@volter/supercode-orchestrator 0.4.148 → 0.4.150

package/board/dispatch.mjs

@@ -15,17 +15,17 @@
 // Every side effect follows a committed transition: a card is claimed before its session is launched, and a
 // subscriber's cursor moves only after its notice was delivered, so two dispatchers over one board never both
 // launch and a crash between the two steps is answered by the next tick.
-import { inspectCompletionEvidence, openReviewPullRequest, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
+import { inspectCompletionEvidence, openReviewPullRequests, reviewDue, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { createRequire } from 'node:module';
 import { spawn as spawnChild, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
-import { hostname, tmpdir } from 'node:os';
+import { hostname, tmpdir, totalmem } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { view, boardPath, claimer, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
 import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, templateValue, workflowFor } from './workflow.mjs';
-import { checkWorkspace, assertWorkspaceOwner, resolveWorkspace } from './workspace.mjs';
+import { checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace } from './workspace.mjs';
 import { evaluate, holds, render } from './expr.mjs';
 import { identifyNotice } from './notices.mjs';
 import { pendingRequestMail } from './request-mail.mjs';
@@ -123,6 +123,8 @@ export function observeFleet() {
   const presence = machines.code === 0 ? lastJson(machines.stdout) : null;
   const online = new Set([localMachine()]);
   for (const m of presence?.items ?? []) if (m.linked) online.add(normalMachine(m.name));
+  presenceReading = { known: presence?.connected === true, online };
+  notePresence(presenceReading);
   return { ok: true, sessions, alive: new Set(sessions.map((s) => s.address).filter(Boolean)), online,
     presenceKnown: presence?.connected === true, machineEvents: presence,
     error: presence?.connected ? null : 'machine event stream unavailable; retaining existing runs until availability is known' };
@@ -143,6 +145,7 @@ const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ?
 
 /** Native activity comes from the machine's harness discovery, not catalogue age. */
 function nativeSessions(machine, harness) {
+  if (offlineMachine(machine)) throw unavailable(`native liveness unavailable: machine ${normalMachine(machine)} is offline`);
   const result = sc(['discover', '--on', machine, '--harness', harness, '--limit', '2000'], { timeout: 120_000 });
   const page = result.code === 0 ? lastJson(result.stdout) : null;
   if (!Array.isArray(page?.sessions)) throw unavailable(`native liveness unavailable on ${machine}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
@@ -173,13 +176,12 @@ function pidAlive(pid) {
 
 /**
  * Hermes's default for kanban.max_in_progress when none is set: one worker per 512 MiB of the host's memory, between
- * two and eight, from /proc/meminfo; none where that cannot be read (which caps nothing).
+ * two and eight. The memory is the host's own reading (os.totalmem: /proc/meminfo on Linux, hw.memsize on macOS), so
+ * the cap holds on every host, not only where /proc exists.
  */
 function derivedMaxInProgress() {
-  try {
-    const total = Number(/^MemTotal:\s+(\d+)/m.exec(readFileSync('/proc/meminfo', 'utf8'))?.[1]);
-    return Number.isFinite(total) && total > 0 ? Math.max(2, Math.min(Math.floor(total / 1024 / 512), 8)) : null;
-  } catch { return null; }
+  const total = totalmem();
+  return Number.isFinite(total) && total > 0 ? Math.max(2, Math.min(Math.floor(total / 1024 / 1024 / 512), 8)) : null;
 }
 
 /**
@@ -219,6 +221,17 @@ export function lanesOf(profiles = {}) {
 }
 
 const onMachine = machine => normalMachine(machine ?? localMachine()) === localMachine() ? [] : ['--machine', machine];
+// The latest presence reading (observeFleet). A machine it reads as offline is not asked: each remote call would
+// wait out its timeout, and one offline machine held every close and launch on this one.
