@volter/supercode-orchestrator 0.4.149 → 0.4.151

package/board/ci.mjs

@@ -6,6 +6,43 @@ import { dirname, join, relative } from 'node:path';
 import { createHash } from 'node:crypto';
 import { branchCheckouts, checkoutOf, resolveWorkspace } from './workspace.mjs';
 
+// GitHub is read through its REST API with Node's own fetch, not the gh binary: Node takes a World's trust bundle and
+// injector (NODE_EXTRA_CA_CERTS, NODE_OPTIONS), so a review World's GitHub twin answers it, where gh (Go) trusts only
+// the system keychain. The read runs in a child Node so the callers stay synchronous.
+const GITHUB_READ = `
+const [path, all] = process.argv.slice(1);
+const base = (process.env.GITHUB_API_URL || 'https://api.github.com').replace(/\\/$/, '');
+const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+const headers = { accept: 'application/vnd.github+json', 'user-agent': 'supercode-board', ...(token ? { authorization: 'Bearer ' + token } : {}) };
+let url = base + path, out = [];
+for (let page = 0; url && page < 10; page += 1) {
+  const r = await fetch(url, { headers });
+  if (!r.ok) { process.stderr.write('GitHub ' + r.status + ' for ' + path + ': ' + (await r.text()).slice(0, 300)); process.exit(1); }
+  const body = await r.json();
+  if (all !== '1') { process.stdout.write(JSON.stringify(body)); process.exit(0); }
+  out = out.concat(body);
+  url = /<([^>]+)>;\\s*rel="next"/.exec(r.headers.get('link') ?? '')?.[1] ?? null;
+}
+process.stdout.write(JSON.stringify(out));`;
+let githubToken;
+/** One GitHub REST read (`all`: every page of a list). The token is the environment's, else gh's stored login. */
+function github(path, all = false) {
+  if (githubToken === undefined) {
+    githubToken = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || null;
+    if (!githubToken) try { githubToken = run('gh', ['auth', 'token']) || null; } catch { githubToken = null; }
+  }
+  const env = githubToken ? { ...process.env, GH_TOKEN: githubToken } : process.env;
+  const result = spawnSync(process.execPath, ['--input-type=module', '-e', GITHUB_READ, path, all ? '1' : '0'], { env, encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(`GitHub: ${(result.stderr || result.error?.message || 'read failed').trim().slice(-500)}`);
+  return JSON.parse(result.stdout);
+}
+const repositoryOf = (url) => new URL(url).pathname.split('/').slice(1, 3).join('/');
+const numberOf = (url) => Number(new URL(url).pathname.split('/')[4]);
+/** A PR as the board reads it (gh's field names). */
+const pullRequest = (repository, p) => ({ url: p.html_url, number: p.number, state: p.merged_at ? 'MERGED' : String(p.state).toUpperCase(), headRefOid: p.head.sha,
+  headRefName: p.head.ref, baseRefName: p.base.ref, isCrossRepository: p.head.repo?.full_name?.toLowerCase() !== repository.toLowerCase(), isDraft: Boolean(p.draft) });
+const readPullRequest = (url) => pullRequest(repositoryOf(url), github(`/repos/${repositoryOf(url)}/pulls/${numberOf(url)}`));
+
 const observations = new Map();
 const key = (board, id) => `${board.root}\0${board.slug}\0${id}`;
 const run = (program, args, cwd) => {
@@ -66,14 +103,28 @@ function repositoryWorkspace(board, id) {
 
 const pullRequestLists = new Map();
 
-function branchCheckout(board, id, repository) {
-  const task = board.db.prepare('SELECT t.branch_name, c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(id);
-  try { return checkoutOf(task?.machine, repository, task?.branch_name ?? `wt/${id}`)?.path ?? null; } catch { return null; }
+function branchCheckout(board, id, repository, branch) {
+  const task = board.db.prepare('SELECT c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(id);
+  try { return checkoutOf(task?.machine, repository, branch)?.path ?? null; } catch { return null; }
+}
+
+/** The sibling checkouts an arc registered: each subtask (and the card itself) that declares a repository
+ *  workspace and a branch, e.g. `create "<what>" --subtask-of <arc> --workspace worktree:<repository> --branch <name>`.
+ *  Their PRs are the arc's whatever the branch is named. */
+function registeredBranches(board, id) {
+  const rows = board.db.prepare(`SELECT t.branch_name, t.workspace_kind, c.workspace_anchor FROM tasks t JOIN supercode_cards c ON c.task_id=t.id
+    WHERE (t.id=? OR c.subtask_of=?) AND t.status != 'cancelled' AND t.workspace_kind IN ('worktree','dir') AND t.branch_name IS NOT NULL`).all(id, id);
+  const out = [];
+  for (const row of rows) {
+    if (!row.workspace_anchor || /^(\/|~|[A-Za-z]:[\\/])/.test(row.workspace_anchor)) continue;
+    out.push({ repository: row.workspace_anchor.replace(/^github\.com\//i, '').replace(/\.git$/, ''), branch: row.branch_name });
+  }
+  return out;
 }
 
 /** Every opened PR of the arc: each open PR whose head is the card's branch or a `wt/<card id>` branch, in the
- *  card's own repository and in every repository this machine keeps a checkout of. One review covers them all;
- *  the caller decides the transition. */
+ *  card's own repository and in every repository this machine keeps a checkout of, and each open PR on a sibling
+ *  checkout the arc registered (`registeredBranches`). One review covers them all; the caller decides the transition. */
 export function openReviewPullRequests(board, id) {
   const own = repositoryWorkspace(board, id);
   if (!own) return null;
@@ -81,20 +132,23 @@ export function openReviewPullRequests(board, id) {
   const branch = task?.branch_name ?? run('git', ['branch', '--show-current'], own);
   const ownRepository = originOf(own);
   if (!ownRepository) return null;
-  const mine = (head) => head === branch || [`wt/${id}`, `wt/${id.replace(/^t_/, 't-')}`].some((prefix) => head === prefix || head.startsWith(`${prefix}-`) || head.startsWith(`${prefix}/`));
+  const registered = registeredBranches(board, id);
+  const mine = (repository, head) => head === branch || [`wt/${id}`, `wt/${id.replace(/^t_/, 't-')}`].some((prefix) => head === prefix || head.startsWith(`${prefix}-`) || head.startsWith(`${prefix}/`))
+    || registered.some((r) => r.repository === repository && r.branch === head);
   const prs = [];
-  for (const repository of new Set([ownRepository, ...knownRepositories()])) {
+  for (const repository of new Set([ownRepository, ...registered.map((r) => r.repository), ...knownRepositories()])) {
     // Discovery is shared per repository for one minute; each selected PR/head is re-read before it authorizes a move.
     let list = pullRequestLists.get(repository);
     if (!list || Date.now() - list.at >= 60_000) {
       let items = [];
-      try { items = JSON.parse(run('gh', ['pr', 'list', '--repo', repository, '--state', 'open', '--limit', '1000', '--json', 'url,headRefOid,headRefName,baseRefName,isCrossRepository'])); }
-      catch (error) { if (repository === ownRepository) throw error; } // another repository unreachable here is not this arc's
+      try { items = github(`/repos/${repository}/pulls?state=open&per_page=100`, true).map((p) => pullRequest(repository, p)); }
+      catch (error) { if (repository === ownRepository || registered.some((r) => r.repository === repository)) throw error; } // another repository unreachable here is not this arc's
       list = { at: Date.now(), items };
       if (pullRequestLists.size >= 64) pullRequestLists.delete(pullRequestLists.keys().next().value);
       pullRequestLists.set(repository, list);
     }
-    for (const pr of list.items) if (!pr.isCrossRepository && mine(pr.headRefName)) prs.push({ url: pr.url, head: pr.headRefOid });
+    // a draft is not handed over yet: its review starts when it is marked ready
+    for (const pr of list.items) if (!pr.isCrossRepository && !pr.isDraft && mine(repository, pr.headRefName)) prs.push({ url: pr.url, head: pr.headRefOid });
   }
   if (!prs.length) return null;
   return { pr: prs.map((p) => p.url), pr_head: prs.map((p) => p.head), branch };
@@ -105,17 +159,35 @@ function knownRepositories() {
   try { return [...new Set(branchCheckouts(null, '*').map((row) => row.repository))]; } catch { return []; }
 }
 
-/** Whether the arc's open PRs (`[{ url, head }]`) call for its review. Before any verdict: while some head has none.
- *  After a verdict: only once a PR that verdict judged shows a new head. A PR that joins the arc, or one that merged or
- *  closed, does not by itself bring the arc back: after changes are requested the next run is the implementer's. */
+/** Whether the arc's open PRs (`[{ url, head }]`) call for its review: some head no verdict judged that is new work.
+ *  Before any verdict every unjudged head is. After a verdict, a PR it judged with a new head is, and so is a head
+ *  committed after that verdict (a new PR carrying the fixes, or any PR after a verdict that named none). A PR that
+ *  joins with a head committed before the verdict is not: after changes are requested the next run is the
+ *  implementer's until it pushes. */
 export function reviewDue(board, id, prs) {
-  const unjudged = prs.some((p) => !judgedHead(board, id, p.head));
-  const last = board.db.prepare(`SELECT r.payload FROM task_events r WHERE r.task_id = ? AND r.kind = 'review_requested'
+  const unjudged = prs.filter((p) => !judgedHead(board, id, p.head));
+  if (!unjudged.length) return false;
+  const last = board.db.prepare(`SELECT r.payload, (SELECT MIN(v.created_at) FROM task_events v WHERE v.task_id = r.task_id
+      AND v.kind IN ('changes_requested', 'review_pass') AND v.id > r.id) AS verdict_at
+    FROM task_events r WHERE r.task_id = ? AND r.kind = 'review_requested'
     AND EXISTS (SELECT 1 FROM task_events v WHERE v.task_id = r.task_id AND v.kind IN ('changes_requested', 'review_pass') AND v.id > r.id)
     ORDER BY r.id DESC LIMIT 1`).get(id);
-  if (!last) return unjudged;
+  if (!last) return true;
   const judged = candidatePullRequests(JSON.parse(last.payload)?.ci);
-  return unjudged && judged.some((j) => prs.some((p) => p.url === j.pr.url && p.head !== j.commit));
+  if (judged.some((j) => prs.some((p) => p.url === j.pr.url && p.head !== j.commit))) return true;
+  return unjudged.some((p) => (commitTime(p) ?? 0) > Number(last.verdict_at));
+}
+
+const commitTimes = new Map();
+/** When a PR's head was committed (seconds), read from GitHub once per head; null when it cannot be read. */
+function commitTime({ url, head }) {
+  if (commitTimes.has(head)) return commitTimes.get(head);
+  let at = null;
+  try {
+    at = Math.floor(Date.parse(github(`/repos/${repositoryOf(url)}/commits/${head}`).commit.committer.date) / 1000) || null;
+  } catch { /* unreadable: not counted as new */ }
+  commitTimes.set(head, at);
+  return at;
 }
 
