@volter/supercode-orchestrator 0.5.210 → 0.5.212

package/board/dispatch.mjs

@@ -27,11 +27,12 @@ import { readMachineFleet } from './machine-fleet.mjs';
 import { homeFleetMachines } from './fleet-targets.mjs';
 import { delegatedWork, idleInterval } from './session-work.mjs';
 import { localSessionDelegations } from '../agents.mjs';
-import { creatorOf, sessionProgress } from './workflow.mjs';
+import { cardSectionHeading, creatorOf, sessionProgress } from './workflow.mjs';
 import { boardLabel, boardName } from '@volter/teams/board-name';
 let fleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, withFreshReviewReads, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { setImmediate as yieldToOwner } from 'node:timers/promises';
+import { ACTIVE_RUN_IDS, latestEvent, readRunPages } from './queries.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
 import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, recordUsageUnread, agentPreamble, agentEnvironment, recordAgentRun, cardAgentAssignments,renameCardAgent,handOffAgents, agentRunForSession } from '../agents.mjs';
 import { finishCardAgentAssignment, recordCardAgentAssignment } from './agent-declarations.mjs';
@@ -50,7 +51,7 @@ import { homedir, hostname, tmpdir, totalmem } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { view, boardCopyOf, boardKey, boardPath, cardHandleOf, readableIdOf, briefPath, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, openBoard, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
+import { view, boardCopyOf, boardKey, boardPath, cardHandleOf, readableIdOf, briefPath, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, NOTICE_RUN_IDS, openBoard, openBoardSnapshot, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
 import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, transitionsFor, scopeOf, statusOf, projectStatus, storedStatus, templateValue, workflowFor } from './workflow.mjs';
 import { checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace } from './workspace.mjs';
 import { capacity, dispatched, executionHost, harnessDefaults, holdings } from './capacity.mjs';
@@ -829,7 +830,14 @@ async function homeHoldings(root, slugs, lanes, fleet, entry) {
   const out = [];
   for (const slug of slugs) {
     try {
-      const b = openBoard(root, slug);
+      // Capacity spans awaits. It needs its own committed snapshot, not the shared writer's total_changes counter:
+      // unrelated owner calls and delivery writes used to invalidate all three attempts at this read.
+      let b;
+      try { b = openBoardSnapshot(root, slug); }
+      catch (error) {
+        if (error.code !== 'board_read_by_owner') throw error;
+        b = openBoard(root, slug); // files/non-WAL backings retain their guarded optimistic read
+      }
       try {
         b.slug ??= slug; b.label ??= boardLabel(root, slug);
         // each run's session read before it is counted live or not (unknown stays unknown)
@@ -839,7 +847,7 @@ async function homeHoldings(root, slugs, lanes, fleet, entry) {
           runLaneOf: row => runLane(b.db, b, entry, getTask(b.db, row.id), lanes) }));
       }
       finally { b.close(); }
-    } catch (error) { if (error.capacityUnread) throw error; /* its own tick reports other board errors */ }
+    } catch (error) { error.capacityUnread = true; throw error; }
   }
   out.defaults = harnessDefaults(out);
   return out;
@@ -926,6 +934,9 @@ async function startCards(board, fleet, lanes, settings, report, entry, effects,
     if (task.subtask_of || task.current_run_id) continue;
     const state = scopeFor(task).card;
     if (state.archived || ['done', 'cancelled'].includes(state.status)) continue;
+    if (state.status === 'running' && completedWork(board.db, task.id)) {
+      waiting(task, 'work is complete; the board must select its independent review before another implementer run'); continue;
+    }
     if (state.detached) { waiting(task, `session belongs to ${state.detached.person}; verified adoption is required`); continue; }
     if (state.dispatch_hold) { waiting(task, 'dispatch held: an explicit start or verified adoption must release it'); continue; }
     if (workflow.run && state.paused) { waiting(task, `paused: ${state.paused.reason ?? 'manager pause'}`); continue; }
@@ -990,7 +1001,7 @@ async function startCards(board, fleet, lanes, settings, report, entry, effects,
         const refused = caps.admit(waitingEntries[i], scope, waitingEntries);
         if (refused) throw Object.assign(new Error(refused.why), { claimedElsewhere: true });
         assertWorkspaceOwner(db, task, checked);
-        if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.mainRoot, task.id);
+        if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.workspaceRoot, task.id);
         if (!task.assignee && plan.profile) {
           db.prepare('UPDATE tasks SET assignee = ? WHERE id = ?').run(plan.profile, task.id);
           event(db, task.id, 'assigned', { assignee: plan.profile, source: 'workflow role' });
@@ -1075,7 +1086,7 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
   const checked = await checkWorkspace(board, task);
   if (checked) runTx(board, id, runId, (db) => {
     assertWorkspaceOwner(db, task, checked);
-    db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.mainRoot, id);
+    db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.workspaceRoot, id);
   });
   const status = view(board, (db) => statusOf(db, task));
   const spec = runSpec(entry, status, task);
@@ -1208,7 +1219,7 @@ export async function startCard(board, id, { roles = ['manager'], lanes, setting
   const moved = tx(board, (db) => {
     if (detachedCard(db, id)) throw new Error(`${id} is detached to a person; request and verify adoption before starting it`);
     assertWorkspaceOwner(db, before, checked);
-    if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.mainRoot, id);
+    if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.workspaceRoot, id);
     if (!roles.some(role => ['manager', 'creator'].includes(role))) throw new Error('Only the manager or creator starts a held card; request its decision.');
     event(db, id, 'dispatch_released', { reason: 'explicit start' });
     requestSessionClose(db,id);
@@ -1398,8 +1409,7 @@ function recordInputClose(board, row, session, reading) {
 /** The closes this process is making now, by run: each one's outcome, for a pass that meets it under way. */
 const closesUnderway = new Map();
 export async function closeRequested(board, report, { taskId = null, caller = null, ttl = null, fleet = null } = {}) {
-  const rows = view(board, (db) => db.prepare(`SELECT id, task_id, profile, ended_at, metadata FROM task_runs
-    WHERE metadata IS NOT NULL ${taskId ? 'AND task_id = ?' : ''}`).all(...(taskId ? [taskId] : [])));
+  const rows = await readRunPages(board.db, 'id, task_id, profile, ended_at, metadata', { task: taskId, where: 'metadata IS NOT NULL' });
   // Repair pre-transfer history once: only identities with an older unended reference need a write.
