hive-c0re: push HelperEvent::Spawned as a todo, not a broker message

Follow-up from #2955 (mara: 'make core able to give agent a todo').
First migration slice: Spawned was pure FYI-check-when-convenient
material, not something needing an immediate turn.

Coordinator::push_todo/push_todo_submitter do a best-effort live dial
of the target agent's own hive-agent-sock (hive_host_sock::agent_todo_
socket), sending the exact UpsertTodo request in-container producers
(matrix/bash/forge-notify) already send. Push, not queue: agent
offline (socket absent) or dial failure is a silent no-op, no retry,
no fallback delivery -- matches mara's 'not available if offline'
call exactly.

HelperEvent::Spawned removed entirely (enum variant + all 3 call
sites migrated: handle_spawn's two arms, finish_approval's Spawn
approval-kind arm) rather than kept alongside a translation layer --
per mara's correction on the first design attempt, migrating the
producer means deleting the old path, not bridging it.

Verified: cargo build/clippy/test -p hive-c0re -p hive-host-sock
-p hive-sh4re clean (318 tests), nix fmt clean.

hive-c0re/src/actions.rs

@@ -498,7 +498,7 @@ async fn run_approval_schedule_prompt(
             .context("insert scheduled prompt")
     }
     .await;
-    finish_approval(coord, &approval, result, None)
+    finish_approval(coord, &approval, result, None).await
 }
 
 /// Resolve an approval row from how its DAG's work ended — the body of the
@@ -565,7 +565,7 @@ pub(crate) async fn resolve_approval_dag(
         }
         _ => {}
     }
-    if let Err(e) = finish_approval(coord, &approval, result, terminal_tag) {
+    if let Err(e) = finish_approval(coord, &approval, result, terminal_tag).await {
         tracing::warn!(approval_id, error = ?e, "approval dag resolved with failure");
     }
 }
@@ -682,10 +682,10 @@ async fn run_approval_init_config(
     {
         tracing::warn!(agent = %approval.agent, error = ?e, "forge: ensure_meta_remote after init_config failed");
     }
-    finish_approval(coord, &approval, result, None)
+    finish_approval(coord, &approval, result, None).await
 }
 
-fn finish_approval(
+async fn finish_approval(
     coord: &Coordinator,
     approval: &hive_sh4re::Approval,
     result: Result<()>,
@@ -747,14 +747,26 @@ fn finish_approval(
                 );
             }
         }
-        ApprovalKind::Spawn => coord.notify_submitter(
-            approval.id,
-            &HelperEvent::Spawned {
-                agent: approval.agent.to_string(),
-                ok,
-                note,
-            },
-        ),
+        ApprovalKind::Spawn => {
+            let summary = if ok {
+                format!("agent '{}' spawned", approval.agent)
+            } else {
+                format!(
+                    "agent '{}' spawn FAILED: {}",
+                    approval.agent,
+                    note.as_deref().unwrap_or("unknown error")
+                )
+            };
+            coord
+                .push_todo_submitter(
+                    approval.id,
+                    "core",
+                    Some(format!("spawned:{}", approval.agent)),
+                    summary,
+                    None,
+                )
+                .await;
+        }
         // MergeConfigPr ends in a container rebuild — surface a Rebuilt
         // lifecycle event. (It is never a first spawn — the agent already
         // exists — so it never needs the Spawned arm above.)

