@volter/supercode-orchestrator 0.5.226 → 0.5.227

package/board/dispatch.mjs

@@ -17,26 +17,28 @@
 // `workflow dispatch`) is harmless: every act of a round is a compare-and-set claim, a transaction that re-reads what it
 // acts on and does nothing when another round already acted (see `tick`). Every side effect follows a committed claim, so
 // a crash between the two steps is answered by the next round.
+import { GENERATION_STOPPED } from './generation.mjs';
 import { machineCall } from './doors.mjs';
-import { detachedCard, detachedSession, personCustody, sessionOperation, takeSessionCustody } from './custody.mjs';
+import { detachedCard, detachedSession, personCustody, personOf, sessionOperation, takeSessionCustody } from './custody.mjs';
 import { processSession } from './caller-session.mjs';
 import { callerOf, current, isCallersCall, ownCall } from './call.mjs';
 import { noteStep } from '@volter/supercode-harness-sdk/slow-log';
 import { monitorsRuns, recoversRuns, retainRecovery, failedObservation, surfaceIncident, auditEndedRuns, originOf } from './incidents.mjs';
 import { readMachineFleet } from './machine-fleet.mjs';
 import { homeFleetMachines } from './fleet-targets.mjs';
-import { delegatedWork, idleInterval, questionText } from './session-work.mjs';
+import { delegatedWork, idleInterval, questionText, resumedWatch } from './session-work.mjs';
 import { localSessionDelegations } from '../agents.mjs';
 import { cardSectionHeading, creatorOf, sessionProgress } from './workflow.mjs';
 import { boardLabel, boardName } from '@volter/teams/board-name';
 let fleetRoot = null;
-import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, withFreshReviewReads, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
+import { inspectCompletionEvidence, returnedReview, noCodeChange, openReviewPullRequests, reviewDue, settledReviewDue, prReviewedHead, withCompletionEvidence, withFreshReviewReads, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { setImmediate as yieldToOwner } from 'node:timers/promises';
 import { ACTIVE_RUN_IDS, latestEvent, readRunPages } from './queries.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
 import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, recordUsageUnread, agentPreamble, agentEnvironment, recordAgentRun, cardAgentAssignments,renameCardAgent,handOffAgents, agentRunForSession } from '../agents.mjs';
 import { finishCardAgentAssignment, recordCardAgentAssignment } from './agent-declarations.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
+import { installedAgentRecords } from '../installed-apps.mjs';
 import { memorySnapshot } from '../hermes-cli.mjs';
 import { hermesModel, codexPaneRoute } from '../worker-route.mjs';
 import { refreshVault } from '../orchestration.mjs';
@@ -46,22 +48,23 @@ import { declareWorkerHome } from '../activation.mjs';
 import { MODEL_ARGUMENTS, NAME_ARGUMENTS } from '../activation.mjs';
 import { createRequire } from 'node:module';
 import { spawn as spawnChild, execFile } from 'node:child_process';
-import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir, hostname, tmpdir, totalmem } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { view, boardCopyOf, boardKey, boardPath, cardHandleOf, readableIdOf, briefPath, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, NOTICE_RUN_IDS, openBoard, openBoardSnapshot, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
-import { doors, fire, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, unrelayedStateAnswers, transitionsFor, scopeOf, statusOf, projectStatus, storedStatus, templateValue, workflowFor } from './workflow.mjs';
-import { checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace } from './workspace.mjs';
+import { doors, fire, ownCoder, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, unrelayedStateAnswers, transitionsFor, scopeOf, statusOf, projectStatus, storedStatus, templateValue, workflowFor } from './workflow.mjs';
+import { branchClaim, checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace, workspaceTask } from './workspace.mjs';
 import { capacity, dispatched, executionHost, harnessDefaults, holdings } from './capacity.mjs';
 import { evaluate, holds, render } from './expr.mjs';
-import { cardNumber, identifyNotice, numbered } from './notices.mjs';
+import { cardName, cardNumber, identifyNotice, noticeName, numbered } from './notices.mjs';
 import { noticeReceiptsInTurns, noticeKey, requireNoticeBasis, noticeWriterBasis } from './notice-receipts.mjs';
 import { pendingRequestMail } from './request-mail.mjs';
 import {
-  cardContext, claimTtl, currentRun, DEFAULT_FAILURE_LIMIT, extendClaim, getTask, lastSession,
-  recomputeReady, runEffects, queueEffects, setRunSession, subscribeIn, replaceWorkerSubscriptions, subscriptions, reconcileDependencySubscriptions,
+  cardContext, cardLabel, claimTtl, currentRun, DEFAULT_FAILURE_LIMIT, extendClaim, getTask, lastSession,
+  recomputeReady, runEffects, queueEffects, setRunSession, subscribeIn, replaceWorkerSubscriptions, subscriptions, reconcileDependencySubscriptions, mentioned,
 } from './engine.mjs';
 
 const WORKER = fileURLToPath(new URL('../bin/hermes-worker.mjs', import.meta.url));
@@ -158,7 +161,7 @@ export function callerSession() {
 export async function observeFleet(root = fleetRoot) {
   const machines = await homeFleetMachines(root, normalMachine);
   const fleet = await readMachineFleet(machines, localMachine());
-  presenceReading = { known: fleet.presenceKnown === true, online: new Set([localMachine(), ...fleet.online]), offline: fleet.offline ?? new Set(), unknown: fleet.unknown ?? new Set(), errors: fleet.errors ?? new Map() };
+  presenceReading = { known: fleet.presenceKnown === true, online: new Set([...(fleet.unknown?.has(localMachine()) ? [] : [localMachine()]), ...fleet.online]), offline: fleet.offline ?? new Set(), unknown: fleet.unknown ?? new Set(), errors: fleet.errors ?? new Map() };
   notePresence(presenceReading);
   return fleet;
 }
@@ -422,10 +425,23 @@ const offlineMachine = (machine) => {
   const m = normalMachine(machine ?? localMachine());
   return m !== localMachine() && presenceReading?.known === true && presenceReading.offline.has(m);
 };
+// The doors a round only reads through. A park (stopDispatching) ends each one still waiting, and answers it as unread
+// at once afterwards: every reader takes an answer that is not 0 as unknown, read next round, as it takes an offline
+// machine's. A round's supervision reads every running card's discovery one after another (up to NATIVE_DISCOVERY_MS
+// each), so a park that waited for them waited out most of the round, past the owner's 8 s wait for 'parked' (VO-3578
+// r2454 F11: 13.6 s and 13.0 s of held card verbs). A door that acts (a pane prepared, a session owned) is never cut: it
+// finishes and the park waits for it.
+const READ_DOORS = new Set(['harness.v1.agent.show', 'harness.v1.launches.get', 'harness.v1.panes.capture', 'harness.v1.panes.list',
+  'harness.v1.panes.presence', 'harness.v1.sessions.activity_under', 'harness.v1.sessions.discover', 'harness.v1.sessions.load']);
+const refusal = (code, message) => ({ code: 1, stdout: '', stderr: JSON.stringify({ code, message }) });
 /** A machine's public door (`harness.v1.*`), answered at once when the machine reads as offline. */
-const doorOn = async (machine, method, params, options) => offlineMachine(machine)
-  ? { code: 1, stdout: '', stderr: JSON.stringify({ code: 'machine_offline', message: `machine ${normalMachine(machine)} is unlinked in the current fleet record: ${presenceReading.errors.get(normalMachine(machine)) ?? 'unlinked from the team'}` }) }
-  : await runtimeDoor(normalMachine(machine ?? localMachine()) === localMachine() ? null : machine, method, params, options);
+const doorOn = async (machine, method, params, options) => {
+  if (offlineMachine(machine)) return refusal('machine_offline', `machine ${normalMachine(machine)} is unlinked in the current fleet record: ${presenceReading.errors.get(normalMachine(machine)) ?? 'unlinked from the team'}`);
+  const reads = READ_DOORS.has(method);
+  if (reads && stopping) return refusal('board_parked', parkedError().message);
+  try { return await runtimeDoor(normalMachine(machine ?? localMachine()) === localMachine() ? null : machine, method, params, reads ? { ...options, signal: park.signal } : options); }
+  finally { roundStep(`${method} on ${normalMachine(machine ?? localMachine())}`); }
+};
 const unavailable = message => Object.assign(new Error(message), { launchDeferred: true });
 
 // ------------------------------------------------------------------ supervise
@@ -516,7 +532,39 @@ async function recordBounces(board, fleet, entry, report) {
   }
 }
 
+/**
+ * An unended run is its card's current run, or it is ended. Every path that ends a run (end_run, endRun, a re-claim,
+ * the supervision below) reaches it through `tasks.current_run_id`, so a run no card holds as current is one nothing
+ * supervises and nothing will end: it reads `running` for ever, keeps its session counted live (sessionEnded) and its
+ * pane protected from closing (recordInputClose). Each such run is ended here as reclaimed, with its card's status at
+ * the time, whether its card is done, cancelled or still open, and whether it recorded a session or none. Its session
+ * is not closed here, and none is guaranteed gone: its card's current run may carry it, or its pane may still be alive
+ * with no owner (a live card a rebuild from the documents deleted keeps its runs, ztrack.mjs `plan.remove`). Where the
+ * workflow monitors runs and the retired run is its open card's latest, reconnectContinuedSessions finds that pane
+ * still running and reopens the run as the card's current run, under supervision again; any other such pane is left
+ * as it is.
+ */
+const UNHELD_RUNS = `SELECT r.id, r.task_id, r.metadata, t.status AS card_status, c.stage FROM task_runs r
+  LEFT JOIN tasks t ON t.id = r.task_id LEFT JOIN supercode_cards c ON c.task_id = r.task_id
+  WHERE r.ended_at IS NULL AND NOT EXISTS (SELECT 1 FROM tasks h WHERE h.current_run_id = r.id)`;
+function retireUnheldRuns(board, report) {
+  // read first: a round with nothing to retire opens no write; the write re-reads what it ends
+  if (!view(board, (db) => db.prepare(`${UNHELD_RUNS} LIMIT 1`).get())) return;
+  tx(board, (db) => {
+    for (const row of db.prepare(UNHELD_RUNS).all()) {
+      const session = json(row.metadata, {})?.supercode ?? null;
+      const status = row.stage ?? row.card_status ?? null;
+      const reason = `run ${row.id} is not the current run of ${row.task_id}${status ? ` (${status})` : ''}; nothing supervises it`;
+      db.prepare(`UPDATE task_runs SET status = 'reclaimed', outcome = 'reclaimed', summary = COALESCE(summary, ?), ended_at = ?,
+        claim_lock = NULL, claim_expires = NULL, worker_pid = NULL WHERE id = ? AND ended_at IS NULL`).run(reason, now(), row.id);
+      event(db, row.task_id, 'run_retired', { reason, card_status: status, session_id: session?.session_id ?? null, pane: session?.pane ?? null, machine: session?.machine ?? null }, row.id);
+      (report.retired ??= []).push([row.task_id, row.id]);
+    }
+  });
+}
+
 async function supervise(board, fleet, settings, report, entry, effects) {
+  retireUnheldRuns(board, report);
   const rows = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
   // Published native observations are the only liveness input. Missing data remains unknown. A launch the
   // observations show stopped is asked, through its machine's door, how it ended.
@@ -883,7 +931,9 @@ async function homeHoldings(root, slugs, lanes, fleet, entry) {
         // each run's session read before it is counted live or not (unknown stays unknown)
         for (const r of b.db.prepare('SELECT r.metadata FROM tasks t JOIN task_runs r ON r.id = t.current_run_id').all()) await readBefore(fleet, json(r.metadata, {})?.supercode);
         const storedOf = (id) => storedStatus(b.db, b, entry, id).stored;
-        out.push(...await holdings(b, { lanes, fleetOk: fleet.ok, alive: (s) => sessionAlive(fleet, s), liveRecord: live, modelOf: transcriptModel, storedOf, machineOf: normalMachine, home: localMachine(),
+        // a session on a machine whose record is not current is not known gone: it keeps its place in the caps
+        out.push(...await holdings(b, { lanes, fleetOk: fleet.ok,
+          alive: (s) => sessionAlive(fleet, s) ?? (s?.surface !== 'headless' && s?.machine && fleet.unknown?.has(normalMachine(s.machine)) ? true : null), liveRecord: live, modelOf: transcriptModel, storedOf, machineOf: normalMachine, home: localMachine(),
           runLaneOf: row => runLane(b.db, b, entry, getTask(b.db, row.id), lanes) }));
       }
       finally { b.close(); }
@@ -974,6 +1024,9 @@ async function startCards(board, fleet, lanes, settings, report, entry, effects,
     if (task.subtask_of || task.current_run_id) continue;
     const state = scopeFor(task).card;
     if (state.archived || ['done', 'cancelled'].includes(state.status)) continue;
+    // A person's card is a dependency on that person, never work for a session: the board starts none for it, whatever
+    // its workflow's start would allow, and it closes when that person completes it (person-done).
+    if (state.person) { waiting(task, `assigned to ${state.person}: a person's card runs no session; it closes when that person completes it`); continue; }
     if (state.status === 'running' && completedWork(board.db, task.id)) {
       waiting(task, 'work is complete; the board must select its independent review before another implementer run'); continue;
     }
@@ -1134,9 +1187,8 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
   const surface = lane.surface === 'pane' ? 'pane' : 'headless';
   const scope = view(board, (db) => scopeOf(db, board, task, { params: entry.params }));
   const where = whereOf(board, task);
-  // a subtask's run also sees its arc: the arc's text, tasks and thread (where its owner's rulings are)
-  const arcContext = task.subtask_of ? view(board, (db) => cardContext(db, task.subtask_of, { nativeHolds: Boolean(entry.workflow.flags?.paused) })) : '';
-  let prompt = render(spec.prompt, { ...scope, where, context: view(board, (db) => cardContext(db, id, { nativeHolds: Boolean(entry.workflow.flags?.paused) })), arc_context: arcContext, doors: doors(entry.workflow, status, spec.role, id, where, surface) });
+  const told = view(board, (db) => roleBrief(db, board, entry, task, status, surface));
+  let prompt = told.prompt;
   // the run's session record knows its status, role and slot (a reviewer's slot is never the implementer's); the slot
   // is a template, so a step can ask for isolation by naming a new one
   const slot = String(templateValue(spec.session ?? 'worker', scope) ?? 'worker');
@@ -1166,13 +1218,26 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
       throw Object.assign(new Error(refused.why), { launchPending: true });
     }
   }
+  // A machine whose record is not current lists none of its sessions or panes: nothing opened there could be checked
+  // against what already runs (a continuation, a cap's holdings). An explicit start or a deferred one waits for its
+  // reading, as a round's launcherCheck does; its clock moves with the wait (reconcileLaunches).
+  const host = lane.surface === 'pane' ? executionHost(lane, task.machine, localMachine(), normalMachine) : null;
+  if (host && fleet?.unknown?.has(host)) {
+    const why = `machine ${host}'s fleet record is not current: ${fleet.errors?.get(host) ?? 'no current record'}; the launch waits for it`;
+    runTx(board, id, runId, db => {
+      const previous = currentRun(db, id)?.metadata?.supercode;
+      setRunSession(db, runId, { status, role: spec.role, slot, launched_at: now(), launch_deferred: true, launch_deferred_error: why });
+      if (previous?.launch_deferred_error !== why) event(db, id, 'launch_deferred', { reason: why }, runId);
+    });
+    throw Object.assign(new Error(why), { launchDeferred: true, launchPending: true });
+  }
   if (spec.role === 'reviewer') {
     const worker = view(board, (db) => lastSession(db, id, 'worker'));
     const reviewer = view(board, (db) => lastSession(db, id, slot));
     if (slot === 'worker' || (worker?.session_id && worker.session_id === reviewer?.session_id)) throw new Error('a reviewer must have a different session from the implementer');
   }
   // the model it runs is recorded with the session, for caps that count by model
-  const meta = { status, role: spec.role, slot, model: task.model_override ?? lane.model ?? null, ...(spec.role === 'reviewer' ? { review_candidate: reviewCandidate(board, id) } : {}) };
+  const meta = { status, role: spec.role, slot, model: task.model_override ?? lane.model ?? null, prompt_digest: told.digest, ...(spec.role === 'reviewer' ? { review_candidate: reviewCandidate(board, id) } : {}) };
   try {
     // Teams is never on a launch's path: the card's agent is its identity minted on this host under its retained intent,
     // and its sessions are joined to it off this path, after the launch. No Teams answer starts, stops or holds a card.
@@ -1237,15 +1302,86 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
  * line stays one line and far under that size whatever the card holds; the session on the board's machine reads the
  * file, one elsewhere prints it through the board's door.
  */
-export function briefByReference(board, task, runId, role, where, prompt) {
+export function briefByReference(board, task, runId, role, where, prompt, how = 'started') {
   const file = briefPath(board.root, board.slug, task.id, runId);
   mkdirSync(dirname(file), { recursive: true });
   writeFileSync(file, `${prompt}\n`, { mode: 0o600 });
+  const card = cardLabel(boardKey(board.root, board.slug), cardNumber(board.db, task.id), task.id, readableIdOf(board, task.id));
+  const opening = how === 'attached' ? `The ${board.label} board attached you to run ${runId} of card ${card} as its ${role}`
+    : how === 'changed' ? `The ${board.label} board's brief for the ${role} of card ${card} changed (run ${runId})`
+    : `The ${board.label} board started run ${runId} of card ${card} and you are its ${role}`;
+  return `${opening}. Your instructions from the board are the brief ${briefFrom(board, task, file, where)}, then carry it out as your own task without waiting for another message.`;
+}
+
+/**
+ * A card role's brief: the workflow's prompt for the role the card's status runs (the home's prompts/<role>.md), rendered
+ * over the card, its arc and the doors that role has. It is the one text every path that puts a session on a card in a
+ * role gives that session: a launch (a fresh start, a resumed or replaced session, a reviewer's), an adoption, and a
+ * telling again when the home's prompt for the role changes (retellBriefs). `digest` names the prompt it came from.
+ */
+export function roleBrief(db, board, entry, task, status, surface = 'pane') {
+  const spec = runSpec(entry, status, task);
+  if (!spec) return null;
+  const where = whereOf(board, task);
+  const nativeHolds = Boolean(entry.workflow.flags?.paused);
+  const scope = scopeOf(db, board, task, { params: entry.params });
+  // a subtask's run also sees its arc: the arc's text, tasks and thread (where its owner's rulings are)
+  const prompt = render(spec.prompt, { ...scope, where, context: cardContext(db, task.id, { nativeHolds }),
+    arc_context: task.subtask_of ? cardContext(db, task.subtask_of, { nativeHolds }) : '', doors: doors(entry.workflow, status, spec.role, task.id, where, surface) });
+  return { spec, where, prompt, digest: promptDigest(spec) };
+}
+const promptDigest = (spec) => spec?.prompt ? createHash('sha256').update(String(spec.prompt)).digest('hex').slice(0, 16) : null;
+
+/** File a role's brief (roleBrief) to the session at `address` on run `runId`, by reference, as a session notice in the
+ *  caller's transaction, and record which prompt it was. */
+function queueBrief(db, board, task, runId, address, told, how) {
+  const role = told.spec.role ?? 'implementer';
+  const text = briefByReference(board, task, runId, role, told.where, told.prompt, how);
+  const source = event(db, task.id, 'brief_told', { address, role, how, prompt_digest: told.digest }, runId);
+  const effect = { kind: 'session_notice', id: task.id, runId, address, text, sourceEvent: source, verb: how === 'changed' ? 'brief_changed' : 'brief',
+    messageKey: `board-brief-${task.id}-${runId}-${told.digest}-${how}-${createHash('sha256').update(address).digest('hex').slice(0, 12)}` };
+  db.prepare('INSERT INTO supercode_effects (effect) VALUES (?)').run(JSON.stringify(effect));
+  setRunSession(db, runId, { prompt_digest: told.digest });
+}
+
+/**
+ * Each session working a card is told its role's brief again, once, when the home's prompt for that role is not the one
+ * it was told (its run's `prompt_digest`; a run that records none was never told this one), as a room's guidance is told
+ * again on every change. A session being launched, closed, released or in a person's hands is told nothing here.
+ */
+function retellBriefs(board, entry, report) {
+  // each card in its own write: a brief that cannot be told (its prompt unreadable, its card changed) is said in the
+  // round's report and stops no other card's
+  for (const { id } of view(board, (db) => db.prepare('SELECT id FROM tasks WHERE current_run_id IS NOT NULL').all())) {
+    try {
+      tx(board, (db) => {
+        const run = currentRun(db, id), session = run?.metadata?.supercode, address = addressOf(session);
+        if (!run || run.ended_at != null || !address || session.surface === 'headless' || session.launch_pending || session.launch_deferred
+          || session.close_requested || session.close_confirmed_at || session.released || detachedSession(db, session)) return;
+        const task = getTask(db, id), status = statusOf(db, task);
+        if (promptDigest(runSpec(entry, status, task)) === (session.prompt_digest ?? null)) return;
+        const told = roleBrief(db, board, entry, task, status, 'pane');
+        if (!told?.digest) return;
+        queueBrief(db, board, task, run.id, address, told, 'changed');
+        (report.briefs_retold ??= []).push([id, run.id, told.digest]);
+      });
+    } catch (error) { (report.failed ??= []).push([id, `brief: ${String(error.message).slice(-200)}`]); }
+  }
+}
+/** Where a run's session reads its brief: the file on the board's machine, the board's door on any other. */
+function briefFrom(board, task, file, where) {
   const local = !task.machine || normalMachine(task.machine) === localMachine();
-  const from = local ? `in the file ${file}: read the whole file now`
+  return local ? `in the file ${file}: read the whole file now`
     : `kept by the board: print it with \`supercode workflow brief ${task.id} ${where}\` (into a file outside your repository when it is long) and read all of it now`;
-  const ref = cardHandleOf(board, task.id)?.toUpperCase();
-  return `The ${board.label} board started run ${runId} of card ${ref ? `${ref} (${task.id})` : task.id} and you are its ${role}. Your instructions from the board are the brief ${from}, then carry it out as your own task without waiting for another message.`;
+}
+/**
+ * The run's pending brief, said again in an idle reminder: a session that stopped before its first turn (its first input
+ * undelivered, its turn interrupted) still has the whole of its instructions in the brief, and a reminder that only
+ * says "continue" names nothing it was told. Null when the run kept no brief (a headless run's prompt is its argv).
+ */
+function pendingBrief(board, task, runId, where) {
+  const file = briefPath(board.root, board.slug, task.id, runId);
+  return existsSync(file) ? `Run ${runId}'s instructions from the board are its brief ${briefFrom(board, task, file, where)}, and carry it out.` : null;
 }
 