   const latest = new Map(), transfers = new Map();
   for (const row of [...rows].sort((a,b) => b.id-a.id)) {
@@ -1413,10 +1423,15 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
     }
   }
   if (transfers.size) tx(board, (db) => {
-    for (const row of transfers.values()) retireSupersededRuns(db, row.task_id, row.id, json(row.metadata, {})?.supercode);
+    for (const row of transfers.values()) {
+      // The paged scan yielded. Transfer only from the successor's current retained identity.
+      const current = db.prepare('SELECT task_id,metadata FROM task_runs WHERE id=?').get(row.id);
+      if (current) retireSupersededRuns(db, current.task_id, row.id, json(current.metadata, {})?.supercode);
+    }
   });
   const panes = new Map();
   for (const row of rows) {
+    await yieldToOwner();
     let session = json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
     if (!session || detachedSession(board.db, session) || session.close_transferred_to || session.close_confirmed_at) continue;
     // A keyed launch is reconciled by its machine's own daemon (D137), never by a door the close waits on. A session
@@ -1445,7 +1460,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
         continue;
       }
     }
-    if (session?.monitor_held && !session.close_requested) continue; // only an explicit close action ends this process
+    if ((session?.monitor_held || session?.retain_after_run) && !session.close_requested) continue; // only an explicit close action ends this process
     if ((!session?.pane && session?.surface !== 'native') || session.close_transferred_to || session.close_confirmed_at || (!row.ended_at && !session.close_requested)) continue;
     if (caller && session.session_id === caller) continue; // let the command that ended its own run return
     // The board closes only what it launched. An adopted session (a person's own thread, a hook session the card was
@@ -1474,12 +1489,12 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       const observed = r.code === 0 ? json(r.stdout.trim(), null) : null;
       if (observed?.pane !== session.pane) continue;
       if (observed.present === true && observed.yours === true) {
-        if (view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all())
+        if (view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all())
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); })) continue;
         finalFailure = false;
       } else if (observed.present !== false) continue;
     }
-    const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all());
+    const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all());
     // Persist retries even for historical ends that did not have a close_session action. The close is claimed in the
     // same transaction, before the pane or process is touched: of two rounds (or a round and a verb) that read one close,
     // only the one whose claim committed closes it, and the other never records the pane it finds gone as a failure.
@@ -1531,7 +1546,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       const observed = panes.get(machine);
       if (observed.error) throw new Error(`close deferred: ${observed.error}`); // an unread pane list is no verdict on the pane
       if (observed.live.has(session.pane)) {
-        const protectedNow = view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all())
+        const protectedNow = view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all())
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); });
         if (protectedNow) throw new Error(`close deferred: pane ${session.pane} is owned by an unended run`);
         // An ended run's session is closed only between its turns, read last, after the claim and the pane list (a pane
@@ -1583,7 +1598,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
         // Removing only the card's own left every subtask notifying a closed session, each attempt a failed delivery,
         // every round. A later run that resumes it by id subscribes it again at its launch (and each round while it is
         // the card's current run).
-        const subscribed = db.prepare('SELECT r.id, r.metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)').all()
+        const subscribed = db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all()
           .some((r) => addressOf(json(r.metadata, {})?.supercode) === address && r.id !== row.id);
         const unsubscribed = subscribed ? 0 : db.prepare("DELETE FROM kanban_notify_subs WHERE platform = 'supercode' AND chat_id = ? AND (task_id = ? OR json_extract(delivery_metadata, '$.role') = 'worker')").run(address, row.task_id).changes;
         event(db, row.task_id, 'session_closed', { session_id: session.session_id, pane: session.pane, machine: session.machine, unsubscribed,
@@ -1612,7 +1627,18 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
     return Number(rows?.find((row) => row.locator?.session_id === session.session_id)?.updated_at_ms) || null;
   };
   const managers = [].concat(entry.params.managers ?? []).filter(Boolean);
-  const delegations = localSessionDelegations(board.root, localMachine());
+  const running = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
+  const edges = localSessionDelegations(board.root, localMachine());
+  const reached = new Set(running.map(({ id }) => addressOf(currentRun(board.db, id)?.metadata?.supercode)).filter(Boolean));
+  const delegations = [];
+  const pending = [...reached];
+  const byStarter = new Map();
+  for (const edge of edges) { const children = byStarter.get(edge.starter) ?? []; children.push(edge); byStarter.set(edge.starter, children); }
+  while (pending.length) for (const edge of byStarter.get(pending.pop()) ?? []) {
+    delegations.push(edge);
+    if (!reached.has(edge.session)) { reached.add(edge.session); pending.push(edge.session); }
+  }
+  report.idle_delegations = { recorded: edges.length, reachable: delegations.length };
   const delegatedReadings = [...fleet.sessions];
   // Forks and concurrent sessions need not have a pane. Read only the exact
   // native identities this home's starter receipts name, before any write.
