@volter/supercode-orchestrator 0.5.207 → 0.5.208

package/board/dispatch.mjs

@@ -33,12 +33,16 @@ let fleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, withFreshReviewReads, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { setImmediate as yieldToOwner } from 'node:timers/promises';
 import { runtimeDoor } from './runtime-door.mjs';
-import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, recordUsageUnread, agentPreamble, agentEnvironment, recordAgentRun, cardAgentAssignments,handOffAgents, agentRunForSession } from '../agents.mjs';
+import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, recordUsageUnread, agentPreamble, agentEnvironment, recordAgentRun, cardAgentAssignments,renameCardAgent,handOffAgents, agentRunForSession } from '../agents.mjs';
 import { finishCardAgentAssignment, recordCardAgentAssignment } from './agent-declarations.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
 import { memorySnapshot } from '../hermes-cli.mjs';
-import { hermesModel } from '../worker-route.mjs';
-import { MODEL_ARGUMENTS } from '../activation.mjs';
+import { hermesModel, codexPaneRoute } from '../worker-route.mjs';
+import { refreshVault } from '../orchestration.mjs';
+import { projectCodexPaneResume } from '../codex-pane-resume.mjs';
+import { codexPaneInputs } from './codex-pane-inputs.mjs';
+import { declareWorkerHome } from '../activation.mjs';
+import { MODEL_ARGUMENTS, NAME_ARGUMENTS } from '../activation.mjs';
 import { createRequire } from 'node:module';
 import { spawn as spawnChild, execFile } from 'node:child_process';
 import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
@@ -46,7 +50,7 @@ import { homedir, hostname, tmpdir, totalmem } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { view, boardCopyOf, boardPath, briefPath, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, openBoard, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
+import { view, boardCopyOf, boardKey, boardPath, cardHandleOf, readableIdOf, briefPath, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, openBoard, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
 import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, projectStatus, storedStatus, templateValue, workflowFor } from './workflow.mjs';
 import { checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace } from './workspace.mjs';
 import { capacity, dispatched, executionHost, harnessDefaults, holdings } from './capacity.mjs';
@@ -153,7 +157,7 @@ export function callerSession() {
 export async function observeFleet(root = fleetRoot) {
   const machines = await homeFleetMachines(root, normalMachine);
   const fleet = await readMachineFleet(machines, localMachine());
-  presenceReading = { known: fleet.presenceKnown === true, online: new Set([localMachine(), ...fleet.online]), unknown: fleet.unknown ?? new Set() };
+  presenceReading = { known: fleet.presenceKnown === true, online: new Set([localMachine(), ...fleet.online]), offline: fleet.offline ?? new Set(), unknown: fleet.unknown ?? new Set(), errors: fleet.errors ?? new Map() };
   notePresence(presenceReading);
   return fleet;
 }
@@ -199,10 +203,11 @@ async function agentMain(address) {
   if (held && Date.now() - held.at <= READING_MS) return held.main;
   const { machine, name } = agentAt(address);
   const local = machine === localMachine();
-  const r = await doorOn(machine, 'harness.v1.agent.show', { name, ...(local ? { claim: { pid: process.pid, ppid: process.ppid, session: null, named: null, owner: null } } : {}) }, { timeout: 5_000 });
+  const r = await doorOn(machine, 'harness.v1.agent.show', { name, records_only: true, ...(local ? { claim: { pid: process.pid, ppid: process.ppid, session: null, named: null, owner: null } } : {}) }, { timeout: 5_000 });
   const answer = r.code === 0 ? lastJson(r.stdout) : null;
-  const main = answer?.agents?.[0]?.main_session;
-  const read = { at: Date.now(), main: typeof main === 'string' && main ? main : answer && Number.isInteger(answer.code) && answer.code !== 0 ? false : null };
+  const agent = answer?.agents?.[0], main = agent?.main_session;
+  const read = { at: Date.now(), main: typeof main === 'string' && main ? main : answer && Number.isInteger(answer.code) && answer.code !== 0 ? false : null,
+    sessions: [main, ...(agent?.former_mains ?? [])].filter(value => typeof value === 'string' && value) };
   agentMains.set(address, read);
   return read.main;
 }
@@ -211,6 +216,8 @@ async function agentMain(address) {
  * An agent's address is as live as its main session.
  */
 async function subscriberAlive(fleet, address) {
+  // The mail router's current inventory includes native sessions outside the pane/discovery reading.
+  if (fleet.noticeAlive?.has(address)) return true;
   if (fleet.alive.has(address)) return true;
   if (agentAt(address)) {
     const main = await agentMain(address);
@@ -230,7 +237,7 @@ async function subscriberAlive(fleet, address) {
  * daemon's index dropped a parent session that ran a subagent, so its absence there is never read as gone.
  */
 function subscriberGone(fleet, address) {
-  if (fleet.alive.has(address) || fleet.native?.has(address)) return false;
+  if (fleet.noticeAlive?.has(address) || fleet.alive.has(address) || fleet.native?.has(address)) return false;
   const session = sessionAt(address);
   const seen = session && discoveries.get(nativeKey(session.machine, session.harness, session.session_id));
   if (!seen?.complete) return false;
@@ -275,7 +282,12 @@ const txRead = (board, fn) => tx(board, fn);
 /** Take the readings a decision or a board write about `session` will need, before it. */
 async function readBefore(fleet, session) {
   if (!session?.machine || session.surface === 'headless') return;
-  if (session.session_id) try { await readNative(session.machine, session.harness ?? 'claude-code', session.session_id); } catch { /* unread: unknown */ }
+  // A pane may use a different Codex home than its daemon. Its native activity
+  // locator names the source to discover; the daemon's default can miss it.
+  const locator = fleet?.sessions?.find(row => row.address === addressOf(session))?.locator;
+  const codexHome = session.codex_home ?? (session.harness === 'codex' && locator?.storage?.kind === 'file'
+    ? /^(.*)[\\/]sessions[\\/]/.exec(locator.storage.path)?.[1] : null);
+  if (session.session_id) try { await readNative(session.machine, session.harness ?? 'claude-code', session.session_id, codexHome); } catch { /* unread: unknown */ }
   if (session.pane && !fleet?.native?.has(addressOf(session))) await readPaneList(session.machine);
 }
 /** A session's native discovery as this round read it (readNative); throws (unavailable) when it was not read. */
@@ -285,26 +297,29 @@ function nativeSessions(machine, harness, sessionId) {
   throw unavailable('native liveness is read before it is used (readBefore), and was not');
 }
 /** Read a session's native discovery through its machine's door, once a round. */
-async function readNative(machine, harness, sessionId) {
+async function readNative(machine, harness, sessionId, codexHome = null) {
   const key = nativeKey(machine, harness, sessionId), seen = discoveries.get(key);
-  if (seen) return seen.sessions;
-  const { sessions, complete } = await discoverNative(machine, harness, sessionId);
-  discoveries.set(key, { at: Date.now(), sessions, complete });
+  const home = harness === 'codex' ? codexHome ?? seen?.codex_home ?? null : null;
+  if (seen && (seen.codex_home ?? null) === home) return seen.sessions;
+  const { sessions, complete } = await discoverNative(machine, harness, sessionId, home);
+  discoveries.set(key, { at: Date.now(), sessions, complete, codex_home: home });
   return sessions;
 }
 // A native discovery is bounded as the fleet reading is: one that does not answer in time is unknown, read next round.
 const NATIVE_DISCOVERY_MS = 15_000;
 const nativeKey = (machine, harness, sessionId) => `${normalMachine(machine)}\u0000${harness}\u0000${sessionId}`;
-async function discoverNative(machine, harness, sessionId) {
+async function discoverNative(machine, harness, sessionId, codexHome = null) {
   if (offlineMachine(machine)) throw unavailable(`native liveness unavailable: machine ${normalMachine(machine)} is offline`);
   // the machine's own harness door, this one's or another's, as every other harness read here is
   // Liveness uses the native activity receipt, never transcript previews. A name miss can match many retained
   // rows; opening every one for its messages delays the board's liveness decision for data it never reads.
