@volter/supercode-orchestrator 0.4.102 → 0.4.104

package/board/cli.mjs

@@ -12,8 +12,8 @@ import { read } from '../orchestration.mjs';
 import { view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
-import { adoptSession, boardAddress, boardLabel, boardSettings, callerSession, lanesOf, localMachine, observeFleet, paused, plan, startCard, tick } from './dispatch.mjs';
-import { loadWorkflow, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
+import { adoptSession, boardAddress, boardLabel, boardSettings, callerSession, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, tick } from './dispatch.mjs';
+import { loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
 import { evaluate } from './expr.mjs';
 
 const HELP = `supercode workflow <verb> [--root <home>] [--board <slug>] [--json]
@@ -1104,32 +1104,19 @@ function authorize(db, verb, rest, args, own) {
 /** Close the live sessions of a card that is not running (its worker's and its reviewers'), freeing its machine's place. */
 function closeSession(board, id) {
   const task = engine.getTask(board.db, id);
-  const rows = board.db.prepare('SELECT id, metadata FROM task_runs WHERE task_id = ? AND metadata IS NOT NULL ORDER BY id DESC').all(id);
   if (!task) throw new Error(`no card ${id}`);
   if (task.current_run_id != null) throw new Error(`${id} has an active run; pause, block or reclaim it before closing its session`);
-  const closed = [];
-  const seen = new Set();
-  for (const row of rows) {
-    const session = json(row.metadata, {})?.supercode;
-    if (!session?.pane || session.closed_at || seen.has(session.session_id)) continue;
-    seen.add(session.session_id);
-    // the board closes its card's pane, whichever session ran `workflow close`
-    const r = spawnSync(process.env.SUPERCODE_BIN || 'supercode', ['teams', 'panes', 'close', session.pane, '--machine', session.machine], { cwd: tmpdir(), encoding: 'utf8', timeout: 60_000, env: { ...process.env, SUPERCODE_CALLER: boardAddress(board.label) } });
-    if (r.status !== 0) throw new Error(`closing pane ${session.pane} on ${session.machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
-    tx(board, (db) => {
-      const whole = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {}) ?? {};
-      db.prepare('UPDATE task_runs SET metadata = ? WHERE id = ?').run(JSON.stringify({ ...whole, supercode: { ...whole.supercode, closed_at: now() } }), row.id);
-      event(db, id, 'session_closed', { session_id: session.session_id, machine: session.machine, pane: session.pane });
-    });
-    closed.push(session);
-  }
-  return closed.length ? closed : null;
+  tx(board, (db) => requestSessionClose(db, id));
+  const report = { undelivered: [], closed: [] };
+  closeRequested(board, report, { taskId: id, caller: callerSession() });
+  if (report.undelivered.length) throw new Error(`close remains queued for retry: ${report.undelivered.map((r) => r[2]).join('; ')}`);
+  return report.closed.length ? report.closed : null;
 }
 
 export function summary(r) {
   const parts = [`board ${r.board}:`];
   if (r.error) parts.push(`error ${r.error}`);
-  for (const [k, label] of [['mailed', 'mailed updates'], ['started', 'started'], ['queued', 'waiting'], ['failed', 'failed'], ['lost', 'lost'], ['crashed', 'crashed'], ['timed_out', 'timed out'], ['reclaimed', 'reclaimed'], ['auto_blocked', 'gave up'], ['notified', 'notices']]) {
+  for (const [k, label] of [['mailed', 'mailed updates'], ['started', 'started'], ['queued', 'waiting'], ['failed', 'failed'], ['lost', 'lost'], ['crashed', 'crashed'], ['timed_out', 'timed out'], ['reclaimed', 'reclaimed'], ['auto_blocked', 'gave up'], ['notified', 'notices'], ['closed', 'closed sessions'], ['undelivered', 'undelivered (retrying)']]) {
     if (r[k]?.length) parts.push(`${label} ${r[k].length}`);
   }
   if (r.promoted) parts.push(`promoted ${r.promoted}`);