 /** The verdict already recorded on `head` of the card's PR: a changes-requested or pass that answered
@@ -146,7 +218,7 @@ export function inspectCompletionEvidence(board, id, entry, payload = {}, stage
         const wanted = candidatePullRequests(candidate);
         if (wanted.length !== passed.length || wanted.some((w) => !passed.some((p) => p.pr.url === w.pr.url && p.commit === w.commit))) throw new Error('The current PR heads need their independent verdict before acceptance.');
         for (const w of wanted) {
-          const pr = JSON.parse(run('gh', ['pr', 'view', w.pr.url, '--repo', w.repository, '--json', 'state,headRefOid']));
+          const pr = readPullRequest(w.pr.url);
           if (!['OPEN', 'MERGED'].includes(pr.state) || pr.headRefOid !== w.commit) throw new Error(`The head of ${w.pr.url} changed after its verdict; request a new review.`);
         }
         Object.assign(state, { ...candidate, ready: true, reason: null });
@@ -192,11 +264,12 @@ function verifyPullRequest(board, id, entry, own, url, supplied, stage) {
   if (typeof url !== 'string' || !/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/[1-9][0-9]*\/?$/.test(url)) throw new Error('Name the opened PR URL with --pr.');
   const repository = new URL(url).pathname.split('/').slice(1, 3).join('/');
   // An arc may change several repositories. A PR is read from GitHub; its pushed head is the reviewed one. The
-  // card's own checkout, and this machine's checkout of another repository on the card's branch when it keeps one,
-  // must also hold that head with nothing uncommitted.
-  const path = originOf(own) === repository ? own : branchCheckout(board, id, repository);
-  const observed = JSON.parse(run('gh', ['pr', 'view', url, '--repo', repository, '--json', 'url,number,state,headRefOid,headRefName,baseRefName,isCrossRepository']));
+  // card's own checkout, and this machine's checkout of the PR's branch when it keeps one, must also hold that head
+  // with nothing uncommitted.
+  const observed = readPullRequest(url);
+  const path = originOf(own) === repository && run('git', ['branch', '--show-current'], own) === observed.headRefName ? own : branchCheckout(board, id, repository, observed.headRefName);
   if (observed.state !== 'OPEN' || observed.isCrossRepository) throw new Error(`Source review needs an open PR from its repository (${url}).`);
+  if (observed.isDraft) throw new Error(`${url} is a draft; its review starts when it is marked ready for review.`);
   const head = supplied ?? observed.headRefOid;
   if (!/^[a-f0-9]{40}$/.test(head)) throw new Error('Name the full PR head commit with --pr-head (reviewer: --reviewed-sha).');
   if (observed.headRefOid !== head) throw new Error(`The head of ${url} changed to ${observed.headRefOid}; request review of that head before recording a verdict.`);
@@ -206,8 +279,8 @@ function verifyPullRequest(board, id, entry, own, url, supplied, stage) {
   if (stage === 'request_review' && path) {
     run('git', ['check-ref-format', '--branch', branch], path);
     if (run('git', ['rev-parse', 'HEAD'], path) !== head) throw new Error(`The head named for ${url} must be its worktree head.`);
-    run('git', ['diff', '--quiet', 'HEAD'], path);
-    if (run('git', ['ls-files', '--others', '--exclude-standard'], path)) throw new Error(`Commit the untracked work in ${path} before requesting review.`);
+    const uncommitted = run('git', ['status', '--porcelain', '--untracked-files=normal'], path).split('\n').filter(Boolean);
+    if (uncommitted.length) throw new Error(`Commit the work in ${path} before requesting review: ${uncommitted.length} uncommitted path(s): ${uncommitted.slice(0, 5).map((l) => l.replace(/^\s*\S+\s+/, '')).join(', ')}${uncommitted.length > 5 ? ', …' : ''}`);
     const pushed = run('git', ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], path).split(/\s+/)[0];
     if (pushed !== head) throw new Error(`Push the exact head of ${url} before requesting review.`);
   }

package/board/cli.mjs

@@ -7,13 +7,13 @@
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { basename, join, resolve } from 'node:path';
-import { tmpdir } from 'node:os';
+import { tmpdir, userInfo } from 'node:os';
 import { read } from '../orchestration.mjs';
 import { actorOf, view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
 import { isLocalWorkspace } from './workspace.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
-import { adoptSession, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, supercodeBin, tick } from './dispatch.mjs';
+import { requestAdoption, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, supercodeBin, tick } from './dispatch.mjs';
 import { watchBoard } from './wake.mjs';
 import { completionOwnerOf, isLatestReviewer, loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
 import { evaluate } from './expr.mjs';
@@ -29,14 +29,14 @@ Hermes Kanban's verbs, with their flags:
          [--model] [--provider] [--goal|--no-goal] [--goal-max-turns] [--initial-status blocked|running]
   swarm <goal> --worker PROFILE:TITLE[:SKILL,SKILL]... --verifier P --synthesizer P
   list [--mine] [--assignee] [--status] [--tenant] [--session] [--archived] [--sort]   show <id>   context <id>   runs <id>
-  assign <id> <profile|none>   reassign <id> <profile> [--reclaim] [--reason]   set-model <id> [model] [--provider]   set-goal <id>... [--goal-max-turns N] [--off]
+  set <id> <assignee|machine|model|every> <value|none> [--provider] [--ids ...]   assign <id> <profile|none>   set-model <id> [model] [--provider]   set-goal <id>... [--goal-max-turns N] [--off]
   claim <id> [--ttl]   reclaim <id> [--reason]   heartbeat <id> [--note] [--until <time|30m>]   link|unlink <parent> <child>
   comment <id> <text> [--author] [--max-len]   attach <id> <path> [--name] [--content-type]   attachments <id>   attach-rm <n>
   complete <id>... [--result] [--summary] [--metadata JSON]   edit <id> --result [--summary] [--metadata]
   block <id> [reason] (--on <card> | --waiting-on <message id>) [--ids ...]   schedule <id> [reason] [--ids ...]
-  pause <id> --reason <why>   resume <id>   cancel <id>   set-every <id> <interval|none>
+  pause <id> --reason <why>   resume <id>   cancel <id>
   request-state <id> --state block|pause|done|cancelled --reason <why> [--on <card>|--waiting-on <message>] [--evidence <pointers>]
-  unblock <id>... [--reason]   request-review <id> (--pr URL --pr-head SHA)... [--summary] [--reviewer] [--force]   request-changes <id> <reason>   reopen-review <id>...   reopen <id>... [--reason]
+  unblock <id>... --on <blocker> --reason <what arrived>   request-review <id> (--pr URL --pr-head SHA)... [--summary] [--reviewer] [--force]   request-changes <id> <reason> [--finding <finding>]...   reopen-review <id>...   reopen <id>... [--reason]
   promote <id> [reason] [--ids ...] [--force] [--dry-run]   archive <id>... [--rm <id>...]
   specify <id> [--title --body] [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch NAME] [--all]
   decompose <id> [--child "<title>[@<profile>]"]... [--all]
@@ -71,7 +71,7 @@ supercode's own:
   workflow declares who may block, pause or finish a card; request-state mails its manager without changing state.
 `;
 
-const MULTI = new Set(['parent', 'skill', 'worker', 'child', 'ids', 'rm', 'pr', 'pr-head', 'reviewed-sha']);
+const MULTI = new Set(['parent', 'skill', 'worker', 'child', 'ids', 'rm', 'pr', 'pr-head', 'reviewed-sha', 'finding']);
 const FLAGS = new Set(['json', 'triage', 'no-notify', 'no-start', 'all', 'force', 'help', 'mine', 'archived', 'reclaim', 'dry-run',
   'goal', 'no-goal', 'off', 'switch', 'delete', 'no-attachments', 'include-logs', 'verbose']);
 // flags that take every following word up to the next flag (Hermes's nargs='+')
@@ -264,8 +264,8 @@ export async function runWorkflow(argv) {
     if (verb === 'comment' && isLatestReviewer(db, cardId, actorOf()) && !roles.includes('reviewer')) roles.push('reviewer');
     return roles;
   });
-  // a verb with no session behind it (a person at the CLI, the board file's sync) is the manager's, as its roles are
-  if (!sid && verb !== 'help') { try { setActor([].concat(workflowFor(root).params?.managers ?? [])[0] ?? null); } catch { /* no workflow */ } }
+  // a verb with no session behind it is recorded as the OS user's; it holds no role on any card
+  if (!sid && verb !== 'help') setActor(`user:${userInfo().username}`);
 
   switch (verb) {
     case 'migrate': {
@@ -314,9 +314,8 @@ export async function runWorkflow(argv) {
       let answer = { id: created.id, existing: created.existing };
       if (args.adopt) {
         withBoard(b => { if (!rolesFor(b.db, created.id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
-        const { settings } = await laneState(root);
-        const adopted = withBoard(b => adoptSession(b, created.id, args.adopt, { ttl: settings.ttl }));
-        answer = { ...answer, started: true, session: adopted.address, mode: adopted.mode };
+        withBoard(b => requestAdoption(b, created.id, args.adopt));
+        answer = { ...answer, adoption_requested: args.adopt };
       }
       // Starting a card is the dispatcher's: this write's wake hint reaches it, and the card's
       // thread records the start. A create never runs a dispatch tick inline.
@@ -326,7 +325,7 @@ export async function runWorkflow(argv) {
       const task = withBoard((b) => view(b, (db) => engine.getTask(db, created.id)));
       const recipients = withBoard(b => engine.subscriptions(b.db, created.id)).filter(s => s.platform === 'supercode').map(s => s.chat_id);
       if (args.json) { say(args, '', { ...cardDict(task), ...answer, notify: address ?? null, recipients }); return answer.failed ? 1 : 0; }
-      const said = answer.started ? `; started session ${answer.session} (${answer.mode})` : answer.failed ? `; did not start: ${answer.failed}` : answer.waits ? `; waits: ${answer.waits}` : '';
+      const said = answer.adoption_requested ? `; held for ${answer.adoption_requested}, which the dispatcher binds on its next tick` : answer.started ? `; started session ${answer.session} (${answer.mode})` : answer.failed ? `; did not start: ${answer.failed}` : answer.waits ? `; waits: ${answer.waits}` : '';
       say(args, `${created.existing ? 'Existing' : 'Created'} ${created.id}  (${task.status}, assignee=${task.assignee || '-'})${said}${recipients.length ? `; notices go to ${recipients.join(', ')}` : ''}`, null);
       return answer.failed ? 1 : 0;
     }
@@ -466,17 +465,18 @@ export async function runWorkflow(argv) {
       return 0;
     }
 