-  const result = await doorOn(machine, 'harness.v1.sessions.discover', { harnesses: [harness], query: sessionId, limit: 2000, include_latest_candidates: false }, { timeout: NATIVE_DISCOVERY_MS });
+  const result = await doorOn(machine, 'harness.v1.sessions.discover', { harnesses: [harness], query: sessionId, limit: 2000, include_latest_candidates: false, ...(harness === 'codex' && codexHome ? { homes: { codex: join(codexHome, 'sessions') } } : {}) }, { timeout: NATIVE_DISCOVERY_MS });
   const page = result.code === 0 ? lastJson(result.stdout) : null;
   if (!Array.isArray(page?.sessions)) throw unavailable(`native liveness unavailable on ${machine}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
-  // whole: every source read, nothing truncated, from an index that keeps every session's own row (subscriberGone)
-  const complete = page.subagent_rows === 'own' && !(Array.isArray(page.failed) && page.failed.length) && !page.receipt?.truncated && page.next_cursor == null;
+  // whole: every source read and none still being reconciled, nothing truncated, from an index that keeps every
+  // session's own row (subscriberGone); a source still being read answers from the rows it held before
+  const complete = page.subagent_rows === 'own' && !(Array.isArray(page.failed) && page.failed.length) && !page.reconciling?.length
+    && !page.receipt?.truncated && page.next_cursor == null;
   return { sessions: page.sessions, complete };
 }
 /**
@@ -317,7 +332,7 @@ async function nativeAbsent(session) {
   if (!session?.session_id || !session.machine) return false;
   const harness = session.harness ?? 'claude-code';
   try {
-    const rows = await readNative(session.machine, harness, session.session_id);
+    const rows = await readNative(session.machine, harness, session.session_id, session.codex_home ?? null);
     return discoveries.get(nativeKey(session.machine, harness, session.session_id))?.complete === true
       && !rows.some((r) => r.locator?.session_id === session.session_id);
   } catch { return false; }
@@ -399,17 +414,16 @@ function runLane(db, board, entry, task, lanes) {
   return lanes[profile] ?? {};
 }
 
-// The latest presence reading (observeFleet). A machine that did not answer it (offline, or unread this round) is not
-// asked again until the next reading: each remote call would wait out its timeout, and one silent machine held every
-// close and launch on this one. Its door answers `machine_offline`, which every caller tries again next round.
+// Only a current explicit unlink establishes offline. A missing or unread record is unknown and cannot suppress
+// a bounded direct door call: the record stream and that machine's channel are independent paths.
 let presenceReading = null;
 const offlineMachine = (machine) => {
   const m = normalMachine(machine ?? localMachine());
-  return m !== localMachine() && presenceReading?.known === true && !presenceReading.online.has(m);
+  return m !== localMachine() && presenceReading?.known === true && presenceReading.offline.has(m);
 };
 /** A machine's public door (`harness.v1.*`), answered at once when the machine reads as offline. */
 const doorOn = async (machine, method, params, options) => offlineMachine(machine)
-  ? { code: 1, stdout: '', stderr: JSON.stringify({ code: 'machine_offline', message: `machine ${normalMachine(machine)} did not answer the fleet reading` }) }
+  ? { code: 1, stdout: '', stderr: JSON.stringify({ code: 'machine_offline', message: `machine ${normalMachine(machine)} is unlinked in the current fleet record: ${presenceReading.errors.get(normalMachine(machine)) ?? 'unlinked from the team'}` }) }
   : await runtimeDoor(normalMachine(machine ?? localMachine()) === localMachine() ? null : machine, method, params, options);
 const unavailable = message => Object.assign(new Error(message), { launchDeferred: true });
 
@@ -517,7 +531,7 @@ async function supervise(board, fleet, settings, report, entry, effects) {
     let locator;
     try { locator = nativeReading(nativeSessions(session.machine, session.harness, session.session_id), session).row?.locator; } catch { continue; }
     if (!locator) continue;
-    const answer = await doorOn(session.machine, 'harness.v1.sessions.load', { locator, options: { include_subagents: false, message_limit: 0, inline_media: 'metadata' } }, { timeout: NATIVE_DISCOVERY_MS });
+    const answer = await doorOn(session.machine, 'harness.v1.sessions.load', { locator, view: { first_response_only: true }, options: { include_subagents: false, message_limit: 0, inline_media: 'metadata' } }, { timeout: NATIVE_DISCOVERY_MS });
     const loaded = answer.code === 0 ? lastJson(answer.stdout) : null;
     const response = loaded?.session?.first_response;
     if (loaded?.session?.session_id !== session.session_id || !['response', 'error'].includes(response?.outcome)
@@ -786,7 +800,7 @@ async function stopOwnedSession(board, session) {
     if (r.code !== 0) throw new Error(`${doorTransient(r) ? 'close deferred: ' : ''}closing native session ${addressOf(session)}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
     // the close's receipt is a discovery taken after it, never the round's cached one from before
     discoveries.delete(nativeKey(session.machine, session.harness, session.session_id));
-    const reading = nativeReading(await readNative(session.machine, session.harness, session.session_id), session);
+    const reading = nativeReading(await readNative(session.machine, session.harness, session.session_id, session.codex_home ?? null), session);
     if (reading.alive !== false) throw new Error(`native close has no confirmed stopped receipt for ${addressOf(session)}`);
     return;
   }
@@ -1070,8 +1084,8 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
   const scope = view(board, (db) => scopeOf(db, board, task, { params: entry.params }));
   const where = whereOf(board, task);
   // a subtask's run also sees its arc: the arc's text, tasks and thread (where its owner's rulings are)
-  const arcContext = task.subtask_of ? view(board, (db) => cardContext(db, task.subtask_of)) : '';
-  let prompt = render(spec.prompt, { ...scope, where, context: view(board, (db) => cardContext(db, id)), arc_context: arcContext, doors: doors(entry.workflow, status, spec.role, id, where, surface) });
+  const arcContext = task.subtask_of ? view(board, (db) => cardContext(db, task.subtask_of, { nativeHolds: Boolean(entry.workflow.flags?.paused) })) : '';
+  let prompt = render(spec.prompt, { ...scope, where, context: view(board, (db) => cardContext(db, id, { nativeHolds: Boolean(entry.workflow.flags?.paused) })), arc_context: arcContext, doors: doors(entry.workflow, status, spec.role, id, where, surface) });
   // the run's session record knows its status, role and slot (a reviewer's slot is never the implementer's); the slot
   // is a template, so a step can ask for isolation by naming a new one
   const slot = String(templateValue(spec.session ?? 'worker', scope) ?? 'worker');
@@ -1113,7 +1127,7 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
     // and its sessions are joined to it off this path, after the launch. No Teams answer starts, stops or holds a card.
