@volter/supercode-orchestrator 0.5.210 → 0.5.212

package/board/published.mjs

@@ -38,7 +38,7 @@ CREATE INDEX IF NOT EXISTS supercode_publication_heads_sequence ON supercode_pub
 // Columns the publication tables gained after their first layout; store.mjs layOut adds each one a store lacks. A head's
 // fingerprint is the cheap reading of its card's rows the head was last compared at (fingerprintOf); the log's prune_from
 // is where a prune under way resumes, null when none is (prunePublications).
-export const PUBLICATION_COLUMNS = { supercode_publication_heads: { fingerprint: 'TEXT' }, supercode_publication_log: { prune_from: 'INTEGER' } };
+export const PUBLICATION_COLUMNS = { supercode_publications: { snapshot_bytes: 'INTEGER' }, supercode_publication_heads: { fingerprint: 'TEXT' }, supercode_publication_log: { prune_from: 'INTEGER' } };
 
 // The snapshot's shape: 1 names the card as a person does (`ref`, VO-856).
 const SNAPSHOT_SHAPE = 4;
@@ -56,7 +56,7 @@ const MARKED = [['tasks', ['id']], ['supercode_cards', ['task_id']], ['task_comm
 export function publicationTriggers(db) {
   const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => row.name));
   const first = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'trigger' AND name = 'supercode_publish_tasks_insert'").get();
-  const snapshotEvents = `(${[...REVIEW_KIND_LIST,...AGENT_KIND_LIST].map((kind) => `'${kind}'`).join(',')})`;
+  const snapshotEvents = `(${[...REVIEW_KIND_LIST,...AGENT_KIND_LIST,'archived'].map((kind) => `'${kind}'`).join(',')})`;
   const agentMigration = tables.has('task_events') && !db.prepare("SELECT sql FROM sqlite_master WHERE type='trigger' AND name='supercode_publish_task_events_insert'").get()?.sql.includes("'agent_assignment_adopted'");
   const scopeMigration = !db.prepare("SELECT 1 FROM sqlite_master WHERE type='trigger' AND name='supercode_publish_supercode_card_agent_scopes_insert'").get();
   // A snapshot names its card's number: a store that numbers its cards republishes every card once, when that is watched.
@@ -64,11 +64,12 @@ export function publicationTriggers(db) {
   // A snapshot of a newer shape (SNAPSHOT_SHAPE) than the heads were published in: every card is published once again.
   const shapeMigration = Number(db.prepare('SELECT max(version) AS version FROM supercode_publication_shape').get()?.version ?? 0) < SNAPSHOT_SHAPE;
   const contentMigration = !db.prepare("SELECT sql FROM sqlite_master WHERE type='trigger' AND name='supercode_publish_task_comments_update'").get()?.sql.includes('fingerprint=NULL');
+  const archiveMigration = !db.prepare("SELECT sql FROM sqlite_master WHERE type='trigger' AND name='supercode_publish_task_events_insert'").get()?.sql.includes("'archived'");
   db.exec('SAVEPOINT supercode_publication_marking');
   try {
     // Existing event triggers only watched reviews. Replace that filter once, preserving the savepoint rollback.
     if(contentMigration)for(const table of ['task_comments','task_events'])for(const verb of ['insert','update','delete'])db.exec(`DROP TRIGGER IF EXISTS supercode_publish_${table}_${verb}`);
-    if(agentMigration)for(const verb of ['insert','update','delete'])db.exec(`DROP TRIGGER IF EXISTS supercode_publish_task_events_${verb}`);
+    if(agentMigration||archiveMigration)for(const verb of ['insert','update','delete'])db.exec(`DROP TRIGGER IF EXISTS supercode_publish_task_events_${verb}`);
     for (const [table, columns] of MARKED) {
       if (!tables.has(table)) continue;
       // Reviews and agent assignment events change a snapshot: an update marks when the
@@ -80,7 +81,7 @@ export function publicationTriggers(db) {
         CREATE TRIGGER IF NOT EXISTS supercode_publish_${table}_update AFTER UPDATE ON ${table}${when(['OLD', 'NEW'])} BEGIN ${mark('NEW')} ${mark('OLD')} END;
         CREATE TRIGGER IF NOT EXISTS supercode_publish_${table}_delete AFTER DELETE ON ${table}${when(['OLD'])} BEGIN ${mark('OLD')} END;`);
     }
-    if ((first || contentMigration || agentMigration || scopeMigration || numberMigration || shapeMigration) && tables.has('tasks')) db.exec(`INSERT INTO supercode_publication_dirty (task_id)
+    if ((first || contentMigration || archiveMigration || agentMigration || scopeMigration || numberMigration || shapeMigration) && tables.has('tasks')) db.exec(`INSERT INTO supercode_publication_dirty (task_id)
       SELECT id FROM tasks UNION SELECT resource_id FROM supercode_publication_heads WHERE digest != 'removed'
       EXCEPT SELECT task_id FROM supercode_publication_dirty`);
     if (shapeMigration) { db.exec('DELETE FROM supercode_publication_shape'); db.prepare('INSERT INTO supercode_publication_shape (version) VALUES (?)').run(SNAPSHOT_SHAPE); }
@@ -100,8 +101,8 @@ export function markRemovedHeads(db) {
 const RETAINED_CHANGES = 1024;
 // The changes one prune transaction deletes: a change's snapshot averaged about 190 KB and reached 3.7 MB, and deleting
 // every pruned change in one statement held the owner's event loop for 291 s (2026-10-21).
-const PRUNE_BATCH = 200;
-const PRUNE_BYTES = 8 * 1024 * 1024;
+const PRUNE_BATCH = 16;
+const PRUNE_BYTES = 1024 * 1024;
 const hash = value => createHash('sha256').update(value).digest('hex');
 const parse = (value,fallback=null) => {try{return JSON.parse(value)??fallback;}catch{return fallback;}};
 const at = value => value == null ? null : new Date(Number(value)*1000).toISOString();
@@ -206,13 +207,10 @@ const perCard=db=>{
 };
 // The columns of a task row that change while its card runs and that no snapshot reads (cardSnapshot).
 const UNREAD_TASK_COLUMNS = new Set(['claim_lock','claim_expires','worker_pid','last_heartbeat_at']);
-// The events a snapshot reads: its reviews, its agents and its archive reason.
