@volter/supercode-orchestrator 0.5.225 → 0.5.227

package/connection.mjs

@@ -1,9 +1,9 @@
 // The kit's connection coordinator. Module manifests and programs belong to their application publisher.
-import { chmodSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, copyFileSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { createHash, randomBytes } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawn } from 'node:child_process';
+import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import { fromContext } from '@volter/teams/context';
 import { supercodeHome } from '@volter/teams/home';
 
@@ -36,7 +36,7 @@ export async function connectionCall(record, side, method, path, body, token) {
   const text=await response.text();
   record.calls??=[];record.calls.push({side,method,path,status:response.status,ms:Date.now()-began,bytes:Buffer.byteLength(text)});record.calls=record.calls.slice(-200);
   let payload;try{payload=text===''&&response.status===204?{}:JSON.parse(text);}catch{throw new Error(`${side} ${method} ${path}: invalid JSON (${response.status})`);}
-  if(!response.ok)throw Object.assign(new Error(`${side} ${method} ${path}: ${payload.error?.code??response.status}`),{code:payload.error?.code,status:response.status});
+  if(!response.ok)throw Object.assign(new Error(`${side} ${method} ${path}: ${payload.error?.code??response.status}`),{code:payload.error?.code,status:response.status,detail:typeof payload.error?.message==='string'?payload.error.message:null});
   return payload;
 }
 /** A registration that trusts a Workplace as its issuer trusts this connection's Workplace and organization, never the
@@ -46,6 +46,7 @@ export function trustedIssuer(manifest,record){return manifest.issuer===undefine
 export function connectionPath(root,id){return join(root,'apps','connections',id,'connection.json');}
 export function generateModuleConfig(root, record, grant) {
   if(SERVICE_APPS.includes(grant.name))return generateServiceConfig(root,record,grant);
+  if(grant.adopted)return generateAdoptedConfig(root,record,grant);
   const folder=dirname(connectionPath(root,record.id)), dir=join(folder,grant.name);
   mkdirSync(dir,{recursive:true,mode:0o700});
   const custody=join(dir,'credentials.env'), configPath=join(dir,'config.json');
@@ -58,8 +59,22 @@ export function generateModuleConfig(root, record, grant) {
     origin:record.origin,organizationId:record.organization,principalId:grant.rh2.principalId,installationId:grant.rh2.installationId,expiresAt:grant.rh2.expiresAt});
   return configPath;
 }
+/** An adopted module's config is its own, as it ran (adoptWorkplaceService): only its custody (the token names it reads,
+ * now holding the connection's current tokens) and its state move into the connection. */
+function generateAdoptedConfig(root, record, grant) {
+  const dir=join(dirname(connectionPath(root,record.id)),grant.name);
+  mkdirSync(dir,{recursive:true,mode:0o700});
+  const custody=join(dir,'credentials.env'), configPath=join(dir,'config.json');
+  writeFileSync(custody,`${grant.config.rh2.tokenEnv}=${grant.rh2.accessToken}\n${grant.teams?`${grant.config.teams.tokenEnv}=${grant.teams.credential.token}\n`:''}`,{mode:0o600});chmodSync(custody,0o600);
+  privateJson(configPath,{...grant.config,envFile:custody,...(grant.config.stateFile?{stateFile:join(dir,'state.json')}:{})});
+  privateJson(join(root,'apps',`${grant.name}.${record.id}.json`),{app:grant.name,connection:record.id,configPath,program:grant.program,adopted:true,
+    origin:record.origin,organizationId:record.organization,principalId:grant.rh2.principalId,installationId:grant.rh2.installationId,expiresAt:grant.rh2.expiresAt});
+  return configPath;
+}
 /** The Workplace service's config and custody, written from the connection alone (no hand-written config): every installed
- * service registration's credentials, ids and state, and the home's registry entry for `grant`. One config serves all. */
+ * service registration's credentials, ids and state, and the home's registry entry for `grant`. One config serves all.
+ * A connection's keys are made under its namespace (`cx<scope>`); an adopted service (adoptWorkplaceService) has no scope
+ * and keeps the unqualified keys its installations have always written, with the settings it ran with. */
 export function generateServiceConfig(root, record, grant) {
   const folder=dirname(connectionPath(root,record.id)), dir=join(folder,'service');
   mkdirSync(dir,{recursive:true,mode:0o700});
@@ -68,18 +83,23 @@ export function generateServiceConfig(root, record, grant) {
   writeFileSync(custody,Object.entries(held).map(([name,g])=>`${SERVICE_TOKENS[name][0]}=${g.rh2.accessToken}\n${SERVICE_TOKENS[name][1]}=${g.teams.credential.token}\n`).join(''),{mode:0o600});chmodSync(custody,0o600);
   const agents=held.agents;
   if(agents){
-    const section=name=>({registration:held[name].clientId,principal:held[name].rh2.principalId,tokenEnv:SERVICE_TOKENS[name][0],teamsTokenEnv:SERVICE_TOKENS[name][1],stateFile:join(dir,`${name}.state.json`)});
+    const section=name=>({registration:held[name].clientId,principal:held[name].rh2.principalId,tokenEnv:SERVICE_TOKENS[name][0],teamsTokenEnv:SERVICE_TOKENS[name][1],stateFile:join(dir,`${name}.state.json`),...record.settings?.[name]});
     const config={
       teams:{server:record.teams.server,team:record.teams.team,installation:agents.teams.installation.id,source:record.source,tokenEnv:SERVICE_TOKENS.agents[1]},
       rh2:{baseUrl:record.origin,organization:record.organization,registration:agents.clientId,...(record.issuer!==record.origin?{issuer:record.issuer}:{}),tokenEnv:SERVICE_TOKENS.agents[0],principal:agents.rh2.principalId},
-      source:{namespace:`cx${record.scope}`},envFile:custody,stateFile:join(dir,'agents.state.json'),
+      ...(record.scope?{source:{namespace:`cx${record.scope}`}}:{}),envFile:custody,stateFile:join(dir,'agents.state.json'),
+      ...record.settings?.service,
       ...(record.webhook?{webhook:record.webhook}:{}),
       ...(held.cards?{cards:section('cards')}:{}),...(held.machines?{machines:section('machines')}:{}),
     };
     privateJson(configPath,config);
   }
-  privateJson(join(root,'apps',`${grant.name}.${record.id}.json`),{app:grant.name,connection:record.id,configPath,program:SERVICE_PROGRAM,
-    origin:record.origin,organizationId:record.organization,principalId:grant.rh2.principalId,installationId:grant.rh2.installationId,expiresAt:grant.rh2.expiresAt});
+  const entry=g=>({app:g.name,connection:record.id,configPath,program:SERVICE_PROGRAM,
+    origin:record.origin,organizationId:record.organization,principalId:g.rh2.principalId,installationId:g.rh2.installationId,expiresAt:g.rh2.expiresAt});
+  privateJson(join(root,'apps',`${grant.name}.${record.id}.json`),entry(grant));
+  // The one config restarts for every renewal, so each registration's entry shows its own current expiry (`apps list`); an
+  // entry that is gone stays gone (it is what stops that registration).
+  for(const other of Object.values(held))if(other.name!==grant.name&&existsSync(join(root,'apps',`${other.name}.${record.id}.json`)))privateJson(join(root,'apps',`${other.name}.${record.id}.json`),entry(other));
   return configPath;
 }
 export function startConnectionRunner(root,id) {
@@ -89,8 +109,49 @@ export function startConnectionRunner(root,id) {
