Daemon pool: collected low-severity per-member assumptions (cp_routing blob, thread-owner filter, channel/agents bind, env gate fail-open, usage RMW, replay log noise, unused data-plane transcript table)

[zfy0701]

Collected low-severity leftovers from the same audit: "one daemon owns this agent for its lifetime" assumptions that are wrong on the pool but do not break a user-visible flow on their own. Filed together so they are recorded without a separate issue each. Related class: #955.

1. cp_routing is one install-wide row rewritten from each member's memory

local-store.ts:3120 upserts on the literal id = 1 (CHECK (id = 1), :831), driven by router/cp-routing-layer.ts:62, which serializes the process's whole assignments map on every upsertAssign / applyUpdate / converge. Each member's write erases every other member's. CpRoutingLayer's constructor (:27) then hydrates whichever member wrote last, so a member boots holding a foreign routing map and a foreign routingEpoch — and applyUpdate's stale guard (:41, if (u.routingEpoch < this.routingEpoch) return) will then discard legitimate global-rule updates until the real epoch catches up. Bounded because converge() on register/ok reasserts from the CP snapshot, so the exposure is boot → register/ok plus continuous cross-member write amplification on one hot row. Fix: key the row by member, or stop persisting it (the CP re-sends the full snapshot on every connect, which is what makes the corruption survivable today).

2. findThreadOwner excludes every pool agent

packages/control-plane/src/persistence/repositories/session.repo.ts:1673:

where: { channel, thread, agent: { daemonId: { not: null }, integrations: { some: { botId, status: 'active' } } } }

The predicate requires a non-null daemonId, so the pull-on-miss fallback that routes un-mentioned thread follow-ups (channel-root / case-2a sessions) never fires for a pool agent. Above it, orchestrator/httpBot.ts:417 (lookupThread) returns SharedThreadAgent.daemonId verbatim — an FK-less column (prisma/schema.prisma:2018) that names a reaped member after a rollout. Note orchestrator/agentRouting.ts:15 explicitly defers thread affinity to a later milestone, so treat the lookupThread half as known-deferred; the findThreadOwner filter is a separate, independently fixable blind spot (resolve through the placement resolver instead of requiring the column).

3. channel/agents ownership bind uses the ingress projection for an authority question

packages/control-plane/src/ws/handlers/channel-agents.ts:131:

const requester = orgRoster.find((a) => a.agentId === requesterAgentId)
if (requester?.daemonId !== conn.daemonId) return []   // null/undefined never equals a daemonId

resolveDirectory deliberately uses routableDaemon (confirmed holders only). Between a duty grant and the member's first confirming digest, a member that genuinely holds the agent is refused and the agent is told it has no peers. Fix: bind with the resolver's may-act predicate (holders, not confirmed holders) while keeping resolveDirectory for the wake targets.

4. The organization-environment compatibility gate fails open for pool agents

packages/control-plane/src/http/routes/organization-environment.ts:139:

if (daemonId === null) return true        // "unplaced is always fine"

called at :158 and :200 with agent.daemonId. A pool agent is placed but names no machine, so it reads as "unplaced" and the AGENT_CONFIG_REVISION_FEATURE precondition is skipped entirely. This is the inverse of the other findings in this class — a silent pass rather than a silent refusal — and worth fixing in the same pass so the two directions do not drift apart.

5. sessions.usage accumulation is a read-modify-write

local-store.ts:2029 / :2043 / :2059 / :2070: getUsage → merge in JS → writeUsage. addTokenUsage and addCost are genuinely additive and will lose increments under concurrency. Blast radius is one session and a session has one owner outside a handover, so this is token-accounting drift rather than a correctness break — but it is the same pattern, and a single relative UPDATE would close it.

