@volter/supercode-orchestrator 0.5.215 → 0.5.216

package/board/owner-files.mjs

@@ -3,7 +3,7 @@
 import { realpathSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 
-const RUNTIME = new Set(['board.lock', 'board.sock']);
+const RUNTIME = new Set(['board.lock', 'board.sock', 'board-generation.json']);
 let home = null;
 
 /** The home this process owns (the owner's, set once when it binds). */

package/board/published.mjs

@@ -6,7 +6,7 @@ import { readFileSync } from 'node:fs';
 // supercode_publication_dirty, whoever writes (this process, Hermes's native writer, a document import). A transaction
 // publishes the marked cards and clears their marks; one that marked nothing reads one row and publishes nothing.
 import { createHash, randomUUID } from 'node:crypto';
-import { executionOf } from './session-work.mjs';
+import { executionOf, readingContext } from './session-work.mjs';
 import { cardState } from './card-state.mjs';
 import { workflowFor } from './workflow.mjs';
 import { cardAgentScopeTransition } from '../agents.mjs';
@@ -40,13 +40,13 @@ CREATE INDEX IF NOT EXISTS supercode_publication_heads_sequence ON supercode_pub
 // is where a prune under way resumes, null when none is (prunePublications).
 export const PUBLICATION_COLUMNS = { supercode_publications: { snapshot_bytes: 'INTEGER' }, supercode_publication_heads: { fingerprint: 'TEXT' }, supercode_publication_log: { prune_from: 'INTEGER' } };
 
-// The snapshot's shape: 1 names the card as a person does (`ref`, VO-856).
-const SNAPSHOT_SHAPE = 4;
+// The snapshot's shape: 1 names the card as a person does (`ref`, VO-856); 5 lists the files attached to it (`attachments`).
+const SNAPSHOT_SHAPE = 5;
 const SNAPSHOT_RELEASE = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 const REVIEW_KIND_LIST = ['review_requested', 'approved', 'review_approved', 'changes_requested', 'escalated'];
 export const AGENT_KIND_LIST = ['agent_declared', 'agent_assignment_ended', 'agent_assignment_reassigned', 'agent_assignment_adopted'];
 // The tables a card's snapshot reads (cardSnapshot), each with the column naming its card; a link names two.
-const MARKED = [['tasks', ['id']], ['supercode_cards', ['task_id']], ['task_comments', ['task_id']], ['task_runs', ['task_id']], ['task_links', ['parent_id', 'child_id']], ['task_events', ['task_id']], ['supercode_card_agent_facts',['task_id']], ['supercode_card_agent_scopes',['task_id']], ['supercode_card_numbers', ['task_id']]];
+const MARKED = [['tasks', ['id']], ['supercode_cards', ['task_id']], ['task_comments', ['task_id']], ['task_runs', ['task_id']], ['task_links', ['parent_id', 'child_id']], ['task_events', ['task_id']], ['supercode_card_agent_facts',['task_id']], ['supercode_card_agent_scopes',['task_id']], ['supercode_card_numbers', ['task_id']], ['task_attachments', ['task_id']]];
 /**
  * The triggers that mark a changed card, on a store that has these tables (CREATE … IF NOT EXISTS: laid out on every
  * open). A card already marked is not marked again, so a writer's many writes while the owner is away leave one mark.
@@ -75,7 +75,7 @@ export function publicationTriggers(db) {
       // Reviews and agent assignment events change a snapshot: an update marks when the
       // row was one before or is one after
       const when = (rows) => table === 'task_events' ? ` WHEN ${rows.map((row) => `${row}.kind IN ${snapshotEvents}`).join(' OR ')}` : '';
-      const invalidate = row => ['task_comments','task_events'].includes(table) ? `UPDATE supercode_publication_heads SET fingerprint=NULL WHERE resource_id=${row}.task_id;` : '';
