@volter/supercode-orchestrator 0.5.201 → 0.5.203

package/README.md

@@ -51,6 +51,12 @@ groups retained wire attempts by caller and endpoint, includes their purposes
 and outcomes, and shows the latest 32 response-header receipts. Unknown transport
 completion remains counted. Tokens and response bodies are not retained.
 
+Board actions check their local role, guard and validator rules before GitHub.
+Fresh source observations are reused only within that action, with at most eight
+concurrent REST operations per process. Owner receipts retain the return code and
+redacted refusal even when a failed call is fast. See
+[acceptance latency readings](../../docs/evidence/board-acceptance-latency-2026-10-14.md).
+
 Board discovery caches advisory reads while waiting. Review requests, verdicts
 and acceptance refresh the complete source set, including previously draft or
 closed declared sources, and validate its current heads. An unread set defers

package/board/ci.mjs

@@ -4,6 +4,7 @@ import { execFile } from 'node:child_process';
 import { readFileSync, realpathSync, writeFileSync, renameSync, statSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
 import { createHash } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { branchCheckouts, checkoutOf, isLocalWorkspace, resolveWorkspace, plainWorkspace } from './workspace.mjs';
 import { noteStep } from '@volter/supercode-harness-sdk/slow-log';
 import { githubFetch } from './github-rest.mjs';
@@ -21,17 +22,51 @@ async function githubToken() {
 }
 /** One GitHub REST read (`all`: every page of a list). The token is the environment's, else gh's stored login: a failed
  *  read of the login is not kept, and a login token GitHub refuses (401, rotated or revoked) is read again once. */
+const actionReads = new AsyncLocalStorage();
+/** Fresh observations belong to one action only; callers and later actions never share this snapshot. */
+export const withFreshReviewReads = (fn) => actionReads.getStore() ? fn() : actionReads.run(new Map(), fn);
 async function github(path, all = false, { purpose = 'validation' } = {}) {
+  const reads = purpose === 'validation' && actionReads.getStore();
+  if (!reads) return githubUncached(path, all, { purpose });
+  const key = `${githubBase()}\0${createHash('sha256').update(await githubToken() ?? '').digest('hex')}\0${all}\0${path}`;
+  if (!reads.has(key)) reads.set(key, githubUncached(path, all, { purpose }));
+  return reads.get(key);
+}
+// Bound actual HTTP/body I/O across all concurrent actions and discovery in this process.
+let activeReads = 0;
+const waitingReads = [];
+async function wireRead(fn) {
+  if (activeReads >= 8) await new Promise(resolve => waitingReads.push(resolve)); else activeReads++;
+  try { return await fn(); }
+  finally { const next = waitingReads.shift(); if (next) next(); else activeReads--; }
+}
+/** Preserve input order; after a failure drain active reads and issue no more work from this batch. */
+async function readTogether(items, read) {
+  const out = new Array(items.length); let cursor = 0, failure;
+  await Promise.all(Array.from({ length: Math.min(8, items.length) }, async () => {
+    while (!failure && cursor < items.length) {
+      const i = cursor++;
+      try { out[i] = await read(items[i], i); } catch (error) { failure ??= error; }
+    }
+  }));
+  if (failure) throw failure;
+  return out;
+}
+async function githubUncached(path, all = false, { purpose = 'validation' } = {}) {
   const read = async () => {
     const token = await githubToken();
     let url = githubBase() + path, out = [];
     for (let page = 0; url && page < 10; page += 1) {
-      const r = await githubFetch(url, { headers: githubHeaders(token), signal: AbortSignal.timeout(30_000) }, { purpose });
-      if (!r.ok) return { status: r.status, error: `GitHub ${r.status} for ${path}: ${(await r.text()).slice(0, 300)}` };
-      const body = await r.json();
+      const pageRead = await wireRead(async () => {
+        const r = await githubFetch(url, { headers: githubHeaders(token), signal: AbortSignal.timeout(30_000) }, { purpose });
+        if (!r.ok) return { status: r.status, error: `GitHub ${r.status} for ${path}: ${(await r.text()).slice(0, 300)}` };
+        return { body: await r.json(), next: /<([^>]+)>;\s*rel="next"/.exec(r.headers.get('link') ?? '')?.[1] ?? null };
+      });
+      if (pageRead.error) return pageRead;
+      const body = pageRead.body;
       if (!all) return { body };
       out = out.concat(body);
-      url = /<([^>]+)>;\s*rel="next"/.exec(r.headers.get('link') ?? '')?.[1] ?? null;
+      url = pageRead.next;
     }
     return { body: out };
   };
@@ -80,9 +115,11 @@ export async function mergeReviewedPullRequest(url, reviewed) {
   const token = await githubToken();
   let answer;
   try {
-    const r = await githubFetch(`${githubBase()}/repos/${repositoryOf(url)}/pulls/${numberOf(url)}/merge`, { method: 'PUT', headers: githubHeaders(token, { 'content-type': 'application/json' }), body: JSON.stringify({ sha: reviewed, merge_method: 'merge' }), signal: AbortSignal.timeout(60_000) }, { purpose: 'mutation' });
-    const text = await r.text();
-    answer = { status: r.status, body: (() => { try { return JSON.parse(text); } catch { return { message: text.slice(0, 300) }; } })() };
+    answer = await wireRead(async () => {
+      const r = await githubFetch(`${githubBase()}/repos/${repositoryOf(url)}/pulls/${numberOf(url)}/merge`, { method: 'PUT', headers: githubHeaders(token, { 'content-type': 'application/json' }), body: JSON.stringify({ sha: reviewed, merge_method: 'merge' }), signal: AbortSignal.timeout(60_000) }, { purpose: 'mutation' });