+let presenceReading = null;
+const offlineMachine = (machine) => {
+  const m = normalMachine(machine ?? localMachine());
+  return m !== localMachine() && presenceReading?.known === true && !presenceReading.online.has(m);
+};
+/** `supercode <args>` for `machine`: on another machine through its Teams server, answered at once when it is offline. */
+const scOn = (machine, args, options) => offlineMachine(machine)
+  ? { code: 1, stdout: '', stderr: `machine ${normalMachine(machine)} is offline` }
+  : sc([...args, ...onMachine(machine)], options);
 const unavailable = message => Object.assign(new Error(message), { launchDeferred: true });
 
 // ------------------------------------------------------------------ supervise
@@ -242,7 +255,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
   for (const { id } of rows) {
     const s = currentRun(board.db, id)?.metadata?.supercode;
     if (!s?.pane || observed.has(s.machine)) continue;
-    const r = sc(['teams', 'panes', 'ls', ...onMachine(s.machine)], { timeout: 60_000 });
+    const r = scOn(s.machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
     const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
     observed.set(s.machine, Array.isArray(list) ? new Set(list.filter(p => !p.dead).map((p) => p.pane)) : null);
     if (!Array.isArray(list)) report.failed.push([id, `pane liveness unavailable; retaining run: ${(r.stderr || r.stdout).trim().slice(-200)}`]);
@@ -333,13 +346,13 @@ function supervise(board, fleet, settings, report, entry, effects) {
         return;
       }
       // a run past its runtime limit (the status's `run.limits.runtime`), as Hermes times its workers out
-      if (limits.runtime && runRow && session?.wait_started_at == null && runWorkingSeconds(runRow, t) > Number(limits.runtime)) {
+      if (limits.runtime && runRow && runWorkingSeconds(runRow, t) > Number(limits.runtime)) {
         observe('timed_out', { limit_seconds: limits.runtime, error: `ran past max_runtime ${limits.runtime}s` }, 'timed_out');
         return;
       }
       if (session?.surface === 'headless') {
         // Hermes's stale check: a worker running past the limit with no heartbeat in the last hour is stopped
-        if (limits.stale && runRow && session?.wait_started_at == null && runWorkingSeconds(runRow, t) >= Number(limits.stale) && !(task.last_heartbeat_at && t - Number(task.last_heartbeat_at) < 3600)) {
+        if (limits.stale && runRow && runWorkingSeconds(runRow, t) >= Number(limits.stale) && !(task.last_heartbeat_at && t - Number(task.last_heartbeat_at) < 3600)) {
           observe('stale', { timeout_seconds: limits.stale, pid: session.pid, error: `no heartbeat after ${t - Number(runRow.started_at)}s running` }, 'reclaimed');
           return;
         }
@@ -357,7 +370,17 @@ function supervise(board, fleet, settings, report, entry, effects) {
       if (session?.session_id) {
         if(exits.has(id)) {
           const exit=exits.get(id);
-          observe('exited',{code:exit.failed?1:0,error:`native session ${session.session_id} ended: ${exit.how}`,session_id:session.session_id,pane:session.pane},'crashed');
+          // an interactive session that ended cleanly was closed (by a person, or by itself): the workflow says what
+          // follows, and it is not a crash to restart
+          const ended = { code: exit.failed ? 1 : 0, error: `native session ${session.session_id} ended: ${exit.how}`, session_id: session.session_id, pane: session.pane };
+          if (!exit.failed) {
+            try {
+              const r = fire(db, board, entry, id, 'session_closed', { roles: ['platform'], payload: ended });
+              effects.push(...r.effects); (report.closed_by_hand ??= []).push(id);
+              return;
+            } catch (error) { if (!error.noTransition) { report.failed.push([id, `session_closed: ${String(error.message).slice(-200)}`]); return; } }
+          }
+          observe('exited', ended, 'crashed');
           return;
         }
         if (session.pane && paneLive === null) return; // no machine reading, no loss verdict
@@ -413,6 +436,7 @@ function stopSession(board, session) {
     if (pidAlive(session.pid)) signal('SIGKILL');
     return;
   }
+  if (session.surface !== 'headless' && offlineMachine(session.machine)) throw new Error(`close deferred: machine ${normalMachine(session.machine)} is offline`);
   if (!session.pane && session.surface === 'native') {
     const r = sc(['close', addressOf(session)], { timeout: 120_000, as: boardAddress(board.label) });
