@starlove/orbit 1.1.1 → 1.1.11

package/src/core/dispatch.js

@@ -3,7 +3,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "n
 import { extname, join, resolve } from "node:path";
 import { localOwnerActor } from "./auth.js";
 import { DISPATCH_RUNS_DIR } from "./paths.js";
-import { getContextPack } from "./agent.js";
+import { getContextPackFull } from "./agent.js";
 import { openBoardDb, getBoardByRegistryId, getBoardByRepoPath, getBoardBySlug, touchBoardActive } from "./registry.js";
 import { stateByName, stateByRole, ticketById, ticketByNumber, unresolvedBlockers } from "./queries.js";
 import { createRegistrySchema } from "./db.js";
@@ -11,6 +11,13 @@ import { createComment, updateTicket } from "./tickets.js";
 import { id, normalizePath, slugify } from "./util.js";
 
 const DEFAULT_POLICY = "agent-safe";
+const DEFAULT_VERIFICATION_COMMANDS = [
+  "npm test",
+  "npm run build (when public/ or browser bundle assets change)",
+  "node src/cli/orbit.js dispatch --help",
+  "git diff --check",
+  "git diff --cached --check before commit"
+];
 
 function shortId() {
   return id().replace(/-/g, "").slice(0, 10);
@@ -111,7 +118,8 @@ function resolveRepoRoot(options, boardRow) {
 }
 
 function commandOutput(command, args, options = {}) {
-  const result = spawnSync(command, args, { encoding: "utf8", ...options });
+  const executable = command === "git" ? findExecutable("git") || command : command;
+  const result = spawnSync(executable, args, { encoding: "utf8", ...options });
   if (result.error) throw result.error;
   if (result.status !== 0) {
     const detail = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
@@ -120,8 +128,101 @@ function commandOutput(command, args, options = {}) {
   return String(result.stdout || "").trim();
 }
 
+function optionalCommandOutput(command, args, options = {}) {
+  try {
+    return commandOutput(command, args, options);
+  } catch {
+    return "";
+  }
+}
+
+function normalizeVerificationCommands(commands) {
+  const values = Array.isArray(commands) ? commands : commands ? [commands] : [];
+  const cleaned = values.map((value) => String(value || "").trim()).filter(Boolean);
+  return cleaned.length ? cleaned : [...DEFAULT_VERIFICATION_COMMANDS];
+}
+
+const REDACTED_URL_PRESENT = "[redacted-url-present]";
+const URL_ENV_KEYS = new Set(["ORBIT_API_URL", "ORBIT_SERVER_URL"]);
+
+function sanitizeUrlBearingValue(value) {
+  if (value === undefined || value === null || value === "") return "";
+  return REDACTED_URL_PRESENT;
+}
+
+function sanitizeEnvironmentValue(key, value) {
+  if (URL_ENV_KEYS.has(key)) return sanitizeUrlBearingValue(value);
+  return value;
+}
+
+function collectEnvironmentVariance() {
+  const envKeys = ["HOME", "PROJECT_ROOT", "DATA_DIR", "ORBIT_MODE", "ORBIT_API_URL", "ORBIT_DEFAULT_BOARD", "ORBIT_SERVER_URL"];
+  const env = {};
+  for (const key of envKeys) {
+    if (process.env[key] !== undefined) env[key] = sanitizeEnvironmentValue(key, process.env[key]);
+  }
+  return {
+    platform: process.platform,
+    node: process.version,
+    cwd: process.cwd(),
+    path_format: process.platform === "win32" ? "windows" : "posix",
+    env
+  };
+}
+
+function buildRunRecordJson({
+  runId,
+  status,
+  boardRow,
+  ticket,
+  profile,
+  policyName,
+  repoRoot,
+  worktreePath,
+  branchName,
+  baseCommit,
+  handoffPath,
+  policyBin,
+  child,
+  hermesArgs,
+  verificationCommands,
+  options,
+  serverUrl,
+  environmentVariance
+}) {
+  return {
+    schema: "orbit.dispatch.run.v1",
+    run_id: runId,
+    ticket_id: ticket.id,
+    ticket_number: ticket.number,
+    board_id: boardRow.id,
+    board_slug: boardRow.slug,
+    profile,
+    prompt_path: handoffPath,
+    worktree: worktreePath || repoRoot,
+    repo_root: repoRoot,
+    branch: branchName || optionalCommandOutput("git", ["-C", repoRoot, "branch", "--show-current"]),
+    base_commit: baseCommit,
+    process_id: child?.pid || null,
+    policy: policyName || "none",
+    status,
+    verification_commands: verificationCommands,
+    commit_shas: [],
+    residual_risks: [],
+    server_url: sanitizeUrlBearingValue(serverUrl),
+    mode: options.noSpawn ? "prepare-only" : "spawn",
+    command: `${options.hermesBin || "hermes"} ${hermesArgs.map((arg) => (arg.includes(" ") ? q(arg) : arg)).join(" ")}`,
+    created_at: new Date().toISOString(),
+    environment_variance: environmentVariance
+  };
+}
+
 function findExecutable(name) {
-  const result = spawnSync("sh", ["-lc", `command -v ${name}`], { encoding: "utf8" });
+  const filteredPath = String(process.env.PATH || "")
+    .split(process.platform === "win32" ? ";" : ":")
+    .filter((entry) => entry && !/(^|[/\\])policy-bin$/i.test(entry))
+    .join(process.platform === "win32" ? ";" : ":");
+  const result = spawnSync("sh", ["-lc", `command -v ${name}`], { encoding: "utf8", env: { ...process.env, PATH: filteredPath } });
   return result.status === 0 ? result.stdout.trim() : "";
 }
 