+      const text = await r.text();
+      return { status: r.status, body: (() => { try { return JSON.parse(text); } catch { return { message: text.slice(0, 300) }; } })() };
+    });
   } catch (error) { throw new Error(`GitHub merge: ${String(error.message).slice(-300)}`); }
   if (answer.status === 200 && answer.body?.merged) return { merged: true, sha: answer.body.sha };
   if (answer.status === 409) return { moved: true, head: null, message: answer.body?.message ?? null };
@@ -267,8 +304,9 @@ export async function openReviewPullRequests(board, id, { fresh = false } = {})
   let branch = task?.branch_name ?? (current || null);
   const mine = (repository, head) => (repository === ownRepository && head === branch) || namedWorkBranch(id, head)
     || registered.some((r) => r.repository === repository && r.branch === head);
-  const prs = [];
-  for (const repository of new Set([ownRepository, ...registered.map((r) => r.repository), ...(await knownRepositories({ fresh }))].filter(Boolean))) {
+  const repositoriesToRead = [...new Set([ownRepository, ...registered.map((r) => r.repository), ...(await knownRepositories({ fresh }))].filter(Boolean))];
+  const groups = await readTogether(repositoriesToRead, async repository => {
+    const prs = [];
     // Advisory discovery is shared. Before a move, refresh the full set, including previously excluded PRs.
     let list;
     try {
@@ -280,7 +318,7 @@ export async function openReviewPullRequests(board, id, { fresh = false } = {})
       list = fresh ? await read() : await discoveryList(pullRequestLists, repository, 300_000, read);
     } catch (error) {
       if (fresh || repository === ownRepository || registered.some(r => r.repository === repository)) throw error;
-      continue; // An unread sibling stays unread: do not cache an empty successful result.
+      return []; // An unread sibling stays unread: do not cache an empty successful result.
     }
     // The repository's default branch is not a work branch, declared or checked out (a card working in a `dir` on main).
     if (repository === ownRepository && branch) {
@@ -296,25 +334,26 @@ export async function openReviewPullRequests(board, id, { fresh = false } = {})
       ...(repository === ownRepository ? branch ? [branch] : [`wt/${id}`, `wt/${id.replace(/^t_/, 't-')}`] : []),
       ...registered.filter(r => r.repository === repository).map(r => r.branch),
     ])];
-    for (const headBranch of historical) {
-      if (headBranch === list.defaultBranch) continue;
-      if (list.items.some(pr => pr.headRefName === headBranch)) continue;
-      for (const pr of await mergedBranchPullRequests(repository, headBranch, { fresh })) {
-        if (!pr.isCrossRepository && pr.headRefName === headBranch && pr.headRefName !== pr.defaultBranch
-          && pr.baseRefName === pr.defaultBranch && !judgedHead(board, id, pr.headRefOid)
-          && !prs.some(known => known.url === pr.url)) prs.push({ url: pr.url, head: pr.headRefOid });
-      }
+    const histories = await readTogether(historical, async headBranch => {
+      if (headBranch === list.defaultBranch || list.items.some(pr => pr.headRefName === headBranch)) return [];
+      return (await mergedBranchPullRequests(repository, headBranch, { fresh })).filter(pr =>
+        !pr.isCrossRepository && pr.headRefName === headBranch && pr.headRefName !== pr.defaultBranch
+        && pr.baseRefName === pr.defaultBranch && !judgedHead(board, id, pr.headRefOid));
+    });
+    for (const history of histories) for (const pr of history) {
+      if (!prs.some(known => known.url === pr.url)) prs.push({ url: pr.url, head: pr.headRefOid });
     }
-  }
+    return prs;
+  });
+  const prs = groups.flat();
   // A source declaration (an implementer's or manager's card comment, engine.comment) adds merged or moved PRs that
   // discovery cannot see; it never hides what discovery found. Only repositories the card's workspace or registered
   // branches name count, and each declared PR is followed at its current head (GitHub's), never pinned to the
   // declared one, so a push after the declaration is reviewed instead of failing every tick.
   const declaration = board.db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='commented' AND json_type(payload,'$.sources')='array' ORDER BY id DESC LIMIT 1").get(id);
   const repositories = new Set([ownRepository, ...registered.map((r) => r.repository)].filter(Boolean).map((r) => r.toLowerCase()));
-  for (const source of declaration ? JSON.parse(declaration.payload).sources : []) {
-    if (!repositories.has(repositoryOf(source.url).toLowerCase()) || prs.some((known) => known.url === source.url)) continue;
-    const pr = await (fresh ? readPullRequest(source.url) : discoverPullRequest(source.url));
+  const sources = (declaration ? JSON.parse(declaration.payload).sources : []).filter(source => repositories.has(repositoryOf(source.url).toLowerCase()) && !prs.some(known => known.url === source.url));
+  for (const pr of await readTogether(sources, source => fresh ? readPullRequest(source.url) : discoverPullRequest(source.url))) {
     if (pr.isCrossRepository || !['OPEN', 'MERGED'].includes(pr.state) || (pr.state === 'OPEN' && pr.isDraft)) continue;
     if (!prs.some((known) => known.url === pr.url)) prs.push({ url: pr.url, head: pr.headRefOid });
   }
@@ -423,6 +462,9 @@ export function judgedHead(board, id, head) {
 }
 
 export async function inspectCompletionEvidence(board, id, entry, payload = {}, stage = 'completion') {
+  return withFreshReviewReads(() => inspectCurrentCompletionEvidence(board, id, entry, payload, stage));
+}
+async function inspectCurrentCompletionEvidence(board, id, entry, payload, stage) {
   const state = { required: false, ready: true, reason: null, phase: 'source', deployed_sha: null };
   try {
     if (stage === 'completion' || stage === 'acceptance') {
@@ -442,10 +484,10 @@ export async function inspectCompletionEvidence(board, id, entry, payload = {},
         const passed = candidatePullRequests(row && JSON.parse(row.payload)?.ci);
         const wanted = candidatePullRequests(candidate);
         if (wanted.length !== passed.length || wanted.some((w) => !passed.some((p) => p.pr.url === w.pr.url && p.commit === w.commit))) throw new Error('The current PR heads need their independent verdict before acceptance.');
-        for (const w of wanted) {
+        await readTogether(wanted, async w => {
           const pr = await readPullRequest(w.pr.url);
           if (!['OPEN', 'MERGED'].includes(pr.state) || pr.headRefOid !== w.commit) throw new Error(`The head of ${w.pr.url} changed after its verdict; request a new review.`);
-        }
+        });
         Object.assign(state, { ...candidate, ready: true, reason: null });
       }
       return state;
@@ -458,7 +500,7 @@ export async function inspectCompletionEvidence(board, id, entry, payload = {},
     // Merged source is immutable and needs no surviving workspace. Resolve an
     // unmerged candidate's checkout as before; a broken legacy path never
     // prevents a verdict on already merged commits.
-    const read = await Promise.all(urls.map(readPullRequest));
+    const read = await readTogether(urls, readPullRequest);
     const mergedOnly = urls.length && read.every(pr => pr.state === 'MERGED');
     const own = mergedOnly ? null : await repositoryWorkspace(board, id);
     if (!own && !urls.length) {
@@ -482,7 +524,7 @@ export async function inspectCompletionEvidence(board, id, entry, payload = {},
       : payload.pr_head ?? payload.commit ?? payload.metadata?.pr_head ?? payload.metadata?.commit ?? []).filter(Boolean);
     if (stage === 'request_review' && named.length !== urls.length) throw new Error('Name each PR head with --pr-head, one for each --pr, in the same order.');
     if (stage === 'review_verdict' && !named.length) throw new Error('Name every reviewed PR head with --reviewed-sha.');
-    const prs = await Promise.all(urls.map((url, index) => verifyPullRequest(board, id, entry, own, url, stage === 'request_review' ? named[index] : null, stage)));
+    const prs = await readTogether(urls, (url, index) => verifyPullRequest(board, id, entry, own, url, stage === 'request_review' ? named[index] : null, stage));
     if (stage === 'request_review') {
       // A review is asked for only while some PR has a head no verdict has judged.
       if (!await reviewDue(board, id, prs.map((p) => ({ url: p.pr.url, head: p.commit })))) throw new Error('The PRs the last verdict judged have no new head; push a new head before requesting review.');

package/board/cli.mjs

@@ -14,6 +14,7 @@ import { taskStatusOf } from './published.mjs';
 import { executionOf } from './session-work.mjs';
 import { listCardsInTurns, writeCardList } from './listing.mjs';
 import { writeOwnerAnswer } from './reply.mjs';
+import { redactText } from '@volter/teams/redact';
 import { createServer } from 'node:net';
 import { chmodSync, existsSync, mkdirSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, copyFileSync, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
 import { notRuntime, ownHome } from './owner-files.mjs';
@@ -1611,10 +1612,14 @@ async function answerOne(root, line) {
   const began = performance.now();
   const before = slowLog.processCounters?.() ?? null;
   let named = null, by = null;
-  try { return await answerRequest(root, line, (verb, caller) => { named = verb; by = caller; }); }
+  let answer;
+  try { answer = await answerRequest(root, line, (verb, caller) => { named = verb; by = caller; }); return answer; }
   finally {
     const ms = performance.now() - began;
-    if (named && ms > slowLog.SLOW_MS) recordSlow({ kind: 'call', name: `owner verb ${named}`, ms, slowest: null, extra: { caller: by, steps: slowLog.stepsWithin?.(began, performance.now()) ?? null, whole_process: before ? slowLog.processUse(before) : null } });
+    if (named) recordSlow({ kind: 'call', name: `owner verb ${named}`, ms, force: answer?.code !== 0,
+      outcome: answer ? answer.code === 0 ? 'ok' : `exit ${answer.code}` : 'unknown', slowest: null,
+      extra: { caller: by, response: { code: answer?.code ?? null, stderr: redactText([].concat(answer?.stderr ?? []).join('')).slice(0, 2000) },
+        steps: slowLog.stepsWithin?.(began, performance.now()) ?? null, whole_process: before ? slowLog.processUse(before) : null } });
   }
 }
 