-const SNAPSHOT_EVENT_KINDS = `(${[...REVIEW_KIND_LIST,...AGENT_KIND_LIST,'archived'].map((kind) => `'${kind}'`).join(',')})`;
 const fingerprintReads=db=>({
-  // comments and events are only ever added or removed by supercode's writers; their bytes catch a document edit that
-  // rewrites one in place; SQLite answers octet_length from a row's header, without reading its text
-  comments:db.prepare('SELECT count(*) AS n,max(id) AS last,total(octet_length(body)) AS bytes FROM task_comments WHERE task_id=?'),
-  events:db.prepare(`SELECT count(*) AS n,max(id) AS last,total(octet_length(payload)) AS bytes FROM task_events WHERE task_id=? AND kind IN ${SNAPSHOT_EVENT_KINDS}`),
+  // Comment/event inserts, updates and deletes invalidate the head's fingerprint in their native transaction.
+  // Even a same-length in-place edit forces a snapshot comparison; rereading every history row's header here adds
+  // no information and held the owner's loop for 1.9 s on one card's comment history.
   facts:db.prepare('SELECT facts_json,receipt_sequence,declared_event_id FROM supercode_card_agent_facts WHERE task_id=?'),
   scope:db.prepare('SELECT from_org,org,changed_at FROM supercode_card_agent_scopes WHERE task_id=?'),
   // a run's metadata changes in place (its session's observations), so every run's snapshot columns are read whole
@@ -227,7 +225,7 @@ const fingerprintReads=db=>({
 function fingerprintOf(reads,rows,row,key,options){
   const task={};for(const [column,value] of Object.entries(row))if(!UNREAD_TASK_COLUMNS.has(column))task[column]=value;
   return hash(JSON.stringify([SNAPSHOT_SHAPE,SNAPSHOT_RELEASE,key,Boolean(options.nativeHolds),task,rows.own(row.id)??null,rows.number(row.id),rows.parents(row.id),rows.children(row.id),
-    reads.comments.get(row.id),reads.events.get(row.id),reads.facts.get(row.id)??null,reads.scope.get(row.id)??null,reads.runs.all(row.id)]));
+    reads.facts.get(row.id)??null,reads.scope.get(row.id)??null,reads.runs.all(row.id)]));
 }
 /** A card's snapshot; `key` is its board's key (store.mjs boardKey), with which `ref` names the card as a person does
  *  (`VO-856`, store.mjs cardRef), null for a card with no number. */
@@ -270,7 +268,7 @@ export function recordCardPublications(db,actor,root,key) {
   db.prepare('INSERT INTO supercode_publication_log(id,pruned_through) SELECT ?,0 WHERE NOT EXISTS (SELECT 1 FROM supercode_publication_log)').run(`log_${randomUUID()}`);
   const rows=perCard(db),reads=fingerprintReads(db),task=db.prepare('SELECT * FROM tasks WHERE id=?'),head=db.prepare('SELECT resource_id,digest,last_event_id,fingerprint FROM supercode_publication_heads WHERE resource_id=?');
   const lastEvent=db.prepare('SELECT id,kind FROM task_events WHERE task_id=? ORDER BY id DESC LIMIT 1');
-  const insert=db.prepare('INSERT INTO supercode_publications(id,resource_id,kind,snapshot,actor,created_at) VALUES (?,?,?,?,?,?)');
+  const insert=db.prepare('INSERT INTO supercode_publications(id,resource_id,kind,snapshot,actor,created_at,snapshot_bytes) VALUES (?,?,?,?,?,?,?)');
   const upsert=db.prepare('INSERT INTO supercode_publication_heads(resource_id,digest,sequence,last_event_id,fingerprint) VALUES (?,?,?,?,?) ON CONFLICT(resource_id) DO UPDATE SET digest=excluded.digest,sequence=excluded.sequence,last_event_id=excluded.last_event_id,fingerprint=excluded.fingerprint');
   const compared=db.prepare('UPDATE supercode_publication_heads SET fingerprint=? WHERE resource_id=?');
   let changed=0;
@@ -285,10 +283,11 @@ export function recordCardPublications(db,actor,root,key) {
       if(previous?.digest===digest){compared.run(`${fingerprint}:${digest}`,id);continue;}
       const last=lastEvent.get(id);
       const kind=`task.${previous&&previous.digest!=='removed'?(last?.id!==previous.last_event_id?kinds[last?.kind]??'changed':'changed'):'created'}`;
-      const inserted=insert.run(`event_${randomUUID()}`,id,kind,snapshot,actor,Date.now());
+      const inserted=insert.run(`event_${randomUUID()}`,id,kind,snapshot,actor,Date.now(),Buffer.byteLength(snapshot));
       upsert.run(id,digest,Number(inserted.lastInsertRowid),last?.id??null,`${fingerprint}:${digest}`);changed++;
     }else if(previous&&previous.digest!=='removed'){
-      const inserted=insert.run(`event_${randomUUID()}`,id,'task.changed',JSON.stringify({id,removed:true}),actor,Date.now());
+      const snapshot=JSON.stringify({id,removed:true});
+      const inserted=insert.run(`event_${randomUUID()}`,id,'task.changed',snapshot,actor,Date.now(),Buffer.byteLength(snapshot));
       db.prepare('UPDATE supercode_publication_heads SET digest=?,sequence=?,fingerprint=NULL WHERE resource_id=?').run('removed',Number(inserted.lastInsertRowid),id);changed++;
     }
   }
@@ -330,7 +329,9 @@ export function prunePublications(db) {
     from=0;
   }
   const floor=Number(db.prepare('SELECT pruned_through FROM supercode_publication_log').get().pruned_through);
-  const candidates=db.prepare(`SELECT sequence,octet_length(snapshot) AS bytes FROM supercode_publications p WHERE sequence>? AND sequence<=? AND ${OLDER} ORDER BY sequence LIMIT ?`).all(from,floor,PRUNE_BATCH);
+  // New rows carry their byte count. Legacy rows fall back one small page at a time; never backfill old snapshots
+  // during an ordinary verb or scan hundreds of snapshot headers before the byte budget can be applied.
+  const candidates=db.prepare(`SELECT sequence,COALESCE(snapshot_bytes,octet_length(snapshot)) AS bytes FROM supercode_publications p WHERE sequence>? AND sequence<=? AND ${OLDER} ORDER BY sequence LIMIT ?`).all(from,floor,PRUNE_BATCH);
   const batch=[];let bytes=0;
   for(const row of candidates){
     // A single oversized row still makes progress, in a transaction of its own.