package/board/dispatch.mjs

@@ -6,7 +6,7 @@
 //
 // - `pane`: an interactive session of the lane's harness (Claude Code or Codex) on the card's machine (`supercode open
 //   --new … --on <machine>`), its session id recorded on the run: one the dispatcher chose (Claude Code's
-//   `--session-id`) or the one the harness named, read from the fleet by its pane (Codex). It stays open. It is live
+//   `--session-id`) or the one the harness named, read from the fleet by its pane (Codex). It closes when its run ends. It is live
 //   while supercode's fleet lists it; one missing for the whole grace on an online machine is lost, and the next start
 //   resumes it in its own harness. Nothing asks the session about itself.
 // - `headless`: the profile's worker for one query on this machine (`bin/hermes-worker.mjs`, Hermes's worker
@@ -22,7 +22,7 @@ import { basename, dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { view, boardPath, claimer, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
-import { doors, fire, loadWorkflow, resumeOf, runSpec, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, templateValue, workflowFor } from './workflow.mjs';
+import { doors, fire, loadWorkflow, resumeOf, runSpec, requestSessionClose, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, templateValue, workflowFor } from './workflow.mjs';
 import { evaluate, holds, render } from './expr.mjs';
 import {
   cardContext, claimTtl, currentRun, DEFAULT_FAILURE_LIMIT, extendClaim, getTask, lastSession,
@@ -284,7 +284,10 @@ function stopSession(board, session) {
     if (pidAlive(session.pid)) signal('SIGKILL');
     return;
   }
-  if (session.pane) sc(['teams', 'panes', 'close', session.pane, ...(session.machine ? ['--machine', session.machine] : [])], { timeout: 60_000, as: boardAddress(board.label) });
+  if (session.pane) {
+    const r = sc(['teams', 'panes', 'close', session.pane, ...(session.machine ? ['--machine', session.machine] : [])], { timeout: 60_000, as: boardAddress(board.label) });
+    if (r.code !== 0 || lastJson(r.stdout)?.closed !== session.pane) throw new Error(`closing pane ${session.pane}: ${(r.stderr || r.stdout || `exit ${r.code}`).trim().slice(-500)}`);
+  }
 }
 