 /** Start one card now by a person's word (a triage card's session, a manager's start): the workflow's start event. */
@@ -1258,6 +1394,8 @@ export async function startCard(board, id, { roles = ['manager'], lanes, setting
   const before = getTaskNow(board, id), checked = await checkWorkspace(board, before);
   const moved = tx(board, (db) => {
     if (detachedCard(db, id)) throw new Error(`${id} is detached to a person; request and verify adoption before starting it`);
+    const person = personOf(getTask(db, id)?.assignee);
+    if (person) throw new Error(`${id} is assigned to ${person}: a person's card runs no session; it closes when that person completes it`);
     assertWorkspaceOwner(db, before, checked);
     if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.workspaceRoot, id);
     if (!roles.some(role => ['manager', 'creator'].includes(role))) throw new Error('Only the manager or creator starts a held card; request its decision.');
@@ -1332,8 +1470,11 @@ async function turnAtClose(session, pane = null, { launchWindow = null, quiet =
   const machine = session.machine ?? localMachine();
   const recordOf = (rows, id, harness) => rows.find((row) => row.locator?.session_id === id && row.locator?.harness === harness);
   let activity, rows = null;
+  // A Codex pane may run under its own Codex home (a pane route's CODEX_HOME, recorded on the run as codex_home), which
+  // the machine's default sources do not hold: every read of its session here names that home, as readNative does.
+  const codexHome = (session.harness ?? 'claude-code') === 'codex' ? session.codex_home ?? null : null;
   if (pane?.pid) {
-    const r = await doorOn(machine, 'harness.v1.sessions.activity_under', { pids: [pane.pid] }, { timeout: NATIVE_DISCOVERY_MS });
+    const r = await doorOn(machine, 'harness.v1.sessions.activity_under', { pids: [pane.pid], ...(codexHome ? { homes: { codex: join(codexHome, 'sessions') } } : {}) }, { timeout: NATIVE_DISCOVERY_MS });
     const page = r.code === 0 ? lastJson(r.stdout) : null;
     if (!Array.isArray(page?.activities)) return { why: `the session in pane ${session.pane} could not be read just now (${(r.stderr || r.stdout).trim().slice(-160)})` };
     activity = page.activities.find((item) => item.pid === pane.pid)?.activity ?? null;
@@ -1349,7 +1490,7 @@ async function turnAtClose(session, pane = null, { launchWindow = null, quiet =
       if (command && !HARNESS_COMMANDS.has(command)) return null;
       const unfound = `pane ${session.pane} runs ${command || 'a program it does not name'}, whose session could not be read`;
       if (!session.session_id) return { why: unfound };
-      try { rows = (await discoverNative(machine, session.harness ?? 'claude-code', session.session_id)).sessions; }
+      try { rows = (await discoverNative(machine, session.harness ?? 'claude-code', session.session_id, codexHome)).sessions; }
       catch (error) { return { why: `${unfound} (${String(error.message).slice(0, 160)})` }; }
       activity = recordOf(rows, session.session_id, session.harness ?? 'claude-code')?.activity ?? null;
       // a row that shows no live owner beside a pane that runs a harness places nothing: another session may run there
@@ -1359,7 +1500,7 @@ async function turnAtClose(session, pane = null, { launchWindow = null, quiet =
     return { why: `pane ${session.pane} names no process to read` };
   } else {
     if (!session.session_id) return { why: 'its session is not known yet' };
-    try { rows = (await discoverNative(machine, session.harness ?? 'claude-code', session.session_id)).sessions; }
+    try { rows = (await discoverNative(machine, session.harness ?? 'claude-code', session.session_id, codexHome)).sessions; }
     catch (error) { return { why: `its session could not be read just now (${String(error.message).slice(0, 160)})` }; }
     activity = nativeReading(rows, session).row?.activity ?? null;
     if (!activity) return { why: `its session ${addressOf(session)} is not in its machine's discovery` };
@@ -1383,7 +1524,7 @@ async function turnAtClose(session, pane = null, { launchWindow = null, quiet =
   if (blocked) return { stopped: blocked };
   const sessionId = activity.session_id ?? session.session_id, harness = activity.harness ?? session.harness ?? 'claude-code';
   if (!sessionId || !quiet) return { why: unknown };
-  if (!rows) try { rows = (await discoverNative(machine, harness, sessionId)).sessions; }
+  if (!rows) try { rows = (await discoverNative(machine, harness, sessionId, codexHome)).sessions; }
     catch (error) { return { why: `${unknown}, and its record could not be read just now (${String(error.message).slice(0, 160)})` }; }
   const record = recordOf(rows, sessionId, harness);
   if (TURN_IN_PROGRESS.has(record?.activity?.turn)) return inTurn(record.activity.turn);
@@ -1469,7 +1610,17 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       if (current) retireSupersededRuns(db, current.task_id, row.id, json(current.metadata, {})?.supercode);
     }
   });
+  // Each machine's pane list, read once per pass: its live panes, and its dead ones. A dead pane is still the machine's
+  // until it is closed (a pane whose program failed is kept, marked dead, for its last screen), so it is closed as any.
   const panes = new Map();
+  const paneListOn = async (machine) => {
+    if (!panes.has(machine)) {
+      const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000, as: boardAddress(board.label) });
+      const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
+      panes.set(machine, Array.isArray(list) ? { live: new Map(list.filter(p => !p.dead).map((p) => [p.pane, { pid: p.pid ?? null, command: p.activeCommand ?? null }])), dead: new Set(list.filter(p => p.dead).map((p) => p.pane)) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
+    }
+    return panes.get(machine);
+  };
   for (const row of rows) {
     await yieldToOwner();
     let session = json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
@@ -1533,6 +1684,8 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); })) continue;
         finalFailure = false;
       } else if (observed.present !== false) continue;
+      // presence answers for a pane whose program runs: one its machine still lists dead is not gone, and its refusal stands
+      else if ((await paneListOn(session.machine ?? localMachine())).dead?.has(session.pane)) continue;
     }
     const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all());
     // Persist retries even for historical ends that did not have a close_session action. The close is claimed in the
@@ -1566,6 +1719,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       return true;
     });
     if (!claimed) continue;
+    noteClaim(board, 'runs', row.id);
     try {
       const machine = session.machine ?? localMachine();
       if (session.surface === 'native' && !session.pane) {
@@ -1578,17 +1732,17 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
           await stopSession(board, session);
         }
       } else if (!finalFailure) {
-      if (!panes.has(machine)) {
-        const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000, as: boardAddress(board.label) });
-        const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
-        panes.set(machine, Array.isArray(list) ? { live: new Map(list.filter(p => !p.dead).map((p) => [p.pane, { pid: p.pid ?? null, command: p.activeCommand ?? null }])) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
-      }
-      const observed = panes.get(machine);
+      const observed = await paneListOn(machine);
       if (observed.error) throw new Error(`close deferred: ${observed.error}`); // an unread pane list is no verdict on the pane
-      if (observed.live.has(session.pane)) {
+      const dead = observed.dead.has(session.pane);
+      if (dead || observed.live.has(session.pane)) {
         const protectedNow = view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all())
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); });
         if (protectedNow) throw new Error(`close deferred: pane ${session.pane} is owned by an unended run`);
+      }
+      // a dead pane's program has ended: it has no turn to close between, and is closed at once
+      if (dead) { await stopSession(board, session); observed.dead.delete(session.pane); }
+      else if (observed.live.has(session.pane)) {
         // An ended run's session is closed only between its turns, read last, after the claim and the pane list (a pane
         // already gone is settled above with no reading; t_f34710bc's coder was cut mid-proof at 15:01:13Z, 2026-10-04).
         if (row.ended_at) {
@@ -1652,7 +1806,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
 }
 
 // When this process last read each run's turn (run id → seconds). Kept in memory on purpose: a board that restarted
-// has watched nothing, and its first reading of a run is where that run's watch begins.
+// has read nothing itself, and its first reading of a run is where that run's watch resumes (resumedWatch).
 const idleWatch = new Map();
 /** Native idle intervals are independent of dispatch cadence and transcript writes.
  * Keep bounded readings on the run so an ordinary quiet stretch can be reviewed later. */
@@ -1720,24 +1874,35 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       // clock of the run moves on a round that could not see it
       if (session.machine && !fleet.online.has(session.machine)) return;
       if (session.surface === 'native' && sessionAlive(fleet, session) !== true) return;
-      // a session in no pane has its turn on its machine's discovery row, which sessionAlive just read
+      // A session the machine's record publishes no activity for has its turn on its machine's discovery row, which
+      // readBefore read: a session in no pane, and a live pane whose record names no session in it (a Codex pane on its
+      // own Codex home, VO-3259 run 2408: supervise read its turn idle there while this read none, so its run took the
+      // unknown-turn notice once and was never reminded or reclaimed). A pane is read so only while its record shows it.
+      const published = fleet.sessions.find((x) => x.address === addressOf(session));
       let nativeRow = null;
-      if (session.surface === 'native') try { nativeRow = nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code', session.session_id), session).row; } catch { /* unread: no turn */ }
-      const live = fleet.sessions.find((x) => x.address === addressOf(session)) ?? (nativeRow ? { address: addressOf(session), turn: nativeRow.activity?.turn ?? null, waiting_for: nativeRow.activity?.evidence?.waiting_for ?? null,
+      if (!published && (session.surface === 'native' || sessionAlive(fleet, session) === true)) try { nativeRow = nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code', session.session_id), session).row; } catch { /* unread: no turn */ }
+      const live = published ?? (nativeRow ? { address: addressOf(session), turn: nativeRow.activity?.turn ?? null, waiting_for: nativeRow.activity?.evidence?.waiting_for ?? null,
         turn_source: nativeRow.activity?.evidence?.source ?? null, turn_since_ms: nativeRow.activity?.evidence?.native_state_since_ms ?? null } : undefined);
       const observedAt = now();
       // Quiet time is time the board watched. A run this process has not read for a while (the board restarted, was
-      // paused, could not read the fleet or the machine) starts its idle and unknown-turn clocks from this reading:
-      // the gap is not idleness, and no reminder is spent on it (volter-org t_9a9c2a9c: reminder 1 in the second its
-      // machine came back, the run reclaimed 45 minutes later).
+      // paused, could not read the fleet or the machine) resumes its idle clock where resumedWatch reads it: from the
+      // harness's own idle-since where its session reads idle with one and its machine's record was current over it,
+      // else from this reading, so a gap the board could not see is not idleness and no reminder is spent on it
+      // (volter-org t_9a9c2a9c: reminder 1 in the second its machine came back, the run reclaimed 45 minutes later).
+      // The unknown-turn clock starts here.
       const lastWatched = idleWatch.get(runRow.id);
       if (lastWatched == null || observedAt - lastWatched > Math.max(3 * settings.interval, settings.idleQuiet / 2)) {
-        setRunSession(db, runRow.id, { watch_since: observedAt, unknown_since: null });
-        session = { ...session, watch_since: observedAt, unknown_since: null };
+        const resumed = resumedWatch(session, live, runRow, fleet.linkedSince?.get(session.machine ?? localMachine()), observedAt);
+        setRunSession(db, runRow.id, { watch_since: resumed, unknown_since: null });
+        session = { ...session, watch_since: resumed, unknown_since: null };
       }
       watched = [runRow.id, observedAt];
-      const read = sessionProgress(db, task);
+      // A reviewer's work is its verdict, and its verdict ends its run: nothing the card shows while the review runs is
+      // the reviewer's progress (the implementer's commits, a card specified or a subtask closed would reset its reminders
+      // for as long as anyone else works), and an unread checkout does not hold them.
+      const reviewing = (session.slot ?? 'worker') === 'reviewer';
       const priorProgress = session.work_progress;
+      const read = reviewing ? { event: priorProgress?.event ?? sessionProgress(db, task).event, commit: null } : sessionProgress(db, task);
       // The commit a run is measured from is the last one read. A checkout that could not be read (its machine silent,
       // its daemon without the door) keeps that baseline: its first reading after is where it stands, not work done.
       const progress = { event: read.event, commit: read.commit ?? priorProgress?.commit ?? null, ...(read.commit == null ? { commit_unread: read.commit_unread } : {}) };
@@ -1845,10 +2010,13 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       // A native idle receipt also works without a transcript timestamp.
       const interval = idleInterval(session, live, observedAt);
       reading.idle_since = interval.since; reading.quiet_seconds = interval.quiet;
+      reading.idle_since_at = new Date(interval.since * 1000).toISOString().replace(/\.\d{3}Z$/, 'Z');
       if (session.idle_since !== interval.since) setRunSession(db, runRow.id, { idle_since: interval.since });
-      // The workflow declares the threshold, repeat interval, eligibility and
-      // notice. The observer only supplies a watched native idle interval. This
-      // path precedes heartbeat/nudge cooldown and unread checkout handling.
+      // The workflow declares the threshold, repeat interval, eligibility (whether
+      // the board shows a recorded wait), audience and notice. The observer only
+      // supplies a watched native idle interval. This path precedes
+      // heartbeat/nudge cooldown and unread checkout handling.
+      let stalled = false;
       if (handles('session_stalled')) {
         const limits = limitsOf(db, board, entry, task, session);
         const first = Number(limits.idle_notice), repeat = Number(limits.idle_notice_repeat);
@@ -1862,6 +2030,7 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
             last_turn_time_source: Number(live?.turn_since_ms) > 0 ? 'native_idle_since' : turnAt ? 'last_session_update' : null, repeat: Boolean(prior) };
           const result = fire(db, board, entry, id, 'session_stalled', { roles: ['platform'], payload });
           staged.push(...result.effects);
+          stalled = true;
           setRunSession(db, runRow.id, { idle_notice: { native_since_ms: nativeIdle, since: interval.since, at: observedAt } });
           report.notified.push([id, 'session_stalled', address]);
         } catch (error) {
@@ -1869,24 +2038,41 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
         }
       }
       if (!handles('session_idle')) return;
+      // a session told it stalled is not also reminded for a whole quiet period after that notice
+      if (stalled || (Number(session.idle_notice?.at) > 0 && observedAt - Number(session.idle_notice.at) < settings.idleQuiet)) { retain('stall_notified'); return; }
       if (reading.quiet_seconds < settings.idleQuiet) { retain('below_threshold'); return; }
       if (session.goal_nudged_at && observedAt - session.goal_nudged_at < settings.idleQuiet) { retain('nudge_cooldown'); return; }
       // a session whose first input bounced was never told its work: its quiet is not idleness (recordBounces told its manager)
       if (session.first_input === 'bounced') { retain('first_input_bounced'); return; }
       // A reminder says the card shows no progress, and the last of them ends the run for it. With the card's checkout
       // unread that is not known: nothing is said or counted until it is read (the reading's `progress` says why).
-      if (read.commit == null) { retain('progress_unread'); return; }
+      if (read.commit == null && !reviewing) { retain('progress_unread'); return; }
       try {
         const where = whereOf(board, task);
         // the ask names what the session may do, as its run's prompt did
         const said = doors(entry.workflow, status, session.role ?? runSpec(entry, status)?.role ?? 'implementer', id, where, session.surface !== 'headless' ? 'pane' : 'headless');
-        const r = fire(db, board, entry, id, 'session_idle', { roles: ['platform'], payload: { ...reading, turns: reading.turns_before, worked }, extra: { where, doors: said } });
+        const brief = pendingBrief(board, task, runRow.id, where);
+        const r = fire(db, board, entry, id, 'session_idle', { roles: ['platform'], payload: { ...reading, turns: reading.turns_before, worked }, extra: { where, doors: said, pending_brief: brief } });
+        // a reminder wakes the session with what its run is for: send_to_actor saves it with the run's pending brief
         staged.push(...r.effects);
         const after = currentRun(db, id);
         const stored = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runRow.id)?.metadata, {})?.supercode;
         const observation = retain('dispatched', { turns_after: Number(stored?.goal_turns ?? 0), nudge_queued: r.effects.some(e => e.kind === 'send_to_actor'), run_ended: after?.id !== runRow.id });
         event(db, id, 'session_idle_observed', observation, runRow.id);
         if (after?.id === runRow.id) setRunSession(db, runRow.id, { goal_nudged_at: observedAt });
+        else if (reviewing && db.prepare('SELECT ended_at FROM task_runs WHERE id = ?').get(runRow.id)?.ended_at != null) {
+          // A reviewer that stayed idle through its reminders with no verdict has its run ended and its session closed;
+          // the card's next review run (the board's own, its card still in review) resumes that same reviewer session
+          // with its round's brief, as every review round does. Nothing is voided: no verdict was given, and every
+          // earlier one stands.
+          requestSessionClose(db, id, { runId: runRow.id });
+          const ended = db.prepare('SELECT outcome FROM task_runs WHERE id = ?').get(runRow.id)?.outcome ?? null;
+          event(db, id, 'review_run_restarted', { run_id: runRow.id, session: address, outcome: ended, reminders: reading.turns_before, quiet_seconds: reading.quiet_seconds }, runRow.id);
+          const card = getTask(db, id), held = Boolean(card?.blocked_by?.length || card?.paused);
+          const to = managers[0] ?? null;
+          if (to) event(db, id, 'board_message', { to, text: `${id}: its reviewer session ${address} stayed idle with no verdict through ${reading.turns_before} reminder(s) carrying its brief; the board ended review run ${runRow.id} (${ended ?? 'ended'}) and closed that session. ${held ? 'The card is held (its failure limit or a block), so its next review resumes that reviewer session once it is released.' : 'Its next review run resumes that reviewer session.'} No verdict was voided.` }, null);
+          (report.review_restarted ??= []).push([id, runRow.id, address]);
+        }
         report.notified.push([id, 'session_idle', addressOf(session)]);
       } catch (error) {
         retain('dispatch_failed', { error: String(error.message).slice(-200) });
@@ -1923,7 +2109,7 @@ export async function sessionNotice(board, e) {
   const address = e.address ?? addressOf(prior);
   if (!address) throw new Error('lifecycle notice awaits the owned launch session identity');
   const card = view(board, (db) => getTask(db, e.id));
-  const subject = numbered(boardKey(board.root, board.slug), card?.number, `${String(e.verb ?? 'run_changed').replaceAll('_', ' ')} · run ${e.runId} · event ${e.sourceEvent ?? 'none'} · ${card?.title || e.id}`);
+  const subject = numbered(boardKey(board.root, board.slug), card?.number, `${String(e.verb ?? 'run_changed').replaceAll('_', ' ')} · run ${e.runId} · event ${e.sourceEvent ?? 'none'} · ${card?.title || e.id}`, noticeName(card));
   const filed = await fileMail(board, address, e.text, effectMessageKey(e), { subject });
   tx(board, (db) => {
     const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(e.runId)?.metadata, {})?.supercode;
@@ -1946,7 +2132,7 @@ export async function sessionEffect(board, e) {
     if (!address) throw new Error('actor session identity unavailable');
     // filed in the actor's mailbox, which delivers it
     const card = view(board, (db) => getTask(db, e.id));
-    const filed = await fileMail(board, address, e.text, effectMessageKey(e), { subject: numbered(boardKey(board.root, board.slug), card?.number, `actor notice · run ${e.runId ?? 'none'} · ${card?.title || e.id}`) });
+    const filed = await fileMail(board, address, e.text, effectMessageKey(e), { subject: numbered(boardKey(board.root, board.slug), card?.number, `actor notice · run ${e.runId ?? 'none'} · ${card?.title || e.id}`, noticeName(card)) });
     if (filed.new) tx(board, db => event(db, e.id, 'actor_notice_filed', { notice: e.durableId, address, message_id: filed.message_id }, e.runId));
     return true;
   }
@@ -2191,16 +2377,18 @@ async function readRunUsage(root,org,row,endedAt){
 /** The board's agent records: each run kept in the agent store, closed cards' assignments ended, declarations and ends
  * handed to this machine's daemon, and usage read from each machine's own doors. No Teams call: the daemon declares and
  * ends agents and binds their sessions (D137). It runs in the delivery pass (`deliver`), never in a dispatch round. */
-async function synchronizeAgents(board, report) {
+async function synchronizeAgents(board, report, fleet = null) {
   // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
   // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
   const agentRuns=[...new Map((await readRunPages(board.db, 'id,task_id,metadata,ended_at', { where: "json_extract(metadata,'$.supercode.agent_id') IS NOT NULL" }))
     .map(row=>{const session=json(row.metadata,{})?.supercode;return [session?.session_id?addressOf(session):`run:${row.id}`,row];})).values()];
+  const live=new Map();
   for(const scanned of agentRuns){
     await yieldToOwner();
     const row=view(board,db=>db.prepare('SELECT id,task_id,metadata,ended_at FROM task_runs WHERE id=?').get(scanned.id));
     if(!row)continue;
     const session=json(row.metadata,{})?.supercode;
+    if(credentialsWanted(board,row,session,fleet))live.set(credentialsKey(session.machine,session.agent_id),{task:row.task_id,run:row.id});
     if(!session?.session_id||!session.agent_org||view(board,db=>detachedSession(db,session)))continue;
     const ref=`${session.harness}:${session.session_id}`;
     // An ended run whose session the agent store already holds for another agent lost that claim when it ran: no round
@@ -2219,6 +2407,7 @@ async function synchronizeAgents(board, report) {
     try{recordAgentRun(board.root,session.agent_org,session.agent_id,{session:ref,machine:session.machine,run:row.id});}
     catch(error){report.queued.push([row.task_id,`run ${row.id}: ${error.message}`]);continue;}
   }
+  await keepAgentCredentialsCurrent(board,live,report);
   // G3: an ended run's session usage, read once from its harness's own records on its machine
   for(const org of new Set(agentRuns.map(row=>json(row.metadata,{})?.supercode?.agent_org).filter(Boolean))){
     let read=0;
@@ -2257,6 +2446,9 @@ async function reconcileLaunches(board, fleet, report, entry, effects, settings,
       const task=getTaskNow(board,id),status=view(board,db=>statusOf(db,task)),spec=runSpec(entry,status,task);
       const profile=spec&&view(board,db=>evaluate(entry.workflow.roles?.[spec.role]??'card.assignee',scopeOf(db,board,task,{params:entry.params})));
       const lane=lanes?.[profile];if(!lane){report.queued.push([id,'launch waits for its configured lane']);continue;}
+      // a launch bound to a machine whose record is not current was not tried either: its clock moves with the wait too
+      const host=lane.surface==='pane'&&task.machine?executionHost(lane,task.machine,localMachine(),normalMachine):null;
+      if(host&&fleet.unknown?.has(host)){tx(board,db=>{if(stillDeferred(db))setRunSession(db,run_id,{launched_at:now()});});report.queued.push([id,`launch waits for machine ${host}'s fleet record: ${fleet.errors?.get(host)??'no current record'}`]);continue;}
       const why=launcherCheck(board.db,task,lane,fleet);if(why){report.queued.push([id,why]);continue;}
       const claimed=tx(board,db=>{if(!stillDeferred(db))return false;setRunSession(db,run_id,{launch_deferred:false});return true;});
       if(!claimed){report.queued.push([id,'its launch was taken by another round']);continue;}
@@ -2325,6 +2517,146 @@ async function reconcileLaunches(board, fleet, report, entry, effects, settings,
   }
 }
 
+// An agent's own Workplace credentials (its records in this home's apps/, installed-apps.mjs) reach each other machine
+// where a session of it runs (sdk/teams/workplace/agent-credentials.mjs keepAgentCredentialsHere), into a home there of
+// this board's own (its scope: sha256 of JSON [this machine, the real home, the slug]), so one board never keeps or
+// removes what another handed. They are handed over the board's operator channel before a pane opens, and again by the
+// delivery pass whenever they change (a renewal, a revocation) or half their lease is gone while a run of the agent is
+// live there; a machine where none is live any more is told to keep none.
+//
+// What the board handed each machine is kept in its own store (supercode_board_state `agent_credentials_handed`, per
+// machine and agent): the scope it was kept under and the home that answered, older scopes still to be emptied
+// (`stale`), a digest of the records without their tokens, the lease's end, the run and card it was handed for, and the
+// attempt that wrote it. Re-keeps and removals go to the stored scope, never one computed again (a machine name read
+// from the host name, a renamed machine or a home named through a link computes another); a launch whose scope differs
+// empties the stored one first. An entry is dropped only once the machine answered keeping none and nothing wrote it
+// meanwhile (compare-and-set on `attempt`), so an offline machine, a lost answer, a restarted board, a separate
+// `workflow deliver` or a concurrent pass is told again. Archiving or deleting a board drains its entries first
+// (drainAgentCredentials). And whatever the board forgets (an archived board's leftovers, a board switched off, a
+// store lost), each copy is a lease the receiving machine removes itself once it passes.
+const HANDED = 'agent_credentials_handed';
+const credentialsKey = (machine, agent) => `${normalMachine(machine)}|${agent}`;
+const credentialsDigest = (records) => createHash('sha256').update(JSON.stringify(records.map(({ token, ...rest }) => rest))).digest('hex');
+const realRoot = (root) => { try { return realpathSync(root); } catch { return root; } };
+const credentialsScope = (board) => createHash('sha256').update(JSON.stringify([localMachine(), realRoot(board.root), board.slug])).digest('hex');
+const handedOf = (db) => json(db.prepare('SELECT value FROM supercode_board_state WHERE key=?').get(HANDED)?.value, {}) ?? {};
+/** Change one entry of the handed set: `change(entry or null)` answers its next value, or null to drop it. */
+function setHanded(board, key, change) {
+  tx(board, (db) => {
+    const handed = handedOf(db), value = change(handed[key] ?? null);
+    if (value) handed[key] = value; else delete handed[key];
+    db.prepare('INSERT INTO supercode_board_state (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(HANDED, JSON.stringify(handed));
+  });
+}
+const runOpen = (board, run) => run != null && Boolean(view(board, (db) => db.prepare('SELECT 1 FROM task_runs WHERE id=? AND ended_at IS NULL').get(run)));
+/** Whether a run's agent wants its credentials on the run's other machine: the run is live (bound yet or not), or it
+ * was detached to a person and its session still runs there (or the fleet cannot say it does not). */
+function credentialsWanted(board, row, session, fleet) {
+  if (!session?.agent_id || !session.machine || normalMachine(session.machine) === localMachine()) return false;
+  if (!row.ended_at) return true;
+  if (!view(board, (db) => detachedSession(db, session) && personCustody(db, addressOf(session)))) return false;
+  const address = addressOf(session);
+  if (!fleet?.ok || fleet.unknown?.has(normalMachine(session.machine))) return true;
+  return Boolean(address && (fleet.alive?.has(address) || (fleet.native?.has(address) && fleet.native.get(address).alive !== false)));
+}
+const UNREACHABLE = new Set(['machine_offline', 'REQUEST_TIMEOUT', 'unavailable', 504, '504', 'ETIMEDOUT', 'ECONNRESET']);
+/** One keep (records) or removal (none) in the home of `scope` on `machine`: `{ home, leaseUntil }`, or `{ why }`. A
+ * machine `unreachable` already holds this pass is not asked again in it. */
+async function credentialsDoor(board, machine, scope, agent, records, unreachable) {
+  if (unreachable?.has(normalMachine(machine))) return { why: `machine ${machine} did not answer earlier in this pass` };
+  const r = await doorOn(machine, 'harness.v1.agent.credentials.keep', { scope, agent, records }, { timeout: 30_000, as: boardAddress(board.label) });
+  const kept = r.code === 0 ? json(r.stdout.trim(), null) : null;
+  if (typeof kept?.home === 'string') return kept;
+  const refusal = json(String(r.stderr ?? '').trim().split('\n').pop(), null);
+  if (UNREACHABLE.has(refusal?.code)) unreachable?.add(normalMachine(machine));
+  return { why: (r.stderr || r.stdout).trim().slice(-300) || 'the machine named no agent home' };
+}
+/** Empty the stale scopes of an entry; each emptied one leaves the list (and, should it be the entry's scope again,
+ * marks the entry to be kept again: the removal may have landed after that keep). Answers the refusals. */
+async function emptyStale(board, key, machine, agent, held, unreachable) {
+  const refused = [];
+  for (const scope of held?.stale ?? []) {
+    const done = await credentialsDoor(board, machine, scope, agent, [], unreachable);
+    if (done.why) { refused.push(done.why); continue; }
+    setHanded(board, key, (entry) => entry && ({ ...entry, stale: (entry.stale ?? []).filter((each) => each !== scope),
+      ...(entry.scope === scope ? { digest: null, attempt: randomUUID() } : {}) }));
+  }
+  return refused;
+}
+/** Keep `agent`'s records in this board's home for it on `machine` (the stored scope; a launch's computed one, the stored
+ * emptied first): `{ home }`, or `{ why }`. */
+async function keepAgentCredentialsOn(board, machine, agent, { records = installedAgentRecords(board.root, agent), run = null, task = null, launch = false, unreachable = null } = {}) {
+  const key = credentialsKey(machine, agent), attempt = randomUUID();
+  const held = view(board, handedOf)[key] ?? null;
+  const scope = launch || !held?.scope ? credentialsScope(board) : held.scope;
+  // Recorded before it is asked: an unanswered keep is still the board's to undo, at this scope.
+  setHanded(board, key, (entry) => ({ ...(entry ?? {}), scope, home: entry?.scope === scope ? entry.home ?? null : null, digest: null, run, task, attempt,
+    stale: [...new Set([...(entry?.stale ?? []), ...(entry?.scope && entry.scope !== scope ? [entry.scope] : [])])].filter((each) => each !== scope) }));
+  await emptyStale(board, key, machine, agent, view(board, handedOf)[key], unreachable);
+  const kept = await credentialsDoor(board, machine, scope, agent, records, unreachable);
+  if (kept.why) return kept;
+  setHanded(board, key, (entry) => entry?.attempt === attempt
+    ? { ...entry, home: kept.home, digest: credentialsDigest(records), keptAt: new Date().toISOString(), leaseUntil: kept.leaseUntil ?? null } : entry);
+  return { home: kept.home };
+}
+/** Tell `machine` to keep none of `agent`'s records for this board, at every scope the entry names; the entry is dropped
+ * only when nothing wrote it since `held` was read, else marked to be decided again. Answers the refusals. */
+async function removeAgentCredentialsOn(board, key, held, unreachable) {
+  const [machine, agent] = key.split('|');
+  const refused = await emptyStale(board, key, machine, agent, held, unreachable);
+  if (held?.scope) {
+    const done = await credentialsDoor(board, machine, held.scope, agent, [], unreachable);
+    if (done.why) return [...refused, done.why];
+  }
+  setHanded(board, key, (entry) => {
+    if (!entry) return null;
+    if (entry.attempt !== held?.attempt) return { ...entry, digest: null, attempt: randomUUID() };
+    const rest = { ...entry, scope: null, home: null, digest: null, stale: entry.stale ?? [] };
+    return rest.stale.length ? rest : null;
+  });
+  return refused;
+}
+/** Whether a kept entry is due again: its records changed, it holds none yet, or half its lease is gone. */
+function credentialsDue(held, records, now = Date.now()) {
+  if (!held?.scope || held.digest !== credentialsDigest(records) || held.stale?.length) return true;
+  const kept = Date.parse(held.keptAt), until = Date.parse(held.leaseUntil);
+  return !(Number.isFinite(kept) && Number.isFinite(until) && now < kept + (until - kept) / 2);
+}
+/** The delivery pass's half: `live` maps each (machine, agent) with a run there that wants its credentials to that run. */
+async function keepAgentCredentialsCurrent(board, live, report) {
+  const unreachable = new Set();
+  for (const key of new Set([...live.keys(), ...Object.keys(view(board, handedOf))])) {
+    const [machine, agent] = key.split('|');
+    // read again for each: a launch or another pass may have written it since this pass began
+    const held = view(board, handedOf)[key] ?? null, wanted = live.get(key) ?? (runOpen(board, held?.run) ? { run: held.run, task: held.task ?? null } : null);
+    const task = wanted?.task ?? held?.task ?? null;
+    if (wanted) {
+      const records = installedAgentRecords(board.root, agent);
+      if (!credentialsDue(held, records)) continue;
+      const kept = await keepAgentCredentialsOn(board, machine, agent, { records, run: wanted.run, task, unreachable });
+      if (kept.why) report.queued.push([task, `agent ${agent}'s own Workplace credentials could not be kept on ${machine}: ${kept.why}`]);
+    } else {
+      const refused = await removeAgentCredentialsOn(board, key, held, unreachable);
+      if (refused.length) report.queued.push([task, `agent ${agent}'s own Workplace credentials could not be removed from ${machine} (its lease ends them by ${held?.leaseUntil ?? 'a day after their last keep'}): ${refused[0]}`]);
+    }
+  }
+}
+/** Before a board is archived or deleted: every machine it handed an agent's records is told to keep none. Answers what
+ * could not be removed now (the lease on that machine ends it). */
+export async function drainAgentCredentials(root, slug) {
+  await knowLocalMachine();
+  const board = openBoard(root, slug);
+  try {
+    board.label = boardLabel(root, slug);
+    const left = [], unreachable = new Set();
+    for (const [key, held] of Object.entries(view(board, handedOf))) {
+      const refused = await removeAgentCredentialsOn(board, key, held, unreachable);
+      if (refused.length) left.push({ machine: key.split('|')[0], agent: key.split('|')[1], leaseUntil: held?.leaseUntil ?? null, reason: refused[0] });
+    }
+    return left;
+  } finally { board.close(); }
+}
+
 async function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'worker', meta = {}, orchestration } = {}) {
   const machine = executionHost(lane, task.machine, localMachine(), normalMachine);
   // Whether a board session opens a terminal window on its machine is the workflow's choice, stated on every launch;
@@ -2344,6 +2676,14 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   if (lane.harness === 'codex' && lane.reasoning_effort) tail.push('-c', `model_reasoning_effort=${JSON.stringify(lane.reasoning_effort)}`);
   const harness = HARNESSES[lane.harness] ? lane.harness : 'claude-code';
   const how = HARNESSES[harness];
+  // A pane on another machine finds its agent's own Workplace credentials in the agent's home there, which its
+  // SUPERCODE_AGENT_HOME names (the rh2 CLI reads it per call); a machine that could not keep them is said on the card,
+  // and its pane opens as before, acting on no Workplace (never on a person's key).
+  if (meta.agent_id && machine !== localMachine()) {
+    const kept = await keepAgentCredentialsOn(board, machine, meta.agent_id, { run: runId, task: task.id, launch: true });
+    if (kept.home) meta.agent_env = { ...meta.agent_env, SUPERCODE_AGENT_HOME: kept.home };
+    else runTx(board, task.id, runId, (db) => event(db, task.id, 'agent_credentials_unkept', { machine, reason: kept.why }, runId));
+  }
   // A card on this machine opens through this machine's own daemon; only another machine is reached with `--on`.
   const base = ['open', '--new', how.program, '--detach', `--window=${window}`, ...(machine === localMachine() ? [] : ['--on', task.machine]), '--cwd', task.workspace_path, '--env', 'SUPERCODE_BOARD_PROCESS_GUARD=1',
     ...Object.entries(meta.agent_env??{}).flatMap(([key,value])=>['--env',`${key}=${value}`])];
@@ -2369,6 +2709,9 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     // the round's own fleet reading: a launch never reads the fleet again
     const fresh = fleet;
     if (!fresh.ok) throw unavailable(`cannot check for a manual continuation of ${prev.session_id}: ${fresh.error}`);
+    // a machine whose record is not current lists no session (continuationPane reads fleet.sessions): no continuation
+    // can be ruled out there, so nothing is resumed beside one
+    if (fresh.unknown?.has(normalMachine(machine))) throw unavailable(`cannot check for a manual continuation of ${prev.session_id}: machine ${machine}'s fleet record is not current: ${fresh.errors?.get(normalMachine(machine)) ?? 'no current record'}`);
     const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
     const listed = r.code === 0 ? json(r.stdout.trim(), null) : null;
     if (!Array.isArray(listed)) throw unavailable(`cannot read panes before continuing ${prev.session_id}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
@@ -2467,7 +2810,14 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     fleet.native ??= new Map(); fleet.native.set(addressOf(prev), reading);
     if (reading.alive && !prev.released && (prev.closed_at || prev.close_requested || prev.forgotten)) throw unavailable(`native session ${addressOf(prev)} is still live; its close must finish before replacement`);
   }
-  if (prev?.forgotten) {
+  // A forgotten session the board released (an adopted one, left running) is still the arc's while it runs: only the
+  // manager's explicit replace_session lets a live one go. Every other forget (a retarget recorded before openCoder kept
+  // the coder) leaves it kept below, as any released session is, and the run is delivered into it; never a fresh
+  // implementer beside it (VO-3755 t_c2d5d21b run 2736). One that is gone is replaced as before.
+  const liveForgotten = prev?.forgotten && prev.released && prev.machine === machine && (prev.harness ?? 'claude-code') === harness
+    && !view(board, (db) => Number(latestEvent(db, task.id, ['session_forgotten'], 'created_at')?.created_at ?? 0) >= Number(prev.forgotten))
+    && (prev.pane ? await panePresent(prev.machine, prev.pane) : sessionAlive(fleet, prev)) === true;
+  if (prev?.forgotten && !liveForgotten) {
     if (!prev.close_confirmed_at && prev.pane && await panePresent(prev.machine, prev.pane)) throw new Error(`forgotten session ${prev.session_id} still has live pane ${prev.pane}; close it before replacement`);
     replaced = { session_id: prev.session_id, why: 'the workflow let it go' };
   }
@@ -2509,12 +2859,13 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     if (next === 'refuse') throw new Error(`session ${prev.session_id} still has live pane ${prev.pane}; cannot resume or replace it`);
     if (next === 'keep') {
       // the session is kept; the heartbeat's count belongs to the run that ended, so the new run starts it again
-      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_since: _is, idle_notice: _in, unknown_since: _us, unknown_notice: _un, work_progress: _wp, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, close_failed_at: _cf, close_unread: _cu, close_claim: _cl, monitor_held: _mh, released: _rl, review_held: _rh, retain_after_run: _rr, ...kept } = prev;
+      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_since: _is, idle_notice: _in, unknown_since: _us, unknown_notice: _un, work_progress: _wp, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, close_failed_at: _cf, close_unread: _cu, close_claim: _cl, monitor_held: _mh, released: _rl, review_held: _rh, retain_after_run: _rr, handed_back_from: _hf, handed_back_run: _hr, forgotten: _fg, resumable: _rs, ...kept } = prev;
       session = { ...kept, mode: 'adopt', launched_at: now(), seen_at: now() };
       // The common binding below transfers ownership and subscriptions before filing the continuation prompt.
     } else if (prev.resumable !== false && await nativeAbsent(prev)) {
-      // nothing to resume and no context to keep: the slot's next session starts fresh
-      replaced = { session_id: prev.session_id, why: `${prev.machine} holds no ${prev.harness ?? 'claude-code'} session of that id (it never took a first turn)`, letGo: true };
+      // its transcript is gone (never written, or removed): nothing to resume and no context to keep, so the slot's next
+      // session starts fresh, and the run's session_replaced event says why
+      replaced = { session_id: prev.session_id, why: `its transcript is gone: ${prev.machine}'s complete ${prev.harness ?? 'claude-code'} discovery lists no session of that id`, letGo: true };
     } else if (prev.resumable !== false) {
       const authorization = view(board, db => currentRun(db,task.id)?.metadata?.supercode?.restart_authorized);
       const released = view(board,db=>{
@@ -2522,11 +2873,12 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
         return last?.kind === 'dispatch_released';
       });
       // Only a session whose run ended in a monitored incident waits for its manager or creator; one a workflow
-      // transition closed (a reviewer after its verdict, an implementer whose card came back) is the slot's
-      // deliberate handoff, resumed for the slot's next run like any other
+      // transition closed (a reviewer after its verdict, an implementer whose card came back) is the slot's deliberate
+      // handoff, resumed for the slot's next run: a card has one session per slot, and every round of that slot runs in
+      // it with the context of the rounds before
       if (monitorsRuns(workflowFor(board.root)) && prev.monitor_held && !authorization && !released) throw new Error(`session ${prev.session_id} is stopped by incident ${prev.incident ?? 'unknown'}; only its manager or creator may restart it with workflow start`);
       // a resumed session is told what this run is for, as a kept one is: the run's own prompt (a reviewer resumed for
-      // its next round gets that round's prompt, its arc's context with it), not only that it was resumed
+      // its next round gets that round's brief and PR heads), not only that it was resumed
       const told = input ? `The board resumed this session for this run of card ${task.id}. ${input}` : `The board resumed this session after it was lost; you are still on card ${task.id}: ${task.title}. Carry on.`;
       // a session is resumed in its own harness, whatever the lane's is now
       const its = HARNESSES[prev.harness ?? 'claude-code'] ?? HARNESSES['claude-code'];
@@ -2547,15 +2899,16 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   if (!session) {
     const sid = how.namesItself ? null : randomUUID();
     const launchKey = `board-${task.id}-r${runId}-${(sid ?? randomUUID()).slice(0,8)}`;
-    // A fresh session is named for its card (`vo-856-3f`; a reviewer's `vo-856-reviewer-3f`), where its harness takes a
-    // name, with the start of its id after it as the name's own suffix; a kept or resumed session keeps its name.
-    const handle = cardHandleOf(board, task.id), ref = handle?.toUpperCase();
-    const name = handle ? `${handle}${slot === 'worker' ? '' : `-${slot}`}-${(sid ?? randomUUID()).slice(0, 2)}` : null;
+    // A fresh session is named for its card by its readable id (`voice-calls-3f`; a reviewer's `voice-calls-reviewer-3f`),
+    // else its handle (`vo-856-3f`), where its harness takes a name, with the start of its id after it as the name's own
+    // suffix; a kept or resumed session keeps its name.
+    const handle = cardHandleOf(board, task.id), readable = readableIdOf(board, task.id), stem = readable ?? handle;
+    const name = stem ? `${stem}${slot === 'worker' ? '' : `-${slot}`}-${(sid ?? randomUUID()).slice(0, 2)}` : null;
     const named = name && NAME_ARGUMENTS[harness] ? NAME_ARGUMENTS[harness](name) : [];
     // Codex names the thread after its native first-input receipt identifies it; Teams uses thread/name/set on
     // this launch's own app-server, then reads the name back. Continuations receive no naming hint.
     session = await openOwned(launchKey, sid, 'fresh', [...base, ...(name && harness === 'codex' ? ['--env', `SUPERCODE_SESSION_NAME=${name}`] : []), '--key', launchKey,
-      '--input', input ?? `Card ${ref ?? task.id}${ref ? ` (${task.id})` : ''}: ${task.title}`, '--', ...(sid ? how.fresh(sid) : how.fresh()), ...named, ...tail]);
+      '--input', input ?? `Card ${cardLabel(boardKey(board.root, board.slug), cardNumber(board.db, task.id), task.id, readable)}: ${task.title}`, '--', ...(sid ? how.fresh(sid) : how.fresh()), ...named, ...tail]);
     if (replaced) session.replaces = replaced.session_id;
   }
   session.harness = session.harness ?? harness;
@@ -2702,7 +3055,13 @@ function rotateLog(file, max, backups) {
 /** A headless card's directory on this machine, made as Hermes makes it (scratch, dir, or a git worktree). */
 async function resolveLocalWorkspace(board, task) {
   const root = board.root;
-  if (task.workspace_kind !== 'scratch') return (await resolveWorkspace({ ...task, handle: cardHandleOf(board, task.id) }, true)).path;
+  if (task.workspace_kind !== 'scratch') {
+    // A branch the board named for the card is claimed until its worktree is made, and the making is recorded once.
+    const facts = view(board, () => workspaceTask(board, task, { claims: true })), claim = facts.branch_claim;
+    const made = await resolveWorkspace(facts, true);
+    if (claim) tx(board, (db) => { if (branchClaim(db, task.id, task.branch_name)) event(db, task.id, 'worktree_made', { branch: task.branch_name, repository: task.workspace_anchor ?? null, path: made.path }); });
+    return made.path;
+  }
   const dir = task.workspace_path || (board.slug === 'default' ? join(root, 'kanban', 'workspaces', task.id) : join(root, 'kanban', 'boards', board.slug, 'workspaces', task.id));
   mkdirSync(dir, { recursive: true });
   return dir;
@@ -2726,10 +3085,46 @@ export function requestAdoption(board, id, who, { workspace = null, assignee = n
   if (boardCopyOf(board)) throw copyRefusal(board, 'adopts no session');
   tx(board, db => {
     if (!getTask(db, id)) throw new Error(`no card ${id}`);
+    // a session named by its address or id is checked now; one named otherwise is checked when it is bound
+    const named = /^sc:[^:]+:[^:]+:(.+)$/.exec(String(who))?.[1] ?? (/^[0-9a-f-]{8,}$/i.test(String(who)) ? String(who) : null);
+    const why = coderAsReviewer(db, board, id, { sessionId: named, assignee, role });
+    if (why) throw new Error(coderAsReviewerRefusal(id, statusOf(db, getTask(db, id)), why));
     event(db, id, 'dispatch_held', { session: who, reason: 'adoption requested', workspace, assignee, role });
   });
 }
 
