@pi-unipi/kanboard 3.0.0-alpha.15 → 3.0.0-alpha.17

package/README.md

@@ -3,10 +3,14 @@
 The pi half of **kanboard v3**: a per-project board for deferred work. The
 storage, transition rules and web UI live in the Rust binary
 ([`crates/kanboard`](../../crates/kanboard) — one writer for every change); this
-package is the terminal-side bridge: commands, the task runner, hub settings and
-the `kanboard` skill.
+package is the terminal-side bridge: commands, the `-do` budget, the turn
+arbiter's kanboard monitor, hub settings and the `kanboard` skill.
+**There is no runner** — the session works board tasks itself; the runner,
+queue and strategy labels were removed (see
+[`docs/plans/2026-09-30-01a0f095.md`](../../docs/plans/2026-09-30-01a0f095.md)).
 
-Spec: [`docs/specs/2026-09-24-kanboard-v3-design.md`](../../docs/specs/2026-09-24-kanboard-v3-design.md).
+Spec: [`docs/specs/2026-09-24-kanboard-v3-design.md`](../../docs/specs/2026-09-24-kanboard-v3-design.md)
+(superseded for the runner/queue/strategy parts).
 
 ## Commands
 
@@ -18,7 +22,7 @@ Spec: [`docs/specs/2026-09-24-kanboard-v3-design.md`](../../docs/specs/2026-09-2
 | `open [--host H] [--port N]` | Ensure the daemon (reuse a healthy one, else spawn `serve` detached) and print `http://127.0.0.1:<port>/p/<slug>`. The browser opens only when `openBrowser` is on. |
 | `onboard` | `project add` for this workspace and remembers the slug. Idempotent. |
 | `close` | Shut down the board daemon — the web UI goes offline until the next `open`. Running tasks are unaffected. |
-| `status` | Daemon pid/port, project counts, active claims (session/pid/host/staleness), this session's queue, and the runner's current task. |
+| `status` | Daemon pid/port, project counts and active claims (session/pid/host/staleness). |
 | `doctor` | ✓/✗ setup check (binary, daemon health, project, summary agent, bind, claims) as a display-only message. |
 
 The other three commands are separate slash commands:
@@ -26,56 +30,46 @@ The other three commands are separate slash commands:
 | Command | What it does |
 |---|---|
 | `/unipi:kanboard-add [-p 1-5] [--after ID] [--status backlog\|todo] <title>` | Capture a task — no agent turn. Lines below the title are the body; existing file paths pasted there are attached. `-p` maps 1 none · 2 low · 3 medium · 4 high · 5 urgent. |
-| `/unipi:kanboard-do <request>` | Reveal the skill and hand the request to the agent with board writes enabled for that turn. The agent may add/move/queue/note; it cannot run tasks — queued ids are drained by the runner when the turn ends. |
-| `/unipi:kanboard-autowork start\|stop` | `start` runs ready tasks one by one (queue order first, then `claim-next`); `stop` finishes the current task, then stops. |
+| `/unipi:kanboard-do <request>` | Reveal the skill and hand the request to the agent with a **budget**: `doTasks` task slots (each `start` uses one) and `doWrites` board writes (add, edit, link, order, move backlog↔todo, note on tasks you don't hold). Always free: reads, and `finish`, `move <ID> blocked --comment` and `note` on tasks this session started. Budgets persist across turns until spent; `-do` tops up without stacking, `off` revokes. Children never write. |
+| `/unipi:kanboard-autowork start\|stop` | `start` turns autowork on: the session works every ready task one at a time, in any mode it chooses, with no budget limits. `stop` turns the offers off (never aborts the current turn). |
 
 The old `add`/`work`/`stop` subcommands and bare-text capture now just point at
 these commands.
 