package/board/dispatch.mjs

@@ -28,7 +28,8 @@ import { localSessionDelegations } from '../agents.mjs';
 import { creatorOf, sessionProgress } from './workflow.mjs';
 import { boardLabel, boardName } from '@volter/teams/board-name';
 let fleetRoot = null;
-import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
+import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, withFreshReviewReads, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
+import { setImmediate as yieldToOwner } from 'node:timers/promises';
 import { runtimeDoor } from './runtime-door.mjs';
 import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, recordUsageUnread, agentPreamble, agentEnvironment, recordAgentRun, cardAgentAssignments,handOffAgents, agentRunForSession } from '../agents.mjs';
 import { finishCardAgentAssignment, recordCardAgentAssignment } from './agent-declarations.mjs';
@@ -1936,6 +1937,7 @@ async function synchronizeAgents(board, report) {
     }
   }
   for(const assignment of cardAgentAssignments(board.root)){
+    await yieldToOwner();
     const task=getTaskNow(board,assignment.target);
     if(task&&(assignment.state==='ended'||task.archived||['done','cancelled'].includes(task.status)))finishCardAgentAssignment(board,assignment,`card ${assignment.target} ${task.archived?'archived':task.status}`);
     else if(task)recordCardAgentAssignment(board,assignment);
@@ -2351,8 +2353,10 @@ const latestAnswer = (db, id) => db.prepare(`SELECT id, kind, payload FROM task_
  * only while that claim is the card's latest.
  */
 export async function completeAdoptions(board, fleet, settings, report, lanes = null) {
-  const pending = view(board, db => db.prepare(`SELECT e.id, e.task_id, e.kind, e.payload, e.created_at FROM task_events e
-    WHERE ((e.kind = 'dispatch_held' AND json_extract(e.payload, '$.reason') = 'adoption requested') OR e.kind = 'adoption_claimed')
+  const pending = view(board, db => db.prepare(`SELECT e.id, e.task_id, e.kind, e.payload, e.created_at
+    FROM (SELECT DISTINCT task_id FROM task_events) cards CROSS JOIN task_events e ON e.task_id=cards.task_id
+    WHERE e.kind IN ('dispatch_held','adoption_claimed')
+    AND ((e.kind = 'dispatch_held' AND json_extract(e.payload, '$.reason') = 'adoption requested') OR e.kind = 'adoption_claimed')
     AND e.id = (SELECT MAX(id) FROM task_events l WHERE l.task_id = e.task_id AND l.kind IN ${ADOPTION_ANSWERS})`).all());
   for (const row of pending) {
     // a request another round has claimed is that round's while its claim holds; a claim whose round died is open again
@@ -2788,6 +2792,7 @@ async function notify(board, fleet, report, entry) {
   await endWorkerSubscriptions(board, fleet, report);
   const record = view(board, (db) => sessionRecord(db));
   for (const sub of subscriptions(board.db).filter((s) => s.platform === 'supercode')) {
+    await yieldToOwner();
     if (stopping) break;
     if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) continue;
     const role = ['worker', 'dependency', 'manager'].includes(sub.delivery_metadata?.role) ? sub.delivery_metadata.role : 'creator';
@@ -2803,7 +2808,8 @@ async function notify(board, fleet, report, entry) {
     } else if (ended) continue; // no fleet reading: nothing is filed unread to a session recorded as ended
     const kinds = heardBy(entry, role);
     if (!kinds.length) continue;
-    const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id`)
+    // The retained cursor resumes the next page; one native read never materializes the whole unread history.
+    const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id LIMIT 64`)
       .all(sub.task_id, sub.last_event_id, ...kinds);
     if (!events.length) continue;
     // the card as the workflow names it (its status the workflow's: triaging, reviewing, stopped; `stored_as` kanban.db's)
@@ -2857,7 +2863,17 @@ async function notify(board, fleet, report, entry) {
     // a subscription past its card's last event ends with the card: a worker's when the card is done or archived (its
     // work is over, and its session may never run again), anyone's when it is archived
     const over = task && (task.stored_as === 'archived' || (role === 'worker' && task.stored_as === 'done'));
-    if (over && cursor >= events.at(-1).id) tx(board, (db) => db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity));
+    if (over) tx(board, (db) => {
+      const durable = db.prepare(`SELECT last_event_id FROM kanban_notify_subs ${where}`).get(...identity);
+      if (!durable) return;
+      // A page's final event is not the end of the backlog. Check past the persisted cursor in the same
+      // transaction as retirement, so another page (including the card's completion) is never abandoned.
+      const remaining = db.prepare(`SELECT 1 FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) LIMIT 1`)
+        .get(sub.task_id, durable.last_event_id, ...kinds);
+      const current = getTask(db, sub.task_id);
+      if (!remaining && current && (current.status === 'archived' || (role === 'worker' && current.status === 'done')))
+        db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity);
+    });
   }
 }
 
@@ -3184,10 +3200,17 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
       }
       if (!dry) await refreshCardInputs(board, id, { commits: true });
       // Cached draft/closed exclusions are useful while waiting, but cannot define a committed review's set.
-      payload = await openReviewPullRequests(board, id, { fresh: true });
-      if (!payload && noCodeReviewDue(board, id)) payload = await noCodeChange(board, id);
+      const observed = await withFreshReviewReads(async () => {
+        const candidate = await openReviewPullRequests(board, id, { fresh: true })
+          ?? (noCodeReviewDue(board, id) ? await noCodeChange(board, id) : null);
+        const evidence = !candidate || candidate.waits ? null : candidate.no_code
+          ? { required: false, ready: true, reason: null, phase: 'source', no_code: candidate.no_code }
+          : await inspectCompletionEvidence(board, id, entry, candidate, 'request_review');
+        return { candidate, evidence };
+      });
+      payload = observed.candidate;
       if (!payload || payload.waits) { report.queued.push([id, `review waits: ${payload?.waits ?? 'the current source set has no review candidate'}`]); payload = null; continue; }
-      const evidence = payload.no_code ? { required: false, ready: true, reason: null, phase: 'source', no_code: payload.no_code } : await inspectCompletionEvidence(board, id, entry, payload, 'request_review');
+      const evidence = observed.evidence;
       if (!evidence.ready) throw new Error(evidence.reason);
       // A dry run names the complete validated review a tick would request and writes nothing.
       if (dry) { (report.would_review ??= []).push({ id, prs: payload.pr, heads: payload.pr_head, no_code: payload.no_code ?? null }); continue; }

