@volter/supercode-orchestrator 0.5.227 → 0.5.229

package/board/storage-contract.mjs

@@ -32,14 +32,23 @@
 //   which every snapshot frame reads, stays complete. Its supercode_board_state key (publication_trim) is one 04bc6948
 //   never reads. A store `workflow compact` rebuilt is in incremental auto-vacuum, which SQLite opens and writes the
 //   same for any release.
+//   635a0880… (#2533, the work ledger: ztrack.mjs registers its `board.transaction` operation at load and runs tx()
+//   inside measureWork, which calls it at once and answers its value unchanged) is read by f5dca0f9…: it adds no
+//   table, column, document text or written value; only the module's source moved.
+//   a188edd2… (VO-3779, current board selectors and held-read observation) is read by 635a0880…: it adds only indexes
+//   to the persistent layout. Changed-row tracking uses connection-local TEMP triggers and bounded in-memory marks;
+//   read boundaries and observation revisions write no persistent state. There is no new table, column, document
+//   text or JSON shape for the predecessor to parse, and SQLite ignores the added indexes when its queries do not
+//   use them. Predecessor readback is qualified against the exact candidate format, not this source-only explanation.
 // `format` is null when a member READS names occurs more than once (the owner then compares `storage`).
 import { createHash } from 'node:crypto';
 import fs, { readFileSync } from 'node:fs';
 import { createRequire, syncBuiltinESMExports } from 'node:module';
 import { DatabaseSync } from 'node:sqlite';
 import { layOut } from './store.mjs';
+import { restingCodecContract } from './resting-protocol.mjs';
 
-const MODULES = ['store.mjs', 'files.mjs', 'ztrack.mjs', 'published.mjs'];
+const MODULES = ['store.mjs', 'files.mjs', 'ztrack.mjs', 'published.mjs', 'resting-state.mjs', 'session-continuity.mjs', 'resting-admission.mjs', 'resting-protocol.mjs', 'workflow.mjs'];
 // Members that only read a store or choose which rows a load keeps (VO-3578 row 22's #2328 changed these): a change to
 // one keeps the format. A member joins this list only when what it writes is rows of the laid-out tables, never a file,
 // a document's text or a JSON shape.
@@ -54,8 +63,19 @@ const require = createRequire(import.meta.url);
 // What the codec writes for two cards, one open and one ended, each given a number as a numbering codec would show it.
 function renders() {
   const codec = require('@volter/ztrack/board-document');
-  const cards = [{ id: 't_00000000', title: 'format', status: 'todo', body: 'A card.' }, { id: 't_00000001', title: 'ended', status: 'done', body: '' }];
-  return cards.map((card, i) => codec.renderBoardCard({ ...card, number: i + 1, key: 'KB' }, 2));
+  const preset = require('@volter/ztrack/kanban-preset');
+  const cards = [{ id: 't_00000000', title: 'format', status: 'todo', body: 'A card.' }, { id: 't_00000001', title: 'ended', status: 'done', body: '' },
+    // Optional metadata is format too: changing a deadline/backlog writer must move the digest even when
+    // the existing cards on a particular board have not yet acquired either flag.
+    { id: 't_00000002', title: 'resting format', status: 'running', body: 'Retained lane.',
+      paused: { by: 'manager', reason: 'until later', until: 2000000000, generation: 'format-generation' },
+      backlog: { by: 'manager', reason: 'accepted for later', since: 1900000000 } },
+  ];
+  const render = (card, i, options) => codec.renderBoardCard({ ...card, ...preset.serializeKanbanCard({
+    ...card, summary: '', acceptanceCriteria: [], relations: [],
+  }, options), number: i + 1, key: 'KB' }, 2, undefined, options);
+  return { legacy: cards.slice(0, 2).map((card, i) => render(card, i, { resting: 'legacy' })),
+    preserved: cards.map((card, i) => render(card, i, { resting: 'preserve' })) };
 }
 // A member's lines in its module: from its first line (`  name(` in a class, `function name(` or `const name =` at the
 // top) to the line that closes it at the same indent, or that line alone when it ends the member. None when absent.