-    case 'assign': need(2, 'a card id and a profile (or none)'); await withBoardAsync((b) => engine.assign(b, id, rest[1] === 'none' ? null : rest[1])); say(args, `Assigned ${id} to ${rest[1] === 'none' ? '(nobody)' : rest[1]}`, { ok: true }); return 0;
-    case 'reassign': {
-      need(2, 'a card id and a profile');
-      await withBoardAsync(async (b) => {
-        const task = engine.getTask(b.db, id);
-        if (task?.current_run_id != null && args.reclaim) await engine.reclaim(b, id, args.reason ?? 'reassign');
-        await engine.assign(b, id, rest[1] === 'none' ? null : rest[1]);
-      });
-      say(args, `Reassigned ${id} to ${rest[1]}`, { ok: true }); return 0;
+    // One door sets a card's properties; the workflow's `set` rules say who may and what follows (a live run
+    // whose session must change is ended, and the dispatcher starts the next itself). `assign`/`reassign` are
+    // Hermes's names for setting the assignee, and `set-model` its name for setting the model.
+    case 'set': {
+      need(3, 'a card id, a property (assignee, machine, model or every) and its value (or none)');
+      const value = rest[2] === 'none' ? null : rest[2];
+      const cards = ids([id]);
+      for (const t of cards) await withBoardAsync((b) => engine.set(b, t, rest[1], value, { provider: args.provider ?? null }));
+      say(args, cards.map((t) => `${t}: ${rest[1]} ${value ?? '(none)'}`).join('\n'), { ok: true }); return 0;
     }
-    case 'set-model': need(1, 'a card id'); await withBoardAsync((b) => engine.setModel(b, id, rest[1] ?? null, args.provider ?? null)); say(args, rest[1] ? `${id} runs on model ${rest[1]}${args.provider ? ` (${args.provider})` : ''} from its next start` : `${id} uses its profile's model`, { ok: true }); return 0;
+    case 'set-model': need(1, 'a card id'); await withBoardAsync((b) => engine.set(b, id, 'model', rest[1] ?? null, { provider: args.provider ?? null })); say(args, rest[1] ? `${id} runs on model ${rest[1]}${args.provider ? ` (${args.provider})` : ''} from its next start` : `${id} uses its profile's model`, { ok: true }); return 0;
+    case 'assign': case 'reassign': need(2, 'a card id and a profile (or none)'); await withBoardAsync((b) => engine.set(b, id, 'assignee', rest[1] === 'none' ? null : rest[1])); say(args, `Assigned ${id} to ${rest[1] === 'none' ? '(nobody)' : rest[1]}`, { ok: true }); return 0;
     case 'set-goal': {
       // a card into goal mode (or out of it with --off) from its next idle turn: the heartbeat keeps its session going
       need(1, 'a card id');
@@ -485,7 +485,6 @@ export async function runWorkflow(argv) {
       for (const t of ids()) await withBoardAsync((b) => engine.setGoal(b, t, { on: !args.off, maxTurns }));
       say(args, ids().map((t) => args.off ? `${t} is no longer a goal card` : `${t} is a goal card${maxTurns ? ` (${maxTurns} turns)` : ''}`).join('\n'), { ok: true }); return 0;
     }
-    case 'move': need(2, 'a card id and a machine (or none)'); await withBoardAsync((b) => engine.setMachine(b, id, rest[1] === 'none' ? null : rest[1])); say(args, `${id} runs on ${rest[1]}`, { ok: true }); return 0;
 
     case 'claim': {
       need(1, 'a card id');
@@ -571,13 +570,21 @@ export async function runWorkflow(argv) {
     case 'unblock': {
       need(1, 'a card id');
       const results = [];
-      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.unblock(b, t, { reason: args.reason ?? null, on: args.on ?? null }))).to]);
+      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.unblock(b, t, { reason: args.reason ?? null, on: args.on ?? args['waiting-on'] ?? null }))).to]);
       // Hermes records the reason as a comment on each card it unblocks
       if (args.reason) for (const [t] of results) await withBoardAsync((b) => engine.comment(b, t, callerName(), `UNBLOCK: ${args.reason}`));
       say(args, results.map(([t, s]) => `Unblocked ${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
     }
     case 'request-review': need(1, 'a card id'); await withBoardAsync((b) => engine.requestReview(b, id, { summary: args.summary ?? null, reviewer: args.reviewer ?? null, metadata: metadataOf(args.metadata) ?? null, commit: args.commit ?? null, ci_run: args['ci-run'] ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args['pr-head'] ?? args.head ?? args.commit ?? null, force: Boolean(args.force), expectedRunId: workerRun(b.db, id, sid) })); say(args, `${id} → review`, { ok: true }); return 0;
-    case 'request-changes': need(2, 'a card id and the reason'); await withBoardAsync((b) => engine.requestChanges(b, id, { reason: rest.slice(1).join(' '), reviewer: args.reviewer ?? null })); say(args, `${id} sent back for changes`, { ok: true }); return 0;
+    case 'request-changes': {
+      need(2, 'a card id and the reason');
+      // each finding is filed as a task on the arc first, so the arc stays open until a pushed head fixes it
+      const findings = [].concat(args.finding ?? []).map((f) => String(f).trim()).filter(Boolean);
+      const filed = [];
+      for (const finding of findings) filed.push((await withBoardAsync((b) => engine.createCard(b, { title: finding, subtaskOf: id }))).id);
+      await withBoardAsync((b) => engine.requestChanges(b, id, { reason: rest.slice(1).join(' '), reviewer: args.reviewer ?? null }));
+      say(args, `${id} sent back for changes${filed.length ? `; findings filed as ${filed.join(', ')}` : ''}`, { ok: true, findings: filed }); return 0;
+    }
     case 'reopen': {
       // a done card back to work; the cards that built on it are invalidated with it (Hermes's reopen)
       need(1, 'a card id');
@@ -805,11 +812,6 @@ export async function runWorkflow(argv) {
       return report.status === 'corrupt' ? 1 : 0;
     }
 
-    case 'set-every': {
-      need(1, 'a card id');
-      await withBoardAsync((b) => engine.act(b, id, 'set_every', { payload: { every: rest[1] === 'none' ? null : rest[1] } }));
-      say(args, `${id} recurrence updated`, { ok: true }); return 0;
-    }
     case 'cancel': {
       need(1, 'a card id');
       await withBoardAsync((b) => engine.act(b, id, 'cancel', { payload: { reason: args.reason ?? rest.slice(1).join(' ') } }));
@@ -844,9 +846,8 @@ export async function runWorkflow(argv) {
     case 'adopt': {
       need(2, 'a card id and a session');
       withBoard(b => { if (!rolesFor(b.db, id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
-      const { settings } = await laneState(root);
-      const got = withBoard((b) => adoptSession(b, id, rest[1], { workspace: args.workspace ?? null, ttl: settings.ttl, assignee: args.assignee ?? null, role: args.role ?? null }));
-      say(args, `${id} is worked by ${got.address} (pane ${got.pane ?? '?'} in ${got.workspace ?? 'its card\'s directory'})`, { ok: true, ...got });
+      withBoard((b) => requestAdoption(b, id, rest[1], { workspace: args.workspace ?? null, assignee: args.assignee ?? null, role: args.role ?? null }));
+      say(args, `${id} is held for ${rest[1]}; the dispatcher verifies and binds it on its next tick (session_adopted, or adoption_failed with the reason)`, { ok: true, requested: rest[1] });
       return 0;
     }
     case 'goto': {
@@ -1093,12 +1094,12 @@ function ownCard(db, sessionId) {
 const READS = new Set(['list', 'ls', 'show', 'context', 'runs', 'log', 'tail', 'watch', 'stats', 'assignees', 'diagnostics', 'diag', 'attachments', 'notify-list', 'help', 'init']);
 
 /**
- * Who a caller is on card `cardId`, in the workflow's roles: a person or the fleet's manager at the CLI (no session)
- * is `manager`; the session of the card's current run has that run's role; the card's working session between runs
+ * Who a caller is on card `cardId`, in the workflow's roles: a caller with no session behind it has no role (the
+ * manager acts from its own session, named in params.managers); the session of the card's current run has that run's role; the card's working session between runs
  * is its `implementer`; the session working a subtask's arc is `arc`; its recorded creator also has the creator role; any other session is nobody on it.
  */
 function rolesFor(db, cardId, sessionId, params = {}) {
-  if (!sessionId) return ['manager', 'owner'];
+  if (!sessionId) return [];
   // a session the workflow names as the board's manager (params.managers: its addresses) is the manager on every card
   const managers = Array.isArray(params.managers) ? params.managers.map(String) : [];
   if (managers.some((m) => m === sessionId || m.endsWith(`:${sessionId}`))) return ['manager'];
@@ -1127,7 +1128,7 @@ function authorize(db, verb, rest, args, own) {
   if (verb === 'boards') { if (!['list', 'ls', 'show', 'current', undefined].includes(rest[0])) refuse('does not change the home\'s boards'); return; }
   // verbs that act on the board rather than on a card are the manager's and the board's, never a card's session's
   // (what a session may do to a card is its workflow's: each transition's `by`)
-  if ((['pause', 'resume'].includes(verb) && !rest[0]) || ['swarm', 'dispatch', 'daemon', 'serve', 'gc', 'repair', 'adopt', 'close', 'move', 'claim', 'attach-rm', 'migrate'].includes(verb)) refuse(`does not ${verb}; the fleet's manager does`);
+  if ((['pause', 'resume'].includes(verb) && !rest[0]) || ['swarm', 'dispatch', 'daemon', 'serve', 'gc', 'repair', 'adopt', 'close', 'set', 'claim', 'attach-rm', 'migrate'].includes(verb)) refuse(`does not ${verb}; the fleet's manager does`);
   if (args.all) refuse(`does not ${verb} every card; only its own`);
   if (['notify-subscribe', 'notify-unsubscribe'].includes(verb) && args['for-card']) {
     if (args['for-card'] !== own.id) refuse(`subscribes only its own arc (--for-card ${own.id})`);
@@ -1205,13 +1206,21 @@ async function serve(root, args = {}) {
       // An installer owns this operational window, not a card pause. Finish the
       // current tick, acknowledge the request, then leave every run untouched.
       // A replacement serve sees the same request before its first tick.
+      // A request whose installer is gone (its pane closed, or it was killed before clearing it) is void.
       const installation = join(root, 'installation-window.json');
-      if (existsSync(installation)) {
-        const request = JSON.parse(readFileSync(installation, 'utf8'));
+      const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
+      const request = existsSync(installation) ? readJson(installation) : null;
+      const installerAlive = (pid) => { try { process.kill(Number(pid), 0); return true; } catch (error) { return error.code === 'EPERM'; } };
+      if (request?.token && request.pid && !installerAlive(request.pid)) {
+        log(`installation window ${request.token} of ${request.owner} is void: its installer ${request.pid} is gone`);
+        for (const path of [installation, join(root, 'installation-window.ack.json')]) if (readJson(path)?.token === request.token) try { unlinkSync(path); } catch { /* gone */ }
+      } else if (request?.token) {
         const acknowledgment = join(root, 'installation-window.ack.json');
-        const previous = existsSync(acknowledgment) ? JSON.parse(readFileSync(acknowledgment, 'utf8')) : null;
+        const previous = readJson(acknowledgment);
         if (previous?.token !== request.token || previous?.pid !== process.pid) {
-          writeFileSync(acknowledgment, JSON.stringify({ token: request.token, pid: process.pid, at: Date.now() }));
+          const temporary = `${acknowledgment}.${process.pid}`;
+          writeFileSync(temporary, JSON.stringify({ token: request.token, pid: process.pid, at: Date.now() }));
+          renameSync(temporary, acknowledgment);
           log(`installation window held by ${request.owner}; dispatch waits`);
         }
         await new Promise(resolve => setTimeout(resolve, 250));

