@volter/supercode-orchestrator 0.4.148 → 0.4.150

package/board/cli.mjs

@@ -7,13 +7,13 @@
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { basename, join, resolve } from 'node:path';
-import { tmpdir } from 'node:os';
+import { tmpdir, userInfo } from 'node:os';
 import { read } from '../orchestration.mjs';
 import { actorOf, view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
 import { isLocalWorkspace } from './workspace.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
-import { adoptSession, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, supercodeBin, tick } from './dispatch.mjs';
+import { requestAdoption, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, supercodeBin, tick } from './dispatch.mjs';
 import { watchBoard } from './wake.mjs';
 import { completionOwnerOf, isLatestReviewer, loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
 import { evaluate } from './expr.mjs';
@@ -29,14 +29,14 @@ Hermes Kanban's verbs, with their flags:
          [--model] [--provider] [--goal|--no-goal] [--goal-max-turns] [--initial-status blocked|running]
   swarm <goal> --worker PROFILE:TITLE[:SKILL,SKILL]... --verifier P --synthesizer P
   list [--mine] [--assignee] [--status] [--tenant] [--session] [--archived] [--sort]   show <id>   context <id>   runs <id>
-  assign <id> <profile|none>   reassign <id> <profile> [--reclaim] [--reason]   set-model <id> [model] [--provider]   set-goal <id>... [--goal-max-turns N] [--off]
+  set <id> <assignee|machine|model|every> <value|none> [--provider] [--ids ...]   assign <id> <profile|none>   set-model <id> [model] [--provider]   set-goal <id>... [--goal-max-turns N] [--off]
   claim <id> [--ttl]   reclaim <id> [--reason]   heartbeat <id> [--note] [--until <time|30m>]   link|unlink <parent> <child>
   comment <id> <text> [--author] [--max-len]   attach <id> <path> [--name] [--content-type]   attachments <id>   attach-rm <n>
   complete <id>... [--result] [--summary] [--metadata JSON]   edit <id> --result [--summary] [--metadata]
   block <id> [reason] (--on <card> | --waiting-on <message id>) [--ids ...]   schedule <id> [reason] [--ids ...]
-  pause <id> --reason <why>   resume <id>   cancel <id>   set-every <id> <interval|none>
+  pause <id> --reason <why>   resume <id>   cancel <id>
   request-state <id> --state block|pause|done|cancelled --reason <why> [--on <card>|--waiting-on <message>] [--evidence <pointers>]
-  unblock <id>... [--reason]   request-review <id> --pr URL --pr-head SHA [--summary] [--reviewer] [--force]   request-changes <id> <reason>   reopen-review <id>...   reopen <id>... [--reason]
+  unblock <id>... --on <blocker> --reason <what arrived>   request-review <id> (--pr URL --pr-head SHA)... [--summary] [--reviewer] [--force]   request-changes <id> <reason> [--finding <finding>]...   reopen-review <id>...   reopen <id>... [--reason]
   promote <id> [reason] [--ids ...] [--force] [--dry-run]   archive <id>... [--rm <id>...]
   specify <id> [--title --body] [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch NAME] [--all]
   decompose <id> [--child "<title>[@<profile>]"]... [--all]
@@ -48,7 +48,7 @@ Hermes Kanban's verbs, with their flags:
 supercode's own:
   init --backing sqlite|files · boards create <slug> --backing sqlite|files
       Where the board is kept: sqlite is Hermes's kanban.db (the default); files is one JSON file per card.
-  create … --machine M --subtask-of ARC --notify ADDRESS|--no-notify --no-start [--review-only]
+  create … --machine M --subtask-of ARC --notify ADDRESS|--no-notify --no-start
       With a pane lane and room, a card starts at once and answers "started" with its session; else it answers why it
       waits, and its creator is told when it starts. A subtask is worked by its arc's session and never starts alone.
   move <id> <machine|none>   adopt <id> <session> [--assignee P] [--role ROLE]   close <id>   serve (= daemon)   list --machine M
@@ -61,10 +61,9 @@ supercode's own:
   create ... --adopt <session>  hold dispatch until that live session is attached
   goto <id> <status> [reason] [--<field> value]: the event the workflow says takes the card to that status, sent.
 