 // ------------------------------------------------------------------ starting, as the workflow's dispatch says
@@ -458,18 +461,54 @@ export async function startCard(board, id, { roles = ['manager'], lanes, setting
  * The heartbeat, observed: a running pane session whose last message is a whole tick old is sent `session_idle` with
  * how many times it has been asked this run and whether it worked since the last ask; the workflow decides the rest.
  */
-/** Panes whose close was asked by their own session's command (see sessionEffect), closed now. */
-function closeRequested(board, report) {
-  const rows = board.db.prepare(`SELECT id, task_id, metadata FROM task_runs WHERE metadata LIKE '%"close_requested"%' AND metadata NOT LIKE '%"closed_at"%'`).all();
+/** Reconcile durable close intent and ended runs, including old unverified closed_at records.
+ * Reads and process I/O stay outside the writer. An active successor owns its pane until it ends. */
+export function closeRequested(board, report, { taskId = null, caller = null } = {}) {
+  const rows = view(board, (db) => db.prepare(`SELECT id, task_id, ended_at, metadata FROM task_runs
+    WHERE metadata IS NOT NULL ${taskId ? 'AND task_id = ?' : ''}`).all(...(taskId ? [taskId] : [])));
+  const panes = new Map();
   for (const row of rows) {
     const session = json(row.metadata, {})?.supercode;
-    if (!session?.pane) continue;
-    try { stopSession(board, session); } catch (error) { report.undelivered.push([row.task_id, session.address, `closing it: ${String(error.message).slice(-200)}`]); continue; }
-    const address = addressOf(session);
+    if (!session?.pane || session.close_confirmed_at || (!row.ended_at && !session.close_requested)) continue;
+    if (caller && session.session_id === caller) continue; // let the command that ended its own run return
+    const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM tasks t JOIN task_runs r ON r.id = t.current_run_id`).all());
+    if (active.some((r) => {
+      const s = json(r.metadata, {})?.supercode;
+      return r.id !== row.id && s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine);
+    })) continue;
+    // Persist retries even for historical ends that did not have a close_session action.
+    tx(board, (db) => requestSessionClose(db, row.task_id, { runId: row.id }));
+    let error = null;
+    try {
+      const machine = session.machine ?? localMachine();
+      if (!panes.has(machine)) {
+        const r = sc(['teams', 'panes', 'ls', '--machine', machine], { timeout: 60_000, as: boardAddress(board.label) });
+        const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
+        panes.set(machine, Array.isArray(list) ? { live: new Set(list.map((p) => p.pane)) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
+      }
+      const observed = panes.get(machine);
+      if (observed.error) throw new Error(observed.error);
+      if (observed.live.has(session.pane)) { stopSession(board, session); observed.live.delete(session.pane); }
+    } catch (e) { error = String(e.message).slice(-500); }
     tx(board, (db) => {
-      setRunSession(db, row.id, { ...session, closed_at: now() });
-      db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ?").run(row.task_id, address);
+      const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
+      if (!current || current.pane !== session.pane) return;
+      const at = now();
+      if (error) {
+        setRunSession(db, row.id, { ...current, close_attempted_at: at, close_attempts: Number(current.close_attempts ?? 0) + 1, close_error: error });
+        // Retain every attempt's latest fact, but avoid an unbounded thread of identical failures.
+        if (current.close_error !== error) event(db, row.task_id, 'session_close_failed', { session_id: session.session_id, pane: session.pane, error, retry: true }, row.id);
+      } else {
+        const { close_error: _error, ...rest } = current;
+        setRunSession(db, row.id, { ...rest, close_error: null, closed_at: at, close_confirmed_at: at });
+        const address = addressOf(session);
+        const subscribed = active.some((r) => addressOf(json(r.metadata, {})?.supercode) === address && r.id !== row.id);
+        if (!subscribed) db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ?").run(row.task_id, address);
+        event(db, row.task_id, 'session_closed', { session_id: session.session_id, pane: session.pane, machine: session.machine }, row.id);
+      }
     });
+    if (error) report.undelivered.push([row.task_id, addressOf(session), error]);
+    else (report.closed ??= []).push({ task_id: row.task_id, ...session });
   }
 }
 
@@ -514,25 +553,9 @@ export async function sessionEffect(board, e) {
     await send(boardAddress(board.label), board.label, address, e.text, `board-actor-${e.id}-${now()}`);
     return;
   }
-  if (e.kind === 'close_session') {
-    const rows = view(board, (db) => db.prepare('SELECT id, metadata FROM task_runs WHERE task_id = ? ORDER BY id DESC').all(e.id));
-    for (const row of rows) {
-      // a run newer than the one that left the status is its successor, already started in this tick: not closed
-      if (e.runId && row.id > e.runId) continue;
-      const session = json(row.metadata, {})?.supercode;
-      if ((session?.slot ?? 'worker') !== e.slot || !session?.pane || session.closed_at) continue;
-      // the session that sent the event is not closed under its own command: the dispatcher closes it next tick
-      const caller = callerSession();
-      if (caller && caller === session.session_id) { tx(board, (db) => setRunSession(db, row.id, { ...session, close_requested: now() })); return; }
-      stopSession(board, session);
-      // a closed session hears nothing more of the card
-      const address = addressOf(session);
-      tx(board, (db) => {
-        setRunSession(db, row.id, { ...session, closed_at: now() });
-        db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ?").run(e.id, address);
-      });
-      return;
-    }
+  if (e.kind === 'close_session' || e.kind === 'run_ended') {
+    tx(board, (db) => requestSessionClose(db, e.id, e.kind === 'run_ended' ? { runId: e.runId } : { slot: e.slot, through: e.runId }));
+    // The serve tick drains the queue after the originating command has returned. Failures remain durable.
   }
 }
 
