@volter/supercode-orchestrator 0.5.209 → 0.5.211

package/README.md

@@ -19,6 +19,16 @@ stage's own transition, which ends the run in the default workflow. See the
 [private manual reading](../../docs/evidence/board-manual-claim-2026-10-09.md)
 for scope and limits; existing inconsistent claims are not repaired automatically.
 
+Completing a task with `--commit` inherits its arc's workspace when the task is
+scratch. When that workspace belongs to another machine, the board verifies the
+commit against the declared repository's pushed branch head through GitHub,
+without requiring the checkout on the board host. A legacy directory path is
+resolved through its own machine's workspace door to obtain that identity.
+Remote commits take a full SHA or at least seven hexadecimal characters; a
+different head or an unread remote refuses completion. Local checkouts keep
+their existing Git commit resolution. This source check does not replace the
+arc's independent review.
+
 The orchestrator's runtime over the ontology: one typed operational model
 (`OrchestratorState` = an orchestration value plus a runtime half) whose folder is its serialization.
 `docs/ORCHESTRATOR-IR.md` is normative. The orchestration value and every codec are the ontology's, in
@@ -125,7 +135,11 @@ redacted refusal even when a failed call is fast. See
 Board discovery caches advisory reads while waiting. Review requests, verdicts
 and acceptance refresh the complete source set, including previously draft or
 closed declared sources, and validate its current heads. An unread set defers
-the action. Unread commit dates also defer eligibility and are never cached as
+the action. Before the dispatcher spends those validation reads, it checks the
+advisory candidate against its local worktrees. A mismatched HEAD or uncommitted
+work refuses that attempt locally. Each later round rechecks the checkout, so
+a repair wakes it; a successful preflight still needs the fresh complete-source,
+local and pushed-head checks before review is recorded. Unread commit dates also defer eligibility and are never cached as
 old work. Merge validation still reads the current head. Every request page, retry, redirect and merge PUT
 reserves its own attempt. All processes and credentials sharing this supercode
 home share a rolling-hour ceiling of 1,200 attempts, including at most 600

package/agents.mjs

@@ -232,8 +232,17 @@ export function localAgentRecord(root,org,id){
 /** Rename only identities this card role declared; a reassigned standing agent keeps its own name. */
 export function renameCardAgent(root, assignment, readableId) {
   const intent=agentIntent(root,assignment.org,assignment.agent_id);
-  if(!intent?.declaration_json)return false;
-  const declaration=JSON.parse(intent.declaration_json);
+  if(!intent||assignment.state!=='active')return false;
+  let declaration=intent.declaration_json?JSON.parse(intent.declaration_json):null;
+  if(!declaration){
+    // Older declared intents kept only their stable key. Recover this role's own current identity, never an agent
+    // reassigned from another card or a standing profile. The existing Teams identity keeps its lineage and sessions.
+    const suffix=`/card/${assignment.target}/${assignment.role}`,base=intent.key.replace(/\/generation\/\d+$/,'');
+    if(!base.endsWith(suffix)||declarationHead(root,assignment.org,base)!==assignment.agent_id)return false;
+    const parent=declarationHead(root,assignment.org,`${base.slice(0,-suffix.length)}/root`);
+    if(!parent)return false;
+    declaration={kind:'card',card:assignment.target,role:assignment.role,profile:intent.profile_ref,parent};
+  }
   if(declaration.kind!=='card'||declaration.card!==assignment.target||declaration.role!==assignment.role)return false;
   const name=`${assignment.role}-${readableId}`;
   if(declaration.name===name&&declaration.readableId===readableId)return false;

package/bin/orchestrator.mjs

@@ -34,7 +34,7 @@ if (process.argv[2] === 'workflow') {
   catch(error) {noteCommandError(error);process.stderr.write(`supercode workflow: ${error.message??error}\n${error?.errcode!=null&&error.stack?`${error.stack}\n`:''}`);code=1;}
   // the board documents' git work this command queued (a ztrack board's commit and push) is finished before it exits
   try{const{settleDocuments}=await import('../board/git-document.mjs');await settleDocuments();}catch{/* nothing queued */}
-  await Promise.all([process.stdout,process.stderr].map(stream=>new Promise(done=>stream.write('',done))));
+  await Promise.all([process.stdout,process.stderr].map(stream=>new Promise(done=>stream.destroyed?done():stream.write('',done))));
   process.exit(code);
 } else if (process.argv[2] === 'connect') {
   const {parseArgs}=await import('node:util');

package/board/agent-declarations.mjs

@@ -1,7 +1,7 @@
 // Consume the card-creation intent after the board transaction; retries reuse the daemon-minted id. The card's agent is
 // minted and recorded here, and its declaration handed to this machine's daemon, which declares it in Teams: whoever ran
 // the effect (the creating command, or a delivery pass retrying it) makes no Teams call (D137).
-import { agentScope, localCardAgent, finishAgentAssignment, cardAgentAssignments, cardAgentScopeTransition, pendingCardAgentChanges, acknowledgeCardAgentChanges, handOffAgents } from '../agents.mjs';
+import { agentScope, localCardAgent, renameCardAgent, finishAgentAssignment, cardAgentAssignments, cardAgentScopeTransition, pendingCardAgentChanges, acknowledgeCardAgentChanges, handOffAgents } from '../agents.mjs';
 import { cardHandleOf, readableIdOf, event, json, tx, view } from './store.mjs';
 import { workflowFor } from './workflow.mjs';
 import { cardAgentFacts, cardAgentReceiptRecorded, syncCardAgentScope } from './published.mjs';
@@ -47,6 +47,23 @@ export async function declareCardAgentEffect(board,effect) {
   }
 }
 
+/** A readable-id edit carries every live role's retained declaration through the existing machine identity door.
+ * No assignment is created or revived here; an ended or reassigned agent keeps its own identity and history. */
+export async function renameCardAgentsEffect(board,effect) {
+  const task=view(board,db=>db.prepare('SELECT t.readable_id,t.status,c.subtask_of,c.archived FROM tasks t JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(effect.id));
+  if(!task?.readable_id||task.subtask_of||task.archived||['done','cancelled','archived'].includes(task.status))return true;
+  const agents=new Set();
+  for(const assignment of cardAgentAssignments(board.root,effect.id)) {
+    if(assignment.state!=='active'||!admitsScope(board,effect.id,assignment.org))continue;
+    renameCardAgent(board.root,assignment,task.readable_id);
+    agents.add(assignment.agent_id);
+  }
+  if(!agents.size)return true;
+  const pending=(await handOffAgents(board.root)).filter(item=>item.agent==='*'||agents.has(item.agent));
+  if(pending.length)throw new Error(pending.map(item=>item.error).join('; '));
+  return true;
+}
+
 /** A failed board write leaves the owner's receipt pending. A failed acknowledgement repeats no board event. */
 export function recordCardAgentChanges(board,target){
   const changes=pendingCardAgentChanges(board.root,target);

package/board/call.mjs

@@ -15,6 +15,7 @@
 //              a connection of its own (store.mjs openBoard), and nothing is written
 import { readFileSync } from 'node:fs';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { withCredentialGuard } from './credential-guard.mjs';
 
 const calls = new AsyncLocalStorage();
 // what a call learns as it runs, and the workflow it read (pinned: a reload while it runs does not change its basis)
@@ -34,7 +35,7 @@ export function within({ caller = null, facts = {}, cwd, stdin = null, out, err,
 /** Run `fn` as a unit of the process's own work (a round, a delivery pass): the process's identity and output, with
  *  what it learns and the workflow it read kept to itself. */
 export function ownCall(fn) {
-  return calls.run({ kind: 'own', caller: null, facts: process.env, ...fresh(), get cwd() { return process.cwd(); }, stdin: null, out: own.out, err: own.err }, fn);
+  return withCredentialGuard(() => calls.run({ kind: 'own', caller: null, facts: process.env, ...fresh(), get cwd() { return process.cwd(); }, stdin: null, out: own.out, err: own.err }, fn));
 }
 