package/board/queries.mjs

@@ -0,0 +1,30 @@
+// Local reads whose cost must follow the matching keys, not the board's accumulated history.
+import { setImmediate as yieldToOwner } from 'node:timers/promises';
+
+/** One reverse index seek per kind, then one payload read. ORDER BY id over an IN-kind filter can instead choose
+ * the task/id index and read unrelated event payloads to reject their kinds. Kinds and columns are code constants. */
+export function latestEvent(db, task, kinds, columns = 'payload') {
+  const seeks = kinds.map(kind => `SELECT (SELECT id FROM task_events WHERE task_id=? AND kind='${kind}' ORDER BY id DESC LIMIT 1) AS id`);
+  return db.prepare(`SELECT ${columns} FROM task_events WHERE id=(SELECT MAX(id) FROM (${seeks.join(' UNION ALL ')}))`).get(...kinds.map(() => task));
+}
+
+/** Read run history in finite, indexed pages, yielding before each page. The candidate page precedes any JSON
+ * predicate, so a page that matches nothing still reads at most 32 rows. Mutations must re-read their target. */
+export async function readRunPages(db, columns, { task = null, where = '1' } = {}) {
+  const high = Number(db.prepare('SELECT MAX(id) AS id FROM task_runs').get()?.id ?? 0);
+  const out = [];
+  let cursor = 0;
+  while (cursor < high) {
+    await yieldToOwner();
+    const ids = db.prepare(`SELECT id FROM task_runs WHERE id>? AND id<=?${task ? ' AND task_id=?' : ''} ORDER BY id LIMIT 32`)
+      .all(cursor, high, ...(task ? [task] : []));
+    if (!ids.length) break;
+    cursor = ids.at(-1).id;
+    out.push(...db.prepare(`SELECT ${columns} FROM task_runs WHERE id IN (SELECT value FROM json_each(?)) AND (${where}) ORDER BY id`)
+      .all(JSON.stringify(ids.map(row => row.id))));
+  }
+  return out;
+}
+
+/** Unended runs plus ended runs a card still names current. Both arms start from small indexed sets. */
+export const ACTIVE_RUN_IDS = 'SELECT id FROM task_runs WHERE ended_at IS NULL UNION SELECT current_run_id FROM tasks WHERE current_run_id IS NOT NULL';