@@ -628,17 +651,36 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   // the slot's last session: kept when live, resumed when lost, never another slot's (a reviewer's is its own)
   // a close its session's own command asked for is carried out first, so its pane is gone before the slot's next
   // session starts (never two processes on one session)
+  // Every old pane in the slot must be settled, including a failed launch with no session id.
+  closeRequested(board, { undelivered: [] }, { taskId: task.id });
+  const pending = view(board, (db) => db.prepare('SELECT id, ended_at, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId))
+    .map((r) => ({ ...r, session: json(r.metadata, {})?.supercode }))
+    .find((r) => r.session?.pane && (r.session.slot ?? 'worker') === slot && (r.ended_at || r.session.close_requested) && !r.session.close_confirmed_at);
+  if (pending) throw new Error(`slot ${slot} still owns pane ${pending.session.pane} from run ${pending.id}; closure must be confirmed before another session starts: ${pending.session.close_error ?? 'close pending'}`);
   let prev = view(board, (db) => lastSession(db, task.id, slot));
   if (prev?.close_requested && !prev.closed_at) {
     const report = { undelivered: [] };
-    closeRequested(board, report);
+    closeRequested(board, report, { taskId: task.id });
     prev = view(board, (db) => lastSession(db, task.id, slot));
     // a pane that could not be closed still holds the session: no second process is started on it
     if (prev?.close_requested && !prev.closed_at) throw new Error(`the slot's session ${prev.session_id} asked to be closed and its pane ${prev.pane} could not be: ${report.undelivered.map((u) => u[2]).join('; ') || 'no reason given'}`);
   }
+  // Record the pane before waiting for the harness to name itself. A failed launch still owns a process.
+  const rememberPane = (pane, sessionId, mode) => {
+    if (!pane) return;
+    tx(board, (db) => {
+      const row = db.prepare('SELECT metadata, ended_at FROM task_runs WHERE id = ?').get(runId);
+      const before = json(row?.metadata, {})?.supercode ?? {};
+      setRunSession(db, runId, { ...before, ...meta, surface: 'pane', session_id: sessionId, harness, machine, pane, slot, mode, launched_at: now() });
+      if (row?.ended_at) requestSessionClose(db, task.id, { runId });
+    });
+  };
   let session = null;
   let replaced = null;
-  if (prev?.forgotten) replaced = { session_id: prev.session_id, why: 'the workflow let it go' };
+  if (prev?.forgotten) {
+    if (prev.pane && panePresent(prev.machine, prev.pane)) throw new Error(`forgotten session ${prev.session_id} still has live pane ${prev.pane}; close it before replacement`);
+    replaced = { session_id: prev.session_id, why: 'the workflow let it go' };
+  }
   else if (prev && (prev.harness ?? 'claude-code') !== harness) {
     // the card was reassigned to a lane of another harness: that harness starts it fresh (the card's text and thread
     // are its context), and the last session, if still open, is closed so two harnesses never work one card
@@ -647,9 +689,11 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   } else if (prev && prev.machine === machine) {
     // a session the board closed, or one whose close its own command asked for (the next tick's sweep closes that
     // run's pane), is not kept, whatever a fleet reading taken before the close still lists
-    if (!prev.closed_at && !prev.close_requested && sessionAlive(fleet, prev)) {
+    const paneLive = prev.pane ? panePresent(prev.machine, prev.pane) : false;
+    if (paneLive && (prev.closed_at || prev.close_requested || prev.forgotten)) throw new Error(`session ${prev.session_id} still has live pane ${prev.pane}; cannot resume or replace it`);
+    if (!prev.closed_at && !prev.close_requested && (prev.pane ? paneLive : sessionAlive(fleet, prev))) {
       // the session is kept; the heartbeat's count belongs to the run that ended, so the new run starts it again
-      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, close_requested: _q, closed_at: _c, ...kept } = prev;
+      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, ...kept } = prev;
       session = { ...kept, mode: 'adopt', launched_at: now(), seen_at: now() };
       // a kept session is told what this run is for (its card came back to it, with what happened since)
       if (input) deliverNow(board, addressOf(prev), input, `board-run-${task.id}-r${runId}`);