package/board/dispatch.mjs

@@ -19,13 +19,13 @@ import { inspectCompletionEvidence, openReviewPullRequests, reviewDue, withCompl
 import { createRequire } from 'node:module';
 import { spawn as spawnChild, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
-import { hostname, tmpdir } from 'node:os';
+import { hostname, tmpdir, totalmem } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { view, boardPath, claimer, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
+import { view, boardCopyOf, boardPath, claimer, copyRefusal, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
 import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, templateValue, workflowFor } from './workflow.mjs';
-import { checkWorkspace, assertWorkspaceOwner, resolveWorkspace } from './workspace.mjs';
+import { checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace } from './workspace.mjs';
 import { evaluate, holds, render } from './expr.mjs';
 import { identifyNotice } from './notices.mjs';
 import { pendingRequestMail } from './request-mail.mjs';
@@ -123,6 +123,8 @@ export function observeFleet() {
   const presence = machines.code === 0 ? lastJson(machines.stdout) : null;
   const online = new Set([localMachine()]);
   for (const m of presence?.items ?? []) if (m.linked) online.add(normalMachine(m.name));
+  presenceReading = { known: presence?.connected === true, online };
+  notePresence(presenceReading);
   return { ok: true, sessions, alive: new Set(sessions.map((s) => s.address).filter(Boolean)), online,
     presenceKnown: presence?.connected === true, machineEvents: presence,
     error: presence?.connected ? null : 'machine event stream unavailable; retaining existing runs until availability is known' };
@@ -143,6 +145,7 @@ const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ?
 
 /** Native activity comes from the machine's harness discovery, not catalogue age. */
 function nativeSessions(machine, harness) {
+  if (offlineMachine(machine)) throw unavailable(`native liveness unavailable: machine ${normalMachine(machine)} is offline`);
   const result = sc(['discover', '--on', machine, '--harness', harness, '--limit', '2000'], { timeout: 120_000 });
   const page = result.code === 0 ? lastJson(result.stdout) : null;
   if (!Array.isArray(page?.sessions)) throw unavailable(`native liveness unavailable on ${machine}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
@@ -173,13 +176,12 @@ function pidAlive(pid) {
 
 /**
  * Hermes's default for kanban.max_in_progress when none is set: one worker per 512 MiB of the host's memory, between
- * two and eight, from /proc/meminfo; none where that cannot be read (which caps nothing).
+ * two and eight. The memory is the host's own reading (os.totalmem: /proc/meminfo on Linux, hw.memsize on macOS), so
+ * the cap holds on every host, not only where /proc exists.
  */
 function derivedMaxInProgress() {
-  try {
-    const total = Number(/^MemTotal:\s+(\d+)/m.exec(readFileSync('/proc/meminfo', 'utf8'))?.[1]);
-    return Number.isFinite(total) && total > 0 ? Math.max(2, Math.min(Math.floor(total / 1024 / 512), 8)) : null;
-  } catch { return null; }
+  const total = totalmem();
+  return Number.isFinite(total) && total > 0 ? Math.max(2, Math.min(Math.floor(total / 1024 / 1024 / 512), 8)) : null;
 }
 
 /**
@@ -219,6 +221,17 @@ export function lanesOf(profiles = {}) {
 }
 
 const onMachine = machine => normalMachine(machine ?? localMachine()) === localMachine() ? [] : ['--machine', machine];
+// The latest presence reading (observeFleet). A machine it reads as offline is not asked: each remote call would
+// wait out its timeout, and one offline machine held every close and launch on this one.
+let presenceReading = null;
+const offlineMachine = (machine) => {
+  const m = normalMachine(machine ?? localMachine());
+  return m !== localMachine() && presenceReading?.known === true && !presenceReading.online.has(m);
+};
+/** `supercode <args>` for `machine`: on another machine through its Teams server, answered at once when it is offline. */
+const scOn = (machine, args, options) => offlineMachine(machine)
+  ? { code: 1, stdout: '', stderr: `machine ${normalMachine(machine)} is offline` }
+  : sc([...args, ...onMachine(machine)], options);
 const unavailable = message => Object.assign(new Error(message), { launchDeferred: true });
 
 // ------------------------------------------------------------------ supervise
@@ -242,7 +255,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
   for (const { id } of rows) {
     const s = currentRun(board.db, id)?.metadata?.supercode;
     if (!s?.pane || observed.has(s.machine)) continue;
-    const r = sc(['teams', 'panes', 'ls', ...onMachine(s.machine)], { timeout: 60_000 });
+    const r = scOn(s.machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
     const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
     observed.set(s.machine, Array.isArray(list) ? new Set(list.filter(p => !p.dead).map((p) => p.pane)) : null);
     if (!Array.isArray(list)) report.failed.push([id, `pane liveness unavailable; retaining run: ${(r.stderr || r.stdout).trim().slice(-200)}`]);
@@ -357,7 +370,17 @@ function supervise(board, fleet, settings, report, entry, effects) {
       if (session?.session_id) {
         if(exits.has(id)) {
           const exit=exits.get(id);
-          observe('exited',{code:exit.failed?1:0,error:`native session ${session.session_id} ended: ${exit.how}`,session_id:session.session_id,pane:session.pane},'crashed');
+          // an interactive session that ended cleanly was closed (by a person, or by itself): the workflow says what
+          // follows, and it is not a crash to restart
+          const ended = { code: exit.failed ? 1 : 0, error: `native session ${session.session_id} ended: ${exit.how}`, session_id: session.session_id, pane: session.pane };
+          if (!exit.failed) {
+            try {
+              const r = fire(db, board, entry, id, 'session_closed', { roles: ['platform'], payload: ended });
+              effects.push(...r.effects); (report.closed_by_hand ??= []).push(id);
+              return;
+            } catch (error) { if (!error.noTransition) { report.failed.push([id, `session_closed: ${String(error.message).slice(-200)}`]); return; } }
+          }
+          observe('exited', ended, 'crashed');
           return;
         }
         if (session.pane && paneLive === null) return; // no machine reading, no loss verdict
@@ -405,6 +428,7 @@ function limitsOf(db, board, entry, task, session) {
 