-  specify <id> --review-only|--no-review-only: a manager declares a standalone independent review job.
   specify <id> --workspace dir:<repository> --branch NAME: the manager retargets a stopped card without replacing its history.
-  request-review <id> --pr URL --pr-head SHA [--branch NAME]: hand over an open PR at its pushed head.
-  request-state <id> --state done --reviewed-sha SHA: record the verdict for the requested PR head.
+  request-review <id> (--pr URL --pr-head SHA)...: hand over every open PR the arc changed, each at its pushed head; one review covers them all.
+  request-state <id> --state done (--reviewed-sha SHA)...: record the verdict on every requested PR head.
   request-state <id>... --state STATE --reason REASON: request several decisions in one retained manager mail.
   complete <id>: creator/manager accepts the independently reviewed arc; deployment CI is not a board gate.
   specify/decompose with no spec start a session on the triage card to write it. A card's own session may comment on,
@@ -72,9 +71,9 @@ supercode's own:
   workflow declares who may block, pause or finish a card; request-state mails its manager without changing state.
 `;
 
-const MULTI = new Set(['parent', 'skill', 'worker', 'child', 'ids', 'rm']);
+const MULTI = new Set(['parent', 'skill', 'worker', 'child', 'ids', 'rm', 'pr', 'pr-head', 'reviewed-sha', 'finding']);
 const FLAGS = new Set(['json', 'triage', 'no-notify', 'no-start', 'all', 'force', 'help', 'mine', 'archived', 'reclaim', 'dry-run',
-  'goal', 'no-goal', 'review-only', 'no-review-only', 'off', 'switch', 'delete', 'no-attachments', 'include-logs', 'verbose']);
+  'goal', 'no-goal', 'off', 'switch', 'delete', 'no-attachments', 'include-logs', 'verbose']);
 // flags that take every following word up to the next flag (Hermes's nargs='+')
 const GREEDY = new Set(['ids', 'rm']);
 
@@ -180,11 +179,11 @@ async function laneState(root) {
 }
 
 /** The caller's own supercode address, when it is a session supercode can reach (for its card's notices). */
+// The calling session's own address, as its actor is named: no fleet scan (a `message list` costs seconds).
 function callerAddress() {
   const id = callerSession();
   if (!id) return null;
-  const fleet = observeFleet();
-  return [...fleet.alive].find((a) => a.endsWith(`:${id}`)) ?? null;
+  return `sc:${localMachine()}:${id === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code'}:${id}`;
 }
 
 const callerName = () => process.env.HERMES_PROFILE || process.env.USER || 'user';
@@ -207,7 +206,7 @@ const cardDict = (t) => ({
   created_by: t.created_by, created_at: t.created_at, started_at: t.started_at, completed_at: t.completed_at, result: t.result,
   skills: t.skills ?? [], max_retries: t.max_retries, model_override: t.model_override, provider_override: t.provider_override,
   session_id: t.session_id, workflow_template_id: t.workflow_template_id, current_step_key: t.current_step_key,
-  machine: t.machine ?? null, subtask_of: t.subtask_of ?? null, review_only: Boolean(t.review_only),
+  machine: t.machine ?? null, subtask_of: t.subtask_of ?? null,
 });
 
 /** Hermes's durations: seconds, or 30s / 5m / 2h / 1d. */
@@ -239,7 +238,6 @@ const metadataOf = (v) => {
 export async function runWorkflow(argv) {
   const args = parse(argv);
   const [verb, ...rest] = args._;
-  if (args['review-only'] && args['no-review-only']) throw new Error('Choose review-only or no-review-only, not both.');
   if (!verb || verb === 'help' || args.help) { process.stdout.write(HELP); return 0; }
   const root = homeOf(args);
   const slug = boardOf(root, args);
@@ -266,8 +264,8 @@ export async function runWorkflow(argv) {
     if (verb === 'comment' && isLatestReviewer(db, cardId, actorOf()) && !roles.includes('reviewer')) roles.push('reviewer');
     return roles;
   });
-  // a verb with no session behind it (a person at the CLI, the board file's sync) is the manager's, as its roles are
-  if (!sid && verb !== 'help') { try { setActor([].concat(workflowFor(root).params?.managers ?? [])[0] ?? null); } catch { /* no workflow */ } }
+  // a verb with no session behind it is recorded as the OS user's; it holds no role on any card
+  if (!sid && verb !== 'help') setActor(`user:${userInfo().username}`);
 