@@ -661,6 +705,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
       const its = HARNESSES[prev.harness ?? 'claude-code'] ?? HARNESSES['claude-code'];
       const r = sc(['open', '--new', its.program, ...base.slice(3), '--key', `board-${task.id}-r${runId}-resume`, '--input', told, '--', ...its.resume(prev.session_id), ...tail], { timeout: 180_000, as: boardAddress(board.label) });
       const pane = r.code === 0 ? lastJson(r.stdout)?.pane ?? null : null;
+      rememberPane(pane, prev.session_id, 'resume');
       // a resume the harness refuses (its transcript is gone) ends the pane at once; another machine's launch
       // answers before that shows, so the pane is looked for again a moment later
       if (pane && paneSurvives(task.machine, pane)) session = { surface: 'pane', session_id: prev.session_id, harness: prev.harness ?? 'claude-code', machine, pane, mode: 'resume', launched_at: now() };
@@ -680,10 +725,11 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     const r = sc([...base, '--key', launchKey, '--input', input ?? `Card ${task.id}: ${task.title}`, '--', ...(sid ? how.fresh(sid) : how.fresh()), ...tail], { timeout: 180_000, as: boardAddress(board.label) });
     if (r.code !== 0) throw new Error(`supercode open --on ${task.machine}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
     const pane = lastJson(r.stdout)?.pane ?? null;
+    rememberPane(pane, sid, 'fresh');
     const receipt=sc(['teams','rpc','launches.get',JSON.stringify({key:launchKey}),'--machine',task.machine],{timeout:30_000,as:boardAddress(board.label)});
     const facts=receipt.code===0?lastJson(receipt.stdout):null;
     if (!pane || facts?.inputDelivered===false || facts?.live===false || (!how.namesItself && !paneSurvives(task.machine,pane))) {
-      if(pane)stopSession(board,{surface:'pane',pane,machine:task.machine});
+      // The failed run's durable close queue owns its pane, even if the close door is unavailable.
       throw new Error(`${harness} launch did not become a working session: ${facts?.inputError??(!pane?'no pane returned':'pane ended or initial input was not delivered')}`);
     }
     // a harness that names its own session is found in the fleet by the pane the board opened for it
@@ -693,7 +739,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     }
     if (!sid) {
       // a pane whose session the board cannot name is closed, never left working beside the next start's
-      if (pane) stopSession(board, { surface: 'pane', pane, machine: task.machine });
+      // The run retains its pane for cleanup even though no harness session id arrived.
       throw new Error(`${harness} in pane ${pane ?? '(none)'} on ${task.machine} named no session within 90 s; the pane is closed`);
     }
     session = { surface: 'pane', session_id: sid, machine, pane, mode: 'fresh', launched_at: now(), ...(replaced ? { replaces: replaced.session_id } : {}) };
@@ -702,7 +748,12 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   session.address = `sc:${machine}:${session.harness}:${session.session_id}`;
   Object.assign(session, meta);
   const kind = { adopt: 'session_adopted', resume: 'session_resumed', fresh: replaced ? 'session_replaced' : 'session_started' }[session.mode];
-  tx(board, (db) => {
+  const recorded = tx(board, (db) => {
+    const row = db.prepare('SELECT ended_at FROM task_runs WHERE id = ?').get(runId);
+    if (row?.ended_at || getTask(db, task.id)?.current_run_id !== runId) {
+      requestSessionClose(db, task.id, { runId });
+      return false;
+    }
     setRunSession(db, runId, session);
     event(db, task.id, kind, { session_id: session.session_id, machine, pane: session.pane, address: session.address, mode: session.mode, ...(replaced ? { replaced } : {}) }, runId);
     // the working session hears updates to its card; the slot's previous session no longer does (a reviewer starting
@@ -713,16 +764,24 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     // it sees the cards its own depends on change, and works its subtasks
     for (const p of db.prepare('SELECT parent_id FROM task_links WHERE child_id = ?').all(task.id)) subscribeIn(db, p.parent_id, session.address, 'dependency');
     for (const t of db.prepare('SELECT task_id FROM supercode_cards WHERE subtask_of = ?').all(task.id)) subscribeIn(db, t.task_id, session.address, 'worker');
+    return true;
   });
+  if (!recorded) throw new Error(`run ${runId} ended while its session launched; its pane is queued for closure`);
   return session;
 }
 