 function stopSession(board, session) {
   if (!session) return;
+  if (boardCopyOf()) throw copyRefusal('closes no session');
   if (session.surface === 'headless' && pidAlive(session.pid)) {
     // SIGTERM to the worker's process group, then SIGKILL if it is still there after a grace, as Hermes stops its own
     const signal = (sig) => { try { process.kill(-session.pid, sig); } catch { try { process.kill(session.pid, sig); } catch { /* gone */ } } };
@@ -413,6 +437,7 @@ function stopSession(board, session) {
     if (pidAlive(session.pid)) signal('SIGKILL');
     return;
   }
+  if (session.surface !== 'headless' && offlineMachine(session.machine)) throw new Error(`close deferred: machine ${normalMachine(session.machine)} is offline`);
   if (!session.pane && session.surface === 'native') {
     const r = sc(['close', addressOf(session)], { timeout: 120_000, as: boardAddress(board.label) });
     if (r.code !== 0) throw new Error(`closing native session ${addressOf(session)}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
@@ -527,7 +552,8 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
     if (why) { note(task.id, why); report.queued.push([task.id, why]); continue; }
     if (dry) {
       report.would.push({ id: task.id, status: plan.target, role: plan.runSpec?.role ?? null, assignee: plan.profile, machine: task.machine ?? null, surface: plan.lane.surface });
-      for (const l of limits) if (holds(l.counts, scope)) { const g = JSON.stringify(evaluate(l.group, scope)); l.tally.set(g, (l.tally.get(g) ?? 0) + 1); }
+      // a card this tick starts counts toward its groups (its scope was read before the start, with no run yet)
+      for (const l of limits) { const g = JSON.stringify(evaluate(l.group, scope)); l.tally.set(g, (l.tally.get(g) ?? 0) + 1); }
       continue;
     }
     let moved, checked;
@@ -549,7 +575,7 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
       continue;
     }
     effects.push(...moved.effects);
-    for (const l of limits) if (holds(l.counts, cardScope.get(task.id) ?? scope)) { const g = JSON.stringify(evaluate(l.group, scope)); l.tally.set(g, (l.tally.get(g) ?? 0) + 1); }
+    for (const l of limits) { const g = JSON.stringify(evaluate(l.group, scope)); l.tally.set(g, (l.tally.get(g) ?? 0) + 1); }
     try {
       const session = launchRun(board, entry, task.id, plan.lane, fleet, settings);
       if (session) {
@@ -690,20 +716,17 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         if (reading.alive) {
           const protectedNow = active.some(r => addressOf(json(r.metadata, {})?.supercode) === addressOf(session));
           if (protectedNow) throw new Error('close deferred: native session is owned by an unended run');
-          if (noticeHoldsClose(session, null)) throw new Error(`close deferred: lifecycle notice ${session.lifecycle_notice_pending} has not been filed`);
           stopSession(board, session);
         }
       } else {
       if (!panes.has(machine)) {
-        const r = sc(['teams', 'panes', 'ls', ...onMachine(machine)], { timeout: 60_000, as: boardAddress(board.label) });
+        const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000, as: boardAddress(board.label) });
         const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
         panes.set(machine, Array.isArray(list) ? { live: new Set(list.filter(p => !p.dead).map((p) => p.pane)) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
       }
       const observed = panes.get(machine);
       if (observed.error) throw new Error(observed.error);
       if (observed.live.has(session.pane)) {
-        const pendingNotice = view(board, (db) => db.prepare("SELECT id FROM supercode_effects WHERE json_extract(effect, '$.kind')='session_notice' AND json_extract(effect, '$.runId')=? LIMIT 1").get(row.id));
-        if (noticeHoldsClose(session, pendingNotice)) throw new Error(`close deferred: lifecycle notice ${pendingNotice?.id ?? session.lifecycle_notice_pending} has not been filed: ${session.lifecycle_notice_error ?? 'pending'}`);
         const protectedNow = view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all())
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); });
         if (protectedNow) throw new Error(`close deferred: pane ${session.pane} is owned by an unended run`);
@@ -800,9 +823,10 @@ export async function sessionNotice(board, e) {
   const prior = view(board, (db) => json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(e.runId)?.metadata, {})?.supercode);
   if (prior?.close_confirmed_at) {
     tx(board, (db) => {
+      // A closed session has nothing to be told; its next run starts with its own prompt.
       const unissued = unissuedLaunch(prior.launch_cancellation, prior);
-      event(db, e.id, unissued ? 'session_notice_not_required' : 'session_notice_failed', { address: e.address, verb: e.verb, notice: e.durableId,
-        error: unissued ? 'machine confirmed launch was not issued; no session exists to notify' : 'session closure already confirmed; notice cannot be delivered', retry: false,
+      event(db, e.id, 'session_notice_not_required', { address: e.address, verb: e.verb, notice: e.durableId,
+        reason: unissued ? 'machine confirmed launch was not issued; no session exists to notify' : 'session closed',
         ...(unissued ? { receipt: prior.launch_cancellation } : {}) }, e.runId);
       if (prior.lifecycle_notice_pending === e.durableId) setRunSession(db, e.runId, { lifecycle_notice_pending: null });
     });
@@ -820,19 +844,13 @@ export async function sessionNotice(board, e) {
   tx(board, (db) => {
     const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(e.runId)?.metadata, {})?.supercode;
     if (session) setRunSession(db, e.runId, { ...session,
-      ...(error ? { lifecycle_notice_error: error, lifecycle_notice_failures: Number(session.lifecycle_notice_failures ?? 0) + 1 }
-        : { lifecycle_notice_error: null, lifecycle_notice_failures: 0, ...(session.lifecycle_notice_pending === e.durableId ? { lifecycle_notice_pending: null } : {}) }) });
+      ...(error ? { lifecycle_notice_error: error }
+        : { lifecycle_notice_error: null, ...(session.lifecycle_notice_pending === e.durableId ? { lifecycle_notice_pending: null } : {}) }) });
     if (!error || session?.lifecycle_notice_error !== error) event(db, e.id, error ? 'session_notice_failed' : receipt?.delivered ? 'session_notice_delivered' : 'session_notice_queued', { address: e.address, verb: e.verb, source_event: e.sourceEvent, notice: e.durableId, receipt, ...(error ? { error, retry: true } : {}) }, e.runId);
   });
   return !error;
 }
 
-// A close waits for its run's lifecycle notice to be filed, but not past this many failed
-// attempts: an unreachable session must not hold its pane, and its slot's next launch, forever.
-const NOTICE_ATTEMPTS_BEFORE_CLOSE = 3;
-const noticeHoldsClose = (session, pending) => Boolean(pending || session.lifecycle_notice_pending)
-  && Number(session.lifecycle_notice_failures ?? 0) < NOTICE_ATTEMPTS_BEFORE_CLOSE;
-
 /** A session effect a committed move asked for: a message to the card's current actor, or closing a slot's pane. */
 export async function sessionEffect(board, e) {
   if (e.kind === 'send_to_actor') {
@@ -898,8 +916,16 @@ const BLOCKER = /\b(quota|rate[\s_-]?limit|429|403|auth\w*|unauthorized|forbidde
 const PR_URL = /https?:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/\d+/i;
 
 
-/** This machine's memory pressure as Hermes reads it (Linux's MemAvailable; `unknown` elsewhere, which restricts nothing). */
+/**
+ * This machine's memory pressure: on Linux as Hermes reads it (MemAvailable); on macOS the kernel's own level
+ * (kern.memorystatus_vm_pressure_level: 1 normal, 2 warning, 4 critical); `unknown` elsewhere, which restricts nothing.
+ */
 function memoryPressure() {
+  if (process.platform === 'darwin') {
+    const r = spawnSync('sysctl', ['-n', 'kern.memorystatus_vm_pressure_level'], { encoding: 'utf8', timeout: 5_000 });
+    const level = Number(String(r.stdout ?? '').trim());
+    return level >= 4 ? 'critical' : level >= 2 ? 'elevated' : level === 1 ? 'ok' : 'unknown';
+  }
   try {
     const info = Object.fromEntries(readFileSync('/proc/meminfo', 'utf8').split('\n').map((l) => /^(\w+):\s+(\d+)/.exec(l)).filter(Boolean).map((m) => [m[1], Number(m[2])]));
     const avail = info.MemAvailable;
@@ -937,7 +963,7 @@ const getTaskNow = (board, id) => view(board, (db) => getTask(db, id));
 
 /** A transport error is not a negative launch receipt. The key remains owned by its run. */
 function launchReceipt(board, session) {
-  const r = sc(['teams', 'launches', 'get', session.launch_key, ...onMachine(session.machine)],
+  const r = scOn(session.machine, ['teams', 'launches', 'get', session.launch_key],
     { timeout: 30_000, as: boardAddress(board.label) });
   if (r.code !== 0) throw unavailable(`launch receipt unavailable on ${session.machine}: install the matching Teams CLI and machine capability (teams launches get): ${(r.stderr || r.stdout).trim().slice(-300)}`);
   if (r.stdout.trim() === 'null') return null;
@@ -947,7 +973,7 @@ function launchReceipt(board, session) {
 }
 
 function cancelUnissuedLaunch(board, session) {
-  const result = sc(['teams', 'launches', 'cancel', session.launch_key, ...onMachine(session.machine)],
+  const result = scOn(session.machine, ['teams', 'launches', 'cancel', session.launch_key],
     { timeout: 30_000, as: boardAddress(board.label) });
   if (result.code !== 0) throw unavailable(`launch cancellation unavailable on ${session.machine}; retain ${session.launch_key}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
   const receipt = lastJson(result.stdout);
@@ -1112,7 +1138,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   if (prev?.session_id && !prev.forgotten && (prev.harness ?? 'claude-code') === harness && prev.machine === machine) {
     const fresh = observeFleet();
     if (!fresh.ok) throw unavailable(`cannot check for a manual continuation of ${prev.session_id}: ${fresh.error}`);
-    const r = sc(['teams', 'panes', 'ls', ...onMachine(machine)], { timeout: 60_000 });
+    const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
     const listed = r.code === 0 ? json(r.stdout.trim(), null) : null;
     if (!Array.isArray(listed)) throw unavailable(`cannot read panes before continuing ${prev.session_id}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
     const pane = continuationPane(fresh, prev, new Set(listed.filter(p => !p.dead).map((p) => p.pane)));
@@ -1245,7 +1271,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
 
 /** A machine reading, not a missing catalog entry, establishes whether a pane is alive. */
 function panePresent(machine, pane) {
-  const r = sc(['teams', 'panes', 'ls', ...onMachine(machine)], { timeout: 60_000 });
+  const r = scOn(machine, ['teams', 'panes', 'ls'], { timeout: 60_000 });
   const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
   if (!Array.isArray(panes)) throw unavailable(`cannot establish pane ${pane} liveness on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
   return panes.some((p) => p.pane === pane && !p.dead);
@@ -1322,14 +1348,40 @@ function resolveLocalWorkspace(board, task) {
  * never as the session describes itself. From then on the board watches it, resumes it when lost, and tells it of
  * its card. `who` is an address, a session id, or a `name@machine` the fleet lists.
  */
-export function adoptSession(board, id, who, { workspace = null, ttl, assignee = null, role = null } = {}) {
-  // Hold before discovery or any other process I/O: a failed attachment remains
-  // visible and cannot race a dispatcher into launching a replacement worker.
+/**
+ * The manager asks the board to adopt session `who` for card `id`: the card is held at once (no replacement can be
+ * launched), and the dispatcher's next tick verifies the session from the fleet reading it already takes and binds
+ * it (`completeAdoptions`). The verb does no process I/O, so it answers as fast as any board write.
+ */
+export function requestAdoption(board, id, who, { workspace = null, assignee = null, role = null } = {}) {
+  if (!who) throw new Error('name the session to adopt');
+  if (boardCopyOf()) throw copyRefusal('adopts no session');
   tx(board, db => {
     if (!getTask(db, id)) throw new Error(`no card ${id}`);
-    event(db, id, 'dispatch_held', { session: who, reason: 'adoption requested' });
+    event(db, id, 'dispatch_held', { session: who, reason: 'adoption requested', workspace, assignee, role });
   });
-  const fleet = observeFleet();
+}
+
+/** Adoptions the manager requested and no tick has answered yet, completed from this tick's fleet reading. */
+export function completeAdoptions(board, fleet, settings, report) {
+  const pending = view(board, db => db.prepare(`SELECT e.task_id, e.payload FROM task_events e WHERE e.kind = 'dispatch_held'
+    AND json_extract(e.payload, '$.reason') = 'adoption requested'
+    AND e.id = (SELECT MAX(id) FROM task_events l WHERE l.task_id = e.task_id AND l.kind IN ('dispatch_held','dispatch_released','session_adopted','adoption_failed'))`).all());
+  for (const row of pending) {
+    const asked = json(row.payload, {}) ?? {};
+    try {
+      const got = adoptSession(board, row.task_id, asked.session, { workspace: asked.workspace ?? null, assignee: asked.assignee ?? null, role: asked.role ?? null, ttl: settings.ttl, fleet: fleet?.ok ? fleet : null });
+      (report.adopted ??= []).push([row.task_id, got.address]);
+    } catch (error) {
+      const message = String(error.message).slice(-400);
+      tx(board, db => event(db, row.task_id, 'adoption_failed', { session: asked.session, error: message }));
+      report.failed.push([row.task_id, `adoption of ${asked.session}: ${message}`]);
+    }
+  }
+}
+
+function adoptSession(board, id, who, { workspace = null, ttl, assignee = null, role = null, fleet = null } = {}) {
+  fleet ??= observeFleet();
   if (!fleet.ok) throw new Error(`supercode could not read the fleet: ${fleet.error}`);
   const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who);
   if (!found) throw new Error(`the fleet lists no live session ${who}`);
@@ -1392,6 +1444,7 @@ export function adoptSession(board, id, who, { workspace = null, ttl, assignee =
 