package/board/store.mjs

@@ -221,6 +221,11 @@ export function listBoards(root) {
 // SQLite uses an expression index only for a statement that writes the expression the same way.
 const RUN_SESSION = "json_extract(metadata, '$.supercode.session_id')";
 const RUN_ADDRESS = "json_extract(metadata, '$.supercode.address')";
+// Notification records historically skipped malformed metadata through the JS parser. Keep that behavior in both
+// the lookup and its indexes, including a legacy store that cannot create the older unguarded JSON indexes.
+const NOTICE_SESSION = `CASE WHEN json_valid(metadata,6) THEN ${RUN_SESSION} END`;
+const NOTICE_ADDRESS = `CASE WHEN json_valid(metadata,6) THEN ${RUN_ADDRESS} END`;
+export const NOTICE_RUN_IDS = `SELECT id FROM task_runs WHERE ${NOTICE_SESSION}=? UNION SELECT id FROM task_runs WHERE ${NOTICE_ADDRESS}=?`;
 const RUN_LAUNCH_PENDING = "json_extract(metadata, '$.supercode.launch_pending')";
 export const CALLER_RUN_ADDRESS = `SELECT ${RUN_ADDRESS} AS address FROM task_runs WHERE ${RUN_SESSION} = ? ORDER BY id DESC LIMIT 1`;
 // Launch/adoption commits the native address and its immutable role-agent together.
@@ -242,6 +247,10 @@ const RUN_LAUNCH_PENDING_INDEX = 'idx_runs_supercode_launch_pending';
 const RUN_INDEXES = [
   [RUN_SESSION_INDEX, `(${RUN_SESSION}, id, ${RUN_ADDRESS})`],
   [RUN_LAUNCH_PENDING_INDEX, `(id) WHERE ${RUN_LAUNCH_PENDING} = 1`],
+  ['idx_runs_notice_session', `(${NOTICE_SESSION}, id)`],
+  ['idx_runs_notice_address', `(${NOTICE_ADDRESS}, id)`],
+  ['idx_runs_open_machine_session', `(json_extract(metadata, '$.supercode.machine'), ${RUN_SESSION}, id) WHERE ended_at IS NULL`],
+  ['idx_runs_open_machine_pane', `(json_extract(metadata, '$.supercode.machine'), json_extract(metadata, '$.supercode.pane'), id) WHERE ended_at IS NULL`],
 ];
 
 // What every verb a session runs asks about its caller (cli.mjs ownCards, dispatch.mjs reconcileCallerLaunch). Each
@@ -395,6 +404,13 @@ export function layOut(db, { fresh }) {
   // each read walked every card's row. Laid out here, after the column it names exists on a store of any age and before
   // any statement is prepared; no statement names it, so a store without it is only slower.
   db.exec('CREATE INDEX IF NOT EXISTS idx_supercode_cards_subtask_of ON supercode_cards(subtask_of)');
+  // Current-run joins and unended-run reconciliation must never search all cards/runs for each historical run.
+  db.exec('CREATE INDEX IF NOT EXISTS idx_tasks_current_run ON tasks(current_run_id) WHERE current_run_id IS NOT NULL');
+  db.exec('CREATE INDEX IF NOT EXISTS idx_runs_unended ON task_runs(id) WHERE ended_at IS NULL');
+  // Ordinary comments vastly outnumber explicit source declarations. Keep their JSON discriminator in a small index.
+  db.exec("CREATE INDEX IF NOT EXISTS idx_events_arc_sources ON task_events(task_id,id) WHERE kind='commented' AND json_valid(payload) AND json_type(payload,'$.branches')='array'");
+  // Capacity pages need these columns without visiting task body/result overflow pages.
+  db.exec('CREATE INDEX IF NOT EXISTS idx_tasks_capacity ON tasks(id,status,assignee,current_run_id,model_override)');
   layOutNumbers(db);
   layOutEventIndex(db);
   layOutHistoryIndexes(db);
@@ -500,7 +516,7 @@ export function heldConfigWatched(slug, source, watched) {
 
 export function openBoard(root, slug = DEFAULT_BOARD, options = {}) {
   // a listing on the owner's read door reads on a connection of its own, never the held board's (openReadOnly)
-  if (current().readOnly) return openReadOnly(root, slug);
+  if (current().readOnly) return openBoardSnapshot(root, slug);
   if (holding !== null && !options.create && realRoot(root) === holding && !untrustedConfig.get(slug)?.size) {
     let entry = heldBoards.get(slug);
     if (!entry) {
@@ -537,7 +553,7 @@ function heldHandle(entry, slug) {
  * reader can take; a store not in WAL or not laid out; one it cannot begin reading, `unreadable`) is left to the owner
  * (listing.mjs byOwner).
  */
-function openReadOnly(root, slug) {
+export function openBoardSnapshot(root, slug) {
   const use = backingOf(root, slug);
   if (!use) throw new Error(`no board ${slug} in ${root} (${boardPath(root, slug)})`);
   const path = backingPaths(root, slug)[use];

package/board/workflow.mjs

@@ -20,6 +20,7 @@ import { evaluate, holds, render, needsSources } from './expr.mjs';
 import { completionEvidence, declaredWorkBranches, namedWorkBranch, reviewCandidate } from './ci.mjs';
 import { cardCommitsOn, isLocalWorkspace, isWorkspacePath } from './workspace.mjs';
 import { cardNumber, identifyNotice, numbered } from './notices.mjs';
+import { latestEvent } from './queries.mjs';
 
 const loaded = new Map();
 // the owner's read door holds the workflow the owner reads (owner-door.mjs), told when it is read again
@@ -189,7 +190,7 @@ export function completionOwnerOf(db, id) {
 
 /** A card's explicitly named review profile, retained in its own history. */
 export function reviewerOf(db, id) {
-  return json(one(db, "SELECT payload FROM task_events WHERE task_id=? AND kind IN ('created','reviewer_set') ORDER BY id DESC LIMIT 1", id)?.payload, {})?.reviewer ?? null;
+  return json(latestEvent(db, id, ['created', 'reviewer_set'])?.payload, {})?.reviewer ?? null;
 }
 
 export function latestReview(db, id) {
@@ -381,6 +382,14 @@ function stateRequestOf(db, id) {
 
 const OPEN_OUTCOME = /^(\s*[-*] )\[ \] (.+)$/;
 const TICKED_OUTCOME = /^\s*[-*] \[[xX]\] .+$/;
+/** Card bodies use Markdown headings and standalone labels such as `Acceptance:` and `Tasks:`. Every label ends
+ * the preceding section, so a task or another section's checkbox never acquires Acceptance permissions. */
+export function cardSectionHeading(line) {
+  const heading = /^#{1,6}\s+(.+?)\s*$/.exec(line);
+  if (heading) return heading[1].replace(/:$/, '').toLowerCase();
+  const label = /^\s*([A-Za-z][A-Za-z0-9 _-]*):\s*$/.exec(line);
+  return label ? label[1].trim().toLowerCase() : null;
+}
 /** Whether `body` is `was` with only outcomes ticked: each changed line is under the Acceptance heading, was `- [ ] X`
  *  and is now `- [x] X` or `- [x] X: <pointer>`, or was `- [x] X` and is now `- [x] X: <pointer>` (the pointer a tick
  *  needs, added after it); no other line added, removed or changed. */
@@ -392,8 +401,8 @@ function onlyTicks(was, body) {
   // an outcome is a line of the card's Acceptance section (its heading at any level), not a task or any other checkbox
   let section = null;
   return before.every((line, i) => {
-    const heading = /^#{1,6}\s+(.+?)\s*$/.exec(line);
-    if (heading) section = heading[1].toLowerCase();
+    const heading = cardSectionHeading(line);
+    if (heading !== null) section = heading;
     if (line === after[i]) return true;
     if (section !== 'acceptance') return false;
     const pointed = (ticked) => after[i].startsWith(`${ticked}: `) && after[i].trim().length > ticked.trim().length + 1;
@@ -469,7 +478,7 @@ export function scopeOf(db, board, task, { params, event = {}, extra = {}, lazy
     get latest_review() { return latestReview(db, task.id) ?? {}; },
     get review_candidate() { return reviewCandidate(board, task.id) ?? {}; },
     ci: completionEvidence(board, task.id),
-    get dispatch_hold() { return one(db, "SELECT kind FROM task_events WHERE task_id=? AND kind IN ('dispatch_held','dispatch_released','session_adopted') ORDER BY id DESC LIMIT 1", task.id)?.kind === 'dispatch_held'; },
+    get dispatch_hold() { return latestEvent(db, task.id, ['dispatch_held', 'dispatch_released', 'session_adopted'], 'kind')?.kind === 'dispatch_held'; },
     status,
     blocked_by: blocks,
     paused: json(state.paused, null),
@@ -486,8 +495,8 @@ export function scopeOf(db, board, task, { params, event = {}, extra = {}, lazy
       const lines = String(task.body ?? '').split('\n');
       let acceptance = false;
       return lines.every((line) => {
-        const heading = /^#{1,6}\s+(.+?)\s*$/.exec(line);
-        if (heading) acceptance = heading[1].toLowerCase() === 'acceptance';
+        const heading = cardSectionHeading(line);
+        if (heading !== null) acceptance = heading === 'acceptance';
         if (!acceptance || !/^\s*[-*] \[[ xX]\]/.test(line)) return true;
         return /^\s*[-*] \[[xX]\] .+: \S.+$/.test(line);
       });
@@ -1054,7 +1063,7 @@ const ACTIONS = {
       else runSession(ctx, (s) => ({ ...s, [counter]: 0 }));
     }
   },
-  end_run(ctx, { outcome, summary = null, error = null } = {}) {
+  end_run(ctx, { outcome, summary = null, error = null, close_session = true } = {}) {
     const row = one(ctx.db, 'SELECT current_run_id FROM tasks WHERE id = ?', ctx.id);
     const t = now();
     if (row?.current_run_id) {
@@ -1062,10 +1071,15 @@ const ACTIONS = {
       retireSupersededRuns(ctx.db, ctx.id, runId, json(one(ctx.db, 'SELECT metadata FROM task_runs WHERE id = ?', runId)?.metadata, {})?.supercode);
       run(ctx.db, `UPDATE task_runs SET status = ?, outcome = ?, summary = COALESCE(?, summary), error = COALESCE(?, error), ended_at = ?, claim_lock = NULL, claim_expires = NULL, worker_pid = NULL
                WHERE id = ? AND ended_at IS NULL`, outcome, outcome, summary, error ?? ctx.scope.event?.error ?? null, t, runId);
-      requestSessionClose(ctx.db, ctx.id, { runId });
       ctx.runId = runId;
       ctx.lastOutcome = outcome;
-      ctx.effects.push({ kind: 'run_ended', id: ctx.id, runId, outcome });
+      runSession(ctx, session => ({ ...session, retain_after_run: !close_session }));
+      // A declared completion may end the attempt while retaining its role session. In particular, its own caller