     if (r.code !== 0) throw new Error(`closing native session ${addressOf(session)}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
@@ -527,7 +551,8 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
     if (why) { note(task.id, why); report.queued.push([task.id, why]); continue; }
     if (dry) {
       report.would.push({ id: task.id, status: plan.target, role: plan.runSpec?.role ?? null, assignee: plan.profile, machine: task.machine ?? null, surface: plan.lane.surface });
-      for (const l of limits) if (holds(l.counts, scope)) { const g = JSON.stringify(evaluate(l.group, scope)); l.tally.set(g, (l.tally.get(g) ?? 0) + 1); }
+      // a card this tick starts counts toward its groups (its scope was read before the start, with no run yet)
+      for (const l of limits) { const g = JSON.stringify(evaluate(l.group, scope)); l.tally.set(g, (l.tally.get(g) ?? 0) + 1); }
       continue;
     }
     let moved, checked;
@@ -549,7 +574,7 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
       continue;
     }
     effects.push(...moved.effects);
-    for (const l of limits) if (holds(l.counts, cardScope.get(task.id) ?? scope)) { const g = JSON.stringify(evaluate(l.group, scope)); l.tally.set(g, (l.tally.get(g) ?? 0) + 1); }
+    for (const l of limits) { const g = JSON.stringify(evaluate(l.group, scope)); l.tally.set(g, (l.tally.get(g) ?? 0) + 1); }
     try {
       const session = launchRun(board, entry, task.id, plan.lane, fleet, settings);
       if (session) {
@@ -690,20 +715,17 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         if (reading.alive) {
           const protectedNow = active.some(r => addressOf(json(r.metadata, {})?.supercode) === addressOf(session));
           if (protectedNow) throw new Error('close deferred: native session is owned by an unended run');
-          if (session.lifecycle_notice_pending) throw new Error(`close deferred: lifecycle notice ${session.lifecycle_notice_pending} has not been delivered`);
           stopSession(board, session);
         }
       } else {
       if (!panes.has(machine)) {
-        const r = sc(['teams', 'panes', 'ls', ...onMachine(machine)], { timeout: 60_000, as: boardAddress(board.label) });
+        const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000, as: boardAddress(board.label) });
         const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
         panes.set(machine, Array.isArray(list) ? { live: new Set(list.filter(p => !p.dead).map((p) => p.pane)) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
       }
       const observed = panes.get(machine);
       if (observed.error) throw new Error(observed.error);
       if (observed.live.has(session.pane)) {
-        const pendingNotice = view(board, (db) => db.prepare("SELECT id FROM supercode_effects WHERE json_extract(effect, '$.kind')='session_notice' AND json_extract(effect, '$.runId')=? LIMIT 1").get(row.id));
-        if (pendingNotice || session.lifecycle_notice_pending) throw new Error(`close deferred: lifecycle notice ${pendingNotice?.id ?? session.lifecycle_notice_pending} has not been delivered: ${session.lifecycle_notice_error ?? 'pending'}`);
         const protectedNow = view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all())
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); });
         if (protectedNow) throw new Error(`close deferred: pane ${session.pane} is owned by an unended run`);
@@ -744,7 +766,6 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
       if (!(entry.workflow.statuses[status]?.on?.session_idle || entry.workflow.on?.session_idle || entry.workflow.run?.on?.session_idle)) return;
       const runRow = currentRun(db, id);
       const session = runRow?.metadata?.supercode;
-      if (session?.wait_started_at != null) return;
       if (!session?.session_id || !['pane', 'native'].includes(session.surface) || session.offline_since != null) return;
       if (session.surface === 'native' && fleet.native?.get(addressOf(session))?.alive !== true) return;
       const live = fleet.sessions.find((x) => x.address === addressOf(session));
@@ -801,9 +822,10 @@ export async function sessionNotice(board, e) {
   const prior = view(board, (db) => json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(e.runId)?.metadata, {})?.supercode);
   if (prior?.close_confirmed_at) {
     tx(board, (db) => {
+      // A closed session has nothing to be told; its next run starts with its own prompt.