-/** Whether a pane just launched on `machine` is still there after the harness had a moment to start. */
+/** A machine reading, not a missing catalog entry, establishes whether a pane is alive. */
+function panePresent(machine, pane) {
+  const r = sc(['teams', 'panes', 'ls', '--machine', machine ?? localMachine()], { timeout: 60_000 });
+  const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
+  if (!Array.isArray(panes)) throw new Error(`cannot establish pane ${pane} liveness on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
+  return panes.some((p) => p.pane === pane);
+}
+
+/** Whether a pane just launched is still there after the harness had a moment to start. */
 function paneSurvives(machine, pane) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 6000);
-  const r = sc(['teams', 'panes', 'ls', '--machine', machine], { timeout: 60_000 });
-  const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
-  return Array.isArray(panes) ? panes.some((p) => p.pane === pane) : true; // no reading: the grace decides
+  return panePresent(machine, pane);
 }
 
 /** Hermes's own worker argv and task environment, run on this machine; watched by its pid. */

package/board/engine.mjs

@@ -12,7 +12,7 @@ import { existsSync, rmSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { view, claimer, event, json, newTaskId, now, tx } from './store.mjs';
-import { refreshCardInputs, eventTo, fire, loadWorkflow, setStatus, settle, startNew, statusOf, runEvent, workflowFor } from './workflow.mjs';
+import { refreshCardInputs, requestSessionClose, eventTo, fire, loadWorkflow, setStatus, settle, startNew, statusOf, runEvent, workflowFor } from './workflow.mjs';
 
 export const STATUSES = ['triage', 'todo', 'scheduled', 'ready', 'running', 'blocked', 'review', 'done', 'archived'];
 export const WORKSPACE_KINDS = ['scratch', 'dir', 'worktree'];
@@ -77,12 +77,13 @@ export function endRun(db, taskId, { outcome, status = null, summary = null, err
   const was = one(db, 'SELECT metadata FROM task_runs WHERE id = ?', runId)?.metadata ?? null;
   const keep = metadata === undefined ? was : (metadata ? JSON.stringify(metadata) : null);
   // a run taken back (reclaim, archive, a reopened ancestor) stops its one-shot worker on this machine, as Hermes
-  // terminates a reclaimed worker (a board's one-shot workers run where the board is); a pane session is a person-visible session and is never killed from the board
+  // terminates a reclaimed worker (a board's one-shot workers run where the board is); pane sessions close through the dispatcher’s durable queue
   const worker = outcome === 'reclaimed' ? json(was, {})?.supercode : null;
   const lock = one(db, 'SELECT claim_lock FROM task_runs WHERE id = ?', runId)?.claim_lock ?? one(db, 'SELECT claim_lock FROM tasks WHERE id = ?', taskId)?.claim_lock;
   if (worker?.surface === 'headless' && worker.pid && String(lock ?? '').startsWith(`${claimer().split(':')[0]}:`)) run(db, 'INSERT INTO supercode_effects(effect) VALUES(?)', JSON.stringify({kind:'stop_run',id:taskId,runId}));
   run(db, `UPDATE task_runs SET status = ?, outcome = ?, summary = ?, error = ?, metadata = ?, ended_at = ?, claim_lock = NULL, claim_expires = NULL, worker_pid = NULL
            WHERE id = ? AND ended_at IS NULL`, status ?? outcome, outcome, summary, error, keep, now(), runId);
+  requestSessionClose(db, taskId, { runId });
   run(db, 'UPDATE tasks SET current_run_id = NULL WHERE id = ?', taskId);
   return runId;
 }
@@ -355,8 +356,9 @@ export async function runEffects(board, effects = []) {
   for (const e of [...pending.map((p) => ({ ...json(p.effect, {}), durableId: p.id })), ...effects]) {
     if (e.kind === 'cleanup_workspace') cleanupWorkspace(board, e.id);
     else if (e.kind === 'invalidate_descendants') tx(board, (db) => invalidateDescendants(db, board, e.id));
-    else if ((e.kind === 'run_ended' && e.outcome === 'reclaimed') || e.kind === 'stop_run') stopWorker(board, e.runId);
-    else if (e.kind === 'close_session' || e.kind === 'send_to_actor') {
+    else if (e.kind === 'stop_run') stopWorker(board, e.runId);
+    else if (e.kind === 'close_session' || e.kind === 'send_to_actor' || e.kind === 'run_ended') {
+      if (e.kind === 'run_ended' && e.outcome === 'reclaimed') stopWorker(board, e.runId);
       const { sessionEffect } = await import('./dispatch.mjs');
       await sessionEffect(board, e);
     }
@@ -365,7 +367,7 @@ export async function runEffects(board, effects = []) {
 }
 