 /** The caller as its address names it, or null. */

package/board/capacity.mjs

@@ -89,50 +89,63 @@ export async function holdings(board, options) {
  */
 async function readHoldings(board, { lanes, fleetOk, alive, liveRecord, modelOf = () => null, storedOf = null, machineOf, home = null, runLaneOf = null }, unchanged) {
   const out = [];
-  const rows = board.db.prepare("SELECT t.id, t.status, t.assignee, t.current_run_id, t.model_override, c.machine, c.subtask_of FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id WHERE t.status != 'archived' AND c.detached IS NULL").all();
-  for (const row of rows) {
+  let cursor = '';
+  const high = board.db.prepare('SELECT MAX(id) AS id FROM tasks').get()?.id ?? '';
+  for (;;) {
     await yieldToOwner();
     if (!unchanged()) return null;
-    const lane = lanes[row.assignee] ?? {};
-    const card = {
-      card: row.id, board: board.slug, assignee: row.assignee ?? null, status: statusOf(board.db, row),
-      // what the board stores for an arc is read through its workflow's stored_as rules now, never the column a write has
-      // not yet brought up to date (a paused card counted as running until its row caught up)
-      stored: !row.subtask_of && storedOf ? storedOf(row.id) : row.status,
-      // a card that names no machine runs on this home's: a cap on this machine counts it
-      machine: row.machine ? machineOf(row.machine) : home,
-      model: row.model_override ?? lane.model ?? null, harness: lane.harness ?? null,
-    };
-    // a session's model: what its transcript reports, else what its launch resolved, else the card's
-    const sessionOf = (s, slot) => {
-      const configured = s.model ?? card.model;
-      return { ...card, counts: 'sessions', slot, session: s.session_id ?? null, unconfigured: !configured,
-        dispatch: dispatched(s), run: s.run ?? null,
-        machine: s.surface === 'headless' ? home : s.machine || s.surface ? machineOf(s.machine ?? row.machine ?? home)
-          : executionHost(runLaneOf ? runLaneOf(row) : lane, row.machine, home, machineOf), harness: s.harness ?? card.harness ?? 'claude-code',
-        model: (s.session_id ? modelOf(s) : null) ?? configured };
-    };
-    const sessions = fleetOk ? await sessionsOf(board.db, row.id, unchanged) : new Map();
-    if (sessions === null) return null;
-    const held = [];
-    let current = null;
-    if (row.current_run_id) {
-      current = { ...json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.current_run_id)?.metadata, {})?.supercode, run: row.current_run_id };
-      out.push({ ...sessionOf(current, current.slot ?? 'worker'), session: undefined, slot: undefined, counts: 'runs' });
-    }
-    for (const [slot, s] of sessions) {
-      if (!alive(s)) continue;
-      const session = sessionOf(s, slot);
-      held.push(session);
-      if (IN_TURN.has(liveRecord(s)?.status)) out.push({ ...session, counts: 'turns' });
+    // Limit candidates before filtering or joining: even a page containing only archived/detached cards is bounded.
+    const candidates = board.db.prepare('SELECT id FROM tasks WHERE id>? AND id<=? ORDER BY id LIMIT 32').all(cursor, high);
+    if (!candidates.length) break;
+    cursor = candidates.at(-1).id;
+    const rows = board.db.prepare(`SELECT t.id,t.status,t.assignee,t.current_run_id,t.model_override,c.machine,c.subtask_of
+      FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id
+      WHERE t.id IN (SELECT value FROM json_each(?)) AND t.status!='archived' AND c.detached IS NULL`)
+      .all(JSON.stringify(candidates.map(row => row.id)));
+    for (const row of rows) {
+      await yieldToOwner();
+      if (!unchanged()) return null;
+      const lane = lanes[row.assignee] ?? {};
+      const card = {
+        card: row.id, board: board.slug, assignee: row.assignee ?? null, status: statusOf(board.db, row),
+        // what the board stores for an arc is read through its workflow's stored_as rules now, never the column a write has
+        // not yet brought up to date (a paused card counted as running until its row caught up)
+        stored: !row.subtask_of && storedOf ? storedOf(row.id) : row.status,
+        // a card that names no machine runs on this home's: a cap on this machine counts it
+        machine: row.machine ? machineOf(row.machine) : home,
+        model: row.model_override ?? lane.model ?? null, harness: lane.harness ?? null,
+      };
+      // a session's model: what its transcript reports, else what its launch resolved, else the card's
+      const sessionOf = (s, slot) => {
+        const configured = s.model ?? card.model;
+        return { ...card, counts: 'sessions', slot, session: s.session_id ?? null, unconfigured: !configured,
+          dispatch: dispatched(s), run: s.run ?? null,
+          machine: s.surface === 'headless' ? home : s.machine || s.surface ? machineOf(s.machine ?? row.machine ?? home)
+            : executionHost(runLaneOf ? runLaneOf(row) : lane, row.machine, home, machineOf), harness: s.harness ?? card.harness ?? 'claude-code',
+          model: (s.session_id ? modelOf(s) : null) ?? configured };
+      };
+      const sessions = fleetOk ? await sessionsOf(board.db, row.id, unchanged) : new Map();
+      if (sessions === null) return null;
+      const held = [];
+      let current = null;
+      if (row.current_run_id) {
+        current = { ...json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.current_run_id)?.metadata, {})?.supercode, run: row.current_run_id };
+        out.push({ ...sessionOf(current, current.slot ?? 'worker'), session: undefined, slot: undefined, counts: 'runs' });
+      }
+      for (const [slot, s] of sessions) {
+        if (!alive(s)) continue;
+        const session = sessionOf(s, slot);
+        held.push(session);
+        if (IN_TURN.has(liveRecord(s)?.status)) out.push({ ...session, counts: 'turns' });
+      }
+      // a live run whose session the fleet does not list yet (launching) holds a session's place already
+      if (current && !held.some((x) => x.slot === (current.slot ?? 'worker'))) held.unshift(sessionOf(current, current.slot ?? 'worker'));
+      out.push(...held);
+      // the card itself, whatever its runs and sessions: a cap says which by its status (a started card holds its slot
+      // until it is done); its model and harness are its run's session's, else its newest live session's, else its own
+      // a subtask is a task of its arc: it never runs or holds a slot of its own
+      if (!row.subtask_of) out.push({ ...(held[0] ?? { ...card, unconfigured: !card.model }), session: undefined, slot: undefined, counts: 'cards' });
     }
-    // a live run whose session the fleet does not list yet (launching) holds a session's place already
-    if (current && !held.some((x) => x.slot === (current.slot ?? 'worker'))) held.unshift(sessionOf(current, current.slot ?? 'worker'));
-    out.push(...held);
-    // the card itself, whatever its runs and sessions: a cap says which by its status (a started card holds its slot
-    // until it is done); its model and harness are its run's session's, else its newest live session's, else its own
-    // a subtask is a task of its arc: it never runs or holds a slot of its own
-    if (!row.subtask_of) out.push({ ...(held[0] ?? { ...card, unconfigured: !card.model }), session: undefined, slot: undefined, counts: 'cards' });
   }
   return out;
 }

package/board/ci.mjs

@@ -291,13 +291,15 @@ async function repositoryWorkspace(board, id) {
   // the worktree's folder, when it is still to be made, is named for its card (workspace.mjs worktreeFolder)
   const workspace = { ...owner, handle: cardHandleOf(board, owner.id) };
   const here = isLocalWorkspace(workspace);
+  if (!here) {
+    const identity = workspace.workspace_anchor ?? workspace.workspace_path;
+    if (!identity) return null;
+    // A portable remote declaration supplies the source identity. Legacy paths
+    // are resolved by their own machine, never read as paths on the board host.
+    const resolved = plainWorkspace(workspace.workspace_kind, identity, workspace.branch_name) ?? await resolveWorkspace(workspace, false);
+    return { ...resolved, branch: workspace.branch_name ?? resolved.branch, here: false };
+  }
   if (workspace.workspace_anchor) {
-    // A portable remote declaration supplies the source identity. Reviewing
-    // its pushed head does not require that machine to keep the old checkout.
-    if (!here) {
-      const declared = plainWorkspace(workspace.workspace_kind, workspace.workspace_anchor, workspace.branch_name);
-      if (declared) return { ...declared, here: false };
-    }
     const resolved = await resolveWorkspace(workspace, false);
     // Resolution without create names a solo worktree even before it exists on
     // this machine. Its portable repository and branch still identify the
@@ -305,7 +307,24 @@ async function repositoryWorkspace(board, id) {
     if (here && !checkoutPresent(resolved.path)) return { ...resolved, here: await recreatedWorktree(workspace, resolved) };
     return { ...resolved, here };
   }
-  return workspace.workspace_path ? { path: workspace.workspace_path, here: here && checkoutPresent(workspace.workspace_path) } : null;
+  return workspace.workspace_path ? { path: workspace.workspace_path, here: checkoutPresent(workspace.workspace_path) } : null;
+}
+
+/** A supplied completion commit belongs to the workspace's machine. Local Git
+ *  keeps its existing semantics; a remote declaration is read at its pushed head. */
+async function completionSource(workspace, supplied) {
+  if (workspace?.here && workspace.path) {
+    return { repository: await originOf(workspace.path), commit: await run('git', ['rev-parse', '--verify', `${supplied}^{commit}`], workspace.path) };
+  }
+  if (!workspace?.repository || !workspace.branch) throw new Error('The named commit needs a declared repository and branch, resolved through the workspace machine when only a path is recorded.');
+  if (typeof supplied !== 'string' || !/^[a-f0-9]{7,40}$/i.test(supplied)) throw new Error('Name the remote completion commit with its full SHA or an abbreviation of at least seven hexadecimal characters.');
+  // Read the declared branch, not an arbitrary commit that merely exists in
+  // the repository. No checkout or daemon upgrade on the board host is needed.
+  const pushed = await github(`/repos/${workspace.repository}/git/ref/heads/${encodeURIComponent(workspace.branch)}`);
+  const head = pushed?.object?.type === 'commit' ? pushed.object.sha : null;
+  if (typeof head !== 'string' || !/^[a-f0-9]{40}$/.test(head)) throw new Error(`The declared remote ${workspace.repository}:${workspace.branch} answered no commit head.`);
+  if (!head.startsWith(supplied.toLowerCase())) throw new Error(`The named commit ${supplied} must be the pushed head of ${workspace.repository}:${workspace.branch}, currently ${head}.`);
+  return { repository: workspace.repository, branch: workspace.branch, commit: head, source_sha: head };
 }
 