@@ -1628,7 +1654,6 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       if (row?.activity) delegatedReadings.push({ address, state: row.activity.presence, turn: row.activity.turn });
     } catch { /* an unread child is never called working */ }
   }
-  const running = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
   // every running card a session is on: a session waiting on its user is told once, naming them all
   const cardsOf = new Map();
   for (const { id } of running) {
@@ -1722,7 +1747,7 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
         const key = [address, live.waiting_for ?? '', live.turn_since_ms ?? ''].join('|');
         if (session.held_notice?.key === key) return;
         // every run a card works under: an ended run can still be its card's current one
-        const told = db.prepare('SELECT r.metadata FROM task_runs r WHERE r.id != ? AND (r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id))').all(runRow.id).some((r) => json(r.metadata, {})?.supercode?.held_notice?.key === key);
+        const told = db.prepare(`SELECT r.metadata FROM task_runs r WHERE r.id != ? AND r.id IN (${ACTIVE_RUN_IDS})`).all(runRow.id).some((r) => json(r.metadata, {})?.supercode?.held_notice?.key === key);
         setRunSession(db, runRow.id, { held_notice: { key, at: observedAt } });
         if (told) return;
         const observation = retain('waiting_on_user', { waiting_for: live.waiting_for ?? null, since_ms: live.turn_since_ms ?? null });
@@ -1752,7 +1777,7 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
         if (reading.quiet_seconds < settings.idleQuiet) { retain('turn_unknown'); return; }
         if (session.unknown_notice) return;
         const key = [address, live?.turn_since_ms ?? 'unknown'].join('|');
-        const told = db.prepare('SELECT r.metadata FROM task_runs r WHERE r.id != ? AND (r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id))').all(runRow.id)
+        const told = db.prepare(`SELECT r.metadata FROM task_runs r WHERE r.id != ? AND r.id IN (${ACTIVE_RUN_IDS})`).all(runRow.id)
           .some(r => json(r.metadata, {})?.supercode?.unknown_notice?.key === key);
         setRunSession(db, runRow.id, { unknown_notice: { key, at: observedAt, since } });
         const observation = retain('turn_unknown_reported', { waiting_for: live?.waiting_for ?? null, turn_source: live?.turn_source ?? null, since_ms: live?.turn_since_ms ?? null });
@@ -2115,9 +2140,12 @@ async function readRunUsage(root,org,row,endedAt){
 async function synchronizeAgents(board, report) {
   // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
   // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
-  const agentRuns=[...new Map(view(board,db=>db.prepare("SELECT id,task_id,metadata,ended_at FROM task_runs WHERE json_extract(metadata,'$.supercode.agent_id') IS NOT NULL ORDER BY id").all())
+  const agentRuns=[...new Map((await readRunPages(board.db, 'id,task_id,metadata,ended_at', { where: "json_extract(metadata,'$.supercode.agent_id') IS NOT NULL" }))
     .map(row=>{const session=json(row.metadata,{})?.supercode;return [session?.session_id?addressOf(session):`run:${row.id}`,row];})).values()];
-  for(const row of agentRuns){
+  for(const scanned of agentRuns){
+    await yieldToOwner();
+    const row=view(board,db=>db.prepare('SELECT id,task_id,metadata,ended_at FROM task_runs WHERE id=?').get(scanned.id));
+    if(!row)continue;
     const session=json(row.metadata,{})?.supercode;
     if(!session?.session_id||!session.agent_org||view(board,db=>detachedSession(db,session)))continue;
     const ref=`${session.harness}:${session.session_id}`;
@@ -2276,6 +2304,10 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   const pending = view(board, (db) => db.prepare('SELECT id, ended_at, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId))
     .map((r) => ({ ...r, session: json(r.metadata, {})?.supercode }))
     .find((r) => (r.session?.pane || r.session?.launch_key || r.session?.surface === 'native') && !r.session.close_transferred_to && (r.session.slot ?? 'worker') === slot && (r.ended_at || r.session.close_requested) && !r.session.close_confirmed_at
+      // Deliberate retention owes no close. Only this slot's latest identity may reach the liveness/continuation
+      // checks below; an explicit close or another unresolved identity still holds the slot.