+      const invalidate = row => ['task_comments','task_events','task_attachments'].includes(table) ? `UPDATE supercode_publication_heads SET fingerprint=NULL WHERE resource_id=${row}.task_id;` : '';
       const mark = (row) => invalidate(row) + columns.map((column) => `INSERT INTO supercode_publication_dirty (task_id) SELECT ${row}.${column} WHERE ${row}.${column} IS NOT NULL AND NOT EXISTS (SELECT 1 FROM supercode_publication_dirty WHERE task_id = ${row}.${column});`).join(' ');
       db.exec(`CREATE TRIGGER IF NOT EXISTS supercode_publish_${table}_insert AFTER INSERT ON ${table}${when(['NEW'])} BEGIN ${mark('NEW')} END;
         CREATE TRIGGER IF NOT EXISTS supercode_publish_${table}_update AFTER UPDATE ON ${table}${when(['OLD', 'NEW'])} BEGIN ${mark('NEW')} ${mark('OLD')} END;
@@ -193,7 +193,11 @@ const perCard=db=>{
   // A card's short sequential number (store.mjs CARD_NUMBERS, named here as store.mjs imports this module), in a store
   // that has numbered its cards.
   const numbered=!!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='supercode_card_numbers'").get();
+  const attached=!!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='task_attachments'").get();
   return {
+  // The files attached to it, by their board ids, as the board door lists and serves them (attachment-get, attachment-read):
+  // never where the board keeps them.
+  attachments:id=>attached?db.prepare('SELECT id,filename,content_type,size,uploaded_by,created_at FROM task_attachments WHERE task_id=? ORDER BY id').all(id):[],
   number:id=>numbered?db.prepare('SELECT number FROM supercode_card_numbers WHERE task_id=?').get(id)?.number??null:null,
   own:id=>db.prepare('SELECT * FROM supercode_cards WHERE task_id=?').get(id),
   comments:id=>db.prepare('SELECT id,author,body,created_at FROM task_comments WHERE task_id=? ORDER BY id').all(id),
@@ -244,13 +248,14 @@ export function cardSnapshot(db,row,rows=perCard(db),key=null,options={}) {
   const lane=own.stage??row.status;
   const archived=Boolean(own.archived || lane==='archived');
   return {id:row.id,readable_id:row.readable_id??null,number,ref:key&&number?`${key}-${number}`:null,title:row.title,body:row.body??'',assignee:row.assignee,status:taskStatusOf(lane,row.completed_at),board_status:cardState({...row,stage:lane,paused:own.paused,blocked_by:own.blocked_by},options).status,lane,
-    execution:executionOf(runs.find(run=>run.id===row.current_run_id)),
+    execution:executionOf(runs.find(run=>run.id===row.current_run_id),readingContext(db,row.id,row.current_run_id)),
     priority:row.priority,created_by:row.created_by,created_at:at(row.created_at),started_at:at(row.started_at),completed_at:at(row.completed_at),result:row.result,skills:parse(row.skills,[]),model:row.model_override,provider:row.provider_override,
     tags:parse(own.tags,null)??(row.tenant?[row.tenant]:[]),requested_by_unverified:parse(own.requested_by_unverified),machine:own.machine??null,subtask_of:own.subtask_of??null,archived,archive_reason:archived?rows.archiveReason(row.id):null,
     blocked_by:parse(own.blocked_by,[]),paused:parse(own.paused),detached:parse(own.detached),every:own.every??null,
     workspace:{kind:row.workspace_kind,path:row.workspace_path,branch:row.branch_name,root:own.workspace_root,anchor:own.workspace_anchor},
     parents:rows.parents(row.id),
-    agents:rows.agents(row.id),reviews,children:rows.children(row.id),comments,attempts};
+    agents:rows.agents(row.id),reviews,children:rows.children(row.id),comments,attempts,
+    attachments:rows.attachments(row.id).map(file=>({id:file.id,name:file.filename,content_type:file.content_type??null,size:file.size,by:file.uploaded_by??null,at:at(file.created_at)}))};
 }
 