 /** A card's declared solo worktree that is missing here (deleted, or never made on this machine) while its branch is on
@@ -383,7 +402,7 @@ function registeredBranches(board, id) {
  *  declaration (engine.comment), the arc's complete set. A multi-repository arc carries them on the arc card, and its
  *  review discovers and accepts PRs from them with no subtask registered in that repository (VO-2858, VO-2860). */
 export function arcSources(db, id) {
-  const row = db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='commented' AND json_type(payload,'$.branches')='array' ORDER BY id DESC LIMIT 1").get(id);
+  const row = db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='commented' AND json_valid(payload) AND json_type(payload,'$.branches')='array' ORDER BY id DESC LIMIT 1").get(id);
   let declared = [];
   try { declared = row ? JSON.parse(row.payload).branches : []; } catch { /* an unreadable declaration names none */ }
   return declared.filter((b) => typeof b?.repository === 'string' && typeof b?.branch === 'string').map((b) => ({ repository: b.repository, branch: b.branch }));
@@ -396,8 +415,9 @@ export const namedWorkBranch = (id, head) => [`wt/${id}`, `wt/${id.replace(/^t_/
 /** The branch names an arc declares as its work: its own and its subtasks' `--branch`, the branches it declares as its
  *  sources (arcSources), and each branch its latest review request covered. With `namedWorkBranch`, these are the branches its PRs are opened from. */
 export function declaredWorkBranches(db, id) {
-  const declared = db.prepare(`SELECT t.branch_name FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id
-    WHERE (t.id=? OR c.subtask_of=?) AND t.status != 'cancelled' AND t.branch_name IS NOT NULL`).all(id, id).map((r) => r.branch_name);
+  const declared = db.prepare(`SELECT branch_name FROM tasks WHERE id=? AND status!='cancelled' AND branch_name IS NOT NULL
+    UNION SELECT t.branch_name FROM supercode_cards c CROSS JOIN tasks t ON t.id=c.task_id
+    WHERE c.subtask_of=? AND t.status!='cancelled' AND t.branch_name IS NOT NULL`).all(id, id).map((r) => r.branch_name);
   declared.push(...arcSources(db, id).map((b) => b.branch));
   const row = db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='review_requested' ORDER BY id DESC LIMIT 1").get(id);
   let reviewed = [];
@@ -410,7 +430,7 @@ export function declaredWorkBranches(db, id) {
  *  of, or a sibling checkout the arc registered (`registeredBranches`). The repository's default branch, declared or
  *  checked out (or no branch), is not a work branch: such a card's PRs are only its `wt/<card>` and registered ones, and with none it
  *  answers `{ waits }` saying so. One review covers them all; the caller decides the transition. */
-export async function openReviewPullRequests(board, id, { fresh = false } = {}) {
+export async function openReviewPullRequests(board, id, { fresh = false, checkWorkspaces = false } = {}) {
   const own = await repositoryWorkspace(board, id);
   const registered = registeredBranches(board, id);
   if (!own && !registered.length) return null;
@@ -450,7 +470,7 @@ export async function openReviewPullRequests(board, id, { fresh = false } = {})
       if (branch === list.defaultBranch) branch = null;
     }
     // a draft is not handed over yet: its review starts when it is marked ready; a PR to another base (main→prod) is a release, not the arc's work
-    for (const pr of list.items) if (!pr.isCrossRepository && !pr.isDraft && pr.baseRefName === pr.defaultBranch && mine(repository, pr.headRefName)) prs.push({ url: pr.url, head: pr.headRefOid });
+    for (const pr of list.items) if (!pr.isCrossRepository && !pr.isDraft && pr.baseRefName === pr.defaultBranch && mine(repository, pr.headRefName)) prs.push({ url: pr.url, head: pr.headRefOid, observed: pr });
     // A manual review and merge during a dispatcher outage may predate any
     // board request. The source-review door already accepts merged heads; make
     // them discoverable so the ordinary independent verdict can be retained.
@@ -467,7 +487,7 @@ export async function openReviewPullRequests(board, id, { fresh = false } = {})
         && pr.baseRefName === pr.defaultBranch && (answered || !judgedHead(board, id, pr.headRefOid)));
     });
     for (const history of histories) for (const pr of history) {
-      if (!prs.some(known => known.url === pr.url)) prs.push({ url: pr.url, head: pr.headRefOid });
+      if (!prs.some(known => known.url === pr.url)) prs.push({ url: pr.url, head: pr.headRefOid, observed: pr });
     }
     return prs;
   });
@@ -481,9 +501,13 @@ export async function openReviewPullRequests(board, id, { fresh = false } = {})
   const sources = (declaration ? JSON.parse(declaration.payload).sources : []).filter(source => repositories.has(repositoryOf(source.url).toLowerCase()) && !prs.some(known => known.url === source.url));
   for (const pr of await readTogether(sources, source => fresh ? readPullRequest(source.url) : discoverPullRequest(source.url))) {
     if (pr.isCrossRepository || !['OPEN', 'MERGED'].includes(pr.state) || (pr.state === 'OPEN' && pr.isDraft)) continue;
-    if (!prs.some((known) => known.url === pr.url)) prs.push({ url: pr.url, head: pr.headRefOid });
+    if (!prs.some((known) => known.url === pr.url)) prs.push({ url: pr.url, head: pr.headRefOid, observed: pr });
   }
   if (!prs.length) return branch || !ownRepository ? null : { waits: `the card has no work branch (${task?.branch_name ? `it declares ${task.branch_name}, its repository's default` : current ? `its checkout ${own.path} is on ${current}, its repository's default` : `its checkout ${own.path} is on no branch`}): give it one with --branch, or open its PR from a wt/${id} branch` };
+  // Advisory facts can refuse an attempt before its authoritative REST scan. Recheck the local checkout each
+  // round, so a repaired HEAD or clean worktree wakes it without caching the refusal. This is never evidence
+  // for a transition: verifyPullRequest repeats the checks against fresh metadata and the pushed head below.
+  if (checkWorkspaces) await readTogether(prs, pr => requireReviewWorkspaceHead(board, id, own, pr.observed, pr.head));
   return { pr: prs.map((p) => p.url), pr_head: prs.map((p) => p.head), branch };
 }
 
@@ -636,9 +660,7 @@ async function inspectCurrentCompletionEvidence(board, id, entry, payload, stage
     if (stage === 'completion' || stage === 'acceptance') {
       const supplied = payload.commit ?? payload.metadata?.commit;
       if (supplied) {
-        const path = (await repositoryWorkspace(board, id))?.path;
-        if (!path) throw new Error('The named commit needs a resolved repository workspace.');
-        Object.assign(state, { repository: await originOf(path), commit: await run('git', ['rev-parse', '--verify', `${supplied}^{commit}`], path) });
+        Object.assign(state, await completionSource(await repositoryWorkspace(board, id), supplied));
       }
       const candidate = stage === 'acceptance' ? reviewCandidate(board, id) : null;
       if (candidate) {
@@ -712,14 +734,28 @@ async function inspectCurrentCompletionEvidence(board, id, entry, payload, stage
   return state;
 }
 
-/** One PR of an arc review, read from GitHub and, for a review request, from the card branch's checkout. */
-async function verifyPullRequest(board, id, entry, own, url, supplied, stage, observed) {
-  if (typeof url !== 'string' || !/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/[1-9][0-9]*\/?$/.test(url)) throw new Error('Name the opened PR URL with --pr.');
-  const repository = new URL(url).pathname.split('/').slice(1, 3).join('/');
+/** Local review readiness, also usable with advisory metadata to refuse before spending REST admission. */
+async function requireReviewWorkspaceHead(board, id, own, observed, head, { pushed = false } = {}) {
+  const url = observed.url, repository = repositoryOf(url), branch = observed.headRefName;
   // An arc may change several repositories. A PR is read from GitHub; its pushed head is the reviewed one. The
   // card's own checkout, and this machine's checkout of the PR's branch when it keeps one, must also hold that head
   // with nothing uncommitted. A card on another machine is reviewed at its pushed head: its checkout is not read from here.
   const path = observed.state === 'MERGED' || (own && !own.here) ? null : !own ? await branchCheckout(board, id, repository, observed.headRefName) : await originOf(own.path) === repository && await run('git', ['branch', '--show-current'], own.path) === observed.headRefName ? own.path : await branchCheckout(board, id, repository, observed.headRefName);
+  if (!path) return;
+  await run('git', ['check-ref-format', '--branch', branch], path);
+  if (await run('git', ['rev-parse', 'HEAD'], path) !== head) throw new Error(`The head named for ${url} must be its worktree head.`);
+  const uncommitted = (await run('git', ['status', '--porcelain', '--untracked-files=normal'], path)).split('\n').filter(Boolean);
+  if (uncommitted.length) throw new Error(`Commit the work in ${path} before requesting review: ${uncommitted.length} uncommitted path(s): ${uncommitted.slice(0, 5).map((l) => l.replace(/^\s*\S+\s+/, '')).join(', ')}${uncommitted.length > 5 ? ', …' : ''}`);
+  if (pushed) {
+    const remote = (await run('git', ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], path)).split(/\s+/)[0];
+    if (remote !== head) throw new Error(`Push the exact head of ${url} before requesting review.`);
+  }
+}
+
+/** One PR of an arc review, read from GitHub and, for a review request, from the card branch's checkout. */
+async function verifyPullRequest(board, id, entry, own, url, supplied, stage, observed) {
+  if (typeof url !== 'string' || !/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/[1-9][0-9]*\/?$/.test(url)) throw new Error('Name the opened PR URL with --pr.');
+  const repository = new URL(url).pathname.split('/').slice(1, 3).join('/');
   // A PR merged before its review (an outage fix landed first) is still reviewed: its head is fixed for good, so the
   // verdict is recorded on that head, and nothing about a worktree or its base can move under it any more.
   const merged = observed.state === 'MERGED';
@@ -732,14 +768,7 @@ async function verifyPullRequest(board, id, entry, own, url, supplied, stage, ob
   const mainBranch = observed.defaultBranch ?? 'main';
   // A merged hotfix may have landed on another base (prod); a PR from the main branch itself is a release, never arc work.
   if (branch === mainBranch || (!merged && observed.baseRefName !== mainBranch)) throw new Error(`${url} must propose its worktree branch to the repository main branch.`);
-  if (stage === 'request_review' && path && !merged) {
-    await run('git', ['check-ref-format', '--branch', branch], path);
-    if (await run('git', ['rev-parse', 'HEAD'], path) !== head) throw new Error(`The head named for ${url} must be its worktree head.`);
-    const uncommitted = (await run('git', ['status', '--porcelain', '--untracked-files=normal'], path)).split('\n').filter(Boolean);
-    if (uncommitted.length) throw new Error(`Commit the work in ${path} before requesting review: ${uncommitted.length} uncommitted path(s): ${uncommitted.slice(0, 5).map((l) => l.replace(/^\s*\S+\s+/, '')).join(', ')}${uncommitted.length > 5 ? ', …' : ''}`);
-    const pushed = (await run('git', ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], path)).split(/\s+/)[0];
-    if (pushed !== head) throw new Error(`Push the exact head of ${url} before requesting review.`);
-  }
+  if (stage === 'request_review') await requireReviewWorkspaceHead(board, id, own, observed, head, { pushed: true });
   return { repository, branch, commit: head, source_sha: head, pr: { url: observed.url, number: observed.number, head, branch, base: observed.baseRefName } };
 }
 

package/board/cli.mjs

@@ -16,7 +16,7 @@ import { taskStatusOf } from './published.mjs';
 import { executionOf } from './session-work.mjs';
 import { attachmentRecord, readAttachment } from './attachment-read.mjs';
 import { listCardsInTurns, READ_BY_OWNER, writeCardList } from './listing.mjs';
-import { redactText } from '@volter/teams/redact';
+import { redactGuardText as redactText, withCredentialGuard } from './credential-guard.mjs';
 import { openOwnerDoor } from './owner-door.mjs';
 import { existsSync, mkdirSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, copyFileSync, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
 import { notRuntime, ownHome } from './owner-files.mjs';
@@ -1749,8 +1749,11 @@ async function answerVerbs(root, log) {
  * absence from a slow-only log cannot prove those calls met the time bound. */
 export async function answerOne(root, line, { readOnly = false } = {}) {
   const scoped = typeof slowLog.withStepScope === 'function';
+  // The owner's receipt includes asynchronous custody preparation too: it is part of the caller's wait.
+  const began = performance.now(), before = slowLog.processCounters?.() ?? null;
+  let prepared = false;
   const run = async () => {
-    const began = performance.now(), before = slowLog.processCounters?.() ?? null;
+    prepared = true;
     let named = null, by = null, answer = null, outcome = 'error';
     try {
       answer = await answerRequest(root, line, (verb, caller) => { named = verb; by = caller; }, { readOnly });
@@ -1769,7 +1772,23 @@ export async function answerOne(root, line, { readOnly = false } = {}) {
       }
     }
   };
-  return scoped ? slowLog.withStepScope(run) : run();
+  const guarded = async () => {
+    try { return await withCredentialGuard(run); }
+    catch (error) {
+      if (!prepared) {
+        const ended = performance.now(), ms = ended - began;
+        const code = error?.code === 'custody_unreadable' ? 'custody_unreadable' : 'custody_preparation_failed';
+        // No request, caller payload or error text is inspected before custody is available. Fixed metadata needs
+        // no redaction read and still records the failed preparation in this request's own step scope.
+        recordSlow({ kind: 'call', name: 'owner verb custody preparation', args: [], ms, outcome: code,
+          slowest: null, force: true, includeFast: true,
+          extra: { failure: { code, phase: 'custody preparation' }, step_scope: scoped ? 'request' : 'process_interval',
+            steps: scoped ? takeSteps() : slowLog.stepsWithin?.(began, ended) ?? null } });
+      }
+      throw error;
+    }
+  };
+  return scoped ? slowLog.withStepScope(guarded) : guarded();
 }
 