+      && !(r.session.retain_after_run && !r.session.close_requested && !r.session.forgotten && last?.session_id
+        && r.session.session_id === last.session_id && r.session.pane === last.pane && r.session.machine === machine && (r.session.harness ?? 'claude-code') === harness)
       && !(closeRefused(r.session) && last?.session_id && r.session.session_id === last.session_id));
   if (pending) throw unavailable(`slot ${slot} still owns pane ${pending.session.pane} from run ${pending.id}; closure must be confirmed before another session starts: ${pending.session.close_error ?? 'close pending'}`);
   let prev = view(board, (db) => lastSession(db, task.id, slot));
@@ -2423,13 +2455,14 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     if (next === 'refuse') throw new Error(`session ${prev.session_id} still has live pane ${prev.pane}; cannot resume or replace it`);
     if (next === 'keep') {
       // the session is kept; the heartbeat's count belongs to the run that ended, so the new run starts it again
-      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_since: _is, idle_notice: _in, unknown_since: _us, unknown_notice: _un, work_progress: _wp, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, close_failed_at: _cf, close_unread: _cu, close_claim: _cl, monitor_held: _mh, released: _rl, review_held: _rh, ...kept } = prev;
+      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_since: _is, idle_notice: _in, unknown_since: _us, unknown_notice: _un, work_progress: _wp, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, close_failed_at: _cf, close_unread: _cu, close_claim: _cl, monitor_held: _mh, released: _rl, review_held: _rh, retain_after_run: _rr, ...kept } = prev;
       session = { ...kept, mode: 'adopt', launched_at: now(), seen_at: now() };
       // a kept session is told what this run is for (its card came back to it, with what happened since), only while
       // this run is still the card's current one (its pane and native reads were awaited)
       tx(board, (db) => {
         if (!runCurrent(db, task.id, runId)) throw Object.assign(new Error(`run ${runId} of ${task.id} ended or was replaced while its session was read; nothing was told to it`), { launchSuperseded: true });
         setRunSession(db, runId, { ...session, ...meta });
+        transferRetainedSession(db, task.id, runId, session);
         // an earlier run's close of this pane is this run's now: the pane is the kept session's, not a close to retry
         if (prev.pane) for (const r of db.prepare('SELECT id, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId)) {
           const s = json(r.metadata, {})?.supercode;
@@ -2444,7 +2477,7 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     } else if (prev.resumable !== false) {
       const authorization = view(board, db => currentRun(db,task.id)?.metadata?.supercode?.restart_authorized);
       const released = view(board,db=>{
-        const last = db.prepare("SELECT id,kind FROM task_events WHERE task_id=? AND kind IN ('dispatch_held','dispatch_released','restart_authorization_consumed') ORDER BY id DESC LIMIT 1").get(task.id);
+        const last = latestEvent(db, task.id, ['dispatch_held', 'dispatch_released', 'restart_authorization_consumed'], 'id,kind');
         return last?.kind === 'dispatch_released';
       });
       // Only a session whose run ended in a monitored incident waits for its manager or creator; one a workflow
@@ -2498,6 +2531,7 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     const saved = json(row?.metadata, {})?.supercode;
     if (saved?.address === session.address && !saved.launch_pending) return true;
     setRunSession(db, runId, session);
+    transferRetainedSession(db, task.id, runId, session);
     event(db, task.id, kind, { session_id: session.session_id, machine, pane: session.pane, address: session.address, mode: session.mode, ...(replaced ? { replaced } : {}) }, runId);
     // the working session hears updates to its card; the slot's previous session no longer does (a reviewer starting
     // leaves the implementer's, and a subtask's arc session's, subscription alone)
@@ -2512,6 +2546,19 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   return session;
 }
 
+/** A continued role identity now belongs to its new attempt. Preserve the completed receipt, and keep an old
+ * retained reference from closing the same native process/pane later. Transfer only after a successful bind. */
+function transferRetainedSession(db, id, runId, session) {
+  if (!session?.session_id) return;
+  for (const row of db.prepare('SELECT id,metadata FROM task_runs WHERE task_id=? AND id<? AND ended_at IS NOT NULL').all(id, runId)) {
+    const old = json(row.metadata, {})?.supercode;
+    if (!old?.retain_after_run || old.close_requested || old.close_confirmed_at || old.close_transferred_to || old.forgotten
+      || old.session_id !== session.session_id || old.machine !== session.machine || (old.slot ?? 'worker') !== (session.slot ?? 'worker')) continue;
+    setRunSession(db, row.id, { close_transferred_to: runId });
+    event(db, id, 'session_transferred', { successor: runId, session_id: old.session_id, pane: old.pane ?? null }, row.id);
+  }
+}
+
 /** The agent a slot's last session belongs to, when it is not the agent this run's `meta` names: the agent store's
  *  owner of the session where it records one in this run's org, else the agent its own run ran as. Null when it is
  *  this run's agent, or no agent is known for it (a session from before card agents). */
@@ -2808,8 +2855,10 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
   // agent store another, and every round after would trip on it.
   const owner = agent ? agentRunForSession(board.root, [`${harness}:${sessionId}`]) : null;
   if (owner && owner.agent_id !== agent.identity.id) throw new Error(`${found.address} already works for agent ${owner.agent_id} (run ${owner.run_id}); it cannot be adopted as ${agent.identity.id}`);
-  // the card's previous session is read before the bind decides whether it is still live
-  await readBefore(fleet, view(board, (db) => lastSession(db, id)));
+  // Each role owns its own slot. A retained worker does not prevent binding the independent reviewer; only this
+  // adoption's slot can conflict with the incoming identity. Independence still reads worker history below.