-## Runner (`/unipi:kanboard-autowork start`)
-
-One job per session. The **runner owns the lifecycle transitions** the agent is
-not allowed to write:
-
-1. `claim-next --session <sid> --pid <ppid> --host <host> --gate <chainGate>` —
-   nothing ready → `Nothing ready (N waiting on deps, M blocked)`.
-2. **The task's labels decide how it runs** (`edit <ID> --strategy
-   none|goal|ralph|swarm|graph` and `--plan yes|no`; `auto`/unset = jev picks).
-   jev gets one `choice` call with only the unset questions (title + body
-   ≤2000 chars): strategy criteria none/goal/ralph/swarm/graph + plan yes/no.
-   jev null → `none` + no plan; the decision is logged to
-   `~/.unipi/logs/kanboard.log` with `UNIPI_DEBUG_KANBOARD=1`.
-3. `set-run --mode`, then the task goes to the agent as a user message: title,
-   body, last 10 activity entries, each dependency with its status and last note,
-   and the rules (block with a comment to ask a question; never write
-   `in_review`/`done`/`cancelled`; work only on this task).
-   - **plan=yes** → plan mode is entered through workflow's `unipi:plan-enter`
-     runner first; approval stays interactive; a discarded plan releases the
-     task to Todo with `plan discarded`. The chosen strategy applies to the
-     work turn after approval (deferred until `planModeChanged`).
-   - **goal** → long-horizon's `unipi:goal-start` runner starts a goal with the
-     task as the objective; the goal id is recorded with `set-run --goal` and
-     completion is read back with `unipi:goal-status`.
-   - **swarm / graph** → long-horizon's `unipi:lh-explicit` runner sets the
-     explicit mode for the work turn.
-   - **ralph** → `unipi:ralph-start` starts the checklist loop (task title +
-     body as the checklist file); with no `- [ ]` items or a failed start it
-     falls back to goal, then none.
-4. Run end (a `/plan` settle after the last `agent_end`, once the agent reports
-   idle with no queued messages): the task is re-read — if the agent blocked it,
-   that is respected and reported (`▣ UNI-12 blocked: <comment>`) and the loop
-   continues; otherwise `release --to in_review --comment <last assistant text
-   ≤500 chars>`. `Esc` (aborted turn) → `release --to todo --comment "interrupted
-   by user"` and the loop stops. Session shutdown → `release --to todo` with
-   `session ended`.
-5. After each task: `✓ UNI-12 → In Review: <first line>`, then the loop takes
-   the next id from the session **queue** (`claim-next --id`; entries that went
-   stale are dropped with a notice), falls back to `claim-next` while autowork
-   is on, and stops when nothing is ready. The event loop is never blocked.
-
-Footer: `▣ UNI-12 · <strategy>[ +plan]` while a task runs. The claimed task is persisted with
-`pi.appendEntry("unipi:kanboard-runner", …)`, so `/reload` or a resume offers to
-resume it or releases it to Todo.
+## Continuation: the turn arbiter's monitor
+
+There is no runner loop. When a run settles, `src/monitor.ts` — a nudge
+provider on core's turn arbiter (`agent_before_settle`) — proposes at most one
+continuation:
+
+- **Claims (priority 50):** a task this session started is still In Progress →
+  `↻ UNI-30 still In Progress — continue, or finish/block it (n/5)`.
+- **Autowork-next (priority 40):** autowork on, no open claims, a ready task
+  exists → `↻ next ready: UNI-33 <title> …`; nothing ready → an
+  `autowork done` notice, then autowork turns itself off.
+
+The monitor defers to a **long-horizon owner** (priority 100), to **pending
+events** and to **wait sources** (a running bg wake, a busy sidekick, a
+background subagent). It **disarms** on an aborted/errored run (Esc never gets
+talked over) and when a goal stops paused/budget with claims open (notice
+only). Runaway guards: 2 nudged runs with zero tool calls → `⚠ stalled`, a
+hard cap of 5 nudges per task, a question heuristic (the agent asked the user
+something → notice, no nudge), and in autowork the same stall rule plus a
+3-offers-per-task cap. After an Esc, a later prompt that names a claimed id
+re-arms the monitor.
+
+**Children are read-only.** Sidekicks and subagents may read the board; every
+write is refused with "board writes are the lead's job — report this to the
+lead". Reminders are silent there too.
+
+**Session identity & lifecycle.** On every lead `session_start` the session id
+becomes `UNIPI_KANBOARD_SESSION = pi-<pi session id>` (stable across `-c`/`-r`)
+and `UNIPI_KANBOARD_PID` the process pid. At startup stale claims whose pid died
+are reaped (`session lost: …`), and tasks released that way get a one-time
+notice ("UNI-30 was released when the last run ended — ask me to re-start it").
+On `session_shutdown` this session's open claims are released to Todo with
+`released: session ended mid-task (<session>)` (actor system — the agent actor
+cannot release).
 