 // a notice sent within a transaction's caller that cannot await (the launcher): the same door, synchronously
 function deliverNow(board, to, body, key) {
+  if (boardCopyOf()) throw copyRefusal('sends no notice to sessions');
   const request = { op: 'send', from: boardAddress(board.label), from_name: `${board.label} board`, to, queue: false, id: key, subject: String(body).split('\n')[0].slice(0, 160),
     body: `[Board notice from the ${board.label} board] ${body}\n\n(An automated notice from the board's dispatcher; replies to this address go nowhere.)` };
   const r = sc(['message', 'remote-deliver'], { input: JSON.stringify(request), timeout: 120_000 });
@@ -1401,6 +1454,7 @@ function deliverNow(board, to, body, key) {
 }
 
 async function send(from, label, to, body, key, { queue = false, ask = false, subject } = {}) {
+  if (boardCopyOf()) throw copyRefusal('sends no mail to sessions or managers');
   const request = {
     op: 'send', from, from_name: `${label} board`, to, queue, id: key, subject: String(subject ?? String(body).split('\n')[0]).slice(0, 160),
     // a question the board waits on is answered by a reply; a notice is not
@@ -1432,7 +1486,7 @@ export async function sendBoardMessages(board, report, taskId = null) {
       const task = view(board, db => getTask(db, first.task_id));
       const subject = mail.requester ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`;
       const receipt = await send(boardAddress(board.label), board.label, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
-      if (!receipt.delivered) throw new Error(receipt.reason ?? 'queued; native transcript confirmation pending');
+      if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'message was not filed');
       tx(board, db => {
         for (const member of mail.members) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, receipt, ...(mail.message_id ? { message_id: mail.message_id, request_id: member.message_id ?? mail.message_id } : {}) });
       });
@@ -1510,11 +1564,23 @@ async function notify(board, fleet, report, entry) {
     if (!events.length) return;
     // the card as the workflow names it (its status the workflow's: triaging, reviewing, stopped; `stored_as` kanban.db's)
     const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, status: statusOf(db, t), stored_as: t.status } : t; });
+    // a worker whose run has ended is not woken by a notice (a second session would start working the card beside
+    // the one the next run gets): the notice is filed in its mailbox, read when it next works
+    const working = role !== 'worker' || view(board, (db) => addressOf(currentRun(db, sub.task_id)?.metadata?.supercode) === sub.chat_id);
+    // An idle Claude session cannot hold a notice in its mailbox (it starts a turn for every message it is given), so
+    // a notice that must not wake it waits, unsent, for the session's next work.
+    if (!working && fleet.ok && fleet.sessions.some((s) => s.address === sub.chat_id && s.harness === 'claude-code' && s.status === 'idle')) {
+      report.notices_waiting = (report.notices_waiting ?? 0) + 1;
+      return;
+    }
     let cursor = Number(sub.last_event_id);
-    let failed = null, pending = false;
+    let failed = null;
     try {
+      // an event older than the workflow's notice_max_age_seconds is history, not news: it is passed over, never mailed
+      const maxAge = Number(entry.params.notice_max_age_seconds) || null;
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
+        if (maxAge && now() - Number(ev.created_at) > maxAge) { cursor = ev.id; (report.stale_notices_passed ??= 0); report.stale_notices_passed += 1; continue; }
         // nobody is told of their own act
         if (p.by && p.by === sub.chat_id) { cursor = ev.id; continue; }
         let text;
@@ -1525,9 +1591,11 @@ async function notify(board, fleet, report, entry) {
         } else text = noticeOf(entry, role, ev.kind, task, p);
         if (text) {
           const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
-          const receipt = await send(from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: !entry.workflow.run && sub.delivery_mode === 'notify', subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
-          if (!receipt.delivered) { pending = Boolean(receipt.queued); throw new Error(receipt.reason ?? 'native delivery confirmation pending'); }
-          tx(board, (db) => event(db, sub.task_id, 'notice_delivered', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }));
+          const receipt = await send(from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: !working || (!entry.workflow.run && sub.delivery_mode === 'notify'), subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
+          // A notice the recipient's mailbox took is filed: the machine delivers it at the session's next turn, so the
+          // board does not send it again.
+          if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'notice was not filed');
+          tx(board, (db) => event(db, sub.task_id, receipt.delivered ? 'notice_delivered' : 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }));
           report.notified.push([sub.task_id, ev.kind, sub.chat_id]);
         }
         cursor = ev.id;
@@ -1535,10 +1603,11 @@ async function notify(board, fleet, report, entry) {
     } catch (error) {
       failed = String(error.message).slice(-200);
       tx(board, (db) => {
-        const kind = pending ? 'notice_queued' : 'notice_failed';
+        const kind = 'notice_failed';
         const previous = db.prepare('SELECT payload FROM task_events WHERE task_id=? AND kind=? ORDER BY id DESC LIMIT 1').get(sub.task_id, kind);
         const payload = { after_event: cursor, address: sub.chat_id, error: failed, retry: true };
-        if (JSON.stringify(json(previous?.payload, {})) !== JSON.stringify(payload)) event(db, sub.task_id, kind, payload);
+        const { by: _, ...said } = json(previous?.payload, {}) ?? {};
+        if (JSON.stringify(said) !== JSON.stringify(payload)) event(db, sub.task_id, kind, payload);
       });
       report.undelivered.push([sub.task_id, sub.chat_id, failed]);
     }
@@ -1547,7 +1616,7 @@ async function notify(board, fleet, report, entry) {
       const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
       const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
       db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(cursor, ...identity, cursor);
-      const failures = failed && !pending ? Number(sub.delivery_metadata?.failures ?? 0) + 1 : 0;
+      const failures = failed ? Number(sub.delivery_metadata?.failures ?? 0) + 1 : 0;
       if (failures >= MAX_SEND_FAILURES) { db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity); return; }
       if (failures !== Number(sub.delivery_metadata?.failures ?? 0)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures }), ...identity);
       if (task?.status === 'archived' && cursor >= events.at(-1).id) db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity);
@@ -1805,11 +1874,16 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
     const ready = view(board, eligible);
     if (!ready) continue;
     if (ready !== true) { report.queued.push([id, `review waits: ${ready.length} open task(s) in the card's Tasks: ${ready[0].id} ${ready[0].title}`]); continue; }
+    let payload = null;
     try {
-      const payload = openReviewPullRequests(board, id);
+      payload = openReviewPullRequests(board, id);
       // The arc's open PRs ask for one review only while some head has no verdict: after changes are
       // requested the next run is the implementer's, until a new head is pushed.
-      if (!payload || !reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) continue;
+      if (!payload) { report.queued.push([id, 'review waits: no open PR on its branch, a wt/<card> branch or a registered checkout']); continue; }
+      if (!reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
+        report.queued.push([id, `review waits: every open PR head (${payload.pr.join(', ')}) has a verdict or predates the last one; push a commit that answers it`]);
+        continue;
+      }
       const evidence = inspectCompletionEvidence(board, id, entry, payload, 'request_review');
       if (!evidence.ready) throw new Error(evidence.reason);
       refreshCardInputs(board, id, { commits: true });
@@ -1824,7 +1898,7 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
         effects.push(...moved.effects);
         (report.review_requested ??= []).push({ id, prs: payload.pr, heads: payload.pr_head });
       }
-    } catch (error) { report.queued.push([id, `PR review waits: ${error.message}`]); }
+    } catch (error) { report.queued.push([id, `PR review waits${payload ? ` (${payload.pr.join(', ')})` : ''}: ${error.message}`]); }
   }
 }
 
@@ -1856,6 +1930,8 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
     const path = boardPath(root, slug);
     const marker = `${path}.corrupt-seen`;
     if (existsSync(marker) && readFileSync(marker, 'utf8').trim() === fingerprint(path)) { report.error = 'skipped: the board file was corrupt and has not changed since (`supercode workflow repair`)'; out.push(report); continue; }
+    // a copy of a home dispatches nothing: its runs, sessions and managers are the original's
+    if (boardCopyOf()) { report.error = `skipped: ${copyRefusal('starts, supervises, adopts and mails nothing').message}`; out.push(report); continue; }
     let board;
     try {
       board = openBoard(root, slug);
@@ -1872,7 +1948,7 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       readMailbox(board, boardAddress(board.label), report); phase('mailbox');
       await refreshRelationAnswers(board); phase('answers');
       const effects = [];
-      reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); await runEffects(board, effects.splice(0), { retryNotices: true }); closeRequested(board, report); phase('supervise');
+      completeAdoptions(board, fleet, settings, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); await runEffects(board, effects.splice(0), { retryNotices: true }); closeRequested(board, report); phase('supervise');
       report.unsettled = [];
       report.promoted = recomputeReady(board, effects, report.unsettled);
       if (dispatch) await activatePullRequestReviews(board, entry, report, effects, { only });

package/board/engine.mjs

@@ -214,6 +214,11 @@ export function createCard(board, spec) {
     if (arc?.subtask_of) throw new Error(`${arc.id} is itself a subtask of ${arc.subtask_of}; a subtask belongs to an arc`);
     let id = newTaskId();
     while (one(db, 'SELECT 1 FROM tasks WHERE id = ?', id)) id = newTaskId();
+    // where a card's blocks are relations, a card created blocked names what it waits on: one that names nothing is
+    // ready at once (board-ir-2 started six minutes after it was created "blocked")
+    if (initial === 'blocked' && !entry.workflow.statuses?.blocked && !parents.length) {
+      throw new Error('A card created blocked names what it waits on: --parent <card> (it starts when that card is done); or create it and block it with --waiting-on <message>.');
+    }
     const creationRoles = workflowFor(board.root).params.create_dependencies_by;
     if ((parents.length || initial === 'blocked') && creationRoles && !callerRoles(db, arc?.id ?? id).some(role => creationRoles.includes(role))) {
       throw new Error('Creating a dependency or initially blocked card requires a permitted manager role; file the task without a blocker and use request-state.');
@@ -279,8 +284,20 @@ function wouldCycle(db, parent, child) {
 