   const child=spawn(process.execPath,[fileURLToPath(new URL('./bin/connection-runner.mjs',import.meta.url)),'--root',root,'--connection',id],{detached:true,stdio:['ignore',fd,fd],env:process.env});
   closeSync(fd);child.unref();return child.pid;
 }
+/** The file a runner that names its tree in its lock watches for its stop: Windows has no signal a process can catch. */
+export const runnerStopPath=lock=>join(dirname(lock),'runner.stop');
+/** Stop a connection's runner as it stops itself, its modules first and then its lock, and answer whether it is gone
+ * within the wait. POSIX delivers SIGTERM to its handler. On Windows process.kill ends the runner alone and leaves its
+ * modules serving with nobody stopping them, so a runner whose lock names its tree (it watches runnerStopPath) is asked
+ * through that file, and an older one is ended with its whole process tree. */
+export async function stopConnectionRunner(lock,running,wait=20000){
+  if(!alive(running.pid))return true;
+  if(process.platform!=='win32'){try{process.kill(running.pid,'SIGTERM');}catch(error){if(error.code!=='ESRCH')throw error;}}
+  else if(running.tree)privateJson(runnerStopPath(lock),{pid:running.pid,at:new Date().toISOString()});
+  else spawnSync('taskkill',['/PID',String(running.pid),'/T','/F'],{stdio:'ignore',windowsHide:true});
+  for(let waited=0;waited<wait&&alive(running.pid);waited+=250)await new Promise(done=>setTimeout(done,250));
+  return !alive(running.pid);
+}
 export function connectionCanRun(record){return record.preparing===false&&record.paused===false&&typeof record.connectedAt==='string'&&!record.disconnectedAt;}
+/** The Teams team a connection installs into and the admin credential that installs there: an explicit local credential
+ * (useful for an owned stack), else the existing Teams context. */
+async function teamsAccess(flags) {
+  if(flags['teams-token-file']){
+    if(!flags['teams-url']||!flags.team)throw new Error('--teams-token-file needs --teams-url and --team');
+    return {teams:{server:new URL(flags['teams-url']).origin,team:flags.team},owner:readFileSync(flags['teams-token-file'],'utf8').trim()};
+  }
+  // An agent session connects as its agent: its delegated context, never the person's who signed the box in (the
+  // Teams verbs' rule, agentContextName). A person's context named from an agent session is refused, as a grant is.
+  const {WorkspaceContexts}=await import('@volter/teams/context');
+  const {agentSessionEnvironment,agentSessionHint,agentContextName,doorGlass}=await import('@volter/supercode-teams/agent-session');
+  const contexts=new WorkspaceContexts(supercodeHome());
+  // Asked of the daemon whatever the environment says: a resumed session can lack its launch's SUPERCODE_AGENT_ID,
+  // and the daemon's retained binding is what names its agent (workspace.mjs does the same for every Teams verb).
+  // On purpose (SUPERCODE_BREAK_GLASS="<reason>"), its guards let the connection act for another and record it.
+  const glass=doorGlass(process.env,'orchestrator connect');
+  const env=await agentSessionEnvironment(process.env,agentSessionHint(process.env),glass);
+  const teamsContext=agentContextName(contexts,env,flags.context??null,glass);
+  const {context}=fromContext({supercodeHome:supercodeHome(),name:teamsContext});
+  return {teams:{server:context.origin,team:context.team_id},owner:contexts.credential(context.credential_ref).token};
+}
+function exactOrigins(origins){
+  for(const origin of origins){
+    const url=new URL(origin);if(url.origin!==origin||url.username||url.password||(url.protocol!=='https:'&&!(url.protocol==='http:'&&['127.0.0.1','localhost','[::1]'].includes(url.hostname))))throw new Error('connection endpoints must be exact HTTPS origins or loopback HTTP');
+  }
+}
 export async function connectWorkplace(flags) {
+  if(flags.adopt||flags['adopt-module'])return adoptWorkplaceService(flags);
   if(!flags.root||!flags['ticket-file']||!flags.source)throw new Error('connect needs --root, --ticket-file and --source (one board event source)');
   const root=resolve(flags.root), ticket=JSON.parse(readFileSync(flags['ticket-file'],'utf8'));
   if(!/^[0-9a-f]{24}$/.test(ticket.scope??''))throw new Error('connection ticket needs a source namespace; apply to a new private output path');
@@ -101,27 +162,8 @@ export async function connectWorkplace(flags) {
   if(names.some(name=>MODULE_APPS.includes(name))&&!flags['modules-root'])throw new Error(`--modules-root names where ${names.filter(name=>MODULE_APPS.includes(name)).join(' and ')} are`);
   if(Boolean(flags['webhook-url'])!==Boolean(flags['webhook-listen']))throw new Error('--webhook-url and --webhook-listen go together: where the Workplace sends the agents registration\'s events, and the loopback address the service listens on');
   const moduleRoot=flags['modules-root']?resolve(flags['modules-root']):null;
-  // An explicit local credential input is useful for an owned stack; a normal connect uses its existing Teams context.
-  let teams,owner;
-  if(flags['teams-token-file']){
-    if(!flags['teams-url']||!flags.team)throw new Error('--teams-token-file needs --teams-url and --team');
-    teams={server:new URL(flags['teams-url']).origin,team:flags.team};owner=readFileSync(flags['teams-token-file'],'utf8').trim();
-  }else{
-    // An agent session connects as its agent: its delegated context, never the person's who signed the box in (the
-    // Teams verbs' rule, agentContextName). A person's context named from an agent session is refused, as a grant is.
-    const {WorkspaceContexts}=await import('@volter/teams/context');
-    const {agentSessionEnvironment,agentSessionHint,agentContextName}=await import('@volter/supercode-teams/agent-session');
-    const contexts=new WorkspaceContexts(supercodeHome());
-    // Asked of the daemon whatever the environment says: a resumed session can lack its launch's SUPERCODE_AGENT_ID,
-    // and the daemon's retained binding is what names its agent (workspace.mjs does the same for every Teams verb).
-    const env=await agentSessionEnvironment(process.env,agentSessionHint(process.env));
-    const teamsContext=agentContextName(contexts,env,flags.context??null);
-    const {context}=fromContext({supercodeHome:supercodeHome(),name:teamsContext});
-    teams={server:context.origin,team:context.team_id};owner=contexts.credential(context.credential_ref).token;
-  }
-  for(const origin of [ticket.origin,ticket.issuer,teams.server]){
-    const url=new URL(origin);if(url.origin!==origin||url.username||url.password||(url.protocol!=='https:'&&!(url.protocol==='http:'&&['127.0.0.1','localhost','[::1]'].includes(url.hostname))))throw new Error('connection endpoints must be exact HTTPS origins or loopback HTTP');
-  }
+  const {teams,owner}=await teamsAccess(flags);
+  exactOrigins([ticket.origin,ticket.issuer,teams.server]);
   const id=createHash('sha256').update(`${ticket.scope}\0${ticket.issuer}\0${ticket.organization}\0${teams.server}\0${teams.team}\0${flags.source}`).digest('hex').slice(0,24);
   const path=connectionPath(root,id),prior=existsSync(path)?JSON.parse(readFileSync(path,'utf8')):null;
   if(!prior&&!(Date.parse(ticket.expiresAt)>Date.now()))throw new Error('connection ticket expired; apply the organization file again');
@@ -192,6 +234,184 @@ export async function connectWorkplace(flags) {
   return {connection:id,root,modules:record.grants.map(g=>g.name),runner:pid,calls:record.calls.map(({side,method,path,status,ms,bytes})=>({side,method,path,status,ms,bytes}))};
 }
 