 ## Settings (hub section "Kanboard")
 
@@ -88,10 +82,11 @@ resume it or releases it to Todo.
 | `openBrowser` | `false` | Open the board in a browser on `open` |
 | `requireAuth` | `false` | Also require the access token on 127.0.0.1 (remote always does) |
 | `keepToken` | `false` | Reuse `<home>/token` across daemon restarts |
-| `queueMax` | `10` | Tasks a session may queue (0 = unlimited); passed to the CLI as `UNIPI_KANBOARD_QUEUE_MAX` |
-| `maxSessions` | `2` | Distinct sessions running tasks per project (`UNIPI_KANBOARD_MAX_SESSIONS`) |
-| `turnAddLimit` | `20` | `add` calls allowed per -do turn or runner task (0 = unlimited) |
-| `reminders` | `true` | Progress reminders for hand-worked tasks: a steer on the first file-changing call while a mentioned task is still Todo (R1), and a follow-up at turn end while a started task is still In Progress (R2, max 2 per task). Text only, silent in runner runs |
+| `maxSessions` | `2` | Distinct sessions holding in-progress tasks per project (`UNIPI_KANBOARD_MAX_SESSIONS`) |
+| `turnAddLimit` | `20` | `add` calls allowed per turn (0 = unlimited) — the runaway guard, applies in autowork too |
+| `reminders` | `true` | R1: steer on the first file-changing call while a mentioned task is still Todo (text only, never blocks; silent in child sessions) |
+| `doTasks` | `5` | Task slots a `/unipi:kanboard-do` grants (each `start` costs one) |
+| `doWrites` | `10` | Board writes a `/unipi:kanboard-do` grants; a stored `doCredits` migrates into this |
 | *actions* | | `Open board…`, `Stop daemon`, `Summary agent command…`, `Rotate access token` |
 
 `Summary agent command…` writes through `settings set agent-command` and
@@ -210,10 +205,10 @@ The extension never edits those files — the binary owns them.
 | `UNI-5 is unreadable: … (line N)` | That task's own file is broken — repair it before moving/noting it. |
 | The daemon looks stale | `unipi-kanboard status` (pid + liveness), then `/unipi:kanboard close`, `unipi-kanboard stop` (SIGTERM, ≤3s) or the hub's **Stop daemon** action. |
 | Nothing is ready | `unipi-kanboard list --ready --json` shows `waitingFor`; a cancelled dependency blocks forever — `link`/`unlink` to re-plan. |
-| The runner prompts for permission on every board call | Fixed in auto mode: `unipi-kanboard … --actor agent` is allow-listed by the permission gate (ask mode still asks). |
+| A board call prompts for permission | Fixed in auto mode: `unipi-kanboard … --actor agent` is allow-listed by the permission gate (ask mode still asks). |
 
 ## Tests
 
 ```bash
-npm test -w packages/kanboard     # bin resolution, commands, runner, settings
+npm test -w packages/kanboard     # bin resolution, commands, budget guard, monitor, settings
 ```