 /**

package/board/reply.mjs

@@ -26,8 +26,8 @@ async function write(socket, text) {
   return !socket.destroyed;
 }
 
-export async function writeOwnerAnswer(socket, { code = 0, stdout = '', stderr = '' }) {
-  if (!await write(socket, `{"code":${JSON.stringify(code)},"stdout":"`)) return;
+export async function writeOwnerAnswer(socket, { code = 0, stdout = '', stderr = '', unanswered = false }) {
+  if (!await write(socket, `{"code":${JSON.stringify(code)},${unanswered ? '"unanswered":true,' : ''}"stdout":"`)) return;
   for (const [index, value] of [stdout, stderr].entries()) {
     let carry = '';
     for (const part of Array.isArray(value) ? value : [value]) {

package/board/session-work.mjs

@@ -1,23 +1,93 @@
 // The dispatcher observes native turns and explicit session delegation. A
 // transcript write, a reminder reply, or sharing a profile proves no progress.
 
-/** A retained reading, separate from the card's workflow lane and launch receipt.
- * An ended attempt is never a live session; an unread live attempt is unknown. */
-export function executionOf(run) {
-  if (!run) return { state: 'awaiting_session', alive: false, observed_at: null };
-  let metadata = run.metadata;
-  if (typeof metadata === 'string') { try { metadata = JSON.parse(metadata); } catch { metadata = null; } }
-  const session = metadata?.supercode;
-  if (run.ended_at != null || session?.close_confirmed_at || session?.released) return { state: 'ended', alive: false, observed_at: session?.presence_observation?.observed_at ?? null };
+const parsed = (value) => {
+  if (typeof value !== 'string') return value ?? null;
+  try { return JSON.parse(value); } catch { return null; }
+};
+const iso = (seconds) => Number(seconds) > 0 ? `${new Date(Number(seconds) * 1000).toISOString().slice(0, 16)}Z` : null;
+const oneLine = (text, max = 200) => String(text ?? '').trim().split('\n')[0].slice(0, max);
+
+/**
+ * A retained reading of the card's session, beside the card's workflow lane and apart from its launch receipt (ADR 0024).
+ * `state` is what the session is doing as the board last read it, and `reason` says it in words wherever the session is
+ * not plainly working: no session, ended, its machine unreachable, unread, waiting until a dated time (the card's last
+ * heartbeat `--until`), waiting on its user, or idle since a time. An ended attempt is never a live session; an unread
+ * live attempt is unknown.
+ * `heartbeat` is the current run's latest heartbeat event on the card ({ payload: { note, until }, at, run_id }) beside the
+ * run's own, `last` its latest run when it has no current one; both are optional (readingContext reads them).
+ */
+export function executionOf(run, { heartbeat = null, last = null } = {}) {
+  if (!run) {
+    const ended = last?.ended_at != null ? last : null;
+    return { state: 'awaiting_session', alive: false, observed_at: null, since: ended ? Number(ended.ended_at) : null,
+      reason: ended ? `no session works it; its last run ended${ended.outcome ?? ended.status ? ` (${ended.outcome ?? ended.status})` : ''} at ${iso(ended.ended_at)}${ended.error ? `: ${oneLine(ended.error)}` : ''}`
+        : 'no session works it' };
+  }
+  const session = parsed(run.metadata)?.supercode;
+  const machine = session?.machine ?? null;
+  if (run.ended_at != null || session?.close_confirmed_at || session?.released) {
+    const at = run.ended_at ?? session?.close_confirmed_at ?? null;
+    return { state: 'ended', alive: false, observed_at: session?.presence_observation?.observed_at ?? null, since: at == null ? null : Number(at),
+      reason: `its session ended${at ? ` at ${iso(at)}` : ''}` };
+  }
   const reading = session?.presence_observation;
-  if (!reading) return { state: 'unknown', alive: null, observed_at: null };
+  if (!reading) return { state: 'unknown', alive: null, observed_at: null, reason: 'the board has not read its session yet' };
   const freshUntil = Number(reading.observed_at) + 90;
-  // A stopped dispatcher cannot keep advertising its last positive reading.
-  // Cached snapshot consumers use the same expiry without another publication.
-  if (Date.now() / 1000 > freshUntil) return { state: 'unknown', alive: null, observed_at: reading.observed_at, fresh_until: freshUntil };
-  const delegated = session?.idle_observation?.decision === 'delegated_work' && session.idle_observation.turn === reading.turn;
-  return { ...reading, fresh_until: freshUntil, state: reading.alive === false ? 'ended' : reading.alive == null ? 'unknown'
-    : delegated ? 'delegating' : reading.turn ?? 'live' };
+  // A stopped dispatcher cannot keep advertising its last reading, its machine wait included: every round renews the