 // a run taken back stops its one-shot worker on this host (Hermes's _terminate_reclaimed_worker); a pane session is
-// a person-visible session and is never killed from the board
+// stopped through its board-owned pane close queue
 function stopWorker(board, runId) {
   if (!runId) return;
   const row = view(board, (db) => one(db, 'SELECT metadata, claim_lock FROM task_runs WHERE id = ?', runId));

package/board/workflow.mjs

@@ -589,6 +589,7 @@ const ACTIONS = {
       const runId = Number(row.current_run_id);
       run(ctx.db, `UPDATE task_runs SET status = ?, outcome = ?, summary = COALESCE(?, summary), error = COALESCE(?, error), ended_at = ?, claim_lock = NULL, claim_expires = NULL, worker_pid = NULL
                WHERE id = ? AND ended_at IS NULL`, outcome, outcome, summary, error ?? ctx.scope.event?.error ?? null, t, runId);
+      requestSessionClose(ctx.db, ctx.id, { runId });
       ctx.runId = runId;
       ctx.lastOutcome = outcome;
       ctx.effects.push({ kind: 'run_ended', id: ctx.id, runId, outcome });
@@ -671,7 +672,11 @@ const ACTIONS = {
   cleanup_workspace(ctx) { ctx.effects.push({ kind: 'cleanup_workspace', id: ctx.id }); },
   stop_run(ctx) { ctx.effects.push({ kind: 'stop_run', id: ctx.id, runId: ctx.runId }); },
   // the run leaving the status is the one whose session closes, never a run started after it (a reclaim's successor)
-  close_session(ctx, slot) { ctx.effects.push({ kind: 'close_session', id: ctx.id, slot, runId: ctx.runId }); },
+  close_session(ctx, slot) {
+    const through = ctx.runId ?? one(ctx.db, 'SELECT MAX(id) AS id FROM task_runs WHERE task_id = ?', ctx.id)?.id ?? 0;
+    requestSessionClose(ctx.db, ctx.id, { slot, through });
+    ctx.effects.push({ kind: 'close_session', id: ctx.id, slot, runId: through });
+  },
   // the slot's last session is let go: its next run starts a new session (a card's context is otherwise kept: a
   // session that cannot be resumed stops the card, it is never replaced on the board's own account)
   forget_session(ctx, slot) {
@@ -707,6 +712,20 @@ const ACTIONS = {
   send_to_actor(ctx, text) { ctx.effects.push({ kind: 'send_to_actor', id: ctx.id, text }); },
 };
 
+/** Persist close intent in the same transaction as the transition; I/O can fail or never run. */
+export function requestSessionClose(db, id, { runId = null, slot = null, through = null } = {}) {
+  for (const row of all(db, 'SELECT id, metadata FROM task_runs WHERE task_id = ?', id)) {
+    if ((runId != null && row.id !== runId) || (through != null && row.id > through)) continue;
+    const whole = json(row.metadata, {}) ?? {};
+    const session = whole.supercode;
+    if (!session?.pane || session.close_confirmed_at || (slot != null && (session.slot ?? 'worker') !== slot)) continue;
+    if (session.close_requested && !session.closed_at) continue;
+    whole.supercode = { ...session, close_requested: session.close_requested ?? now() };
+    delete whole.supercode.closed_at; // older versions recorded success without checking the receipt
+    run(db, 'UPDATE task_runs SET metadata = ? WHERE id = ?', JSON.stringify(whole), row.id);
+  }
+}
+
 function runSession(ctx, change) {
   const runId = ctx.runId ?? one(ctx.db, 'SELECT current_run_id FROM tasks WHERE id = ?', ctx.id)?.current_run_id;
   if (!runId) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.4.102",
+  "version": "0.4.104",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {