@volter/supercode-orchestrator 0.5.204 → 0.5.206

package/board/doors.mjs

@@ -45,33 +45,63 @@ async function opened(machine) {
  */
 export async function machineCall(machine, method, params = {}, { timeoutMs = 60_000 } = {}) {
   if (!method.startsWith('harness.v1.')) throw new Error('a machine door is a harness.v1 method');
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error('a machine door timeout is a positive finite number of milliseconds');
   const started = performance.now();
+  const deadline = started + timeoutMs;
+  // The caller's bound covers admission too. Shared openings remain the owner's: a caller that stops waiting must
+  // not close another caller's channel/client. Once its admission wait expires, it never sends the method later.
+  const phase = async (name, work) => {
+    const at = performance.now();
+    const remaining = deadline - at;
+    const expired = () => Object.assign(new Error(`${method} exceeded ${timeoutMs} ms while waiting for ${name}${name === 'request' ? '; whether the method ran is unknown' : '; the method was not sent'}`), {
+      code: 'REQUEST_TIMEOUT', phase: name, requestNotSent: name !== 'request',
+    });
+    if (remaining <= 0) throw expired();
+    const controller = new AbortController();
+    let timer;
+    try {
+      const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => { const error = expired(); controller.abort(error); reject(error); }, remaining);
+      });
+      return await Promise.race([work({ timeoutMs: remaining, signal: controller.signal }), timeout]);
+    } finally {
+      clearTimeout(timer);
+      noteStep(`door ${method}: ${name}`, performance.now() - at);
+    }
+  };
   let door = null;
   try {
-    door = await opened(machine);
+    door = await phase('machine channel', () => opened(machine));
     if (method.startsWith('harness.v1.sessions.')) {
       // The harness client starts its transport again itself once it ends (a daemon restart there); one that never
       // started is let go, so the next call starts another.
-      if (!door.harness) {
-        const starting = (async () => { const client = new SupercodeHarnessClient({ transport: channelHarness(door.channel, machine) }); await client.start?.(); return client; })();
-        starting.catch(() => { if (door.harness === starting) door.harness = null; });
-        door.harness = starting;
-      }
-      return await (await door.harness).request(method, params, { timeoutMs });
+      const client = await phase('harness admission', () => {
+        if (!door.harness) {
+          const starting = (async () => { const client = new SupercodeHarnessClient({ transport: channelHarness(door.channel, machine) }); await client.start?.(); return client; })();
+          starting.catch(() => { if (door.harness === starting) door.harness = null; });
+          door.harness = starting;
+        }
+        return door.harness;
+      });
+      return await phase('request', (options) => client.request(method, params, options));
     }
     // The node stream ends with the daemon behind it (another machine's daemon restarting, an upgrade) while the channel
     // to it stays open: it is used only while it is open, and opened again once it is not.
-    if (!door.node) {
-      const opening = door.channel.open('node').then((stream) => {
-        stream.on('close', () => { if (door.node === opening) door.node = null; });
-        return new StreamRpc(stream);
-      });
-      opening.catch(() => { if (door.node === opening) door.node = null; });
-      door.node = opening;
-    }
-    return await (await door.node).call(method, params, { timeoutMs });
+    const rpc = await phase('node admission', () => {
+      if (!door.node) {
+        const opening = door.channel.open('node').then((stream) => {
+          stream.on('close', () => { if (door.node === opening) door.node = null; });
+          return new StreamRpc(stream);
+        });
+        opening.catch(() => { if (door.node === opening) door.node = null; });
+        door.node = opening;
+      }
+      return door.node;
+    });
+    return await phase('request', (options) => rpc.call(method, params, options));
   } catch (error) {
-    if (machine && door && (error?.code === 'REQUEST_TIMEOUT' || error?.code === 504)) retireSilent(machine, door, started);
+    // An expired admission sent nothing and retains the shared opening. Retire only an owned remote request channel that stayed silent.
+    if (machine && door && error?.requestNotSent !== true && (error?.code === 'REQUEST_TIMEOUT' || error?.code === 504)) retireSilent(machine, door, started);
     throw error;
   } finally {
     noteStep(`door ${method}${machine ? ' (another machine)' : ''}`, performance.now() - started);

package/board/engine.mjs

@@ -8,6 +8,7 @@
 // Each function takes an open board (`store.mjs`) and runs in one write transaction. Nothing here launches,
 // observes or sends: the dispatcher (`dispatch.mjs`) does, and records what it did through these.
 import { current } from './call.mjs';
+import { detachedCard, detachedSession, personCustody, sessionAddress, sessionOperation } from './custody.mjs';
 import { executionOf } from './session-work.mjs';
 import { spawn, execFile } from 'node:child_process';
 import { existsSync, rmSync } from 'node:fs';
@@ -15,8 +16,8 @@ import { join, resolve } from 'node:path';
 import { checkWorkspace, assertWorkspaceOwner, declareWorkspace, isLocalWorkspace, plainWorkspace } from './workspace.mjs';
 import { DatabaseSync } from 'node:sqlite';
 import { view, actorOf, principalOf, claimer, contention, event, json, newTaskId, now, retryContention, tx } from './store.mjs';
-import { completionPhase, inspectCompletionEvidence, observeCompletionEvidence, withCompletionEvidence } from './ci.mjs';
-import { addDependency, retireSupersededRuns, refreshCardInputs, requestSessionClose, eventTo, fire, validateEvent, loadWorkflow, setStatus, settle, startNew, statusOf, runEvent, workflowFor } from './workflow.mjs';
+import { assertSourceReceipt, completionPhase, inspectCompletionEvidence, observeCompletionEvidence, withCompletionEvidence } from './ci.mjs';
+import { addDependency, retireSupersededRuns, refreshCardInputs, requestSessionClose, reviewerOf, eventTo, fire, validateEvent, loadWorkflow, setStatus, settle, startNew, statusOf, runEvent, workflowFor } from './workflow.mjs';
 import { refuseCredentialDump, withheldIfDump } from './credential-guard.mjs';
 import { AGENT_KIND_LIST, compactCardAgentEvents } from './published.mjs';
 
@@ -41,7 +42,7 @@ export function getTask(db, id) {
   const row = one(db, 'SELECT * FROM tasks WHERE id = ?', id);
   if (!row) return null;
   const ours = one(db, 'SELECT * FROM supercode_cards WHERE task_id = ?', id);
-  return { ...row, workspace_anchor: ours?.workspace_anchor ?? null, blocked_by: json(ours?.blocked_by, []) ?? [], paused: json(ours?.paused, null), archived: Boolean(ours?.archived), every: ours?.every ?? null, skills: json(row.skills, []) ?? [], machine: ours?.machine ?? null, subtask_of: ours?.subtask_of ?? null,
+  return { ...row, workspace_anchor: ours?.workspace_anchor ?? null, blocked_by: json(ours?.blocked_by, []) ?? [], paused: json(ours?.paused, null), detached: json(ours?.detached, null), archived: Boolean(ours?.archived), every: ours?.every ?? null, skills: json(row.skills, []) ?? [], machine: ours?.machine ?? null, subtask_of: ours?.subtask_of ?? null,
     tags: json(ours?.tags, null) ?? (row.tenant ? [row.tenant] : []), sponsor: ours?.sponsor ?? null, sponsor_evidence: json(ours?.sponsor_evidence, null), requested_by_unverified: json(ours?.requested_by_unverified, null) };
 }
 
@@ -122,10 +123,11 @@ export function setRunSession(db, runId, session) {
 
 /** The card's latest session the dispatcher recorded, newest run first; null when it never had one. */
 export function lastSession(db, taskId, slot = 'worker') {
+  if (detachedCard(db, taskId)) return null;
   // a session slot's own last session (runs recorded before slots existed are the worker's)
   for (const row of all(db, 'SELECT metadata FROM task_runs WHERE task_id = ? AND metadata IS NOT NULL ORDER BY id DESC', taskId)) {
     const s = json(row.metadata, {})?.supercode;
-    if (s?.session_id && (s.slot ?? 'worker') === slot) return s;
+    if (s?.session_id && (s.slot ?? 'worker') === slot) return detachedSession(db, s) ? null : s;
   }
   return null;
 }
@@ -241,6 +243,9 @@ export function createCard(board, spec) {
     if (missing.length) throw new Error(`unknown parent card(s): ${missing.join(', ')}`);
     const arc = spec.subtaskOf ? getTask(db, spec.subtaskOf) : null;
     const entry = workflowFor(board.root);
+    if (spec.reviewer != null && (typeof spec.reviewer !== 'string' || !spec.reviewer.trim() || !entry.profiles?.[spec.reviewer]?.worker?.harness)) {
+      throw new Error('A card reviewer names a runnable profile in this home.');
+    }
     if (spec.subtaskOf && !arc) throw new Error(`no card ${spec.subtaskOf} to be a subtask of`);
     if (arc?.subtask_of) throw new Error(`${arc.id} is itself a subtask of ${arc.subtask_of}; a subtask belongs to an arc`);
     let id = newTaskId();
@@ -281,7 +286,8 @@ export function createCard(board, spec) {
     // the create's own words: whether it asked to be a goal card (null: the workflow decides), triage, its arc
     const status = startNew(db, board, entry, getTask(db, id), { triage: Boolean(spec.triage), initial_status: initial,
       every: spec.every ?? null, goal: spec.goal === undefined || spec.goal === null ? null : spec.goal !== false, subtask_of: arc?.id ?? null });
-    event(db, id, 'created', { creator: actorOf(), created_by: one(db, 'SELECT created_by FROM tasks WHERE id=?', id)?.created_by ?? null, assignee: spec.assignee || null, status, parents, tags, ...(spec.sponsor ? { sponsor: spec.sponsor } : {}), ...(spec.requestedByUnverified ? { requested_by_unverified: spec.requestedByUnverified } : {}), ...(machine ? { machine } : {}), ...(arc ? { subtask_of: arc.id } : {}) });
+    event(db, id, 'created', { creator: actorOf(), created_by: one(db, 'SELECT created_by FROM tasks WHERE id=?', id)?.created_by ?? null, assignee: spec.assignee || null,
+      ...(spec.reviewer != null ? { reviewer: spec.reviewer } : {}), status, parents, tags, ...(spec.sponsor ? { sponsor: spec.sponsor } : {}), ...(spec.requestedByUnverified ? { requested_by_unverified: spec.requestedByUnverified } : {}), ...(machine ? { machine } : {}), ...(arc ? { subtask_of: arc.id } : {}) });
     if ((spec.noStart || spec.adopt) && !arc) event(db, id, 'dispatch_held', { session: spec.adopt ?? null, reason: spec.adopt ? 'awaiting adoption' : 'created with --no-start' });
     if (parents.length) inheritSubscriptions(db, id, parents);
     if (arc) {
@@ -290,7 +296,7 @@ export function createCard(board, spec) {
       event(db, arc.id, 'subtask_added', { subtask: id, title });
     }
     if (initial === 'running' && arc && entry.workflow.run) setStatus(db, entry.workflow, id, 'running');
-    else if (initial === 'running') claimIn(db, id, { ttl: claimTtl() });
+    else if (initial === 'running') claimIn(db, id, { ttl: claimTtl(), workflow: entry.workflow });
     // The creation declares its role even when dispatch is held. The existing durable effect queue
     // keeps public-door I/O outside this transaction and retains an offline declaration for retry.
     let declaration;
@@ -333,12 +339,13 @@ function wouldCycle(db, parent, child) {
  * from a native binary released before its `set` (the orchestrator and the native install separately) still has a verb
  * per property: it is answered so until that native is gone from the fleet, then this fallback is deleted (t_530ce43e).
  */
-export const SETTABLE = ['assignee', 'machine', 'model', 'every'];
+export const SETTABLE = ['assignee', 'machine', 'model', 'every', 'reviewer'];
 export function set(board, id, field, value, { provider = null, roles } = {}) {
   if (!SETTABLE.includes(field)) throw new Error(`set takes one of ${SETTABLE.join(', ')}, not ${field}`);
   if (provider && (field !== 'model' || !value)) throw new Error('a provider goes with a model');
   value = value || null;
   if (workflowFor(board.root).workflow.verbs?.set) return act(board, id, 'set', { roles, payload: { field, value, provider } });
+  if (field === 'reviewer') throw new Error('This older workflow declares no reviewer setter; update its workflow before setting a card reviewer.');
   const verb = { assignee: ['assign', { assignee: value }], machine: ['move', { machine: value }], model: ['set_model', { model: value, provider }], every: ['set_every', { every: value }] }[field];
   return act(board, id, verb[0], { roles, payload: verb[1] });
 }
@@ -347,11 +354,12 @@ export function set(board, id, field, value, { provider = null, roles } = {}) {
 