+  // observation (supervise), so one older than its freshness is unknown. Cached snapshot consumers use the same expiry.
+  if (Date.now() / 1000 > freshUntil) return { state: 'unknown', alive: null, observed_at: reading.observed_at, fresh_until: freshUntil,
+    reason: `the board has not read its session since ${iso(reading.observed_at)}` };
+  const read = { ...reading, fresh_until: freshUntil };
+  // the run's machine wait: the board read the session's machine as unlinked from the team (supervise, machine_offline)
+  if (session.offline_since != null) {
+    return { ...read, state: 'unreachable', machine, since: Number(session.offline_since),
+      reason: `machine ${machine ?? '(unnamed)'} unreachable since ${iso(session.offline_since)}; the board cannot see its session` };
+  }
+  // the session's machine as the same round read it, where nothing else read the session: unlinked from the team is
+  // unreachable; a record that is out of date or not held says nothing of the link, and its session is unknown
+  if (reading.alive == null && reading.machine_reading && reading.machine_reading !== 'online') {
+    const offline = reading.machine_reading === 'offline';
+    return { ...read, state: offline ? 'unreachable' : 'unknown', machine,
+      reason: `machine ${machine ?? '(unnamed)'} ${offline ? 'is unlinked from the team' : 'cannot be read'}${reading.machine_error ? `: ${oneLine(reading.machine_error)}` : ''}; the board cannot see its session` };
+  }
+  if (reading.alive === false) return { ...read, state: 'ended', reason: `its session is gone from ${machine ?? 'its machine'}` };
+  if (reading.alive == null) return { ...read, state: 'unknown', reason: `its session on ${machine ?? 'its machine'} could not be read` };
+  if (session?.idle_observation?.decision === 'delegated_work' && session.idle_observation.turn === reading.turn) return { ...read, state: 'delegating', reason: null };
+  if (reading.turn === 'working') return { ...read, state: 'working', reason: null };
+  if (reading.turn === 'needs_input') {
+    const asked = typeof session?.question === 'string' ? session.question : session?.question?.question;
+    return { ...read, state: 'needs_input', reason: asked ? `its session asks: ${oneLine(asked)}` : 'its session waits on its user' };
+  }
+  // a bounded wait the session declared on its card (heartbeat --until), still ahead: the run's own heartbeat (a workflow
+  // with a run machine keeps it on the run, as the workflow's `card.last_events` reads it) or the card's, the later
+  // (only this run's: a wait an earlier run declared is not this session's)
+  const own = parsed(run.metadata)?.last_events?.heartbeat ?? null;
+  const card = heartbeat && run.id != null && heartbeat.run_id != null && Number(heartbeat.run_id) === Number(run.id) ? heartbeat : null;
+  const beat = own && !(Number(card?.at) > Number(own.at)) ? own : card;
+  const wait = parsed(beat?.payload);
+  if (Number(wait?.until) > Date.now() / 1000) {
+    return { ...read, state: 'waiting', until: Number(wait.until), since: Number(beat.at) || null,
+      reason: `waiting until ${iso(wait.until)}${wait.note ? `: ${oneLine(wait.note)}` : ''}` };
+  }
+  if (reading.turn === 'idle') {
+    const since = Number(session?.idle_since) || null;
+    return { ...read, state: 'idle', since, reason: since ? `idle, no turn since ${iso(since)}` : 'idle' };
+  }
+  const unknownSince = Number(session?.unknown_since) || null;
+  return { ...read, state: reading.turn ?? 'live', since: unknownSince,
+    reason: reading.turn ? null : `its session's turn is not known${unknownSince ? ` since ${iso(unknownSince)}` : ''}` };
+}
+
+/** What executionOf reads beside a card's current run, for a card in a working lane (running or review) only, as the
+ * listing reads it (listing.mjs READING_CONTEXT): the current run's latest heartbeat event, and the latest run when
+ * none is current. Any other lane reads none. */
+export function readingContext(db, taskId, currentRunId) {
+  const lane = db.prepare('SELECT COALESCE(c.stage,t.status) AS lane FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(taskId)?.lane;
+  if (!['running', 'review'].includes(lane)) return { heartbeat: null, last: null };
+  const heartbeat = currentRunId ? db.prepare("SELECT payload,created_at AS at,run_id FROM task_events WHERE task_id=? AND kind='heartbeat' AND run_id=? ORDER BY id DESC LIMIT 1").get(taskId, currentRunId) ?? null : null;
+  const last = currentRunId ? null : db.prepare('SELECT status,outcome,ended_at,error FROM task_runs WHERE task_id=? ORDER BY id DESC LIMIT 1').get(taskId) ?? null;
+  return { heartbeat, last };
 }
 