       const unissued = unissuedLaunch(prior.launch_cancellation, prior);
-      event(db, e.id, unissued ? 'session_notice_not_required' : 'session_notice_failed', { address: e.address, verb: e.verb, notice: e.durableId,
-        error: unissued ? 'machine confirmed launch was not issued; no session exists to notify' : 'session closure already confirmed; notice cannot be delivered', retry: false,
+      event(db, e.id, 'session_notice_not_required', { address: e.address, verb: e.verb, notice: e.durableId,
+        reason: unissued ? 'machine confirmed launch was not issued; no session exists to notify' : 'session closed',
         ...(unissued ? { receipt: prior.launch_cancellation } : {}) }, e.runId);
       if (prior.lifecycle_notice_pending === e.durableId) setRunSession(db, e.runId, { lifecycle_notice_pending: null });
     });
@@ -814,13 +836,16 @@ export async function sessionNotice(board, e) {
   try {
     if (!e.address) throw new Error('lifecycle notice awaits the owned launch session identity');
     receipt = await send(boardAddress(board.label), board.label, e.address, e.text, effectMessageKey(e));
-    if (!receipt.delivered) error = receipt.reason ?? 'notice queued; native transcript confirmation pending'; }
+    // A notice filed in the session's mailbox is done: the session reads its mail at its next
+    // turn, and a resumed session first. Only a notice no mailbox took is retried.
+    if (!receipt.delivered && !receipt.queued) error = receipt.reason ?? 'notice was not filed'; }
   catch (failure) { error = String(failure.message).slice(-500); }
   tx(board, (db) => {
     const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(e.runId)?.metadata, {})?.supercode;
     if (session) setRunSession(db, e.runId, { ...session,
-      ...(error ? { lifecycle_notice_error: error } : { lifecycle_notice_error: null, ...(session.lifecycle_notice_pending === e.durableId ? { lifecycle_notice_pending: null } : {}) }) });
-    if (!error || session?.lifecycle_notice_error !== error) event(db, e.id, error ? (receipt?.queued ? 'session_notice_queued' : 'session_notice_failed') : 'session_notice_delivered', { address: e.address, verb: e.verb, source_event: e.sourceEvent, notice: e.durableId, receipt, ...(error ? { error, retry: true } : {}) }, e.runId);
+      ...(error ? { lifecycle_notice_error: error }
+        : { lifecycle_notice_error: null, ...(session.lifecycle_notice_pending === e.durableId ? { lifecycle_notice_pending: null } : {}) }) });
+    if (!error || session?.lifecycle_notice_error !== error) event(db, e.id, error ? 'session_notice_failed' : receipt?.delivered ? 'session_notice_delivered' : 'session_notice_queued', { address: e.address, verb: e.verb, source_event: e.sourceEvent, notice: e.durableId, receipt, ...(error ? { error, retry: true } : {}) }, e.runId);
   });
   return !error;
 }
@@ -830,10 +855,6 @@ export async function sessionEffect(board, e) {
   if (e.kind === 'send_to_actor') {
     const row = view(board, db => e.runId ? db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(e.runId) : null);
     const session = json(row?.metadata, {})?.supercode;
-    if (session?.wait_started_at != null) {
-      tx(board, db => event(db, e.id, 'actor_notice_suppressed', { notice: e.durableId, reason: 'run is waiting', run_id: e.runId }, e.runId));
-      return true;
-    }
     const address = addressOf(session);
     let receipt;
     try {
@@ -894,8 +915,16 @@ const BLOCKER = /\b(quota|rate[\s_-]?limit|429|403|auth\w*|unauthorized|forbidde
 const PR_URL = /https?:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/\d+/i;
 
 
-/** This machine's memory pressure as Hermes reads it (Linux's MemAvailable; `unknown` elsewhere, which restricts nothing). */
+/**
+ * This machine's memory pressure: on Linux as Hermes reads it (MemAvailable); on macOS the kernel's own level
+ * (kern.memorystatus_vm_pressure_level: 1 normal, 2 warning, 4 critical); `unknown` elsewhere, which restricts nothing.