 /** Claim a ready card: running, a claim held until `ttl` from now, a run opened. Answers the run id or null. */
 export function claim(board, id, { ttl, lock = claimer(), expectStatus = 'ready' } = {}) {
-  return tx(board, (db) => claimIn(db, id, { ttl, lock, expectStatus }));
+  const { workflow } = workflowFor(board.root);
+  return tx(board, (db) => claimIn(db, id, { ttl, lock, expectStatus, workflow }));
 }
 
-/** `claim` inside the caller's own transaction (a dispatcher's guard and claim see one state). */
-export function claimIn(db, id, { ttl = claimTtl(), lock = claimer(), expectStatus = null } = {}) {
+/** Manual `claim` inside the caller's transaction; the declared stage and run commit together. */
+export function claimIn(db, id, { ttl = claimTtl(), lock = claimer(), expectStatus = null, workflow } = {}) {
   if (getTask(db, id)?.subtask_of) throw new Error('a subtask is worked by its arc and has no run of its own');
   // a triage card is claimed to be specified, which does not wait on its parents
   if (expectStatus !== 'triage' && !parentsDone(db, id)) {
@@ -360,19 +368,22 @@ export function claimIn(db, id, { ttl = claimTtl(), lock = claimer(), expectStat
     return null;
   }
   const task = must(db, id);
-  if (expectStatus && task.status !== expectStatus) return null;
+  const sourceStatus = statusOf(db, task);
+  if (expectStatus && sourceStatus !== expectStatus) return null;
   if (task.claim_lock) return null;
+  if (!workflow?.statuses?.running) throw new Error('manual claim needs a running status declared by this home\'s workflow');
   const t = now();
   if (task.current_run_id) {
     run(db, "UPDATE task_runs SET status = 'reclaimed', outcome = 'reclaimed', summary = COALESCE(summary, 'invariant recovery on re-claim'), ended_at = ?, claim_lock = NULL, claim_expires = NULL, worker_pid = NULL WHERE id = ? AND ended_at IS NULL", t, task.current_run_id);
   }
   const expires = t + ttl;
-  run(db, 'UPDATE tasks SET status = ?, claim_lock = ?, claim_expires = ?, started_at = COALESCE(started_at, ?) WHERE id = ?', 'running', lock, expires, t, id);
+  setStatus(db, workflow, id, 'running');
+  run(db, 'UPDATE tasks SET claim_lock = ?, claim_expires = ?, started_at = COALESCE(started_at, ?) WHERE id = ?', lock, expires, t, id);
   const r = run(db, "INSERT INTO task_runs (task_id, profile, step_key, status, claim_lock, claim_expires, max_runtime_seconds, started_at) VALUES (?, ?, ?, 'running', ?, ?, ?, ?)",
     id, task.assignee, task.current_step_key, lock, expires, task.max_runtime_seconds, t);
   const runId = Number(r.lastInsertRowid);
   run(db, 'UPDATE tasks SET current_run_id = ? WHERE id = ?', runId, id);
-  event(db, id, 'claimed', { lock, expires, run_id: runId, source_status: ['review', 'triage'].includes(task.status) ? task.status : 'ready' }, runId);
+  event(db, id, 'claimed', { lock, expires, run_id: runId, source_status: ['review', 'triage'].includes(sourceStatus) ? sourceStatus : 'ready' }, runId);
   return runId;
 }
 
@@ -428,6 +439,7 @@ export function setCaller(fn) { current().roles = fn; }
 const callerRoles = (db, cardId) => current().roles(db, cardId);
 
 export async function act(board, id, name, { roles = null, payload = {}, extra = {} } = {}) {
+  assertSourceReceipt(payload);
   const entry = await loadWorkflow(board.root);
   if (name === 'comment' && (!String(payload.body ?? '').trim() || !String(payload.author ?? '').trim())) throw new Error('a comment has an author and body');
   refuseCredentialDump(name === 'comment' ? `the comment on ${id}` : `${name.replace(/_/g, '-')} on ${id}`, payload);
@@ -455,6 +467,7 @@ export async function act(board, id, name, { roles = null, payload = {}, extra =
 }
 
 export async function requestStateMany(board, ids, payload = {}) {
+  assertSourceReceipt(payload);
   const targets = [...new Set(ids.map(String))];
   if (!targets.length) throw new Error('A state request names at least one card.');
   const entry = await loadWorkflow(board.root);
@@ -485,6 +498,7 @@ export async function requestStateMany(board, ids, payload = {}) {
 