 /** One request answered in a call of its own; on the read door (`readOnly`) a listing only, and `{ byOwner: true }` for
@@ -1949,7 +1968,20 @@ async function serve(root, args = {}) {
   let listenerRecords = {}, listenerReloading = null, listenerReloadDue = false, listenerReading = null;
   const listenerErrors = new Set();
   const listenerLog = text => { if (!listenerErrors.has(text)) { if (listenerErrors.size >= 128) listenerErrors.clear(); listenerErrors.add(text); log(text); } };
-  const scanListeners = ({ waiting = true } = {}) => listenerBootstrapped && fleetRecordsCurrent() && ownCall(() => observeRoleFleet(root, fleetListeners, listenerRecords, listenerLog, { waiting }));
+  const scanListeners = async ({ waiting = true } = {}) => {
+    if (stopped || !fleetListeners.enabled || !listenerBootstrapped || !fleetRecordsCurrent()) return;
+    const revision = listenerRevision;
+    try {
+      await ownCall(() => {
+        if (stopped || revision !== listenerRevision || !fleetListeners.enabled || !fleetRecordsCurrent()) return;
+        observeRoleFleet(root, fleetListeners, listenerRecords, listenerLog, { waiting });
+      });
+    } catch {
+      // Every caller may schedule this without awaiting it. Preparation refusal leaves source cursors untouched;
+      // the next admitted scan retries the retained observations, while the owner's public door stays available.
+      listenerLog('fleet listener scan refused; retained observations wait for a prepared owner call');
+    }
+  };
   const readListenerRecords = () => {
     if (!fleetListeners.enabled || stopped || listenerReading) return listenerReading;
     const revision = listenerRevision;
@@ -1964,7 +1996,9 @@ async function serve(root, args = {}) {
   };
   fleetListeners = new FleetListenerRouter({ root, log: listenerLog,
     file: (to, body, key) => ownCall(() => fileFleetNotice(root, to, body, key)),
-    enrich: event => ownCall(() => enrichFleetEvent(root, event)),
+    // The scan/flush prepares custody once; enqueue needs the event synchronously before committing its cursor.
+    enrich: event => enrichFleetEvent(root, event),
+    work: ownCall,
     retry: () => scanListeners({ waiting: false }),
   });
   const unfollowRecords = onRecordsChanged(records => { listenerRecords = records; scanListeners(); });

package/board/credential-guard.mjs

@@ -3,7 +3,20 @@
 // gitleaks' rule set and this machine's custody values), plus the shape of an environment listing: several NAME=value
 // lines in a row. A shell that expanded `$(env)` or a pasted .env into a comment once put live keys on a card, where
 // every reader, every launch prompt and the board's own remote received them.
-import { redactText } from '@volter/teams/redact';
+import { redactText, redactionSnapshotAsync, withRedactionSnapshot } from '@volter/teams/redact';
+import { noteStep } from '@volter/supercode-harness-sdk/slow-log';
+
+/** One fresh, fail-closed custody observation per call/round, read before its synchronous guards. No role decision
+ * is kept here, and a concurrent caller cannot replace this call's redaction basis. */
+export async function withCredentialGuard(fn) {
+  const began = performance.now();
+  let snapshot;
+  try { snapshot = await redactionSnapshotAsync(process.env, { fresh: true }); }
+  finally { noteStep('custody observation', performance.now() - began); }
+  return withRedactionSnapshot(process.env, snapshot, fn);
+}
+
+export const redactGuardText = text => redactText(text);
 
 const ENV_LINE = /^\s*(?:export\s+|declare\s+-x\s+)?[A-Z][A-Z0-9_]{2,}=\S/;
 const ENV_LINES = 5;
@@ -13,7 +26,7 @@ export function credentialDumpIn(text) {
   if (typeof text !== 'string' || text.length < 8) return null;
   const lines = text.split('\n').filter((line) => ENV_LINE.test(line)).length;
   if (lines >= ENV_LINES) return `${lines} NAME=value lines, the shape of an environment listing`;
-  const redacted = redactText(text);
+  const redacted = redactGuardText(text);
   if (redacted === text) return null;
   const before = new Set(text.match(/\[redacted:[^\]]+\]/g) ?? []);
   const found = [...new Set((redacted.match(/\[redacted:[^\]]+\]/g) ?? []).filter((marker) => !before.has(marker)))]

package/board/dispatch.mjs

@@ -32,6 +32,7 @@ import { boardLabel, boardName } from '@volter/teams/board-name';
 let fleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, withFreshReviewReads, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { setImmediate as yieldToOwner } from 'node:timers/promises';
+import { ACTIVE_RUN_IDS, latestEvent, readRunPages } from './queries.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
 import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, recordUsageUnread, agentPreamble, agentEnvironment, recordAgentRun, cardAgentAssignments,renameCardAgent,handOffAgents, agentRunForSession } from '../agents.mjs';
 import { finishCardAgentAssignment, recordCardAgentAssignment } from './agent-declarations.mjs';
@@ -50,7 +51,7 @@ import { homedir, hostname, tmpdir, totalmem } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { view, boardCopyOf, boardKey, boardPath, cardHandleOf, readableIdOf, briefPath, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, openBoard, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
+import { view, boardCopyOf, boardKey, boardPath, cardHandleOf, readableIdOf, briefPath, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, NOTICE_RUN_IDS, openBoard, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
 import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, projectStatus, storedStatus, templateValue, workflowFor } from './workflow.mjs';
 import { checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace } from './workspace.mjs';
 import { capacity, dispatched, executionHost, harnessDefaults, holdings } from './capacity.mjs';
@@ -1398,8 +1399,7 @@ function recordInputClose(board, row, session, reading) {
 /** The closes this process is making now, by run: each one's outcome, for a pass that meets it under way. */
 const closesUnderway = new Map();
 export async function closeRequested(board, report, { taskId = null, caller = null, ttl = null, fleet = null } = {}) {
-  const rows = view(board, (db) => db.prepare(`SELECT id, task_id, profile, ended_at, metadata FROM task_runs
-    WHERE metadata IS NOT NULL ${taskId ? 'AND task_id = ?' : ''}`).all(...(taskId ? [taskId] : [])));
+  const rows = await readRunPages(board.db, 'id, task_id, profile, ended_at, metadata', { task: taskId, where: 'metadata IS NOT NULL' });
   // Repair pre-transfer history once: only identities with an older unended reference need a write.
   const latest = new Map(), transfers = new Map();
   for (const row of [...rows].sort((a,b) => b.id-a.id)) {
@@ -1413,10 +1413,15 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
     }
   }
   if (transfers.size) tx(board, (db) => {
-    for (const row of transfers.values()) retireSupersededRuns(db, row.task_id, row.id, json(row.metadata, {})?.supercode);
+    for (const row of transfers.values()) {
+      // The paged scan yielded. Transfer only from the successor's current retained identity.
+      const current = db.prepare('SELECT task_id,metadata FROM task_runs WHERE id=?').get(row.id);
+      if (current) retireSupersededRuns(db, current.task_id, row.id, json(current.metadata, {})?.supercode);
+    }
   });
   const panes = new Map();
   for (const row of rows) {
+    await yieldToOwner();
     let session = json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
     if (!session || detachedSession(board.db, session) || session.close_transferred_to || session.close_confirmed_at) continue;
     // A keyed launch is reconciled by its machine's own daemon (D137), never by a door the close waits on. A session
@@ -1474,12 +1479,12 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       const observed = r.code === 0 ? json(r.stdout.trim(), null) : null;
       if (observed?.pane !== session.pane) continue;
       if (observed.present === true && observed.yours === true) {
-        if (view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all())
+        if (view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all())
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); })) continue;
         finalFailure = false;
       } else if (observed.present !== false) continue;
     }
-    const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all());
+    const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all());
     // Persist retries even for historical ends that did not have a close_session action. The close is claimed in the
     // same transaction, before the pane or process is touched: of two rounds (or a round and a verb) that read one close,
     // only the one whose claim committed closes it, and the other never records the pane it finds gone as a failure.
@@ -1531,7 +1536,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       const observed = panes.get(machine);
       if (observed.error) throw new Error(`close deferred: ${observed.error}`); // an unread pane list is no verdict on the pane
       if (observed.live.has(session.pane)) {
-        const protectedNow = view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all())
+        const protectedNow = view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all())
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); });
         if (protectedNow) throw new Error(`close deferred: pane ${session.pane} is owned by an unended run`);
         // An ended run's session is closed only between its turns, read last, after the claim and the pane list (a pane
@@ -1583,7 +1588,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
         // Removing only the card's own left every subtask notifying a closed session, each attempt a failed delivery,
         // every round. A later run that resumes it by id subscribes it again at its launch (and each round while it is
         // the card's current run).
-        const subscribed = db.prepare('SELECT r.id, r.metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)').all()
+        const subscribed = db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all()
           .some((r) => addressOf(json(r.metadata, {})?.supercode) === address && r.id !== row.id);
         const unsubscribed = subscribed ? 0 : db.prepare("DELETE FROM kanban_notify_subs WHERE platform = 'supercode' AND chat_id = ? AND (task_id = ? OR json_extract(delivery_metadata, '$.role') = 'worker')").run(address, row.task_id).changes;
         event(db, row.task_id, 'session_closed', { session_id: session.session_id, pane: session.pane, machine: session.machine, unsubscribed,
@@ -1722,7 +1727,7 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
         const key = [address, live.waiting_for ?? '', live.turn_since_ms ?? ''].join('|');
         if (session.held_notice?.key === key) return;
         // every run a card works under: an ended run can still be its card's current one
-        const told = db.prepare('SELECT r.metadata FROM task_runs r WHERE r.id != ? AND (r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id))').all(runRow.id).some((r) => json(r.metadata, {})?.supercode?.held_notice?.key === key);
+        const told = db.prepare(`SELECT r.metadata FROM task_runs r WHERE r.id != ? AND r.id IN (${ACTIVE_RUN_IDS})`).all(runRow.id).some((r) => json(r.metadata, {})?.supercode?.held_notice?.key === key);
         setRunSession(db, runRow.id, { held_notice: { key, at: observedAt } });
         if (told) return;
         const observation = retain('waiting_on_user', { waiting_for: live.waiting_for ?? null, since_ms: live.turn_since_ms ?? null });
@@ -1752,7 +1757,7 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
         if (reading.quiet_seconds < settings.idleQuiet) { retain('turn_unknown'); return; }
         if (session.unknown_notice) return;
         const key = [address, live?.turn_since_ms ?? 'unknown'].join('|');
-        const told = db.prepare('SELECT r.metadata FROM task_runs r WHERE r.id != ? AND (r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id))').all(runRow.id)
+        const told = db.prepare(`SELECT r.metadata FROM task_runs r WHERE r.id != ? AND r.id IN (${ACTIVE_RUN_IDS})`).all(runRow.id)
           .some(r => json(r.metadata, {})?.supercode?.unknown_notice?.key === key);
         setRunSession(db, runRow.id, { unknown_notice: { key, at: observedAt, since } });
         const observation = retain('turn_unknown_reported', { waiting_for: live?.waiting_for ?? null, turn_source: live?.turn_source ?? null, since_ms: live?.turn_since_ms ?? null });
@@ -2115,9 +2120,12 @@ async function readRunUsage(root,org,row,endedAt){
 async function synchronizeAgents(board, report) {
   // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
   // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
-  const agentRuns=[...new Map(view(board,db=>db.prepare("SELECT id,task_id,metadata,ended_at FROM task_runs WHERE json_extract(metadata,'$.supercode.agent_id') IS NOT NULL ORDER BY id").all())
+  const agentRuns=[...new Map((await readRunPages(board.db, 'id,task_id,metadata,ended_at', { where: "json_extract(metadata,'$.supercode.agent_id') IS NOT NULL" }))
     .map(row=>{const session=json(row.metadata,{})?.supercode;return [session?.session_id?addressOf(session):`run:${row.id}`,row];})).values()];
-  for(const row of agentRuns){
+  for(const scanned of agentRuns){
+    await yieldToOwner();
+    const row=view(board,db=>db.prepare('SELECT id,task_id,metadata,ended_at FROM task_runs WHERE id=?').get(scanned.id));
+    if(!row)continue;
     const session=json(row.metadata,{})?.supercode;
     if(!session?.session_id||!session.agent_org||view(board,db=>detachedSession(db,session)))continue;
     const ref=`${session.harness}:${session.session_id}`;
@@ -2444,7 +2452,7 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     } else if (prev.resumable !== false) {
       const authorization = view(board, db => currentRun(db,task.id)?.metadata?.supercode?.restart_authorized);
       const released = view(board,db=>{
-        const last = db.prepare("SELECT id,kind FROM task_events WHERE task_id=? AND kind IN ('dispatch_held','dispatch_released','restart_authorization_consumed') ORDER BY id DESC LIMIT 1").get(task.id);
+        const last = latestEvent(db, task.id, ['dispatch_held', 'dispatch_released', 'restart_authorization_consumed'], 'id,kind');
         return last?.kind === 'dispatch_released';
       });
       // Only a session whose run ended in a monitored incident waits for its manager or creator; one a workflow
@@ -2956,8 +2964,11 @@ async function fileMail(board, to, body, key, { ask = false, wake = true, subjec
 }
 