package/index.ts

@@ -2,36 +2,43 @@
  * @pi-unipi/kanboard — pi extension.
  *
  * Bridges the terminal to the board: `/unipi:kanboard` (open/close/onboard/
- * status/doctor — bare lists the commands), `/unipi:kanboard-add`,
- * `/unipi:kanboard-do` (opens the board-write window for one turn),
- * `/unipi:kanboard-autowork` (the runner loop: queue first, then claim-next).
- * The runner owns claim → In Progress and run-end → In Review for queued work;
- * an agent working a task by hand uses `start`/`finish` (free), nudged by the
- * progress reminders (src/reminders.ts). The board itself
- * is written by the Rust binary (`crates/kanboard`); this extension never edits
- * task files. Bash calls into the binary are gated by the write window
- * (src/guard.ts): reads always pass, writes need a -do turn or a running task.
+ * status/doctor/show — bare lists the commands), `/unipi:kanboard-add`,
+ * `/unipi:kanboard-do` (grants task slots + a write budget for one prompt),
+ * `/unipi:kanboard-autowork` (work every ready task in this session). The
+ * session works tasks itself — there is no runner. Continuation is the turn
+ * arbiter's job: src/monitor.ts proposes at most one nudge per settle (claims
+ * first, then the next ready autowork task). Bash calls into the Rust binary
+ * are gated by src/guard.ts: reads always pass, children never write, writes
+ * cost the -do budget (own-claim closes are free). The board itself is
+ * written by the binary; this extension never edits task files.
  */
 
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { Text } from "@earendil-works/pi-tui";
 import {
   MODULES,
   UNIPI_EVENTS,
   emitEvent,
   getPackageVersion,
+  getSettings,
+  getSharedKanboardStatus,
+  getSharedOwnerStatus,
   initUnipiDirs,
+  isChildProcess,
   registerCommandRunner,
-  getSettings,
-  appendProgress,
+  registerEvidenceContributor,
+  registerNudgeProvider,
   registerProgressRenderer,
+  setSharedKanboardStatus,
+  appendProgress,
 } from "@pi-unipi/core";
 
 import { openCli, type KanboardCli } from "./src/bin.js";
-import { createWriteGuard } from "./src/guard.js";
+import { kanboardInvocations } from "./src/guard.js";
+import { maybeBadgeToolResult, registerBadgeRenderer } from "./src/badges.js";
 import {
-  drainQueueAfterDo,
   registerKanboardCommands,
   runOpen,
   syncPiRuntime,
@@ -39,9 +46,12 @@ import {
   runStopDaemon,
   type CommandDeps,
 } from "./src/commands.js";
-import { createDebugLog, createRunner, registerPlanEventListener, type Runner } from "./src/runner.js";
-import { createProgressTracker, registerProgressReminders, sendReminder } from "./src/reminders.js";
-import { asTaskList } from "./src/shapes.js";
+import { createWriteGuard } from "./src/guard.js";
+import { NOTICE_ENTRY, flushNotices, NoticeBuffer } from "./src/notice-buffer.js";
+import { createKanboardMonitor } from "./src/monitor.js";
+import { createDebugLog } from "./src/debug.js";
+import { createProgressTracker, registerProgressReminders, ANTI_POISONING_SUFFIX } from "./src/reminders.js";
+import { asTaskList, type KanboardTask } from "./src/shapes.js";
 import {
   ACTION_OPEN,
   ACTION_STOP_DAEMON,
@@ -58,7 +68,8 @@ export const SKILL_REVEAL_EVENT = "unipi:skills:reveal";
 export const KANBOARD_SKILL = "kanboard";
 
 export default function (pi: ExtensionAPI) {
-  // One session id shared by the runner and the agent's bash calls.
+  // One session id shared by the agent's bash calls (refined at session_start
+  // from the pi session id; children keep the value they inherited).
   process.env.UNIPI_KANBOARD_SESSION ??= `pi-${process.pid}`;
   // `start` claims belong to this pi process: the stale-claim reaper releases
   // them to Todo when it dies (the agent's bash inherits the env).
@@ -71,15 +82,11 @@ export default function (pi: ExtensionAPI) {
 
   let cli: KanboardCli | null = null;
   let unavailable: string | null = null;
-  let runner: Runner | null = null;
-  const guard = createWriteGuard(
-    () => {
-      const status = runner?.status();
-      return status?.phase === "running" ? status.taskId : null;
-    },
-    () => readKanboardSettings().turnAddLimit,
-    () => readKanboardSettings().doCredits,
-  );
+  const guard = createWriteGuard({
+    addLimit: () => readKanboardSettings().turnAddLimit,
+    doTasks: () => readKanboardSettings().doTasks,
+    doWrites: () => readKanboardSettings().doWrites,
+  });
   const sessionId = (): string => process.env.UNIPI_KANBOARD_SESSION ?? `pi-${process.pid}`;
 
   const projectSlug = (): string => {
@@ -93,8 +100,87 @@ export default function (pi: ExtensionAPI) {
     }
   };
 