 /** Take card `id` to `status` by the event the workflow says goes there for this caller (`goto`). */
 export async function goto(board, id, status, { roles = null, payload = {} } = {}) {
+  assertSourceReceipt(payload);
   const entry = await loadWorkflow(board.root);
   await refreshCardInputs(board, id, { commits: true });
   await observeCompletionEvidence(board, id, entry, payload);
@@ -552,7 +566,17 @@ export async function runEffects(board, effects = [], { pending: due = false, el
     // the claim: taken only while the row is due and not failed; another pass holding it answers no change
     if (e.durableId && !tx(board, (db) => db.prepare('UPDATE supercode_effects SET next_at = ? WHERE id = ? AND failed_at IS NULL AND next_at <= ?').run(now() + EFFECT_CLAIM, e.durableId, now()).changes)) { did.claimed_elsewhere.push(e.durableId); continue; }
     let done, error = null;
-    try { done = await runEffect(board, e); } catch (thrown) { done = false; error = String(thrown?.message ?? thrown).slice(0, 500); }
+    try {
+      const effectSession = e.runId ? json(board.db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(e.runId)?.metadata, {})?.supercode : null;
+      done = e.id && e.kind !== 'board_message'
+        ? await sessionOperation(board, { taskId: e.id, address: e.address ?? sessionAddress(effectSession), kind: `board effect ${e.kind}` }, () => runEffect(board, e))
+        : await runEffect(board, e);
+    } catch (thrown) {
+      // Pending work no longer owns the person's session or its workspace.
+      done = Boolean(thrown?.sessionDetached);
+      error = done ? null : String(thrown?.message ?? thrown).slice(0, 500);
+      if (done && e.id) tx(board, db => event(db, e.id, 'effect_passed', { effect: e.durableId ?? null, kind: e.kind, reason: 'card detached to a person' }, e.runId ?? null));
+    }
     if (!e.durableId) continue;
     if (done) { tx(board, (db) => db.prepare('DELETE FROM supercode_effects WHERE id = ?').run(e.durableId)); did.done.push(`${e.durableId}:${e.kind}`); continue; }
     did.kept.push(e.durableId);
@@ -602,7 +626,7 @@ function stopWorker(board, runId) {
   if (!runId) return;
   const row = view(board, (db) => one(db, 'SELECT metadata, claim_lock FROM task_runs WHERE id = ?', runId));
   const worker = json(row?.metadata, {})?.supercode;
-  if (worker?.surface === 'headless' && worker.pid) terminate(Number(worker.pid));
+  if (worker?.surface === 'headless' && worker.pid && !detachedSession(board.db, worker)) terminate(Number(worker.pid));
 }
 
 /**
@@ -652,14 +676,20 @@ function invalidateDescendants(db, board, id) {
 
 // each of Hermes's verbs is an event of the workflow; the words it takes are the event's payload
 
-export const complete = async (board, id, { result = null, summary = null, metadata = null, roles, runId = null, commit = null, ci_run = null, branch = null, pr = null, pr_head = null, reviewed_sha = null } = {}) =>
-  await act(board, id, 'complete', { roles, payload: { result, summary, metadata, run_id: runId, commit, ci_run, branch, pr, pr_head, reviewed_sha } });
+export const complete = async (board, id, options = {}) => {
+  assertSourceReceipt(options);
+  const { result = null, summary = null, metadata = null, roles, runId = null, commit = null, branch = null, pr = null, pr_head = null, reviewed_sha = null } = options;
+  return await act(board, id, 'complete', { roles, payload: { result, summary, metadata, run_id: runId, commit, branch, pr, pr_head, reviewed_sha } });
+};
 // a block names the one thing that ends it: a card it waits on (`on`), or the message whose answer it waits for (`waiting_on`)
 export const block = async (board, id, { reason = null, on = null, waitingOn = null, roles, runId = null } = {}) =>
   await act(board, id, 'block', { roles, payload: { reason, on, waiting_on: waitingOn, run_id: runId } });
 export const unblock = (board, id, { reason = null, on = null, roles } = {}) => act(board, id, 'unblock', { roles, payload: { reason, on } });
-export const requestReview = async (board, id, { summary = null, metadata = null, reviewer = null, force = false, expectedRunId = null, roles, commit = null, ci_run = null, branch = null, pr = null, pr_head = null } = {}) =>
-  await act(board, id, 'request_review', { roles, payload: { summary, metadata, reviewer, force, run_id: expectedRunId, commit, ci_run, branch, pr, pr_head } });
+export const requestReview = async (board, id, options = {}) => {
+  assertSourceReceipt(options);
+  const { summary = null, metadata = null, reviewer = null, force = false, expectedRunId = null, roles, commit = null, branch = null, pr = null, pr_head = null } = options;
+  return await act(board, id, 'request_review', { roles, payload: { summary, metadata, reviewer, force, run_id: expectedRunId, commit, branch, pr, pr_head } });
+};
 export const requestChanges = (board, id, { reason = null, reviewer = null, roles } = {}) => act(board, id, 'request_changes', { roles, payload: { reason, reviewer } });
 export const reopen = (board, id, { author = 'user', reason = null, roles } = {}) => act(board, id, 'reopen', { roles, payload: { author, reason } });
 export const reopenReview = (board, id, { roles, reason = null } = {}) => act(board, id, 'reopen_review', { roles, payload: { reason } });
@@ -752,11 +782,35 @@ export async function comment(board, id, author, body, { roles, pr = null, pr_he
  * starts, completion and blocks) or `worker` (told of updates to the card it works).
  */
 export function subscribeIn(db, id, address, role = 'creator') {
+  if (personCustody(db, address)) return;
   const cursor = one(db, 'SELECT COALESCE(MAX(id), 0) AS c FROM task_events WHERE task_id = ?', id).c;
   run(db, `INSERT OR IGNORE INTO kanban_notify_subs (task_id, platform, chat_id, thread_id, chat_type, delivery_mode, delivery_metadata, created_at, last_event_id)
            VALUES (?, 'supercode', ?, '', 'dm', 'notify+wake', ?, ?, ?)`, id, address, JSON.stringify({ role }), now(), cursor);
 }
 