+ */
 function memoryPressure() {
+  if (process.platform === 'darwin') {
+    const r = spawnSync('sysctl', ['-n', 'kern.memorystatus_vm_pressure_level'], { encoding: 'utf8', timeout: 5_000 });
+    const level = Number(String(r.stdout ?? '').trim());
+    return level >= 4 ? 'critical' : level >= 2 ? 'elevated' : level === 1 ? 'ok' : 'unknown';
+  }
   try {
     const info = Object.fromEntries(readFileSync('/proc/meminfo', 'utf8').split('\n').map((l) => /^(\w+):\s+(\d+)/.exec(l)).filter(Boolean).map((m) => [m[1], Number(m[2])]));
     const avail = info.MemAvailable;
@@ -933,7 +962,7 @@ const getTaskNow = (board, id) => view(board, (db) => getTask(db, id));
 
 /** A transport error is not a negative launch receipt. The key remains owned by its run. */
 function launchReceipt(board, session) {
-  const r = sc(['teams', 'launches', 'get', session.launch_key, ...onMachine(session.machine)],
+  const r = scOn(session.machine, ['teams', 'launches', 'get', session.launch_key],
     { timeout: 30_000, as: boardAddress(board.label) });
   if (r.code !== 0) throw unavailable(`launch receipt unavailable on ${session.machine}: install the matching Teams CLI and machine capability (teams launches get): ${(r.stderr || r.stdout).trim().slice(-300)}`);
   if (r.stdout.trim() === 'null') return null;
@@ -943,7 +972,7 @@ function launchReceipt(board, session) {
 }
 
 function cancelUnissuedLaunch(board, session) {
-  const result = sc(['teams', 'launches', 'cancel', session.launch_key, ...onMachine(session.machine)],
+  const result = scOn(session.machine, ['teams', 'launches', 'cancel', session.launch_key],
     { timeout: 30_000, as: boardAddress(board.label) });
   if (result.code !== 0) throw unavailable(`launch cancellation unavailable on ${session.machine}; retain ${session.launch_key}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
   const receipt = lastJson(result.stdout);
@@ -1078,6 +1107,10 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
 
 function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'worker', meta = {} } = {}) {
   const machine = normalMachine(task.machine);
+  // Whether a board session opens a terminal window on its machine is the workflow's choice, stated on every launch;
+  // no machine default decides it.
+  const window = workflowFor(board.root).params.session_window;
+  if (typeof window !== 'boolean') throw unavailable('the workflow declares no params.session_window (true or false): whether a board session opens a window on its machine is the workflow\'s choice');
   {
     const made = resolveLocalWorkspace(board, task);
     tx(board, (db) => {
@@ -1090,7 +1123,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   if (lane.harness === 'codex' && lane.reasoning_effort) tail.push('-c', `model_reasoning_effort=${JSON.stringify(lane.reasoning_effort)}`);
   const harness = HARNESSES[lane.harness] ? lane.harness : 'claude-code';
   const how = HARNESSES[harness];
-  const base = ['open', '--new', how.program, '--detach', '--on', task.machine, '--cwd', task.workspace_path];
+  const base = ['open', '--new', how.program, '--detach', `--window=${window}`, '--on', task.machine, '--cwd', task.workspace_path];
   // the slot's last session: kept when live, resumed when lost, never another slot's (a reviewer's is its own)
   // a close its session's own command asked for is carried out first, so its pane is gone before the slot's next
   // session starts (never two processes on one session)
@@ -1104,7 +1137,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   if (prev?.session_id && !prev.forgotten && (prev.harness ?? 'claude-code') === harness && prev.machine === machine) {
     const fresh = observeFleet();
     if (!fresh.ok) throw unavailable(`cannot check for a manual continuation of ${prev.session_id}: ${fresh.error}`);
-    const r = sc(['teams', 'panes', 'ls', ...onMachine(machine)], { timeout: 60_000 });
+    const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
     const listed = r.code === 0 ? json(r.stdout.trim(), null) : null;
     if (!Array.isArray(listed)) throw unavailable(`cannot read panes before continuing ${prev.session_id}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
     const pane = continuationPane(fresh, prev, new Set(listed.filter(p => !p.dead).map((p) => p.pane)));
@@ -1237,7 +1270,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
 
 /** A machine reading, not a missing catalog entry, establishes whether a pane is alive. */
 function panePresent(machine, pane) {
-  const r = sc(['teams', 'panes', 'ls', ...onMachine(machine)], { timeout: 60_000 });
+  const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
   const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
   if (!Array.isArray(panes)) throw unavailable(`cannot establish pane ${pane} liveness on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
   return panes.some((p) => p.pane === pane && !p.dead);
@@ -1314,14 +1347,39 @@ function resolveLocalWorkspace(board, task) {
  * never as the session describes itself. From then on the board watches it, resumes it when lost, and tells it of
  * its card. `who` is an address, a session id, or a `name@machine` the fleet lists.