+/** The service settings an adopted config carries as it ran (main.mjs names every key it accepts); everything else in its
+ * config is rebuilt from the connection's own custody, and any key that is neither is named in the answer as dropped. */
+const ADOPTED_SETTINGS={service:['closedLanes','leadProfiles','launch','teamsPerMinute'],cards:['floorTagPrefix'],machines:[]};
+const REBUILT={teams:['server','team','installation','source','tokenEnv'],rh2:['baseUrl','organization','registration','issuer','tokenEnv','principal','cardsPrincipalId'],
+  source:['namespace'],envFile:null,stateFile:null,webhook:['url','listen'],cards:['registration','principal','tokenEnv','teamsTokenEnv','stateFile'],machines:['registration','principal','tokenEnv','teamsTokenEnv','stateFile']};
+function dropped(config){
+  const out=[];
+  for(const [key,value] of Object.entries(config)){
+    if(ADOPTED_SETTINGS.service.includes(key))continue;
+    if(!Object.hasOwn(REBUILT,key)){out.push(key);continue;}
+    if(REBUILT[key]===null||value===null||typeof value!=='object')continue;
+    for(const inner of Object.keys(value))if(!REBUILT[key].includes(inner)&&!(ADOPTED_SETTINGS[key]??[]).includes(inner))out.push(`${key}.${inner}`);
+  }
+  return out;
+}
+const envValues=path=>Object.fromEntries(readFileSync(path,'utf8').split('\n').filter(line=>line.includes('=')).map(line=>[line.slice(0,line.indexOf('=')),line.slice(line.indexOf('=')+1)]));
+function alive(pid){if(!Number.isInteger(pid)||pid<=0)return false;try{process.kill(pid,0);return true;}catch(error){if(error.code==='ESRCH')return false;throw error;}}
+/** The pids of processes whose arguments name `path` (a config only its own program is started with). */
+function runningWith(path){
+  if(process.platform==='win32')return [];
+  return execFileSync('/bin/ps',['-axww','-o','pid=,command='],{encoding:'utf8',timeout:5000}).split('\n')
+    .map(line=>line.trim().match(/^(\d+)\s+(.*)$/)).filter(Boolean).filter(([,pid,command])=>Number(pid)!==process.pid&&` ${command} `.includes(` ${path} `)).map(([,pid])=>Number(pid));
+}
+/** Every `…Env` field of a config, by its dotted path: the custody names its program reads. */
+function envFields(value,at=''){
+  if(value===null||typeof value!=='object'||Array.isArray(value))return [];
+  return Object.entries(value).flatMap(([key,inner])=>/Env$/.test(key)&&typeof inner==='string'?[[`${at}${key}`,inner]]:envFields(inner,`${at}${key}.`));
+}
+// A Teams installation's credential lives TOKEN_MS (sdk/volter-teams/server/apps.mjs, 90 days) from its exchange, which
+// follows the installation's (re)creation within its ten-minute code: created_at plus that lifetime is its earliest end.
+const TEAMS_CREDENTIAL_MS=90*86400000;
+
+/** `connect --adopt <process.json>` and `--adopt-module NAME=CONFIG`: programs already running on their own installations
+ * (the Workplace service from its process record, a module from its config, each with hand-written custody) move under
+ * this home's installed-app runner as the connection of the installations they already hold. Nothing is registered,
+ * consented or exchanged: the adoption ticket (`rh2 apply-org … --connection-out … --adopt …`) names each registration's
+ * one active installation, and each token proves itself through its own installation's doors (RH2's renew, which keeps
+ * the expiry outside its last seven days and answers which installation and principal the token is; Teams' /me, which
+ * names the token's installation, that installation read with the token itself, and its renew door asked with the
+ * credential as its own replacement, which only an installation root is answered for and which changes nothing). No
+ * admin is needed: the Teams context only names the team. There is no scope: the same installations keep writing
+ * the keys they always have, so nothing is made twice and no history changes hands (ADR 0032, "Adoption"). Every program
+ * adopted must be stopped, and is checked again before its state is copied and before the runner starts: one writer at a
+ * time. State is copied into the connection until the connection first runs, the originals kept as they were. No
+ * credential is renewed by adopting: the old custody stays usable for a way back until the first renewal, in the last
+ * seven days. A Teams credential's expiry was never kept by hand, so it is its earliest possible end (TEAMS_CREDENTIAL_MS). */
+export async function adoptWorkplaceService(flags) {
+  if(!flags.root||!flags['ticket-file'])throw new Error('connect --adopt needs --root and --ticket-file (the ticket of rh2 apply-org … --connection-out … --adopt)');
+  for(const flag of ['source','webhook-url','webhook-listen','alert-role'])if(flags[flag]!==undefined)throw new Error(`connect --adopt takes no --${flag}: the adopted programs' own configs name it`);
+  const root=resolve(flags.root), ticket=JSON.parse(readFileSync(flags['ticket-file'],'utf8'));
+  const processPath=flags.adopt?realpathSync(resolve(flags.adopt)):null;
+  const pairs=(list,flag)=>Object.fromEntries([].concat(list??[]).map(value=>{const at=value.indexOf('=');if(at<1)throw new Error(`--${flag} is NAME=PATH`);return [value.slice(0,at),resolve(value.slice(at+1))];}));
+  const moduleConfigs=pairs(flags['adopt-module'],'adopt-module'), programs=pairs(flags['adopt-program'],'adopt-program');
+  if(Object.keys(programs).some(name=>!moduleConfigs[name]))throw new Error('--adopt-program names a module that --adopt-module adopts');
+  if(!processPath&&!Object.keys(moduleConfigs).length)throw new Error('connect --adopt names the service\'s process record, --adopt-module NAME=CONFIG each module, or both');
+  if(ticket.version!==1||ticket.adopt!==true||ticket.scope!==undefined||!Array.isArray(ticket.grants)||!ticket.grants.length)throw new Error('connect --adopt takes an adoption ticket (rh2 apply-org … --connection-out … --adopt): it names existing installations and has no scope');
+  const names=ticket.grants.map(g=>g.name);
+  if(new Set(names).size!==names.length)throw new Error('an adoption ticket names each app once');
+  for(const g of ticket.grants)if(!/^app_[a-f0-9]{16}$/.test(g.clientId??'')||!/^prn_[a-z0-9]+$/.test(g.principalId??'')||!/^installation_[a-z0-9]+$/.test(g.installationId??'')||!Array.isArray(g.manifest?.actions))throw new Error(`${g.name}: the adoption ticket names its registration, principal, installation and consented actions`);
+  if(Object.keys(moduleConfigs).some(name=>SERVICE_APPS.includes(name)))throw new Error(`${SERVICE_APPS.join(', ')} run in the Workplace service: adopt it with --adopt <its process record>`);
+  // What each grant runs as now: a section of the service's config, or a module's own config.
+  const service=processPath?JSON.parse(readFileSync(processPath,'utf8')):null, config=service?JSON.parse(readFileSync(service.configPath,'utf8')):null;
+  const sections=config?{agents:{registration:config.rh2?.registration,principal:config.rh2?.principal,tokenEnv:config.rh2?.tokenEnv,teamsTokenEnv:config.teams?.tokenEnv,stateFile:config.stateFile},
+    ...(config.cards?{cards:config.cards}:{}),...(config.machines?{machines:config.machines}:{})}:{};
+  const modules={};