     const context=current().facts.SUPERCODE_CONTEXT,team=agentScope(context);
     const agent=await localCardAgent({root:board.root,org:team.org,server:team.server,profiles:entry.profiles,
-      profile:lane.name,card:id,role:spec.role??slot,sponsor:task.sponsor??null});
+      profile:lane.name,card:id,handle:cardHandleOf(board,id),readableId:readableIdOf(board,id),role:spec.role??slot});
     assertRunCurrent(board,id,runId);
     recordCardAgentAssignment(board,cardAgentAssignments(board.root,id).find(assignment=>assignment.org===team.org&&assignment.id===agent.assignment));
     // G3: a run of an agent over its budget does not start; the reason waits on the card until the window passes
@@ -1132,7 +1146,7 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
     if(surface==='headless')meta.agent_env.HERMES_HOME=agentHome;
     else{const memory=await memorySnapshot(agentHome).catch(()=>'');assertRunCurrent(board,id,runId);if(memory)prompt=`${prompt}\n\n${memory}`;}
     const result = surface === 'pane'
-      ? await launchPane(board, task, runId, lane, fleet, { input: briefByReference(board, task, runId, spec.role ?? slot, where, prompt), slot, meta })
+      ? await launchPane(board, task, runId, lane, fleet, { input: briefByReference(board, task, runId, spec.role ?? slot, where, prompt), slot, meta, orchestration: entry.orchestration ?? { profiles: entry.profiles } })
       : await launchHeadless(board, task, runId, lane, settings, { prompt, skills: spec.skills ?? [], meta });
     tx(board,db=>{
       if(!runCurrent(db,id,runId))return; // replaced once launched: its session is the ended run's, closed as one
@@ -1179,7 +1193,8 @@ export function briefByReference(board, task, runId, role, where, prompt) {
   const local = !task.machine || normalMachine(task.machine) === localMachine();
   const from = local ? `in the file ${file}: read the whole file now`
     : `kept by the board: print it with \`supercode workflow brief ${task.id} ${where}\` (into a file outside your repository when it is long) and read all of it now`;
-  return `The ${board.label} board started run ${runId} of card ${task.id} and you are its ${role}. Your instructions from the board are the brief ${from}, then carry it out as your own task without waiting for another message.`;
+  const ref = cardHandleOf(board, task.id)?.toUpperCase();
+  return `The ${board.label} board started run ${runId} of card ${ref ? `${ref} (${task.id})` : task.id} and you are its ${role}. Your instructions from the board are the brief ${from}, then carry it out as your own task without waiting for another message.`;
 }
 
 /** Start one card now by a person's word (a triage card's session, a manager's start): the workflow's start event. */
@@ -1499,7 +1514,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
     try {
       const machine = session.machine ?? localMachine();
       if (session.surface === 'native' && !session.pane) {
-        const reading = nativeReading(await readNative(machine, session.harness, session.session_id), session);
+        const reading = nativeReading(await readNative(machine, session.harness, session.session_id, session.codex_home ?? null), session);
         if (reading.alive == null) throw new Error(`close deferred: native liveness unknown for ${addressOf(session)}`);
         if (reading.alive) {
           const protectedNow = active.some(r => addressOf(json(r.metadata, {})?.supercode) === addressOf(session));
@@ -1627,10 +1642,15 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       staged = []; watched = null;
       const task = getTask(db, id);
       const status = statusOf(db, task);
-      if (!(entry.workflow.statuses[status]?.on?.session_idle || entry.workflow.on?.session_idle || entry.workflow.run?.on?.session_idle)) return;
+      const handles = name => entry.workflow.statuses[status]?.on?.[name] || entry.workflow.on?.[name] || entry.workflow.run?.on?.[name];
+      if (!handles('session_idle') && !handles('session_stalled')) return;
       const runRow = currentRun(db, id);
       let session = runRow?.metadata?.supercode;
       if (!session?.session_id || !['pane', 'native'].includes(session.surface) || session.offline_since != null) return;
+      if (task.paused || task.archived || task.detached || runRow.ended_at != null) {
+        if (session.idle_since != null || session.idle_notice) setRunSession(db, runRow.id, { idle_since: null, idle_notice: null, watch_since: now() });
+        return;
+      }
       // a machine this round did not read as online (offline, or its door silent) shows nothing of its session: no
       // clock of the run moves on a round that could not see it
       if (session.machine && !fleet.online.has(session.machine)) return;
@@ -1696,6 +1716,7 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       // a reading that shows the session no longer waiting ends the prompt; a round that did not read it does not
       if (session.held_notice && live && !asked) setRunSession(db, runRow.id, { held_notice: null });
       if (asked) {
+        if (session.idle_since != null || session.idle_notice) setRunSession(db, runRow.id, { idle_since: null, idle_notice: null });
         // One prompt is one notice: the same wait (what it waits for, since when its harness says) on the same
         // session, whichever of its cards a round reads first and however long it stands.
         const key = [address, live.waiting_for ?? '', live.turn_since_ms ?? ''].join('|');
@@ -1715,7 +1736,7 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
         return;
       }
       if (live?.turn === 'working' || delegated.length) {
-        if (session.idle_since != null) setRunSession(db, runRow.id, { idle_since: null });
+        if (session.idle_since != null || session.idle_notice) setRunSession(db, runRow.id, { idle_since: null, idle_notice: null });
         retain(delegated.length ? 'delegated_work' : 'working', { delegated_sessions: delegated });
         return;
       }
@@ -1723,6 +1744,7 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       // indefinitely. Bound the observed interval independently of transcript
       // writes, and tell the manager once with the native facts we actually read.
       if (live?.turn !== 'idle') {
+        if (session.idle_since != null || session.idle_notice) setRunSession(db, runRow.id, { idle_since: null, idle_notice: null });
         const since = Number(session.unknown_since ?? observedAt);
         reading.unknown_since = since;
         reading.quiet_seconds = Math.max(0, observedAt - since);
@@ -1747,6 +1769,29 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       const interval = idleInterval(session, live, observedAt);
       reading.idle_since = interval.since; reading.quiet_seconds = interval.quiet;
       if (session.idle_since !== interval.since) setRunSession(db, runRow.id, { idle_since: interval.since });
+      // The workflow declares the threshold, repeat interval, eligibility and
+      // notice. The observer only supplies a watched native idle interval. This
+      // path precedes heartbeat/nudge cooldown and unread checkout handling.
+      if (handles('session_stalled')) {
+        const limits = limitsOf(db, board, entry, task, session);
+        const first = Number(limits.idle_notice), repeat = Number(limits.idle_notice_repeat);
+        const nativeIdle = live?.turn_since_ms ?? null;
+        const prior = session.idle_notice?.native_since_ms === nativeIdle ? session.idle_notice : null;
+        const due = first > 0 && interval.quiet >= first && (!prior || (repeat > 0 && observedAt - prior.at >= repeat));
+        if (due) try {
+          const turnAt = Number(live?.turn_since_ms) || (lastAt > 0 ? Number(lastAtMs) : null);
+          const payload = { ...reading, session: address, run_id: runRow.id, last_turn_at_ms: turnAt,
+            last_turn_at: turnAt ? new Date(turnAt).toISOString() : null,
+            last_turn_time_source: Number(live?.turn_since_ms) > 0 ? 'native_idle_since' : turnAt ? 'last_session_update' : null, repeat: Boolean(prior) };
+          const result = fire(db, board, entry, id, 'session_stalled', { roles: ['platform'], payload });
+          staged.push(...result.effects);
+          setRunSession(db, runRow.id, { idle_notice: { native_since_ms: nativeIdle, since: interval.since, at: observedAt } });
+          report.notified.push([id, 'session_stalled', address]);
+        } catch (error) {
+          if (!error.noTransition) report.failed.push([id, `session_stalled: ${String(error.message).slice(-200)}`]);
+        }
+      }
+      if (!handles('session_idle')) return;
       if (reading.quiet_seconds < settings.idleQuiet) { retain('below_threshold'); return; }
       if (session.goal_nudged_at && observedAt - session.goal_nudged_at < settings.idleQuiet) { retain('nudge_cooldown'); return; }
       // a session whose first input bounced was never told its work: its quiet is not idleness (recordBounces told its manager)
@@ -1801,7 +1846,7 @@ export async function sessionNotice(board, e) {
   const address = e.address ?? addressOf(prior);
   if (!address) throw new Error('lifecycle notice awaits the owned launch session identity');
   const card = view(board, (db) => getTask(db, e.id));
-  const subject = numbered(card?.number, `${String(e.verb ?? 'run_changed').replaceAll('_', ' ')} · run ${e.runId} · event ${e.sourceEvent ?? 'none'} · ${card?.title || e.id}`);
+  const subject = numbered(boardKey(board.root, board.slug), card?.number, `${String(e.verb ?? 'run_changed').replaceAll('_', ' ')} · run ${e.runId} · event ${e.sourceEvent ?? 'none'} · ${card?.title || e.id}`);
   const filed = await fileMail(board, address, e.text, effectMessageKey(e), { subject });
   tx(board, (db) => {
     const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(e.runId)?.metadata, {})?.supercode;
@@ -1822,7 +1867,7 @@ export async function sessionEffect(board, e) {
     if (!address) throw new Error('actor session identity unavailable');
     // filed in the actor's mailbox, which delivers it
     const card = view(board, (db) => getTask(db, e.id));
-    const filed = await fileMail(board, address, e.text, effectMessageKey(e), { subject: numbered(card?.number, `actor notice · run ${e.runId ?? 'none'} · ${card?.title || e.id}`) });
+    const filed = await fileMail(board, address, e.text, effectMessageKey(e), { subject: numbered(boardKey(board.root, board.slug), card?.number, `actor notice · run ${e.runId ?? 'none'} · ${card?.title || e.id}`) });
     if (filed.new) tx(board, db => event(db, e.id, 'actor_notice_filed', { notice: e.durableId, address, message_id: filed.message_id }, e.runId));
     return true;
   }
@@ -1897,7 +1942,7 @@ function launcherCheck(db, task, lane, fleet) {
   if (!task.machine) return 'the card names no machine; a pane session runs on the machine its card names';
   const machine = executionHost(lane, task.machine, localMachine(), normalMachine);
   if (!fleet.ok) return `supercode could not read the fleet: ${fleet.error}`;
-  if (fleet.unknown?.has(machine)) return `machine ${machine}'s door did not answer; the card starts when it does`;
+  if (fleet.unknown?.has(machine)) return `machine ${machine}'s fleet record is not current: ${fleet.errors?.get(machine) ?? 'no current record'}; the card starts when it is`;
   // a machine is scheduled only when it can take a board launch: its board process guard runs this harness, and its
   // daemon keeps keyed launches (it reconciles them itself). One without them is not scheduled, and says why.