6. Boot inbox replay logs one warn per foreign row

daemon.ts:20530: a member boots holding nothing, so replayInbox walks the whole install-wide inbox and logs durable inbox: skipping replay of <id> — unknown agent "<agentId>" for every pending row of every organization. Accurate when the store was one daemon's SQLite file; on the shared store it is per-Pod-start noise proportional to fleet backlog. Drop to debug, or scope the boot read.

7. The org-fenced data-plane transcript table is off the write path

PostgresDataPlane.transcripts — the agentconnect_data_plane.transcript table that carries org_id in every index (store/postgres-migrations.ts:28) — is constructed and then never read or written by the daemon (grep '\.transcripts\b' matches only its own constructor and flush). All transcript traffic goes to the LocalStore mirror in agentconnect_cloud_store, whose transcript / transcript_recipient tables have no org_id column at all (local-store.ts:798). Not a live bug — reads are keyed by (channel, thread) and go through agent-scoped callers — but the tenant fence that was written for this data is not the one in force, which is worth either wiring up or deleting so the schema stops implying a guarantee it does not provide.

[zfy0701]

Six of the seven are resolved. Status per item, so what remains is unambiguous:

#	Item	Status
1	cp_routing install-wide row	✅ #1063
2	findThreadOwner excludes pool agents	✅ #1063
3	channel/agents bind on the ingress projection	✅ #1063
4	org-environment gate fails open	✅ #1063
5	sessions.usage read-modify-write	✅ #1063
6	boot inbox replay log noise	✅ fixed separately on main
7	org-fenced data-plane transcript table	⬜ open

Three notes where the fix diverged from what this issue proposed, since the reasoning matters more than the diff:

Item 1 took the second option, not the first. Partitioning the row per member does not work: ownerId is a process incarnation (PostgresDataPlane mints randomUUID() on every open, and local-store.ts calls the column "daemon incarnation holding the grant"), so a per-member key changes on every restart — leaking a row each time and still hydrating nothing. No stable member identity exists at store-open time either; the CP assigns daemonId later, at auth/ok. So a shared store now simply does not persist the row, and an exclusively owned one is untouched. No schema change at all. If global-rule survival across a pool restart turns out to matter, that needs a stable member identity and is worth its own issue.

Item 3 needed one thing beyond the bind. Swapping to mayAct alone changes no outcome, because visibleToRequester fails closed on a requester missing from the roster — the member would pass the new bind and still be told it has no peers. The requester's own row now rides along when nothing routes to it yet; its peers stay filtered by routability, so nothing becomes discoverable-but-uncallable.

Item 5 could not use a relative UPDATE. usage is one JSON blob and the two store backends spell JSON mutation differently (json_set vs jsonb_set), so no single statement works on both. A compare-and-set is plain SQL in both and closes the same gap, degrading on its last attempt to exactly the blind write it replaces.

Item 6 was fixed independently while this was in progress — daemon.ts now computes const level = this.dataPlane ? 'debug' : 'warn' and skips on !this.servesAgent(row.agentId).

Item 7 is deliberately untouched, and is the only reason this issue is still open. Its own framing — "either wiring up or deleting" — is two opposite tenancy decisions rather than two spellings of one fix: wiring it up makes transcripts org-fenced at the data plane and touches the read path plus the LocalStore mirror schema, which carries no org_id at all; deleting it concedes the fence does not apply to this data. That is an owner's call, not a drive-by patch. Happy to split it into a focused issue so this one can close — say the word.

---

Generated by Claude Code

[zfy0701]

Item 7 decision (owner): option B — the live transcript tables in the pool store (LocalStore transcript / transcript_recipient) gain an org_id (NOT NULL on the shared store; a local single-org daemon fills its own org), writes carry it from the agent's org, reads are fenced on (org, channel, thread); the never-used PostgresDataPlane.transcripts table and its code/migration are deleted so one store carries the fence. Backfill existing rows via session → agent → org; rows that cannot be attributed are dropped (only test data exists on any shared store). No compatibility layer. Items 1–6 landed in #1063.