  */
-export function adoptSession(board, id, who, { workspace = null, ttl, assignee = null, role = null } = {}) {
-  // Hold before discovery or any other process I/O: a failed attachment remains
-  // visible and cannot race a dispatcher into launching a replacement worker.
+/**
+ * The manager asks the board to adopt session `who` for card `id`: the card is held at once (no replacement can be
+ * launched), and the dispatcher's next tick verifies the session from the fleet reading it already takes and binds
+ * it (`completeAdoptions`). The verb does no process I/O, so it answers as fast as any board write.
+ */
+export function requestAdoption(board, id, who, { workspace = null, assignee = null, role = null } = {}) {
+  if (!who) throw new Error('name the session to adopt');
   tx(board, db => {
     if (!getTask(db, id)) throw new Error(`no card ${id}`);
-    event(db, id, 'dispatch_held', { session: who, reason: 'adoption requested' });
+    event(db, id, 'dispatch_held', { session: who, reason: 'adoption requested', workspace, assignee, role });
   });
-  const fleet = observeFleet();
+}
+
+/** Adoptions the manager requested and no tick has answered yet, completed from this tick's fleet reading. */
+export function completeAdoptions(board, fleet, settings, report) {
+  const pending = view(board, db => db.prepare(`SELECT e.task_id, e.payload FROM task_events e WHERE e.kind = 'dispatch_held'
+    AND json_extract(e.payload, '$.reason') = 'adoption requested'
+    AND e.id = (SELECT MAX(id) FROM task_events l WHERE l.task_id = e.task_id AND l.kind IN ('dispatch_held','dispatch_released','session_adopted','adoption_failed'))`).all());
+  for (const row of pending) {
+    const asked = json(row.payload, {}) ?? {};
+    try {
+      const got = adoptSession(board, row.task_id, asked.session, { workspace: asked.workspace ?? null, assignee: asked.assignee ?? null, role: asked.role ?? null, ttl: settings.ttl, fleet: fleet?.ok ? fleet : null });
+      (report.adopted ??= []).push([row.task_id, got.address]);
+    } catch (error) {
+      const message = String(error.message).slice(-400);
+      tx(board, db => event(db, row.task_id, 'adoption_failed', { session: asked.session, error: message }));
+      report.failed.push([row.task_id, `adoption of ${asked.session}: ${message}`]);
+    }
+  }
+}
+
+function adoptSession(board, id, who, { workspace = null, ttl, assignee = null, role = null, fleet = null } = {}) {
+  fleet ??= observeFleet();
   if (!fleet.ok) throw new Error(`supercode could not read the fleet: ${fleet.error}`);
   const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who);
   if (!found) throw new Error(`the fleet lists no live session ${who}`);
@@ -1424,7 +1482,7 @@ export async function sendBoardMessages(board, report, taskId = null) {
       const task = view(board, db => getTask(db, first.task_id));
       const subject = mail.requester ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`;
       const receipt = await send(boardAddress(board.label), board.label, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
-      if (!receipt.delivered) throw new Error(receipt.reason ?? 'queued; native transcript confirmation pending');
+      if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'message was not filed');
       tx(board, db => {
         for (const member of mail.members) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, receipt, ...(mail.message_id ? { message_id: mail.message_id, request_id: member.message_id ?? mail.message_id } : {}) });
       });
@@ -1502,8 +1560,11 @@ async function notify(board, fleet, report, entry) {
     if (!events.length) return;
     // the card as the workflow names it (its status the workflow's: triaging, reviewing, stopped; `stored_as` kanban.db's)
     const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, status: statusOf(db, t), stored_as: t.status } : t; });