   const can = fleet.capabilities?.get(machine);
@@ -1987,9 +2032,9 @@ function launchReading(fleet, session) {
 }
 
 /** How a keyed launch ended, as its machine recorded it; read only where the machine has the door (supervise). */
-async function launchReceipt(board, session) {
+async function launchReceipt(board, session, timeout = 30_000) {
   const r = await doorOn(session.machine, 'harness.v1.launches.get',{key:session.launch_key},
-    { timeout: 30_000, as: boardAddress(board.label) });
+    { timeout, as: boardAddress(board.label) });
   if (r.code !== 0) throw unavailable(`launch receipt unavailable on ${session.machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
   if (r.stdout.trim() === 'null') return null;
   const receipt = lastJson(r.stdout);
@@ -2105,7 +2150,10 @@ async function synchronizeAgents(board, report) {
     await yieldToOwner();
     const task=getTaskNow(board,assignment.target);
     if(task&&(assignment.state==='ended'||task.archived||['done','cancelled'].includes(task.status)))finishCardAgentAssignment(board,assignment,`card ${assignment.target} ${task.archived?'archived':task.status}`);
-    else if(task)recordCardAgentAssignment(board,assignment);
+    else if(task){
+      if(task.readable_id)renameCardAgent(board.root,assignment,task.readable_id);
+      recordCardAgentAssignment(board,assignment);
+    }
   }
   // What a creating or closing verb could not hand on (no daemon running then) is handed on here.
   try{for(const pending of await handOffAgents(board.root))report.queued.push([pending.agent,pending.error]);}
@@ -2145,8 +2193,7 @@ async function reconcileLaunches(board, fleet, report, entry, effects, settings,
   const rows = view(board, (db) => db.prepare(`SELECT id, task_id, started_at, ended_at, metadata FROM task_runs
     WHERE json_extract(metadata, '$.supercode.launch_pending') = 1
     AND json_extract(metadata, '$.supercode.close_confirmed_at') IS NULL`).all());
-  // A keyed launch whose session is not bound yet is bound from this round's fleet reading: its pane, and the session
-  // the reading finds in it. Its machine's daemon reconciles the key itself (D137); no door is asked here. A launch with
+  // A keyed launch is bound from the fleet reading, or its machine's exact native first-input receipt. A launch with
   // no pane waits for its launch window (supervise surfaces it then); a pane read absent on its online machine after
   // the grace ended before its session was bound.
   for (const row of rows) {
@@ -2157,6 +2204,16 @@ async function reconcileLaunches(board, fleet, report, entry, effects, settings,
         && ((s.pane && f.pane === s.pane) || (s.session_id && f.session_id === s.session_id)));
       const sid = s.session_id ?? found?.address.split(':')[3];
       if (found && sid) { bindLaunch(board, row, s, found.pane ?? s.pane, sid); continue; }
+      // An app-server-owned Codex thread can confirm its first input before process discovery knows that thread.
+      // Bind only this board's live issuance, its exact pane and the native user-message receipt, never a title match.
+      if (!row.ended_at && s.launch_key && launchReading(fleet, s) === 'present') {
+        const receipt = await launchReceipt(board, s, 5000);
+        if (receipt?.by === boardAddress(board.label) && receipt.pane === s.pane && receipt.live === true
+            && receipt.inputDelivered === true && receipt.inputReceipt === 'native-user-message'
+            && typeof receipt.native_session === 'string' && receipt.native_session) {
+          bindLaunch(board, row, s, s.pane, receipt.native_session); continue;
+        }
+      }
       // An ended run's launch that bound no session within its window awaits nothing: the run is over, and its pane's
       // close (closeRequested) needs no session. It was reported as awaiting its session every round, for good, once
       // its machine refused that close (t_7ec85b6b run 1203, 2026-10-09).
@@ -2186,7 +2243,7 @@ async function reconcileLaunches(board, fleet, report, entry, effects, settings,
   }
 }
 
-async function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'worker', meta = {} } = {}) {
+async function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'worker', meta = {}, orchestration } = {}) {
   const machine = executionHost(lane, task.machine, localMachine(), normalMachine);
   // Whether a board session opens a terminal window on its machine is the workflow's choice, stated on every launch;
   // no machine default decides it.
@@ -2246,6 +2303,43 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   // The pane id is chosen from the launch key and recorded before open runs, so a launch whose answer is lost (a
   // timeout, a closed stream) is still found by its pane in a later round's fleet reading, and by its session id.
   const openOwned = async (key, sid, mode, args) => {
+    // Keeping a live pane never prepares or mutates a different route/home.
+    if (harness === 'codex') {
+      const profile = meta.agent_profile_intent;
+      if (!profile || !orchestration) throw unavailable('headful Codex has no retained profile route; no shared-login pane was launched');
+      const vault = new Map();
+      refreshVault(orchestration, vault);
+      const selected = { ...profile, name: lane.name, dir: lane.dir };
+      const worker = { ...profile.worker, harness: 'codex', model: model ?? undefined };
+      let resume = null;
+      if (mode === 'resume') {
+        const rows = await readNative(machine, 'codex', sid, prev?.codex_home ?? null);
+        const paths = [...new Set(rows.filter(row => row.locator?.harness === 'codex' && row.locator?.session_id === sid
+          && row.locator.storage?.kind === 'file').map(row => row.locator.storage.path))];
+        if (paths.length !== 1) throw unavailable('the resumed Codex has no unique physical transcript source; no pane was launched');
+        resume = { source: paths[0], id: sid };
+      }
+      let route;
+      if (machine === localMachine()) {
+        route = codexPaneRoute(selected, worker, vault);
+        if (resume) projectCodexPaneResume(route.env.CODEX_HOME, resume.source, resume.id);
+      } else {
+        const prepared = await doorOn(machine, 'harness.v1.codex.pane.prepare', {
+          scope: `${localMachine()}:${board.root}:${lane.name}`, machine: localMachine(),
+          cwd: task.workspace_path,
+          ...codexPaneInputs(selected, worker, vault), ...(resume ? { resume } : {}),
+        }, { timeout: 30_000, as: boardAddress(board.label) });
+        route = prepared.code === 0 ? json(prepared.stdout.trim(), null) : null;
+        if (!route?.env?.CODEX_HOME || !Array.isArray(route.args))
+          throw unavailable(`the destination did not prepare the login-free Codex route: ${prepared.stderr.trim() || 'invalid route receipt'}`);
+      }
+      meta.codex_home = route.env.CODEX_HOME;
+      const separator = args.indexOf('--');
+      if (separator < 0) throw unavailable('the headful Codex launch has no native argument boundary');
+      args = [...args.slice(0, separator), ...Object.entries(route.env).flatMap(([name, value]) => ['--env', `${name}=${value}`]),
+        ...args.slice(separator), ...route.args];
+      if (machine === localMachine()) declareWorkerHome({ harness: 'codex', env: route.env, cwd: task.workspace_path });
+    }
     const chosen = `p_${createHash('sha256').update(key).digest('hex').slice(0, 16)}`;
     tx(board, (db) => {
       if (!runCurrent(db, task.id, runId)) throw Object.assign(new Error(`run ${runId} of ${task.id} ended or was replaced while its launch was prepared; nothing was started`), { launchSuperseded: true });
@@ -2277,12 +2371,12 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     throw Object.assign(new Error(reason), { launchPending: true });
   };
   let session = null;
-  let replaced = null;
+  let replaced = null, predecessor = null;
   // A session in no pane is read on its machine before anything replaces it. One the board released (an adopted
   // session it did not launch, left running at its run's end) is never resumed beside itself: while it runs it is kept,
   // and the card's next run is delivered into it, as into any kept session.
   if (prev?.surface === 'native' && !prev.pane && (!prev.close_confirmed_at || prev.released)) {
-    const reading = nativeReading(await readNative(prev.machine, prev.harness, prev.session_id), prev);
+    const reading = nativeReading(await readNative(prev.machine, prev.harness, prev.session_id, prev.codex_home ?? null), prev);
     if (reading.alive == null) throw unavailable(`cannot establish native continuation liveness for ${addressOf(prev)}`);
     fleet.native ??= new Map(); fleet.native.set(addressOf(prev), reading);
     if (reading.alive && !prev.released && (prev.closed_at || prev.close_requested || prev.forgotten)) throw unavailable(`native session ${addressOf(prev)} is still live; its close must finish before replacement`);
@@ -2291,6 +2385,32 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     if (!prev.close_confirmed_at && prev.pane && await panePresent(prev.machine, prev.pane)) throw new Error(`forgotten session ${prev.session_id} still has live pane ${prev.pane}; close it before replacement`);
     replaced = { session_id: prev.session_id, why: 'the workflow let it go' };
   }
+  else if (prev && meta.agent_id && (predecessor = otherAgent(board, prev, meta))) {
+    // A session is continued only as the agent it belongs to: the daemon refuses any other ("session … is agent …'s;
+    // nothing resumes it as agent …"), and keeping it would deliver this run into another agent's session. A card's role
+    // agent ends with the card (finishCardAgentAssignment) and an ended agent is never started again (agents.mjs
+    // localAgent: the key's next generation is minted in its place, with fresh memory), so a reopened card's run is a new
+    // agent, as is one the manager reassigned to another agent. Its predecessor's session is let go and the run starts
+    // fresh from the card's text and thread, as a lane of another harness does (VO-2858 t_cc590655: reopened at 22:57Z on
+    // 2026-10-17, runs 1545 and 1546 ended spawn_failed resuming codex 01a14bac, agent_21e274c9's, as agent_00246aaa).