+  const adoptionSlot = beforeSession?.slot ?? runSpec(entry0, view(board, db => statusOf(db, card0)), card0)?.session ?? 'worker';
+  await readBefore(fleet, view(board, (db) => lastSession(db, id, adoptionSlot)));
   const adopted = tx(board, (db) => {
     const task = getTask(db, id);
     if (!task) throw new Error(`no card ${id}`);
@@ -2818,7 +2867,7 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
     if (changed) throw changed;
     if (beforeRun && assignee && assignee !== task.assignee) throw new Error('rebinding a session does not reassign its active run');
     if (task.machine && normalMachine(task.machine) !== host) throw new Error(`${id} runs on ${task.machine}, and ${found.address} is on ${host}; move the card first`);
-    const was = lastSession(db, id);
+    const was = lastSession(db, id, adoptionSlot);
     // a session whose close the board confirmed is not live, whatever a fleet reading still lists (a released one was
     // left running, and is read)
     if (was && was.session_id !== sessionId && !(was.close_confirmed_at && !was.released) && sessionAlive(fleet, was)) throw new Error(`${id} already has a live session, ${was.address}`);
@@ -2956,8 +3005,11 @@ async function fileMail(board, to, body, key, { ask = false, wake = true, subjec
 }
 
 /** Fleet listener mail uses the owner's ordinary filing door, including board-copy refusal and sender custody. */
-export function fileFleetNotice(root, to, body, key) {
-  return fileMail({ root, label: boardLabel(root, 'default') }, to, body, key);
+export async function fileFleetNotice(root, to, body, key) {
+  const board = openBoard(root, 'default');
+  board.label = boardLabel(root, 'default');
+  try { return await fileMail(board, to, body, key); }
+  finally { board.close(); }
 }
 
 /**
@@ -3102,9 +3154,13 @@ function noticeWait(board, sub, report, reason = null) {
  * the latest run that names it. A Claude or Codex session resumed by id keeps its address, so a run that resumes it
  * holds it again.
  */
-function sessionRecord(db) {
+function sessionRecord(db, address) {
   const held = new Set(), latest = new Map();
-  for (const r of db.prepare('SELECT r.id, r.task_id, r.ended_at, r.metadata, t.id AS current FROM task_runs r LEFT JOIN tasks t ON t.current_run_id = r.id ORDER BY r.id').all()) {
+  const named = sessionAt(address);
+  if (!named) return { held, latest };
+  // Both arms seek one native identity; the join's current_run_id has its own index. Never read unrelated sessions.
+  for (const r of db.prepare(`SELECT r.id,r.task_id,r.ended_at,r.metadata,t.id AS current FROM task_runs r
+    LEFT JOIN tasks t ON t.current_run_id=r.id WHERE r.id IN (${NOTICE_RUN_IDS}) ORDER BY r.id`).all(named.session_id, address)) {
     const session = json(r.metadata, {})?.supercode, address = addressOf(session);
     if (!address) continue;
     if (!r.ended_at || r.current) held.add(address);
@@ -3152,10 +3208,10 @@ async function endWorkerSubscriptions(board, fleet, report) {
     if (aliveNow.get(address) === false && subscriberGone(fleet, address)) goneNow.set(address, now());
   }
   tx(board, (db) => {
-    const { held, latest } = sessionRecord(db);
     const remove = db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?");
     const ended = new Map();
     for (const row of db.prepare("SELECT task_id, chat_id, thread_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) {
+      const { held, latest } = sessionRecord(db, row.chat_id);
       const address = row.chat_id, record = latest.get(address);
       // a session alive, or whose liveness could not be read (unknown, never taken as ended), keeps its subscription
       if (!record || record.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) !== false)) continue;
@@ -3185,7 +3241,6 @@ async function endWorkerSubscriptions(board, fleet, report) {
  */
 async function notify(board, fleet, report, entry) {
   await endWorkerSubscriptions(board, fleet, report);
-  const record = view(board, (db) => sessionRecord(db));
   for (const sub of subscriptions(board.db).filter((s) => s.platform === 'supercode')) {
     await yieldToOwner();
     if (stopping) break;
@@ -3198,6 +3253,7 @@ async function notify(board, fleet, report, entry) {
     const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id LIMIT 64`)
       .all(sub.task_id, sub.last_event_id, ...kinds);
     if (!events.length) { noticeWait(board, sub, report); continue; }
+    const record = view(board, db => sessionRecord(db, sub.chat_id));
     // Events name the acting native session; subscriptions may name its agent.
     // Use the daemon's retained binding, including former mains, for both
     // coalescing and delivery. An unread binding proves no additional alias.
@@ -3511,14 +3567,37 @@ export async function plan({ root, lanes, settings, slugs = null, params = {} })
   return out;
 }
 
+/** An explicit completion of the latest attempt, after any previous review or reopening. A reclaimed or failed
+ * attempt is not a completed disposition, and a new attempt or returned verdict invalidates the old receipt. */
+function completedWork(db, id) {
+  const last = db.prepare(`SELECT id,kind,run_id FROM task_events WHERE task_id=?