+      // must be able to finish and return before the board starts the independent review.
+      if (close_session) {
+        requestSessionClose(ctx.db, ctx.id, { runId });
+        ctx.effects.push({ kind: 'run_ended', id: ctx.id, runId, outcome });
+      }
     } else if (summary || ctx.scope.event?.metadata) {
       // an outcome reached with no run open (a person completing a card nobody claimed)
       const task = one(ctx.db, 'SELECT assignee FROM tasks WHERE id = ?', ctx.id);
@@ -1140,13 +1154,24 @@ const ACTIONS = {
       const task = cardOf(ctx.db, ctx.id);
       const readable = allocateReadableId(ctx.db, task.title, said.readable_id, ctx.id);
       run(ctx.db, 'UPDATE tasks SET readable_id=? WHERE id=?', readable, ctx.id);
+      if (readable !== task.readable_id) {
+        // Keep the obligation with the edit: a stopped dispatcher or interrupted caller must not lose the rename.
+        // Delivery reads the current name, so an older edit can never restore an obsolete name.
+        const effect = { kind: 'rename_card_agents', id: ctx.id };
+        const inserted = run(ctx.db, 'INSERT INTO supercode_effects (effect) VALUES (?)', JSON.stringify(effect));
+        ctx.effects.push({ ...effect, durableId: Number(inserted.lastInsertRowid) });
+      }
     }
     if (said?.title && String(said.title).trim()) run(ctx.db, 'UPDATE tasks SET title = ? WHERE id = ?', String(said.title).trim(), ctx.id);
     if (said?.body !== undefined && said?.body !== null) run(ctx.db, 'UPDATE tasks SET body = ? WHERE id = ?', said.body, ctx.id);
   },
   decompose(ctx, said) {
-    // the children are filed by the caller before the event (they are cards of their own); the card waits on them
-    for (const child of said?.children ?? []) run(ctx.db, 'INSERT OR IGNORE INTO task_links (parent_id, child_id) VALUES (?, ?)', child, ctx.id);
+    // Native arc tasks are worked by the arc's session, never dispatched as prerequisite cards of their own.
+    // Retain the older workflow's dependency action only for separately declared cards.
+    for (const child of said?.children ?? []) {
+      if (one(ctx.db, 'SELECT subtask_of FROM supercode_cards WHERE task_id=?', child)?.subtask_of === ctx.id) continue;
+      run(ctx.db, 'INSERT OR IGNORE INTO task_links (parent_id, child_id) VALUES (?, ?)', child, ctx.id);
+    }
   },
   // card ids a handoff names that no card has (Hermes flags them the same way)
   check_references(ctx, said) {
@@ -1231,11 +1256,12 @@ const ACTIONS = {
 /** Binding a newer run transfers ownership; stale run references cannot veto its later stop. */
 export function retireSupersededRuns(db, id, runId, session) {
   if (!session?.session_id && !session?.pane) return;
-  for (const old of all(db, `SELECT id, task_id, metadata FROM task_runs WHERE id < ? AND ended_at IS NULL
-    AND json_extract(metadata, '$.supercode.machine') IS ?
-    AND ((? IS NOT NULL AND json_extract(metadata, '$.supercode.session_id') = ?)
-      OR (? IS NOT NULL AND json_extract(metadata, '$.supercode.pane') = ?))`,
-    runId, session.machine ?? null, session.session_id ?? null, session.session_id ?? null, session.pane ?? null, session.pane ?? null)) {
+  for (const old of all(db, `SELECT id,task_id,metadata FROM task_runs WHERE id IN (
+    SELECT id FROM task_runs WHERE id<? AND ended_at IS NULL AND json_extract(metadata, '$.supercode.machine') IS ?
+      AND json_extract(metadata, '$.supercode.session_id')=?
+    UNION SELECT id FROM task_runs WHERE id<? AND ended_at IS NULL AND json_extract(metadata, '$.supercode.machine') IS ?
+      AND json_extract(metadata, '$.supercode.pane')=?)`,
+    runId, session.machine ?? null, session.session_id ?? null, runId, session.machine ?? null, session.pane ?? null)) {
     const whole = json(old.metadata, {}) ?? {}, s = whole.supercode;
     if (!s || detachedSession(db, s) || s.machine !== session.machine || !((session.session_id && s.session_id === session.session_id) || (session.pane && s.pane === session.pane))) continue;
     if (old.task_id !== id && one(db, 'SELECT 1 FROM tasks WHERE current_run_id = ?', old.id)) throw new Error(`session is still owned by active run ${old.id} of ${old.task_id}`);