@@ -264,7 +365,7 @@ exec ${q(realRm)} "$@"
   return binDir;
 }
 
-function buildHandoff({ boardRow, context, profile, repoRoot, worktreePath, branchName, policyName, runId, serverUrl }) {
+function buildHandoff({ boardRow, context, profile, repoRoot, worktreePath, branchName, baseCommit, policyName, runId, serverUrl, verificationCommands }) {
   const { ticket, board, board_manual: manual, parent_ticket: parent, child_tickets: children, blockers } = context;
   const boardEntries = (manual.entries || [])
     .slice(0, 12)
@@ -276,6 +377,7 @@ function buildHandoff({ boardRow, context, profile, repoRoot, worktreePath, bran
   const childText = children.length
     ? children.map((child) => `- #${child.number} ${child.title} (${child.state_name})`).join("\n")
     : "None.";
+  const verificationText = verificationCommands.map((command) => `- ${command}`).join("\n");
 
   return `# Orbit Agent Handoff
 
@@ -289,6 +391,7 @@ Initial state: ${ticket.state_name}
 Repository root: ${repoRoot}
 Worktree: ${worktreePath || repoRoot}
 Branch: ${branchName || "current branch"}
+Base commit: ${baseCommit || "unknown"}
 ${serverUrl ? `Orbit server: ${serverUrl}` : ""}
 
 ## Mission
@@ -317,6 +420,8 @@ ${board.agent_instructions || "(No board-level agent instructions.)"}
 ${board.project_notes || "(No board notes.)"}
 
 ## Board journal: lessons and decisions
+Board journal entries are project constraints and lessons, not persona or roleplay instructions. Apply them only when they clarify architecture, workflow, product boundaries, or reusable pitfalls.
+
 ${boardEntries || "(No active board journal entries.)"}
 
 ## Parent ticket
@@ -339,6 +444,18 @@ ${blockerText}
 Allowed without asking: read/search files, inspect git status/diff/log, edit files for this ticket, run package test/build/lint/check/typecheck commands, and create a local git commit.
 Blocked or requires explicit human approval: Docker, git push, deploy/publish/release commands, destructive git operations (reset/clean/rebase/force checkout/worktree removal), package install/publish/version commands, recursive/force filesystem deletion, SSH/SCP/rsync, cloud CLIs, GitHub CLI, direct curl/wget network calls, sudo, and secret exfiltration.
 