+    AND kind IN ('work_completed','review_requested','changes_requested','review_pass','review_voided','reopened')
+    ORDER BY id DESC LIMIT 1`).get(id);
+  if (last?.kind !== 'work_completed') return null;
+  const attempt = db.prepare('SELECT id,outcome,ended_at FROM task_runs WHERE task_id=? ORDER BY id DESC LIMIT 1').get(id);
+  return attempt?.id === last.run_id && attempt.outcome === 'completed' && attempt.ended_at != null ? last : null;
+}
+
+/** Finish ends the attempt, not its caller's native turn. Keep observing that retained attempt until the board
+ * requests review; the receipt's lifecycle/latest-attempt fence prevents an older session holding later work. */
+function reviewTurnRun(db, id) {
+  const active = currentRun(db, id);
+  if (active) return active;
+  const completed = completedWork(db, id);
+  if (!completed || detachedCard(db, id)) return null;
+  const row = db.prepare('SELECT * FROM task_runs WHERE id=?').get(completed.run_id);
+  const metadata = json(row?.metadata, {}) ?? {}, session = metadata.supercode;
+  return row && session?.retain_after_run && !session.close_transferred_to && !detachedSession(db, session) ? { ...row, metadata } : null;
+}
+
 /** Whether an arc with no open PR may be one that changed no code and is due its review: it has done work, by filing
- *  tasks or by a run that ended with an Acceptance outcome ticked (a fresh arc with neither has not started), and no
+ *  tasks, an explicit completed-work receipt, or a completed run with an Acceptance outcome ticked, and no
  *  review of it is pending or passed (after changes are requested, closing the tasks that own the findings makes it
  *  due again). */
 function noCodeReviewDue(board, id) {
   return view(board, (db) => {
     const filed = db.prepare('SELECT 1 FROM supercode_cards WHERE subtask_of = ? LIMIT 1').get(id);
-    if (!filed && !(db.prepare('SELECT 1 FROM task_runs WHERE task_id = ? AND ended_at IS NOT NULL LIMIT 1').get(id) &&
+    if (!filed && !completedWork(db, id) && !(db.prepare("SELECT 1 FROM task_runs WHERE task_id = ? AND outcome = 'completed' AND ended_at IS NOT NULL LIMIT 1").get(id) &&
       outcomeTicked(db.prepare('SELECT body FROM tasks WHERE id = ?').get(id)?.body))) return false;
     const last = db.prepare("SELECT kind FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass','review_voided') ORDER BY id DESC LIMIT 1").get(id);
     return !last || ['changes_requested','review_voided'].includes(last.kind);
@@ -3534,8 +3613,8 @@ function passedReview(board, id) {
 function outcomeTicked(body) {
   let acceptance = false;
   return String(body ?? '').split('\n').some((line) => {
-    const heading = /^#{1,6}\s+(.+?)\s*$/.exec(line);
-    if (heading) acceptance = heading[1].toLowerCase() === 'acceptance';
+    const heading = cardSectionHeading(line);
+    if (heading !== null) acceptance = heading === 'acceptance';
     return acceptance && /^\s*[-*] \[[xX]\] \S/.test(line);
   });
 }
@@ -3556,7 +3635,7 @@ function outcomeTicked(body) {
  *  running a proof, still holds the review. */
 async function turnInFlight(board, id, fleet, heldSince = null) {
   if (!fleet?.ok) return null;
-  const session = currentRun(board.db, id)?.metadata?.supercode;
+  const session = reviewTurnRun(board.db, id)?.metadata?.supercode;
   if (!session?.session_id || session.surface === 'headless' || session.close_requested) return null;
   let live = fleet.sessions?.find((x) => x.address === addressOf(session)) ?? null;
   if (live?.turn == null && session.surface === 'native') try {
@@ -3628,14 +3707,17 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
       }
       // A native turn holds the advisory proposal before authoritative source reads. Retain the proposal on the run
       // (`review_held`) so a goal turn can be told to have started after that work was first observed.
-      const heldRun = currentRun(board.db, id), dueKey = reviewDueKey(board, id, payload);
+      const heldRun = reviewTurnRun(board.db, id), dueKey = reviewDueKey(board, id, payload);
       const held = heldRun?.metadata?.supercode?.review_held?.key === dueKey ? heldRun.metadata.supercode.review_held : null;
       const inTurn = await turnInFlight(board, id, fleet, held ? Number(held.since) : null);
       if (inTurn) {
-        if (!held && !dry && heldRun) tx(board, (db) => { if (currentRun(db, id)?.id === heldRun.id) setRunSession(db, heldRun.id, { review_held: { key: dueKey, since: now() } }); });
+        if (!held && !dry && heldRun) tx(board, (db) => { if (reviewTurnRun(db, id)?.id === heldRun.id) setRunSession(db, heldRun.id, { review_held: { key: dueKey, since: now() } }); });
         report.queued.push([id, `review waits: ${inTurn.why}`]);
         continue;
       }
+      // A stable local refusal (wrong HEAD or uncommitted work) must not spend a full fresh REST scan every
+      // round. Advisory discovery is sufficient to refuse, never to authorize; the scan below still owns that.
+      if (!payload.no_code) await openReviewPullRequests(board, id, { checkWorkspaces: true });
       if (!dry) await refreshCardInputs(board, id, { commits: true });
       // Cached draft/closed exclusions are useful while waiting, but cannot define a committed review's set.