 
 
-/** The machine a card's session runs on. Moving it is a decision: a running card is reclaimed first. */
-export const setMachine = (board, id, machine, { roles } = {}) => act(board, id, 'move', { roles, payload: { machine: machine || null } });
+/**
+ * Set one of a card's properties (`assignee`, `machine`, `model`, `every`) through the workflow's `set` verb, whose
+ * rules say who may and what follows: a change to how its session runs ends a live run and lets the dispatcher start
+ * the next one itself. A workflow without `set` (Hermes's own) has a verb per property.
+ */
+export const SETTABLE = ['assignee', 'machine', 'model', 'every'];
+export function set(board, id, field, value, { provider = null, roles } = {}) {
+  if (!SETTABLE.includes(field)) throw new Error(`set takes one of ${SETTABLE.join(', ')}, not ${field}`);
+  if (provider && (field !== 'model' || !value)) throw new Error('a provider goes with a model');
+  value = value || null;
+  if (workflowFor(board.root).workflow.verbs?.set) return act(board, id, 'set', { roles, payload: { field, value, provider } });
+  const verb = { assignee: ['assign', { assignee: value }], machine: ['move', { machine: value }], model: ['set_model', { model: value, provider }], every: ['set_every', { every: value }] }[field];
+  return act(board, id, verb[0], { roles, payload: verb[1] });
+}
 
 // ------------------------------------------------------------------ lifecycle
 
@@ -545,12 +562,7 @@ export async function specify(board, id, { title = null, body = null, workspace
 }
 export const editResult = (board, id, { result, summary = null, metadata = undefined, roles } = {}) => act(board, id, 'edit', { roles, payload: { result, summary, metadata } });
 export const heartbeat = (board, id, note = null, { roles, until = null } = {}) => act(board, id, 'heartbeat', { roles, payload: { note, until } });
-export const setModel = (board, id, model = null, provider = null, { roles } = {}) => {
-  if (provider && !model) throw new Error('a provider needs a model');
-  return act(board, id, 'set_model', { roles, payload: { model: model || null, provider: provider || null } });
-};
 export const setGoal = (board, id, { on = true, maxTurns = null, roles } = {}) => act(board, id, 'set_goal', { roles, payload: { goal: Boolean(on), max_turns: on ? maxTurns : null } });
-export const assign = (board, id, profile, { roles } = {}) => act(board, id, 'assign', { roles, payload: { assignee: profile || null } });
 
 /** A triage card fans out into children it waits on (Hermes's decomposer); answers their ids. */
 export async function decompose(board, id, children, { author = 'user', roles } = {}) {

package/board/store.mjs

@@ -10,7 +10,7 @@
 // are in `engine.mjs`. Hermes's own tools may write a `kanban.db` at the same time: every write there takes SQLite's
 // native transaction boundary and retries an optimistic conflict.
 import { randomBytes } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
@@ -142,7 +142,23 @@ export function layOut(db, { fresh }) {
  * Open (creating when `create`, in `backing`) board `slug`: `{ db, root, slug, path, backing, tx, close }`. `db` answers
  * SQLite's statement API (`prepare(sql).get|all|run`, `exec`) whatever the backing.
  */
+// A home records where it was made (`.board-origin` at its root). A copy of the home carries that record elsewhere and
+// is a copy: it may be read and written, but it addresses no session and no manager, which are the original's.
+let copyOfHome = null;
+/** The original home's path when the board opened last is a copy of it; null for a home of its own. */
+export const boardCopyOf = () => copyOfHome;
+export const copyRefusal = (what) => new Error(`this board is a copy of the home at ${copyOfHome}; it ${what}, which belong to the original`);
+function noteOrigin(root) {
+  if (!existsSync(root)) return;
+  const here = realpathSync(root), file = join(root, '.board-origin');
+  let origin = null;
+  try { origin = JSON.parse(readFileSync(file, 'utf8')).root ?? null; } catch { /* none yet */ }
+  if (!origin) { writeFileSync(file, `${JSON.stringify({ root: here })}\n`); origin = here; }
+  copyOfHome = origin === here ? null : origin;
+}
+
 export function openBoard(root, slug = DEFAULT_BOARD, { create = false, backing = null, document = null } = {}) {
+  noteOrigin(root);
   const kept = backingOf(root, slug);
   if (!kept && !create) throw new Error(`no board ${slug} in ${root} (${boardPath(root, slug)})`);
   if (kept && backing && kept !== backing) throw new Error(`board ${slug} in ${root} is kept by the ${kept} backing, not ${backing}`);

package/board/tools.mjs

@@ -132,8 +132,11 @@ export async function boardTool(root, name, args = {}, env = {}) {
       }
       case 'kanban_request_changes': {
         const stale = ownRun(); if (stale) return error(stale);
+        // each finding is filed as a task on the arc first, so the arc stays open until a pushed head fixes it
+        const findings = [].concat(args.findings ?? []).map((f) => redact(String(f)).trim()).filter(Boolean);
+        const filed = findings.map((finding) => engine.createCard(board, { title: finding, subtaskOf: tid }).id);
         await engine.requestChanges(board, tid, { reason: args.reason ? redact(String(args.reason)) : null, reviewer: author });
-        return ok({ task_id: tid });
+        return ok({ task_id: tid, findings: filed });
       }
       case 'kanban_heartbeat': {
         const stale = ownRun(); if (stale) return error(stale);

package/board/workflow.mjs

@@ -583,7 +583,7 @@ const FORMAT = {
   commented: ({ e }) => ({ author: String(e.author ?? 'user').trim(), len: String(e.body ?? '').length }),
   archived: () => null,
   status: ({ e, before, to }) => ({ status: to, reason: e.reason ?? 'reopened', previous_status: before.stored_as }),
-  machine_set: ({ e, before }) => ({ machine: e.machine ?? null, was: before.machine }),
+  machine_set: ({ e, before }) => ({ machine: e.field === 'machine' ? e.value ?? null : e.machine ?? null, was: before.machine }),
 };
 const RETRY_KINDS = new Set(['crashed', 'timed_out', 'stale', 'rate_limited', 'session_lost', 'reclaimed', 'reconciled', 'spawn_failed']);
 
@@ -806,29 +806,15 @@ const ACTIONS = {
     const name = String(typeof slot === 'object' && slot ? slot.slot ?? 'worker' : slot ?? 'worker');
     const harness = typeof slot === 'object' && slot ? ctx.entry.profiles[slot.assignee]?.worker?.harness : null;
     if (typeof slot === 'object' && slot && !harness) return;
-    const released = new Set();
     for (const row of all(ctx.db, 'SELECT id, metadata FROM task_runs WHERE task_id = ? AND metadata IS NOT NULL ORDER BY id DESC', ctx.id)) {
       const whole = json(row.metadata, {}) ?? {};
       const session = whole.supercode;
       if ((!session?.session_id && !session?.pane && !session?.launch_key) || (name !== '*' && (session.slot ?? 'worker') !== name) || (harness && (session.harness ?? 'claude-code') === harness)) continue;
       requestSessionClose(ctx.db, ctx.id, { runId: row.id });
       const latest = json(one(ctx.db, 'SELECT metadata FROM task_runs WHERE id=?', row.id)?.metadata, {}) ?? {};
-      if (session.session_id) released.add(session.session_id);
       latest.supercode = { ...latest.supercode, forgotten: now(), resumable: false };
       run(ctx.db, "UPDATE task_runs SET metadata=?, ended_at=COALESCE(ended_at,?), status=CASE WHEN ended_at IS NULL THEN 'superseded' ELSE status END, outcome=CASE WHEN ended_at IS NULL THEN 'superseded' ELSE outcome END, claim_lock=NULL,claim_expires=NULL,worker_pid=NULL WHERE id=?", JSON.stringify(latest), now(), row.id);
     }
-    const gaveUp = one(ctx.db, "SELECT created_at,payload FROM task_events WHERE task_id=? AND kind='gave_up' ORDER BY id DESC LIMIT 1", ctx.id);
-    const failures = Number(json(gaveUp?.payload, {})?.failures ?? 0);
-    if (!failures || !released.size) return;
-    const recent = all(ctx.db, 'SELECT outcome,metadata FROM task_runs WHERE task_id=? AND ended_at<=? ORDER BY id DESC LIMIT ?', ctx.id, gaveUp.created_at, failures);
-    if (recent.length !== failures || !recent.every(row => {
-      const failure = json(row.metadata, {})?.last_events?.spawn_failed?.payload;
-      return row.outcome === 'spawn_failed' && failure?.resume_failed === true && released.has(failure.session_id);
-    })) return;
-    const blocks = json(one(ctx.db, 'SELECT blocked_by FROM supercode_cards WHERE task_id=?', ctx.id)?.blocked_by, []);
-    for (const block of blocks.filter(block => block.kind === 'message' && block.reason === 'failure limit reached' && block.since === gaveUp.created_at))
-      ACTIONS.relation(ctx, { remove: block.id, reason: 'The manager released the session responsible for these stale continuation failures.' });
-    run(ctx.db, 'UPDATE tasks SET consecutive_failures=0,last_failure_error=NULL WHERE id=?', ctx.id);
   },
   // an event sent to other cards (`to`: an expression naming their ids, e.g. a card's open subtasks), as `as` sends it;
   // a card it does not apply to now is passed over
@@ -1012,15 +998,21 @@ function settleRelations(db, board, entry, id, effects) {
     if (!json(one(db, 'SELECT blocked_by FROM supercode_cards WHERE task_id = ?', id)?.blocked_by, []).some((b) => b.id === block.id)) continue;
     const dependency = block.kind === 'card' ? one(db, 'SELECT * FROM tasks WHERE id = ?', block.id) : null;
     const status = dependency ? statusOf(db, dependency) : null;
-    const answer = block.kind === 'message' ? answerTo(block.id) : null;
+    // an answer is handed to the workflow once; the block stays until a verb lifts it
+    const answer = block.kind === 'message' && !block.answered ? answerTo(block.id) : null;
     const policy = entry.workflow.relations.blocked_by;
     const name = answer ? policy.answered : status === 'done' ? policy.completed : status === 'cancelled' ? policy.cancelled : null;
+    if (answer) {
+      const current = json(one(db, 'SELECT blocked_by FROM supercode_cards WHERE task_id = ?', id)?.blocked_by, []);
+      run(db, 'UPDATE supercode_cards SET blocked_by = ? WHERE task_id = ?', JSON.stringify(current.map((b) => b.id === block.id ? { ...b, answered: answer } : b)), id);
+    }
     if (name) effects.push(...fire(db, board, entry, id, name, { roles: ['platform'], payload: { on: block.id, reason: answer ? `reply ${answer}` : `${block.id} ${status}` } }).effects);
-    else if (policy.aged && policy.age_seconds != null) {
+    // a block that has aged is told once, not every age interval for as long as it lasts
+    else if (policy.aged && policy.age_seconds != null && !block.aged_at) {
       const seconds = Number(evaluate(String(policy.age_seconds), { params: entry.params }));
       if (seconds > 0 && now() - Number(block.notified_at ?? block.since ?? now()) >= seconds) {
         const current = json(one(db, 'SELECT blocked_by FROM supercode_cards WHERE task_id = ?', id)?.blocked_by, []);
-        run(db, 'UPDATE supercode_cards SET blocked_by = ? WHERE task_id = ?', JSON.stringify(current.map((b) => b.id === block.id ? { ...b, notified_at: now() } : b)), id);
+        run(db, 'UPDATE supercode_cards SET blocked_by = ? WHERE task_id = ?', JSON.stringify(current.map((b) => b.id === block.id ? { ...b, aged_at: now() } : b)), id);
         effects.push(...fire(db, board, entry, id, policy.aged, { roles: ['platform'], payload: { on: block.id, reason: block.reason } }).effects);
       }
     }

