaseRef = typeof command.params.baseRef === "string" ? command.params.baseRef : undefined;
   let transitionCompleted = false;
@@ -360,13 +363,13 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
     if (retryableNonLand) {
       if (ancestryUnconfirmed && landedWorkspace) {
         const ws = transitioned ?? landedWorkspace;
-        deferLandSettleSideEffect("land-unconfirmed", () => notifyLandUnconfirmed({ workspace: ws, commandId: command.id, sha: authoritativeLandedSha, targetRef: landTargetRef, kind: landAncestry }));
+        deferLandSettleSideEffect("land-unconfirmed", async () => await notifyLandUnconfirmed({ workspace: ws, commandId: command.id, sha: authoritativeLandedSha, targetRef: landTargetRef, kind: landAncestry }));
       }
       return { settled: true };
     }
     const noopBase = nothingBase ?? (mergeResult.noop === true && !resultError && mergeResult.landMechanism !== "plain-git" && (resultStatus === "merged" || resultStatus === "active") && typeof baseSha === "string" && /^[0-9a-f]{40,64}$/.test(baseSha) ? baseSha : undefined);
     if (noopBase && landedWorkspace) await finishWorkspaceStewardHandoff(landedWorkspace);
-    if (noopBase && landedWorkspace) deferLandSettleSideEffect("nothing-to-land", () => notifyNothingToLand(landedWorkspace, noopBase, command.id, typeof command.params.expectedHeadSha === "string" ? command.params.expectedHeadSha : undefined));
+    if (noopBase && landedWorkspace) deferLandSettleSideEffect("nothing-to-land", async () => await notifyNothingToLand(landedWorkspace, noopBase, command.id, typeof command.params.expectedHeadSha === "string" ? command.params.expectedHeadSha : undefined));
     const landConfirmed = !nothingBase && workspaceMergeProvesLand(mergeResult, command.params);
     const continuationBranch = normalizedStatus === "active" ? landedWorkspace?.branch : undefined;
     // #1790 F1 — build the land notice up front so the durable RECEIPT can be written SYNCHRONOUSLY,
@@ -393,7 +396,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         ...(prLanded || landedCommitCount === undefined ? {} : { landedCommitCount }),
       }
       : undefined;
-    if (landedNotice) recordLandingReceipt(landedNotice);
+    if (landedNotice) (await recordLandingReceipt(landedNotice));
     // #1744 F1 — record the tree-keyed land-gate attestation. Placed HERE, not at the executor, so
     // that "the full gate passed on tree T" only becomes deployable evidence once the relay has
     // CONFIRMED (ancestry-gated above, #1713) that T actually reached the base ref: a gated attempt
@@ -408,7 +411,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         const repo = landRepo(landedWorkspace.repoRoot);
         // No resolvable origin ⇒ no shared identity with cd-watcher's detection clone ⇒ no row.
         if (repo) {
-          insertLandGateAttestation({
+          (await insertLandGateAttestationAsync({
             repo,
             treeSha: attestation.treeSha,
             commitSha: authoritativeLandedSha,
@@ -419,7 +422,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
             gatesRan: attestation.gatesRan,
             workspaceId: landedWorkspace.id,
             ...(attestation.suiteCoverage ? { suiteCoverage: attestation.suiteCoverage } : {}),
-          });
+          }));
         }
       } catch (error) {
         console.warn(`[land-gate-attestation] failed to record tree ${attestation.treeSha.slice(0, 12)} for ${workspaceId}: ${String(error)}`);
@@ -439,7 +442,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         preservedWipPaths: Array.isArray(baseWorktreeSync.preservedWipPaths) ? baseWorktreeSync.preservedWipPaths.filter((p): p is string => typeof p === "string") : undefined,
         message: typeof baseWorktreeSync.message === "string" ? baseWorktreeSync.message : undefined,
       };
-      deferLandSettleSideEffect("base-worktree-strand", () => notifyBaseWorktreeStrand({ workspace: ws, sync: strandSync }));
+      deferLandSettleSideEffect("base-worktree-strand", async () => await notifyBaseWorktreeStrand({ workspace: ws, sync: strandSync }));
     }
     // #1713 — reaching here means the land is either ancestry-CONFIRMED, a remote-verified PR land, or
     // a proven zero-commit no-op (handled inside announceBranchLanded, #1620); an unconfirmed
@@ -450,7 +453,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
     // i.e. the serialized writes this issue is about — so it runs off the settle hot path.