-  // Live getters: the command is registered before the binary is resolved, so
-  // the deps object must read the current state at call time.
+  // ── board reads (lead monitor/evidence/holder/notice) ────────────────
+  const listTasks = async (args: string[] = []): Promise<KanboardTask[]> => {
+    const client = cli;
+    const slug = projectSlug();
+    if (!client || !slug) return [];
+    const payload = await client.run<unknown>(["list", ...args, "--json"], {
+      extraEnv: { UNIPI_KANBOARD_PROJECT: slug, UNIPI_KANBOARD_SESSION: sessionId() },
+    });
+    return asTaskList(payload).tasks;
+  };
+  const ownClaims = async (): Promise<KanboardTask[]> => {
+    try {
+      const session = sessionId();
+      return (await listTasks()).filter((task) => {
+        const run = task.run as { session?: string } | null | undefined;
+        return task.status === "in_progress" && run?.session === session;
+      });
+    } catch {
+      return [];
+    }
+  };
+
+  // ── monitor: the arbiter's kanboard nudge provider (lead only) ───────
+  // User-only notices queue here and flush at agent_settled (post boundary).
+  const pendingNotices = new NoticeBuffer();
+  const monitor = createKanboardMonitor({
+    list: () => listTasks(),
+    listReady: () => listTasks(["--ready"]),
+    session: sessionId,
+    ownerStatus: () => getSharedOwnerStatus(),
+    now: () => Date.now(),
+    // User-only: only QUEUE here — a sendMessage custom message would be
+    // converted to a user-role LLM message (never what a notice wants).
+    // kanboard's agent_settled handler drains the buffer (appendEntry + toast).
+    notify: (text, level) => {
+      pendingNotices.queue(text, level);
+    },
+    // The monitor turned autowork off itself (done / stalled): the guard's
+    // budget and the footer's `▣ autowork` flag must follow.
+    onAutoworkOff: () => {
+      guard.setAutowork(false);
+      void refreshHolder();
+    },
+    cliPrefix: () => {
+      const slug = projectSlug();
+      return cli && slug ? `${cli.binary.path} --actor agent --project ${slug}` : null;
+    },
+    debug,
+  });
+
+  const refreshHolder = async (): Promise<void> => {
+    try {
+      setSharedKanboardStatus({
+        claims: (await ownClaims()).map((task) => task.id),
+        autowork: guard.remaining().autowork,
+      });
+    } catch {
+      // The footer simply shows nothing until the next refresh.
+    }
+  };
+
+  if (!isChildProcess()) {
+    try {
+      registerNudgeProvider("kanboard", 50, (info) => monitor.propose(info));
+    } catch {
+      // Registration must never block module load.
+    }
+    try {
+      registerEvidenceContributor("kanboard", async () => ({
+        blocking: (await ownClaims()).map(
+          (task) => `${task.id} is still In Progress (claimed by this session) — finish it or move it to blocked`,
+        ),
+        notes: [],
+      }));
+    } catch {
+      // Registration must never block module load.
+    }
+    registerBadgeRenderer(pi);
+  }
+
+  // ── command plumbing ─────────────────────────────────────────────────
   const buildDeps = (): CommandDeps => ({
       get cli() {
         return cli;
@@ -104,10 +190,12 @@ export default function (pi: ExtensionAPI) {
       },
       settings: () => readKanboardSettings(process.cwd()),
       revealSkill,
-      work: (ctx) => runner?.work(ctx) ?? Promise.resolve(),
-      stop: (ctx) => runner?.stop(ctx),
-      drainQueue: (ctx) => runner?.drain(ctx) ?? Promise.resolve(),
-      status: () => runner?.status() ?? { taskId: null, mode: null, phase: "idle" },
+      setAutowork: (on) => {
+        guard.setAutowork(on);
+        monitor.setAutowork(on);
+        if (on) monitor.arm("autowork");
+        void refreshHolder();
+      },
       guard,
       session: sessionId,
       debug,
@@ -130,35 +218,19 @@ export default function (pi: ExtensionAPI) {
     cli = opened;
     unavailable = null;
     debug(`binary: ${opened.binary.path} (${opened.binary.source})`);
-    if (!runner) {
-      runner = createRunner({
-        pi,
-        cli,
-        project: projectSlug,
-        cwd: ctx.cwd,
-        settings: () => readKanboardSettings(ctx.cwd),
-        debug,
-      });
-      registerPlanEventListener(pi, runner);
-    }
     return true;
   };
 