+    // Nothing is closed here: every ended run's pane was confirmed closed above (`pending`), so a session still open at
+    // this point is one the board does not close (a close refused for good, which runs on; a pane a person continued by
+    // hand, swapped in above), and is released as an adopted one is (closeRequested), never closed. The release is
+    // written to the runs that hold it before the fresh session starts, so the slot's next launch, which reads the fresh
+    // session as the slot's last, finds no pane of them still owed a close (`pending`); a Codex launch binds from a later
+    // round's reading, so the release cannot wait for this launch's own record.
+    tx(board, (db) => {
+      if (!runCurrent(db, task.id, runId)) throw Object.assign(new Error(`run ${runId} of ${task.id} ended or was replaced while its launch was prepared; nothing was started`), { launchSuperseded: true });
+      for (const r of db.prepare('SELECT id, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId)) {
+        const held = json(r.metadata, {})?.supercode;
+        if (held?.session_id !== prev.session_id || (held.slot ?? 'worker') !== slot || held.close_confirmed_at || held.close_transferred_to) continue;
+        const at = now();
+        setRunSession(db, r.id, { ...held, close_requested: held.close_requested ?? at, closed_at: held.closed_at ?? at, close_confirmed_at: at, close_error: null, released: true });
+        event(db, task.id, 'session_released', { session_id: held.session_id, pane: held.pane ?? null, machine: held.machine ?? null, reason: `it is agent ${predecessor}'s; run ${runId} is agent ${meta.agent_id}'s and starts fresh, and it is left running` }, r.id);
+      }
+    });
+    replaced = { session_id: prev.session_id, why: `it is agent ${predecessor}'s, and this run is agent ${meta.agent_id}'s`, letGo: true };
+  }
   else if (prev && (prev.harness ?? 'claude-code') !== harness) {
     // the card was reassigned to a lane of another harness: that harness starts it fresh (the card's text and thread
     // are its context), and the last session, if still open, is closed so two harnesses never work one card
@@ -2303,7 +2423,7 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     if (next === 'refuse') throw new Error(`session ${prev.session_id} still has live pane ${prev.pane}; cannot resume or replace it`);
     if (next === 'keep') {
       // the session is kept; the heartbeat's count belongs to the run that ended, so the new run starts it again
-      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_since: _is, unknown_since: _us, unknown_notice: _un, work_progress: _wp, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, close_failed_at: _cf, close_unread: _cu, close_claim: _cl, monitor_held: _mh, released: _rl, review_held: _rh, ...kept } = prev;
+      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_since: _is, idle_notice: _in, unknown_since: _us, unknown_notice: _un, work_progress: _wp, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, close_failed_at: _cf, close_unread: _cu, close_claim: _cl, monitor_held: _mh, released: _rl, review_held: _rh, ...kept } = prev;
       session = { ...kept, mode: 'adopt', launched_at: now(), seen_at: now() };
       // a kept session is told what this run is for (its card came back to it, with what happened since), only while
       // this run is still the card's current one (its pane and native reads were awaited)
@@ -2343,7 +2463,8 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
       letGo: recoversRuns(workflowFor(board.root)) && Boolean(prev.resume_failed_before_live) && Boolean(prev.close_confirmed_at) };
   } else if (prev) replaced = { session_id: prev.session_id, why: `the card moved from ${prev.machine} to ${machine}` };
   // a card keeps its context: a slot's session that cannot be kept or resumed stops the launch, and only a session the
-  // workflow let go (`forget_session`) or its manager did (a reassignment to another harness's lane) is replaced
+  // workflow let go (`forget_session`), its manager did (a reassignment to another harness's lane), or that belongs to
+  // another agent than the run's (otherAgent) is replaced
   if (replaced && !prev?.forgotten && !replaced.letGo) {
     const failed = new Error(`session ${replaced.session_id} (${slot}) could not be continued: ${replaced.why}. The board keeps a card's context and starts a new session only when the workflow lets this one go`);
     failed.resumeFailed = { session_id: replaced.session_id, slot, why: replaced.why };
@@ -2352,8 +2473,15 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   if (!session) {
     const sid = how.namesItself ? null : randomUUID();
     const launchKey = `board-${task.id}-r${runId}-${(sid ?? randomUUID()).slice(0,8)}`;
-    session = await openOwned(launchKey, sid, 'fresh', [...base, '--key', launchKey,
-      '--input', input ?? `Card ${task.id}: ${task.title}`, '--', ...(sid ? how.fresh(sid) : how.fresh()), ...tail]);
+    // A fresh session is named for its card (`vo-856-3f`; a reviewer's `vo-856-reviewer-3f`), where its harness takes a
+    // name, with the start of its id after it as the name's own suffix; a kept or resumed session keeps its name.
+    const handle = cardHandleOf(board, task.id), ref = handle?.toUpperCase();
+    const name = handle ? `${handle}${slot === 'worker' ? '' : `-${slot}`}-${(sid ?? randomUUID()).slice(0, 2)}` : null;
+    const named = name && NAME_ARGUMENTS[harness] ? NAME_ARGUMENTS[harness](name) : [];
+    // Codex names the thread after its native first-input receipt identifies it; Teams uses thread/name/set on
+    // this launch's own app-server, then reads the name back. Continuations receive no naming hint.
+    session = await openOwned(launchKey, sid, 'fresh', [...base, ...(name && harness === 'codex' ? ['--env', `SUPERCODE_SESSION_NAME=${name}`] : []), '--key', launchKey,
+      '--input', input ?? `Card ${ref ?? task.id}${ref ? ` (${task.id})` : ''}: ${task.title}`, '--', ...(sid ? how.fresh(sid) : how.fresh()), ...named, ...tail]);
     if (replaced) session.replaces = replaced.session_id;
   }
   session.harness = session.harness ?? harness;
@@ -2384,6 +2512,16 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   return session;
 }
 
+/** The agent a slot's last session belongs to, when it is not the agent this run's `meta` names: the agent store's
+ *  owner of the session where it records one in this run's org, else the agent its own run ran as. Null when it is
+ *  this run's agent, or no agent is known for it (a session from before card agents). */
+function otherAgent(board, prev, meta) {
+  let owner = null;
+  try { owner = agentRunForSession(board.root, [`${prev.harness ?? 'claude-code'}:${prev.session_id}`]); } catch { /* conflicting owners: its run's record */ }
+  const agent = owner && owner.org === meta.agent_org ? owner.agent_id : prev.agent_id ?? null;
+  return agent && agent !== meta.agent_id ? agent : null;
+}
+
 /**
  * What a slot's last session on the card's machine is to the card's next run, given whether it is live (its pane, else
  * its native process): an open session that is live is kept, and the run is delivered into it; a live pane holding a
@@ -2472,7 +2610,7 @@ function rotateLog(file, max, backups) {
 /** A headless card's directory on this machine, made as Hermes makes it (scratch, dir, or a git worktree). */
 async function resolveLocalWorkspace(board, task) {
   const root = board.root;
-  if (task.workspace_kind !== 'scratch') return (await resolveWorkspace(task, true)).path;
+  if (task.workspace_kind !== 'scratch') return (await resolveWorkspace({ ...task, handle: cardHandleOf(board, task.id) }, true)).path;
   const dir = task.workspace_path || (board.slug === 'default' ? join(root, 'kanban', 'workspaces', task.id) : join(root, 'kanban', 'boards', board.slug, 'workspaces', task.id));
   mkdirSync(dir, { recursive: true });
   return dir;
@@ -2664,7 +2802,7 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
   });
   progress.claimed = request !== null;
   // The adopted session joins the role's agent as a launch does: its identity minted on this host, never asked of Teams.