   switch (verb) {
     case 'migrate': {
@@ -282,7 +280,7 @@ export async function runWorkflow(argv) {
         const migrated = openZtrackBoard(preparing, { create: true, document: args.document, seed: { db: source.db, mapping }, init: layOut, root, slug, compatPath: paths.sqlite });
         migrated.close();
       } finally { source.close(); }
-      renameSync(`${preparing}.runtime.db`, `${paths.ztrack}.runtime.db`);
+      renameSync(`${preparing}.board.db`, `${paths.ztrack}.board.db`);
       renameSync(preparing, paths.ztrack);
       say(args, `Board migrated to ${args.document}; kanban.db is now a Hermes export`, { ok: true, backing: 'ztrack', document: args.document });
       return 0;
@@ -298,7 +296,6 @@ export async function runWorkflow(argv) {
 
     case 'create': {
       need(1, 'a title');
-      const { lanes, settings } = await laneState(root);
       const maxRetries = args['max-retries'] !== undefined ? Number(args['max-retries']) : null;
       if (maxRetries !== null && !(maxRetries >= 1)) throw new Error(`--max-retries must be >= 1 (got ${args['max-retries']}); use 1 to trip on the first failure`);
       const meta = boardMeta(root, slug);
@@ -310,29 +307,25 @@ export async function runWorkflow(argv) {
         workspace, branch: args.branch, parents: args.parent, priority: args.priority, tenant: args.tenant,
         triage: args.triage, idempotencyKey: args['idempotency-key'], maxRuntime: duration(args['max-runtime']),
         maxRetries, skills: args.skill, model: args.model, provider: args.provider, createdBy: args['created-by'] ?? callerName(),
-        noStart: Boolean(args['no-start']), adopt: args.adopt ?? null, reviewOnly: Boolean(args['review-only']),
+        noStart: Boolean(args['no-start']), adopt: args.adopt ?? null,
         every: args.every ?? null, sessionId: callerSession(), subtaskOf: args['subtask-of'] ?? null, initialStatus: args['initial-status'] ?? null,
         project: args.project ?? meta.project_id ?? null, goal: args.goal ? { maxTurns: args['goal-max-turns'] ? Number(args['goal-max-turns']) : null } : args['no-goal'] ? false : null,
       }), true);
       let answer = { id: created.id, existing: created.existing };
       if (args.adopt) {
         withBoard(b => { if (!rolesFor(b.db, created.id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
-        const adopted = withBoard(b => adoptSession(b, created.id, args.adopt, { ttl: settings.ttl }));
-        answer = { ...answer, started: true, session: adopted.address, mode: adopted.mode };
-      } else if (!args['no-start'] && !created.existing && !args['subtask-of']) {
-        const [report] = await tick({ root, lanes, settings, only: created.id, slugs: [slug] });
-        const started = report.started.find(([t]) => t === created.id);
-        const queued = report.queued.find(([t]) => t === created.id);
-        const failed = report.failed.find(([t]) => t === created.id);
-        answer = { ...answer, ...(started ? { started: true, session: started[1], mode: started[2] } : {}), ...(queued ? { started: false, waits: queued[1] } : {}), ...(failed ? { started: false, failed: failed[1] } : {}) };
+        withBoard(b => requestAdoption(b, created.id, args.adopt));
+        answer = { ...answer, adoption_requested: args.adopt };
       }
+      // Starting a card is the dispatcher's: this write's wake hint reaches it, and the card's
+      // thread records the start. A create never runs a dispatch tick inline.
       // the creator hears what happens from here on; a start answered above is not told twice
       const address = args['no-notify'] ? null : args.notify ?? callerAddress();
       if (address) withBoard((b) => engine.subscribe(b, created.id, address, 'creator'));
       const task = withBoard((b) => view(b, (db) => engine.getTask(db, created.id)));
       const recipients = withBoard(b => engine.subscriptions(b.db, created.id)).filter(s => s.platform === 'supercode').map(s => s.chat_id);
       if (args.json) { say(args, '', { ...cardDict(task), ...answer, notify: address ?? null, recipients }); return answer.failed ? 1 : 0; }
-      const said = answer.started ? `; started session ${answer.session} (${answer.mode})` : answer.failed ? `; did not start: ${answer.failed}` : answer.waits ? `; waits: ${answer.waits}` : '';
+      const said = answer.adoption_requested ? `; held for ${answer.adoption_requested}, which the dispatcher binds on its next tick` : answer.started ? `; started session ${answer.session} (${answer.mode})` : answer.failed ? `; did not start: ${answer.failed}` : answer.waits ? `; waits: ${answer.waits}` : '';
       say(args, `${created.existing ? 'Existing' : 'Created'} ${created.id}  (${task.status}, assignee=${task.assignee || '-'})${said}${recipients.length ? `; notices go to ${recipients.join(', ')}` : ''}`, null);
       return answer.failed ? 1 : 0;
     }
@@ -472,17 +465,18 @@ export async function runWorkflow(argv) {
       return 0;
     }
 