     if (landedNotice) {
       const notice = landedNotice;
-      deferLandSettleSideEffect("branch-landed", () => announceBranchLanded(notice));
+      deferLandSettleSideEffect("branch-landed", async () => await announceBranchLanded(notice));
     }
     const gateSkipped = normalizeGateSkipped(mergeResult.gateSkipped);
     if (gateSkipped && landedWorkspace) {
@@ -462,7 +465,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         },
       });
       const ws = landedWorkspace;
-      deferLandSettleSideEffect("land-gate-skipped", () => notifyLandGateSkipped({ workspace: ws, ...gateSkipped }));
+      deferLandSettleSideEffect("land-gate-skipped", async () => await notifyLandGateSkipped({ workspace: ws, ...gateSkipped }));
     }
     const gateWarnings = mergeResult.merged === true ? normalizeGateWarnings(mergeResult.gateWarnings) : [];
     if (gateWarnings.length && landedWorkspace) {
@@ -500,7 +503,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
           console.warn(`land-gate-warnings artifact upload failed for ${warnWorkspace.id}: ${String(error)}`);
         }
         try {
-          notifyLandGateWarnings({ workspace: warnWorkspace, warnings: gateWarnings, artifactId, fullOutput: !anyTruncated });
+          await notifyLandGateWarnings({ workspace: warnWorkspace, warnings: gateWarnings, artifactId, fullOutput: !anyTruncated });
         } catch (error) {
           console.warn(`land-gate-warnings notify threw for ${warnWorkspace.id}: ${String(error)}`);
         }
@@ -537,6 +540,11 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
       if (await settleRestartKilledLand(command, current)) markTransitionCompleted();
       return { settled: true };
     }
+    if (!alreadyLanded && isRecord(command.result) && command.result.landingBlockerCode === DELEGATED_LAND_REFUSAL_CODE) {
+      await refuseWorkspaceLand(current, reason, command.id);
+      markTransitionCompleted();
+      return { settled: true };
+    }
     const transitioned = await updateWorkspaceStatusAsync(command.correlationId, nextStatus, {
       mergeCommandId: command.id,
       landGateQueue: undefined,
@@ -553,12 +561,12 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
     // announcements off it, so they run off the settle hot path (same as the success path's fan-out).
     if (nextStatus === "conflict" && !alreadyLanded) {
       // #2704 — the settle is the one conflict entry that never woke a steward (case A): give it its resolver.
-      deferLandSettleSideEffect("land-conflict-resolver", () => superviseLandConflictLater(current.id, reason, landedHead ? { tip: landedHead } : {}));
-      deferLandSettleSideEffect("land-conflict-semantic", () => emitWorkspaceTaskSemanticNotifications({
+      deferLandSettleSideEffect("land-conflict-semantic", async () => await emitWorkspaceTaskSemanticNotifications({
         workspace: current, transition: "land-conflict", actor: "workspace-merge",
         idempotencyKey: landFailureEventKey(current, command.id),
         outcome: { reason, commandId: command.id, status: nextStatus },
       }));
+      deferLandSettleSideEffect("land-conflict-resolver", () => superviseLandConflictLater(current.id, reason, landedHead ? { tip: landedHead } : {}));
     }
     if (gateFailure) {
       const gateFailedAt = Date.now();
@@ -572,9 +580,9 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
       });
     } else if (!alreadyLanded && nextStatus !== "conflict") {
       // A conflict's owner hears from its resolver instead: the steward hand-off, or the hand-back (#2704).
-      deferLandSettleSideEffect("land-failed", () => {
-        notifyBranchLandFailed({ workspace: current, commandId: command.id, reason });
-        notifyLandUnconfirmed({ workspace: current, commandId: command.id, targetRef: current.baseRef ?? "main", kind: "merge-failed", detail: reason });
+      deferLandSettleSideEffect("land-failed", async () => {
+        await notifyBranchLandFailed({ workspace: current, commandId: command.id, reason });
+        await notifyLandUnconfirmed({ workspace: current, commandId: command.id, targetRef: current.baseRef ?? "main", kind: "merge-failed", detail: reason });
       });
     }
     return { settled: true };