   registerProgressRenderer(pi);
   registerKanboardCommands(pi, buildDeps());
 
-  // R1/R2 progress reminders for hand-worked tasks (silent in runner runs).
-  const reminders = registerProgressReminders(
+  // R1 progress reminders for hand-worked tasks (silent in child sessions).
+  registerProgressReminders(
     pi,
     createProgressTracker({
       enabled: () => readKanboardSettings().reminders,
-      runnerOwned: () => (runner?.status().phase ?? "idle") !== "idle",
       session: sessionId,
-      list: async () => {
-        const slug = projectSlug();
-        if (!cli || !slug) return [];
-        return asTaskList(await cli.run<unknown>(["list"], { extraEnv: { UNIPI_KANBOARD_PROJECT: slug } })).tasks;
-      },
+      list: () => listTasks(),
       cliPrefix: () => {
         const slug = projectSlug();
         return cli && slug ? `${cli.binary.path} --actor agent --project ${slug}` : null;
@@ -189,10 +261,78 @@ export default function (pi: ExtensionAPI) {
     await runRotateTokenAction(buildDeps(), context);
   });
 
+  // ── run hooks: monitor, badges, holder (lead only) ───────────────────
+  pi.on("before_agent_start", async (event) => {
+    try {
+      await monitor.onUserPrompt(String((event as { prompt?: unknown }).prompt ?? ""));
+    } catch {
+      // Prompt handling must never abort a turn.
+    }
+    return undefined;
+  });
+  pi.on("agent_start", () => {
+    try {
+      monitor.onAgentStart();
+    } catch {
+      // Accounting must never abort a turn.
+    }
+  });
+  pi.on("agent_end", async (event) => {
+    try {
+      guard.onAgentEnd();
+      monitor.onAgentEnd((event as { messages?: unknown[] }).messages);
+    } catch {
+      // Monitoring must never abort a turn.
+    }
+  });
+  // Post-boundary: entries append fine here (they are dropped inside the
+  // settle path), and the toast gives the notice a life outside the transcript.
+  pi.on("agent_settled", async (_event, ctx) => {
+    try {
+      const ui = ctx as unknown as { hasUI?: boolean; ui?: { notify?: (t: string, l?: string) => void } } | undefined;
+      flushNotices(
+        pi,
+        pendingNotices,
+        {
+          hasUI: ui?.hasUI,
+          notify: (text, level) => ui?.ui?.notify?.(text, level ?? "info"),
+        },
+        debug,
+      );
+      void refreshHolder();
+    } catch {
+      // The footer simply shows nothing until the next refresh.
+    }
+  });
+  pi.on("tool_result", async (event) => {
+    const toolEvent = event as { toolName?: string; input?: Record<string, unknown>; isError?: boolean };
+    try {
+      if (isChildProcess()) return undefined;
+      if (toolEvent.toolName !== "bash" && toolEvent.toolName !== "powershell") return undefined;
+      maybeBadgeToolResult(pi, String(toolEvent.toolName), toolEvent.input, toolEvent.isError === true);
+      if (toolEvent.isError) return undefined;
+      const invocations = kanboardInvocations(String(toolEvent.input?.command ?? ""));
+      if (invocations.some((inv) => inv.sub === "start" || inv.sub === "finish" || inv.sub === "move")) {
+        if (invocations.some((inv) => inv.sub === "start")) monitor.arm("start");
+        void refreshHolder();
+      }
+    } catch {
+      // Badges and holder refreshes must never abort a turn.
+    }
+    return undefined;
+  });
+
+  // ── session lifecycle ────────────────────────────────────────────────
   pi.on("session_start", async (_event, ctx) => {
     // Kanboard's own ambient children (summaries, --list-models) get this env:
     // they must not re-sync the runtime or spawn a daemon.
     if (process.env.UNIPI_KANBOARD_CHILD) return;
+    // Children keep the session id they inherited from the lead.
+    if (!isChildProcess()) {
+      // Step 0: reason is "startup" even for -c/-r — never branch on it.