@@ -103,21 +123,123 @@ function format() {
     const layout = db.prepare("SELECT type, name, tbl_name, sql FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' ORDER BY type, name, tbl_name").all()
       .map(({ type, name, tbl_name: table, sql }) => [type, name, table, sql]);
     const modules = MODULES.map((file) => [file, code((READS[file] ?? []).reduce(without, source(file)))]);
-    return createHash('sha256').update(JSON.stringify({ layout, modules, renders: renders() })).digest('hex');
+    return createHash('sha256').update(JSON.stringify({ layout, modules, codec: restingCodecContract(), renders: renders() })).digest('hex');
   } finally { db.close(); }
 }
 
-const READABLE_BY = {
+const LEGACY_READABLE_BY = {
   '2bfde37add33506a56e910c49c9643e91a4f96d36378daeb8cdae3018835a089': ['c23c3ca4bd184cd9c6d9312f4c3fd0ab7f8bc5bde4926f01d32951a641ebde7d'],
   '2964acd14bca601e85ffaccc160bf058ee327f4aafb9ee5a0d8559fe509632e1': ['2bfde37add33506a56e910c49c9643e91a4f96d36378daeb8cdae3018835a089'],
   '04bc6948582c8de470a7c5301ede239bcf26730f7a1d725ccde7fb03aecf9ba5': ['2964acd14bca601e85ffaccc160bf058ee327f4aafb9ee5a0d8559fe509632e1'],
   'f5dca0f9a1337a7f807b8a21c39826bfd5c165bcb6a3d847fb9fb31a9d620afb': ['04bc6948582c8de470a7c5301ede239bcf26730f7a1d725ccde7fb03aecf9ba5'],
+  '635a08803519d72e943488171abafd1f5387b4c76244b129f9c485bb45bf95fc': ['f5dca0f9a1337a7f807b8a21c39826bfd5c165bcb6a3d847fb9fb31a9d620afb'],
+  'a188edd20da4124c2b27a10847f0cd1072bb1e0bfcbf887d7aef160289e13bb7': ['635a08803519d72e943488171abafd1f5387b4c76244b129f9c485bb45bf95fc'],
+  // VO-3783: actual 771cd155 / codec be866b90 reads and rewrites this exact bridge's legacy output across all
+  // backings; fresh document-only native rebuild preserves root/child identities, numbers, body and pause actor.
+  'a61920d6b543cfc9c5a68b8c670ab66ab0d9427d11dd03bf078ac0fc1c8c160b': ['635a08803519d72e943488171abafd1f5387b4c76244b129f9c485bb45bf95fc'],
+  // Existing stored bodies retain the same frozen predecessor projection; newly supplied bodies remain guarded.
+  'e126e6e0b60f354420a77364cd337d0774fc1dc5f80e0686919f684185e2c6be': ['635a08803519d72e943488171abafd1f5387b4c76244b129f9c485bb45bf95fc'],
+  // The corrected inline-HTML codec retains literal outcome evidence under the same frozen predecessor grammar.
+  'db6050ed7b48b9697d393ae880d1c61db0057c8c116fa9822bbdd37ff2a065e2': ['635a08803519d72e943488171abafd1f5387b4c76244b129f9c485bb45bf95fc'],
+  // VO-3783 preparation reuses only successful exact-text admission within one captured generation.
+  // Its bridge writes the same legacy data; the actual 635a predecessor qualifies the retained rollback.
+  'e203b32c46dd55e7c09a71fd429200058b4a2174e8eedaa6a7720123df1eb0de': ['635a08803519d72e943488171abafd1f5387b4c76244b129f9c485bb45bf95fc'],
+};
+
+// Each relationship is independently qualified against its exact candidate. A bridge running over a modern
+// predecessor may preserve modern fields and must never advertise that output to a legacy rollback.
+const READABLE_BY = {
+  // Complete-reader admission only: both native releases bind corrected codec 4a1f551. The final reader preserves
+  // ztrack root/nested records, rich Acceptance/escapes, exact bodies, holds, sessions and publication frames.
+  'a61920d6b543cfc9c5a68b8c670ab66ab0d9427d11dd03bf078ac0fc1c8c160b': ['9d9b9f4e2d28e3b4fad4381501155a1e8c9f52b9fdd7b20a9de062a503446289'],
+  // The complete bridge reader preserves this final writer's modern root/nested records and existing holds.