-  const agent = lane ? await localCardAgent({ root: board.root, org: team.org, server: team.server, profiles: entry0.profiles, profile: lane.name, card: id, role: agentRole, sponsor: card0?.sponsor ?? null }) : null;
+  const agent = lane ? await localCardAgent({ root: board.root, handle: cardHandleOf(board, id), readableId: readableIdOf(board, id), org: team.org, server: team.server, profiles: entry0.profiles, profile: lane.name, card: id, role: agentRole}) : null;
   if(agent)recordCardAgentAssignment(board,cardAgentAssignments(board.root,id).find(assignment=>assignment.org===team.org&&assignment.id===agent.assignment));
   // A session another agent already owns is refused before anything is recorded: the run would name one agent and the
   // agent store another, and every round after would trip on it.
@@ -2865,7 +3003,7 @@ export async function fileBoardMail(board, report, taskId = null) {
     const first = mail.members[0];
     try {
       const task = view(board, db => getTask(db, first.task_id));
-      const subject = numbered(task?.number, mail.requester ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`);
+      const subject = numbered(boardKey(board.root, board.slug), mail.requester && !mail.message_id && new Set(mail.members.map((m) => m.task_id)).size > 1 ? null : task?.number, mail.requester ? (mail.message_id ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${mail.title ?? mail.requester} · ${mail.members.length} card(s)`) : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`);
       const filed = await fileMail(board, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
       tx(board, db => {
         if (filed.detached) {
@@ -2896,7 +3034,7 @@ export function noticeOf(entry, audience, kind, task, payload, comment = null) {
   if (template === undefined || template === null) return null;
   const cut = (text, n) => String(text ?? '').slice(0, Number(n));
   const text = render(template, { card: task, event: payload ?? {}, comment, params: entry.params, cut });
-  return text.trim() ? numbered(task?.number, text) : null;
+  return text.trim() ? numbered(task?.key, task?.number, text) : null;
 }
 
 /**
@@ -2923,6 +3061,42 @@ function ensureSubscriptions(board, entry) {
 /** The event kinds an audience hears (the workflow's notify). */
 const heardBy = (entry, audience) => Object.keys(entry.workflow.notify?.[audience] ?? {});
 
+/** Positive liveness from the same machine door as `message list`, once per delivery pass. Stale remote rows prove nothing. */
+async function noticeSessions() {
+  const r = await runtimeDoor(null, 'harness.v1.mail.list', {}, { timeout: 5_000 });
+  const rows = r.code === 0 ? lastJson(r.stdout)?.rows : null;
+  return new Set((Array.isArray(rows) ? rows : [])
+    .filter(row => sessionAt(row.address) && row.stale === undefined && !row.error && row.delivery
+      && !['stale', 'unavailable', 'unknown'].includes(row.status))
+    .map(row => row.address));
+}
+
+/** Retain a subscription's wait across passes and owner restarts; only transitions enter the log report. */
+function noticeWait(board, sub, report, reason = null) {
+  if (reason === null && !sub.delivery_metadata?.notice_wait) return;
+  const changed = tx(board, db => {
+    const where = "WHERE task_id=? AND platform='supercode' AND chat_id=? AND thread_id=?";
+    const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
+    const row = db.prepare(`SELECT delivery_metadata FROM kanban_notify_subs ${where}`).get(...identity);
+    if (!row) return false;
+    const metadata = json(row.delivery_metadata, {}) ?? {};
+    if ((metadata.role ?? 'creator') !== (sub.delivery_metadata?.role ?? 'creator')) return false;
+    const previous = metadata.notice_wait;
+    if ((previous?.reason ?? null) === reason) return false;
+    if (reason === null) delete metadata.notice_wait;
+    else metadata.notice_wait = { reason, since: now() };
+    db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata=? ${where}`).run(JSON.stringify(metadata), ...identity);
+    event(db, sub.task_id, reason === null ? 'notice_resumed' : 'notice_waiting', {
+      address: sub.chat_id, thread_id: sub.thread_id ?? '', reason, previous: previous?.reason ?? null,
+    });
+    return true;
+  });
+  if (changed) {
+    if (reason !== null) report.undelivered.push([sub.task_id, sub.chat_id, reason]);
+    else (report.notices_resumed ??= []).push([sub.task_id, sub.chat_id]);
+  }
+}
+
 /**
  * The board's record of each session address: `held`, every address an unended or current run works in, and `latest`,
  * the latest run that names it. A Claude or Codex session resumed by id keeps its address, so a run that resumes it
@@ -2945,6 +3119,21 @@ function sessionRecord(db) {
  */
 const recordedEnded = ({ held, latest }, address) => Boolean(sessionAt(address)) && !held.has(address) && Boolean(latest.get(address)?.session.close_confirmed_at);
 
+/**
+ * Whether the board has asked to close the session at `address` and the close has not landed: the latest run that names
+ * it asked the close, nothing confirmed it, it was not released to a person, no unended or current run works in it, and
+ * the close was not refused for good (closeRefused: the board stops trying, the session lives on and is told as before).
+ * A close waits for the session's turn to end (turnAtClose), and a notice filed in that wait is left unread in its
+ * mailbox once the close lands, where the machine's health reads it as main work waiting on a session that will never
+ * answer (VO-1221 t_4007dd5b: its machine_set notice m-f91ba984 was filed to fad0018e at 20:00:05Z on 2026-10-17, the
+ * second the deferred close of that session landed, and raised aarons-mac-mini's CRIT agent-main-advances).
+ */
+const closePending = ({ held, latest }, address) => {
+  const session = latest.get(address)?.session;
+  return Boolean(sessionAt(address)) && !held.has(address) && Boolean(session?.close_requested) && !session.close_confirmed_at && !session.released
+    && !closeRefused(session);
+};
+
 /**
  * The worker subscriptions of sessions that have ended, removed in one transaction, with one notice_unsubscribed event
  * per session naming its cards. A session has ended when no unended or current run works in it, the fleet does not list
@@ -2989,8 +3178,10 @@ async function endWorkerSubscriptions(board, fleet, report) {
  * write under the notice's fixed key; the mailbox delivers it to the session, on this machine or through Teams on
  * another. Each subscription's notices go in order, and its cursor moves past a notice once it is filed (or passed
  * over); a filing that failed here leaves the cursor before it, and the next pass files it. A session the board's own
- * record says has ended (recordedEnded) is filed nothing, in any role, until it is read running again: its cursor
- * stays, so a session resumed later is told what it missed. A pass with no fleet reading files it nothing either.
+ * record says has ended (recordedEnded) is filed nothing, in any role, until it is read running again, and neither is a
+ * worker whose close the board has asked and not yet confirmed (closePending): its cursor stays, so a session resumed
+ * later is told what it missed. The mail router's current session listing is also positive liveness evidence,
+ * including when pane/discovery liveness cannot be read. An unread listing never proves a session absent.
  */
 async function notify(board, fleet, report, entry) {
   await endWorkerSubscriptions(board, fleet, report);
@@ -3001,34 +3192,45 @@ async function notify(board, fleet, report, entry) {
     if (view(board, db => personCustody(db, sub.chat_id))) continue;
     if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) continue;
     const role = ['worker', 'dependency', 'manager'].includes(sub.delivery_metadata?.role) ? sub.delivery_metadata.role : 'creator';
-    // Native notices wait with their cursor intact until their own door proves
-    // liveness. A failed fleet reading supplies no permission to file them.
+    const kinds = heardBy(entry, role);
+    if (!kinds.length) { noticeWait(board, sub, report); continue; }
+    // Read pending news before liveness: a subscription with nothing to file is not waiting on delivery.
+    const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id LIMIT 64`)
+      .all(sub.task_id, sub.last_event_id, ...kinds);
+    if (!events.length) { noticeWait(board, sub, report); continue; }
+    // Events name the acting native session; subscriptions may name its agent.
+    // Use the daemon's retained binding, including former mains, for both
+    // coalescing and delivery. An unread binding proves no additional alias.