+/** Reconcile only the current worker's audience, inside the binding transaction. */
+export function replaceWorkerSubscriptions(db, id, address) {
+  const active = currentRun(db, id), session = active?.metadata?.supercode;
+  const bound = session?.address ?? (session?.session_id && session.machine ? `sc:${session.machine}:${session.harness ?? 'claude-code'}:${session.session_id}` : null);
+  if (!address || bound !== address || active.ended_at) return false;
+  const replaces = (session.slot ?? 'worker') === 'worker';
+  const family = all(db, `WITH RECURSIVE family(task_id) AS (
+    SELECT ? UNION SELECT c.task_id FROM supercode_cards c JOIN family f ON c.subtask_of = f.task_id
+  ) SELECT task_id FROM family`, id);
+  const removed = [];
+  for (const { task_id: card } of family) {
+    for (const old of replaces ? all(db, "SELECT chat_id,thread_id FROM kanban_notify_subs WHERE task_id=? AND platform='supercode' AND json_extract(delivery_metadata,'$.role')='worker' AND chat_id!=?", card, address) : []) {
+      run(db, "DELETE FROM kanban_notify_subs WHERE task_id=? AND platform='supercode' AND chat_id=? AND thread_id=? AND json_extract(delivery_metadata,'$.role')='worker'", card, old.chat_id, old.thread_id);
+      removed.push({ card, address: old.chat_id });
+    }
+    // INSERT OR IGNORE preserves an independent creator/manager subscription
+    // and the current worker's existing cursor on repeated reconciliation.
+    subscribeIn(db, card, address, 'worker');
+  }
+  if (removed.length) event(db, id, 'notice_subscriptions_replaced', { address, role: 'worker', superseded: removed, reason: 'the current worker binding replaced its audience' }, active.id);
+  return true;
+}
+
 export function subscribe(board, id, address, role = 'creator') {
   return tx(board, (db) => { must(db, id); subscribeIn(db, id, address, role); });
 }
@@ -767,9 +821,9 @@ export function unsubscribe(board, id, address) {
 
 function dependencyRecipient(db, id) {
   const owner = must(db, id);
-  if (owner.archived || ['done', 'cancelled', 'archived'].includes(owner.status)) return null;
+  if (owner.detached || owner.archived || ['done', 'cancelled', 'archived'].includes(owner.status)) return null;
   const session = currentRun(db, id)?.metadata?.supercode ?? lastSession(db, id);
-  return session?.forgotten || session?.close_confirmed_at ? null : session?.address ?? null;
+  return session?.forgotten || session?.close_confirmed_at || detachedSession(db, session) ? null : session?.address ?? null;
 }
 
 export function subscribeDependency(board, ownerId, sourceId, { remove = false } = {}) {
@@ -800,7 +854,7 @@ export function reconcileDependencySubscriptions(db) {
     const address = owner ? dependencyRecipient(db, owner.id) : null;
     const where = "WHERE task_id=? AND platform='supercode' AND chat_id=? AND thread_id=?";
     const identity = [row.task_id, row.chat_id, row.thread_id];
-    if (!owner || owner.archived || ['done', 'cancelled', 'archived'].includes(owner.status)) run(db, `DELETE FROM kanban_notify_subs ${where}`, ...identity);
+    if (!owner || owner.detached || owner.archived || ['done', 'cancelled', 'archived'].includes(owner.status)) run(db, `DELETE FROM kanban_notify_subs ${where}`, ...identity);
     else if (address && (address !== row.chat_id || metadata.waiting_recipient)) run(db, `UPDATE kanban_notify_subs SET chat_id=?,delivery_metadata=? ${where}`, address, JSON.stringify({ ...metadata, waiting_recipient: false, failures: 0 }), ...identity);
     else if (!address && !metadata.waiting_recipient) run(db, `UPDATE kanban_notify_subs SET delivery_metadata=? ${where}`, JSON.stringify({ ...metadata, waiting_recipient: true }), ...identity);
   }
@@ -833,7 +887,7 @@ export function listCards(db, { status = null, assignee = null, machine = null,
 }
 
 export function showCard(db, id) {
-  const task = must(db, id);
+  const task = { ...must(db, id), reviewer: reviewerOf(db, id) };
   return {
     task,
     parents: parentsOf(db, id),
@@ -1011,7 +1065,7 @@ export function diagnose(db, task, { failureLimit = DEFAULT_FAILURE_LIMIT, stran
     const cycles = events.filter((e) => e.kind === 'unblocked' && t - e.created_at < 24 * 3600).length;
     if (cycles >= 3) out.push({ kind: 'block_unblock_cycling', severity: 'warning', title: `block→unblock cycled ${cycles}x in 24h`, data: { cycles }, actions: [] });
   }
-  if (task.status === 'ready' && task.assignee) {
+  if (!task.detached && task.status === 'ready' && task.assignee) {
     const since = [...events].reverse().find((e) => ['created', 'promoted', 'unblocked', 'reclaimed', 'session_lost', 'promoted_manual'].includes(e.kind))?.created_at ?? task.created_at;
     const age = t - since;
     if (age >= strandedSeconds) {