+      process.env.UNIPI_KANBOARD_SESSION = `pi-${ctx.sessionManager.getSessionId()}`;
+      process.env.UNIPI_KANBOARD_PID = String(process.pid);
+    }
     initUnipiDirs();
     if (attach(ctx as unknown as ExtensionContext)) {
       const deps = buildDeps();
@@ -209,6 +349,50 @@ export default function (pi: ExtensionAPI) {
       debug(`unavailable: ${unavailable}`);
       return;
     }
+    // Reap claims whose pid died with the process (the runner used to do
+    // this): released tasks get the "session lost: <session>" activity the
+    // resume notice below keys on. The reaper acts as the system actor.
+    if (!isChildProcess()) {
+      try {
+        const reaped = await cli!.run<unknown>(["reap", "--json"], {
+          extraEnv: { UNIPI_KANBOARD_PROJECT: projectSlug(), UNIPI_KANBOARD_SESSION: sessionId() },
+        });
+        debug(`reap: ${JSON.stringify(reaped)}`);
+      } catch (error) {
+        debug(`reap failed: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    void refreshHolder();
+
+    // Resume notice: claims the reaper released when a previous run of THIS
+    // session died ("session lost: <session> …"), or that a shutdown released
+    // ("released: … session ended mid-task (<session>)"). Once per start.
+    // Activity entries are ordered oldest-first — the LAST one must be the
+    // release (a task that moved on afterwards is not news).
+    if (!isChildProcess()) {
+      try {
+        const session = sessionId();
+        const stale = (await listTasks()).filter((task) => {
+          if (task.status !== "todo") return false;
+          const last = task.activity?.at(-1);
+          if (!last) return false;
+          return (
+            last.text.startsWith(`session lost: ${session}`) ||
+            last.text.includes(`released: session ended mid-task (${session})`)
+          );
+        });
+        if (stale.length > 0) {
+          const ids = stale.map((task) => task.id).join(", ");
+          (ctx as unknown as { ui?: { notify?: (t: string, l?: string) => void } }).ui?.notify?.(
+            `kanboard: ${ids} was released when the last run ended — ask me to re-start it`,
+            "info",
+          );
+        }
+      } catch (error) {
+        debug(`resume notice failed: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+
     const client = cli!;
     const settings = readKanboardSettings(ctx.cwd);
     if (settings.archiveAfterDays > 0 || settings.retentionDays > 0) {
@@ -224,30 +408,41 @@ export default function (pi: ExtensionAPI) {
         .then((payload) => debug(`archive-sweep: ${JSON.stringify(payload)}`))
         .catch((error) => debug(`archive-sweep failed: ${error instanceof Error ? error.message : String(error)}`));
     }
-    await runner?.onSessionStart(ctx as unknown as ExtensionContext);
-  });
-
-  let drainPending = false;
-  pi.on("agent_end", async (event, ctx) => {
-    runner?.onAgentEnd(event as { messages?: unknown[] }, ctx as unknown as ExtensionContext);
-    // A -do window closes on the first real agent_end (the 150ms echo guard
-    // inside onAgentEnd skips the previous turn's late end). The drain itself
-    // runs at agent_settled: sending a task prompt while the turn is still
-    // finalizing would queue it as a follow-up that never gets delivered.
-    if (guard.onAgentEnd()) drainPending = true;
-  });
-
-  pi.on("agent_settled", async (_event, ctx) => {
-    const reminder = reminders.takePending();
-    if (drainPending) {
-      drainPending = false;
-      await drainQueueAfterDo(buildDeps(), ctx as unknown as ExtensionContext);
-    }
-    // A drained queue hands the session to the runner: the reminder is moot.
-    if (reminder && (runner?.status().phase ?? "idle") === "idle") sendReminder(pi, reminder);
   });
 