+/**
+ * Why adopting a session onto card `id` would make the card's own coder its reviewer, or null. A session adopted onto a
+ * card whose run is its reviewer's (a card in review) is bound as that reviewer, and a reviewer is never the card's own
+ * coder (ADR 0001 rule 8; ADR 0019: an implementer adopted as reviewer is refused). Its coder is a worker-slot session of
+ * any of its runs or one of its side sessions (`sessionId`), a profile any of its worker runs ran as or its implementer
+ * (`assignee`), or a request for another role (`role`). The adoption is refused, never turned into a return: taking a
+ * card out of review is the manager's own act (`return-review`), recorded with its reason.
+ */
+function coderAsReviewer(db, board, id, { sessionId = null, assignee = null, role = null, assigneeBefore = undefined } = {}) {
+  const card = getTask(db, id);
+  if (!card) return null;
+  // the card's assignee before this adoption wrote its own (a bind writes --assignee first)
+  const held = assigneeBefore === undefined ? card.assignee : assigneeBefore;
+  const entry = workflowFor(board.root);
+  const bound = currentRun(db, id)?.metadata?.supercode;
+  const slot = bound?.slot ?? String(templateValue(runSpec(entry, statusOf(db, card), card)?.session ?? 'worker', scopeOf(db, board, card, { params: entry.params })));
+  if (slot !== 'reviewer') return null;
+  if (role && role !== 'reviewer') return `the adoption asks for its ${role} role`;
+  if (sessionId && ownCoder(db, id, sessionId)) return `${sessionId} is its own coder (a worker or side session of ${id})`;
+  if (assignee) {
+    const coders = new Set(db.prepare(`SELECT DISTINCT profile FROM task_runs WHERE task_id = ? AND profile IS NOT NULL
+      AND COALESCE(json_extract(metadata, '$.supercode.slot'), 'worker') = 'worker'`).all(id).map((r) => r.profile));
+    const implementer = scopeOf(db, board, card, { params: entry.params, lazy: true }).card.implementer;
+    // the implementer a review request recorded (with none recorded, card.implementer is the card's own assignee)
+    if (coders.has(assignee) || (assignee === implementer && implementer !== held)) return `--assignee ${assignee} is its coder's profile`;
+  }
+  return null;
+}
+const coderAsReviewerRefusal = (id, status, why) => `${id} is ${status}, where an adopted session is bound as its reviewer, and ${why}. `
+  + `A reviewer is never the card's own coder. To put its coder back to work, return the card first `
+  + `(supercode workflow return-review ${id} --reason "<why>"), then adopt the session.`;
+
 /** How long a requested adoption waits for its session to appear in the fleet before it fails. */
 const ADOPTION_LISTING_WINDOW_S = 180;
 
@@ -2746,7 +3141,7 @@ const latestAnswer = (db, id) => db.prepare(`SELECT id, kind, payload FROM task_
  * of two rounds that read one request, one binds it and the other leaves it; the bind and the failure are each written
  * only while that claim is the card's latest.
  */
-export async function completeAdoptions(board, fleet, settings, report, lanes = null) {
+export async function completeAdoptions(board, fleet, settings, report) {
   const pending = view(board, db => db.prepare(`SELECT e.id, e.task_id, e.kind, e.payload, e.created_at
     FROM (SELECT DISTINCT task_id FROM task_events) cards CROSS JOIN task_events e ON e.task_id=cards.task_id
     WHERE e.kind IN ('dispatch_held','adoption_claimed')
@@ -2764,7 +3159,7 @@ export async function completeAdoptions(board, fleet, settings, report, lanes =
     const asked = json(request.payload, {}) ?? {};
     const progress = {};
     try {
-      const got = await adoptSession(board, row.task_id, asked.session, { request: request.id, open: row.id, progress, workspace: asked.workspace ?? null, assignee: asked.assignee ?? null, role: asked.role ?? null, ttl: settings.ttl, fleet: fleet?.ok ? fleet : null , lanes});
+      const got = await adoptSession(board, row.task_id, asked.session, { request: request.id, open: row.id, progress, workspace: asked.workspace ?? null, assignee: asked.assignee ?? null, role: asked.role ?? null, ttl: settings.ttl, fleet: fleet?.ok ? fleet : null});
       (report.adopted ??= []).push([row.task_id, got.address]);
     } catch (error) {
       const message = String(error.message).slice(-400);
@@ -2781,7 +3176,7 @@ export async function completeAdoptions(board, fleet, settings, report, lanes =
         continue;
       }
       // the failure answers the request only while it is still open, or claimed by this round: an adoption that bound and
-      // then failed after (its agent run not recorded) is bound, and a request another round claimed is that round's
+      // then failed after is bound, and a request another round claimed is that round's
       // A failed adoption answers its request and ends the hold the request put on the card: the card is held again
       // only if it was held before the request (an incident's hold, kept for its own release), and is otherwise the
       // dispatcher's again. A hold that outlived its failed request held cards nobody adopted until a person released them.
@@ -2792,7 +3187,7 @@ export async function completeAdoptions(board, fleet, settings, report, lanes =
         return true;
       });
       // A request another round answered or claimed first is that round's, not a failure of this one: it is noted where
-      // no round prints it. A failure after this round's own claim (bound, then its agent run not recorded) is one.
+      // no round prints it. A failure after this round's own claim is one.
       if (!answered && !progress.claimed) { (report.adoption_skipped ??= []).push([row.task_id, message]); continue; }
       report.failed.push([row.task_id, `adoption of ${asked.session}${answered ? '' : ' (bound by this round, then failed)'}: ${message}`]);
     }
@@ -2834,25 +3229,19 @@ async function nativeListing(who) {
 /** The verb an adoption with no current run fires: the workflow's own `adopt` where it declares one, else its dispatch start. */
 const adoptionVerb = (entry) => (entry.workflow.verbs?.adopt || !entry.workflow.run ? 'adopt' : entry.workflow.dispatch.start);
 
-/**
- * The role an adopted session works on its card: a rebound run's own, else the role of the status the adoption's verb
- * moves the card to, as its claim names it. A card in review adopts its reviewer, never its implementer.
- */
-function adoptedRole(db, board, entry, task, run) {
-  const kept = run?.metadata?.supercode?.role;
-  if (kept) return kept;
-  const verb = adoptionVerb(entry), by = verb === 'adopt' ? 'manager' : 'platform';
-  const status = statusOf(db, task), scope = scopeOf(db, board, task, { params: entry.params });
-  const t = transitionsFor(entry.workflow, status, verb).find((x) => !x.by?.length || x.by.includes(by));
-  return runSpec(entry, t?.target ? String(templateValue(t.target, scope)) : status, task)?.role ?? null;
-}
-
-async function adoptSession(board, id, who, { request = null, open = request, progress = {}, workspace = null, ttl, assignee = null, role = null, fleet = null, lanes = null } = {}) {
+async function adoptSession(board, id, who, { request = null, open = request, progress = {}, workspace = null, ttl, assignee = null, role = null, fleet = null } = {}) {
   fleet ??= await observeFleet();
   // a fleet that could not be read says nothing of the session: the request stays open for the next reading
   if (!fleet.ok) throw Object.assign(new Error(`supercode could not read the fleet: ${fleet.error}`), { unread: true });
-  const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who) ?? await nativeListing(who);
-  if (!found) throw Object.assign(new Error(`the fleet lists no live session ${who}`), { notListed: true });
+  // A session no current machine lists may be one of a machine whose record is not current: the one its address names,
+  // or any, for a bare name. Its native listing is not taken there (it knows no pane, and the session may run in one).
+  const named = /^sc:([^:]+):/.exec(String(who))?.[1], machines = named ? [normalMachine(named)].filter((machine) => fleet.unknown?.has(machine)) : [...(fleet.unknown ?? [])];
+  const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who) ?? (named && machines.length ? null : await nativeListing(who));
+  if (!found) {
+    // said, and waited on as an unlisted session is, within the listing window
+    const unread = machines.map((machine) => `machine ${machine}'s record is not current: ${fleet.errors?.get(machine) ?? 'no current record'}`).join('; ');
+    throw Object.assign(new Error(`the fleet lists no live session ${who}${unread ? ` (${unread})` : ''}`), { notListed: true });
+  }
   const [, host, harness, sessionId] = found.address.split(':');
   if (!HARNESSES[harness]) throw new Error(`${found.address} is ${harness}; the board keeps and resumes ${Object.keys(HARNESSES).join(' and ')} sessions`);
   const native = found.pane ? null : nativeReading(await readNative(host, harness, sessionId), { session_id: sessionId, harness });
@@ -2884,14 +3273,9 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
     const r = await runtimeDoor(normalMachine(host)===localMachine()?null:host,'harness.v1.panes.list',{}, { timeout: 60_000 });
     dir = (json(r.stdout.trim(), []) ?? []).find((p) => p.pane === found.pane)?.cwd ?? null;
   }
-  // Rule 2: a session working a card role is that role's agent, however it started; adopted, it joins the agent as a
-  // launch does, and its recorded profile is compared with the role's intent (rule 4).
-  const agentRole = view(board, (db) => adoptedRole(db, board, entry0, card0, beforeRun)) ?? 'implementer';
-  const laneName = view(board, (db) => evaluate(entry0.workflow.roles?.[agentRole] ?? 'card.assignee', scopeOf(db, board, card0, { params: entry0.params }))) ?? assignee ?? card0?.assignee;
-  const lane = laneName ? lanes?.[laneName] : null, context = current().facts.SUPERCODE_CONTEXT, team = agentScope(context);
-  // The request is claimed before this adoption's first write outside the board (the agent store, below), in
-  // a transaction that finds it still open and the card's run the one read: a request answered or claimed meanwhile, or
-  // a run that changed, ends it here with nothing written anywhere, and no other round acts on a request claimed here.
+  // Agents are started, not attached (owner, VO-3751). Adoption records card work only: the session
+  // keeps its original identity, profile, hooks, MCP and folder, including when another card's agent owns it.
+  // Claim the request before reading its slot again, so another round cannot bind the same request meanwhile.
   const stale = (db) => {
     if (request !== null && !adoptionOpenTo(db, id, request, open)) return Object.assign(new Error(`${id}'s adoption request was answered or claimed meanwhile`), { superseded: true });
     if ((getTask(db, id)?.current_run_id ?? null) !== (beforeRun?.id ?? null)) return new Error(`${id} changed runs during adoption; retry against its current run`);
@@ -2905,14 +3289,8 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
     if (refused) throw refused;
     event(db, id, 'adoption_claimed', { request, session: who, ...newClaim(ttl) });
   });
+  if (request !== null) noteClaim(board, 'cards', id);
   progress.claimed = request !== null;
-  // The adopted session joins the role's agent as a launch does: its identity minted on this host, never asked of Teams.
-  const agent = lane ? await localCardAgent({ root: board.root, handle: cardHandleOf(board, id), readableId: readableIdOf(board, id), org: team.org, server: team.server, profiles: entry0.profiles, profile: lane.name, card: id, role: agentRole}) : null;
-  if(agent)recordCardAgentAssignment(board,cardAgentAssignments(board.root,id).find(assignment=>assignment.org===team.org&&assignment.id===agent.assignment));
-  // A session another agent already owns is refused before anything is recorded: the run would name one agent and the
-  // agent store another, and every round after would trip on it.
-  const owner = agent ? agentRunForSession(board.root, [`${harness}:${sessionId}`]) : null;
-  if (owner && owner.agent_id !== agent.identity.id) throw new Error(`${found.address} already works for agent ${owner.agent_id} (run ${owner.run_id}); it cannot be adopted as ${agent.identity.id}`);
   // Each role owns its own slot. A retained worker does not prevent binding the independent reviewer; only this
   // adoption's slot can conflict with the incoming identity. Independence still reads worker history below.
   await readBefore(fleet, view(board, (db) => lastSession(db, id, adoptionSlot)));
@@ -2934,56 +3312,46 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
     if (dir && !task.workspace_anchor && !(task.workspace_kind === 'dir' && task.workspace_path)) {
       db.prepare("UPDATE tasks SET workspace_kind = 'dir', workspace_path = ? WHERE id = ?").run(dir.replace(/^dir:/, ''), id);
     }
-    // Adoption takes the role and slot declared for this card's current stage.
     const entry = workflowFor(board.root);
-    const expected = runSpec(entry, statusOf(db, task), task);
-    if (role && role !== expected?.role) throw new Error(`${id} needs its ${expected?.role ?? 'declared'} role, not ${role}`);
-    if (expected?.role === 'reviewer') {
-      // Independence reads history even when its implementer's custody was handed back.
-      const implementer = json(db.prepare(`SELECT metadata FROM task_runs WHERE task_id=?
-        AND COALESCE(json_extract(metadata,'$.supercode.slot'),'worker')='worker'
-        AND json_extract(metadata,'$.supercode.session_id') IS NOT NULL ORDER BY id DESC LIMIT 1`).get(id)?.metadata, {})?.supercode;
-      if (implementer?.session_id === sessionId) throw new Error('a reviewer must be independent of the implementer session');
-    }
     takeSessionCustody(db, id, found.address);
     event(db, id, 'dispatch_released', { reason: 'verified adoption', session: found.address });
     // the manager's adoption is the workflow's own `adopt` verb where it declares one, sent as the manager; else its
     // dispatch start, which the platform sends for a verified adoption
     if (!beforeRun) { const verb = adoptionVerb(entry);
-      fire(db, board, entry, id, verb, { roles: [verb === 'adopt' ? 'manager' : 'platform'], payload: { lock: claimer() },
-        noticeSession: { address: found.address, session_id: sessionId, machine: host, harness } }); }
+      fire(db, board, entry, id, verb, { roles: [verb === 'adopt' ? 'manager' : 'platform'], payload: { lock: claimer() }, adopting: true }); }
     const runId = getTask(db, id).current_run_id;
     if (!runId) throw new Error(`${id} waits on parents that are not done`);
-    // the agent joined above is the one of the run's own role; a run of another role would name the wrong agent
+    // A ready/todo card has no run role until adoption fires its transition. Validate the actual run's
+    // role here, in the same transaction, so refusal rolls back both the transition and the attachment.
     const runRole = currentRun(db, id)?.metadata?.supercode?.role;
-    if (agent && runRole && runRole !== agentRole) throw new Error(`${id}'s run is its ${runRole}'s, and ${found.address} was joined as its ${agentRole}; adopt again`);
-    const session = { surface: found.pane ? 'pane' : 'native', session_id: sessionId, harness, machine: host, pane: found.pane ?? null, address: found.address, mode: 'adopt', launched_at: now(), seen_at: now(),
-      ...(agent ? { agent_id: agent.identity.id, agent_org: team.org, agent_context: context ?? null,
-        agent_profile_intent: { ...structuredClone(agent.intended.resolved), worker: { ...agent.intended.resolved?.worker, harness: lane.harness, model: lane.model ?? null, cwd: dir ?? task.workspace_path ?? null } } } : {}) };
+    if (role && role !== runRole) throw new Error(`${id} needs its ${runRole ?? 'declared'} role, not ${role}`);
+    if (runRole === 'reviewer') {
+      // Independence reads history even when its implementer's custody was handed back: no worker session of any run of
+      // the card, none of its side sessions, and no profile its coder ran as (t_2a2ef475: a side session adopted with
+      // --assignee coder-claude onto the card in review was bound as its reviewer, run 2732).
+      const why = coderAsReviewer(db, board, id, { sessionId, assignee, role, assigneeBefore: task.assignee ?? null });
+      if (why) throw new Error(coderAsReviewerRefusal(id, statusOf(db, task), why));
+    }
+    const session = { surface: found.pane ? 'pane' : 'native', session_id: sessionId, harness, machine: host, pane: found.pane ?? null, address: found.address, mode: 'adopt', launched_at: now(), seen_at: now() };
     // a deferred launch was never issued: the adopted session is the run's, and no later round launches another
     const owned = [beforeSession, was].find(s => s && s.pane === session.pane && (sameIdentity(s) || s === beforeSession && keyedPane));
     setRunSession(db, runId, { ...(currentRun(db, id)?.metadata?.supercode ?? {}), ...session,
+      // A deferred or rebound run may retain launch intent. It must not make the delivery pass bind this
+      // attached session to that intent's agent; the session's existing ownership stays with its starter.
+      agent_id: null, agent_org: null, agent_context: null, agent_profile_intent: null, agent_env: null,
       detached_at: null, detached_to: null, launch_key: owned?.launch_key ?? null, launch_pending: false, launch_error: null,
       launch_deferred: false, launch_deferred_error: null, slot: adoptionSlot, retain_after_run: false,
       close_requested: null, closed_at: null, close_confirmed_at: null, close_error: null, close_failed_at: null, close_claim: null,
-      released: false, forgotten: false, monitor_held: false, missing_since: null });
+      released: false, forgotten: false, monitor_held: false, missing_since: null, handed_back_from: null, handed_back_run: null });
     transferRetainedSession(db, id, runId, session);
     event(db, id, 'session_adopted', { session_id: sessionId, machine: host, pane: session.pane, address: found.address, mode: 'adopt', role: currentRun(db, id)?.metadata?.supercode?.role }, runId);
+    // an attached session is told its role's brief, the same one a launched session starts with
+    const card = getTask(db, id), told = roleBrief(db, board, entry, card, statusOf(db, card), 'pane');
+    if (told?.prompt) queueBrief(db, board, card, runId, found.address, told, 'attached');
     replaceWorkerSubscriptions(db, id, found.address);
     for (const p of db.prepare('SELECT parent_id FROM task_links WHERE child_id = ?').all(id)) subscribeIn(db, p.parent_id, found.address, 'dependency');
     return { ...session, run: runId, workspace: dir };
   });
-  if (agent) {
-    recordAgentRun(board.root, team.org, agent.identity.id, { session: `${harness}:${sessionId}`, machine: host, run: adopted.run });
-    // Teams learns whose the session is the way a launch tells it (ADR 0013, "launched or adopted"): the session's machine
-    // queues it with the same agent environment a launch carries, and binds it when Teams answers. The adoption stands
-    // either way; the card says whether the machine took it.
-    const environment = agentEnvironment(agent, { root: board.root, context: normalMachine(host) === localMachine() ? localReaderContext(team.org, agent.identity.id) ?? undefined : undefined });
-    const r = await doorOn(host, 'harness.v1.sessions.own', { session: `${harness}:${sessionId}`, environment }, { timeout: 30_000 });
-    const answer = r.code === 0 ? lastJson(r.stdout) : null;
-    tx(board, (db) => event(db, id, answer?.queued === true ? 'agent_session_queued' : 'agent_session_unqueued',
-      { session: found.address, agent: agent.identity.id, ...(answer?.queued === true ? {} : { reason: String(answer?.reason ?? (r.stderr || r.stdout || 'the machine did not answer')).slice(0, 300) }) }, adopted.run));
-  }
   return adopted;
 }
 
@@ -3118,7 +3486,8 @@ export async function fileBoardMail(board, report, taskId = null) {
     const first = mail.members[0];
     try {
       const task = view(board, db => getTask(db, first.task_id));
-      const subject = numbered(boardKey(board.root, board.slug), mail.requester && !mail.message_id && new Set(mail.members.map((m) => m.task_id)).size > 1 ? null : task?.number, mail.requester ? (mail.message_id ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${mail.title ?? mail.requester} · ${mail.members.length} card(s)`) : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`);
+      const several = mail.requester && !mail.message_id && new Set(mail.members.map((m) => m.task_id)).size > 1;
+      const subject = numbered(boardKey(board.root, board.slug), several ? null : task?.number, mail.requester ? (mail.message_id ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${mail.title ?? mail.requester} · ${mail.members.length} card(s)`) : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`, several ? null : noticeName(task));
       const filed = await fileMail(board, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
       tx(board, db => {
         if (filed.detached) {
@@ -3144,26 +3513,42 @@ const MAX_SEND_FAILURES = 12;
  * What an audience is told of an event: the workflow's `notify[audience][kind]` template over the card, the event's
  * payload and (for a comment) the comment; null when the workflow names no such notice.
  */
-export function noticeOf(entry, audience, kind, task, payload, comment = null) {
+export function noticeOf(entry, audience, kind, task, payload, comment = null, recipient = null) {
   const template = entry.workflow.notify?.[audience]?.[kind];
   if (template === undefined || template === null) return null;
   const cut = (text, n) => String(text ?? '').slice(0, Number(n));
-  const text = render(template, { card: task, event: payload ?? {}, comment, params: entry.params, cut });
-  return text.trim() ? numbered(task?.key, task?.number, text) : null;
+  // `recipient`: who is told (its subscription's address) and whether the comment @mentions it, for an audience that
+  // hears only what names it (an empty notice is not filed)
+  const text = render(template, { card: task, event: payload ?? {}, comment, params: entry.params, cut, recipient: recipient ?? { address: null, mentioned: false } });
+  return text.trim() ? numbered(task?.key, task?.number, text, noticeName(task)) : null;
 }
 
 /**
  * Who hears a card without having asked: each running card's session hears its card and its subtasks (a subscription a
  * launch or a missed fleet read lost comes back), and each of the workflow's managers (`params.managers`) hears every
- * open card as the `manager` audience, whoever filed it, when the workflow's notify names one.
+ * open arc (not its subtasks) as the `manager` audience, whoever filed it, when the workflow's notify names one.
  */
 function ensureSubscriptions(board, entry) {
   const managers = Array.isArray(entry.params.managers) ? entry.params.managers.map(String) : [];
   const toManagers = Object.keys(entry.workflow.notify?.manager ?? {}).length > 0;
   tx(board, (db) => {
     reconcileDependencySubscriptions(db);
-    for (const t of db.prepare("SELECT id, current_run_id FROM tasks WHERE status NOT IN ('done', 'archived')").all()) {
-      if (toManagers) for (const m of managers) subscribeIn(db, t.id, m, 'manager');
+    // A subtask's watchers are its own (its creator, its worker, whoever comments on it or is mentioned there), as an
+    // issue tracker's sub-task's are: the manager follows arcs, and an arc's follower is not copied onto its subtasks.
+    // Such copies made before are removed here.
+    db.prepare(`DELETE FROM kanban_notify_subs WHERE platform = 'supercode' AND thread_id = ''
+      AND task_id IN (SELECT task_id FROM supercode_cards WHERE subtask_of IS NOT NULL)
+      AND ((json_extract(delivery_metadata, '$.role') = 'manager' AND json_extract(delivery_metadata, '$.own') IS NULL)
+        OR (COALESCE(json_extract(delivery_metadata, '$.role'), 'creator') = 'creator'
+          AND json_extract(delivery_metadata, '$.own') IS NULL
+          AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.id = kanban_notify_subs.task_id AND t.created_by IN (kanban_notify_subs.chat_id, 'session:' || kanban_notify_subs.chat_id))
+          AND NOT EXISTS (SELECT 1 FROM task_events e WHERE e.task_id = kanban_notify_subs.task_id AND e.kind = 'created'
+            AND json_extract(e.payload, '$.creator') IN (kanban_notify_subs.chat_id, 'session:' || kanban_notify_subs.chat_id))
+          AND EXISTS (SELECT 1 FROM kanban_notify_subs arc JOIN supercode_cards c ON c.subtask_of = arc.task_id
+            WHERE c.task_id = kanban_notify_subs.task_id AND arc.chat_id = kanban_notify_subs.chat_id AND arc.platform = 'supercode')))`).run();
+    for (const t of db.prepare(`SELECT t.id, t.current_run_id, c.subtask_of FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id
+      WHERE t.status NOT IN ('done', 'archived')`).all()) {
+      if (toManagers && !t.subtask_of) for (const m of managers) subscribeIn(db, t.id, m, 'manager');
       if (!t.current_run_id) continue;
       const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(t.current_run_id)?.metadata, {})?.supercode;
       const address = addressOf(session);
@@ -3216,7 +3601,7 @@ function settleStateRequestAnswers(board, entry, report) {
       const text = `${a.task_id}: your request-state ${a.state ?? ''} (${a.question}) was answered by ${a.answered_by ?? 'the manager'} in ${a.answer}; ${outcome}.\n${String(a.text ?? '').trim()}\nRead the card: supercode workflow show ${a.task_id} --root ${board.root}`;
       const effect = { kind: 'send_to_actor', id: a.task_id, runId: a.run_id, address: to, sourceEvent: id, verb: 'state_request_answered',
         messageKey: `board-state-answer-${a.task_id}-${id}`,
-        text: identifyNotice({ id, kind: 'state_request_answered', run_id: a.run_id, created_at: now() }, numbered(boardKey(board.root, board.slug), cardNumber(db, a.task_id), text)) };
+        text: identifyNotice({ id, kind: 'state_request_answered', run_id: a.run_id, created_at: now() }, numbered(boardKey(board.root, board.slug), cardNumber(db, a.task_id), text, cardName(db, a.task_id))) };
       db.prepare('INSERT INTO supercode_effects (effect) VALUES (?)').run(JSON.stringify(effect));
     }
   });
@@ -3302,81 +3687,204 @@ const closePending = ({ held, latest }, address) => {
     && !closeRefused(session);
 };
 