package/board/fleet-listeners.mjs

@@ -0,0 +1,268 @@
+// Fleet facts are mail obligations, independent of card transitions and dispatch ticks. Intent comes only from the
+// canonical workflow IR. The sender supplies observations from its admitted sources; this router grants nothing.
+import { DatabaseSync } from 'node:sqlite';
+import { chmodSync, mkdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+
+const KINDS = new Set(['session_started', 'session_resumed', 'session_ended', 'duplicate_session_process', 'card_waiting_on_user', 'machine_health_crit']);
+const ADDRESS = /^sc:[^:\s]+:[^:\s]+:[^:\s]+$/;
+const MACHINE = /^[a-z0-9_-]+$/;
+const MAX_PENDING = 4096, MAX_PENDING_BYTES = 16 * 1024 * 1024, MAX_EVENT_BYTES = 64 * 1024;
+const digest = value => createHash('sha256').update(value).digest('hex');
+const refused = message => Object.assign(new Error(message), { code: 'fleet_listener_refused' });
+
+/** A retained mail outbox. `file` is the board's existing admitted mailbox filing door, never a transport or
+ *  provider selected from the observed payload. No runtime database is opened until the home opts into listeners. */
+export class FleetListenerRouter {
+  constructor({ root, file, enrich = event => event, retry = () => {}, log = () => {} }) {
+    if (typeof file !== 'function') throw refused('fleet listener router needs the admitted mailbox filing door');
+    this.root = root; this.file = file; this.enrich = enrich; this.retry = retry; this.log = log; this.definitions = {}; this.closed = false; this.suspended = false;
+  }
+
+  /** The workflow's decoded declarations. An invalid replacement refuses without discarding the prior outbox. */
+  configure(definitions = {}) {
+    if (this.closed) throw refused('fleet listener router is closed');
+    if (!definitions || typeof definitions !== 'object' || Array.isArray(definitions)) throw refused('listeners must be a role map');
+    const next = Object.create(null);
+    for (const [role, declaration] of Object.entries(definitions)) {
+      if (!role || !declaration || Object.keys(declaration).some(key => !['events', 'addresses', 'machines'].includes(key))) throw refused(`invalid fleet listener ${role}`);
+      const { events, addresses, machines } = declaration;
+      if (!Array.isArray(events) || !events.length || events.some(kind => !KINDS.has(kind))) throw refused(`fleet listener ${role} names unsupported events`);
+      if (!Array.isArray(addresses) || !addresses.length || addresses.some(address => typeof address !== 'string' || !ADDRESS.test(address) || /[\x00-\x1f\x7f]/.test(address))) throw refused(`fleet listener ${role} needs full mail addresses`);
+      if (machines != null && (!Array.isArray(machines) || machines.some(machine => typeof machine !== 'string' || !MACHINE.test(machine)))) throw refused(`fleet listener ${role} needs normalized machine names`);
+      next[role] = { events: [...new Set(events)], addresses: [...new Set(addresses)], machines: machines == null ? null : [...new Set(machines)] };
+    }
+    this.definitions = next;
+    this.suspended = false;
+    if (Object.keys(next).length) {
+      this.store();
+      if (!this.timer) { this.timer = setInterval(() => { if (!this.suspended) { try { this.retry(); } catch (error) { this.log(`fleet listener source: ${String(error.message).slice(0, 300)}`); } } this.wake(); }, 1000); this.timer.unref?.(); }
+      this.wake();
+    } else if (this.db) {
+      this.db.prepare('INSERT INTO fleet_listener_runtime(id,needs_baseline) VALUES(1,1) ON CONFLICT(id) DO UPDATE SET needs_baseline=1').run();
+    }
+  }
+
+  suspend() { this.suspended = true; }
+  get enabled() { return !this.closed && !this.suspended && Object.keys(this.definitions).length > 0; }
+
+  store() {
+    if (this.db) return this.db;
+    const directory = join(this.root, 'runtime');
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const path = join(directory, 'fleet-listeners.sqlite');
+    const db = new DatabaseSync(path);
+    try {
+      chmodSync(path, 0o600);
+      db.exec(`PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;
+      CREATE TABLE IF NOT EXISTS fleet_listener_mail (
+        id TEXT PRIMARY KEY, role TEXT NOT NULL, address TEXT NOT NULL,
+        kind TEXT NOT NULL, machine TEXT NOT NULL, digest TEXT NOT NULL,
+        body TEXT, bytes INTEGER NOT NULL, state TEXT NOT NULL,
+        created_at INTEGER NOT NULL, attempts INTEGER NOT NULL DEFAULT 0,
+        next_at INTEGER NOT NULL DEFAULT 0, error TEXT, message_id TEXT, filed_at INTEGER
+      ) STRICT;
+      CREATE INDEX IF NOT EXISTS fleet_listener_due ON fleet_listener_mail(state,next_at,created_at,id);
+      CREATE TABLE IF NOT EXISTS fleet_listener_sources (
+        source TEXT PRIMARY KEY, sequence INTEGER NOT NULL, baseline INTEGER NOT NULL, error TEXT,
+        gaps INTEGER NOT NULL DEFAULT 0, last_gap TEXT, updated_at INTEGER NOT NULL
+      ) STRICT;
+      CREATE TABLE IF NOT EXISTS fleet_listener_waits (
+        address TEXT PRIMARY KEY, active INTEGER NOT NULL, wait_key TEXT, event TEXT, routed INTEGER NOT NULL DEFAULT 0
+      ) STRICT;
+      CREATE TABLE IF NOT EXISTS fleet_listener_runtime (id INTEGER PRIMARY KEY CHECK(id=1), needs_baseline INTEGER NOT NULL) STRICT;`);
+    } catch (error) { db.close(); throw error; }
+    this.db = db;
+    return db;
+  }
+
+  matches(role, event, address) {
+    const declaration = this.definitions[role];
+    return Boolean(declaration?.events.includes(event.kind) && declaration.addresses.includes(address)
+      && (declaration.machines == null || declaration.machines.includes(event.machine)));
+  }
+
+  /** Commit each matched obligation before a source advances its own cursor. A full outbox or a conflicting replay
+   *  throws; the source must retain/retry that event rather than mark it consumed. IDs come from the source's retained
+   *  observation, never from this process's current time. The same event/role/address keeps the same filing id. */
+  enqueue(event) {
+    if (this.closed) throw refused('fleet listener router is closed');
+    if (this.suspended) throw refused('fleet listener configuration is not current');