package/board/workspace.mjs

@@ -1,5 +1,5 @@
 // Filesystem/RPC work happens before a board transaction; the ownership check is pure.
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import { basename, dirname } from 'node:path';
 import { runtimeDoor } from './runtime-door.mjs';
 import { inspectCheckout } from '@volter/teams/checkout';
@@ -130,23 +130,34 @@ export async function checkWorkspace(board, task) {
   if (task.workspace_kind === 'scratch') return null;
   task = { ...task, handle: task.handle ?? cardHandleOf(board, task.id) };
   const facts = await resolveWorkspace(task), peers = [];
-  if (task.workspace_kind === 'dir' && !facts.linked) {
-    for (const row of board.db.prepare(`SELECT t.id,t.workspace_path,t.branch_name,c.workspace_anchor,c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.current_run_id IS NOT NULL AND t.workspace_kind='dir'`).all()) {
+  const workspaceRoot = task.workspace_kind === 'worktree' ? facts.path : facts.root;
+  // New claims retain their exact checkout receipt before launch. Legacy claims without a receipt are resolved
+  // once for this check, including subdirectories and remote aliases that their retained path alone cannot identify.
+  {
+    for (const row of board.db.prepare(`SELECT t.id,t.workspace_kind,t.workspace_path,t.branch_name,c.workspace_anchor,c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.current_run_id IS NOT NULL AND t.workspace_kind!='scratch' AND c.workspace_root IS NULL`).all()) {
       if (row.id === task.id || normalMachine(row.machine ?? localMachine()) !== normalMachine(task.machine ?? localMachine())) continue;
       let other;
-      try { other = await resolveWorkspace({ ...row, workspace_kind: 'dir' }); } catch { continue; } // That card's own launch reports its invalid workspace.
-      if (!other.linked && other.root === facts.root) peers.push(row.id);
+      try { other = await resolveWorkspace({ ...row, handle: cardHandleOf(board, row.id) }); } catch { continue; } // Its retained path/reservation is still checked below.
+      if ((row.workspace_kind === 'worktree' ? other.path : other.root) === workspaceRoot) peers.push(row.id);
     }
   }
-  const checked = { ...facts, mainRoot: task.workspace_kind === 'dir' && !facts.linked ? facts.root : null, peers };
+  const checked = { ...facts, workspaceRoot, peers };
   assertWorkspaceOwner(board.db, task, checked);
   return checked;
 }
+const workspacePath = (path, local) => {
+  if (!path) return null;
+  if (local) { try { return realpathSync(path); } catch { /* a pre-launch reservation may not exist yet */ } }
+  return path.replace(/\/+$/, '');
+};
 export function assertWorkspaceOwner(db, task, checked) {
-  if (!checked?.mainRoot) return;
-  const conflict = db.prepare(`SELECT t.id,c.machine,c.workspace_root FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.current_run_id IS NOT NULL AND t.workspace_kind='dir'`).all()
-    .find(row => row.id !== task.id && normalMachine(row.machine ?? localMachine()) === normalMachine(task.machine ?? localMachine()) && (row.workspace_root === checked.mainRoot || checked.peers?.includes(row.id)));
-  if (conflict) throw new Error(`main checkout is already used by running card ${conflict.id}; declare worktree:${checked.repository} for a solo worktree`);
+  if (!checked?.workspaceRoot) return;
+  const machine = normalMachine(task.machine ?? localMachine()), local = machine === localMachine();
+  const path = workspacePath(checked.workspaceRoot, local);
+  const conflict = db.prepare(`SELECT t.id,t.workspace_path,c.machine,c.workspace_root FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.current_run_id IS NOT NULL AND t.workspace_kind!='scratch'`).all()
+    .find(row => row.id !== task.id && normalMachine(row.machine ?? localMachine()) === machine &&
+      (workspacePath(row.workspace_root, local) === path || workspacePath(row.workspace_path, local) === path || checked.peers?.includes(row.id)));
+  if (conflict) throw new Error(`workspace ${checked.path} is already used by running card ${conflict.id}; declare worktree:${checked.repository} for a solo worktree`);
 }
 
 export const isLocalWorkspace = task => !task.machine || normalMachine(task.machine) === localMachine();

package/board-input.d.ts

@@ -1,2 +1,4 @@
 /** Read a remote card write's selected text file (or stdin) on the caller's machine. */
 export function prepareBoardText(argv: string[]): { argv: string[]; stdin: string | null };
+/** Read a caller-local attachment in bounded requests, ending with its digest. */
+export function prepareBoardInputs(argv: string[]): Generator<{ argv: string[]; stdin: string | null }>;

package/board-input.mjs

@@ -1,6 +1,8 @@
 // A remote card write reads its text on the caller's machine, before the board door is called.
 // The board's own argument parser decides which file is used; its last value wins.
-import { readFileSync } from 'node:fs';
+import { closeSync, fstatSync, openSync, readFileSync, readSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { basename } from 'node:path';
 import { parse } from './board/args.mjs';
 
 /** Carry a comment/create/specify text input as the owner's existing `stdin` field. */
@@ -14,3 +16,33 @@ export function prepareBoardText(argv) {
   // reads the carried text at `-`, never an unrelated file at the caller's original path on another machine.
   return { argv: [...argv, `--${key}`, '-'], stdin: readFileSync(file === '-' ? 0 : file, 'utf8') };
 }
+
+/** Each yielded request fits one board frame. Only the last answer is the attachment receipt. */
+export function* prepareBoardInputs(argv) {
+  const args = parse(argv);
+  if (args._[0] !== 'attach' || args.help) { yield prepareBoardText(argv); return; }
+  if (args._.length !== 3 || args.upload !== undefined) throw new Error('attach needs a card id and a local file');
+  const source = openSync(args._[2], 'r');
+  try {
+    const before = fstatSync(source, { bigint: true });
+    if (!before.isFile() || before.size > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error('attach needs a regular file of supported size');
+    const upload = randomUUID(), size = Number(before.size), hash = createHash('sha256');
+    const command = ['attach', args._[1], '-', '--upload', upload];
+    if (args.json) command.push('--json');
+    for (const key of ['name', 'content-type', 'author']) if (args[key] !== undefined) command.push(`--${key}`, args[key]);
+    const input = body => ({ argv: command, stdin: JSON.stringify(body) });
+    yield input({ action: 'begin', size, name: args.name ?? basename(args._[2]) });
+    const buffer = Buffer.alloc(1024 * 1024);
+    for (let offset = 0; offset < size;) {
+      const count = readSync(source, buffer, 0, Math.min(buffer.length, size - offset), offset);
+      if (count <= 0) throw new Error('attachment ended during upload; no attachment was committed');
+      const bytes = buffer.subarray(0, count); hash.update(bytes);
+      yield input({ action: 'append', offset, bytes: bytes.toString('base64') });
+      offset += count;
+    }
+    const after = fstatSync(source, { bigint: true });
+    if (before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+      throw new Error('attachment changed during upload; no attachment was committed');
+    yield input({ action: 'commit', sha256: hash.digest('hex') });
+  } finally { closeSync(source); }
+}