       const observed = await withFreshReviewReads(async () => {
@@ -3884,7 +3966,7 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       if (dispatch && !only && !report.paused) await observeIdle(board, fleet, settings, report, entry, effects);
       // what the moves asked for is recorded with them; the delivery pass (`deliver`) carries it out, outside the round
       queueEffects(board, effects);
-      phase('goals');
+      phase('idle');
       ensureSubscriptions(board, entry);
       fireHooks(board, settings, report);
       if (String(board.db.prepare('PRAGMA journal_mode').get()?.journal_mode).toLowerCase() === 'wal') board.db.prepare('PRAGMA wal_checkpoint(PASSIVE)').get();

package/board/engine.mjs

@@ -292,7 +292,7 @@ export function createCard(board, spec) {
     const handle = cardHandle(boardKey(board.root, board.slug), numberOf(db, id));
     if (namedBranch) run(db, 'UPDATE tasks SET branch_name = ? WHERE id = ?', handle ? namedBranch(handle) : `wt/${id}`, id);
     const machine = spec.machine ?? arc?.machine ?? null;
-    run(db, 'INSERT OR REPLACE INTO supercode_cards (task_id,machine,subtask_of,workspace_anchor,workspace_root,tags,requested_by_unverified) VALUES (?,?,?,?,?,?,?)', id, machine, arc?.id ?? null, declared.repository, checked?.mainRoot ?? null,
+    run(db, 'INSERT OR REPLACE INTO supercode_cards (task_id,machine,subtask_of,workspace_anchor,workspace_root,tags,requested_by_unverified) VALUES (?,?,?,?,?,?,?)', id, machine, arc?.id ?? null, declared.repository, checked?.workspaceRoot ?? null,
       tags.length ? JSON.stringify(tags) : null, spec.requestedByUnverified ? JSON.stringify(spec.requestedByUnverified) : null);
     for (const p of parents) addDependency(db, entry, id, p);
     // where it starts is the workflow's `initial` (Hermes: triage, blocked, todo behind open parents, else ready)
@@ -468,8 +468,9 @@ export async function act(board, id, name, { roles = null, payload = {}, extra =
     // Authorization and the comment row share one transaction: a refusal stores nothing.
     if (name === 'comment') r.commentId = Number(run(db, 'INSERT INTO task_comments (task_id, author, body, created_at) VALUES (?, ?, ?, ?)', id, payload.author.trim(), payload.body.trim(), now()).lastInsertRowid);
     // the cards that wait on it, and its subtasks, see it change
-    const related = all(db, 'SELECT task_id, blocked_by FROM supercode_cards').filter((c) => json(c.blocked_by, []).some((b) => b.id === id)).map((c) => c.task_id);
-    const around = [...related, ...childrenOf(db, id), ...all(db, 'SELECT task_id AS id FROM supercode_cards WHERE subtask_of = ?', id).map((x) => x.id)];
+    // Card blockers are mirrored to task_links by relation writes and document imports. Its parent key is the reverse
+    // lookup; reading every card's blocked_by JSON on each public verb only rediscovers the same children.
+    const around = [...childrenOf(db, id), ...all(db, 'SELECT task_id AS id FROM supercode_cards WHERE subtask_of = ?', id).map((x) => x.id)];
     for (const other of new Set(around)) settle(db, board, entry, other, r.effects);
     return r;
   });
@@ -532,7 +533,7 @@ export async function goto(board, id, status, { roles = null, payload = {} } = {
 // it keeps trying at the capped wait, and at EFFECT_ATTEMPTS failed attempts its card records `effect_stalled` and the
 // managers are mailed once, so a passed card whose merge keeps failing is seen, and still heals when the cause clears.
 export const EFFECT_ATTEMPTS = 6;
-const OWNED = new Set(['merge_reviewed', 'cleanup_workspace']);
+const OWNED = new Set(['merge_reviewed', 'cleanup_workspace', 'rename_card_agents']);
 const effectWait = (attempts) => Math.min(1800, 30 * 2 ** Math.max(0, attempts - 1));
 // A delivery pass claims a row by compare-and-set on its next_at (set ahead only while the row is due) before trying it,
 // so two passes (serve's, the hosted loop's, a person's `workflow deliver`, a verb's own) never try one effect at once.
@@ -620,6 +621,7 @@ async function runEffect(board, e) {
   if (e.kind === 'session_notice') { const { sessionNotice } = await import('./dispatch.mjs'); return await sessionNotice(board, e) !== false; }
   if (e.kind === 'cleanup_workspace') { await cleanupWorkspace(board, e.id); return true; }
   if (e.kind === 'declare_card_agent') { const { declareCardAgentEffect } = await import('./agent-declarations.mjs'); return (await declareCardAgentEffect(board, e)) !== false; }
+  if (e.kind === 'rename_card_agents') { const { renameCardAgentsEffect } = await import('./agent-declarations.mjs'); return await renameCardAgentsEffect(board, e); }
   // a verb's own ask files its card's mail at once (a local write; the mailbox delivers it)
   if (e.kind === 'board_message') { const { fileBoardMail } = await import('./dispatch.mjs'); await fileBoardMail(board, { undelivered: [] }, e.id); return true; }
   if (e.kind === 'merge_reviewed') { const { mergeReviewed } = await import('./dispatch.mjs'); return await mergeReviewed(board, e) !== false; }
@@ -738,17 +740,26 @@ export const editResult = (board, id, { result, summary = null, metadata = undef
 export const heartbeat = (board, id, note = null, { roles, until = null } = {}) => act(board, id, 'heartbeat', { roles, payload: { note, until } });
 export const setGoal = (board, id, { on = true, maxTurns = null, roles } = {}) => act(board, id, 'set_goal', { roles, payload: { goal: Boolean(on), max_turns: on ? maxTurns : null } });
 
-/** A triage card fans out into children it waits on (Hermes's decomposer); answers their ids. */
+/** File the named card's tasks only if its workflow accepts decompose; refusal leaves no cards behind. */
 export async function decompose(board, id, children, { author = 'user', roles } = {}) {
   if (!children.length) throw new Error('decompose names at least one child (--child "<title>[@<assignee>]")');
-  const task = view(board, (db) => must(db, id));
-  const ids = [];
-  for (const c of children) ids.push(createCard(board, await prepareCard(board, {
-    title: c.title, body: c.body ?? null, assignee: c.assignee ?? task.assignee, machine: task.machine,
-    workspace: task.workspace_anchor ? `${task.workspace_kind}:${task.workspace_anchor}` : task.workspace_path ? `${task.workspace_kind}:${task.workspace_path}` : task.workspace_kind, tenant: task.tenant, createdBy: author,
-  })).id);
-  await act(board, id, 'decompose', { roles, payload: { children: ids, author } });
-  return ids;
+  const entry = await loadWorkflow(board.root);
+  await refreshCardInputs(board, id);
+  const result = tx(board, db => {
+    const task = must(db, id), sender = roles ?? callerRoles(db, id);
+    if (task.subtask_of) throw new Error(`${id} is itself a subtask of ${task.subtask_of}; decompose its arc instead`);
+    // Creation and authorization share this transaction. Guards see the actual child ids, and any refusal
+    // (including a later child's invalid spec) rolls back every child, event, subscription and queued effect.