+    if (!Object.keys(this.definitions).length) return { queued: 0 };
+    if (!event || !KINDS.has(event.kind) || typeof event.source !== 'string' || !event.source
+      || typeof event.id !== 'string' || !event.id || typeof event.machine !== 'string' || !MACHINE.test(event.machine)
+      || !Number.isSafeInteger(event.observed_at_ms) || event.observed_at_ms < 0) throw refused('fleet event needs its kind, source, retained id, machine and observation time');
+    const original = JSON.stringify(event), hash = digest(original);
+    const body = JSON.stringify(this.enrich(event)), bytes = Buffer.byteLength(body);
+    if (bytes > MAX_EVENT_BYTES) throw refused('fleet event exceeds 64 KiB; source observation remains owed');
+    const db = this.store();
+    let queued = 0;
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      const held = db.prepare("SELECT COUNT(*) AS count,COALESCE(SUM(bytes),0) AS bytes FROM fleet_listener_mail WHERE state='pending'").get();
+      for (const [role, declaration] of Object.entries(this.definitions)) for (const address of declaration.addresses) {
+        if (!this.matches(role, event, address)) continue;
+        const id = `fleet-${digest(JSON.stringify([event.source, event.id, role, address]))}`;
+        const previous = db.prepare('SELECT digest FROM fleet_listener_mail WHERE id=?').get(id);
+        if (previous) { if (previous.digest !== hash) throw refused('fleet event id was replayed with different contents'); continue; }
+        if (held.count + queued >= MAX_PENDING || held.bytes + (queued + 1) * bytes > MAX_PENDING_BYTES) throw refused('fleet listener outbox full; source observation remains owed');
+        db.prepare("INSERT INTO fleet_listener_mail(id,role,address,kind,machine,digest,body,bytes,state,created_at) VALUES(?,?,?,?,?,?,?,?, 'pending',?)")
+          .run(id, role, address, event.kind, event.machine, hash, body, bytes, Date.now());
+        queued++;
+      }
+      db.exec('COMMIT');
+    } catch (error) { db.exec('ROLLBACK'); throw error; }
+    this.wake();
+    return { queued };
+  }
+
+  /** Existing machines establish a baseline on first enrollment (or after all listeners were explicitly removed).
+   * An ordinary owner restart preserves its cursors. Machines first seen after enrollment offer their retained window. */
+  bootstrap(records) {
+    if (!this.enabled) return;
+    const db = this.store(), runtime = db.prepare('SELECT needs_baseline FROM fleet_listener_runtime WHERE id=1').get();
+    if (runtime?.needs_baseline === 0) return;
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      for (const [machine, held] of Object.entries(records)) {
+        for (const [section, prefix] of [['fleet', 'machine-fleet'], ['health_events', 'machine-health']]) {
+          const fleet = ['self', 'open'].includes(held.stream) && !held.record?.unread?.[section] ? held.record?.[section] : null;
+          if (!fleet || typeof fleet.source !== 'string' || !fleet.source.startsWith(`${prefix}:${machine}:`) || !Number.isSafeInteger(fleet.last) || fleet.last < 0) continue;
+          db.prepare(`INSERT INTO fleet_listener_sources(source,sequence,baseline,updated_at) VALUES(?,?,?,?)
+            ON CONFLICT(source) DO UPDATE SET sequence=excluded.sequence,baseline=excluded.baseline,error=NULL,updated_at=excluded.updated_at`).run(fleet.source, fleet.last, fleet.last, Date.now());
+        }
+      }
+      db.prepare('INSERT INTO fleet_listener_runtime(id,needs_baseline) VALUES(1,0) ON CONFLICT(id) DO UPDATE SET needs_baseline=0').run();
+      db.exec('COMMIT');
+    } catch (error) { db.exec('ROLLBACK'); throw error; }
+  }
+
+  /** A source cursor moves only after every matched filing obligation is committed. Refusal retains the event and
+   * cursor for retry. A new machine starts with the first observation still available in its retained window. */
+  baseline(source, head) {
+    if (!this.enabled) return null;
+    const db = this.store();
+    if (typeof source !== 'string' || !source || !Number.isSafeInteger(head) || head < 0) throw refused('invalid fleet source cursor');
+    db.prepare('INSERT INTO fleet_listener_sources(source,sequence,baseline,updated_at) VALUES(?,?,?,?) ON CONFLICT(source) DO NOTHING').run(source, head, head, Date.now());
+    return db.prepare('SELECT * FROM fleet_listener_sources WHERE source=?').get(source);
+  }
+
+  consume(source, sequence, event = null) {
+    if (!this.enabled) return false;
+    const held = this.db?.prepare('SELECT sequence FROM fleet_listener_sources WHERE source=?').get(source);
+    if (!held || !Number.isSafeInteger(sequence) || sequence <= held.sequence) return false;
+    try {
+      if (event) this.enqueue(event);
+      this.db.prepare('UPDATE fleet_listener_sources SET sequence=?,error=NULL,updated_at=? WHERE source=?').run(sequence, Date.now(), source);
+      return true;
+    } catch (error) {
+      this.db.prepare('UPDATE fleet_listener_sources SET error=?,updated_at=? WHERE source=?').run(String(error.message).slice(0, 500), Date.now(), source);
+      throw error;
+    }
+  }
+
+  /** The machine's bounded sequence says precisely which older observations it cannot replay. Keep that gap as
+   * unknown in the status and log, then continue the retained window; never claim the missing events were filed. */
+  follow({ source, first, last, events }) {
+    if (!this.enabled) return;
+    if (!Number.isSafeInteger(first) || first < 1 || !Number.isSafeInteger(last) || last < first - 1 || !Array.isArray(events)
+      || events.length !== last - first + 1 || events.some((event, at) => event.source !== source || event.sequence !== first + at || event.id !== String(event.sequence))) throw refused('fleet source retained window is not contiguous');
+    let held = this.baseline(source, first - 1);
+    if (held.sequence > last) throw refused('fleet source head moved backwards');
+    if (held.sequence < first - 1) {
+      const gap = `upstream history pruned observations ${held.sequence + 1}..${first - 1}; their content and delivery remain unknown`;