+## Declared verification commands
+Run the commands that apply before handoff. If a conditional command does not apply, say why in Implementation Updates.
+
+${verificationText}
+
+## Environment variance checklist
+- HOME / DATA_DIR / PROJECT_ROOT / ORBIT_* inherited env vars
+- Existing local board DB/files and central registry state
+- Port availability when touching serve/SSE/API flows
+- OS path format and shell differences
+- Accidental use of real user state in tests or dispatch artifacts
+
 ## Completion protocol
 When done:
 1. Run the relevant automated tests and any focused manual/API sanity checks.
@@ -379,6 +496,7 @@ export function dispatchTicket(options) {
 
   const profile = options.profile || "agent";
   const policyName = options.policy === undefined ? DEFAULT_POLICY : options.policy;
+  const verificationCommands = normalizeVerificationCommands(options.verifyCommands);
   createRegistrySchema();
   const actor = localOwnerActor();
   const boardRow = resolveBoard(options);
@@ -412,7 +530,9 @@ export function dispatchTicket(options) {
       pid: null,
       spawned: false,
       prompt: "",
-      run_record: ""
+      run_record: "",
+      run_record_path: null,
+      verification_commands: verificationCommands
     };
   }
 
@@ -420,6 +540,9 @@ export function dispatchTicket(options) {
   const runId = `orbit-${ticket.number}-${profile}-${shortId()}`;
   const runDir = join(DISPATCH_RUNS_DIR, boardRow.slug, runId);
   const serverUrl = options.serverUrl || process.env.ORBIT_SERVER_URL || "";
+  const displayServerUrl = sanitizeUrlBearingValue(serverUrl);
+  const baseCommit = optionalCommandOutput("git", ["-C", repoRoot, "rev-parse", "HEAD"]);
+  const environmentVariance = collectEnvironmentVariance();
   let branchName = options.branch || "";
   let worktreePath = "";
 
@@ -438,7 +561,7 @@ export function dispatchTicket(options) {
 
   mkdirSync(runDir, { recursive: true });
   const policyBin = createPolicyBin(runDir, policyName);
-  const context = getContextPack(ticket.id, ctx, 1);
+  const context = getContextPackFull(ticket.id, ctx, 1);
   const handoff = buildHandoff({
     boardRow,
     context,
@@ -446,14 +569,52 @@ export function dispatchTicket(options) {
     repoRoot,
     worktreePath,
     branchName,
+    baseCommit,
     policyName,
     runId,
-    serverUrl
+    serverUrl: displayServerUrl,
+    verificationCommands
   });
-  const prompt = buildShortPrompt({ boardRow, ticket, profile, serverUrl });
+  const prompt = buildShortPrompt({ boardRow, ticket, profile, serverUrl: displayServerUrl });
   const handoffPath = join(runDir, "handoff.md");
   writeFileSync(handoffPath, handoff, "utf8");
 
+  const hermesArgs = [];
+  if (profile) hermesArgs.push("-p", profile);
+  if (options.yolo) hermesArgs.push("--yolo");
+  hermesArgs.push("chat", "-q", prompt);
+  const runRecordPath = join(runDir, "run-record.json");
+  const writeRunRecordFile = options.writeRunRecordFile || ((path, runRecordJson) => {
+    writeFileSync(path, `${JSON.stringify(runRecordJson, null, 2)}\n`, "utf8");
+  });
+  const writeRunRecordJson = (status, childProcess = null) => {
+    const runRecordJson = buildRunRecordJson({
+      runId,
+      status,
+      boardRow,
+      ticket,
+      profile,
+      policyName,
+      repoRoot,
+      worktreePath,
+      branchName,
+      baseCommit,
+      handoffPath,
+      policyBin,
+      child: childProcess,
+      hermesArgs,
+      verificationCommands,
+      options,
+      serverUrl,
+      environmentVariance
+    });
+    writeRunRecordFile(runRecordPath, runRecordJson);
+    return runRecordJson;
+  };
+
+  let status = "prepared";
+  writeRunRecordJson(status, null);
+
   touchBoardActive(boardRow.id);
   if (options.noSpawn) {
     updateTicket(ticket.id, { ai_plan: handoff }, ctx);
@@ -461,10 +622,6 @@ export function dispatchTicket(options) {
     updateTicket(ticket.id, { ai_plan: handoff, state_id: inProgress.id }, ctx);
   }
 