 /** Sessions this session started, transitively. Cycles never imply work. */

package/connection.mjs

@@ -8,13 +8,14 @@ import { fromContext } from '@volter/teams/context';
 import { supercodeHome } from '@volter/teams/home';
 
 // RH2's modules, each its own program under --modules-root.
-export const MODULE_APPS = ['arcs-rooms','orchestration-rh2'];
+export const MODULE_APPS = ['orchestration-rh2'];
 // supercode's Workplace service's registrations (supercode ADR 0041 decision 3; runhuman-2 ADR 0055 decision 3): one program,
 // sdk/teams/workplace/main.mjs, hosts them all, each with its own credentials on both sides. Their manifests ship here, so an
 // organization's file selects them by these names and `rh2 apply-org` reads them with --modules-root SERVICE_REGISTRATIONS.
 export const SERVICE_APPS = ['agents','cards','machines'];
-export const SERVICE_REGISTRATIONS = fileURLToPath(new URL('../teams/workplace/registrations/', import.meta.url));
-export const SERVICE_PROGRAM = fileURLToPath(new URL('../teams/workplace/main.mjs', import.meta.url));
+const SERVICE_ROOT = new URL('./workplace/', import.meta.resolve('@volter/supercode-teams'));
+export const SERVICE_REGISTRATIONS = fileURLToPath(new URL('registrations/', SERVICE_ROOT));
+export const SERVICE_PROGRAM = fileURLToPath(new URL('main.mjs', SERVICE_ROOT));
 const SERVICE_TOKENS = { agents: ['AGENTS_WORKPLACE_TOKEN','AGENTS_TEAMS_TOKEN'], cards: ['CARDS_WORKPLACE_TOKEN','CARDS_TEAMS_TOKEN'], machines: ['MACHINES_WORKPLACE_TOKEN','MACHINES_TEAMS_TOKEN'] };
 export function privateJson(path, value) {
   mkdirSync(dirname(path),{recursive:true,mode:0o700});
@@ -48,14 +49,10 @@ export function generateModuleConfig(root, record, grant) {
   const folder=dirname(connectionPath(root,record.id)), dir=join(folder,grant.name);
   mkdirSync(dir,{recursive:true,mode:0o700});
   const custody=join(dir,'credentials.env'), configPath=join(dir,'config.json');
-  writeFileSync(custody,`RH2_TOKEN=${grant.rh2.accessToken}\n${grant.teams?`TEAMS_TOKEN=${grant.teams.credential.token}\n`:''}`,{mode:0o600});chmodSync(custody,0o600);
-  // The arcs module seats card agents by resolving them in the registration that provides them: the connection's agents.
-  const agents=record.grants.find(g=>g.name==='agents'&&g.clientId), cards=record.grants.find(g=>g.name==='cards'&&g.rh2);
-  const config={rh2:{baseUrl:record.origin,issuer:record.issuer,organization:record.organization,principalId:grant.rh2.principalId,tokenEnv:'RH2_TOKEN',...(agents?{agentsRegistration:agents.clientId}:{}),...(cards?{cardsPrincipalId:cards.rh2.principalId}:{})},
-    teams:{server:record.teams.server,team:record.teams.team,source:record.source,tokenEnv:'TEAMS_TOKEN'},
-    envFile:custody,stateFile:join(dir,'state.json'),defaultFloor:record.floor,
-    source:{key:`connection-${record.scope}`,namespace:`cx${record.scope}`,name:`${record.organization} / ${record.source}`,home:root,...(record.teamsContext?{teamsContext:record.teamsContext}:{}),...(process.env.SUPERCODE_BIN?{program:process.env.SUPERCODE_BIN}:{}),harness:record.harness??'hermes'},
-    alerts:{role:record.alertRole??'admin'},standingFile:join(folder,'standing.json')};
+  writeFileSync(custody,`RH2_TOKEN=${grant.rh2.accessToken}\n`,{mode:0o600});chmodSync(custody,0o600);
+  const config={rh2:{baseUrl:record.origin,issuer:record.issuer,organization:record.organization,tokenEnv:'RH2_TOKEN'},envFile:custody,
+    source:{key:`connection-${record.scope}`,name:`${record.organization} / ${record.source}`,home:root,...(process.env.SUPERCODE_BIN?{program:process.env.SUPERCODE_BIN}:{}),harness:record.harness??'hermes'},
+    alerts:{role:record.alertRole??'admin'}};
   privateJson(configPath,config);
   privateJson(join(root,'apps',`${grant.name}.${record.id}.json`),{app:grant.name,connection:record.id,configPath,moduleRoot:record.moduleRoot,
     origin:record.origin,organizationId:record.organization,principalId:grant.rh2.principalId,installationId:grant.rh2.installationId,expiresAt:grant.rh2.expiresAt});
@@ -105,7 +102,7 @@ export async function connectWorkplace(flags) {
   if(Boolean(flags['webhook-url'])!==Boolean(flags['webhook-listen']))throw new Error('--webhook-url and --webhook-listen go together: where the Workplace sends the agents registration\'s events, and the loopback address the service listens on');
   const moduleRoot=flags['modules-root']?resolve(flags['modules-root']):null;
   // An explicit local credential input is useful for an owned stack; a normal connect uses its existing Teams context.
-  let teams,owner,teamsContext=flags.context??process.env.SUPERCODE_CONTEXT;
+  let teams,owner;
   if(flags['teams-token-file']){
     if(!flags['teams-url']||!flags.team)throw new Error('--teams-token-file needs --teams-url and --team');
     teams={server:new URL(flags['teams-url']).origin,team:flags.team};owner=readFileSync(flags['teams-token-file'],'utf8').trim();
@@ -118,7 +115,7 @@ export async function connectWorkplace(flags) {
     // Asked of the daemon whatever the environment says: a resumed session can lack its launch's SUPERCODE_AGENT_ID,
     // and the daemon's retained binding is what names its agent (workspace.mjs does the same for every Teams verb).
     const env=await agentSessionEnvironment(process.env,agentSessionHint(process.env));
-    teamsContext=agentContextName(contexts,env,flags.context??null);
+    const teamsContext=agentContextName(contexts,env,flags.context??null);
     const {context}=fromContext({supercodeHome:supercodeHome(),name:teamsContext});