-    case 'assign': need(2, 'a card id and a profile (or none)'); await withBoardAsync((b) => engine.assign(b, id, rest[1] === 'none' ? null : rest[1])); say(args, `Assigned ${id} to ${rest[1] === 'none' ? '(nobody)' : rest[1]}`, { ok: true }); return 0;
-    case 'reassign': {
-      need(2, 'a card id and a profile');
-      await withBoardAsync(async (b) => {
-        const task = engine.getTask(b.db, id);
-        if (task?.current_run_id != null && args.reclaim) await engine.reclaim(b, id, args.reason ?? 'reassign');
-        await engine.assign(b, id, rest[1] === 'none' ? null : rest[1]);
-      });
-      say(args, `Reassigned ${id} to ${rest[1]}`, { ok: true }); return 0;
+    // One door sets a card's properties; the workflow's `set` rules say who may and what follows (a live run
+    // whose session must change is ended, and the dispatcher starts the next itself). `assign`/`reassign` are
+    // Hermes's names for setting the assignee, and `set-model` its name for setting the model.
+    case 'set': {
+      need(3, 'a card id, a property (assignee, machine, model or every) and its value (or none)');
+      const value = rest[2] === 'none' ? null : rest[2];
+      const cards = ids([id]);
+      for (const t of cards) await withBoardAsync((b) => engine.set(b, t, rest[1], value, { provider: args.provider ?? null }));
+      say(args, cards.map((t) => `${t}: ${rest[1]} ${value ?? '(none)'}`).join('\n'), { ok: true }); return 0;
     }
-    case 'set-model': need(1, 'a card id'); await withBoardAsync((b) => engine.setModel(b, id, rest[1] ?? null, args.provider ?? null)); say(args, rest[1] ? `${id} runs on model ${rest[1]}${args.provider ? ` (${args.provider})` : ''} from its next start` : `${id} uses its profile's model`, { ok: true }); return 0;
+    case 'set-model': need(1, 'a card id'); await withBoardAsync((b) => engine.set(b, id, 'model', rest[1] ?? null, { provider: args.provider ?? null })); say(args, rest[1] ? `${id} runs on model ${rest[1]}${args.provider ? ` (${args.provider})` : ''} from its next start` : `${id} uses its profile's model`, { ok: true }); return 0;
+    case 'assign': case 'reassign': need(2, 'a card id and a profile (or none)'); await withBoardAsync((b) => engine.set(b, id, 'assignee', rest[1] === 'none' ? null : rest[1])); say(args, `Assigned ${id} to ${rest[1] === 'none' ? '(nobody)' : rest[1]}`, { ok: true }); return 0;
     case 'set-goal': {
       // a card into goal mode (or out of it with --off) from its next idle turn: the heartbeat keeps its session going
       need(1, 'a card id');
@@ -491,7 +485,6 @@ export async function runWorkflow(argv) {
       for (const t of ids()) await withBoardAsync((b) => engine.setGoal(b, t, { on: !args.off, maxTurns }));
       say(args, ids().map((t) => args.off ? `${t} is no longer a goal card` : `${t} is a goal card${maxTurns ? ` (${maxTurns} turns)` : ''}`).join('\n'), { ok: true }); return 0;
     }
-    case 'move': need(2, 'a card id and a machine (or none)'); await withBoardAsync((b) => engine.setMachine(b, id, rest[1] === 'none' ? null : rest[1])); say(args, `${id} runs on ${rest[1]}`, { ok: true }); return 0;
 