 /** Fleet listener mail uses the owner's ordinary filing door, including board-copy refusal and sender custody. */
-export function fileFleetNotice(root, to, body, key) {
-  return fileMail({ root, label: boardLabel(root, 'default') }, to, body, key);
+export async function fileFleetNotice(root, to, body, key) {
+  const board = openBoard(root, 'default');
+  board.label = boardLabel(root, 'default');
+  try { return await fileMail(board, to, body, key); }
+  finally { board.close(); }
 }
 
 /**
@@ -3102,9 +3113,13 @@ function noticeWait(board, sub, report, reason = null) {
  * the latest run that names it. A Claude or Codex session resumed by id keeps its address, so a run that resumes it
  * holds it again.
  */
-function sessionRecord(db) {
+function sessionRecord(db, address) {
   const held = new Set(), latest = new Map();
-  for (const r of db.prepare('SELECT r.id, r.task_id, r.ended_at, r.metadata, t.id AS current FROM task_runs r LEFT JOIN tasks t ON t.current_run_id = r.id ORDER BY r.id').all()) {
+  const named = sessionAt(address);
+  if (!named) return { held, latest };
+  // Both arms seek one native identity; the join's current_run_id has its own index. Never read unrelated sessions.
+  for (const r of db.prepare(`SELECT r.id,r.task_id,r.ended_at,r.metadata,t.id AS current FROM task_runs r
+    LEFT JOIN tasks t ON t.current_run_id=r.id WHERE r.id IN (${NOTICE_RUN_IDS}) ORDER BY r.id`).all(named.session_id, address)) {
     const session = json(r.metadata, {})?.supercode, address = addressOf(session);
     if (!address) continue;
     if (!r.ended_at || r.current) held.add(address);
@@ -3152,10 +3167,10 @@ async function endWorkerSubscriptions(board, fleet, report) {
     if (aliveNow.get(address) === false && subscriberGone(fleet, address)) goneNow.set(address, now());
   }
   tx(board, (db) => {
-    const { held, latest } = sessionRecord(db);
     const remove = db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?");
     const ended = new Map();
     for (const row of db.prepare("SELECT task_id, chat_id, thread_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) {
+      const { held, latest } = sessionRecord(db, row.chat_id);
       const address = row.chat_id, record = latest.get(address);
       // a session alive, or whose liveness could not be read (unknown, never taken as ended), keeps its subscription
       if (!record || record.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) !== false)) continue;
@@ -3185,7 +3200,6 @@ async function endWorkerSubscriptions(board, fleet, report) {
  */
 async function notify(board, fleet, report, entry) {
   await endWorkerSubscriptions(board, fleet, report);
-  const record = view(board, (db) => sessionRecord(db));
   for (const sub of subscriptions(board.db).filter((s) => s.platform === 'supercode')) {
     await yieldToOwner();
     if (stopping) break;
@@ -3198,6 +3212,7 @@ async function notify(board, fleet, report, entry) {
     const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id LIMIT 64`)
       .all(sub.task_id, sub.last_event_id, ...kinds);
     if (!events.length) { noticeWait(board, sub, report); continue; }
+    const record = view(board, db => sessionRecord(db, sub.chat_id));
     // Events name the acting native session; subscriptions may name its agent.
     // Use the daemon's retained binding, including former mains, for both
     // coalescing and delivery. An unread binding proves no additional alias.
@@ -3636,6 +3651,9 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
         report.queued.push([id, `review waits: ${inTurn.why}`]);
         continue;
       }
+      // A stable local refusal (wrong HEAD or uncommitted work) must not spend a full fresh REST scan every
+      // round. Advisory discovery is sufficient to refuse, never to authorize; the scan below still owns that.
+      if (!payload.no_code) await openReviewPullRequests(board, id, { checkWorkspaces: true });
       if (!dry) await refreshCardInputs(board, id, { commits: true });
       // Cached draft/closed exclusions are useful while waiting, but cannot define a committed review's set.
       const observed = await withFreshReviewReads(async () => {

package/board/engine.mjs

@@ -468,8 +468,9 @@ export async function act(board, id, name, { roles = null, payload = {}, extra =
     // Authorization and the comment row share one transaction: a refusal stores nothing.
     if (name === 'comment') r.commentId = Number(run(db, 'INSERT INTO task_comments (task_id, author, body, created_at) VALUES (?, ?, ?, ?)', id, payload.author.trim(), payload.body.trim(), now()).lastInsertRowid);
     // the cards that wait on it, and its subtasks, see it change
-    const related = all(db, 'SELECT task_id, blocked_by FROM supercode_cards').filter((c) => json(c.blocked_by, []).some((b) => b.id === id)).map((c) => c.task_id);
-    const around = [...related, ...childrenOf(db, id), ...all(db, 'SELECT task_id AS id FROM supercode_cards WHERE subtask_of = ?', id).map((x) => x.id)];
+    // Card blockers are mirrored to task_links by relation writes and document imports. Its parent key is the reverse
+    // lookup; reading every card's blocked_by JSON on each public verb only rediscovers the same children.
+    const around = [...childrenOf(db, id), ...all(db, 'SELECT task_id AS id FROM supercode_cards WHERE subtask_of = ?', id).map((x) => x.id)];
     for (const other of new Set(around)) settle(db, board, entry, other, r.effects);
     return r;
   });
@@ -532,7 +533,7 @@ export async function goto(board, id, status, { roles = null, payload = {} } = {
 // it keeps trying at the capped wait, and at EFFECT_ATTEMPTS failed attempts its card records `effect_stalled` and the
 // managers are mailed once, so a passed card whose merge keeps failing is seen, and still heals when the cause clears.
 export const EFFECT_ATTEMPTS = 6;
-const OWNED = new Set(['merge_reviewed', 'cleanup_workspace']);
+const OWNED = new Set(['merge_reviewed', 'cleanup_workspace', 'rename_card_agents']);
 const effectWait = (attempts) => Math.min(1800, 30 * 2 ** Math.max(0, attempts - 1));
 // A delivery pass claims a row by compare-and-set on its next_at (set ahead only while the row is due) before trying it,
 // so two passes (serve's, the hosted loop's, a person's `workflow deliver`, a verb's own) never try one effect at once.
@@ -620,6 +621,7 @@ async function runEffect(board, e) {
   if (e.kind === 'session_notice') { const { sessionNotice } = await import('./dispatch.mjs'); return await sessionNotice(board, e) !== false; }
   if (e.kind === 'cleanup_workspace') { await cleanupWorkspace(board, e.id); return true; }
   if (e.kind === 'declare_card_agent') { const { declareCardAgentEffect } = await import('./agent-declarations.mjs'); return (await declareCardAgentEffect(board, e)) !== false; }
+  if (e.kind === 'rename_card_agents') { const { renameCardAgentsEffect } = await import('./agent-declarations.mjs'); return await renameCardAgentsEffect(board, e); }
   // a verb's own ask files its card's mail at once (a local write; the mailbox delivers it)
   if (e.kind === 'board_message') { const { fileBoardMail } = await import('./dispatch.mjs'); await fileBoardMail(board, { undelivered: [] }, e.id); return true; }
   if (e.kind === 'merge_reviewed') { const { mergeReviewed } = await import('./dispatch.mjs'); return await mergeReviewed(board, e) !== false; }