+    const recipientActors = new Set([sub.chat_id]);
+    if (agentAt(sub.chat_id)) {
+      await agentMain(sub.chat_id);
+      for (const address of agentMains.get(sub.chat_id)?.sessions ?? []) recipientActors.add(address);
+    }
+    const ownAct = payload => Boolean(payload?.by && recipientActors.has(payload.by));
+    // a worker the board is closing is filed nothing: its cursor stays, so a close that is refused or a session resumed
+    // is told what it missed, and a close that lands ends its subscription (endWorkerSubscriptions)
+    if (role === 'worker' && closePending(record, sub.chat_id)) {
+      noticeWait(board, sub, report, 'its session close is pending; its notices wait'); continue;
+    }
+    // Native notices wait with their cursor intact until the fleet, discovery or mail inventory proves liveness.
     // Agent, board and operator mailboxes route independently of a native PID.
     if (sessionAt(sub.chat_id)) {
-      const alive = fleet.ok ? await subscriberAlive(fleet, sub.chat_id) : null;
+      const alive = fleet.noticeAlive?.has(sub.chat_id) ? true : fleet.ok ? await subscriberAlive(fleet, sub.chat_id) : null;
       if (alive !== true) {
-        report.undelivered.push([sub.task_id, sub.chat_id, alive === false ? 'its session is not running; its notices wait' : 'its liveness could not be read; its notices wait until it can be']);
+        noticeWait(board, sub, report, alive === false ? 'its session is not running; its notices wait' : 'its liveness could not be read; its notices wait until it can be');
         continue;
       }
     }
-    // a session the fleet does not list this pass is told next pass: one reading is not a loss (a loaded box drops
-    // sessions from a read, and a dropped subscription never came back), and a session that is replaced on its card
-    // has its subscription moved when the new one starts
+    // A missing or unread session keeps its cursor and subscription until a positive reading returns.
     const ended = recordedEnded(record, sub.chat_id);
     if (!sessionAt(sub.chat_id) && (role !== 'creator' || ended) && fleet.ok) {
       const alive = await subscriberAlive(fleet, sub.chat_id);
-      if (alive === false) continue;
+      if (alive === false) { noticeWait(board, sub, report, 'its session is not running; its notices wait'); continue; }
       // unknown is not absent: its notices wait, and the wait is said, until its liveness can be read
-      if (alive === null) { report.undelivered.push([sub.task_id, sub.chat_id, 'its liveness could not be read; its notices wait until it can be']); continue; }
+      if (alive === null) { noticeWait(board, sub, report, 'its liveness could not be read; its notices wait until it can be'); continue; }
     } else if (!sessionAt(sub.chat_id) && ended) continue; // native sessions already required a current live observation
-    const kinds = heardBy(entry, role);
-    if (!kinds.length) continue;
-    // The retained cursor resumes the next page; one native read never materializes the whole unread history.
-    const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id LIMIT 64`)
-      .all(sub.task_id, sub.last_event_id, ...kinds);
-    if (!events.length) continue;
     // the card as the workflow names it (its status the workflow's: triaging, reviewing, stopped; `stored_as` kanban.db's)
-    const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, status: statusOf(db, t), stored_as: t.status } : t; });
+    const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, key: boardKey(board.root, board.slug), status: statusOf(db, t), stored_as: t.status } : t; });
     // a worker whose run has ended is not woken by a notice (a second session would start working the card beside
     // the one the next run gets): the notice is filed for its next turn, and the next run's brief carries the card's
     // thread. A subtask has no run of its own: its worker works in its arc's run.
@@ -3046,18 +3248,18 @@ async function notify(board, fleet, report, entry) {
     // is its own fact, keyed by the card it names); a comment or an answer is always its own message. Only events that
     // would be told count: a stale one or the recipient's own act never supersedes one that would be.
     const subjectOf = (ev) => { const p = json(ev.payload, {}) ?? {}; return ['commented', 'answered'].includes(ev.kind) ? `${ev.kind}:${ev.id}` : `${ev.kind}:${p.subtask ?? p.parent ?? p.child ?? ''}`; };
-    const latest = new Map(events.filter((ev) => !stale(ev) && !((json(ev.payload, {}) ?? {}).by === sub.chat_id)).map((ev) => [subjectOf(ev), ev.id]));
+    const latest = new Map(events.filter((ev) => !stale(ev) && !ownAct(json(ev.payload, {}))).map((ev) => [subjectOf(ev), ev.id]));
     let cursor = Number(sub.last_event_id);
     try {
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
         if (stale(ev)) { cursor = ev.id; report.stale_notices_passed = (report.stale_notices_passed ?? 0) + 1; continue; }
         // nobody is told of their own act
-        if (p.by && p.by === sub.chat_id) { cursor = ev.id; continue; }
+        if (ownAct(p)) { cursor = ev.id; continue; }
         if (latest.get(subjectOf(ev)) !== ev.id) { cursor = ev.id; report.superseded_notices_passed = (report.superseded_notices_passed ?? 0) + 1; continue; }
         let text;
         if (ev.kind === 'commented') {
-          if (p.author === sub.chat_id) { cursor = ev.id; continue; }
+          if (recipientActors.has(p.author)) { cursor = ev.id; continue; }
           const c = board.db.prepare('SELECT author, body FROM task_comments WHERE task_id = ? AND author = ? AND created_at >= ? ORDER BY id LIMIT 1').get(sub.task_id, p.author, ev.created_at);
           text = c ? noticeOf(entry, role, ev.kind, task, p, c) : null;
         } else text = noticeOf(entry, role, ev.kind, task, p);
@@ -3070,7 +3272,7 @@ async function notify(board, fleet, report, entry) {
           if (Number(currentSub.last_event_id) >= ev.id) { cursor = Math.max(cursor, Number(currentSub.last_event_id)); continue; }
           const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
           // filed under its fixed key: a second pass filing the same notice files nothing new
-          const filed = await fileMail(board, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { wake, subject: numbered(task?.number, `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}`),
+          const filed = await fileMail(board, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { wake, subject: numbered(task?.key, task?.number, `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}`),
             eligible: () => view(board, db => {
               const currentSub = db.prepare(`SELECT last_event_id FROM kanban_notify_subs ${where}`).get(...identity);
               return Boolean(currentSub) && Number(currentSub.last_event_id) < ev.id;
@@ -3081,8 +3283,9 @@ async function notify(board, fleet, report, entry) {
         cursor = ev.id;
         forward(cursor);
       }
+      noticeWait(board, sub, report);
     } catch (error) {
-      report.undelivered.push([sub.task_id, sub.chat_id, String(error.message).slice(-200)]);
+      noticeWait(board, sub, report, String(error.message).slice(-200));
     }
     forward(cursor);
     // a subscription past its card's last event ends with the card: a worker's when the card is done or archived (its
@@ -3123,7 +3326,7 @@ export async function notifyChats(root, adapters, log = () => {}, wake = null) {
         if (sub.platform === 'supercode' || !adapter) continue;
         const events = board.db.prepare(`SELECT id, kind, payload FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id`).all(sub.task_id, sub.last_event_id, ...kinds);
         if (!events.length) continue;
-        const task = view(board, (db) => getTask(db, sub.task_id));
+        const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, key: boardKey(board.root, board.slug) } : t; });
         let cursor = Number(sub.last_event_id);
         let failed = false;
         for (const ev of events) {
@@ -3357,7 +3560,7 @@ async function turnInFlight(board, id, fleet, heldSince = null) {
   if (!session?.session_id || session.surface === 'headless' || session.close_requested) return null;
   let live = fleet.sessions?.find((x) => x.address === addressOf(session)) ?? null;
   if (live?.turn == null && session.surface === 'native') try {
-    const activity = nativeReading(await readNative(session.machine, session.harness ?? 'claude-code', session.session_id), session).row?.activity;
+    const activity = nativeReading(await readNative(session.machine, session.harness ?? 'claude-code', session.session_id, session.codex_home ?? null), session).row?.activity;
     live = activity ? { turn: activity.turn ?? null, turn_trigger: activity.evidence?.turn_trigger ?? null, turn_since_ms: activity.evidence?.native_state_since_ms ?? null } : live;
   } catch { /* unread: waits on nothing */ }
   const turn = live?.turn ?? null;
@@ -3382,6 +3585,8 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
   const candidates = view(board, db => db.prepare(`SELECT t.id FROM tasks t JOIN supercode_cards c ON c.task_id=t.id
     WHERE c.subtask_of IS NULL AND c.every IS NULL
     ${only ? 'AND t.id=?' : ''}`).all(...(only ? [only] : [])));
+  // Review waits only someone's act clears, and the cards read this round in a state that is no such wait (surfaceReviewStalls)
+  const stalls = [], settled = [];
   for (const { id } of candidates) {
     const eligible = db => {
       const task = getTask(db, id);
@@ -3395,22 +3600,30 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
       return open.length ? open : true;
     };
     const ready = view(board, eligible);
-    if (!ready) continue;
-    if (ready !== true) { report.queued.push([id, `review waits: ${ready.length} open task(s) in the card's Tasks: ${ready[0].id} ${ready[0].title}`]); continue; }
+    if (!ready) { settled.push(id); continue; }
+    if (ready !== true) { settled.push(id); report.queued.push([id, `review waits: ${ready.length} open task(s) in the card's Tasks: ${ready[0].id} ${ready[0].title}`]); continue; }
     let payload = null;
     try {
       payload = await openReviewPullRequests(board, id);
-      // The arc's open PRs ask for one review only while some head has no verdict: after changes are
-      // requested the next run is the implementer's, until a new head is pushed.