     case 'claim': {
       need(1, 'a card id');
@@ -552,7 +545,7 @@ export async function runWorkflow(argv) {
     case 'complete': {
       need(1, 'a card id');
       const metadata = metadataOf(args.metadata);
-      for (const t of rest) await withBoardAsync((b) => engine.complete(b, t, { summary: args.summary ?? null, result: args.result ?? null, metadata: metadata ?? null, commit: args.commit ?? null, ci_run: args['ci-run'] ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args['pr-head'] ?? null, reviewed_sha: args['reviewed-sha'] ?? null }));
+      for (const t of rest) await withBoardAsync((b) => engine.complete(b, t, { summary: args.summary ?? null, result: args.result ?? null, metadata: metadata ?? null, commit: args.commit ?? null, ci_run: args['ci-run'] ?? null, pr: args.pr ?? null, pr_head: args['pr-head'] ?? null, reviewed_sha: args['reviewed-sha'] ?? null }));
       say(args, rest.map((t) => `Completed ${t}`).join('\n'), { ok: true, completed: rest }); return 0;
     }
     case 'edit': {
@@ -577,13 +570,21 @@ export async function runWorkflow(argv) {
     case 'unblock': {
       need(1, 'a card id');
       const results = [];
-      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.unblock(b, t, { reason: args.reason ?? null, on: args.on ?? null }))).to]);
+      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.unblock(b, t, { reason: args.reason ?? null, on: args.on ?? args['waiting-on'] ?? null }))).to]);
       // Hermes records the reason as a comment on each card it unblocks
       if (args.reason) for (const [t] of results) await withBoardAsync((b) => engine.comment(b, t, callerName(), `UNBLOCK: ${args.reason}`));
       say(args, results.map(([t, s]) => `Unblocked ${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
     }
     case 'request-review': need(1, 'a card id'); await withBoardAsync((b) => engine.requestReview(b, id, { summary: args.summary ?? null, reviewer: args.reviewer ?? null, metadata: metadataOf(args.metadata) ?? null, commit: args.commit ?? null, ci_run: args['ci-run'] ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args['pr-head'] ?? args.head ?? args.commit ?? null, force: Boolean(args.force), expectedRunId: workerRun(b.db, id, sid) })); say(args, `${id} → review`, { ok: true }); return 0;
-    case 'request-changes': need(2, 'a card id and the reason'); await withBoardAsync((b) => engine.requestChanges(b, id, { reason: rest.slice(1).join(' '), reviewer: args.reviewer ?? null })); say(args, `${id} sent back for changes`, { ok: true }); return 0;
+    case 'request-changes': {
+      need(2, 'a card id and the reason');
+      // each finding is filed as a task on the arc first, so the arc stays open until a pushed head fixes it
+      const findings = [].concat(args.finding ?? []).map((f) => String(f).trim()).filter(Boolean);
+      const filed = [];
+      for (const finding of findings) filed.push((await withBoardAsync((b) => engine.createCard(b, { title: finding, subtaskOf: id }))).id);
+      await withBoardAsync((b) => engine.requestChanges(b, id, { reason: rest.slice(1).join(' '), reviewer: args.reviewer ?? null }));
+      say(args, `${id} sent back for changes${filed.length ? `; findings filed as ${filed.join(', ')}` : ''}`, { ok: true, findings: filed }); return 0;
+    }
     case 'reopen': {
       // a done card back to work; the cards that built on it are invalidated with it (Hermes's reopen)
       need(1, 'a card id');
@@ -637,8 +638,8 @@ export async function runWorkflow(argv) {
       if (!targets[0]) throw new Error(`${verb} needs a card id, or --all`);
       const results = [];
       for (const t of targets) {
-        if (verb === 'specify' && (args.title !== undefined || args.body !== undefined || args.workspace !== undefined || args.branch !== undefined || args['review-only'] || args['no-review-only'])) {
-          const moved = await withBoardAsync((b) => engine.specify(b, t, { title: args.title ?? null, body: args.body ?? null, workspace: args.workspace ?? null, branch: args.branch ?? null, reviewOnly: args['review-only'] ? true : args['no-review-only'] ? false : null, author: args.author ?? callerAddress() ?? callerName() }));
+        if (verb === 'specify' && (args.title !== undefined || args.body !== undefined || args.workspace !== undefined || args.branch !== undefined)) {
+          const moved = await withBoardAsync((b) => engine.specify(b, t, { title: args.title ?? null, body: args.body ?? null, workspace: args.workspace ?? null, branch: args.branch ?? null, author: args.author ?? callerAddress() ?? callerName() }));
           results.push({ id: t, specified: true, status: moved.to });
         } else if (verb === 'decompose' && args.child?.length) {
           const children = args.child.map((c) => { const [title, assignee] = c.split(/@(?=[^@]*$)/); return { title: title.trim(), assignee: assignee?.trim() || undefined }; });
@@ -811,11 +812,6 @@ export async function runWorkflow(argv) {
       return report.status === 'corrupt' ? 1 : 0;
     }
 