package/board/engine.mjs

@@ -16,7 +16,7 @@ import { checkWorkspace, assertWorkspaceOwner, declareWorkspace, isLocalWorkspac
 import { DatabaseSync } from 'node:sqlite';
 import { view, actorOf, principalOf, claimer, contention, event, json, newTaskId, now, retryContention, tx } from './store.mjs';
 import { completionPhase, inspectCompletionEvidence, observeCompletionEvidence, withCompletionEvidence } from './ci.mjs';
-import { addDependency, retireSupersededRuns, refreshCardInputs, requestSessionClose, eventTo, fire, loadWorkflow, setStatus, settle, startNew, statusOf, runEvent, workflowFor } from './workflow.mjs';
+import { addDependency, retireSupersededRuns, refreshCardInputs, requestSessionClose, eventTo, fire, validateEvent, loadWorkflow, setStatus, settle, startNew, statusOf, runEvent, workflowFor } from './workflow.mjs';
 import { refuseCredentialDump, withheldIfDump } from './credential-guard.mjs';
 import { AGENT_KIND_LIST, compactCardAgentEvents } from './published.mjs';
 
@@ -432,6 +432,8 @@ export async function act(board, id, name, { roles = null, payload = {}, extra =
   if (name === 'comment' && (!String(payload.body ?? '').trim() || !String(payload.author ?? '').trim())) throw new Error('a comment has an author and body');
   refuseCredentialDump(name === 'comment' ? `the comment on ${id}` : `${name.replace(/_/g, '-')} on ${id}`, payload);
   await refreshCardInputs(board, id, { commits: ['complete', 'request_review'].includes(name) });
+  if (['complete', 'request_review', 'request_state'].includes(name)) view(board, db => validateEvent(db, board, entry, id, name,
+    { roles: roles ?? callerRoles(db, id), payload, extra, localOnly: true }));
   const evidencePhase = ['complete', 'request_review', 'request_state'].includes(name) ? completionPhase(board, id, entry, name, payload, roles ?? callerRoles(board.db, id)) : null;
   if (evidencePhase) payload = { ...payload, ci: await observeCompletionEvidence(board, id, entry, payload, evidencePhase) };
   if (payload.ci?.required && !payload.ci.ready && (name !== 'request_state' || evidencePhase === 'review_verdict')) throw new Error(payload.ci.reason ?? 'The PR candidate could not be verified.');
@@ -459,6 +461,7 @@ export async function requestStateMany(board, ids, payload = {}) {
   const prepared = new Map(await Promise.all(targets.map(async id => {
     const roles = callerRoles(board.db, id);
     const phase = completionPhase(board, id, entry, 'request_state', payload, roles);
+    view(board, db => validateEvent(db, board, entry, id, 'request_state', { roles, payload, localOnly: true }));
     const evidence = await inspectCompletionEvidence(board, id, entry, payload, phase);
     // An ordinary request mails a decision to the manager, not a completion.
     // Keep a failed source observation in that mail. A reviewer recording an

package/board/expr.mjs

@@ -129,6 +129,45 @@ function compiled(text) {
 
 const own = (o, k) => o !== null && o !== undefined && (typeof o === 'object' || typeof o === 'function') && Object.prototype.hasOwnProperty.call(o, k);
 