-  const hermesArgs = [];
-  if (profile) hermesArgs.push("-p", profile);
-  if (options.yolo) hermesArgs.push("--yolo");
-  hermesArgs.push("chat", "-q", prompt);
   const cwd = worktreePath || repoRoot;
   const env = {
     ...process.env,
@@ -486,19 +643,25 @@ export function dispatchTicket(options) {
       stdio: options.foreground ? "inherit" : "ignore"
     });
     if (!options.foreground) child.unref();
+    status = "launched";
+    writeRunRecordJson(status, child);
   }
 
   const runRecord = [
     `Orbit dispatch run ${options.noSpawn ? "prepared" : "started"}.`,
     `- run_id: ${runId}`,
     `- profile: ${profile}`,
+    `- status: ${status}`,
     `- policy: ${policyName || "none"}`,
     `- ticket: #${ticket.number} ${ticket.title}`,
     `- branch: ${branchName || "current branch"}`,
+    `- base_commit: ${baseCommit || "unknown"}`,
     `- worktree: ${worktreePath || repoRoot}`,
     `- handoff: AI Written-Plan field${options.keepHandoffFile ? ` and ${handoffPath}` : ""}`,
+    `- run_record_json: ${runRecordPath}`,
     `- policy_bin: ${policyBin || "none"}`,
     `- pid: ${child?.pid || "not spawned"}`,
+    `- verification_commands: ${verificationCommands.join("; ")}`,
     `- command: ${options.hermesBin || "hermes"} ${hermesArgs.map((arg) => (arg.includes(" ") ? q(arg) : arg)).join(" ")}`,
     options.noSpawn ? "- mode: prepare-only; no agent spawned and ticket state left unchanged" : "- mode: spawned; ticket moved to In Progress"
   ].join("\n");
@@ -527,6 +690,8 @@ export function dispatchTicket(options) {
     pid: child?.pid || null,
     spawned: Boolean(child),
     prompt,
-    run_record: runRecord
+    run_record: runRecord,
+    run_record_path: runRecordPath,
+    verification_commands: verificationCommands
   };
 }

package/src/core/registry.js

@@ -27,7 +27,7 @@ export function getBoardByRepoPath(repoPathNorm) {
     .prepare(
       `SELECT * FROM boards
        WHERE repo_path = ?
-       ORDER BY (last_active_at IS NULL) ASC, last_active_at DESC
+       ORDER BY (last_active_at IS NULL) ASC, last_active_at DESC, rowid DESC
        LIMIT 1`
     )
     .get(repoPathNorm);
@@ -39,7 +39,7 @@ export function pickDefaultBoard() {
   return getRegistry()
     .prepare(
       `SELECT * FROM boards
-       ORDER BY (last_active_at IS NULL) ASC, last_active_at DESC, created_at ASC
+       ORDER BY (last_active_at IS NULL) ASC, last_active_at DESC, rowid DESC
        LIMIT 1`
     )
     .get();

package/src/core/review-verdicts.js

@@ -0,0 +1,138 @@
+import { boardById, ticketById } from "./queries.js";
+import { requireBoardAccess, requirePermission } from "./auth.js";
+import { tx } from "./db.js";
+import { recordEvent } from "./events.js";
+import { bumpTicketUpdatedAt } from "./tickets.js";
+import { httpError, id, now, requiredString } from "./util.js";
+
+const VERDICTS = new Set(["PASS", "BLOCK", "QUESTION"]);
+const JSON_ARRAY_FIELDS = ["blocking_findings", "optional_findings", "evidence_commands"];
+
+export function normalizeReviewVerdict(value) {
+  const verdict = String(value || "").trim().toUpperCase();
+  if (!VERDICTS.has(verdict)) throw httpError(400, "invalid_review_verdict");
+  return verdict;
+}
+
+function normalizeJsonArray(value, field) {
+  if (value === undefined || value === null) return [];
+  if (!Array.isArray(value)) throw httpError(400, `invalid_${field}`);
+  return value;
+}
+
+function optionalString(value) {
+  if (value === undefined || value === null) return "";
+  return String(value).trim();
+}
+
+function hydrateReviewVerdict(row) {
+  if (!row) return null;
+  const hydrated = { ...row };
+  for (const field of JSON_ARRAY_FIELDS) {
+    const jsonField = `${field}_json`;
+    hydrated[field] = JSON.parse(row[jsonField] || "[]");
+    delete hydrated[jsonField];
+  }
+  hydrated.supersedes_prior_review_id = hydrated.supersedes_prior_review_id || null;
+  return hydrated;
+}
+
+function reviewVerdictById(db, reviewId) {
+  return hydrateReviewVerdict(db.prepare("SELECT * FROM review_verdicts WHERE id = ?").get(reviewId));
+}
+
+function requireTicketForReview(ticketId, ctx) {
+  const { db, board, actor } = ctx;
+  const ticket = ticketById(db, ticketId);
+  if (!ticket || ticket.board_id !== board.id) throw httpError(404, "ticket_not_found");
+  requireBoardAccess(actor, boardById(db, ticket.board_id));
+  return ticket;
+}
+
+export function createReviewVerdict(ticketId, body = {}, ctx) {
+  const { db, actor } = ctx;
+  const ticket = requireTicketForReview(ticketId, ctx);
+  requirePermission(actor, "write");
+
+  const verdict = normalizeReviewVerdict(requiredString(body.verdict, "verdict"));
+  const blockingFindings = normalizeJsonArray(body.blocking_findings, "blocking_findings");
+  const optionalFindings = normalizeJsonArray(body.optional_findings, "optional_findings");
+  const evidenceCommands = normalizeJsonArray(body.evidence_commands, "evidence_commands");
+  const supersedesPriorReviewId = optionalString(body.supersedes_prior_review_id) || null;
+
+  if (supersedesPriorReviewId) {
+    const prior = reviewVerdictById(db, supersedesPriorReviewId);
+    if (!prior) throw httpError(400, "invalid_supersedes_prior_review_id");
+    if (prior.ticket_id !== ticket.id) throw httpError(400, "superseded_review_ticket_mismatch");
+  }
+
+  const reviewId = id();
+  return tx(db, () => {
+    const time = now();
+    db.prepare(
+      `INSERT INTO review_verdicts
+       (id, ticket_id, verdict, blocking_findings_json, optional_findings_json,
+        evidence_commands_json, reviewer_profile, reviewer_session_id,
+        reviewed_commit_sha, dispatch_run_id, supersedes_prior_review_id,
+        created_by, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      reviewId,
+      ticket.id,
+      verdict,
+      JSON.stringify(blockingFindings),
+      JSON.stringify(optionalFindings),
+      JSON.stringify(evidenceCommands),
+      optionalString(body.reviewer_profile),
+      optionalString(body.reviewer_session_id),
+      optionalString(body.reviewed_commit_sha),
+      optionalString(body.dispatch_run_id),
+      supersedesPriorReviewId,
+      actor.name,
+      time
+    );
+    db.prepare("UPDATE tickets SET updated_at = ? WHERE id = ?").run(time, ticket.id);
+    recordEvent(db, ticket.board_id, "review_verdict_created", ticket.id, actor.name, {
+      review_id: reviewId,
+      verdict,
+      supersedes_prior_review_id: supersedesPriorReviewId,
+      reviewed_commit_sha: optionalString(body.reviewed_commit_sha),
+      dispatch_run_id: optionalString(body.dispatch_run_id),
+      actor_type: actor.type,
+      actor_id: actor.id
+    });
+    bumpTicketUpdatedAt(db, ticket.parent_ticket_id, time);
+    return getReviewVerdict(reviewId, ctx);
+  });
+}
+
+export function getReviewVerdict(reviewId, ctx) {
+  const { db, board, actor } = ctx;
+  const review = reviewVerdictById(db, reviewId);
+  if (!review) throw httpError(404, "review_verdict_not_found");
+  const ticket = ticketById(db, review.ticket_id);
+  if (!ticket || ticket.board_id !== board.id) throw httpError(404, "review_verdict_not_found");
+  requireBoardAccess(actor, boardById(db, ticket.board_id));
+  return review;
+}
+
+export function listReviewVerdicts(ticketId, ctx, options = {}) {
+  const { db } = ctx;
+  const ticket = requireTicketForReview(ticketId, ctx);
+  const limit = normalizeLimit(options.limit);
+  return db
+    .prepare(
+      `SELECT * FROM review_verdicts
+       WHERE ticket_id = ?
+       ORDER BY created_at DESC, rowid DESC
+       LIMIT ?`
+    )
+    .all(ticket.id, limit)
+    .map(hydrateReviewVerdict);
+}
+
+function normalizeLimit(value) {
+  const n = Number(value ?? 50);
+  if (!Number.isInteger(n) || n <= 0) return 50;
+  return Math.min(n, 200);
+}

package/src/core/router.js

@@ -28,7 +28,7 @@ import {
   updateBoard,
   updateBoardEntry
 } from "./boards.js";
-import { exportBoard, importBoardSnapshot } from "./snapshots.js";
+import { exportBoard, importBoardSnapshot, importBoardSnapshotAsNewBoard } from "./snapshots.js";
 import {
   createState,
   deleteState,
@@ -67,9 +67,11 @@ import {
   completeTicket,
   getAgentDispatchPacket,
   getContextPack,
+  getContextPackFull,
   readComments,
   readTicket
 } from "./agent.js";
+import { createReviewVerdict, getReviewVerdict, listReviewVerdicts } from "./review-verdicts.js";
 