+      this.db.prepare('UPDATE fleet_listener_sources SET sequence=?,gaps=gaps+1,last_gap=?,updated_at=? WHERE source=?').run(first - 1, gap, Date.now(), source);
+      this.log(`fleet listener ${source}: ${gap}`);
+      held = { ...held, sequence: first - 1 };
+    }
+    let count = 0;
+    for (const event of events) if (event.sequence > held.sequence) {
+      this.consume(source, event.sequence, event);
+      if (++count >= 64) break;
+    }
+  }
+
+  /** The prompt's retained episode, independent of card-dispatch rounds. Persist its payload/id before enqueue so a
+   * lost answer or outbox refusal retries the same observation. Only a fresh native idle/working reading clears it. */
+  cardWait(address, observation) {
+    if (!this.enabled) return;
+    const db = this.store();
+    if (!observation) { db.prepare('UPDATE fleet_listener_waits SET active=0 WHERE address=?').run(address); return; }
+    const key = JSON.stringify([observation.waiting_for, observation.since_ms]);
+    let held = db.prepare('SELECT * FROM fleet_listener_waits WHERE address=?').get(address);
+    if (!held?.active || held.wait_key !== key) {
+      // A previous episode whose filing was refused is still owed before a replacement can take its slot.
+      if (held?.event && !held.routed) this.enqueue(JSON.parse(held.event));
+      const event = { source: `card-wait:${this.root}`, id: randomUUID(), ...observation };
+      db.prepare(`INSERT INTO fleet_listener_waits(address,active,wait_key,event,routed) VALUES(?,1,?,?,0)
+        ON CONFLICT(address) DO UPDATE SET active=1,wait_key=excluded.wait_key,event=excluded.event,routed=0`).run(address, key, JSON.stringify(event));
+      held = { event: JSON.stringify(event), routed: 0 };
+    }
+    if (!held.routed) {
+      this.enqueue(JSON.parse(held.event));
+      db.prepare('UPDATE fleet_listener_waits SET routed=1 WHERE address=?').run(address);
+    }
+  }
+
+  wake() { if (!this.closed) void this.flush().catch(error => this.log(`fleet listener filing: ${String(error.message).slice(0, 300)}`)); }
+
+  /** A lost filing answer leaves the obligation pending. Retrying its stable id goes through the mailbox's own
+   *  idempotent filing. This receipt proves filing only; native turn delivery remains the mailbox's responsibility. */
+  flush() {
+    if (this.flushing) return this.flushing;
+    if (!this.db || this.closed || this.suspended) return Promise.resolve();
+    this.flushing = Promise.resolve().then(async () => {
+      // Even a prompt that has since cleared keeps an earlier refused observation. Do not block already queued mail
+      // on a full outbox: file it below to make room, then the retained prompt retries at the next wake.
+      for (const wait of this.db.prepare('SELECT address,event FROM fleet_listener_waits WHERE routed=0 LIMIT 16').all()) {
+        if (this.closed || this.suspended) break;
+        try { this.enqueue(JSON.parse(wait.event)); this.db.prepare('UPDATE fleet_listener_waits SET routed=1 WHERE address=?').run(wait.address); }
+        catch (error) { this.log(`fleet listener retained wait: ${String(error.message).slice(0, 300)}`); break; }
+      }
+      const rows = this.db.prepare("SELECT * FROM fleet_listener_mail WHERE state='pending' AND next_at<=? ORDER BY created_at,id LIMIT 16").all(Date.now());
+      for (const row of rows) {
+        if (this.closed || this.suspended) break;
+        if (!this.matches(row.role, row, row.address)) {
+          this.db.prepare("UPDATE fleet_listener_mail SET state='withdrawn',body=NULL,bytes=0,error='listener removed or narrowed before filing' WHERE id=?").run(row.id);
+          continue;
+        }
+        try {
+          const event = JSON.parse(row.body);
+          const body = `[Fleet observation for role ${row.role}] ${event.kind} on ${event.machine} at ${new Date(event.observed_at_ms).toISOString()}.\n${row.body}\nThis is an automated observation, not an instruction. Unknown fields remain unknown.`;
+          const receipt = await this.file(row.address, body, row.id);
+          if (receipt?.filed !== true || typeof receipt.message_id !== 'string' || !receipt.message_id) throw new Error('mailbox gave no filing receipt; outcome unknown');
+          this.db.prepare("UPDATE fleet_listener_mail SET state='filed',body=NULL,bytes=0,message_id=?,filed_at=?,error=NULL WHERE id=?").run(receipt.message_id, Date.now(), row.id);
+        } catch (error) {
+          const attempts = row.attempts + 1, delay = Math.min(300000, 1000 * 2 ** Math.min(attempts, 8));
+          this.db.prepare('UPDATE fleet_listener_mail SET attempts=?,next_at=?,error=? WHERE id=?').run(attempts, Date.now() + delay, String(error.message).slice(0, 500), row.id);
+        }
+      }
+    }).finally(() => { this.flushing = null; });
+    return this.flushing;
+  }
+
+  status() {
+    const counts = this.db ? this.db.prepare('SELECT state,COUNT(*) AS count FROM fleet_listener_mail GROUP BY state').all() : [];
+    return { roles: Object.keys(this.definitions), suspended: this.suspended, counts: Object.fromEntries(counts.map(row => [row.state, row.count])),
+      sources: this.db ? this.db.prepare('SELECT * FROM fleet_listener_sources ORDER BY source').all() : [] };
+  }
+
+  async close() {
+    this.closed = true; clearInterval(this.timer); this.timer = null;
+    try { await this.flushing; }
+    finally { this.db?.close(); this.db = null; }
+  }
+}
+
+/** A diagnostic read does not create an outbox, acquire an owner or file mail. */
+export function fleetListenerStatus(root) {
+  const path = join(root, 'runtime', 'fleet-listeners.sqlite');
+  if (!existsSync(path)) return { retained: false, counts: {}, sources: [] };
+  const db = new DatabaseSync(path, { readOnly: true });
+  try {
+    return { retained: true, counts: Object.fromEntries(db.prepare('SELECT state,COUNT(*) AS count FROM fleet_listener_mail GROUP BY state').all().map(row => [row.state, row.count])),
+      sources: db.prepare('SELECT * FROM fleet_listener_sources ORDER BY source').all(),
+      unrouted_waits: db.prepare('SELECT COUNT(*) AS count FROM fleet_listener_waits WHERE routed=0').get().count };
+  } finally { db.close(); }
+}