package/board/workspace.mjs

@@ -5,7 +5,13 @@ import { basename, dirname } from 'node:path';
 import { Workspaces, inspectCheckout, repositoryId, teamsHome } from '@volter/supercode-teams/workspaces';
 import { localMachine, normalMachine, supercodeBin, commandEnv } from './dispatch.mjs';
 export const isWorkspacePath = value => /^(\/|~|[A-Za-z]:[\\/])/.test(value ?? '');
+// The dispatcher's latest presence reading (observeFleet): a machine it reads as offline is not asked.
+let presence = null;
+export const notePresence = (reading) => { presence = reading; };
 function workspaceDoor(machine, verb, value, options = {}) {
+  if (machine && presence?.known === true && normalMachine(machine) !== localMachine() && !presence.online.has(normalMachine(machine))) {
+    throw new Error(`workspace on ${machine}: machine ${normalMachine(machine)} is offline`);
+  }
   if (!machine || normalMachine(machine) === localMachine()) {
     const map = new Workspaces(teamsHome());
     if (verb === 'inspect') return inspectCheckout(value);

package/board/ztrack.mjs

@@ -70,8 +70,13 @@ class ZtrackBoard {
     this.seed = seed; this.root = root; this.slug = slug; this.init = init; this.compatPath = compatPath;
     this.file = `${marker}.board.db`;
     mkdirSync(dirname(this.path), { recursive: true });
-    if (!existsSync(this.file)) this.create(`${marker}.runtime.db`);
+    const legacy = `${marker}.runtime.db`;
+    // A 0-byte file is no store: a read through the sqlite3 CLI creates one at a path that has none (on 2026-10-01 a
+    // `sqlite3 <store> "select …"` made the empty file the next release then opened instead of importing).
+    if (existsSync(this.file) && statSync(this.file).size === 0) unlinkSync(this.file);
+    if (!existsSync(this.file)) this.create(legacy);
     this.conn = new DatabaseSync(this.file);
+    this.refuseUnimported(legacy);
     this.errors = new Map(); this.statements = new Map(); this.hashes = new Map();
     this.active = false; this.overlay = false; this.seen = null;
     this.prepareConnection();
@@ -146,6 +151,24 @@ class ZtrackBoard {
     }
   }
 
+  // A store holding fewer runs than the earlier store beside it was made without the one-time import (on 2026-10-01
+  // one such store, created by an opener nobody named, sent the dispatcher on to start a second session on every
+  // running card). The board refuses it, so nothing runs on a board without its history.
+  refuseUnimported(legacy) {
+    if (!existsSync(legacy)) return;
+    const here = this.conn.prepare('SELECT COUNT(*) AS n FROM main.task_runs').get().n;
+    let runs = 0;
+    const old = new DatabaseSync(legacy, { readOnly: true });
+    try {
+      if (old.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'runtime_rows'").get()) {
+        runs = old.prepare("SELECT COUNT(*) AS n FROM runtime_rows WHERE name = 'task_runs' AND value IS NOT NULL").get().n;
+      }
+    } finally { old.close(); }
+    if (here >= runs) return;
+    this.conn.close();
+    throw new Error(`${this.file} holds ${here} runs, but ${legacy} holds ${runs}: it was created without importing them. Move it aside (keep it; writes made to it are not in the earlier store) and run any board command to import.`);
+  }
+
   // A board created from the previous runtime store imports its rows once; the old file stays as it was.
   create(legacy) {
     const tmp = `${this.file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;

package/cron.mjs

@@ -750,18 +750,24 @@ function firePrompt(job) {
   return job.prompt ?? '';
 }
 
+// supercode's normal machine name (session addresses spell a machine this way)
+const machineName = (name) => String(name ?? '').split('.')[0].toLowerCase().replace(/[^a-z0-9_-]/g, '-');
+
 function startFire(state, profile, job, now, effects) {
   const fire = claimFire(profile, job, now);
   if (!fire) return;
   effects.push({ type: 'save' }); // the claim is durable before anything runs (at-most-once)
-  if (state.runtime?.hostedJobs) {
+  // A job that names another machine runs each fire in a session there: the loop launches it on that machine, and the
+  // launch's receipt finishes the fire as a host's would.
+  const remote = job.machine && state.runtime?.machine && machineName(job.machine) !== state.runtime.machine ? machineName(job.machine) : null;
+  if (state.runtime?.hostedJobs || remote) {
     fire.started_at = now;
     fire.status = 'running';
     fire.session_id = null; // a host callback is not a fabricated native worker session
     fire.residue = { execution: 'host_task' };
     state.runtime.hostedFires[`${profile.name}:${fire.id}`] = true;
     effects.push({ type: 'save' });
-    effects.push({ type: 'execute_job', profile: profile.name, job_id: job.id, fire_id: fire.id });
+    effects.push({ type: 'execute_job', profile: profile.name, job_id: job.id, fire_id: fire.id, ...(remote ? { machine: remote } : {}) });
     return;
   }
   // A gate (a script, a monitor source) runs before any model, off the event

package/loop.mjs

@@ -23,6 +23,9 @@ import { performRemoveProfileDir } from './operator.mjs';
 import { harnessHomes } from './mcp/verbs.mjs';
 import { checkMonitor, runJobScript } from './gates.mjs';
 import { startBoard } from './board.mjs';
+import { localMachine } from './board/dispatch.mjs';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 
 /**
  * Where a worker keeps its transcripts inside its config home (`<profile>/<harness>`), as discovery and
@@ -54,6 +57,7 @@ export class Orchestrator {
     this.hostedTasks = new Set();
     state.runtime ??= {};
     state.runtime.hostedJobs = !!executeJob;
+    state.runtime.machine = localMachine(); // a job naming another machine fires there (cron.mjs startFire)
     state.runtime.hostedFires = {};
     this.vault = vault;
     this.client = client;
@@ -263,12 +267,12 @@ export class Orchestrator {
     }
   }
 
-  executeHostedJob({ profile: name, job_id, fire_id }) {
+  executeHostedJob({ profile: name, job_id, fire_id, machine = null }) {
     const profile = this.state.profiles[name];
     const job = structuredClone(profile.jobs[job_id]);
     const fire = structuredClone(profile.fires.find((f) => f.id === fire_id));
     // Host work never blocks the state queue; completion returns as an event.
-    const task = Promise.resolve().then(() => this.executeJob({ profile: name, job, fire }))
+    const task = Promise.resolve().then(() => machine ? this.launchRemoteFire({ profile, job, fire, machine }) : this.executeJob({ profile: name, job, fire }))
       .then((receipt) => {
         if (!receipt || typeof receipt.output !== 'string' || receipt.accepted !== true)
           throw new Error('The host did not confirm this scheduled task');
@@ -279,6 +283,23 @@ export class Orchestrator {
     this.hostedTasks.add(task);
   }
 
+  /**
+   * A fire of a job pinned to another machine: a session of the profile's worker harness on that machine, in a window
+   * there, given the job's prompt (`supercode open --new --on`, keyed by the fire so a retry never opens a second).
+   * The launch is the fire's receipt; the session does the job's work and reports through its own doors.
+   */
+  async launchRemoteFire({ profile, job, fire, machine }) {
+    const harness = profile.worker?.harness;
+    const program = { 'claude-code': 'claude', codex: 'codex' }[harness];
+    if (!program) throw new Error(`profile ${profile.name}'s worker (${harness ?? 'none'}) cannot run a fire on ${machine}`);
+    const args = ['open', '--new', program, '--detach', '--window=true', '--on', machine, '--key', `cron-${fire.id}`, '--input', job.prompt ?? ''];
+    if (job.workdir && job.workdir.startsWith('/')) args.push('--cwd', job.workdir);
+    if (job.model) args.push('--', '--model', job.model);
+    const { stdout } = await promisify(execFile)(process.env.SUPERCODE_BIN || 'supercode', args, { timeout: 180_000, maxBuffer: 4 * 1024 * 1024 });
+    const pane = /"pane"\s*:\s*"([^"]+)"/.exec(stdout)?.[1] ?? null;
+    return { accepted: true, output: `Fire ${fire.id} of ${job.id} launched on ${machine}${pane ? ` in pane ${pane}` : ''}.`, machine, pane };
+  }
+
   /**
    * A fire's gate, off the queue (a script may run for Hermes's hour): the
    * monitor source first, then the pre-run script unless the monitor already

package/mcp/hermes-kanban-tools.json

@@ -226,6 +226,13 @@
         "board": {
           "type": "string",
           "description": "Kanban board slug to target. When omitted, the call resolves the active board the usual way: HERMES_KANBAN_DB env \u2192 HERMES_KANBAN_BOARD env \u2192 the 'current' symlink under the kanban home \u2192 'default'. Pass an explicit slug only when the caller (e.g. a Telegram routing layer) needs to override the env-pinned active board for this one call."
+        },
+        "findings": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Each finding, filed as a task on the arc before the card returns; an arc with no open task is refused."
         }
       },
       "required": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.4.149",
+  "version": "0.4.151",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {