@volter/supercode-orchestrator 0.5.215 → 0.5.217

package/README.md

@@ -77,6 +77,14 @@ Other SDK callers that persist runtime state set `preserve_workflow: true` on
 
 ## Board machine-call deadlines
 
+`workflow serve` retains its public socket and kernel lock while dispatcher generations change.
+`workflow handover --entry /absolute/path/to/bin/orchestrator.mjs --supercode /absolute/path/to/native --root HOME`
+prepares a successor through the normal source checks, drains admitted work, and transfers its writer epoch.
+It routes calls only after a clean round and a successful stats reply. The parked predecessor remains available
+for rollback after candidate loss. A request already sent to a lost generation returns an unknown outcome and
+is never replayed. This source mechanism still needs the complete machine release integration and recorded
+qualification described in [ADR 0080](../../docs/adr/0080-serving-generation-handovers.md).
+
 The board owner's machine calls share one timeout budget across channel admission,
 node or harness admission, and the method request. A call whose admission expires
 never sends the method after its caller has stopped waiting. It leaves the owner's
@@ -109,6 +117,11 @@ retains a separate partial file and reports its path; there is no automatic resu
 The board host needs an orchestrator that serves `attachment-read` and its normal
 running board owner. Remote reads keep the board door's caller and grant checks.
 
+A card's published snapshot lists its attachments (`attachments`: each `{ id, name, content_type, size, by, at }`,
+never where the board keeps it), and attaching or removing a file publishes the card, so an integration that reads only
+the board (runhuman-2 ADR 0063 decision 3: Project Rooms reposting a card's images and videos) learns of a new file from
+the card's change and reads its bytes through the board door with `attachment-get` or `attachment-read`.
+
 `workflow attachment-read <card> <attachment-id>` returns JSON with at most 1 MiB
 of `content_base64`, metadata, offsets, `eof` and a filesystem metadata `version`.
 Subsequent reads pass `--offset`, `--length` and the first response's `--version`.
@@ -326,7 +339,8 @@ await orch.tick();                           // the same, on the orchestrator's
   job's `last_delivery_error`; a delivery that finally fails writes it.
 - A fire whose worker has been silent for `HERMES_CRON_TIMEOUT` seconds (600 by default, 0 for no
   limit, as in Hermes) is closed as a timeout, its failure delivered, and its runtime closed; before,
-  a hung fire kept its job from ever running again.
+  a hung fire kept its job from ever running again. A fire in flight when the daemon stopped or crashed
+  is not that: the next daemon reopens its session and tells it to carry the run on.
 - A job's `model` (and a profile's, and `/model`'s) reaches the worker's launch (`claude --model`,
   `codex app-server -c model=…`, `gemini -m`). For a harness with no such flag it is refused where it is
   set (`/model`, `jobs.create|update`, `cronjob_create`) and again at the start, rather than run on
@@ -366,8 +380,16 @@ await orch.tick();                           // the same, on the orchestrator's
   decided goes to the job's `failure_deliver`, else `deliver`, else home (a webhook's: its
   `deliver`). A chat's prompt is still relayed to the chat.
 - A Codex worker asks only when started with an approval policy: where the profile keeps Hermes's
-  approvals (`approvals.mode` unset or not `off`) it starts with `approval_policy: untrusted`, so it asks
-  before every command and Hermes's rule answers; with approvals off it asks nothing.
+  approvals (`approvals.mode` unset or not `off`) it starts with `approval_policy: untrusted` and
+  `approvals_reviewer: user` on its thread (`APPROVAL_POLICY`, `APPROVALS_REVIEWER`), so it asks before
+  every command and Hermes's rule answers, whatever reviewer the worker's config names. A headful
+  main takes its policy on Codex's CLI, which refuses `untrusted` (codex-cli 0.163.0), so it starts
+  with `--ask-for-approval on-request -c approvals_reviewer="user"` (`MAIN_ASKING_ARGUMENTS`): what Codex
+  asks about comes to a person. With approvals off it asks no person: it starts with
+  `approval_policy: on-request`, sandbox `danger-full-access` and Codex's auto-reviewer
+  (`approvals_reviewer = "auto_review"`) under an `auto_review.policy` that approves every request
+  (`OPEN_POLICY`, `OPEN_ARGUMENTS` in `activation.mjs`). It never starts with `never`, under which
+  Codex refuses outright any command its own check flags as dangerous.
 
 ```yaml
 worker:
@@ -490,10 +512,14 @@ daemon start attaches the `rh2` channel for that profile. Uninstalling in RH2 re
 the channel stops. A `platforms: rh2` block grants no integration authority and the runtime reports
 it as unsupported. Native Hermes channel configuration remains the worker's configuration.
 
-A mail agent the RH2 organization declares is one participant there, as its own agent principal: an admin issues that
-agent a token at RH2's agent-token door, and the home keeps it for the agent's channel, which then joins its Room's
-conversation answering every line. The record names the one agent it is (`--agent`, its Teams id): it is mounted in
-that agent's own sessions as the `rh2-agent` MCP server, and never in another agent's that shares its name or profile:
+A mail agent the RH2 organization declares is one participant there, as its own agent principal, with one record per
+Workplace in the home: the Agents → Room agents integration (`sdk/teams/workplace`, `launch.root`) provisions one for
+every agent it provides, the token of its principal minted at RH2's agent-token door on that registration's own
+installation (`rh2-agent.<agent id>@<Workplace host>`, renewed before it lapses, revoked when Teams ends the agent); one
+can also be kept by hand. Every session of the agent acts through them (the `rh2` CLI and MCP read the record for the
+Workplace each call goes to, from `RH2_AGENT_HOMES`), the agent's channel joins its Room's conversation on its record,
+and orchestrator-launched sessions mount them as the `rh2-agent` MCP server, never in another agent's that shares its
+name or profile. Kept by hand:
 
 ```sh
 supercode orchestrator apps install rh2-agent --origin https://pilot.runhuman.com --organization volter \
@@ -613,7 +639,39 @@ lock names a live process on this machine, since this boot, is refused; a lock n
 that is **gone**, or one another machine or an earlier boot wrote (a home on a volume the
 sandbox before this one mounted), is the mark of a daemon that died, and the daemon dispatches
 `restart` (§4.7) before it accepts anything. Nothing is signalled on the word of a lock from
-elsewhere. `leaseIsLive` and `readLease` are the package's reading of it. A clean stop removes its own lock, so an ordinary start replays nothing.
+elsewhere. `leaseIsLive` and `readLease` are observations; PID liveness never
+authorizes stop. A clean stop removes its own lock, so an ordinary start replays nothing.
+
+`supercode orchestrator stop --root <home> [--json]` requests the daemon's
+incarnation-bound local control socket. Its issued lease names the canonical
+home, host, boot and random incarnation. The daemon checks that exact record
+before accepting shutdown, joins its owners and removes only its own unchanged
+lease. The CLI sends no PID signal and deletes no lease. Old leases without an
+incarnation refuse; their actual process/service owner retains shutdown authority.
+JSON results name the selected daemon and `stopped`, `failed` or `refused`.
+Lost replies or a five-second deadline report an unknown outcome and retain the
+incarnation; there is no automatic retry. Shutdown continues in the daemon.
+Successful completion concerns that incarnation; a service manager may launch a
+successor. See the [stop contract](../../docs/adr/0165-the-complete-orchestrator-entry-is-owned-by-node.md#stop-names-the-issued-daemon-2026-10-19-t_b37f54c7).
+Foreground start reports that same actual daemon only after its live control
+door confirms the invocation's issued lease. A gateway re-exec never turns the
+launcher PID into an invented daemon lease; unconfirmed startup refuses.
+Channel close retains the actual Chat SDK platform/state disconnect results,
+including failures swallowed by `chat@4.39.0` itself, and joins the owned gateway
+and its pending work. A failed channel keeps its token claim and yields failed
+stop/exit status; it cannot become `stopped` merely because SDK shutdown fulfilled.
+The daemon retains its lease on cleanup failure. Passive webhook bodies are
+cancelled on close while complete-body handlers already admitted are joined.
+Ingress closes before adapter connection waits. Already-admitted bodies keep
+their processing authority through asynchronous signature verification and are
+joined before the loop's stopping event. Direct-delivery HTTP 202 follows dispatch
+and persistence. Worker-backed HTTP 202 also waits for actual runtime input
+handoff; a memory queue alone receives no success acknowledgement. Stop refuses
+unsent input with retryable HTTP 503, joins sends already in progress, drains
+internal completion events and records interrupted handed turns before teardown.
+Refusal removes only that unhanded input's queue/turn and dedup entry, permitting
+retry. Concurrent matching delivery IDs share the handoff result. Intentional
+refusal permits clean stop; actual processing/cleanup failures still fail close.
 
 On `restart`: every pending obligation goes out again, and every binding that held a lease is
 re-opened. The lease table is never persisted (§2.8), so a lease start records `runtime_id` on the
@@ -623,7 +681,11 @@ binding's residue; the loop tries `runtimes.attach_existing` where the harness's
 mark without the notice — nobody is reading them.
 
 The repo's Hermes fixture home (`crates/harness/fixtures/hermes_home`) is a ready home to drive it
-against by hand; that needs `target/debug/supercode` built.
+against by hand after the source tree's locked SDK dependencies are installed.
+The source orchestrator selects that tree's Node front door; it requires no
+debug native build. A source lock must explicitly bind Node at its exact root,
+version and commit. Legacy native-bound declarations refuse until explicitly
+re-pinned; no source lock or installed service is migrated by a command start.
 
 ## Board session cleanup
 

package/activation.mjs

@@ -8,6 +8,7 @@ import { mkdirSync, readFileSync, readdirSync, lstatSync, rmSync, writeFileSync,
 import { CLAUDE_BRIDGE, linkTo, skillSources } from './hermes-home.mjs';
 import { ownLogin } from './worker-route.mjs';
 import { execFile } from 'node:child_process';
+import { supercodeInvocation } from '@volter/supercode-harness-sdk/supercode-program';
 
 /** Which env var each harness reads its config home from (supercode registry evidence). */
 export const HOME_ENV = Object.freeze({
@@ -66,7 +67,8 @@ export function declareWorkerHome({ harness, env, cwd, log = () => {} }) {
   const home = ['codex', 'claude-code'].includes(harness) ? env?.[HOME_ENV[harness]] : null;
   if (!home || declaredHomes.has(`${harness}\0${home}\0${cwd}`)) return;
   declaredHomes.add(`${harness}\0${home}\0${cwd}`);
-  execFile(process.env.SUPERCODE_BIN || 'supercode', ['teams', 'roots', 'home', 'add', home, '--harness', harness, '--cwd', cwd, '--json'], { timeout: 30_000 }, (error, _stdout, stderr) => {
+  const selected = supercodeInvocation(process.env.SUPERCODE_BIN || 'supercode', ['teams', 'roots', 'home', 'add', home, '--harness', harness, '--cwd', cwd, '--json']);
+  execFile(selected.program, selected.arguments, { timeout: 30_000 }, (error, _stdout, stderr) => {
     if (!error) return;
     declaredHomes.delete(`${harness}\0${home}\0${cwd}`);
     log('warn', `worker home ${home} not declared to this machine's connector: ${String(stderr || error.message).trim().split('\n').at(-1)}`);
@@ -104,7 +106,10 @@ export function declareWorkerFolder({ cwd, root, profile = null, profileDirs = [
   const held = coveredFolders.get(folder);
   if (held && (held.until === undefined || Date.now() < held.until)) return held.answer;
   const program = process.env.SUPERCODE_BIN || 'supercode';
-  const run = (args) => new Promise((done) => execFile(program, args, { timeout: 30_000 }, (error, stdout, stderr) => done({ error, stdout, stderr })));
+  const run = (args) => {
+    const selected = supercodeInvocation(program, args);
+    return new Promise((done) => execFile(selected.program, selected.arguments, { timeout: 30_000 }, (error, stdout, stderr) => done({ error, stdout, stderr })));
+  };
   const said = (answer) => String(answer.stderr ?? '').trim().split('\n')
     .filter((line) => line && !/^\(node:\d+\) ExperimentalWarning: SQLite|^\(Use `node --trace-warnings/.test(line)).at(-1)
     ?? (answer.error?.code != null ? `exited ${answer.error.code}` : 'failed');
@@ -308,21 +313,36 @@ export function modelArguments(worker) {
  * Where each harness takes an approval policy at start (the harness SDK's `approval_policy`, Codex's
  * `approvalPolicy` on `thread/start` and `thread/resume`): `untrusted` asks before every command, and the
  * orchestrator answers each ask with Hermes's approval rule (loop.mjs `onWorkerEvent`). Codex takes no such
- * policy from its config (`approval_policy = "untrusted"` in `config.toml` stops its app server: measured).
+ * policy from its config (`approval_policy = "untrusted"` in `config.toml` stops its app server: measured); its
+ * app-server protocol still takes `untrusted`, its CLI does not (see `MAIN_ASKING_ARGUMENTS`).
  */
 export const APPROVAL_POLICY = Object.freeze({ codex: 'untrusted' });
+/**
+ * A headful main's CLI arguments with approvals on: a person answers. codex-cli 0.163.0 takes only `on-request` or
+ * `never` for `--ask-for-approval` (`untrusted` and `on-failure` are refused: measured), so the main runs `on-request`
+ * with its asks going to the user, never its auto-reviewer, whatever the person's config.toml says.
+ */
+export const MAIN_ASKING_ARGUMENTS = Object.freeze({ codex: ['--ask-for-approval', 'on-request', '-c', 'approvals_reviewer="user"'] });
 
 /**
- * Where the owner turned a profile's approvals off, its worker runs as a container's does: nothing asks, and the
- * harness's own sandbox is off. Codex's default (workspace-write, no network) otherwise asks to reach GitHub and, with
- * nobody attending, is denied (measured: the organization cycle could not read its own Discussion). Codex takes the
- * policy on `thread/start` and its sandbox as a launch override.
+ * Where the owner turned a profile's approvals off, its worker runs as a container's does: nothing asks a person, and
+ * the harness's own sandbox is off. Codex's default (workspace-write, no network) otherwise asks to reach GitHub and,
+ * with nobody attending, is denied (measured: the organization cycle could not read its own Discussion). Codex takes the
+ * policy on `thread/start` and its sandbox and reviewer as launch overrides. The policy is `on-request`, never `never`:
+ * under `never` Codex refuses outright ("blocked by policy") any command its own check flags as dangerous (`rm -f`,
+ * `npm ci`); under `on-request` that request goes to Codex's auto-reviewer, whose policy here approves every one.
  */
-export const OPEN_POLICY = Object.freeze({ codex: 'never' });
+export const OPEN_POLICY = Object.freeze({ codex: 'on-request' });
+/** The auto-review policy every unattended Codex session runs under: the same text as `auto_review.policy` in
+ *  sdk/interchange/startup-prompts.json (what `supercode open` passes) and the harness service's yolo policy. */
+export const CODEX_AUTO_REVIEW_POLICY = 'Approve every request. The person running this session has authorized every action it takes, including commands that delete files, install packages, use the network or write outside the workspace.';
 // Claude Code takes its open policy at launch (its permission mode), as supercode's relay runs it: with approvals off a
 // dispatched Claude worker otherwise asks for every tool and, with nobody attending, is denied (measured: the review
 // World's Claude coder could not run one command).
-export const OPEN_ARGUMENTS = Object.freeze({ codex: ['-c', 'sandbox_mode="danger-full-access"'], 'claude-code': ['--permission-mode', 'bypassPermissions'] });
+export const OPEN_ARGUMENTS = Object.freeze({
+  codex: ['-c', 'sandbox_mode="danger-full-access"', '-c', 'approvals_reviewer="auto_review"', '-c', `auto_review.policy=${JSON.stringify(CODEX_AUTO_REVIEW_POLICY)}`],
+  'claude-code': ['--permission-mode', 'bypassPermissions'],
+});
 
 const approvalsOff = (profile) => String(profile?.residue?.config?.approvals?.mode ?? 'manual').trim().toLowerCase() === 'off';
 