package/board/event-stream.mjs

@@ -3,6 +3,7 @@
 import { watch, existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { dirname, basename, join, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
+import { once } from 'node:events';
 import { listBoards, openBoard, backingPaths } from './store.mjs';
 
 const identity = root => createHash('sha256').update(realpathSync(root)).digest('hex');
@@ -117,14 +118,47 @@ export async function* followBoardPublications({root,after,signal}) {
 
 export async function streamBoardPublications(options) {
   if(options.once&&options.after)throw new Error('--once requires a fresh snapshot; omit --after');
+  const parent=process.ppid, reader=Number(process.env.SUPERCODE_WORKFLOW_READER_PID??parent);
+  if(!Number.isSafeInteger(reader)||reader<1||reader>2147483647)throw new Error('Invalid SUPERCODE_WORKFLOW_READER_PID');
   const abort=new AbortController();const stop=()=>abort.abort();
+  let outputError=null;
+  const failed=error=>{outputError=error;stop();};
   process.once('SIGINT',stop);process.once('SIGTERM',stop);
+  process.stdout.on('error',failed);process.stdout.once('close',stop);
+  // Quiet streams never meet EPIPE. The connector names the real reader across native/npm/home hand-offs; direct
+  // callers use their parent. Unix also detects reparenting (including death before this command finished starting).
+  // On Windows ppid does not change, but probing the named reader still detects its exit.
+  const checkReader=()=>{
+    if(process.platform!=='win32'&&(parent===1||process.ppid!==parent)){stop();return;}
+    try{process.kill(reader,0);}catch(error){if(error.code==='ESRCH')stop();}
+  };
+  const lifetime=setInterval(checkReader,1000);lifetime.unref();checkReader();
+  const write=async frame=>{
+    if(abort.signal.aborted)return;
+    try{
+      if(!process.stdout.write(`${JSON.stringify(frame)}\n`))await once(process.stdout,'drain',{signal:abort.signal});
+    }catch(error){
+      if(error.name==='AbortError'&&abort.signal.aborted)return;
+      if(error.code==='EPIPE'){stop();return;}
+      throw error;
+    }
+  };
+  let code=0;
   try {
     for await(const frame of followBoardPublications({...options,signal:abort.signal})){
-      if(!process.stdout.write(`${JSON.stringify(frame)}\n`))await new Promise(done=>process.stdout.once('drain',done));
+      if(abort.signal.aborted)break;
+      await write(frame);
+      if(abort.signal.aborted)break;
       if(options.once&&frame.type==='snapshot_end')break;
     }
-  }catch(error){if(error.code==='resync_required'){process.stdout.write(`${JSON.stringify({type:'resync_required',reason:error.message})}\n`);return 1;}throw error;}
-  finally{process.removeListener('SIGINT',stop);process.removeListener('SIGTERM',stop);}
-  return 0;
+  }catch(error){if(error.code==='resync_required'){await write({type:'resync_required',reason:error.message});code=1;}else throw error;}
+  finally{
+    clearInterval(lifetime);process.removeListener('SIGINT',stop);process.removeListener('SIGTERM',stop);
+    // No final flush can drain into a dead or stalled reader. Returning the iterator above closes its board and
+    // watchers first; discard pending bytes on cancellation so the public entry can finish too.
+    if(abort.signal.aborted)process.stdout.destroy();
+    process.stdout.removeListener('error',failed);process.stdout.removeListener('close',stop);
+  }
+  if(outputError&&outputError.code!=='EPIPE')throw outputError;
+  return code;
 }

package/board/fleet-listeners.mjs

@@ -15,9 +15,9 @@ const refused = message => Object.assign(new Error(message), { code: 'fleet_list
 /** A retained mail outbox. `file` is the board's existing admitted mailbox filing door, never a transport or
  *  provider selected from the observed payload. No runtime database is opened until the home opts into listeners. */
 export class FleetListenerRouter {
-  constructor({ root, file, enrich = event => event, retry = () => {}, log = () => {} }) {
+  constructor({ root, file, enrich = event => event, work = fn => fn(), retry = () => {}, log = () => {} }) {
     if (typeof file !== 'function') throw refused('fleet listener router needs the admitted mailbox filing door');
-    this.root = root; this.file = file; this.enrich = enrich; this.retry = retry; this.log = log; this.definitions = {}; this.closed = false; this.suspended = false;
+    this.root = root; this.file = file; this.enrich = enrich; this.work = work; this.retry = retry; this.log = log; this.definitions = {}; this.closed = false; this.suspended = false;
   }
 
   /** The workflow's decoded declarations. An invalid replacement refuses without discarding the prior outbox. */
@@ -37,7 +37,15 @@ export class FleetListenerRouter {
     this.suspended = false;
     if (Object.keys(next).length) {
       this.store();
-      if (!this.timer) { this.timer = setInterval(() => { if (!this.suspended) { try { this.retry(); } catch (error) { this.log(`fleet listener source: ${String(error.message).slice(0, 300)}`); } } this.wake(); }, 1000); this.timer.unref?.(); }
+      if (!this.timer) {
+        this.timer = setInterval(() => {
+          void Promise.resolve().then(() => {
+            if (!this.closed && !this.suspended) return this.retry();
+          }).catch(error => this.log(`fleet listener source: ${String(error.message).slice(0, 300)}`))
+            .finally(() => this.wake());
+        }, 1000);
+        this.timer.unref?.();
+      }
       this.wake();
     } else if (this.db) {
       this.db.prepare('INSERT INTO fleet_listener_runtime(id,needs_baseline) VALUES(1,1) ON CONFLICT(id) DO UPDATE SET needs_baseline=1').run();
@@ -212,7 +220,10 @@ export class FleetListenerRouter {
   flush() {
     if (this.flushing) return this.flushing;
     if (!this.db || this.closed || this.suspended) return Promise.resolve();
-    this.flushing = Promise.resolve().then(async () => {
+    // Prepare owner work before replaying retained waits too. Enrichment and enqueue remain synchronous, so the
+    // source cursor cannot advance until its complete event body is committed to the outbox.
+    this.flushing = Promise.resolve().then(() => this.work(async () => {
+      if (this.closed || this.suspended) return;
       // Even a prompt that has since cleared keeps an earlier refused observation. Do not block already queued mail
       // on a full outbox: file it below to make room, then the retained prompt retries at the next wake.
       for (const wait of this.db.prepare('SELECT address,event FROM fleet_listener_waits WHERE routed=0 LIMIT 16').all()) {
@@ -238,7 +249,7 @@ export class FleetListenerRouter {
           this.db.prepare('UPDATE fleet_listener_mail SET attempts=?,next_at=?,error=? WHERE id=?').run(attempts, Date.now() + delay, String(error.message).slice(0, 500), row.id);
         }
       }
-    }).finally(() => { this.flushing = null; });
+    })).finally(() => { this.flushing = null; });
     return this.flushing;
   }
 

package/board/published.mjs

@@ -38,7 +38,7 @@ CREATE INDEX IF NOT EXISTS supercode_publication_heads_sequence ON supercode_pub
 // Columns the publication tables gained after their first layout; store.mjs layOut adds each one a store lacks. A head's
 // fingerprint is the cheap reading of its card's rows the head was last compared at (fingerprintOf); the log's prune_from
 // is where a prune under way resumes, null when none is (prunePublications).
-export const PUBLICATION_COLUMNS = { supercode_publication_heads: { fingerprint: 'TEXT' }, supercode_publication_log: { prune_from: 'INTEGER' } };
+export const PUBLICATION_COLUMNS = { supercode_publications: { snapshot_bytes: 'INTEGER' }, supercode_publication_heads: { fingerprint: 'TEXT' }, supercode_publication_log: { prune_from: 'INTEGER' } };
 
 // The snapshot's shape: 1 names the card as a person does (`ref`, VO-856).
 const SNAPSHOT_SHAPE = 4;
@@ -56,7 +56,7 @@ const MARKED = [['tasks', ['id']], ['supercode_cards', ['task_id']], ['task_comm
 export function publicationTriggers(db) {
   const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => row.name));
   const first = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'trigger' AND name = 'supercode_publish_tasks_insert'").get();
-  const snapshotEvents = `(${[...REVIEW_KIND_LIST,...AGENT_KIND_LIST].map((kind) => `'${kind}'`).join(',')})`;
+  const snapshotEvents = `(${[...REVIEW_KIND_LIST,...AGENT_KIND_LIST,'archived'].map((kind) => `'${kind}'`).join(',')})`;
   const agentMigration = tables.has('task_events') && !db.prepare("SELECT sql FROM sqlite_master WHERE type='trigger' AND name='supercode_publish_task_events_insert'").get()?.sql.includes("'agent_assignment_adopted'");
   const scopeMigration = !db.prepare("SELECT 1 FROM sqlite_master WHERE type='trigger' AND name='supercode_publish_supercode_card_agent_scopes_insert'").get();
   // A snapshot names its card's number: a store that numbers its cards republishes every card once, when that is watched.
@@ -64,11 +64,12 @@ export function publicationTriggers(db) {
   // A snapshot of a newer shape (SNAPSHOT_SHAPE) than the heads were published in: every card is published once again.
   const shapeMigration = Number(db.prepare('SELECT max(version) AS version FROM supercode_publication_shape').get()?.version ?? 0) < SNAPSHOT_SHAPE;
   const contentMigration = !db.prepare("SELECT sql FROM sqlite_master WHERE type='trigger' AND name='supercode_publish_task_comments_update'").get()?.sql.includes('fingerprint=NULL');
+  const archiveMigration = !db.prepare("SELECT sql FROM sqlite_master WHERE type='trigger' AND name='supercode_publish_task_events_insert'").get()?.sql.includes("'archived'");
   db.exec('SAVEPOINT supercode_publication_marking');
   try {
     // Existing event triggers only watched reviews. Replace that filter once, preserving the savepoint rollback.
     if(contentMigration)for(const table of ['task_comments','task_events'])for(const verb of ['insert','update','delete'])db.exec(`DROP TRIGGER IF EXISTS supercode_publish_${table}_${verb}`);
-    if(agentMigration)for(const verb of ['insert','update','delete'])db.exec(`DROP TRIGGER IF EXISTS supercode_publish_task_events_${verb}`);
+    if(agentMigration||archiveMigration)for(const verb of ['insert','update','delete'])db.exec(`DROP TRIGGER IF EXISTS supercode_publish_task_events_${verb}`);
     for (const [table, columns] of MARKED) {
       if (!tables.has(table)) continue;
       // Reviews and agent assignment events change a snapshot: an update marks when the
@@ -80,7 +81,7 @@ export function publicationTriggers(db) {
         CREATE TRIGGER IF NOT EXISTS supercode_publish_${table}_update AFTER UPDATE ON ${table}${when(['OLD', 'NEW'])} BEGIN ${mark('NEW')} ${mark('OLD')} END;
         CREATE TRIGGER IF NOT EXISTS supercode_publish_${table}_delete AFTER DELETE ON ${table}${when(['OLD'])} BEGIN ${mark('OLD')} END;`);
     }
-    if ((first || contentMigration || agentMigration || scopeMigration || numberMigration || shapeMigration) && tables.has('tasks')) db.exec(`INSERT INTO supercode_publication_dirty (task_id)
+    if ((first || contentMigration || archiveMigration || agentMigration || scopeMigration || numberMigration || shapeMigration) && tables.has('tasks')) db.exec(`INSERT INTO supercode_publication_dirty (task_id)
       SELECT id FROM tasks UNION SELECT resource_id FROM supercode_publication_heads WHERE digest != 'removed'
       EXCEPT SELECT task_id FROM supercode_publication_dirty`);
     if (shapeMigration) { db.exec('DELETE FROM supercode_publication_shape'); db.prepare('INSERT INTO supercode_publication_shape (version) VALUES (?)').run(SNAPSHOT_SHAPE); }
@@ -100,8 +101,8 @@ export function markRemovedHeads(db) {
 const RETAINED_CHANGES = 1024;
 // The changes one prune transaction deletes: a change's snapshot averaged about 190 KB and reached 3.7 MB, and deleting
 // every pruned change in one statement held the owner's event loop for 291 s (2026-10-21).
-const PRUNE_BATCH = 200;
-const PRUNE_BYTES = 8 * 1024 * 1024;
+const PRUNE_BATCH = 16;
+const PRUNE_BYTES = 1024 * 1024;
 const hash = value => createHash('sha256').update(value).digest('hex');
 const parse = (value,fallback=null) => {try{return JSON.parse(value)??fallback;}catch{return fallback;}};
 const at = value => value == null ? null : new Date(Number(value)*1000).toISOString();
@@ -206,13 +207,10 @@ const perCard=db=>{
 };
 // The columns of a task row that change while its card runs and that no snapshot reads (cardSnapshot).
 const UNREAD_TASK_COLUMNS = new Set(['claim_lock','claim_expires','worker_pid','last_heartbeat_at']);
-// The events a snapshot reads: its reviews, its agents and its archive reason.
-const SNAPSHOT_EVENT_KINDS = `(${[...REVIEW_KIND_LIST,...AGENT_KIND_LIST,'archived'].map((kind) => `'${kind}'`).join(',')})`;
 const fingerprintReads=db=>({
-  // comments and events are only ever added or removed by supercode's writers; their bytes catch a document edit that
-  // rewrites one in place; SQLite answers octet_length from a row's header, without reading its text
-  comments:db.prepare('SELECT count(*) AS n,max(id) AS last,total(octet_length(body)) AS bytes FROM task_comments WHERE task_id=?'),
-  events:db.prepare(`SELECT count(*) AS n,max(id) AS last,total(octet_length(payload)) AS bytes FROM task_events WHERE task_id=? AND kind IN ${SNAPSHOT_EVENT_KINDS}`),
+  // Comment/event inserts, updates and deletes invalidate the head's fingerprint in their native transaction.
+  // Even a same-length in-place edit forces a snapshot comparison; rereading every history row's header here adds
+  // no information and held the owner's loop for 1.9 s on one card's comment history.
   facts:db.prepare('SELECT facts_json,receipt_sequence,declared_event_id FROM supercode_card_agent_facts WHERE task_id=?'),
   scope:db.prepare('SELECT from_org,org,changed_at FROM supercode_card_agent_scopes WHERE task_id=?'),
   // a run's metadata changes in place (its session's observations), so every run's snapshot columns are read whole
@@ -227,7 +225,7 @@ const fingerprintReads=db=>({
 function fingerprintOf(reads,rows,row,key,options){
   const task={};for(const [column,value] of Object.entries(row))if(!UNREAD_TASK_COLUMNS.has(column))task[column]=value;
   return hash(JSON.stringify([SNAPSHOT_SHAPE,SNAPSHOT_RELEASE,key,Boolean(options.nativeHolds),task,rows.own(row.id)??null,rows.number(row.id),rows.parents(row.id),rows.children(row.id),
-    reads.comments.get(row.id),reads.events.get(row.id),reads.facts.get(row.id)??null,reads.scope.get(row.id)??null,reads.runs.all(row.id)]));
+    reads.facts.get(row.id)??null,reads.scope.get(row.id)??null,reads.runs.all(row.id)]));
 }
 /** A card's snapshot; `key` is its board's key (store.mjs boardKey), with which `ref` names the card as a person does
  *  (`VO-856`, store.mjs cardRef), null for a card with no number. */
@@ -270,7 +268,7 @@ export function recordCardPublications(db,actor,root,key) {
   db.prepare('INSERT INTO supercode_publication_log(id,pruned_through) SELECT ?,0 WHERE NOT EXISTS (SELECT 1 FROM supercode_publication_log)').run(`log_${randomUUID()}`);
   const rows=perCard(db),reads=fingerprintReads(db),task=db.prepare('SELECT * FROM tasks WHERE id=?'),head=db.prepare('SELECT resource_id,digest,last_event_id,fingerprint FROM supercode_publication_heads WHERE resource_id=?');
   const lastEvent=db.prepare('SELECT id,kind FROM task_events WHERE task_id=? ORDER BY id DESC LIMIT 1');
-  const insert=db.prepare('INSERT INTO supercode_publications(id,resource_id,kind,snapshot,actor,created_at) VALUES (?,?,?,?,?,?)');
+  const insert=db.prepare('INSERT INTO supercode_publications(id,resource_id,kind,snapshot,actor,created_at,snapshot_bytes) VALUES (?,?,?,?,?,?,?)');
   const upsert=db.prepare('INSERT INTO supercode_publication_heads(resource_id,digest,sequence,last_event_id,fingerprint) VALUES (?,?,?,?,?) ON CONFLICT(resource_id) DO UPDATE SET digest=excluded.digest,sequence=excluded.sequence,last_event_id=excluded.last_event_id,fingerprint=excluded.fingerprint');
   const compared=db.prepare('UPDATE supercode_publication_heads SET fingerprint=? WHERE resource_id=?');
   let changed=0;
@@ -285,10 +283,11 @@ export function recordCardPublications(db,actor,root,key) {
       if(previous?.digest===digest){compared.run(`${fingerprint}:${digest}`,id);continue;}
       const last=lastEvent.get(id);
       const kind=`task.${previous&&previous.digest!=='removed'?(last?.id!==previous.last_event_id?kinds[last?.kind]??'changed':'changed'):'created'}`;
-      const inserted=insert.run(`event_${randomUUID()}`,id,kind,snapshot,actor,Date.now());
+      const inserted=insert.run(`event_${randomUUID()}`,id,kind,snapshot,actor,Date.now(),Buffer.byteLength(snapshot));
       upsert.run(id,digest,Number(inserted.lastInsertRowid),last?.id??null,`${fingerprint}:${digest}`);changed++;
     }else if(previous&&previous.digest!=='removed'){
-      const inserted=insert.run(`event_${randomUUID()}`,id,'task.changed',JSON.stringify({id,removed:true}),actor,Date.now());
+      const snapshot=JSON.stringify({id,removed:true});
+      const inserted=insert.run(`event_${randomUUID()}`,id,'task.changed',snapshot,actor,Date.now(),Buffer.byteLength(snapshot));
       db.prepare('UPDATE supercode_publication_heads SET digest=?,sequence=?,fingerprint=NULL WHERE resource_id=?').run('removed',Number(inserted.lastInsertRowid),id);changed++;
     }
   }
@@ -330,7 +329,9 @@ export function prunePublications(db) {
     from=0;
   }
   const floor=Number(db.prepare('SELECT pruned_through FROM supercode_publication_log').get().pruned_through);
-  const candidates=db.prepare(`SELECT sequence,octet_length(snapshot) AS bytes FROM supercode_publications p WHERE sequence>? AND sequence<=? AND ${OLDER} ORDER BY sequence LIMIT ?`).all(from,floor,PRUNE_BATCH);
+  // New rows carry their byte count. Legacy rows fall back one small page at a time; never backfill old snapshots
+  // during an ordinary verb or scan hundreds of snapshot headers before the byte budget can be applied.
+  const candidates=db.prepare(`SELECT sequence,COALESCE(snapshot_bytes,octet_length(snapshot)) AS bytes FROM supercode_publications p WHERE sequence>? AND sequence<=? AND ${OLDER} ORDER BY sequence LIMIT ?`).all(from,floor,PRUNE_BATCH);
   const batch=[];let bytes=0;
   for(const row of candidates){
     // A single oversized row still makes progress, in a transaction of its own.