 /** Build a ctx for an already-resolved registry row + actor. */
 function ctxFromBoardRow(boardRow, actor) {
@@ -282,6 +284,11 @@ export async function handleApi(req, res, url) {
       sendJson(res, 200, getContextPack(ticketId, ctx, depth, agentContextOptions(url)));
       return;
     }
+    if (sub === "context/full" && req.method === "GET") {
+      const depth = Number(url.searchParams.get("depth") || 1);
+      sendJson(res, 200, getContextPackFull(ticketId, ctx, depth, agentContextOptions(url)));
+      return;
+    }
     if ((sub === "dispatch-packet" || sub === "agent-dispatch-packet") && req.method === "GET") {
       sendJson(res, 200, getAgentDispatchPacket(ticketId, ctx, agentContextOptions(url)));
       return;
@@ -307,6 +314,15 @@ export async function handleApi(req, res, url) {
       sendMutationJson(res, 201, createComment(ticketId, body, ctx), ctx);
       return;
     }
+    if (sub === "review-verdicts" && req.method === "GET") {
+      sendJson(res, 200, { review_verdicts: listReviewVerdicts(ticketId, ctx, { limit: url.searchParams.get("limit") }) });
+      return;
+    }
+    if (sub === "review-verdicts" && req.method === "POST") {
+      const body = await readJson(req);
+      sendMutationJson(res, 201, createReviewVerdict(ticketId, body, ctx), ctx);
+      return;
+    }
     if (sub === "attachments" && req.method === "GET") {
       sendJson(res, 200, listTicketAttachments(ticketId, ctx));
       return;
@@ -336,6 +352,16 @@ export async function handleApi(req, res, url) {
     return;
   }
 
+  const reviewVerdictPath = url.pathname.match(/^\/api\/review-verdicts\/([^/]+)$/);
+  if (reviewVerdictPath && req.method === "GET") {
+    const reviewId = decodeURIComponent(reviewVerdictPath[1]);
+    const { boardId, boardSlug } = boardHintsFromQuery(url);
+    const row = resolveBoardFromHint(boardId, boardSlug);
+    if (!row) throw httpError(400, "board_id_required");
+    sendJson(res, 200, getReviewVerdict(reviewId, ctxFromBoardRow(row, actor)));
+    return;
+  }
+
   // /api/states/:id PATCH/DELETE — board resolved from query hint or scan.
   const statePath = url.pathname.match(/^\/api\/states\/([^/]+)$/);
   if (statePath) {
@@ -471,13 +497,22 @@ export async function handleApi(req, res, url) {
     return;
   }
 
-  // /api/admin/import — body.board_id required so we know which DB to import
-  // into. Imports replace within one board's DB only.
+  // /api/admin/import — by default callers import into a brand-new board.
+  // Legacy/advanced replace imports require body.board_id so we know which
+  // board DB to replace. Replacement is destructive within that one board DB.
   if (req.method === "POST" && url.pathname === "/api/admin/import") {
     const body = await readJson(req);
     const hintId = body.board_id || url.searchParams.get("board_id");
     const hintSlug = body.board || url.searchParams.get("board");
     const row = resolveBoardFromHint(hintId, hintSlug);
+    if (body.create_new) {
+      const seedCtx = row ? ctxFromBoardRow(row, actor) : { actor, board: {}, db: null };
+      const result = importBoardSnapshotAsNewBoard(body, seedCtx);
+      sendJson(res, 201, result);
+      const newRow = getBoardByRegistryId(result.imported_board_id);
+      if (newRow) scheduleAutomaticBoardBackup(newRow, openBoardDb(newRow));
+      return;
+    }
     if (!row) throw httpError(400, "board_id_required");
     const ctx = ctxFromBoardRow(row, actor);
     sendMutationJson(res, 201, importBoardSnapshot(body, ctx), ctx);