+      // The arc's open PRs ask for one review only while the last verdict is answered or some head is new work: after
+      // changes are requested the next run is the implementer's, until it closes the verdict's tasks or changes the
+      // source (reviewDue).
       // An arc that closed its tasks having changed no code gets its one review of the act itself (ADR 0003).
       if (!payload && noCodeReviewDue(board, id)) payload = await noCodeChange(board, id);
       // An arc whose last verdict is a pass, with nothing unjudged since, waits on no review: what is left is its
       // session's done request and the manager's or creator's `complete`, and the round says that (volter-org
       // t_b499d0cf and t_a2bd2a5f were logged as waiting for a review every round for hours after theirs passed).
       if (!payload) { report.queued.push([id, passedReview(board, id) ? 'its review passed and no PR head is unjudged since: no review is due; the arc waits on `complete`' : 'review waits: no open or unjudged merged PR on its declared branches, and no completed disposition']); continue; }
-      if (payload.waits) { report.queued.push([id, `review waits: ${payload.waits}`]); payload = null; continue; }
+      if (payload.waits) {
+        report.queued.push([id, `review waits: ${payload.waits}`]);
+        stalls.push({ id, key: `no_work_branch:${lastReviewEvent(board, id)}`, why: `its review waits: ${payload.waits}` });
+        payload = null; continue;
+      }
       if (!payload.no_code && !await reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
-        report.queued.push([id, `review waits: every open PR head (${payload.pr.join(', ')}) has a verdict or predates the last one; push a commit that answers it`]);
+        const why = `every open PR head (${payload.pr.join(', ')}) has a verdict, carries the source tree its verdict judged, or predates it; push a commit that changes the source, or close the tasks that own the last verdict's findings`;
+        report.queued.push([id, `review waits: ${why}`]);
+        // After a pass the arc's own session merges and asks for done; any other verdict nothing answered waits on an act
+        if (!passedReview(board, id)) stalls.push({ id, key: `verdict:${lastReviewEvent(board, id)}`, why: `its review waits: ${why}. Every task is closed, so no session of the arc is due to act on it.` });
         continue;
       }
       // A native turn holds the advisory proposal before authoritative source reads. Retain the proposal on the run
@@ -3449,11 +3662,66 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
         }));
       });
       if (moved) {
+        settled.push(id);
         effects.push(...moved.effects);
         (report.review_requested ??= []).push({ id, prs: payload.pr, heads: payload.pr_head });
       }
     } catch (error) { report.queued.push([id, `PR review waits${payload ? ` (${payload.pr.join(', ')})` : ''}: ${error.message}`]); }
   }
+  if (!dry) surfaceReviewStalls(board, entry, stalls, settled, report);
+}
+
+/** The id of the arc's last review event (requested, changes requested, passed, voided), or 0: a review wait's key
+ *  carries it, so the wait a new verdict or request leaves is a new wait. */
+const lastReviewEvent = (board, id) => board.db.prepare("SELECT MAX(id) AS id FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass', 'review_voided')").get(id)?.id ?? 0;
+
+/** At most this many review waits are told per round; the rest are told in the rounds after, in candidate order. */
+const REVIEW_WAITS_TOLD_PER_ROUND = 8;
+/**
+ * A review wait that only someone's act clears (the last verdict asked for changes and nothing since answers it; the
+ * card has no work branch to review) reaches the board's manager through the board's own mail, as an incident does
+ * (surfaceIncident's `board_message`, filed by the delivery pass's fileBoardMail): the dispatcher reads these waits every
+ * round, and before this only its log heard them (VO-2858 t_cc590655, 2026-10-17).
+ *
+ * Each is told once. The board_message is the record: it carries the wait's key (its kind and the arc's last review
+ * event), and while the card's last told key is the same and no `review_wait_cleared` follows it, nothing is told
+ * again, across rounds and restarts. A card read this round in a state that is no such wait (no longer reviewable from
+ * where it stands, an open task holding it, or its review requested: `settled`) clears its told wait once, so the same
+ * wait coming back is told again. An unread round (a GitHub error, a session in a turn) neither tells nor clears.
+ * One round tells at most REVIEW_WAITS_TOLD_PER_ROUND, and the waits told together share one batch, so the manager
+ * gets one mail listing them (pendingRequestMail groups a batch by recipient and requester).
+ */
+function surfaceReviewStalls(board, entry, stalls, settled, report) {
+  const to = [].concat(entry.params.managers ?? []).find(Boolean);
+  if (!to || (!stalls.length && !settled.length)) return;
+  // the key of the card's told review wait not cleared since, or null
+  const told = (db, id) => {
+    const last = db.prepare("SELECT id, json_extract(payload, '$.review_wait') AS key FROM task_events WHERE task_id = ? AND kind = 'board_message' AND json_extract(payload, '$.review_wait') IS NOT NULL ORDER BY id DESC LIMIT 1").get(id);
+    if (!last) return null;
+    const cleared = db.prepare("SELECT MAX(id) AS id FROM task_events WHERE task_id = ? AND kind = 'review_wait_cleared'").get(id)?.id ?? 0;
+    return cleared > last.id ? null : last.key;
+  };
+  // read first: a round with nothing to tell or clear opens no write
+  const plan = view(board, (db) => ({
+    clear: settled.filter((id) => told(db, id)),
+    tell: stalls.filter((stall) => told(db, stall.id) !== stall.key),
+  }));
+  if (plan.tell.length > REVIEW_WAITS_TOLD_PER_ROUND) report.review_waits_deferred = plan.tell.length - REVIEW_WAITS_TOLD_PER_ROUND;
+  plan.tell = plan.tell.slice(0, REVIEW_WAITS_TOLD_PER_ROUND);
+  if (!plan.clear.length && !plan.tell.length) return;
+  tx(board, (db) => {
+    for (const id of plan.clear) {
+      const key = told(db, id);
+      if (key) event(db, id, 'review_wait_cleared', { key }, null);
+    }
+    for (const stall of plan.tell) {
+      if (told(db, stall.id) === stall.key) continue;
+      const card = getTask(db, stall.id);
+      event(db, stall.id, 'board_message', { to, review_wait: stall.key, text: `${numbered(boardKey(board.root, board.slug), card?.number, stall.id)} ${card?.title ?? ''}: ${stall.why}`,
+        batch: { requester: 'board review waits', title: 'Review waits only an act clears', window_seconds: 0 } }, null);
+      (report.review_waits_told ??= []).push([stall.id, stall.key]);
+    }
+  });
 }
 
 /**
@@ -3481,6 +3749,7 @@ export function startDelivery(root, { slugs = null, log = () => {} } = {}) {
     for (const r of reports) {
       if (r.error) log('warn', `delivery on board ${r.board} failed: ${r.error}`);
       for (const [task, to, why] of r.undelivered ?? []) log('warn', `board ${r.board}: a delivery for ${task} to ${to} waits: ${why}`);
+      for (const [task, to] of r.notices_resumed ?? []) log('info', `board ${r.board}: notices for ${task} to ${to} resumed`);
       log('info', `delivery on board ${r.board}: ${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good; took ${Object.entries(r.ms ?? {}).map(([k, v]) => `${k} ${(v / 1000).toFixed(1)}s`).join(', ')}`);
     }
   }, (error) => log('warn', `delivery pass failed: ${error?.message ?? error}`)).finally(() => deliveries.delete(root));
@@ -3517,6 +3786,7 @@ export async function deliver({ root, slugs = null, controller = false }) {
   const boards = (slugs ?? listBoards(root)).filter((slug) => !controller || dispatchingOf(root, slug).on);
   if (!boards.length) return [];
   const fleet = await observeFleet();
+  fleet.noticeAlive = await noticeSessions();
   const out = [];
   for (const slug of boards) {
     if (controller && !dispatchingOf(root, slug).on) continue;