+/** Whether an expression may read observed sources, including through derived card fields. Unknown access waits. */
+export function needsSources(text, derived = {}) {
+  const visiting = new Set();
+  const field = (root, key) => {
+    if (key === 'ci') return true;
+    if (root !== 'card' || !own(derived, key)) return false;
+    if (visiting.has(key)) return true;
+    visiting.add(key);
+    const dependent = expression(derived[key]);
+    visiting.delete(key);
+    return dependent;
+  };
+  const root = e => e.k === 'name' && ['card', 'event'].includes(e.v);
+  const visit = e => {
+    switch (e.k) {
+      case 'lit': return false;
+      case 'name': return root(e); // passing the whole object can expose its sources
+      case 'get': return root(e.on)
+        ? e.key.k !== 'lit' || field(e.on.v, e.key.v)
+        : visit(e.on) || visit(e.key);
+      case 'method': return (root(e.on)
+        ? e.m === 'size' || field(e.on.v, e.m)
+        : visit(e.on)) || e.args.some(visit);
+      case 'list': return e.items.some(visit);
+      case 'call': return e.args.some(visit);
+      case 'macro': return visit(e.on) || visit(e.body);
+      case 'not': case 'neg': return visit(e.e);
+      case 'bin': return visit(e.l) || visit(e.r);
+      case 'if': return visit(e.c) || visit(e.a) || visit(e.b);
+      default: return true;
+    }
+  };
+  const expression = value => {
+    if (value === null || value === undefined || String(value).trim() === '') return false;
+    try { return visit(compiled(String(value))); } catch { return true; }
+  };
+  return expression(text);
+}
+
 function run(e, scope) {
   switch (e.k) {
     case 'lit': return e.v;

package/board/workflow.mjs

@@ -14,7 +14,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'nod
 import { randomBytes } from 'node:crypto';
 import { actorOf, appendRunObservation, event as record, json, now } from './store.mjs';
 import { releaseAllSideSessions } from './side-sessions.mjs';
-import { evaluate, holds, render } from './expr.mjs';
+import { evaluate, holds, render, needsSources } from './expr.mjs';
 import { completionEvidence, declaredWorkBranches, namedWorkBranch, reviewCandidate } from './ci.mjs';
 import { cardCommitsOn, isLocalWorkspace, isWorkspacePath } from './workspace.mjs';
 import { identifyNotice } from './notices.mjs';
@@ -383,7 +383,7 @@ function timeOf(db, task) {
 function askedOf(id) { return mailboxAnswers.get(id)?.askedOf ?? null; }
 