hive-c0re/src/coordinator.rs

@@ -1355,12 +1355,91 @@ impl Coordinator {
     /// failure — fall back to the root agent, preserving the prior
     /// always-root behaviour.
     pub fn notify_submitter(&self, approval_id: i64, event: &hive_sh4re::HelperEvent) {
-        let target = self
-            .approvals
+        let target = self.submitter_or_manager(approval_id);
+        self.notify_agent(&target, event);
+    }
+
+    /// Shared resolution for "which agent should hear about approval
+    /// `approval_id`" — the authenticated socket caller at submit time,
+    /// falling back to the manager for legacy rows with no recorded
+    /// submitter (or any lookup failure). Used by both `notify_submitter`
+    /// and `push_todo_submitter` so the fallback rule lives in one place.
+    fn submitter_or_manager(&self, approval_id: i64) -> String {
+        self.approvals
             .submitter_of(approval_id)
             .unwrap_or_default()
-            .unwrap_or_else(|| hive_sh4re::MANAGER_AGENT.to_owned());
-        self.notify_agent(&target, event);
+            .unwrap_or_else(|| hive_sh4re::MANAGER_AGENT.to_owned())
+    }
+
+    /// Push a todo directly into `agent`'s in-container todo store — a
+    /// best-effort *live* dial of its `hive-agent-sock` socket
+    /// (`hive_host_sock::agent_todo_socket`), same `UpsertTodo` request
+    /// shape the in-container producers (matrix/bash/forge-notify)
+    /// already send. This is the migration target for `HelperEvent`
+    /// variants that are pure "FYI, check when convenient" notices: the
+    /// event stops being a broker `Message` (which always drives an
+    /// immediate turn) and becomes a todo instead, with the same
+    /// dedup-by-key semantics as any other producer.
+    ///
+    /// Deliberately push, not queue: if the agent's container is down
+    /// (socket file absent) or the dial otherwise fails, this is a
+    /// silent no-op (logged at `debug`/`warn`) — no retry, no fallback
+    /// delivery. An agent that's down doesn't need a todo about
+    /// something it'll never see appear this way; whatever mechanism
+    /// resurfaces its state on the next boot is unrelated to this path.
+    pub async fn push_todo(
+        &self,
+        agent: &str,
+        subsystem: &str,
+        key: Option<String>,
+        summary: String,
+        source: Option<String>,
+    ) {
+        let Ok(ident) = hive_types::Ident::parse(agent) else {
+            tracing::warn!(%agent, "push_todo: not a valid agent ident, skipping");
+            return;
+        };
+        let path = hive_host_sock::agent_todo_socket(&ident);
+        if !path.exists() {
+            tracing::debug!(%agent, path = %path.display(), "push_todo: agent socket not present (offline?), skipping");
+            return;
+        }
+        let req = hive_agent_sock::Request::UpsertTodo {
+            subsystem: subsystem.to_owned(),
+            key,
+            summary,
+            source,
+        };
+        match hive_sock_client::request::<_, hive_agent_sock::Response>(
+            &path,
+            &req,
+            hive_sock_client::Retry::None,
+        )
+        .await
+        {
+            Ok(hive_agent_sock::Response::Err { message }) => {
+                tracing::warn!(%agent, %message, "push_todo: agent rejected the todo");
+            }
+            Err(e) => {
+                tracing::warn!(%agent, error = ?e, "push_todo: dial failed");
+            }
+            Ok(_) => {}
+        }
+    }
+
+    /// `push_todo` to whichever agent submitted approval `approval_id` —
+    /// same resolution `notify_submitter` uses.
+    pub async fn push_todo_submitter(
+        &self,
+        approval_id: i64,
+        subsystem: &str,
+        key: Option<String>,
+        summary: String,
+        source: Option<String>,
+    ) {
+        let target = self.submitter_or_manager(approval_id);
+        self.push_todo(&target, subsystem, key, summary, source)
+            .await;
     }
 
     /// Push a `HelperEvent` into an arbitrary agent's inbox. Encoded

hive-c0re/src/server.rs

@@ -297,22 +297,30 @@ async fn handle_spawn(coord: &Arc<Coordinator>, name: &str) -> Result<HostRespon
             // Bind the MCP listener now that the container is starting up.
             // The harness connects to this socket on its first turn.
             coord.register_agent(name)?;
-            coord.notify_manager(&hive_sh4re::HelperEvent::Spawned {
-                agent: name.to_owned(),
-                ok: true,
-                note: None,
-            });
+            coord
+                .push_todo(
+                    hive_sh4re::MANAGER_AGENT,
+                    "core",
+                    Some(format!("spawned:{name}")),
+                    format!("agent '{name}' spawned"),
+                    None,
+                )
+                .await;
             // Update tmpfiles.d so the new agent's dirs survive a reboot.
             tokio::spawn(lifecycle::sync_tmpfiles());
         }
         Err(e) => {
             // Spawn failed: register_agent was never called, so there is
             // nothing to unregister. Notify the manager and propagate.
-            coord.notify_manager(&hive_sh4re::HelperEvent::Spawned {
-                agent: name.to_owned(),
-                ok: false,
-                note: Some(format!("{e:#}")),
-            });
+            coord
+                .push_todo(
+                    hive_sh4re::MANAGER_AGENT,
+                    "core",
+                    Some(format!("spawned:{name}")),
+                    format!("agent '{name}' spawn FAILED: {e:#}"),
+                    None,
+                )
+                .await;
             return Err(e);
         }
     }