+/** A subscription's role on its card: worker, dependency, manager, participant, else creator. */
+const followerRole = (sub) => ['worker', 'dependency', 'manager', 'participant'].includes(sub.delivery_metadata?.role) ? sub.delivery_metadata.role : 'creator';
+
 /**
- * The worker subscriptions of sessions that have ended, removed in one transaction, with one notice_unsubscribed event
- * per session naming its cards. A session has ended when no unended or current run works in it, the fleet does not list
- * it running, its latest run is not a release (a released session is a person's own, left running), and the board
- * closed it (that run's confirmed close). Everything is read inside the transaction, so a run that took the session
- * meanwhile keeps it. A worker session that ended any other way keeps its subscriptions, and is passed over while the
- * fleet does not list it (`notify`); a run
- * that resumes the session subscribes it again at its launch and each round while it is the card's current run.
- * A creator's or manager's subscription is never ended here: its notices wait for the session to come back.
+ * The subscriptions of sessions that have ended, removed in one transaction, with one notice_unsubscribed event per
+ * session naming its cards, whatever role they follow a card in (a dependency subscription is its arc's, moved with the
+ * arc's session by reconcileDependencySubscriptions). A session has ended when no unended or current run works in it,
+ * the fleet does not list it running, its latest run is not a release (a released session is a person's own, left
+ * running), and the board closed it (that run's confirmed close) or it is gone (no transcript, process or pane, read
+ * whole: subscriberGone). Everything is read inside the transaction, so a run that took the session meanwhile keeps it.
+ * Nothing waits for an ended session: what it was not told is not kept for it, and a session resumed later follows a
+ * card again from then (its run's launch, its own comment, a mention). A session that ended any other way keeps its
+ * subscriptions and is passed over while the fleet does not list it (`notify`), and what it misses meanwhile grows old
+ * there (liveSeconds), never told late.
  */
-async function endWorkerSubscriptions(board, fleet, report) {
-  // each worker subscriber's liveness is read before the write
+async function endEndedSubscriptions(board, fleet, report) {
+  const followers = "platform = 'supercode' AND json_extract(delivery_metadata, '$.dependent_card') IS NULL AND COALESCE(json_extract(delivery_metadata, '$.role'), 'creator') != 'dependency'";
+  // each native subscriber's liveness is read before the write
   const aliveNow = new Map(), goneNow = new Map();
-  if (fleet.ok) for (const { chat_id: address } of board.db.prepare("SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) {
+  if (fleet.ok) for (const { chat_id: address } of board.db.prepare(`SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE ${followers}`).all()) {
+    if (!sessionAt(address)) continue;
     aliveNow.set(address, await subscriberAlive(fleet, address));
     if (aliveNow.get(address) === false && subscriberGone(fleet, address)) goneNow.set(address, now());
   }
   tx(board, (db) => {
     const remove = db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?");
-    const ended = new Map();
-    for (const row of db.prepare("SELECT task_id, chat_id, thread_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) {
-      const { held, latest } = sessionRecord(db, row.chat_id);
-      const address = row.chat_id, record = latest.get(address);
+    const ended = new Map(), records = new Map();
+    for (const row of db.prepare(`SELECT task_id, chat_id, thread_id, delivery_metadata FROM kanban_notify_subs WHERE ${followers}`).all()) {
+      const address = row.chat_id;
+      if (!sessionAt(address)) continue;
+      if (!records.has(address)) records.set(address, sessionRecord(db, address));
+      const { held, latest } = records.get(address);
+      const record = latest.get(address);
       // a session alive, or whose liveness could not be read (unknown, never taken as ended), keeps its subscription
-      if (!record || record.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) !== false)) continue;
+      if (record?.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) !== false)) continue;
       // the board closed it, or it is gone (no transcript, process or pane, read whole: subscriberGone)
-      const evidence = record.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at }
-        : goneNow.has(address) ? { by: 'gone', run: record.run, read_at: goneNow.get(address), machine: sessionAt(address)?.machine ?? null } : null;
+      const evidence = record?.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at }
+        : goneNow.has(address) ? { by: 'gone', run: record?.run ?? null, read_at: goneNow.get(address), machine: sessionAt(address)?.machine ?? null } : null;
       if (!evidence || !remove.run(row.task_id, address, row.thread_id).changes) continue;
-      if (!ended.has(address)) ended.set(address, { record, evidence, cards: [] });
+      if (!ended.has(address)) ended.set(address, { record, evidence, cards: [], roles: new Set() });
       ended.get(address).cards.push(row.task_id);
+      ended.get(address).roles.add(json(row.delivery_metadata, {})?.role ?? 'creator');
     }
-    for (const [address, { record, evidence, cards }] of ended) {
-      event(db, record.task_id, 'notice_unsubscribed', { address, role: 'worker', reason: 'the session has ended', evidence, cards, count: cards.length }, record.run);
+    for (const [address, { record, evidence, cards, roles }] of ended) {
+      event(db, record?.task_id ?? cards[0], 'notice_unsubscribed', { address, role: roles.size === 1 ? [...roles][0] : [...roles].sort(), reason: 'the session has ended', evidence, cards: cards.slice(0, 50), count: cards.length }, record?.run ?? null);
       for (const card of cards) (report.subscriptions_ended ??= []).push([card, address]);
     }
   });
 }
 
+/**
+ * One follower, one subscription: a session that is an agent's main session, or was one (its former mains), follows a
+ * card under its agent's address (engine.followerAddress), read from each agent the board knows (its managers, and each
+ * agent address that follows a card). Its subscriptions move to that address, starting from each card's last event
+ * (nothing it was not told is carried over), and where the agent already follows the card its own subscription stands
+ * alone. A worker's subscription is its run's session's and stays where it is.
+ */
+async function foldAgentSessions(board, entry, report) {
+  const agents = new Set([...[].concat(entry.params.managers ?? []).map(String),
+    ...board.db.prepare("SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE platform = 'supercode' AND chat_id LIKE 'sc:%:agent:%'").all().map((r) => r.chat_id)].filter((a) => agentAt(a)));
+  const agentOf = new Map();
+  for (const agent of agents) {
+    await agentMain(agent);
+    for (const session of agentMains.get(agent)?.sessions ?? []) if (sessionAt(session) && !agentOf.has(session)) agentOf.set(session, agent);
+  }
+  if (!agentOf.size) return;
+  tx(board, (db) => {
+    const sessions = [...agentOf.keys()];
+    const rows = db.prepare(`SELECT task_id, chat_id, thread_id, delivery_metadata FROM kanban_notify_subs WHERE platform = 'supercode' AND chat_id IN (${sessions.map(() => '?').join(', ')})`).all(...sessions);
+    const moved = new Map();
+    for (const row of rows) {
+      const metadata = json(row.delivery_metadata, {}) ?? {};
+      if (['worker', 'dependency'].includes(metadata.role) || metadata.dependent_card) continue;
+      const agent = agentOf.get(row.chat_id);
+      const head = db.prepare('SELECT COALESCE(MAX(id), 0) AS c FROM task_events WHERE task_id = ?').get(row.task_id).c;
+      const { notice_wait: _wait, failures: _failures, ...kept } = metadata;
+      db.prepare(`INSERT OR IGNORE INTO kanban_notify_subs (task_id, platform, chat_id, thread_id, chat_type, delivery_mode, delivery_metadata, created_at, last_event_id)
+        VALUES (?, 'supercode', ?, ?, 'dm', 'notify+wake', ?, ?, ?)`).run(row.task_id, agent, row.thread_id, JSON.stringify(kept), now(), head);
+      db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?").run(row.task_id, row.chat_id, row.thread_id);
+      if (!moved.has(row.chat_id)) moved.set(row.chat_id, { agent, cards: [] });
+      moved.get(row.chat_id).cards.push(row.task_id);
+    }
+    for (const [address, { agent, cards }] of moved) {
+      event(db, cards[0], 'notice_subscriptions_folded', { address, agent, reason: `${address} is ${agent}'s main session or a former one: it follows cards as ${agent}`, cards: cards.slice(0, 50), count: cards.length });
+      for (const card of cards) (report.subscriptions_folded ??= []).push([card, address, agent]);
+    }
+  });
+}
+
+/** The batching window, by default (params.notice_digest_seconds): what happens on one card within it after a notice
+ *  of that card is one message to each recipient at the window's end, as an issue tracker batches an issue's changes. */
+const NOTICE_DIGEST_SECONDS = 60;
+/** The flood ceiling: at most this many notice messages reach one recipient in a window; past it, the rest are one
+ *  summary message naming their cards (params.notice_ceiling). */
+const NOTICE_CEILING_DEFAULT = 10;
+/** A card's batch shows at most this many notices in full, each at most this many characters; the card holds the rest. */
+const CARD_DIGEST_ITEMS = 10;
+const CARD_DIGEST_TEXT = 2000;
+/** The role a session hears an event in when it follows the card more than one way: the first here that hears its kind. */
+const NOTICE_RANK = ['worker', 'manager', 'dependency', 'creator', 'participant'];
+const digestSeconds = (entry) => Math.max(Number(entry.params.notice_digest_seconds) || NOTICE_DIGEST_SECONDS, 1);
+/**
+ * How old an event may be and still be told: its batching window and three delivery passes after it (one a dispatch
+ * interval), never past the workflow's notice_max_age_seconds. An older one is history: passed over, never filed, and
+ * read on its card.
+ */
+function liveSeconds(entry) {
+  const live = digestSeconds(entry) + 3 * Math.max(Number(entry.params.dispatch_interval_seconds) || 60, 1);
+  const max = Number(entry.params.notice_max_age_seconds) || null;
+  return max ? Math.min(max, live) : live;
+}
+const cutText = (text, n) => { const t = String(text).trim(); return t.length > n ? `${t.slice(0, n - 1)}…` : t; };
+
 /**
  * Each subscriber's notices, filed in its mailbox (D138 step 6, D140): the dispatcher's job ends at the filing, a local
- * write under the notice's fixed key; the mailbox delivers it to the session, on this machine or through Teams on
- * another. Each subscription's notices go in order, and its cursor moves past a notice once it is filed (or passed
- * over); a filing that failed here leaves the cursor before it, and the next pass files it. A session the board's own
- * record says has ended (recordedEnded) is filed nothing, in any role, until it is read running again, and neither is a
- * worker whose close the board has asked and not yet confirmed (closePending): its cursor stays, so a session resumed
- * later is told what it missed. The mail router's current session listing is also positive liveness evidence,
- * including when pane/discovery liveness cannot be read. An unread listing never proves a session absent.
+ * write under its fixed key; the mailbox delivers it to the session, on this machine or through Teams on another.
+ *
+ * - Nothing historical is sent. A subscription's cursor moves past every event of its card it has read, heard or not,
+ *   so a kind or a role it hears later never makes the card's earlier events news, and an event older than
+ *   liveSeconds is passed over.
+ * - One event reaches one session once, whatever addresses it follows the card under (an agent's address is its main
+ *   session's), in the role ranked first in NOTICE_RANK that hears it.
+ * - Batching, per recipient and card: a card's notices are one message; a card told within the last window
+ *   (notice_digest_seconds, measured between delivery passes) waits, cursors unmoved, and what happened on it meanwhile
+ *   is one message when the window ends.
+ * - The ceiling: at most NOTICE_CEILING messages reach one recipient in a window; past it, the rest are one summary
+ *   message naming their cards, recorded as notice_flood_collapsed. No defect upstream can mail one session more.
+ *
+ * A filing that failed leaves its cursors before it, and the next pass files it. A session the board's own record says
+ * has ended (recordedEnded) is filed nothing, and neither is a worker whose close the board has asked and not yet
+ * confirmed (closePending). The mail router's current session listing is also positive liveness evidence, including
+ * when pane/discovery liveness cannot be read. An unread listing never proves a session absent.
  */
 async function notify(board, fleet, report, entry) {
-  await endWorkerSubscriptions(board, fleet, report);
-  for (const sub of subscriptions(board.db).filter((s) => s.platform === 'supercode')) {
+  await endEndedSubscriptions(board, fleet, report);
+  await foldAgentSessions(board, entry, report);
+  const passAt = now(), window = digestSeconds(entry), live = liveSeconds(entry);
+  const NOTICE_CEILING = Math.max(Number(entry.params.notice_ceiling) || NOTICE_CEILING_DEFAULT, 1);
+  const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
+  const identityOf = (sub) => [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
+  const forward = (db, sub, to) => db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(to, ...identityOf(sub), to);
+  const rank = (sub) => NOTICE_RANK.indexOf(followerRole(sub));
+  // cursors moved past what was read with nothing to tell, written together after the pass
+  const quiet = [];
+  // recipient session → { recipient, to, items, subs: [{ sub, through }], wake }
+  const digests = new Map();
+  // `<recipient> <event id>`: one event reaches one session once
+  const claimed = new Set();
+  // and across passes: an event the board recorded filed to any address of the same session is not told again
+  const filedBefore = (taskId, eventId, aliases) => Boolean(board.db.prepare(`SELECT 1 FROM task_events WHERE task_id = ? AND kind = 'notice_filed'
+    AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') IN (${aliases.map(() => '?').join(', ')}) LIMIT 1`).get(taskId, eventId, ...aliases));
+  const read = [];
+  for (const sub of subscriptions(board.db).filter((s) => s.platform === 'supercode').sort((a, b) => rank(a) - rank(b))) {
     await yieldToOwner();
     if (stopping) break;
     if (view(board, db => personCustody(db, sub.chat_id))) continue;
     if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) continue;
-    const role = ['worker', 'dependency', 'manager'].includes(sub.delivery_metadata?.role) ? sub.delivery_metadata.role : 'creator';
-    const kinds = heardBy(entry, role);
-    if (!kinds.length) { noticeWait(board, sub, report); continue; }
+    // an unsubscribed follower is told nothing until a mention or its own comment brings it back (engine.follow)
+    if (sub.delivery_metadata?.unsubscribed) continue;
+    const role = followerRole(sub);
+    // what it hears: its role's kinds, and those of a role it held before taking this one (engine.subscribeIn `also`),
+    // each told in the first of its roles whose workflow names that kind
+    const roles = [role, ...[].concat(sub.delivery_metadata?.also ?? []).filter((r) => typeof r === 'string' && r !== role)];
+    const kinds = [...new Set(roles.flatMap((r) => heardBy(entry, r)))];
+    const toldAs = (kind) => roles.find((r) => heardBy(entry, r).includes(kind)) ?? role;
+    // the card's last event, read before its news: the cursor moves to it past every event, heard or not
+    const head = Number(board.db.prepare('SELECT COALESCE(MAX(id), 0) AS c FROM task_events WHERE task_id = ?').get(sub.task_id).c);
+    if (!kinds.length) { if (head > Number(sub.last_event_id)) quiet.push({ sub, through: head }); noticeWait(board, sub, report); continue; }
     // Read pending news before liveness: a subscription with nothing to file is not waiting on delivery.
-    const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id LIMIT 64`)
-      .all(sub.task_id, sub.last_event_id, ...kinds);
-    if (!events.length) { noticeWait(board, sub, report); continue; }
+    // the page starts past every event already history (older than liveSeconds), so a long backlog never holds back
+    // what is news now
+    // A follower's news is history past liveSeconds; a worker's or a dependency's (a verdict it must act on, its run
+    // changed) only past notice_max_age_seconds, so a worker whose liveness could not be read for minutes is still told.
+    const horizon = ['worker', 'dependency'].includes(role) ? Math.max(live, Number(entry.params.notice_max_age_seconds) || live) : live;
+    const historyThrough = Number(board.db.prepare('SELECT COALESCE(MAX(id), 0) AS c FROM task_events WHERE task_id = ? AND id > ? AND id <= ? AND created_at < ?')
+      .get(sub.task_id, sub.last_event_id, head, passAt - horizon).c);
+    const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND id <= ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id LIMIT 64`)
+      .all(sub.task_id, Math.max(Number(sub.last_event_id), historyThrough), head, ...kinds);
+    const through = events.length === 64 ? events[63].id : head;
+    if (!events.length) { if (head > Number(sub.last_event_id)) quiet.push({ sub, through: head }); noticeWait(board, sub, report); continue; }
     const record = view(board, db => sessionRecord(db, sub.chat_id));
     // Events name the acting native session; subscriptions may name its agent.
     // Use the daemon's retained binding, including former mains, for both
     // coalescing and delivery. An unread binding proves no additional alias.
     const recipientActors = new Set([sub.chat_id]);
+    let recipient = sub.chat_id;
     if (agentAt(sub.chat_id)) {
-      await agentMain(sub.chat_id);
+      const main = await agentMain(sub.chat_id);
+      if (main && sessionAt(main)) recipient = main;
       for (const address of agentMains.get(sub.chat_id)?.sessions ?? []) recipientActors.add(address);
     }
     const ownAct = payload => Boolean(payload?.by && recipientActors.has(payload.by));
+    // the addresses of the same session: its agent's (or, for a native session, every agent whose main or former main it
+    // is), as this pass read their bindings
+    const aliases = new Set([...recipientActors, recipient]);
+    if (!agentAt(sub.chat_id)) for (const [agent, read] of agentMains) if (agentAt(agent) && (read?.sessions ?? []).includes(sub.chat_id)) aliases.add(agent);
     // a worker the board is closing is filed nothing: its cursor stays, so a close that is refused or a session resumed
-    // is told what it missed, and a close that lands ends its subscription (endWorkerSubscriptions)
+    // is told what it missed, and a close that lands ends its subscription (endEndedSubscriptions)
     if (role === 'worker' && closePending(record, sub.chat_id)) {
       noticeWait(board, sub, report, 'its session close is pending; its notices wait'); continue;
     }
@@ -3397,70 +3905,136 @@ async function notify(board, fleet, report, entry) {
       // unknown is not absent: its notices wait, and the wait is said, until its liveness can be read
       if (alive === null) { noticeWait(board, sub, report, 'its liveness could not be read; its notices wait until it can be'); continue; }
     } else if (!sessionAt(sub.chat_id) && ended) continue; // native sessions already required a current live observation
-    // the card as the workflow names it (its status the workflow's: triaging, reviewing, stopped; `stored_as` kanban.db's)
-    const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, key: boardKey(board.root, board.slug), status: statusOf(db, t), stored_as: t.status } : t; });
+    // the card as the workflow names it (its status the workflow's: triaging, reviewing, stopped; `stored_as` kanban.db's;
+    // `person` the person it is assigned to, if any)
+    const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, key: boardKey(board.root, board.slug), status: statusOf(db, t), stored_as: t.status, person: personOf(t.assignee) } : t; });
     // a worker whose run has ended is not woken by a notice (a second session would start working the card beside
     // the one the next run gets): the notice is filed for its next turn, and the next run's brief carries the card's
     // thread. A subtask has no run of its own: its worker works in its arc's run.
     const working = role !== 'worker' || view(board, (db) => addressOf(currentRun(db, task?.subtask_of ?? sub.task_id)?.metadata?.supercode) === sub.chat_id);
     // a Claude session always starts a turn when mail reaches it, so its mail is always delivered now
-    const wake = String(sub.chat_id).includes(':claude-code:') || (working && !(!entry.workflow.run && sub.delivery_mode === 'notify'));
-    const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
-    const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
-    const forward = (to) => tx(board, (db) => db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(to, ...identity, to));
-    // an event older than the workflow's notice_max_age_seconds is history, not news: it is passed over, never filed
-    const maxAge = Number(entry.params.notice_max_age_seconds) || null;
-    const stale = (ev) => maxAge && now() - Number(ev.created_at) > maxAge;
+    const wake = String(sub.chat_id).includes(':claude-code:') || String(recipient).includes(':claude-code:') || (working && !(!entry.workflow.run && sub.delivery_mode === 'notify'));
+    const stale = (ev) => passAt - Number(ev.created_at) > horizon;
     // A backlog (a restart, a pass that did not run) is told as it stands now: news is coalesced by its subject, not its
     // kind alone (a later `assigned` says what an earlier one did, but each subtask added, dependency linked or unlinked
     // is its own fact, keyed by the card it names); a comment or an answer is always its own message. Only events that
     // would be told count: a stale one or the recipient's own act never supersedes one that would be.
     const subjectOf = (ev) => { const p = json(ev.payload, {}) ?? {}; return ['commented', 'answered'].includes(ev.kind) ? `${ev.kind}:${ev.id}` : `${ev.kind}:${p.subtask ?? p.parent ?? p.child ?? ''}`; };
     const latest = new Map(events.filter((ev) => !stale(ev) && !ownAct(json(ev.payload, {}))).map((ev) => [subjectOf(ev), ev.id]));
-    let cursor = Number(sub.last_event_id);
+    const items = [];
+    for (const ev of events) {
+      const p = json(ev.payload, {}) ?? {};
+      if (stale(ev)) { report.stale_notices_passed = (report.stale_notices_passed ?? 0) + 1; continue; }
+      // nobody is told of their own act
+      if (ownAct(p)) continue;
+      if (latest.get(subjectOf(ev)) !== ev.id) { report.superseded_notices_passed = (report.superseded_notices_passed ?? 0) + 1; continue; }
+      // the event is this recipient's in this role (the first that hears it); no other subscription of its tells it again
+      const claim = `${recipient} ${ev.id}`;
+      if (claimed.has(claim) || filedBefore(sub.task_id, ev.id, [...aliases])) { report.duplicate_notices_passed = (report.duplicate_notices_passed ?? 0) + 1; continue; }
+      let text;
+      if (ev.kind === 'commented') {
+        if (recipientActors.has(p.author)) continue;
+        const c = board.db.prepare('SELECT author, body FROM task_comments WHERE task_id = ? AND author = ? AND created_at >= ? ORDER BY id LIMIT 1').get(sub.task_id, p.author, ev.created_at);
+        // whether the comment @mentions this recipient (its address, its agent, a session it is), for a role that hears
+        // only what names it
+        const named = c ? view(board, (db) => mentioned(db, entry, c.body)).some((address) => recipientActors.has(address) || address === recipient) : false;
+        text = c ? noticeOf(entry, toldAs(ev.kind), ev.kind, task, p, c, { address: sub.chat_id, mentioned: named }) : null;
+      } else text = noticeOf(entry, toldAs(ev.kind), ev.kind, task, p, null, { address: sub.chat_id, mentioned: false });
+      // claimed once it says something: a role whose notice of it is empty leaves it to the session's other subscriptions
+      if (text) { claimed.add(claim); items.push({ sub, ev, text, body: ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text, task }); }
+    }
+    read.push({ sub, role, task, kinds });
+    // nothing to tell: its cursor moves past what was read
+    if (!items.length) { quiet.push({ sub, through }); noticeWait(board, sub, report); continue; }
+    const digest = digests.get(recipient) ?? { recipient, to: sub.chat_id, cards: new Map() };
+    // a recipient that follows as its agent is mailed at its agent's address, as it subscribed
+    if (agentAt(sub.chat_id) && !agentAt(digest.to)) digest.to = sub.chat_id;
+    const card = digest.cards.get(sub.task_id) ?? { task_id: sub.task_id, task, items: [], subs: [], wake: false };
+    card.items.push(...items);
+    card.subs.push({ sub, through });
+    card.wake ||= wake;
+    digest.cards.set(sub.task_id, card);
+    digests.set(recipient, digest);
+  }
+  // One filing: its cursors move once it is filed (or passed to a person, or already moved), and the recipient's
+  // window state with it; a filing that failed leaves them where they were, and the next pass files it.
+  const file = async (digest, state, { cards, body, subject, kind }) => {
+    const items = cards.flatMap((c) => c.items), subs = cards.flatMap((c) => c.subs), wake = cards.some((c) => c.wake);
+    const key = `board-${kind}-${createHash('sha256').update(`${digest.to}|${items.map((i) => `${i.sub.task_id}:${i.ev.id}`).join(',')}`).digest('hex').slice(0, 24)}`;
     try {
-      for (const ev of events) {
-        const p = json(ev.payload, {}) ?? {};
-        if (stale(ev)) { cursor = ev.id; report.stale_notices_passed = (report.stale_notices_passed ?? 0) + 1; continue; }
-        // nobody is told of their own act
-        if (ownAct(p)) { cursor = ev.id; continue; }
-        if (latest.get(subjectOf(ev)) !== ev.id) { cursor = ev.id; report.superseded_notices_passed = (report.superseded_notices_passed ?? 0) + 1; continue; }
-        let text;
-        if (ev.kind === 'commented') {
-          if (recipientActors.has(p.author)) { cursor = ev.id; continue; }
-          const c = board.db.prepare('SELECT author, body FROM task_comments WHERE task_id = ? AND author = ? AND created_at >= ? ORDER BY id LIMIT 1').get(sub.task_id, p.author, ev.created_at);
-          text = c ? noticeOf(entry, role, ev.kind, task, p, c) : null;
-        } else text = noticeOf(entry, role, ev.kind, task, p);
-        if (text) {
-          // A verified binding may have replaced this audience while liveness
-          // or an earlier filing awaited a door. Re-read before every filing.
-          const currentSub = board.db.prepare(`SELECT last_event_id,delivery_metadata FROM kanban_notify_subs ${where}`).get(...identity);
-          const currentRole = json(currentSub?.delivery_metadata, {})?.role ?? 'creator';
-          if (!currentSub || currentRole !== role) break;
-          if (Number(currentSub.last_event_id) >= ev.id) { cursor = Math.max(cursor, Number(currentSub.last_event_id)); continue; }
-          const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
-          // filed under its fixed key: a second pass filing the same notice files nothing new
-          const filed = await fileMail(board, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { wake, subject: numbered(task?.key, task?.number, `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}`),
-            eligible: () => view(board, db => {
-              const currentSub = db.prepare(`SELECT last_event_id FROM kanban_notify_subs ${where}`).get(...identity);
-              return Boolean(currentSub) && Number(currentSub.last_event_id) < ev.id;
-            }) });
-          if (filed.new) tx(board, (db) => event(db, sub.task_id, 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, message_id: filed.message_id, wake }));
-          if (filed.filed) report.notified.push([sub.task_id, ev.kind, sub.chat_id]);
+      const filed = await fileMail(board, digest.to, body, key, { wake, subject,
+        eligible: () => view(board, db => subs.some(({ sub, through }) => {
+          const row = db.prepare(`SELECT last_event_id FROM kanban_notify_subs ${where}`).get(...identityOf(sub));
+          return Boolean(row) && Number(row.last_event_id) < through;
+        })) });
+      tx(board, (db) => {
+        for (const { sub, through } of subs) forward(db, sub, through);
+        if (filed.filed) {
+          state.sent.push(passAt);
+          for (const c of cards) state.cards[c.task_id] = passAt;
+          db.prepare('INSERT INTO supercode_board_state (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(state.key, JSON.stringify({ sent: state.sent, cards: state.cards }));
         }
-        cursor = ev.id;
-        forward(cursor);
-      }
-      noticeWait(board, sub, report);
+        if (filed.new) for (const i of items) event(db, i.sub.task_id, 'notice_filed', { source_event: i.ev.id, kind: i.ev.kind, address: digest.to, message_id: filed.message_id, wake, ...(items.length > 1 ? { batched: items.length } : {}), ...(kind === 'summary' ? { summary: true } : {}) });
+        if (filed.new && kind === 'summary') event(db, cards[0].task_id, 'notice_flood_collapsed', { address: digest.to, recipient: digest.recipient, notices: items.length,
+          cards: cards.map((c) => c.task_id).slice(0, 50), card_count: cards.length, ceiling: NOTICE_CEILING, window_seconds: window, message_id: filed.message_id,
+          reason: `more than ${NOTICE_CEILING} notice messages in ${window} s for one recipient: the rest are one summary` });
+      });
+      if (filed.filed) for (const i of items) report.notified.push([i.sub.task_id, i.ev.kind, digest.to]);
+      if (filed.filed && kind === 'summary') (report.notices_collapsed ??= []).push([digest.to, items.length, cards.length]);
+      for (const { sub } of subs) noticeWait(board, sub, report);
     } catch (error) {
-      noticeWait(board, sub, report, String(error.message).slice(-200));
+      for (const { sub } of subs) noticeWait(board, sub, report, String(error.message).slice(-200));
+    }
+  };
+  for (const digest of digests.values()) {
+    if (stopping) break;
+    // the recipient's window: the messages filed to it and the cards it was told of in the last `window` seconds
+    const stateKey = `notice_digest:${digest.recipient}`;
+    const stored = json(board.db.prepare('SELECT value FROM supercode_board_state WHERE key = ?').get(stateKey)?.value, null) ?? {};
+    const state = { key: stateKey, sent: [].concat(stored.sent ?? []).map(Number).filter((at) => passAt - at < window),
+      cards: Object.fromEntries(Object.entries(stored.cards ?? {}).filter(([, at]) => passAt - Number(at) < window)) };
+    const cards = [...digest.cards.values()].sort((a, b) => a.items[0].ev.id - b.items[0].ev.id);
+    // a card told within its window waits: what happens on it meanwhile is one message when the window ends
+    const ready = cards.filter((c) => !(c.task_id in state.cards));
+    const hold = (list) => {
+      if (!list.length) return;
+      report.notices_held = (report.notices_held ?? 0) + list.reduce((n, c) => n + c.items.length, 0);
+      const ends = list.map((c) => Number(state.cards[c.task_id] ?? state.sent[0] ?? passAt) + window);
+      report.next_notice_at = Math.min(report.next_notice_at ?? Infinity, ...ends);
+    };
+    hold(cards.filter((c) => c.task_id in state.cards));
+    // the ceiling: at most NOTICE_CEILING messages a window; past it, the rest are one summary message
+    const budget = NOTICE_CEILING - state.sent.length;
+    if (budget <= 0) { hold(ready); continue; }
+    const each = ready.length <= budget ? ready : ready.slice(0, budget - 1);
+    const rest = ready.length <= budget ? [] : ready.slice(budget - 1);
+    for (const c of each) {
+      if (stopping) break;
+      const first = c.items[0], label = numbered(c.task?.key, c.task?.number, c.task?.title || c.task_id, noticeName(c.task));
+      const shown = c.items.slice(0, CARD_DIGEST_ITEMS);
+      const body = c.items.length === 1 ? first.body
+        : `${c.items.length} updates on ${label}:\n\n${shown.map((i) => cutText(i.body, CARD_DIGEST_TEXT)).join('\n\n')}`
+          + `${c.items.length > shown.length ? `\n\n…and ${c.items.length - shown.length} more` : ''}\n\nThe card: supercode workflow show ${c.task_id} --root ${board.root}`;
+      const subject = c.items.length === 1
+        ? numbered(c.task?.key, c.task?.number, `${first.ev.kind.replaceAll('_', ' ')} · run ${first.ev.run_id ?? 'none'} · event ${first.ev.id} · ${c.task?.title || c.task_id}`, noticeName(c.task))
+        : numbered(c.task?.key, c.task?.number, `${c.items.length} updates · ${c.task?.title || c.task_id}`, noticeName(c.task));
+      await file(digest, state, { cards: [c], body, subject, kind: 'notice' });
     }
-    forward(cursor);
-    // a subscription past its card's last event ends with the card: a worker's when the card is done or archived (its
-    // work is over, and its session may never run again), anyone's when it is archived
+    if (rest.length && !stopping) {
+      const count = rest.reduce((n, c) => n + c.items.length, 0);
+      const names = rest.map((c) => numbered(c.task?.key, c.task?.number, c.task_id, noticeName(c.task)));
+      const body = `${count} updates on ${rest.length} card(s): ${names.slice(0, 20).join(', ')}${names.length > 20 ? `, and ${names.length - 20} more` : ''}. `
+        + `Read them on the board: supercode workflow show <card> --root ${board.root}. More than ${NOTICE_CEILING} notice messages in ${window} s would have reached this session, so the rest are this one summary (board event notice_flood_collapsed).`;
+      await file(digest, state, { cards: rest, body, subject: numbered(boardKey(board.root, board.slug), null, `${count} updates on ${rest.length} cards`), kind: 'summary' });
+    }
+  }
+  if (quiet.length) tx(board, (db) => { for (const { sub, through } of quiet) forward(db, sub, through); });
+  // a subscription past its card's last event ends with the card: a worker's when the card is done or archived (its
+  // work is over, and its session may never run again), anyone's when it is archived
+  for (const { sub, role, task, kinds } of read) {
     const over = task && (task.stored_as === 'archived' || (role === 'worker' && task.stored_as === 'done'));
     if (over) tx(board, (db) => {
-      const durable = db.prepare(`SELECT last_event_id FROM kanban_notify_subs ${where}`).get(...identity);
+      const durable = db.prepare(`SELECT last_event_id FROM kanban_notify_subs ${where}`).get(...identityOf(sub));
       if (!durable) return;
       // A page's final event is not the end of the backlog. Check past the persisted cursor in the same
       // transaction as retirement, so another page (including the card's completion) is never abandoned.
@@ -3468,7 +4042,7 @@ async function notify(board, fleet, report, entry) {
         .get(sub.task_id, durable.last_event_id, ...kinds);
       const current = getTask(db, sub.task_id);
       if (!remaining && current && (current.status === 'archived' || (role === 'worker' && current.status === 'done')))
-        db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity);
+        db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identityOf(sub));
     });
   }
 }
@@ -3647,10 +4221,68 @@ export { boardLabel };
 