-    case 'set-every': {
-      need(1, 'a card id');
-      await withBoardAsync((b) => engine.act(b, id, 'set_every', { payload: { every: rest[1] === 'none' ? null : rest[1] } }));
-      say(args, `${id} recurrence updated`, { ok: true }); return 0;
-    }
     case 'cancel': {
       need(1, 'a card id');
       await withBoardAsync((b) => engine.act(b, id, 'cancel', { payload: { reason: args.reason ?? rest.slice(1).join(' ') } }));
@@ -850,9 +846,8 @@ export async function runWorkflow(argv) {
     case 'adopt': {
       need(2, 'a card id and a session');
       withBoard(b => { if (!rolesFor(b.db, id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
-      const { settings } = await laneState(root);
-      const got = withBoard((b) => adoptSession(b, id, rest[1], { workspace: args.workspace ?? null, ttl: settings.ttl, assignee: args.assignee ?? null, role: args.role ?? null }));
-      say(args, `${id} is worked by ${got.address} (pane ${got.pane ?? '?'} in ${got.workspace ?? 'its card\'s directory'})`, { ok: true, ...got });
+      withBoard((b) => requestAdoption(b, id, rest[1], { workspace: args.workspace ?? null, assignee: args.assignee ?? null, role: args.role ?? null }));
+      say(args, `${id} is held for ${rest[1]}; the dispatcher verifies and binds it on its next tick (session_adopted, or adoption_failed with the reason)`, { ok: true, requested: rest[1] });
       return 0;
     }
     case 'goto': {
@@ -1099,12 +1094,12 @@ function ownCard(db, sessionId) {
 const READS = new Set(['list', 'ls', 'show', 'context', 'runs', 'log', 'tail', 'watch', 'stats', 'assignees', 'diagnostics', 'diag', 'attachments', 'notify-list', 'help', 'init']);
 