+    // a worker whose run has ended is not woken by a notice (a second session would start working the card beside
+    // the one the next run gets): the notice is filed in its mailbox, read when it next works
+    const working = role !== 'worker' || view(board, (db) => addressOf(currentRun(db, sub.task_id)?.metadata?.supercode) === sub.chat_id);
     let cursor = Number(sub.last_event_id);
-    let failed = null, pending = false;
+    let failed = null;
     try {
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
@@ -1517,9 +1578,11 @@ async function notify(board, fleet, report, entry) {
         } else text = noticeOf(entry, role, ev.kind, task, p);
         if (text) {
           const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
-          const receipt = await send(from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: !entry.workflow.run && sub.delivery_mode === 'notify', subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
-          if (!receipt.delivered) { pending = Boolean(receipt.queued); throw new Error(receipt.reason ?? 'native delivery confirmation pending'); }
-          tx(board, (db) => event(db, sub.task_id, 'notice_delivered', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }));
+          const receipt = await send(from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: !working || (!entry.workflow.run && sub.delivery_mode === 'notify'), subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
+          // A notice the recipient's mailbox took is filed: the machine delivers it at the session's next turn, so the
+          // board does not send it again.
+          if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'notice was not filed');
+          tx(board, (db) => event(db, sub.task_id, receipt.delivered ? 'notice_delivered' : 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }));
           report.notified.push([sub.task_id, ev.kind, sub.chat_id]);
         }
         cursor = ev.id;
@@ -1527,7 +1590,7 @@ async function notify(board, fleet, report, entry) {
     } catch (error) {
       failed = String(error.message).slice(-200);
       tx(board, (db) => {
-        const kind = pending ? 'notice_queued' : 'notice_failed';
+        const kind = 'notice_failed';
         const previous = db.prepare('SELECT payload FROM task_events WHERE task_id=? AND kind=? ORDER BY id DESC LIMIT 1').get(sub.task_id, kind);
         const payload = { after_event: cursor, address: sub.chat_id, error: failed, retry: true };
         if (JSON.stringify(json(previous?.payload, {})) !== JSON.stringify(payload)) event(db, sub.task_id, kind, payload);
@@ -1539,7 +1602,7 @@ async function notify(board, fleet, report, entry) {
       const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
       const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
       db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(cursor, ...identity, cursor);
-      const failures = failed && !pending ? Number(sub.delivery_metadata?.failures ?? 0) + 1 : 0;
+      const failures = failed ? Number(sub.delivery_metadata?.failures ?? 0) + 1 : 0;
       if (failures >= MAX_SEND_FAILURES) { db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity); return; }
       if (failures !== Number(sub.delivery_metadata?.failures ?? 0)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures }), ...identity);
       if (task?.status === 'archived' && cursor >= events.at(-1).id) db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity);
@@ -1778,38 +1841,46 @@ export async function plan({ root, lanes, settings, slugs = null, params = {} })
 }
 
 /** An opened PR asks for the declared review transition once the arc's tasks are closed. */
+// A task written in the card's own Tasks section that did not become a subtask holds its review too.