+    const ids = children.map(c => createCard(board, {
+      title: c.title, body: c.body ?? null, assignee: c.assignee ?? task.assignee, machine: task.machine,
+      subtaskOf: id, workspace: 'scratch', tenant: task.tenant, createdBy: author,
+    }).id);
+    const move = fire(db, board, entry, id, 'decompose', { roles: sender, payload: { children: ids, author } });
+    for (const child of ids) settle(db, board, entry, child, move.effects);
+    return { ids, effects: move.effects };
+  });
+  await runEffects(board, result.effects);
+  return result.ids;
 }
 
 /** `child` waits for `parent`. */

package/board/fleet-listeners.mjs

@@ -15,9 +15,9 @@ const refused = message => Object.assign(new Error(message), { code: 'fleet_list
 /** A retained mail outbox. `file` is the board's existing admitted mailbox filing door, never a transport or
  *  provider selected from the observed payload. No runtime database is opened until the home opts into listeners. */
 export class FleetListenerRouter {
-  constructor({ root, file, enrich = event => event, retry = () => {}, log = () => {} }) {
+  constructor({ root, file, enrich = event => event, work = fn => fn(), retry = () => {}, log = () => {} }) {
     if (typeof file !== 'function') throw refused('fleet listener router needs the admitted mailbox filing door');
-    this.root = root; this.file = file; this.enrich = enrich; this.retry = retry; this.log = log; this.definitions = {}; this.closed = false; this.suspended = false;
+    this.root = root; this.file = file; this.enrich = enrich; this.work = work; this.retry = retry; this.log = log; this.definitions = {}; this.closed = false; this.suspended = false;
   }
 
   /** The workflow's decoded declarations. An invalid replacement refuses without discarding the prior outbox. */
@@ -37,7 +37,15 @@ export class FleetListenerRouter {
     this.suspended = false;
     if (Object.keys(next).length) {
       this.store();
-      if (!this.timer) { this.timer = setInterval(() => { if (!this.suspended) { try { this.retry(); } catch (error) { this.log(`fleet listener source: ${String(error.message).slice(0, 300)}`); } } this.wake(); }, 1000); this.timer.unref?.(); }
+      if (!this.timer) {
+        this.timer = setInterval(() => {
+          void Promise.resolve().then(() => {
+            if (!this.closed && !this.suspended) return this.retry();
+          }).catch(error => this.log(`fleet listener source: ${String(error.message).slice(0, 300)}`))
+            .finally(() => this.wake());
+        }, 1000);
+        this.timer.unref?.();
+      }
       this.wake();
     } else if (this.db) {
       this.db.prepare('INSERT INTO fleet_listener_runtime(id,needs_baseline) VALUES(1,1) ON CONFLICT(id) DO UPDATE SET needs_baseline=1').run();
@@ -212,7 +220,10 @@ export class FleetListenerRouter {
   flush() {
     if (this.flushing) return this.flushing;
     if (!this.db || this.closed || this.suspended) return Promise.resolve();
-    this.flushing = Promise.resolve().then(async () => {
+    // Prepare owner work before replaying retained waits too. Enrichment and enqueue remain synchronous, so the
+    // source cursor cannot advance until its complete event body is committed to the outbox.
+    this.flushing = Promise.resolve().then(() => this.work(async () => {
+      if (this.closed || this.suspended) return;
       // Even a prompt that has since cleared keeps an earlier refused observation. Do not block already queued mail
       // on a full outbox: file it below to make room, then the retained prompt retries at the next wake.
       for (const wait of this.db.prepare('SELECT address,event FROM fleet_listener_waits WHERE routed=0 LIMIT 16').all()) {
@@ -238,7 +249,7 @@ export class FleetListenerRouter {
           this.db.prepare('UPDATE fleet_listener_mail SET attempts=?,next_at=?,error=? WHERE id=?').run(attempts, Date.now() + delay, String(error.message).slice(0, 500), row.id);
         }
       }
-    }).finally(() => { this.flushing = null; });
+    })).finally(() => { this.flushing = null; });
     return this.flushing;
   }