 /**
- * Who a caller is on card `cardId`, in the workflow's roles: a person or the fleet's manager at the CLI (no session)
- * is `manager`; the session of the card's current run has that run's role; the card's working session between runs
+ * Who a caller is on card `cardId`, in the workflow's roles: a caller with no session behind it has no role (the
+ * manager acts from its own session, named in params.managers); the session of the card's current run has that run's role; the card's working session between runs
  * is its `implementer`; the session working a subtask's arc is `arc`; its recorded creator also has the creator role; any other session is nobody on it.
  */
 function rolesFor(db, cardId, sessionId, params = {}) {
-  if (!sessionId) return ['manager', 'owner'];
+  if (!sessionId) return [];
   // a session the workflow names as the board's manager (params.managers: its addresses) is the manager on every card
   const managers = Array.isArray(params.managers) ? params.managers.map(String) : [];
   if (managers.some((m) => m === sessionId || m.endsWith(`:${sessionId}`))) return ['manager'];
@@ -1133,7 +1128,7 @@ function authorize(db, verb, rest, args, own) {
   if (verb === 'boards') { if (!['list', 'ls', 'show', 'current', undefined].includes(rest[0])) refuse('does not change the home\'s boards'); return; }
   // verbs that act on the board rather than on a card are the manager's and the board's, never a card's session's
   // (what a session may do to a card is its workflow's: each transition's `by`)
-  if ((['pause', 'resume'].includes(verb) && !rest[0]) || ['swarm', 'dispatch', 'daemon', 'serve', 'gc', 'repair', 'adopt', 'close', 'move', 'claim', 'attach-rm', 'migrate'].includes(verb)) refuse(`does not ${verb}; the fleet's manager does`);
+  if ((['pause', 'resume'].includes(verb) && !rest[0]) || ['swarm', 'dispatch', 'daemon', 'serve', 'gc', 'repair', 'adopt', 'close', 'set', 'claim', 'attach-rm', 'migrate'].includes(verb)) refuse(`does not ${verb}; the fleet's manager does`);
   if (args.all) refuse(`does not ${verb} every card; only its own`);
   if (['notify-subscribe', 'notify-unsubscribe'].includes(verb) && args['for-card']) {
     if (args['for-card'] !== own.id) refuse(`subscribes only its own arc (--for-card ${own.id})`);
@@ -1211,18 +1206,30 @@ async function serve(root, args = {}) {
       // An installer owns this operational window, not a card pause. Finish the
       // current tick, acknowledge the request, then leave every run untouched.
       // A replacement serve sees the same request before its first tick.
+      // A request whose installer is gone (its pane closed, or it was killed before clearing it) is void.
       const installation = join(root, 'installation-window.json');
-      if (existsSync(installation)) {
-        const request = JSON.parse(readFileSync(installation, 'utf8'));
+      const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
+      const request = existsSync(installation) ? readJson(installation) : null;
+      const installerAlive = (pid) => { try { process.kill(Number(pid), 0); return true; } catch (error) { return error.code === 'EPERM'; } };
+      if (request?.token && request.pid && !installerAlive(request.pid)) {
+        log(`installation window ${request.token} of ${request.owner} is void: its installer ${request.pid} is gone`);
+        for (const path of [installation, join(root, 'installation-window.ack.json')]) if (readJson(path)?.token === request.token) try { unlinkSync(path); } catch { /* gone */ }
+      } else if (request?.token) {
         const acknowledgment = join(root, 'installation-window.ack.json');
-        const previous = existsSync(acknowledgment) ? JSON.parse(readFileSync(acknowledgment, 'utf8')) : null;
+        const previous = readJson(acknowledgment);
         if (previous?.token !== request.token || previous?.pid !== process.pid) {
-          writeFileSync(acknowledgment, JSON.stringify({ token: request.token, pid: process.pid, at: Date.now() }));
+          const temporary = `${acknowledgment}.${process.pid}`;
+          writeFileSync(temporary, JSON.stringify({ token: request.token, pid: process.pid, at: Date.now() }));
+          renameSync(temporary, acknowledgment);
           log(`installation window held by ${request.owner}; dispatch waits`);
         }
         await new Promise(resolve => setTimeout(resolve, 250));
         continue;
       }
+      // A serve never ticks on code older than the installed orchestrator, also right after an
+      // installation window: its keeper starts the new one, whose board store this one does not keep.
+      const replaced = (() => { const now = installed(); return running && now && now !== running ? now : null; })();
+      if (replaced) { log(`orchestrator ${replaced} is installed (this serve runs ${running}); stopping, for its keeper to start the new one`); break; }
       pausedSaid = Boolean(paused(root)) && pausedSaid;
       let interval = 60;
       let nextMailAt = Infinity;