 async function activatePullRequestReviews(board, entry, report, effects, { only = null } = {}) {
   const candidates = view(board, db => db.prepare(`SELECT t.id FROM tasks t JOIN supercode_cards c ON c.task_id=t.id
-    WHERE c.subtask_of IS NULL AND COALESCE(c.review_only,0)=0 AND c.every IS NULL
+    WHERE c.subtask_of IS NULL AND c.every IS NULL
     AND t.workspace_kind!='scratch' ${only ? 'AND t.id=?' : ''}`).all(...(only ? [only] : [])));
   for (const { id } of candidates) {
     const eligible = db => {
       const task = getTask(db, id);
       if (!task) return false;
       const scope = scopeOf(db, board, task, { params: entry.params });
-      return task && transitionsFor(entry.workflow, statusOf(db, task), 'request_review').some(t => !t.by || t.by.includes('platform')) &&
-        !scope.card.dispatch_hold && !scope.card.paused && !scope.card.blocked_by.length &&
-        scope.card.subtasks.every(t => ['done', 'cancelled'].includes(t.status));
+      if (!transitionsFor(entry.workflow, statusOf(db, task), 'request_review').some(t => !t.by || t.by.includes('platform')) ||
+        scope.card.dispatch_hold || scope.card.paused || scope.card.blocked_by.length) return false;
+      // The card's Tasks are its subtasks; an open one holds the review, and says so.
+      const open = scope.card.subtasks.filter(t => !['done', 'cancelled'].includes(t.status));
+      return open.length ? open : true;
     };
-    if (!view(board, eligible)) continue;
+    const ready = view(board, eligible);
+    if (!ready) continue;
+    if (ready !== true) { report.queued.push([id, `review waits: ${ready.length} open task(s) in the card's Tasks: ${ready[0].id} ${ready[0].title}`]); continue; }
+    let payload = null;
     try {
-      const payload = openReviewPullRequest(board, id);
-      if (!payload) continue;
+      payload = openReviewPullRequests(board, id);
+      // The arc's open PRs ask for one review only while some head has no verdict: after changes are
+      // requested the next run is the implementer's, until a new head is pushed.
+      if (!payload || !reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) continue;
       const evidence = inspectCompletionEvidence(board, id, entry, payload, 'request_review');
       if (!evidence.ready) throw new Error(evidence.reason);
       refreshCardInputs(board, id, { commits: true });
       const moved = tx(board, db => {
         const task = getTask(db, id);
-        if (!eligible(db)) return null;
+        if (eligible(db) !== true) return null;
         return withCompletionEvidence(board, id, evidence, () => fire(db, board, entry, id, 'request_review', {
-          roles: ['platform'], payload: { ...payload, run_id: task.current_run_id, summary: `Opened PR ${payload.pr} at ${payload.pr_head}`, ci: evidence }
+          roles: ['platform'], payload: { ...payload, run_id: task.current_run_id, summary: `Opened ${payload.pr.map((url, index) => `${url} at ${payload.pr_head[index]}`).join(', ')}`, ci: evidence }
         }));
       });
       if (moved) {
         effects.push(...moved.effects);
-        (report.review_requested ??= []).push({ id, pr: payload.pr, head: payload.pr_head });
+        (report.review_requested ??= []).push({ id, prs: payload.pr, heads: payload.pr_head });
       }
-    } catch (error) { report.queued.push([id, `PR review waits: ${error.message}`]); }
+    } catch (error) { report.queued.push([id, `PR review waits${payload ? ` (${payload.pr.join(', ')})` : ''}: ${error.message}`]); }
   }
 }
 
@@ -1857,7 +1928,7 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       readMailbox(board, boardAddress(board.label), report); phase('mailbox');
       await refreshRelationAnswers(board); phase('answers');
       const effects = [];
-      reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); await runEffects(board, effects.splice(0), { retryNotices: true }); closeRequested(board, report); phase('supervise');
+      completeAdoptions(board, fleet, settings, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); await runEffects(board, effects.splice(0), { retryNotices: true }); closeRequested(board, report); phase('supervise');
       report.unsettled = [];
       report.promoted = recomputeReady(board, effects, report.unsettled);
       if (dispatch) await activatePullRequestReviews(board, entry, report, effects, { only });