 // A dispatcher told to stop (its serve's SIGTERM, SIGINT or SIGHUP) starts nothing more in the round it is in: no further
 // board, card start, board message or notice. What it leaves unfiled is not a failure; the next dispatcher files it.
-let stopping = false;
-export function stopDispatching() { stopping = true; }
+let stopping = false, park = new AbortController();
+const parkedError = () => Object.assign(new Error('the board generation parked before this read answered; it is read next round'), { code: 'board_parked' });
+export function stopDispatching() { stopping = true; park.abort(parkedError()); }
+/** `work`, or `parkedValue()` as soon as a park lands (the fleet's read, which only observes: the successor's round reads
+ *  the fleet again). The park's listener goes with the work, so a long-lived generation keeps none. */
+function untilParked(work, parkedValue) {
+  if (stopping) return Promise.resolve(parkedValue());
+  const signal = park.signal;
+  return new Promise((resolve, reject) => {
+    const onPark = () => resolve(parkedValue());
+    signal.addEventListener('abort', onPark, { once: true });
+    work.then((value) => { signal.removeEventListener('abort', onPark); resolve(value); }, (error) => { signal.removeEventListener('abort', onPark); reject(error); });
+  });
+}
+/**
+ * A parking generation's claims end with its park (cli.mjs, while it still writes). A parked generation stays alive after
+ * its successor serves, and a claim whose process is alive holds until its TTL (store.mjs claimHolds), so the successor
+ * could not close a session or bind an adoption this generation had claimed (VO-3578: run 2408's close, claimed by the
+ * predecessor 61278 at 01:19:26Z, held generation 46402 off it until 01:29:50Z). A close claim is cleared; an adoption
+ * claim is recorded again already expired, which every round reads as a dead round's claim, open again.
+ * Only the rows this process claimed are read (`claimsMade`, by primary key and the card's latest answer), never a scan of
+ * every run's metadata and every adoption event: on bb8821620's first park those two scans read about 5,000 pages the
+ * system no longer held, 5.8 s of the park's 6.27 s (slow.jsonl, pid 78550, 2026-10-24T01:50:12.415Z), and the park is
+ * the window card verbs wait out.
+ */
+export function releaseClaims(root) {
+  const lock = claimer();
+  let released = 0;
+  for (const slug of listBoards(root)) {
+    const board = openBoard(root, slug);
+    try {
+      const made = claimsMade.get(board.key);
+      if (!made) continue;
+      released += tx(board, (db) => {
+        let n = 0;
+        for (const runId of made.runs) {
+          const claim = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(runId)?.metadata, {})?.supercode?.close_claim;
+          if (claim?.lock === lock) { setRunSession(db, runId, { close_claim: null }); n++; }
+        }
+        for (const id of made.cards) {
+          const last = latestAnswer(db, id);
+          const claim = last?.kind === 'adoption_claimed' ? json(last.payload, {}) ?? {} : null;
+          if (claim?.lock === lock) { event(db, id, 'adoption_claimed', { ...claim, expires: 0 }); n++; }
+        }
+        return n;
+      });
+      claimsMade.delete(board.key);
+    } finally { board.close(); }
+  }
+  return released;
+}
+/** The close claims (by run) and adoption claims (by card) this process has written, per board: what its park releases. */
+const claimsMade = new Map();
+function noteClaim(board, kind, id) {
+  let made = claimsMade.get(board.key);
+  if (!made) claimsMade.set(board.key, made = { runs: new Set(), cards: new Set() });
+  made[kind].add(id);
+}
+/** A round a park ended early: its reports are marked `cut`, so it is never read as a clean round (cli.mjs serving). */
+const cutRound = (reports) => Object.defineProperty(reports, 'cut', { value: true });
 // Only the stable owner's parked generation is resumed; it takes a fresh fencing epoch first.
-export function resumeDispatching() { stopping = false; }
+export function resumeDispatching() { stopping = false; park = new AbortController(); }
 
 /** A board file's fingerprint: a corrupt board is skipped until the file changes (Hermes retries it then). */
 const fingerprint = (path) => { try { const st = statSync(path); return `${st.size}:${st.mtimeMs}`; } catch { return 'missing'; } };
@@ -3713,8 +4345,9 @@ function noCodeReviewDue(board, id) {
     const filed = db.prepare('SELECT 1 FROM supercode_cards WHERE subtask_of = ? LIMIT 1').get(id);
     if (!filed && !completedWork(db, id) && !(db.prepare("SELECT 1 FROM task_runs WHERE task_id = ? AND outcome = 'completed' AND ended_at IS NOT NULL LIMIT 1").get(id) &&
       outcomeTicked(db.prepare('SELECT body FROM tasks WHERE id = ?').get(id)?.body))) return false;
-    const last = db.prepare("SELECT kind FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass','review_voided') ORDER BY id DESC LIMIT 1").get(id);
-    return !last || ['changes_requested','review_voided'].includes(last.kind);
+    const last = db.prepare("SELECT kind FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass','review_voided','review_returned') ORDER BY id DESC LIMIT 1").get(id);
+    // a review the manager returned is due again once the disposition is completed again (a finish after the return)
+    return !last || ['changes_requested','review_voided'].includes(last.kind) || (last.kind === 'review_returned' && Boolean(completedWork(db, id)));
   });
 }
 
@@ -3774,6 +4407,8 @@ function reviewDueKey(board, id, payload) {
   return `${source}|${closed ?? ''}`;
 }
 