     teams={server:context.origin,team:context.team_id};owner=contexts.credential(context.credential_ref).token;
   }
@@ -128,8 +125,8 @@ export async function connectWorkplace(flags) {
   const id=createHash('sha256').update(`${ticket.scope}\0${ticket.issuer}\0${ticket.organization}\0${teams.server}\0${teams.team}\0${flags.source}`).digest('hex').slice(0,24);
   const path=connectionPath(root,id),prior=existsSync(path)?JSON.parse(readFileSync(path,'utf8')):null;
   if(!prior&&!(Date.parse(ticket.expiresAt)>Date.now()))throw new Error('connection ticket expired; apply the organization file again');
-  const record=prior??{version:1,id,scope:ticket.scope,teamsContext,origin:ticket.origin,issuer:ticket.issuer,organization:ticket.organization,teams,source:flags.source,
-    selection:ticket.grants.map(g=>g.name),moduleRoot,...(flags['webhook-url']?{webhook:{url:flags['webhook-url'],listen:flags['webhook-listen']}}:{}),floor:flags.floor??ticket.floor??'Work',alertRole:flags['alert-role']??'admin',grants:[]};
+  const record=prior??{version:1,id,scope:ticket.scope,origin:ticket.origin,issuer:ticket.issuer,organization:ticket.organization,teams,source:flags.source,
+    selection:ticket.grants.map(g=>g.name),moduleRoot,...(flags['webhook-url']?{webhook:{url:flags['webhook-url'],listen:flags['webhook-listen']}}:{}),alertRole:flags['alert-role']??'admin',grants:[]};
   record.root=root;
   if(prior?.disconnectedAt)throw new Error('this connection was disconnected; apply the organization file again for a new ticket');
   // The service's event address is part of the connection: a different one is a new connection, never silently dropped.
@@ -145,15 +142,13 @@ export async function connectWorkplace(flags) {
       return {connection:id,root,modules:record.grants.map(g=>g.name),runner:running.pid,calls:[]};
     }
   }
-  record.standingSelection=flags['standing-file']?JSON.parse(readFileSync(flags['standing-file'],'utf8')):(ticket.grants.find(g=>g.name==='arcs-rooms')?.rooms??[]).map(seat=>({profile:seat.key,roomKey:seat.key,roleKeys:seat.roleKeys}));
-  if(record.standingSelection.some(row=>!/^[-a-z0-9]{1,64}$/.test(row.profile??'')||!/^[-a-z0-9]{1,64}$/.test(row.roomKey??'')||row.session||row.agent))throw new Error('standing selections name a profile and Room key; agent/session ids come from the home');
   // Registry entries may become visible during setup. They are never permission to start a writer.
   record.preparing=true;record.paused=true;
   privateJson(path,record);
   for(const selected of ticket.grants){
     let grant=record.grants.find(g=>g.name===selected.name);
-    if(grant && JSON.stringify([grant.manifest,grant.teamsManifest,grant.rooms])!==JSON.stringify([selected.manifest,selected.teamsManifest,selected.rooms]))throw new Error('existing connection consent differs from the ticket');
-    if(!grant){grant={name:selected.name,clientId:selected.clientId,rooms:selected.rooms,manifest:selected.manifest,teamsManifest:selected.teamsManifest};record.grants.push(grant);privateJson(path,record);}
+    if(grant && JSON.stringify([grant.manifest,grant.teamsManifest])!==JSON.stringify([selected.manifest,selected.teamsManifest]))throw new Error('existing connection consent differs from the ticket');
+    if(!grant){grant={name:selected.name,clientId:selected.clientId,manifest:selected.manifest,teamsManifest:selected.teamsManifest};record.grants.push(grant);privateJson(path,record);}
     if(SERVICE_APPS.includes(grant.name)&&!selected.teamsManifest)throw new Error(`${grant.name}: its Teams manifest is missing from the ticket (apply with --modules-root naming ${SERVICE_REGISTRATIONS})`);
     if(!grant.rh2){
       const recovering=typeof grant.redemption==='string';
@@ -191,7 +186,6 @@ export async function connectWorkplace(flags) {
   if(!record.issuerRegistration){record.issuerStagedSecret??=`sca_${randomBytes(32).toString('base64url')}`;privateJson(path,record);record.issuerRegistration=(await connectionCall(record,'teams','POST',`/api/v1/teams/${encodeURIComponent(teams.team)}/apps`,{name:`Workplace issuer (${id.slice(0,8)})`,description:'The Workplace as a delegated issuer, verified against its JWKS',actions:['delegation.sessions','delegation.surfaces','delegation.notices','delegation.machines'],event_kinds:[],redirect_urls:['http://127.0.0.1/connected'],issuer:record.issuer,secret:record.issuerStagedSecret},owner)).data;privateJson(path,record);}
   if(!record.issuerConsent&&!record.issuerCredential){record.issuerStagedCode??=`sci_${randomBytes(32).toString('base64url')}`;privateJson(path,record);record.issuerConsent=(await connectionCall(record,'teams','POST',`/api/v1/teams/${encodeURIComponent(teams.team)}/apps/${record.issuerRegistration.id}/installations`,{redirect_url:'http://127.0.0.1/connected',state:id,code:record.issuerStagedCode},owner)).data;privateJson(path,record);}
   if(!record.issuerCredential){record.issuerStagedCredential??=newInstallationToken();privateJson(path,record);record.issuerCredential=await connectionCall(record,'teams','POST','/api/v1/apps/token',{app_id:record.issuerRegistration.id,app_secret:record.issuerStagedSecret,code:record.issuerStagedCode,redirect_url:'http://127.0.0.1/connected',credential_token:record.issuerStagedCredential});privateJson(path,record);delete record.issuerConsent;delete record.issuerRegistration.secret;privateJson(path,record);}
-  privateJson(join(dirname(path),'standing.json'),[]);
   record.connectedAt??=new Date().toISOString();
   record.preparing=false;record.paused=Boolean(flags['no-start']);privateJson(path,record);
   const pid=record.paused?null:startConnectionRunner(root,id);