 /** The scope an expression is evaluated in: the card (with its relations), the event, params, time, extras. */
-export function scopeOf(db, board, task, { params, event = {}, extra = {}, lazy = false } = {}) {
+export function scopeOf(db, board, task, { params, event = {}, extra = {}, lazy = false, deferSources = false } = {}) {
   // Only read-only guards opt into demand reads. Mutation scopes materialize before any write,
   // keeping `before` and run-history fields pinned to their original snapshot.
   const once = (read) => { let done = false, value; return () => { if (!done) { value = read(); done = true; } return value; }; };
@@ -486,8 +486,10 @@ export function scopeOf(db, board, task, { params, event = {}, extra = {}, lazy
     Object.defineProperty(card, key, { get: read, enumerable: true, configurable: true });
     if (!lazy) read();
   }
-  for (const [key, expr] of Object.entries(loaded.get(board.root)?.workflow?.derived ?? {})) {
-    const value = evaluate(expr, { card, event, params, now: now() });
+  const derived = loaded.get(board.root)?.workflow?.derived ?? {};
+  for (const [key, expr] of Object.entries(derived)) {
+    // Preflight neither evaluates nor exposes a derived source value from a stale/missing observation.
+    const value = deferSources && needsSources(expr, derived) ? undefined : evaluate(expr, { card, event, params, now: now() });
     Object.defineProperty(card, key, { value, writable: true, enumerable: true, configurable: true });
   }
   return {
@@ -594,7 +596,7 @@ function declaredStatus(db, board, entry, task) {
  * takes only a sender in one of its roles; `platform` for the dispatcher's own observations). Answers
  * `{ from, to, effects }`; throws the refusal when no transition applies or a validator fails.
  */
-export function fire(db, board, entry, id, name, { roles = [], payload = {}, extra = {} } = {}) {
+export function validateEvent(db, board, entry, id, name, { roles = [], payload = {}, extra = {}, localOnly = false } = {}) {
   // A card ends with its reason: a cancel or archive that says nothing why is refused, whoever sends it, the manager
   // included. The reason is all the next reader of an ended card has (an empty-reason cancel once ended an arc that had
   // shipped half, and nothing on the card said so).
@@ -603,14 +605,14 @@ export function fire(db, board, entry, id, name, { roles = [], payload = {}, ext
   // archive: that ends it the way the document already has, and is the one way a manager clears it.
   if (db.boardErrors?.has(id) && !(/cannot change card removal/.test(db.boardErrors.get(id)) && ['cancel', 'archive'].includes(name) && roles.includes('manager'))) throw new Error(`${id}: ${db.boardErrors.get(id)}`);
   const { workflow, params } = entry;
-  if (workflow.run && (workflow.run.on?.[name] || Object.values(workflow.run.states ?? {}).some((s) => s.on?.[name]))) return fireRun(db, board, entry, id, name, { roles, payload, extra });
+  if (workflow.run && (workflow.run.on?.[name] || Object.values(workflow.run.states ?? {}).some((s) => s.on?.[name]))) return null;
   const task = cardOf(db, id);
-  const beforeRun = noticeRun(db, task);
-  const from = declaredStatus(db, board, entry, task);
+  const from = localOnly ? statusOf(db, task) : declaredStatus(db, board, entry, task);
+  if (localOnly && !workflow.statuses[from]) return null; // only fire adopts an imported status
   const candidates = transitionsFor(workflow, from, name);
   if (!candidates.length) throw new Error(`${id} is ${from}; ${name.replace(/_/g, '-')} does not apply there`);
   // `sender`: the roles the event was sent with (a validator can ask who is asking)
-  const scope = scopeOf(db, board, task, { params, event: payload, extra: { lanes: lanesIn(entry), ...extra, sender: roles, verb: name } });
+  const scope = scopeOf(db, board, task, { params, event: payload, lazy: localOnly, deferSources: localOnly, extra: { lanes: lanesIn(entry), ...extra, sender: roles, verb: name } });
   const allowed = candidates.filter((t) => !t.by?.length || t.by.some((r) => roles.includes(r)));
   if (!allowed.length) {
     const state = name === 'complete' ? 'done' : name === 'cancel' ? 'cancelled' : null;
@@ -618,6 +620,10 @@ export function fire(db, board, entry, id, name, { roles = [], payload = {}, ext
       ? ` Ask the manager with workflow request-state ${id} --state ${state} --reason <why> --evidence <verdict-and-pointers>.` : '';
     throw new Error(`${id} is ${from}; ${name.replace(/_/g, '-')} there is for ${[...new Set(candidates.flatMap((t) => t.by ?? []))].join(' or ')}. ${candidates.map((t) => t.description).filter(Boolean).join(' ')}${request}`);
   }
+  // A source-dependent branch is undecidable before observation; preflight must not choose its fallback.
+  const needsSource = expr => needsSources(expr, workflow.derived);
+  // Other roles' guards also determine the refusal below; none may decide it using stale sources.
+  if (localOnly && candidates.some(t => needsSource(t.guard))) return null;
   const taken = allowed.find((t) => holds(t.guard ?? null, scope));
   // none of the sender's rules holds, but another role's does (one verb with a rule per case, as `set` has one per
   // field): it is that role's to send
@@ -633,8 +639,17 @@ export function fire(db, board, entry, id, name, { roles = [], payload = {}, ext
     none.noTransition = true; throw none;
   }
   for (const v of taken.validate ?? []) {
+    if (localOnly && needsSource(v.expr)) continue;
     if (!holds(v.expr, scope)) { const reason = render(v.message, scope); const refusal = new Error(reason); refusal.refusal = reason; throw refusal; }
   }
+  return { task, from, taken, scope, beforeRun: localOnly ? null : noticeRun(db, task) };
+}
+
+export function fire(db, board, entry, id, name, { roles = [], payload = {}, extra = {} } = {}) {
+  const checked = validateEvent(db, board, entry, id, name, { roles, payload, extra });
+  if (!checked) return fireRun(db, board, entry, id, name, { roles, payload, extra });
+  const { task, from, taken, scope, beforeRun } = checked;
+  const { params } = entry;
   const effects = [];
   const to = take(db, board, entry, task, from, taken, scope, effects);
   settle(db, board, entry, id, effects);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.201",
+  "version": "0.5.203",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -28,10 +28,10 @@
     "check-types": "node scripts/generate-types.mjs --check"
   },
   "dependencies": {
-    "@volter/supercode-teams": "^0.3.333",
+    "@volter/supercode-teams": "^0.3.335",
     "@volter/supercode-terminal": "^0.3.8",
-    "@volter/supercode-harness-sdk": "^0.3.101",
-    "@volter/teams": "0.2.93",
+    "@volter/supercode-harness-sdk": "^0.3.102",
+    "@volter/teams": "0.2.94",
     "@volter/ztrack": "^2.4.23",
     "yaml": "^2.9.0"
   },