package/board/queries.mjs

@@ -0,0 +1,30 @@
+// Local reads whose cost must follow the matching keys, not the board's accumulated history.
+import { setImmediate as yieldToOwner } from 'node:timers/promises';
+
+/** One reverse index seek per kind, then one payload read. ORDER BY id over an IN-kind filter can instead choose
+ * the task/id index and read unrelated event payloads to reject their kinds. Kinds and columns are code constants. */
+export function latestEvent(db, task, kinds, columns = 'payload') {
+  const seeks = kinds.map(kind => `SELECT (SELECT id FROM task_events WHERE task_id=? AND kind='${kind}' ORDER BY id DESC LIMIT 1) AS id`);
+  return db.prepare(`SELECT ${columns} FROM task_events WHERE id=(SELECT MAX(id) FROM (${seeks.join(' UNION ALL ')}))`).get(...kinds.map(() => task));
+}
+
+/** Read run history in finite, indexed pages, yielding before each page. The candidate page precedes any JSON
+ * predicate, so a page that matches nothing still reads at most 32 rows. Mutations must re-read their target. */
+export async function readRunPages(db, columns, { task = null, where = '1' } = {}) {
+  const high = Number(db.prepare('SELECT MAX(id) AS id FROM task_runs').get()?.id ?? 0);
+  const out = [];
+  let cursor = 0;
+  while (cursor < high) {
+    await yieldToOwner();
+    const ids = db.prepare(`SELECT id FROM task_runs WHERE id>? AND id<=?${task ? ' AND task_id=?' : ''} ORDER BY id LIMIT 32`)
+      .all(cursor, high, ...(task ? [task] : []));
+    if (!ids.length) break;
+    cursor = ids.at(-1).id;
+    out.push(...db.prepare(`SELECT ${columns} FROM task_runs WHERE id IN (SELECT value FROM json_each(?)) AND (${where}) ORDER BY id`)
+      .all(JSON.stringify(ids.map(row => row.id))));
+  }
+  return out;
+}
+
+/** Unended runs plus ended runs a card still names current. Both arms start from small indexed sets. */
+export const ACTIVE_RUN_IDS = 'SELECT id FROM task_runs WHERE ended_at IS NULL UNION SELECT current_run_id FROM tasks WHERE current_run_id IS NOT NULL';

package/board/store.mjs

@@ -221,6 +221,11 @@ export function listBoards(root) {
 // SQLite uses an expression index only for a statement that writes the expression the same way.
 const RUN_SESSION = "json_extract(metadata, '$.supercode.session_id')";
 const RUN_ADDRESS = "json_extract(metadata, '$.supercode.address')";
+// Notification records historically skipped malformed metadata through the JS parser. Keep that behavior in both
+// the lookup and its indexes, including a legacy store that cannot create the older unguarded JSON indexes.
+const NOTICE_SESSION = `CASE WHEN json_valid(metadata,6) THEN ${RUN_SESSION} END`;
+const NOTICE_ADDRESS = `CASE WHEN json_valid(metadata,6) THEN ${RUN_ADDRESS} END`;
+export const NOTICE_RUN_IDS = `SELECT id FROM task_runs WHERE ${NOTICE_SESSION}=? UNION SELECT id FROM task_runs WHERE ${NOTICE_ADDRESS}=?`;
 const RUN_LAUNCH_PENDING = "json_extract(metadata, '$.supercode.launch_pending')";
 export const CALLER_RUN_ADDRESS = `SELECT ${RUN_ADDRESS} AS address FROM task_runs WHERE ${RUN_SESSION} = ? ORDER BY id DESC LIMIT 1`;
 // Launch/adoption commits the native address and its immutable role-agent together.
@@ -242,6 +247,10 @@ const RUN_LAUNCH_PENDING_INDEX = 'idx_runs_supercode_launch_pending';
 const RUN_INDEXES = [
   [RUN_SESSION_INDEX, `(${RUN_SESSION}, id, ${RUN_ADDRESS})`],
   [RUN_LAUNCH_PENDING_INDEX, `(id) WHERE ${RUN_LAUNCH_PENDING} = 1`],
+  ['idx_runs_notice_session', `(${NOTICE_SESSION}, id)`],
+  ['idx_runs_notice_address', `(${NOTICE_ADDRESS}, id)`],
+  ['idx_runs_open_machine_session', `(json_extract(metadata, '$.supercode.machine'), ${RUN_SESSION}, id) WHERE ended_at IS NULL`],
+  ['idx_runs_open_machine_pane', `(json_extract(metadata, '$.supercode.machine'), json_extract(metadata, '$.supercode.pane'), id) WHERE ended_at IS NULL`],
 ];
 
 // What every verb a session runs asks about its caller (cli.mjs ownCards, dispatch.mjs reconcileCallerLaunch). Each
@@ -395,6 +404,13 @@ export function layOut(db, { fresh }) {
   // each read walked every card's row. Laid out here, after the column it names exists on a store of any age and before
   // any statement is prepared; no statement names it, so a store without it is only slower.
   db.exec('CREATE INDEX IF NOT EXISTS idx_supercode_cards_subtask_of ON supercode_cards(subtask_of)');
+  // Current-run joins and unended-run reconciliation must never search all cards/runs for each historical run.
+  db.exec('CREATE INDEX IF NOT EXISTS idx_tasks_current_run ON tasks(current_run_id) WHERE current_run_id IS NOT NULL');
+  db.exec('CREATE INDEX IF NOT EXISTS idx_runs_unended ON task_runs(id) WHERE ended_at IS NULL');
+  // Ordinary comments vastly outnumber explicit source declarations. Keep their JSON discriminator in a small index.
+  db.exec("CREATE INDEX IF NOT EXISTS idx_events_arc_sources ON task_events(task_id,id) WHERE kind='commented' AND json_valid(payload) AND json_type(payload,'$.branches')='array'");
+  // Capacity pages need these columns without visiting task body/result overflow pages.
+  db.exec('CREATE INDEX IF NOT EXISTS idx_tasks_capacity ON tasks(id,status,assignee,current_run_id,model_override)');
   layOutNumbers(db);
   layOutEventIndex(db);
   layOutHistoryIndexes(db);

package/board/workflow.mjs

@@ -20,6 +20,7 @@ import { evaluate, holds, render, needsSources } from './expr.mjs';
 import { completionEvidence, declaredWorkBranches, namedWorkBranch, reviewCandidate } from './ci.mjs';
 import { cardCommitsOn, isLocalWorkspace, isWorkspacePath } from './workspace.mjs';
 import { cardNumber, identifyNotice, numbered } from './notices.mjs';
+import { latestEvent } from './queries.mjs';
 
 const loaded = new Map();
 // the owner's read door holds the workflow the owner reads (owner-door.mjs), told when it is read again
@@ -189,7 +190,7 @@ export function completionOwnerOf(db, id) {
 
 /** A card's explicitly named review profile, retained in its own history. */
 export function reviewerOf(db, id) {
-  return json(one(db, "SELECT payload FROM task_events WHERE task_id=? AND kind IN ('created','reviewer_set') ORDER BY id DESC LIMIT 1", id)?.payload, {})?.reviewer ?? null;
+  return json(latestEvent(db, id, ['created', 'reviewer_set'])?.payload, {})?.reviewer ?? null;
 }
 
 export function latestReview(db, id) {
@@ -469,7 +470,7 @@ export function scopeOf(db, board, task, { params, event = {}, extra = {}, lazy
     get latest_review() { return latestReview(db, task.id) ?? {}; },
     get review_candidate() { return reviewCandidate(board, task.id) ?? {}; },
     ci: completionEvidence(board, task.id),
-    get dispatch_hold() { return one(db, "SELECT kind FROM task_events WHERE task_id=? AND kind IN ('dispatch_held','dispatch_released','session_adopted') ORDER BY id DESC LIMIT 1", task.id)?.kind === 'dispatch_held'; },
+    get dispatch_hold() { return latestEvent(db, task.id, ['dispatch_held', 'dispatch_released', 'session_adopted'], 'kind')?.kind === 'dispatch_held'; },
     status,
     blocked_by: blocks,
     paused: json(state.paused, null),
@@ -1140,6 +1141,13 @@ const ACTIONS = {
       const task = cardOf(ctx.db, ctx.id);
       const readable = allocateReadableId(ctx.db, task.title, said.readable_id, ctx.id);
       run(ctx.db, 'UPDATE tasks SET readable_id=? WHERE id=?', readable, ctx.id);
+      if (readable !== task.readable_id) {
+        // Keep the obligation with the edit: a stopped dispatcher or interrupted caller must not lose the rename.
+        // Delivery reads the current name, so an older edit can never restore an obsolete name.
+        const effect = { kind: 'rename_card_agents', id: ctx.id };
+        const inserted = run(ctx.db, 'INSERT INTO supercode_effects (effect) VALUES (?)', JSON.stringify(effect));
+        ctx.effects.push({ ...effect, durableId: Number(inserted.lastInsertRowid) });
+      }
     }
     if (said?.title && String(said.title).trim()) run(ctx.db, 'UPDATE tasks SET title = ? WHERE id = ?', String(said.title).trim(), ctx.id);
     if (said?.body !== undefined && said?.body !== null) run(ctx.db, 'UPDATE tasks SET body = ? WHERE id = ?', said.body, ctx.id);
@@ -1231,11 +1239,12 @@ const ACTIONS = {
 /** Binding a newer run transfers ownership; stale run references cannot veto its later stop. */
 export function retireSupersededRuns(db, id, runId, session) {
   if (!session?.session_id && !session?.pane) return;
-  for (const old of all(db, `SELECT id, task_id, metadata FROM task_runs WHERE id < ? AND ended_at IS NULL
-    AND json_extract(metadata, '$.supercode.machine') IS ?
-    AND ((? IS NOT NULL AND json_extract(metadata, '$.supercode.session_id') = ?)
-      OR (? IS NOT NULL AND json_extract(metadata, '$.supercode.pane') = ?))`,
-    runId, session.machine ?? null, session.session_id ?? null, session.session_id ?? null, session.pane ?? null, session.pane ?? null)) {
+  for (const old of all(db, `SELECT id,task_id,metadata FROM task_runs WHERE id IN (
+    SELECT id FROM task_runs WHERE id<? AND ended_at IS NULL AND json_extract(metadata, '$.supercode.machine') IS ?
+      AND json_extract(metadata, '$.supercode.session_id')=?
+    UNION SELECT id FROM task_runs WHERE id<? AND ended_at IS NULL AND json_extract(metadata, '$.supercode.machine') IS ?
+      AND json_extract(metadata, '$.supercode.pane')=?)`,
+    runId, session.machine ?? null, session.session_id ?? null, runId, session.machine ?? null, session.pane ?? null)) {
     const whole = json(old.metadata, {}) ?? {}, s = whole.supercode;
     if (!s || detachedSession(db, s) || s.machine !== session.machine || !((session.session_id && s.session_id === session.session_id) || (session.pane && s.pane === session.pane))) continue;
     if (old.task_id !== id && one(db, 'SELECT 1 FROM tasks WHERE current_run_id = ?', old.id)) throw new Error(`session is still owned by active run ${old.id} of ${old.task_id}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.209",
+  "version": "0.5.211",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -32,10 +32,10 @@
     "check-types": "node scripts/generate-types.mjs --check"
   },
   "dependencies": {
-    "@volter/supercode-teams": "^0.3.344",
+    "@volter/supercode-teams": "^0.3.346",
     "@volter/supercode-terminal": "^0.3.10",
     "@volter/supercode-harness-sdk": "^0.3.104",
-    "@volter/teams": "0.2.98",
+    "@volter/teams": "0.2.99",
     "@volter/ztrack": "^2.4.23",
     "yaml": "^2.9.0"
   },
@@ -61,5 +61,6 @@
     "board",
     "apply",
     "README.md"
-  ]
+  ],
+  "gitHead": "38f4a38369c31949d4d81fd3520a6aa678582ead"
 }