+const PASSED_WAITS = 'its review passed and no PR head is unjudged since: no review is due; the arc waits on `complete`';
+
 /** Review selection shared by rounds and read-only inspection (`dry: true`). */
 export async function activatePullRequestReviews(board, entry, report, effects, { only = null, dry = false, fleet = null } = {}) {
   const candidates = view(board, db => db.prepare(`SELECT t.id FROM tasks t JOIN supercode_cards c ON c.task_id=t.id
@@ -3789,13 +4424,26 @@ export async function activatePullRequestReviews(board, entry, report, effects,
       if (!transitionsFor(entry.workflow, statusOf(db, task), 'request_review').some(t => !t.by || t.by.includes('platform'))) return false;
       const scope = scopeOf(db, board, task, { params: entry.params, lazy: true });
       if (scope.card.dispatch_hold || scope.card.paused || scope.card.blocked_by.length) return false;
-      // The card's Tasks are its subtasks; an open one holds the review, and says so.
-      const open = scope.card.subtasks.filter(t => !['done', 'cancelled'].includes(t.status));
+      // A person's card needs no review: it closes on that person's completion.
+      if (scope.card.person) return false;
+      // The card's Tasks are its subtasks; an open one holds the review, and says so. A paused one holds nothing.
+      const open = scope.card.subtasks.filter(t => !['done', 'cancelled'].includes(t.status) && !t.paused);
       return open.length ? open : true;
     };
     const ready = view(board, eligible);
     if (!ready) { settled.push(id); continue; }
-    if (ready !== true) { settled.push(id); report.queued.push([id, `review waits: ${ready.length} open task(s) in the card's Tasks: ${ready[0].id} ${ready[0].title}`]); continue; }
+    if (ready !== true) {
+      settled.push(id);
+      // what holds the final review is said by name, on the round and once on the card each time the set changes
+      const holds = ready.map((t) => `${t.id} "${t.title}"`).join(', ');
+      report.queued.push([id, `review waits on ${ready.length} open task(s): ${holds}`]);
+      if (!dry) tx(board, (db) => {
+        const key = ready.map((t) => t.id).sort().join(',');
+        const last = latestEvent(db, id, ['review_waits_on_tasks']);
+        if (json(last?.payload, {})?.key !== key) event(db, id, 'review_waits_on_tasks', { key, tasks: ready.map((t) => ({ id: t.id, title: t.title, status: t.status })), reason: `the final review waits on ${ready.length} open task(s): ${holds}` });
+      });
+      continue;
+    }
     let payload = null;
     try {
       payload = await openReviewPullRequests(board, id);
@@ -3804,21 +4452,31 @@ export async function activatePullRequestReviews(board, entry, report, effects,
       // source (reviewDue).
       // An arc that closed its tasks having changed no code gets its one review of the act itself (ADR 0003).
       if (!payload && noCodeReviewDue(board, id)) payload = await noCodeChange(board, id);
-      // An arc whose last verdict is a pass, with nothing unjudged since, waits on no review: what is left is its
-      // session's done request and the manager's or creator's `complete`, and the round says that (volter-org
-      // t_b499d0cf and t_a2bd2a5f were logged as waiting for a review every round for hours after theirs passed).
-      if (!payload) { report.queued.push([id, passedReview(board, id) ? 'its review passed and no PR head is unjudged since: no review is due; the arc waits on `complete`' : 'review waits: no open or unjudged merged PR on its declared branches, and no completed disposition']); continue; }
+      if (!payload) { report.queued.push([id, passedReview(board, id) ? PASSED_WAITS : 'review waits: no open or merged PR on its declared branches, and no completed disposition']); continue; }
       if (payload.waits) {
         report.queued.push([id, `review waits: ${payload.waits}`]);
         stalls.push({ id, key: `no_work_branch:${lastReviewEvent(board, id)}`, why: `its review waits: ${payload.waits}` });
         payload = null; continue;
       }
+      // An arc whose every PR merged at the head its PR review passed (`pr_reviewed`) still gets its final review, of its
+      // Acceptance against them, once that is due (settledReviewDue).
+      const settledOnly = !payload.no_code && !payload.pr.length && !payload.stacked?.length && Boolean(payload.pr_reviewed?.length);
+      if (settledOnly && !settledReviewDue(board, id)) { report.queued.push([id, passedReview(board, id) ? PASSED_WAITS : `review waits: every PR of the arc (${payload.pr_reviewed.map((p) => p.url).join(', ')}) merged at the head its PR review passed, and no final review is due since its last one`]); continue; }
       // A PR of the arc proposed to a branch other than main is refused below, whatever the others' verdicts.
-      if (!payload.no_code && !payload.stacked?.length && !await reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
-        const why = `every open PR head (${payload.pr.join(', ')}) has a verdict, carries the source tree its verdict judged, or predates it; push a commit that changes the source, or close the tasks that own the last verdict's findings`;
+      if (!settledOnly && !payload.no_code && !payload.stacked?.length && !await reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
+        // An arc whose last verdict is a pass, with nothing unjudged since, waits on no review: what is left is its
+        // session's done request and the manager's or creator's `complete`, and the round says that (volter-org
+        // t_b499d0cf and t_a2bd2a5f were logged as waiting for a review every round for hours after theirs passed).
+        if (passedReview(board, id)) { report.queued.push([id, PASSED_WAITS]); continue; }
+        // a review the manager returned waits on its coder's next pushed head, which the coder is due to push
+        if (returnedReview(board, id)) { report.queued.push([id, 'review waits: the manager returned it from review with no verdict; the next review starts once a pushed PR head changes']); continue; }
+        // a PR whose PR review passed at its head waits on its coder's merge at that head, which settles it
+        const passedOpen = payload.pr.filter((url, index) => prReviewedHead(board, id, payload.pr_head[index]));
+        const why = passedOpen.length ? `${passedOpen.join(', ')} passed its PR review and waits on its merge at its reviewed head; every other PR head has a verdict, carries the source tree its verdict judged, or predates it`
+          : `every PR head (${payload.pr.join(', ')}) has a verdict, carries the source tree its verdict judged, or predates it; push a commit that changes the source, or close the tasks that own the last verdict's findings`;
         report.queued.push([id, `review waits: ${why}`]);
-        // After a pass the arc's own session merges and asks for done; any other verdict nothing answered waits on an act
-        if (!passedReview(board, id)) stalls.push({ id, key: `verdict:${lastReviewEvent(board, id)}`, why: `its review waits: ${why}. Every task is closed, so no session of the arc is due to act on it.` });
+        // A verdict other than a pass that nothing answered waits on an act
+        stalls.push({ id, key: `verdict:${lastReviewEvent(board, id)}`, why: `its review waits: ${why}. Every task is closed, so no session of the arc is due to act on it.` });
         continue;
       }
       // A native turn holds the advisory proposal before authoritative source reads. Retain the proposal on the run
@@ -3857,14 +4515,14 @@ export async function activatePullRequestReviews(board, entry, report, effects,
       const evidence = observed.evidence;
       if (!evidence.ready) throw Object.assign(new Error(evidence.reason), { code: evidence.code, refusals: evidence.refusals });
       // A dry run names the complete validated review a tick would request and writes nothing.
-      if (dry) { (report.would_review ??= []).push({ id, prs: payload.pr, heads: payload.pr_head, no_code: payload.no_code ?? null }); continue; }
+      if (dry) { (report.would_review ??= []).push({ id, prs: payload.pr, heads: payload.pr_head, no_code: payload.no_code ?? null, pr_reviewed: payload.pr_reviewed ?? null }); continue; }
       const moved = tx(board, db => {
         const task = getTask(db, id);
         if (eligible(db) !== true) return null;
         return withCompletionEvidence(board, id, evidence, () => fire(db, board, entry, id, 'request_review', {
           roles: ['platform'], payload: { ...payload, run_id: task.current_run_id, ci: evidence, summary: payload.no_code
             ? `${payload.no_code.kind === 'disposition' ? 'Scratch operational disposition.' : `No code changed: ${payload.no_code.repository} ${payload.branch} holds no commit beyond ${payload.no_code.base} and no PR was opened from it.`} Review the arc's act from the card: its comments, its tasks' results and what they point at.`
-            : `Source ${payload.pr.map((url, index) => `${url} at ${payload.pr_head[index]}`).join(', ')}` }
+            : `${payload.pr.length ? `Source ${payload.pr.map((url, index) => `${url} at ${payload.pr_head[index]}`).join(', ')}` : 'No PR left to review'}${payload.pr_reviewed?.length ? `${payload.pr.length ? '; settled' : ': every PR merged'} at the head its PR review passed: ${payload.pr_reviewed.map((p) => `${p.url} at ${p.head}`).join(', ')}. Review the arc's Acceptance against them.` : ''}` }
         }));
       });
       if (moved) {
@@ -3884,9 +4542,9 @@ export async function activatePullRequestReviews(board, entry, report, effects,
   if (!dry) surfaceReviewStalls(board, entry, stalls, settled, report);
 }
 
-/** The id of the arc's last review event (requested, changes requested, passed, voided), or 0: a review wait's key
+/** The id of the arc's last review event (requested, changes requested, passed, voided, returned), or 0: a review wait's key
  *  carries it, so the wait a new verdict or request leaves is a new wait. */
-const lastReviewEvent = (board, id) => board.db.prepare("SELECT MAX(id) AS id FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass', 'review_voided')").get(id)?.id ?? 0;
+const lastReviewEvent = (board, id) => board.db.prepare("SELECT MAX(id) AS id FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass', 'review_voided', 'review_returned')").get(id)?.id ?? 0;
 
 /** A review refusal's wait key: the arc's last review event and the sorted kinds and PRs it refused (ci.mjs refusalOf),
  *  never a count or a path, so the same refusal is the same wait however its detail or read order changes. */
@@ -3936,7 +4594,7 @@ function surfaceReviewStalls(board, entry, stalls, settled, report) {
     for (const stall of plan.tell) {
       if (told(db, stall.id) === stall.key) continue;
       const card = getTask(db, stall.id);
-      event(db, stall.id, 'board_message', { to, review_wait: stall.key, text: `${numbered(boardKey(board.root, board.slug), card?.number, stall.id)} ${card?.title ?? ''}: ${stall.why}`,
+      event(db, stall.id, 'board_message', { to, review_wait: stall.key, text: `${numbered(boardKey(board.root, board.slug), card?.number, stall.id, noticeName(card))} ${card?.title ?? ''}: ${stall.why}`,
         batch: { requester: 'board review waits', title: 'Review waits only an act clears', window_seconds: 0 } }, null);
       (report.review_waits_told ??= []).push([stall.id, stall.key]);
     }
@@ -3964,14 +4622,14 @@ export function startDelivery(root, { slugs = null, log = () => {} } = {}) {
   // the controller's delivery pass, run here by the owner (no process of its own), never two at once for a home; the
   // round never waits for it
   if (deliveries.has(root)) return false;
-  const pass = ownCall(() => deliver({ root, slugs, controller: true })).then((reports) => {
+  const pass = ownCall(() => deliver({ root, slugs, controller: true }), 'a delivery pass').then((reports) => {
     for (const r of reports) {
       if (r.error) log('warn', `delivery on board ${r.board} failed: ${r.error}`);
       for (const [task, to, why] of r.undelivered ?? []) log('warn', `board ${r.board}: a delivery for ${task} to ${to} waits: ${why}`);
       for (const [task, to] of r.notices_resumed ?? []) log('info', `board ${r.board}: notices for ${task} to ${to} resumed`);
       log('info', `delivery on board ${r.board}: ${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good; took ${Object.entries(r.ms ?? {}).map(([k, v]) => `${k} ${(v / 1000).toFixed(1)}s`).join(', ')}`);
     }
-  }, (error) => log('warn', `delivery pass failed: ${error?.message ?? error}`)).finally(() => deliveries.delete(root));
+  }, (error) => error?.code === GENERATION_STOPPED ? log('info', `delivery pass not run: ${error.message}`) : log('warn', `delivery pass failed: ${error?.message ?? error}`)).finally(() => deliveries.delete(root));
   deliveries.set(root, pass);
   return true;
 }
@@ -4016,7 +4674,7 @@ export async function deliver({ root, slugs = null, controller = false }) {
       board.label = boardLabel(root, slug);
       setActor(boardAddress(board.label));
       let mark = Date.now();
-      const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
+      const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; roundStep(`${slug} ${name}`); };
       // board mail and notices are filed in their receivers' mailboxes (local writes); the mailbox delivers them
       // a controller's pass reads the board's switch before each phase and each effect: switched off meanwhile, what had
       // not begun is left (an operator's `workflow deliver` delivers as asked)
@@ -4024,7 +4682,7 @@ export async function deliver({ root, slugs = null, controller = false }) {
       if (on()) { await fileBoardMail(board, report); phase('mail'); }
       if (on()) { report.effects = await runEffects(board, [], { pending: true, eligible: controller ? on : null }); phase('effects'); }
       if (on()) { await notify(board, fleet, report, entry); phase('notify'); }
-      if (on()) { await synchronizeAgents(board, report); phase('agents'); }
+      if (on()) { await synchronizeAgents(board, report, fleet); phase('agents'); }
       report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
       report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);
     } catch (error) { report.error = error.message; }
@@ -4034,6 +4692,40 @@ export async function deliver({ root, slugs = null, controller = false }) {
   return out;
 }
 
+/**
+ * The round's close pass alone (closeRequested, its supervise phase's last act), for the boards in `slugs`: the owner
+ * runs it each interval for every board whose dispatching is off, so an ended run's session closes as it does with
+ * dispatching on. Switching dispatching off stops launches, not closes: VO-3578's reviewer run r2612 ended 12 s after
+ * its board was switched off, and its pane stayed open. Nothing else of a round runs here: no mailbox, adoption,
+ * reconnection, launch, supervision, review, start, effect or delivery. Answers one report per board.
+ */
+export async function closeEnded({ root, slugs, settings }) {
+  fleetRoot = root;
+  if (stopping || !slugs.length || boardCopyOf({ root })) return [];
+  // a session's native discovery is read once a pass, as once a round (readNative)
+  discoveries.clear();
+  // the fleet reading settles a launch that never bound a pane; one unread leaves that close waiting, as a round's does
+  const fleet = await untilParked(observeFleet(), () => null).catch((error) => ({ ok: false, error: error.message }));
+  if (!fleet) return [];
+  const out = [];
+  for (const slug of slugs) {
+    if (stopping) break;
+    const report = { board: slug, closed: [], undelivered: [] };
+    const path = boardPath(root, slug);
+    if (existsSync(`${path}.corrupt-seen`) && readFileSync(`${path}.corrupt-seen`, 'utf8').trim() === fingerprint(path)) continue;
+    let board;
+    try {
+      board = openBoard(root, slug);
+      board.label = boardLabel(root, slug);
+      setActor(boardAddress(board.label));
+      await closeRequested(board, report, { ttl: settings.ttl, fleet });
+    } catch (error) { report.error = error.message; }
+    finally { board?.close(); }
+    out.push(report);
+  }
+  return out;
+}
+
 /**
  * One tick over every board of the home at `root`. `lanes` from `lanesOf`, `settings` from `boardSettings`.
  * `only` limits starting to one card (a create that answers whether its card started). No dispatcher file lock: two
@@ -4052,7 +4744,16 @@ export async function deliver({ root, slugs = null, controller = false }) {
  * effect and delivers nothing: it records effects (`queueEffects`) and the delivery pass (`deliver`) carries them out.
  * Answers one report per board.
  */
-export async function tick({ root, lanes, settings, only = null, slugs = null, dispatch = true, params = {}, deploymentReceipt = false }) {
+// A round's progress, said to whoever asked for it (`tick`'s `progress`; the board generation's first round, which its
+// owner bounds by progress, never by the round's length): each phase a board's round ends and each door call that
+// settles, answered or not. A round slow only because another machine answers slowly is progressing; one in which
+// nothing settles is not. It is the round's own: a card verb this process answers meanwhile says nothing of it.
+const roundProgress = new AsyncLocalStorage();
+const roundStep = (step) => { try { roundProgress.getStore()?.(step); } catch { /* the round goes on unsaid */ } };
+export function tick({ progress = null, ...options }) {
+  return roundProgress.run(progress, () => boardRound(options));
+}
+async function boardRound({ root, lanes, settings, only = null, slugs = null, dispatch = true, params = {}, deploymentReceipt = false }) {
   fleetRoot = root;
   discoveries.clear();
   // a verb's flags (dispatch --max, --failure-limit) are params of this tick, read by the workflow as its own
@@ -4061,13 +4762,21 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
   const entry = { ...loaded, params: { ...loaded.params, ...params } };
   const needFleet = Object.values(lanes).some((l) => l.surface === 'pane');
   const fleetAt = Date.now();
-  const fleet = needFleet ? await observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
+  const fleet = needFleet ? await untilParked(observeFleet(), () => null) : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
   const fleetMs = Date.now() - fleetAt;
+  roundStep('the fleet read');
+  // A park (stopDispatching) ends the round at its next step, not at its end: the successor's first round does the rest,
+  // and every act re-reads its basis in its own transaction, so a round cut between steps leaves nothing half done. A
+  // round that only read has nothing to keep; one that moved cards keeps the effects those moves asked for (queueEffects
+  // below runs whatever was skipped). A park that waited out a whole round (11-15 s of other machines' doors) missed the
+  // owner's 8 s wait for 'parked', and the handover rolled back (VO-3578, pin V, 21:53Z).
+  if (stopping) return cutRound([]);
   await readMemoryPressure();
   const boards = slugs ?? listBoards(root);
   // what every board of the home holds, for caps whose scope is the whole home (kanban.max_in_progress counts so): every
   // board, including one whose dispatching is off, whose live workers still hold their places
   const held = dispatch ? await homeHoldings(root, listBoards(root), lanes, fleet, entry) : [];
+  if (stopping) return cutRound([]);
   const out = [];
   for (const slug of boards) {
     if (stopping) break;
@@ -4090,17 +4799,20 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       let mark = Date.now();
       const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
 
-      await readMailbox(board, boardAddress(board.label), report); phase('mailbox');
-      await refreshRelationAnswers(board); settleStateRequestAnswers(board, entry, report); phase('answers');
+      // each step after a park is skipped (above); the effects of what moved are still recorded (queueEffects)
+      const going = () => !stopping;
+      if (going()) await readMailbox(board, boardAddress(board.label), report); phase('mailbox');
+      if (going()) { await refreshRelationAnswers(board); settleStateRequestAnswers(board, entry, report); } phase('answers');
       const effects = [];
-      await completeAdoptions(board, fleet, settings, report, lanes); await reconnectContinuedSessions(board, fleet, entry, report); await reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); await recordBounces(board, fleet, entry, report); await supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); await closeRequested(board, report, { ttl: settings.ttl, fleet }); phase('supervise');
+      if (going()) await completeAdoptions(board, fleet, settings, report); if (going()) await reconnectContinuedSessions(board, fleet, entry, report); if (going()) await reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); if (going()) await recordBounces(board, fleet, entry, report); if (going()) await supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); if (going()) await closeRequested(board, report, { ttl: settings.ttl, fleet }); phase('supervise');
       report.unsettled = [];
       report.promoted = recomputeReady(board, effects, report.unsettled);
       tx(board,db=>auditEndedRuns(db,board,entry));
-      if (dispatch) await activatePullRequestReviews(board, entry, report, effects, { only, fleet });
-      if (dispatch && !stopping) await startCards(board, fleet, lanes, settings, report, entry, effects, { only, held });
+      if (dispatch && going()) await activatePullRequestReviews(board, entry, report, effects, { only, fleet });
+      if (dispatch && going()) await startCards(board, fleet, lanes, settings, report, entry, effects, { only, held });
       phase('start');
-      if (dispatch && !only && !report.paused) await observeIdle(board, fleet, settings, report, entry, effects);
+      if (dispatch && !only && !report.paused && going()) await observeIdle(board, fleet, settings, report, entry, effects);
+      if (dispatch && !only && !report.paused && going()) retellBriefs(board, entry, report);
       // what the moves asked for is recorded with them; the delivery pass (`deliver`) carries it out, outside the round
       queueEffects(board, effects);
       phase('idle');
@@ -4119,7 +4831,8 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
     }
     out.push(report);
   }
-  if (deployment && out.every(report => !report.error)) {
+  if (stopping) cutRound(out);
+  if (deployment && !out.cut && out.every(report => !report.error)) {
     const receipt = await retainWorkflowTick(root, deployment);
     if (receipt && out[0]) out[0].deployment = receipt;
   }