package/hermes-cli.mjs

@@ -1,13 +1,14 @@
 // Hermes's own tools beside a worker (docs/plans/hermes-compat.md row 7). A home is a Hermes home, and the
 // skills it carries call Hermes's CLI (`hermes kanban …`, `hermes cron notepad …`, `hermes cron doctor`)
 // against it, so a worker of any harness runs with `HERMES_HOME` set to its profile's folder and the
-// pinned `hermes` on its `PATH`; and what Hermes's scheduler records about a failed run (its incidents,
-// in `cron/executions.db`) the orchestrator records through Hermes's own function.
+// pinned `hermes` on its `PATH`. Native cron incidents use the owning interchange codec, in the same executions store.
 import { spawn, spawnSync } from 'node:child_process';
 import { accessSync, constants, existsSync, readFileSync, statSync } from 'node:fs';
 import { delimiter, dirname, join } from 'node:path';
 import { parseDotenv } from './orchestration.mjs';
 import { locateHermes } from './apply/doors.mjs';
+import { recordCronIncident } from '@volter/supercode-interchange/cron-incidents';
+import { redactText } from '@volter/teams/redact';
 
 /** Hermes's interpreter over `code`, `payload` on stdin, without blocking the daemon: `{ status, stdout, stderr }`. */
 function python(install, code, payload, env, timeout) {
@@ -48,23 +49,10 @@ export function hermesToolEnv(profileDir) {
   return env;
 }
 
-/**
- * Record a failed run as Hermes's scheduler does: `cron.incidents.upsert_incident`, one incident per job
- * and error signature, in the profile's `cron/executions.db`. Answers the incident id, or null (and why)
- * when Hermes is not installed or refused.
- */
-export function recordIncident(profileDir, { job_id, job_name = null, error }) {
-  const install = hermesInstall();
-  if (!install?.python) return { id: null, why: 'no Hermes install on PATH' };
-  const code = 'import json,sys\nfrom cron.incidents import upsert_incident\na=json.loads(sys.stdin.read())\nprint(json.dumps(upsert_incident(a["job_id"], a["error"], job_name=a.get("job_name"))))';
-  const run = spawnSync(install.python, ['-c', code], {
-    input: JSON.stringify({ job_id, job_name, error: String(error ?? 'failed') }),
-    encoding: 'utf8', timeout: 30_000, cwd: install.source,
-    env: { PATH: process.env.PATH ?? '', HOME: process.env.HOME ?? '', HERMES_HOME: profileDir, PYTHONPATH: install.source },
-  });
-  if (run.status !== 0) return { id: null, why: (run.stderr || run.error?.message || '').trim().slice(-300) };
-  const [id] = JSON.parse(run.stdout.trim().split('\n').pop());
-  return { id };
+/** Record native cron failure grouping without requiring a separate Hermes Python installation. */
+export function recordIncident(profileDir, { job_id, error }) {
+  try { return recordCronIncident(profileDir, { job_id, error: String(error ?? 'failed'), redacted_error: redactText(String(error ?? 'failed')) }); }
+  catch (error) { return { id: null, why: error.message }; }
 }
 
 // Access through Hermes's own pairing store and writers (docs/plans/hermes-compat.md row 8): a code is

package/index.d.ts

@@ -443,7 +443,7 @@ export interface McpServerLaunch { name: string; command: string; arguments: str
 export function mountOrchestratorMcp(o: {
   root: Path; profile: Profile; harness: string; surfaceKey?: string | null;
   launch?: { program: string; arguments?: string[]; env?: Record<string, string> };
-  socketPath?: Path; serverPath?: Path; program?: string;
+  socketPath?: Path; program?: string;
   /** The Teams id of the agent the session is; the rh2-agent record installed for that id (`--agent`) is mounted beside
    * the orchestrator server as `rh2-agent`. */
   agentId?: string | null;

package/loop.mjs

@@ -6,6 +6,7 @@
 
 import { mkdirSync, writeFileSync, existsSync, readdirSync, readFileSync, renameSync, unlinkSync, realpathSync } from 'node:fs';
 import { basename, join, dirname } from 'node:path';
+import { parseSessionWire, stringifySessionWire } from '@volter/supercode-teams/session-read-client';
 import { step, leaseId } from './reducer.mjs';
 import * as events from './events.mjs';
 import { read, save, retainWorld, releaseWorld, refreshVault } from './orchestration.mjs';
@@ -278,9 +279,18 @@ export class Orchestrator {
       try {event={...event,identity:await this.identityRecord.observe({observation,location:JSON.stringify(event.key),at:Date.parse(event.at),name:event.sender_name,evidence:{adapter:event.adapter,message_id:event.message_id}})};}
       catch(error){event={...event,identity:{observation,principal:null,classification:'unresolved',label:'unresolved'}};this.log('warn',`identity observation unavailable: ${error.message}`);}
     }
+    const before = parseSessionWire(stringifySessionWire(this.state));
     const effects = step(this.state, event);
-    for (const effect of effects) {
+    const firstSave = effects.findIndex(effect => effect.type === 'save');
+    if (firstSave >= 0) {
+      // Persist the reducer's claims before any external action. A refused save must leave no in-memory gate or
+      // hosted-fire marker behind: otherwise the next tick thinks an execution that never started is still alive.
+      try { await this.save(); }
+      catch (error) { this.state = before; throw error; }
+    }
+    for (const [index, effect] of effects.entries()) {
       this.effectLog.push(effect);
+      if (index === firstSave) continue;
       await this.perform(effect);
     }
     return effects;