+  for(const [name,path] of Object.entries(moduleConfigs)){
+    const own=JSON.parse(readFileSync(path,'utf8')), fields=envFields(own);
+    const unknown=fields.filter(([at])=>!['rh2.tokenEnv','teams.tokenEnv'].includes(at));
+    if(unknown.length)throw new Error(`${name}: ${unknown.map(([at])=>at).join(', ')} name custody adopt does not renew`);
+    if(!own.rh2?.tokenEnv||!own.envFile)throw new Error(`${name}: its config names no rh2.tokenEnv and envFile`);
+    const program=programs[name]??(flags['modules-root']?join(resolve(flags['modules-root']),name,'main.mjs'):null);
+    if(!program||!existsSync(program))throw new Error(`${name}: its program is --adopt-program ${name}=PATH or <--modules-root>/${name}/main.mjs`);
+    modules[name]={path,config:own,program:realpathSync(program),tokenEnv:own.rh2.tokenEnv,teamsTokenEnv:own.teams?.tokenEnv,stateFile:own.stateFile,principal:own.rh2.principalId};
+  }
+  const expected=[...Object.keys(sections),...Object.keys(modules)].sort().join(',');
+  if(expected!==[...names].sort().join(','))throw new Error(`the ticket names ${names.join(', ')}; the programs adopted run ${expected}: adopt exactly those`);
+  if(Object.keys(sections).length&&!sections.agents)throw new Error('the service is the agents registration\'s host');
+  for(const g of ticket.grants){
+    const section=sections[g.name];
+    if(section&&(section.registration!==g.clientId||(section.principal!==undefined&&section.principal!==g.principalId)))throw new Error(`${g.name}: the ticket's registration ${g.clientId} (${g.principalId}) is not the one the service runs (${section.registration})`);
+    if(modules[g.name]?.principal!==undefined&&modules[g.name].principal!==g.principalId)throw new Error(`${g.name}: the ticket's principal ${g.principalId} is not the one its config names (${modules[g.name].principal})`);
+  }
+  if(config){
+    if(ticket.organization!==config.rh2.organization)throw new Error(`the ticket is for ${ticket.organization}; the service writes ${config.rh2.organization}`);
+    // The service's state is bound to the Workplace origin its tokens are issued by (main.mjs identity): the same one.
+    if(ticket.issuer!==new URL(config.rh2.issuer??config.rh2.baseUrl).origin)throw new Error(`the ticket's issuer ${ticket.issuer} is not the service's Workplace (${new URL(config.rh2.issuer??config.rh2.baseUrl).origin}); apply with --issuer naming it`);
+    if(config.source?.namespace)throw new Error('this service already writes under a connection namespace; adopt takes a service with the unqualified keys');
+    if(config.webhook?.secretEnv)throw new Error('adopt does not carry webhook.secretEnv; the adopted service keeps its webhook secret in its state');
+  }
+  for(const [name,m] of Object.entries(modules))if(m.config.rh2.organization!==ticket.organization)throw new Error(`${name}: its config writes ${m.config.rh2.organization}, not ${ticket.organization}`);
+  // One writer at a time: nothing adopted may still run, asked again before its state is copied and before the runner starts.
+  const stopped=()=>{
+    if(service&&alive(service.servicePid))throw new Error(`the service ${processPath} names still runs (pid ${service.servicePid}): stop it and whatever restarts it first (one writer at a time)`);
+    for(const path of new Set([...(service?[service.configPath,realpathSync(service.configPath)]:[]),...Object.values(modules).flatMap(m=>[m.path,realpathSync(m.path)])])){const pids=runningWith(path);if(pids.length)throw new Error(`pid ${pids.join(', ')} still runs with ${path}: stop it and whatever restarts it first (one writer at a time)`);}
+  };
+  stopped();
+  // The context names the team only: no call is made with its credential, so a member's context adopts as an admin's does.
+  const {teams}=await teamsAccess(flags);
+  exactOrigins([ticket.origin,ticket.issuer,teams.server]);
+  if(config&&(teams.server!==new URL(config.teams.server).origin||teams.team!==config.teams.team))throw new Error(`the Teams context is ${teams.server} ${teams.team}; the service reads ${config.teams.server} ${config.teams.team}`);
+  for(const [name,m] of Object.entries(modules))if(m.teamsTokenEnv&&(teams.server!==new URL(m.config.teams.server).origin||teams.team!==m.config.teams.team))throw new Error(`${name}: the Teams context is ${teams.server} ${teams.team}; it reads ${m.config.teams.server} ${m.config.teams.team}`);
+  const held={};
+  for(const [name,s] of Object.entries(sections))held[name]={tokenEnv:s.tokenEnv,teamsTokenEnv:s.teamsTokenEnv,stateFile:s.stateFile,env:envValues(config.envFile),envFile:config.envFile};
+  for(const [name,m] of Object.entries(modules))held[name]={tokenEnv:m.tokenEnv,teamsTokenEnv:m.teamsTokenEnv,stateFile:m.stateFile,env:envValues(m.config.envFile),envFile:m.config.envFile};
+  for(const [name,h] of Object.entries(held))for(const key of [h.tokenEnv,h.teamsTokenEnv].filter(Boolean))if(!h.env[key])throw new Error(`${name}: ${key} is not in ${h.envFile}`);
+  const source=config?.teams.source??null;
+  const id=createHash('sha256').update(`adopt\0${processPath??''}\0${Object.entries(moduleConfigs).sort().map(([n,p])=>`${n}=${p}`).join('\0')}\0${ticket.issuer}\0${ticket.organization}\0${teams.server}\0${teams.team}\0${source??''}`).digest('hex').slice(0,24);
+  const path=connectionPath(root,id),prior=existsSync(path)?JSON.parse(readFileSync(path,'utf8')):null;
+  if(!prior&&!(Date.parse(ticket.expiresAt)>Date.now()))throw new Error('adoption ticket expired; apply the organization file again');
+  if(prior?.disconnectedAt)throw new Error('this connection was disconnected; it is never adopted again');
+  if(prior&&((prior.adopted?.process??null)!==processPath||prior.selection.join(',')!==names.join(',')))throw new Error('the existing connection adopted other programs or another selection');
+  const lock=join(dirname(path),'runner.lock');
+  if(prior&&existsSync(lock)){
+    const running=JSON.parse(readFileSync(lock,'utf8'));
+    if(alive(running.pid)){if(flags['no-start'])throw new Error('stop this connection runner before preparing an owner handover');return {connection:id,root,adopted:processPath,modules:prior.grants.map(g=>g.name),runner:running.pid,calls:[]};}
+  }
+  const carry=(from,keys)=>Object.fromEntries(keys.filter(key=>from?.[key]!==undefined).map(key=>[key,from[key]]));
+  const record=prior??{version:1,id,adopted:{process:processPath,modules:moduleConfigs,source:service?.source??null,at:new Date().toISOString()},origin:ticket.origin,issuer:ticket.issuer,organization:ticket.organization,teams,
+    source,selection:names,moduleRoot:null,...(config?.webhook?{webhook:{url:config.webhook.url,listen:config.webhook.listen}}:{}),alertRole:'admin',
+    ...(config?{settings:{service:carry(config,ADOPTED_SETTINGS.service),cards:carry(config.cards,ADOPTED_SETTINGS.cards)}}:{}),grants:[]};
+  record.root=root;
+  record.preparing=true;record.paused=true;
+  privateJson(path,record);
+  for(const selected of ticket.grants){
+    const h=held[selected.name];
+    let grant=record.grants.find(g=>g.name===selected.name);
+    if(!grant){grant={name:selected.name,clientId:selected.clientId,adopted:true,manifest:selected.manifest,teamsManifest:selected.teamsManifest??null,