   pi.on("session_shutdown", async (_event, ctx) => {
-    await runner?.onSessionShutdown(ctx as unknown as ExtensionContext);
+    // Release this session's open claims so the board shows the truth. The
+    // in_progress → todo transition allows the system actor only (the agent
+    // cannot release), and release requires a comment — the next run's resume
+    // notice keys on it. Best effort: a dead pid is reaped with "session
+    // lost" anyway.
+    // Children (subagents, fusion sidekicks, kanboard's own helpers) inherit
+    // the lead's session id: their shutdown must never release the lead's
+    // claims (a finished subagent used to bounce the lead's task to Todo).
+    if (isChildProcess() || process.env.UNIPI_KANBOARD_CHILD) return;
+    try {
+      const session = sessionId();
+      const claims = await ownClaims();
+      const client = cli;
+      const slug = projectSlug();
+      if (!client || !slug || claims.length === 0) return;
+      for (const task of claims) {
+        await client
+          .run([
+            "--actor", "system",
+            "--project", slug,
+            "release", task.id, "--to", "todo",
+            "--comment", `released: session ended mid-task (${session})`,
+          ], {
+            extraEnv: { UNIPI_KANBOARD_PROJECT: slug, UNIPI_KANBOARD_SESSION: session },
+          })
+          .then(() => debug(`released ${task.id} at shutdown`))
+          .catch((error) => debug(`shutdown release ${task.id} failed: ${error instanceof Error ? error.message : String(error)}`));
+      }
+      setSharedKanboardStatus({ claims: [], autowork: guard.remaining().autowork });
+    } catch {
+      // Shutdown must never hang the session teardown.
+    }
+    void ctx;
   });
 }

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@pi-unipi/kanboard",
-  "version": "3.0.0-alpha.15",
+  "version": "3.0.0-alpha.17",
   "description": "Kanboard v3 — deferred-work board: CLI/daemon bridge, task runner and skill",
   "type": "module",
   "main": "index.ts",
   "license": "MIT",
   "author": "Neuron Mr White",
   "scripts": {
-    "test": "npx tsx --test tests/**/*.test.ts"
+    "test": "UNIPI_FUSION_CHILD= UNIPI_SUBAGENT_CHILD= UNIPI_KANBOARD_CHILD= npx tsx --test tests/*.test.ts tests/*/*.test.ts"
   },
   "repository": {
     "type": "git",
@@ -31,7 +31,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.15"
+    "@pi-unipi/core": "3.0.0-alpha.17"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",
@@ -48,10 +48,10 @@
     "themes": []
   },
   "optionalDependencies": {
-    "@pi-unipi/kanboard-linux-x64": "3.0.0-alpha.15",
-    "@pi-unipi/kanboard-linux-arm64": "3.0.0-alpha.15",
-    "@pi-unipi/kanboard-darwin-x64": "3.0.0-alpha.15",
-    "@pi-unipi/kanboard-darwin-arm64": "3.0.0-alpha.15",
-    "@pi-unipi/kanboard-win32-x64": "3.0.0-alpha.15"
+    "@pi-unipi/kanboard-linux-x64": "3.0.0-alpha.17",
+    "@pi-unipi/kanboard-linux-arm64": "3.0.0-alpha.17",
+    "@pi-unipi/kanboard-darwin-x64": "3.0.0-alpha.17",
+    "@pi-unipi/kanboard-darwin-arm64": "3.0.0-alpha.17",
+    "@pi-unipi/kanboard-win32-x64": "3.0.0-alpha.17"
   }
 }