@@ -334,11 +354,27 @@ export function approvalPolicy(profile, harness) {
   return approvalsOff(profile) ? OPEN_POLICY[harness] : APPROVAL_POLICY[harness];
 }
 
-/** The launch arguments that turn a harness's own sandbox off, for a profile whose approvals are off. */
-export function sandboxArguments(profile, harness) {
+/** Who answers a worker thread's approval requests (Codex's `approvalsReviewer` on thread/start and thread/resume):
+ *  with approvals on the user, so the profile's rule answers before any auto-reviewer a worker's config names; with
+ *  approvals off Codex's auto-reviewer, as `OPEN_ARGUMENTS` sets on its launch. */
+export const APPROVALS_REVIEWER = Object.freeze({ codex: 'user' });
+export const OPEN_APPROVALS_REVIEWER = Object.freeze({ codex: 'auto_review' });
+export function approvalsReviewer(profile, harness) {
+  return (approvalsOff(profile) ? OPEN_APPROVALS_REVIEWER : APPROVALS_REVIEWER)[harness] ?? null;
+}
+
+/** The launch arguments that go with a worker's approval policy where the profile's approvals are off: the harness's
+ *  own sandbox off and (Codex) its auto-reviewer approving every request. */
+export function modeArguments(profile, harness) {
   return approvalsOff(profile) ? [...(OPEN_ARGUMENTS[harness] ?? [])] : [];
 }
 
+/** A headful Codex main's approval arguments on its CLI: the open policy and its arguments with approvals off, a
+ *  person answering with approvals on (`MAIN_ASKING_ARGUMENTS`). */
+export function mainApprovalArguments(profile) {
+  return approvalsOff(profile) ? ['--ask-for-approval', OPEN_POLICY.codex, ...OPEN_ARGUMENTS.codex] : [...MAIN_ASKING_ARGUMENTS.codex];
+}
+
 /**
  * Hermes `resolve_turn_limit`: the profile's `agent.max_turns` as a positive
  * cap, or null for unlimited (Hermes's default; `none`, `inf`, 0, -1 and

package/adapters/chat-sdk.mjs

@@ -179,6 +179,28 @@ export class ChatSdkAdapter {
     this.emit = null;
     /** thread_id -> the live `Thread`, so `send` posts through the SDK's own door. */
     this.threads = new Map();
+    this.chats = new Set();
+    this.disconnects = new Map();
+  }
+
+  // chat@4.39.0 logs platform disconnect rejections and fulfills shutdown().
+  // Observe the actual lifecycle door, preserving its receiver and original
+  // rejection. SDK shutdown and our final join share ONE physical disconnect.
+  ownDisconnect(owner, name) {
+    if (!owner || typeof owner.disconnect !== 'function' || this.disconnects.has(owner)) return;
+    const original = owner.disconnect;
+    let result;
+    const disconnect = (...args) => result ??= Promise.resolve().then(() => original.apply(owner, args));
+    owner.disconnect = disconnect;
+    this.disconnects.set(owner, { name, disconnect });
+  }
+
+  ownChat(chat) {
+    this.chats.add(chat);
+    this.ownDisconnect(this.sdkAdapter, `platform ${this.platform}`);
+    // Public SDK doors also cover an already-built Chat supplied by a client.
+    for (const name of Object.keys(chat.webhooks ?? {})) this.ownDisconnect(chat.getAdapter?.(name), `platform ${name}`);
+    this.ownDisconnect(chat.getState?.(), 'state');
   }
 
   /** The block's `extra:` map, whose keys the loader prefixes with `extra.` (the world codec's channel decoder). */
@@ -294,15 +316,20 @@ export class ChatSdkAdapter {
    * and a follow-up in a subscribed thread all become one `inbound`.
    */
   async connect(emit) {
+    if (this.closePromise) throw new Error('chat-sdk adapter is closing');
     this.emit = emit;
     if (!this.chat) {
       try {
         const { Chat } = await import(/* @vite-ignore */ CHAT_SDK_PACKAGE);
         const sdkAdapter = this.sdkAdapter ?? (await this.buildSdkAdapter());
         this.sdkAdapter = sdkAdapter;
+        // Retain custody even if constructing/initializing Chat fails.
+        this.ownDisconnect(sdkAdapter, `platform ${this.platform}`);
+        const state = await this.buildState();
+        this.ownDisconnect(state, 'state');
         this.chat = new Chat({
           adapters: { [sdkAdapter.name]: sdkAdapter },
-          state: await this.buildState(),
+          state,
           // F4 finding 11: the IR owns the queue, so the SDK's is off by default
           concurrency: this.extra('concurrency', 'concurrent'),
           logger: this.extra('logger', 'silent'),
@@ -320,6 +347,7 @@ export class ChatSdkAdapter {
         return { state: 'down', error: error.message, configured: false };
       }
     }
+    this.ownChat(this.chat);
     if (!this.handlersOn) {
       // registered once: a retried connect must not answer each message twice
       const handle = (thread, message) => this.handle(thread, message);
@@ -357,15 +385,25 @@ export class ChatSdkAdapter {
       while (!abort.signal.aborted && typeof this.sdkAdapter?.startGatewayListener === 'function') {
         const tasks = [];
         const began = Date.now();
-        let why = null;
+        const errors = [];
         try {
-          const res = await this.sdkAdapter.startGatewayListener({ waitUntil: (task) => { tasks.push(task); } }, GATEWAY_SLICE_MS, abort.signal);
-          if (res && typeof res.status === 'number' && res.status >= 400) why = `the listener answered ${res.status}`;
-          await Promise.allSettled(tasks);
+          const res = await this.sdkAdapter.startGatewayListener({ waitUntil: (task) => {
+            const pending = Promise.resolve(task);
+            void pending.catch(() => {}); // the slice owns and joins it below
+            tasks.push(pending);
+          } }, GATEWAY_SLICE_MS, abort.signal);
+          if (res && typeof res.status === 'number' && res.status >= 400) errors.push(new Error(`the listener answered ${res.status}`));
         } catch (error) {
-          why = error.message;
+          errors.push(error);
+        }
+        // Join waitUntil work even when the listener itself rejected.
+        for (const result of await Promise.allSettled(tasks)) if (result.status === 'rejected') errors.push(result.reason);
+        if (abort.signal.aborted) {
+          const failed = errors.filter(error => error !== abort.signal.reason && error?.cause !== abort.signal.reason);
+          if (failed.length) throw new AggregateError(failed, failed.map(error => String(error?.message ?? error)).join('; '));
+          break;
         }
-        if (abort.signal.aborted) break;
+        const why = errors.length ? errors.map(error => String(error?.message ?? error)).join('; ') : null;
         // a slice that ended well before its time (a refused login, a
         // dropped socket) is retried with backoff, never in a tight loop
         if (why || Date.now() - began < GATEWAY_SLICE_MS * 0.9) {
@@ -380,7 +418,9 @@ export class ChatSdkAdapter {
         } else backoff = 0;
       }
     };
-    void run().catch((error) => this.log('error', `chat-sdk ${this.platform}: gateway: ${error.message}`));
+    this.gatewayTask = run();
+    // Keep the original rejected promise for close(), even before it joins.
+    void this.gatewayTask.catch(() => {});
   }
 
   /**
@@ -392,7 +432,8 @@ export class ChatSdkAdapter {
     if (!this.emit) throw new Error('chat-sdk adapter is not connected');
     const inbound = toInbound({ profile: this.profile, thread, message });
     // one message reaches several handlers (a mention in a free channel): it is one turn
-    const seen = (this.seen ??= new Set());
+    this.seen ??= new Set();
+    const seen = this.seen;
     if (seen.has(inbound.message_id)) return undefined;
     if (!this.admitDiscord(inbound, unmentioned)) return undefined;
     seen.add(inbound.message_id);
@@ -408,11 +449,12 @@ export class ChatSdkAdapter {
    */
   discordRules() {
     if (this.rules !== undefined) return this.rules;
-    if (String(this.extra('slug', this.platform)) !== 'discord') return (this.rules = null);
+    if (String(this.extra('slug', this.platform)) !== 'discord') { this.rules = null; return this.rules; }
     const file = this.profileDir ? join(this.profileDir, '.env') : null;
     const env = file && existsSync(file) ? parseDotenv(readFileSync(file, 'utf8')) : new Map();
     const list = (name) => new Set(String(env.get(name) ?? process.env[name] ?? '').split(',').map((v) => v.trim()).filter(Boolean));
-    return (this.rules = { allowed: list('DISCORD_ALLOWED_CHANNELS'), ignored: list('DISCORD_IGNORED_CHANNELS'), free: list('DISCORD_FREE_RESPONSE_CHANNELS') });
+    this.rules = { allowed: list('DISCORD_ALLOWED_CHANNELS'), ignored: list('DISCORD_IGNORED_CHANNELS'), free: list('DISCORD_FREE_RESPONSE_CHANNELS') };
+    return this.rules;
   }
 
   /** Whether Hermes's Discord adapter would take this message: DMs always; else not ignored, allowed, and mentioned unless free. */
@@ -471,12 +513,37 @@ export class ChatSdkAdapter {
     return this.sdkAdapter.encodeThreadId({ guildId: '@me', channelId: chat });
   }
 
-  async close() {
+  close() {
+    this.closePromise ??= this.closeOwned();
+    return this.closePromise;
+  }
+
+  async closeOwned() {
     this.gateway?.abort();
-    this.gateway = null;
     this.emit = null;
     this.threads.clear();
-    try { await this.chat?.shutdown(); } catch (error) { this.log('warn', `chat-sdk shutdown: ${error.message}`); }
-    if (this.tokenLock) { releaseTokenLock(this.tokenLock); this.tokenLock = null; }
+    if (this.chat) this.ownChat(this.chat);
+    const sdkErrors = [];
+    for (const chat of this.chats) {
+      try { await chat.shutdown(); } catch (error) { sdkErrors.push(error); }
+    }
+    const errors = [], seen = new Set();
+    const attempt = async (name, work) => {
+      try { await work(); }
+      catch (error) {
+        if (seen.has(error)) return;
+        seen.add(error);
+        errors.push(new Error(`${name}: ${String(error?.message ?? error)}`, { cause: error }));
+      }
+    };
+    // Rejoin the SDK's actual disconnects, including rejections it swallowed,
+    // and attempt any owner it never reached. No disconnect is issued twice.
+    for (const { name, disconnect } of this.disconnects.values()) await attempt(name, disconnect);
+    for (const error of sdkErrors) await attempt('SDK shutdown', () => { throw error; });
+    await attempt('gateway', () => this.gatewayTask);
+    this.gateway = null;
+    // A failed physical owner must not be presented as a released token claim.
+    if (!errors.length && this.tokenLock) await attempt('token lock', () => { releaseTokenLock(this.tokenLock); this.tokenLock = null; });
+    if (errors.length) throw new AggregateError(errors, errors.map(error => error.message).join('; '));
   }
 }

package/adapters/rh2.mjs

@@ -1,16 +1,17 @@
 // The RH2 adapter: a Runhuman Room conversation as an ordinary channel, the
 // same three-method trait as every adapter — connect(emit) / send(target,
 // content) / close(). The orchestrator holds an RH2 session (the bot
-// principal's automation token), is a member of the Rooms it follows and a
-// participant of their conversations, and reads and answers there the way it
-// does in a Slack channel. RH2's own rule keeps a coding seat and this loop
+// principal's automation token), reads the Rooms it may read and answers
+// every line its conversation participation asks for only in a Room it was
+// brought into by the join command (RH2's `broughtIn` on the Room's members),
+// elsewhere only a line naming it, the way it does in a Slack channel. RH2's own rule keeps a coding seat and this loop
 // from answering each other: a seat is never woken by an agent's message, and
 // this adapter turns only a person's line (kind `human`, or a trigger's
 // `automation`) into an `inbound`.
 //
 // Doors (RH2 `/api/v3`, bearer + `x-rh2-organization`):
 //   GET  /rooms                                            the Rooms to follow
-//   GET  /rooms/:room/view                                 members (names), conversations (permissions, nextSequence)
+//   GET  /rooms/:room/view                                 members (names, broughtIn), conversations (permissions, nextSequence)
 //   GET  /rooms/:room/conversations/:c/messages?after=&limit=
 //   POST /rooms/:room/conversations/:c/messages            {body, correlationId, kind: "agent", parentMessageId?}
 //   PATCH /rooms/:room/conversations/:c/messages/:id        {body} — a streamed reply grows, a progress line updates, by edit
@@ -49,8 +50,8 @@ export class Rh2Adapter {
     this.running = false;
     /** conversation id -> { roomId, after } */
     this.cursors = new Map();
-    /** room id -> { name, names: Map<principalId, displayName>, conversations: Map<id, name>, seated: whether the Workplace
-     * delivers this Room's lines to this principal's own session } */
+    /** room id -> { name, names: Map<principalId, displayName>, conversations: Map<id, { name, answers }>, seated: whether the
+     * Workplace delivers this Room's lines to this principal's own session } */
     this.rooms = new Map();
     /** message id -> the root of the thread it is in (its own id for a root). */
     this.threadOf = new Map();
@@ -159,6 +160,9 @@ export class Rh2Adapter {
       const room = view.room ?? {};
       if (room.state && room.state !== 'active') continue;
       const names = new Map((view.members ?? []).filter((m) => m.principalId).map((m) => [String(m.principalId), String(m.displayName ?? m.principalId)]));
+      // Whether this principal is in the Room is RH2's own answer: brought in by the join command (`broughtIn`, runhuman-2
+      // ADR 0063). Only then does it take the lines its channel participation asks for; elsewhere, only those naming it.
+      const broughtIn = (view.members ?? []).some((m) => String(m.principalId) === this.principalId() && m.broughtIn === true);
       // Where this principal's own seat carries a session, the Workplace delivers the Room's lines to that session itself
       // (runhuman-2 ADR 0046 decision 4); this adapter then hands none of them on, so no line reaches it twice.
       const seated = (view.members ?? []).some((m) => String(m.principalId) === this.principalId() && m.sessionBinding);
@@ -166,7 +170,7 @@ export class Rh2Adapter {
       for (const conversation of view.conversations ?? []) {
         if (!conversation.conversationId || !(conversation.permissions ?? []).includes('conversation.read')) continue;
         const participation = (conversation.agentParticipants ?? []).find((p) => String(p.principalId) === this.principalId());
-        conversations.set(conversation.conversationId, { name: String(conversation.name ?? conversation.conversationId), answers: participation?.answers ?? null });
+        conversations.set(conversation.conversationId, { name: String(conversation.name ?? conversation.conversationId), answers: broughtIn ? participation?.answers ?? null : null });
         live.add(conversation.conversationId);
         if (!this.cursors.has(conversation.conversationId)) {
           // At start, a conversation is read from its current end: no backlog is answered. One that becomes

package/agents.mjs

@@ -251,7 +251,7 @@ export function renameCardAgent(root, assignment, readableId) {
 }
 /** The id a home's mail agent runs as, read and never minted: its own declared identity (`agent/<name>`) where the home
  * holds one, else its profile's (`profile/<profile>`), as localProfileAgent keys them, each at its current generation.
- * Null when the home holds neither, or has no agent store. A channel names its agent by this id (agent-channel). */
+ * Null when the home holds neither, or has no agent store. */
 export function homeAgentId(root,{org,server,name,profile=name}){
   if(!existsSync(join(root,'agent-state.sqlite')))return null;
   const db=store(root);
@@ -512,7 +512,3 @@ export function agentEnvironment(agent,{root,context,session=null,main=true}={})
     ...(session?{SUPERCODE_AGENT_SESSION:session}:{})};
 }
 
-/** A standing profile's conversation runtime; scheduled/card runs never select its conversation. */
-export function localAgentConversation(root,org,id){
-  const db=store(root);try{return db.prepare('SELECT session_ref session,started_at,ended_at FROM agent_runs WHERE org=? AND agent_id=? AND conversation=1 ORDER BY (ended_at IS NULL) DESC,started_at DESC,rowid DESC LIMIT 1').get(org,id)??null;}finally{db.close();}
-}