+      ...(modules[selected.name]?{program:modules[selected.name].program,config:modules[selected.name].config}:{})};record.grants.push(grant);privateJson(path,record);}
+    if(!grant.rh2){
+      // Only this installation's current token is answered here; outside the last seven days the expiry stays as it is.
+      const renewed=(await connectionCall(record,'rh2','POST',`/api/v3/automation/installations/${encodeURIComponent(selected.installationId)}/renew`,{},h.env[h.tokenEnv])).data;
+      if(renewed.installationId!==selected.installationId||renewed.principalId!==selected.principalId||renewed.organizationId!==ticket.organization)throw new Error(`${selected.name}: ${h.tokenEnv} answers as ${renewed.principalId} on ${renewed.installationId}, not the ticket's installation`);
+      grant.rh2={accessToken:renewed.accessToken,expiresAt:renewed.expiresAt,installationId:renewed.installationId,organizationId:renewed.organizationId,principalId:renewed.principalId};privateJson(path,record);
+    }
+    if(h.teamsTokenEnv&&!grant.teams){
+      // The token names its own installation (/me) and reads it in the team (a credential of another team is refused, and
+      // one whose installation or app is no longer active authenticates as no one): the installation's own doors, no admin's.
+      const token=h.env[h.teamsTokenEnv], me=await connectionCall(record,'teams','GET','/api/v1/me',undefined,token);
+      if(!me.installation_id)throw new Error(`${selected.name}: ${h.teamsTokenEnv} is no installation's credential`);
+      const installation=(await connectionCall(record,'teams','GET',`/api/v1/teams/${encodeURIComponent(teams.team)}/app-installations/${encodeURIComponent(me.installation_id)}`,undefined,token)).data;
+      if(installation.team_id!==teams.team||installation.principal_id!==me.principal?.id||installation.state!=='active')throw new Error(`${selected.name}: ${h.teamsTokenEnv} is no active installation of team ${teams.team}`);
+      if(selected.name==='agents'&&installation.id!==config.teams.installation)throw new Error(`agents: ${h.teamsTokenEnv} is installation ${installation.id}, not the service's ${config.teams.installation}`);
+      // Renewal is answered only for an installation's root credential (issuer-connection.mjs root()); asked with itself as
+      // its replacement, an unrenewed root with no predecessor is refused as "this root has no renewal predecessor" and
+      // nothing changes. Any other answer refuses the adoption: a non-root is forbidden, and a root already renewed (its
+      // replacement elsewhere, its own expiry cut to five minutes) is "already has a replacement".
+      let probe=null;
+      try{await connectionCall(record,'teams','POST',`/api/v1/teams/${encodeURIComponent(teams.team)}/app-installations/${encodeURIComponent(installation.id)}/renew`,{replacement_token:token},token);probe='answered';}
+      catch(error){probe=error;}
+      if(!(probe instanceof Error&&probe.status===409&&/no renewal predecessor/.test(probe.detail??'')))throw new Error(`${selected.name}: ${h.teamsTokenEnv} is not its installation's unrenewed root credential (${probe instanceof Error?`${probe.code??probe.status}${probe.detail?`: ${probe.detail}`:''}`:probe}), so it could not be renewed from here; reconsent the installation`);
+      grant.registration={id:installation.app_id};
+      grant.teams={installation,credential:{token,kind:'service',expires_at:installation.created_at+TEAMS_CREDENTIAL_MS,expiresAtDerived:true}};privateJson(path,record);
+    }
+  }
+  // State: what each adopted program wrote up to its stop, with the ledger of its writes whose answers were lost. Copied
+  // again on every run until the connection first runs (a run that stopped before its runner started copies afresh); once
+  // it has run, its own state stands, and adopting the old programs' later state means setting the connection's folder aside.
+  stopped();
+  const folder=dirname(path);
+  for(const grant of record.grants){
+    const from=held[grant.name]?.stateFile;
+    if(!from||record.connectedAt)continue;
+    const into=SERVICE_APPS.includes(grant.name)?join(folder,'service',`${grant.name}.state.json`):join(folder,grant.name,'state.json');
+    mkdirSync(dirname(into),{recursive:true,mode:0o700});
+    for(const [a,b] of [[`${from}.unknown-writes.json`,`${into}.unknown-writes.json`],[from,into],[`${from}.cursor.json`,`${into}.cursor.json`]]){
+      if(existsSync(a)){copyFileSync(a,`${b}.${process.pid}.tmp`);chmodSync(`${b}.${process.pid}.tmp`,0o600);renameSync(`${b}.${process.pid}.tmp`,b);}else if(existsSync(b))unlinkSync(b);
+    }
+  }
+  for(const grant of record.grants)if(SERVICE_APPS.includes(grant.name))generateServiceConfig(root,record,grant);else generateModuleConfig(root,record,grant);
+  stopped();
+  record.connectedAt??=new Date().toISOString();
+  record.preparing=false;record.paused=Boolean(flags['no-start']);privateJson(path,record);
+  const pid=record.paused?null:startConnectionRunner(root,id);
+  return {connection:id,root,adopted:{process:processPath,modules:moduleConfigs},modules:record.grants.map(g=>g.name),runner:pid,dropped:config?dropped(config):[],
+    expiry:record.grants.map(g=>({name:g.name,rh2:g.rh2.expiresAt,teams:g.teams?new Date(g.teams.credential.expires_at).toISOString():null})),
+    calls:(record.calls??[]).map(({side,method,path,status,ms,bytes})=>({side,method,path,status,ms,bytes}))};
+}
+
 /** Undo a connection with its own credentials, no admin needed (runhuman-2 ADR 0055 decision 3): its runner stops, every
  * installation it holds leaves both sides by itself (each Workplace installation through its own leave door, each
  * Teams installation and the issuer's by deleting itself), and the home's registry entries go. The registrations stay, as
@@ -202,12 +422,12 @@ export async function disconnectWorkplace(flags) {
   const root=resolve(flags.root), path=connectionPath(root,flags.connection);
   if(!existsSync(path))throw new Error(`no connection ${flags.connection} in ${root}`);
   const record=JSON.parse(readFileSync(path,'utf8'));record.root=root;
+  // An adopted connection's installations predate it: leaving uninstalls what the adopted programs ran on before.
+  if(record.adopted&&!flags['uninstall-adopted'])throw new Error(`connection ${record.id} adopted installations made before it (${record.grants.map(g=>`${g.name} ${g.rh2?.installationId}`).join(', ')}); disconnect uninstalls them on both sides. Stopping its runner (kill -TERM the pid in its runner.lock) hands nothing back; pass --uninstall-adopted to uninstall them`);
   record.paused=true;privateJson(path,record);
   const lock=join(dirname(path),'runner.lock');
   if(existsSync(lock)){
-    const running=JSON.parse(readFileSync(lock,'utf8'));
-    try{process.kill(running.pid,'SIGTERM');}catch(error){if(error.code!=='ESRCH')throw error;}
-    for(let waited=0;waited<20000;waited+=250){try{process.kill(running.pid,0);}catch{break;}await new Promise(done=>setTimeout(done,250));}
+    await stopConnectionRunner(lock,JSON.parse(readFileSync(lock,'utf8')));
   }
   const team=`/api/v1/teams/${encodeURIComponent(record.teams.team)}`, left=[];
   const leave=async(name,side,method,door,token)=>{