package/cron.mjs

@@ -716,18 +716,28 @@ function reapStaleFires(state, profile, now, effects, limitS) {
     // an ended binding lives under a started_at-qualified slot, so search by the fire it ran
     const binding = Object.values(profile.bindings).find((b) => b.residue?.fire_id === fire.id);
     if (binding && !binding.ended_at) {
+      const ks = surfaceKeyString(binding.key);
+      const lid = leaseId(profile.name, ks);
+      // The lease, the start mark and the activity clock live in this daemon's memory only (§2.8). A run this daemon
+      // holds no worker for, is not starting and has never heard from had its worker on an earlier daemon: a stop
+      // closes every runtime (loop.mjs `stop`) and a crash takes them with it. That run is not silent, it is cut off,
+      // so its session is reopened and told to carry on, rather than timed out against a clock this daemon never kept.
+      if (rt.activity[lid] === undefined && !rt.leases[lid]) {
+        // a re-attach after a crash is in flight (handleRestart): it attaches, or interrupts and the next tick resumes
+        if (!rt.starting[lid]) resumeFire(state, profile, ks, binding, fire, now, effects);
+        continue;
+      }
       // Hermes's inactivity watchdog, transcribed: a worker silent for the
       // limit is a hung run. Without it the fire stays in flight and its job
       // is never due again. Silence counts from the last worker event, the
-      // lease (a reattach after restart starts it afresh) or the claim.
+      // lease, the resume or the claim.
       if (!(limitS > 0)) continue;
-      const ks = surfaceKeyString(binding.key);
-      const lid = leaseId(profile.name, ks);
       const lastAt = [rt.activity[lid], rt.leases[lid]?.since, fire.started_at, fire.claimed_at].filter(Boolean).sort().pop();
       const idle = Math.round((Date.parse(now) - Date.parse(lastAt)) / 1000);
       if (idle < limitS) continue;
       const job = profile.jobs[fire.job_id] ?? null;
-      const why = `no activity from the worker for ${idle}s (limit ${limitS}s, HERMES_CRON_TIMEOUT; last activity ${lastAt}${rt.leases[lid] ? '' : ', the worker never started'}); the run was stopped`;
+      const unstarted = rt.leases[lid] ? '' : fire.residue?.resumed_at ? `, its worker resumed at ${fire.residue.resumed_at} never started` : ', the worker never started';
+      const why = `no activity from the worker for ${idle}s (limit ${limitS}s, HERMES_CRON_TIMEOUT; last activity ${lastAt}${unstarted}); the run was stopped`;
       finishFire(profile, fire, job, 'timeout', now, why, effects);
       deliverResult(state, profile, { job, fire, sub: null }, why, true, now, effects);
       endBinding(state, profile.name, ks, 'error', now, effects); // the fire records the timeout; EndReason is closed
@@ -742,6 +752,46 @@ function reapStaleFires(state, profile, now, effects, limitS) {
   }
 }
 
+/** A run cut off by more restarts than this is failed with that reason rather than resumed again. */
+const MAX_FIRE_RESUMES = 3;
+
+/**
+ * A run whose worker went away with an earlier daemon, picked up by this one: the fire's own session is reopened
+ * (`resume_runtime_id`, which the stop or the failed re-attach recorded; a session that will not reopen starts fresh in
+ * the loop) on the job's worker, and its first line says the run was cut off and carries the job's prompt, so a
+ * reopened session continues and a fresh one does the job whole. Its silence counts from now.
+ */
+function resumeFire(state, profile, ks, binding, fire, now, effects) {
+  const rt = ensureRuntime(state);
+  const lid = leaseId(profile.name, ks);
+  const job = profile.jobs[fire.job_id] ?? null;
+  const cut = `the orchestrator restarted at ${now} while this run was in flight`;
+  const resumes = Number(fire.residue?.resumes ?? 0);
+  const budget = job && profile.worker ? budgetRefusal(state, profile, profile.name, now) : null;
+  const refused = !job ? 'its job is gone'
+    : !profile.worker ? `profile ${profile.name} has no worker configured`
+    : resumes >= MAX_FIRE_RESUMES ? `it was already resumed ${resumes} times (the last at ${fire.residue.resumed_at}), and each time the orchestrator restarted again before it finished`
+    : budget ? `not started: ${budget}` : null;
+  if (refused) {
+    const why = `${cut}, and it was not resumed: ${refused}`;
+    finishFire(profile, fire, job, 'failed', now, why, effects);
+    deliverResult(state, profile, { job, fire, sub: null }, why, true, now, effects);
+    endBinding(state, profile.name, ks, 'error', now, effects, why);
+    if (budget && resumes < MAX_FIRE_RESUMES) effects.push({ type: 'budget_refused', profile: profile.name, agent: profile.name, reason: budget });
+    return;
+  }
+  if (binding.worker.session_id && binding.worker.session_id !== fire.id) binding.residue.resume_runtime_id ??= binding.worker.session_id;
+  fire.residue = { ...(fire.residue ?? {}), resumed_at: now, resumes: resumes + 1 };
+  rt.activity[lid] = now;
+  rt.starting[lid] = true;
+  const text = `[${cut}; this is the same scheduled run, picked up where it stopped] Carry the run on from where it stopped, without redoing what is already done, and end with its final report. The job, as it was given:\n\n${firePrompt(job)}`;
+  (rt.queues[lid] ??= []).push({ text, at: now, context_from: job.context_from ?? null, skills: job.skills ?? [], job_id: job.id });
+  const worker = { ...profile.worker, model: job.model ?? profile.worker.model, cwd: job.workdir ?? profile.worker.cwd };
+  effects.push({ type: 'runtime_start', profile: profile.name, keyString: ks, worker, prompt: text, resume_runtime_id: binding.residue.resume_runtime_id ?? null, agent: profile.name });
+  effects.push({ type: 'log', level: 'info', message: `cron ${profile.name}/${job.residue?.name ?? job.id}: run ${fire.id} lost its worker with an earlier daemon; ${binding.residue.resume_runtime_id ? `reopening ${binding.residue.resume_runtime_id}` : 'starting it afresh'}` });
+  effects.push({ type: 'save' });
+}
+
 /**
  * The fire prompt is the job's prompt; `context_from` (job ids or "self") is
  * carried beside it so the loop, which can read files, prepends those jobs'
@@ -832,6 +882,9 @@ function launchFire(state, profile, job, fire, prompt, now, effects) {
     agent: profile.name, recurrence: { job_id: job.id }, residue: { fire_id: fire.id },
   };
   fire.started_at = now;
+  // this daemon holds the run from its launch: silence counts from here, and the reaper never takes it for a run an
+  // earlier daemon left behind (`resumeFire`)
+  rt.activity[leaseId(profile.name, ks)] = now;
   const worker = { ...profile.worker, model: job.model ?? profile.worker.model, cwd: job.workdir ?? profile.worker.cwd };
   // The prompt rides the queue: `handleWorker`'s `started` case flushes it once
   // the lease exists, the same path an inbound message takes.

package/daemon-control.d.ts

@@ -0,0 +1,39 @@
+export interface DaemonIdentity {
+	pid: number;
+	started_at: string;
+	root: string;
+	host: string | null;
+	boot?: string | null;
+	incarnation: string;
+	launch_request?: string | null;
+}
+export interface DaemonStopReceipt {
+	version: 1;
+	daemon: DaemonIdentity;
+	status: "stopped" | "failed" | "refused";
+	errors: string[];
+}
+export function newDaemonIncarnation(): string;
+export function sameDaemon(a: unknown, b: unknown): boolean;
+export function clearDaemonLease(root: string, lease: DaemonIdentity): void;
+export function requestDaemonStop(
+	root: string,
+	lease: DaemonIdentity,
+	options?: { signal?: AbortSignal; timeoutMs?: number },
+): Promise<DaemonStopReceipt>;
+export function describeDaemon(
+	root: string,
+	lease: DaemonIdentity,
+	options?: { signal?: AbortSignal; timeoutMs?: number },
+): Promise<{
+	version: 1;
+	daemon: DaemonIdentity;
+	status: "running" | "refused";
+	errors: string[];
+}>;
+export function startDaemonControl(options: {
+	root: string;
+	lease: DaemonIdentity;
+	stop: (reason: string) => Promise<DaemonStopReceipt>;
+	complete: () => void;
+}): Promise<{ close(): Promise<void> }>;