package/index.d.ts

@@ -151,7 +151,9 @@ export interface RuntimeState {
   /** The last worker event per lease (§4.3's inactivity limit). */
   activity: Record<string, Instant>;
   adapters: Record<Platform, { state: 'up' | 'down' | 'paused'; breaker: { failures: number; until?: Instant } }>;
-  pending_requests: Record<string, { profile: ProfileName; keyString: string; runtime_id: string | null; asked_at: Instant; options: RequestOption[] }>;
+  pending_requests: Record<string, { profile: ProfileName; keyString: string; runtime_id: string | null; asked_at: Instant; options: RequestOption[]; subject?: string | null }>;
+  /** The worker's settlements of requests not yet queued (`settled` before its `request`), as `runtime_id\nrequest id`: the most recent 256. */
+  settled_requests?: string[];
   clock: Instant | null;
   hostedJobs?: boolean;
   hostedFires?: Record<string, boolean>;
@@ -169,6 +171,8 @@ export type WorkerEvent =
   | { kind: 'steer_refused'; text: string; webhook_input_id?: string | null }
   | { kind: 'final'; text: string | null; outcome?: 'completed' | 'error'; message?: string | null }
   | { kind: 'request'; id: string; subject: string; options: RequestOption[] }
+  /** The worker settled request `id` itself (Claude Code's `control_cancel_request`, Codex's `serverRequest/resolved`). */
+  | { kind: 'settled'; id: string }
   | { kind: 'ended'; reason: string }
   | { kind: 'error'; message: string };
 

package/installed-apps.mjs

@@ -10,6 +10,10 @@ export const APPS_DIR = 'apps';
 /** The apps this orchestrator can host, by name: what each installs and which adapter it attaches. */
 export const INSTALLABLE_APPS = Object.freeze({
   'orchestration-rh2': { side: 'rh2', module: true, describe: 'orchestration-rh2 installed module' },
+  // The Workplace service's registrations (connection.mjs SERVICE_APPS): one program the connection runner hosts.
+  agents: { side: 'rh2', service: true, describe: 'Agents → Room agents, in the connection\'s Workplace service' },
+  cards: { side: 'rh2', service: true, describe: 'Cards → Tasks, in the connection\'s Workplace service' },
+  machines: { side: 'rh2', service: true, describe: 'Machines → RH2 resources, in the connection\'s Workplace service' },
   'room-chat': { side: 'rh2', adapter: 'rh2', describe: 'Room chat → orchestrator: a person\'s line in an RH2 Room reaches the agent seated there' },
   // An agent the RH2 organization declares is one participant there: its chat and its call are its own agent principal,
   // never an automation beside it. One record per agent per Workplace, bound to its Teams id (`agentId`) and that
@@ -26,7 +30,7 @@ export function installedApps(root) {
   return readdirSync(dir).filter((file) => file.endsWith('.json')).map((file) => {
     const record = JSON.parse(readFileSync(join(dir, file), 'utf8'));
     return { ...record, name: file.slice(0, -5) };
-  }).filter((record) => INSTALLABLE_APPS[record.app ?? record.name]);
+  }).filter((record) => INSTALLABLE_APPS[record.app ?? record.name] || typeof record.connection === 'string');
 }
 
 /** An RH2 agent's own identity: the token the organization's admin issued that agent principal (RH2's agent-token door),
@@ -104,7 +108,7 @@ export function rh2AgentEnv(record, root = null) {
 /** Exchange an RH2 install code for the installation's token and keep the record. */
 export async function installApp({ root, name, origin, clientId, clientSecret, code, profile = 'default', fetchImpl = globalThis.fetch }) {
   const app = INSTALLABLE_APPS[name];
-  if(app?.module)throw new Error('module apps are consented and installed together by orchestrator connect');
+  if(app?.module||app?.service)throw new Error('module and service apps are consented and installed together by orchestrator connect');
   if (!app) throw new Error(`no installable app named ${name} (${Object.keys(INSTALLABLE_APPS).join(', ')})`);
   if (!rh2Origin(origin)) throw new Error('the RH2 origin is an https URL');
   const base = new URL(origin).origin;
@@ -128,12 +132,14 @@ export function removeApp(root, name) {
 }
 
 /** What `apps list` shows: never the token. */
-export const appView = (record) => ({ name: record.name, side: record.side, origin: record.origin, organization: record.organizationId, principal: record.principalId, agent: record.agentId, installation: record.installationId, profile: record.profile, expires_at: record.expiresAt });
+export const appView = (record) => ({ name: record.name, side: record.side ?? INSTALLABLE_APPS[record.app]?.side, origin: record.origin, organization: record.organizationId, principal: record.principalId, agent: record.agentId, installation: record.installationId, profile: record.profile, expires_at: record.expiresAt });
 
-/** The same home's app registry drives module hosting after a daemon restart. */
+/** The same home's app registry drives every connection's hosting after a daemon restart: each connection with an entry
+ * (its modules, its Workplace service, the programs it adopted) gets its runner back, so its renewals go on after a reboot.
+ * A source activation's restart does the same: a live runner of another tree yields to the serving tree's (connection-runner.mjs). */
 export async function startInstalledModules(root) {
   if(!root)return [];
   const {startConnectionRunner}=await import('./connection.mjs');
-  const ids=[...new Set(installedApps(root).filter(app=>INSTALLABLE_APPS[app.app]?.module).map(app=>app.connection))];
+  const ids=[...new Set(installedApps(root).filter(app=>typeof app.connection==='string').map(app=>app.connection))];
   return ids.map(id=>({connection:id,pid:startConnectionRunner(root,id)})).filter(row=>row.pid!==null);
 }

package/loop.mjs

@@ -1363,8 +1363,14 @@ export function normalizeWorkerEvent(ev) {
     case 'native':
       if (ev.kind === 'supercode/acp_request_completed') return { kind: 'final', text: null };
       if (ev.kind === 'control_request') return claudePermissionRequest(ev.payload);
+      // Claude Code withdraws a `can_use_tool` it settled without this host (a PermissionRequest hook or permission
+      // rule decided it, an answer arrived another way, or its turn was stopped): the request no longer waits on an answer
+      if (ev.kind === 'control_cancel_request') return typeof ev.payload?.request_id === 'string' ? { kind: 'settled', id: JSON.stringify(ev.payload.request_id) } : null;
       return null;
     case 'request': return { kind: 'request', id: JSON.stringify(ev.requestId), command: requestCommand(ev.payload), ...requestTool(ev), subject: ev.requestKind ?? ev.kind, options: ev.options ?? [] };
+    // Codex's `serverRequest/resolved` (`params.requestId`, the request's own id): the request was settled, by this host's
+    // answer or without it
+    case 'request_resolved': return ev.requestId == null ? null : { kind: 'settled', id: JSON.stringify(ev.requestId) };
     case 'error': return ev.terminal ? { kind: 'error', message: ev.message } : null;
     case 'closed': return { kind: 'ended', reason: ev.message ?? ev.kind };
     default: return null;

package/mcp/hermes-kanban-tools.json

@@ -202,6 +202,10 @@
             "type": "string"
           },
           "description": "The full 40-character pushed head SHA of each PR, in the same order as pr."
+        },
+        "plan": {
+          "type": "boolean",
+          "description": "Ask the plan review of a big arc's proposed ADR (its PR in pr, its pushed head in pr_head) before any code. Without it, one PR named with its head is that PR's review."
         }
       },
       "required": [
@@ -400,6 +404,10 @@
           "type": "string",
           "description": "Short task title (required)."
         },
+        "readable_id": {
+          "type": "string",
+          "description": "The card's readable id (required): a few lowercase words joined by hyphens naming its outcome (e.g. 'voice-calls'), at most 32 characters, unique on the board. It names the card's branch, worktree folder, sessions and agents."
+        },
         "assignee": {
           "type": "string",
           "description": "Profile name that should execute this task (e.g. 'researcher-a', 'reviewer', 'writer'). Required \u2014 tasks without an assignee are never dispatched."
@@ -438,7 +446,7 @@
         },
         "project": {
           "type": "string",
-          "description": "Optional project id or slug to link the task to. When set, the task becomes a git worktree under the project's primary repo with a deterministic branch (project slug + task id), instead of a random branch."
+          "description": "Optional project id or slug to link the task to. When set, the task becomes a git worktree under the project's primary repo with a deterministic branch (project slug + readable id), instead of a random branch."
         },
         "triage": {
           "type": "boolean",
@@ -490,6 +498,7 @@
       },
       "required": [
         "title",
+        "readable_id",
         "assignee"
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.225",
+  "version": "0.5.227",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -36,11 +36,11 @@
     "check-types": "node scripts/generate-types.mjs --check"
   },
   "dependencies": {
-    "@volter/supercode-teams": "^0.3.382",
-    "@volter/supercode-terminal": "^0.3.12",
-    "@volter/supercode-harness-sdk": "^0.3.106",
-    "@volter/teams": "0.2.106",
-    "@volter/ztrack": "^2.4.23",
+    "@volter/supercode-teams": "^0.3.344",
+    "@volter/supercode-terminal": "^0.3.10",
+    "@volter/supercode-harness-sdk": "^0.3.104",
+    "@volter/teams": "0.2.99",
+    "@volter/ztrack": "2.4.23",
     "yaml": "^2.9.0"
   },
   "devDependencies": {

package/reducer.mjs

@@ -29,6 +29,11 @@ export function ensureRuntime(state) {
   return r;
 }
 
+// The settlements of requests not yet queued that the reducer remembers (`settled` in handleWorker): the most recent
+// this many. A request id is its runtime's (Codex numbers them per connection), so each is kept with its runtime.
+const SETTLED_KEPT = 256;
+const settledKey = (runtimeId, requestId) => `${runtimeId ?? ''}\n${requestId}`;
+
 function leaseId(profile, keyString) {
   return `${profile} ${keyString}`;
 }
@@ -564,7 +569,31 @@ function handleWorker(state, ev, effects) {
       effects.push({ type: 'save' });
       break;
     }
+    case 'settled': {
+      // The worker settled one of its requests itself (Claude Code's `control_cancel_request`, Codex's
+      // `serverRequest/resolved`). One still asked on the surface retires, so no later number answers it and its timeout
+      // sends nothing. One not asked yet is remembered: Hermes's approval rule runs before a request is queued here
+      // (loop.mjs onWorkerEvent), so its settlement can arrive first.
+      const id = String(w.id);
+      const p = rt.pending_requests[id];
+      if (p && p.profile === profile.name && p.keyString === ev.keyString && (!p.runtime_id || !ev.runtime_id || p.runtime_id === ev.runtime_id)) {
+        delete rt.pending_requests[id];
+        if (binding) reply(state, profile, binding.key, `Permission no longer needed: ${p.subject ?? 'the worker settled its request'}. The worker settled it itself; no reply is needed.`, now, effects);
+        break;
+      }
+      const settled = (rt.settled_requests ??= []);
+      settled.push(settledKey(ev.runtime_id, id));
+      if (settled.length > SETTLED_KEPT) settled.splice(0, settled.length - SETTLED_KEPT);
+      break;
+    }
     case 'request': {
+      // a request the worker settled before it was queued here is asked of nobody and answered by nobody
+      const settled = rt.settled_requests?.indexOf(settledKey(ev.runtime_id, String(w.id))) ?? -1;
+      if (settled >= 0) {
+        rt.settled_requests.splice(settled, 1);
+        effects.push({ type: 'log', level: 'info', message: `session ${ev.keyString}: the worker settled ${String(w.subject ?? 'a request').slice(0, 200)} itself` });
+        break;
+      }
       if (!binding) break;
       // Hermes's approval rule allowed it (a safe command, any other tool): it runs without asking, as under Hermes
       if (w.hermes?.verdict === 'allow') {
@@ -580,7 +609,7 @@ function handleWorker(state, ev, effects) {
         effects.push({ type: 'log', level: 'info', message: `launched session ${ev.keyString}: ${approve ? 'approved' : 'denied'} ${String(w.subject ?? 'a tool call').slice(0, 200)}` });
         break;
       }
-      rt.pending_requests[String(w.id)] = { profile: profile.name, keyString: ev.keyString, runtime_id: rt.leases[lid]?.runtime_id ?? null, asked_at: now, options: w.options ?? [] };
+      rt.pending_requests[String(w.id)] = { profile: profile.name, keyString: ev.keyString, runtime_id: rt.leases[lid]?.runtime_id ?? null, asked_at: now, options: w.options ?? [], subject: w.subject ?? null };
       const options = (w.options ?? []).map((o, i) => `${i + 1}. ${o.name}`).join('\n');
       reply(state, profile, binding.key, `Permission needed: ${w.subject ?? 'the worker wants to act'}\nReply with a number:\n${options}`, now, effects);
       break;
@@ -723,7 +752,7 @@ function handleStopping(state, ev, effects) {
 
 function handleRestart(state, ev, effects) {
   const rt = ensureRuntime(state);
-  rt.leases = {}; rt.turns = {}; rt.queues = {}; rt.pending_requests = {};
+  rt.leases = {}; rt.turns = {}; rt.queues = {}; rt.pending_requests = {}; rt.settled_requests = [];
   let live = 0;
   const replays = [];
   for (const profile of Object.values(state.profiles)) {