+  // Its legacy-only stored-body refusals do not change complete-reader preservation; retained handover qualifies both.
+  '9d9b9f4e2d28e3b4fad4381501155a1e8c9f52b9fdd7b20a9de062a503446289': ['a61920d6b543cfc9c5a68b8c670ab66ab0d9427d11dd03bf078ac0fc1c8c160b'],
+  // Codec 8133a03 keeps literal inline HTML in outcome evidence. Older modern readers lose that outcome,
+  // so this corrected pair advertises only its matching complete reader, never the older modern formats.
+  'db6050ed7b48b9697d393ae880d1c61db0057c8c116fa9822bbdd37ff2a065e2': ['d2bec3f8a1c708aed6424ea280afd5ce024cf1dcc0c74bc03c9ca2b5821d9f6c'],
+  'd2bec3f8a1c708aed6424ea280afd5ce024cf1dcc0c74bc03c9ca2b5821d9f6c': ['db6050ed7b48b9697d393ae880d1c61db0057c8c116fa9822bbdd37ff2a065e2'],
+  // The exact preparation-cache pair preserves the same corrected codec, admission and stored values.
+  // Both directions require the complete-reader capability and retained native handover/readback.
+  'e203b32c46dd55e7c09a71fd429200058b4a2174e8eedaa6a7720123df1eb0de': ['df98f5ddd847054e7324f4b06ef27b22b16a50afef938fca691880778c1db188'],
+  'df98f5ddd847054e7324f4b06ef27b22b16a50afef938fca691880778c1db188': ['e203b32c46dd55e7c09a71fd429200058b4a2174e8eedaa6a7720123df1eb0de', '391fcc8198003c5c0b10a8491c0c5a35a72263250d2bf7de46d06e0cb749d23e'],
+  // #2659 only changes the harness a replace_session authorization names inside the existing run metadata
+  // (replacement_authorization.target.harness); no table, column, document text or JSON shape moves, and either reader
+  // compares that value with its own lane harness exactly as before.
+  '391fcc8198003c5c0b10a8491c0c5a35a72263250d2bf7de46d06e0cb749d23e': ['df98f5ddd847054e7324f4b06ef27b22b16a50afef938fca691880778c1db188'],
+  // VO-3795 only drops a card's session reading's time (`execution.observed_at`, `fresh_until`) from the snapshots it
+  // stores in supercode_publications, and reads a presence reading's currency in place of its time in a head's
+  // fingerprint. No table, column, document text or other JSON field moves. 391fcc81 reads a stored snapshot as any JSON
+  // card (`workflow events` yields it, its connector's publishableCard sends it on) and reads neither field; a head this
+  // writer compared carries a fingerprint 391fcc81 never matches, so it compares that card's snapshot once again.
+  '46a45d5c68b9ff7e8cb9638b8e381d849fcd5c5130aa75789b207fa293c36cca': ['391fcc8198003c5c0b10a8491c0c5a35a72263250d2bf7de46d06e0cb749d23e'],
+  // VO-3795 freshness correction: the fingerprint and snapshot share one clock reading. Stored tables, document
+  // bytes and snapshot fields are unchanged; the predecessor reads the same execution states and fingerprint text.
+  '677974041866e5d762207ad9a69c45004614c5b156f8b787e3d221b27de6dcbd': ['46a45d5c68b9ff7e8cb9638b8e381d849fcd5c5130aa75789b207fa293c36cca'],
+  // VO-3801 / ADR 0080: the no-refusals workflow keeps the existing layout, codec and document fields. Its optional
+  // raw review request fields and retained request/hold event payloads are ordinary task_events JSON, which the actual
+  // selected MacBook predecessor preserves and reads by named kind. Its hold/run readers preserve wait
+  // deadlines, stopped-session receipts and prior dispatch holds. Rollback retains queued requests; only the new
+  // dispatcher consumes them, so the claim promises readable retained state, never execution by an older dispatcher.
+  // The exact candidate/codec and predecessor require native handover and rollback readback before adoption.
+  'e3883cbe12612694af3f3aec332134a583aad26e527bf89ab209165cb6b4c429': ['677974041866e5d762207ad9a69c45004614c5b156f8b787e3d221b27de6dcbd'],
+  // VO-3810 only narrows Acceptance edit admission and names the guard that refused an event. Existing rows,
+  // layout, document bytes and codec stay unchanged; accepted edits still store the same body/title/id fields,
+  // and refusal reasons remain text in the existing event payload. The exact serving e3883cbe reader must
+  // preserve the candidate's retained state through native handover and rollback before live adoption.
+  '549c19dabb29be516af7ad3277eb24d20405ddcd27937c4a0e67e3df4b7b7cb8': ['e3883cbe12612694af3f3aec332134a583aad26e527bf89ab209165cb6b4c429'],
+  // #2741 makes an ended card use its existing done/archived stored_as value even when a hold remains.
+  // It changes no layout, codec, document field, event payload or status vocabulary. The exact serving
+  // 549c19da reader already reads those terminal values and retains the workflow stage and hold events;
+  // its older projection may reproduce the fixed display bug, but loses no state needed by either reader.
+  // This exact pair permits retained handover; it does not grant a later writer the same admission.
+  '3c3a7beb442f5d29d6b494c9244b551e2dceb881d19dc19ce54f512393ad9279': ['549c19dabb29be516af7ad3277eb24d20405ddcd27937c4a0e67e3df4b7b7cb8'],
+  // #2751 writes null as a replacement authorization's target.agent (task_runs metadata) when the session's agent
+  // ended here. No table, column, codec, document field or event kind moves, and the field was already null for a
+  // session with no agent. The exact serving 3c3a7beb reader reads that null and falls back to the prior session's
+  // agent (dispatch.mjs existingAgent), so a rollback may repeat the fixed revival but loses no stored state.
+  // This exact pair permits retained handover; it does not grant a later writer the same admission.
+  'efc27e5963c668603834be6b9d5d31b976802bc8b1c43b7a924d89db782db106': ['3c3a7beb442f5d29d6b494c9244b551e2dceb881d19dc19ce54f512393ad9279'],
+  // #2759 queues a closed card's worktree retirement as a `retire_workspace` row in supercode_effects (workflow.mjs
+  // queueCleanup, one row per card; `scratch: true` where a workflow declares cleanup_workspace), and records worktree_kept / worktree_removed task_events and a board comment. No table, column,
+  // codec or document field moves. The exact serving efc27e59 reader (d818a7d607) knows only `cleanup_workspace`, which
+  // it answers with `git worktree remove --force` (engine.mjs:892 -> 487); a `retire_workspace` row reaches its
+  // runEffect's closing `return true` (engine.mjs:905) and is deleted unread (engine.mjs:865), so a rollback leaves the
+  // worktree. It reads task_events by named kinds (an unnamed last kind publishes as task.changed, published.mjs:354),
+  // writes the same board comment itself (engine.mjs:1413), and its gc drops the two new kinds past retention
+  // (engine.mjs:1664), after which this release's gc no longer rereads that closed card's kept worktree.
+  // This exact pair permits retained handover; it does not grant a later writer the same admission.
+  '7ca68e5be53314541223fbc0d04160e1b1f55ab033bb84581de827d63e63ab8d': ['efc27e5963c668603834be6b9d5d31b976802bc8b1c43b7a924d89db782db106'],
+  // Current-run caller ownership changes only a SELECT. Layout, codec, document bytes and stored JSON are
+  // unchanged; the 7ca68e5b reader preserves every stored value, including the ended runs excluded by this query.
+  '572c21b048d39451954181c5fa808beacac2cb70d09b836881fd1a55b0b04902': ['7ca68e5be53314541223fbc0d04160e1b1f55ab033bb84581de827d63e63ab8d'],
+  // First-reader retry checks and lazy scope reads preserve existing board/run/document values and codec.
+  // The actual serving b1f328ed reader retains them; ADR0080 still requires exact native rollback qualification.
+  '1fe57063f9d050c5a0935c0fc160416b5d7cf7e96430952e7ce6fc15bf00a4fc': ['b1f328ed24cd2bceaf881b2928b0ba10d243caddf546d6d50c5e52d413a126fc'],
+  // Indexed hold reads and demand-selected notice gates preserve layout, codec, document values and retained JSON.
+  // The serving b588e9c0 reader preserves those values; exact native rollback qualification remains required.
+  '07748d0b8f684fad5bd774f7c792b6a98ece77d4b6a1c9a125e2a2d452507946': ['b588e9c0a6175bd250ded6d469b7f4f278c159ea8787599f40d30b622e496088'],
+  // One reviewer per arc (ADR 0003 c84, ADR 0019): every run is its card's current run, on its card's machine. The
+  // layout drops two indexes and adds none; codec and document bytes are unchanged. Its new task_events kinds
+  // (review_queue_waiting, first_input_refiled), a run's owed brief (brief_owed) and a `closed` or `refused` queue settlement are
+  // ordinary JSON the serving 0d5b21c8
+  // reader (4d2208fe) reads by named kinds and counts as settled, and its one-at-a-time runs are a subset of the
+  // executions that reader reads, so rollback needs no bridge. Its worker subscriptions name no execution owner; that
+  // reader's subscription repair rebinds them on its first round. Exact native handover and rollback readback remain
+  // required before adoption.
+  'f4c5fc89e326027b2e876a04cf665184023e186247e1c8670c28740f25131a58': ['0d5b21c8f5a22795053a2d0754f8eadbbd432b1a0422f110bd6064ede1f4cb68'],
+  // ADR 0262 adds JSON-safe allocation indexes; no table, column, codec or document bytes change. Reviewer
+  // cwd/allocation fields are optional run metadata JSON; retirement paths and stage_entered are event payloads.
+  // The serving 1429cad5 reader preserves this JSON and reads events by named kind. Rollback can reproduce
+  // its prior workspace behavior without losing retained state. This claim admits only this exact writer.
+  '7b49bef1dfedbdefb4b235451ee95153f0b7482fbfaca2277354e0f4f4bdadf5': ['f4c5fc89e326027b2e876a04cf665184023e186247e1c8670c28740f25131a58'],
 };
 
-export function storageContract() {
+export function storageContract({ restingAdmission = 'unknown' } = {}) {
   const storage = createHash('sha256');
   for (const file of MODULES) storage.update(file).update(readFileSync(new URL(file, import.meta.url)));
   let formatDigest = null;
   try { formatDigest = format(); } catch (error) { process.stderr.write(`board storage contract: no format digest (${error.message}); the owner compares storage\n`); }
-  return { storage: storage.digest('hex'), format: formatDigest, readableBy: (formatDigest && READABLE_BY[formatDigest]) || [] };
+  const qualified = restingAdmission === 'legacy-reader' ? LEGACY_READABLE_BY : restingAdmission === 'compatible-reader' ? READABLE_BY : {};
+  return { storage: storage.digest('hex'), format: formatDigest, readableBy: (formatDigest && qualified[formatDigest]) || [] };
 }

package/board/store.mjs

@@ -20,9 +20,11 @@ import { hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { openZtrackBoard } from './ztrack.mjs';
-import { byOwner, LIST_CONNECTION, TASK_SUMMARY_INDEX, TASK_SUMMARY_INDEX_SQL } from './listing.mjs';
+import { byOwner, LIST_CONNECTION, readBoundary, TASK_SUMMARY_INDEX, TASK_SUMMARY_INDEX_SQL } from './listing.mjs';
+import { trackCurrentRecords } from './current-records.mjs';
 import { isFilesBoard, openFilesBoard } from './files.mjs';
 import { signalBoardWrite } from './wake.mjs';
+import { NEW_HOLD_SQL, PAUSE_DEADLINE } from './resting-state.mjs';
 import { PUBLICATION_COLUMNS, PUBLICATION_SCHEMA, incrementalStore, pruneDue, prunePublications, publicationTriggers, reclaimDue, reclaimSlice, recordCardPublications, trimDue, trimPublications } from './published.mjs';
 
 import { fillReadableIds } from './readable-id.mjs';
@@ -94,7 +96,7 @@ CREATE TABLE IF NOT EXISTS supercode_session_operations (
 // An effect's attempts: how many were made, when the next may be, and, once its attempts are spent, when it failed and
 // why (engine.mjs runEffects). A failed effect is kept as the record of its terminal state and never tried again.
 const EFFECT_COLUMNS = { attempts: 'INTEGER NOT NULL DEFAULT 0', next_at: 'INTEGER NOT NULL DEFAULT 0', failed_at: 'INTEGER', last_error: 'TEXT' };
-const OURS_COLUMNS = { workspace_anchor: 'TEXT', workspace_root: 'TEXT', subtask_of: 'TEXT', stage: 'TEXT', since: 'INTEGER', after_fired: 'TEXT', blocked_by: 'TEXT', paused: 'TEXT', detached: 'TEXT', archived: 'INTEGER DEFAULT 0', every: 'TEXT', next_run_at: 'INTEGER', tags: 'TEXT', requested_by_unverified: 'TEXT' };
+const OURS_COLUMNS = { workspace_anchor: 'TEXT', workspace_root: 'TEXT', subtask_of: 'TEXT', stage: 'TEXT', since: 'INTEGER', after_fired: 'TEXT', blocked_by: 'TEXT', paused: 'TEXT', backlog: 'TEXT', detached: 'TEXT', archived: 'INTEGER DEFAULT 0', every: 'TEXT', next_run_at: 'INTEGER', tags: 'TEXT', requested_by_unverified: 'TEXT' };
 
 // ------------------------------------------------------------------ backings
 //
@@ -233,13 +235,13 @@ const NOTICE_ADDRESS = `CASE WHEN json_valid(metadata,6) THEN ${RUN_ADDRESS} END
 export const NOTICE_RUN_IDS = `SELECT id FROM task_runs WHERE ${NOTICE_SESSION}=? UNION SELECT id FROM task_runs WHERE ${NOTICE_ADDRESS}=?`;
 const RUN_LAUNCH_PENDING = "json_extract(metadata, '$.supercode.launch_pending')";
 export const CALLER_RUN_ADDRESS = `SELECT ${RUN_ADDRESS} AS address FROM task_runs WHERE ${RUN_SESSION} = ? ORDER BY id DESC LIMIT 1`;
-// Launch/adoption commits the native address and its immutable role-agent together.
-// Pending/unissued launches are not an ownership receipt. Read only that identity,
-// never the current assignee, a profile hint, or mutable manager/admission state.
+// The current launch/adoption commits the native address and its immutable role-agent together.
+// Ended/superseded runs and pending/unissued launches cannot establish the caller's current ownership.
 export const CALLER_RUN_AGENT = `SELECT DISTINCT
   json_extract(metadata, '$.supercode.agent_id') AS agent_id,
   json_extract(metadata, '$.supercode.agent_org') AS org
-  FROM task_runs WHERE ${RUN_SESSION} = ? AND ${RUN_ADDRESS} = ?
+  FROM task_runs r JOIN tasks t ON t.id = r.task_id AND t.current_run_id = r.id
+  WHERE r.ended_at IS NULL AND ${RUN_SESSION} = ? AND ${RUN_ADDRESS} = ?
   AND COALESCE(${RUN_LAUNCH_PENDING}, 0) = 0
   AND COALESCE(json_extract(metadata, '$.supercode.launch_deferred'), 0) = 0
   AND json_extract(metadata, '$.supercode.mode') IN ('fresh', 'resume', 'adopt')
@@ -247,6 +249,17 @@ export const CALLER_RUN_AGENT = `SELECT DISTINCT
   AND json_extract(metadata, '$.supercode.agent_org') IS NOT NULL`;
 const RUN_SESSION_INDEX = 'idx_runs_supercode_session';
 const RUN_LAUNCH_PENDING_INDEX = 'idx_runs_supercode_launch_pending';
+// Strict JSON matches the JS metadata reader, including on old stores containing malformed text.
+export const runField = (name) => `json_extract(CASE WHEN json_valid(metadata) THEN metadata END, '$.supercode.${name}')`;
+export const RUN_SLOT = `COALESCE(${runField('slot')},'worker')`;
+export const REVIEW_ALLOCATION_PATH = runField('review_workspace.path');
+export const REVIEW_ALLOCATION_MACHINE = runField('review_workspace.machine');
+export const REVIEW_ALLOCATION_KEY = `CASE WHEN ${REVIEW_ALLOCATION_PATH} IS NOT NULL THEN json_array(${REVIEW_ALLOCATION_PATH},${REVIEW_ALLOCATION_MACHINE},${RUN_SLOT}) END`;
+export const RUN_AGENT_REF = `COALESCE(${runField('address')},CASE WHEN ${runField('session_id')} IS NOT NULL AND ${runField('session_id')} NOT IN ('',0)
+  AND ${runField('machine')} IS NOT NULL AND ${runField('machine')} NOT IN ('',0) THEN 'sc:'||${runField('machine')}||':'||COALESCE(${runField('harness')},'claude-code')||':'||${runField('session_id')} END,'run:'||id)`;
+export const CLOSE_OPEN_RUNS = `${runField('close_confirmed_at')} IS NULL AND ${runField('close_transferred_to')} IS NULL
+  AND (ended_at IS NOT NULL OR ${runField('close_requested')} IS NOT NULL)
+  AND (${runField('pane')} IS NOT NULL OR ${runField('surface')}='native' OR (${runField('surface')}='headless' AND ${runField('pid')} IS NOT NULL) OR (${runField('launch_key')} IS NOT NULL AND ${runField('launch_pending')}=1))`;
 // The indexes on a run's metadata. The second holds only the runs whose launch is pending (7 of 1,387 on the store
 // these were measured for), in the runs' own order.
 const RUN_INDEXES = [
@@ -256,6 +269,14 @@ const RUN_INDEXES = [
   ['idx_runs_notice_address', `(${NOTICE_ADDRESS}, id)`],
   ['idx_runs_open_machine_session', `(json_extract(metadata, '$.supercode.machine'), ${RUN_SESSION}, id) WHERE ended_at IS NULL`],
   ['idx_runs_open_machine_pane', `(json_extract(metadata, '$.supercode.machine'), json_extract(metadata, '$.supercode.pane'), id) WHERE ended_at IS NULL`],
+  ['idx_runs_close_open', `(id) WHERE ${CLOSE_OPEN_RUNS}`],
+  ['idx_runs_latest_slot', `(task_id,${RUN_SLOT},id DESC) WHERE ${runField('session_id')} IS NOT NULL AND ${runField('session_id')} NOT IN ('',0)`],
+  ['idx_runs_agent_current', `(${RUN_AGENT_REF},id DESC) WHERE ${runField('agent_id')} IS NOT NULL`],
+  ['idx_runs_task_agent_ref', `(task_id,${RUN_AGENT_REF},id) WHERE ${runField('agent_id')} IS NOT NULL`],
+  ['idx_runs_transfer_session', `(task_id,${runField('machine')},${runField('session_id')},id)`],
+  ['idx_runs_transfer_pane', `(task_id,${runField('machine')},${runField('pane')},id)`],
+  ['idx_runs_review_allocations', `(task_id,${REVIEW_ALLOCATION_KEY},id DESC) WHERE ${REVIEW_ALLOCATION_KEY} IS NOT NULL`],
+  ['idx_runs_review_owners', `(${REVIEW_ALLOCATION_PATH},${REVIEW_ALLOCATION_MACHINE},task_id) WHERE ${REVIEW_ALLOCATION_PATH} IS NOT NULL`],
 ];
 
 // What every verb a session runs asks about its caller (cli.mjs ownCards, dispatch.mjs reconcileCallerLaunch). Each
@@ -430,6 +451,8 @@ export function layOut(db, { fresh }) {
     addColumns(db, table, added);
   }
   addColumns(db, 'supercode_cards', OURS_COLUMNS);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_cards_pause_deadline ON supercode_cards(${PAUSE_DEADLINE},task_id) WHERE paused IS NOT NULL`);
+  db.exec(`CREATE INDEX IF NOT EXISTS idx_cards_modern_holds ON supercode_cards(task_id) WHERE ${NEW_HOLD_SQL}`);
   db.exec('CREATE INDEX IF NOT EXISTS supercode_readable_ids ON tasks(readable_id)');
   fillReadableIds(db);
   db.exec("CREATE UNIQUE INDEX IF NOT EXISTS supercode_open_readable_ids ON tasks(readable_id) WHERE status NOT IN ('done','cancelled','archived')");
@@ -439,9 +462,15 @@ export function layOut(db, { fresh }) {
   db.exec('CREATE INDEX IF NOT EXISTS idx_supercode_cards_subtask_of ON supercode_cards(subtask_of)');
   // Current-run joins and unended-run reconciliation must never search all cards/runs for each historical run.
   db.exec('CREATE INDEX IF NOT EXISTS idx_tasks_current_run ON tasks(current_run_id) WHERE current_run_id IS NOT NULL');
+  db.exec("CREATE INDEX IF NOT EXISTS idx_cards_start_candidates ON supercode_cards(task_id) WHERE subtask_of IS NULL AND stage NOT IN ('done','cancelled')");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_start_fallback ON tasks(id) WHERE current_run_id IS NULL AND status NOT IN ('archived','done','cancelled')");
   db.exec('CREATE INDEX IF NOT EXISTS idx_runs_unended ON task_runs(id) WHERE ended_at IS NULL');
   // Ordinary comments vastly outnumber explicit source declarations. Keep their JSON discriminator in a small index.
   db.exec("CREATE INDEX IF NOT EXISTS idx_events_arc_sources ON task_events(task_id,id) WHERE kind='commented' AND json_valid(payload) AND json_type(payload,'$.branches')='array'");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_events_board_messages ON task_events(id) WHERE kind='board_message'");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_events_board_message_batches ON task_events(id) WHERE kind='board_message_batch'");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_events_mail_changes ON task_events(id) WHERE kind IN ('board_message','board_message_sent','board_message_passed','board_message_batch')");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_events_mail_settled ON task_events(task_id,json_extract(CASE WHEN json_valid(payload) THEN payload END,'$.event')) WHERE kind IN ('board_message_sent','board_message_passed')");
   // Capacity pages need these columns without visiting task body/result overflow pages.
   db.exec('CREATE INDEX IF NOT EXISTS idx_tasks_capacity ON tasks(id,status,assignee,current_run_id,model_override)');
   layOutNumbers(db);
@@ -475,6 +504,7 @@ export function layOut(db, { fresh }) {
   addColumns(db, 'supercode_effects', EFFECT_COLUMNS);
   // what changed is marked by the store itself, whoever writes it (published.mjs)
   publicationTriggers(db);
+  trackCurrentRecords(db);
 }
 
 /**
@@ -550,7 +580,10 @@ export function heldConfigWatched(slug, source, watched) {
 export function openBoard(root, slug = DEFAULT_BOARD, options = {}) {
   // a listing on the owner's read door reads on a connection of its own, never the held board's (openReadOnly)
   if (current().readOnly) return openBoardSnapshot(root, slug);
-  if (holding !== null && !options.create && realRoot(root) === holding && !untrustedConfig.get(slug)?.size) {
+  // A card create is a write on this held store too. Opening a second files
+  // projection here would leave the response reading the old one until its watch
+  // fires, even though the new card has already committed on disk.
+  if (holding !== null && realRoot(root) === holding && !untrustedConfig.get(slug)?.size) {
     let entry = heldBoards.get(slug);
     if (!entry) {
       const began = performance.now();
@@ -573,7 +606,7 @@ function heldHandle(entry, slug) {
   const guard = () => { if (entry.retired) throw Object.assign(new Error(`board ${slug}'s configuration changed while this call held it; nothing was written (read it again)`), { code: 'board_retired' }); };
   const bound = (target, key) => { const value = target[key]; return typeof value === 'function' ? value.bind(target) : value; };
   const statement = (st) => new Proxy(st, { get: (target, key) => key === 'run' ? (...args) => { guard(); return target.run(...args); } : bound(target, key) });
-  const db = new Proxy(entry.board.db, { get: (target, key) => key === LIST_CONNECTION ? target : key === 'prepare' ? (sql) => statement(target.prepare(sql)) : key === 'exec' ? (sql) => { guard(); return target.exec(sql); } : bound(target, key) });
+  const db = new Proxy(entry.board.db, { get: (target, key) => key === LIST_CONNECTION ? (target[LIST_CONNECTION] ?? target) : key === 'prepare' ? (sql) => statement(target.prepare(sql)) : key === 'exec' ? (sql) => { guard(); return target.exec(sql); } : bound(target, key) });
   let closed = false;
   // a rebuild runs on the backing's own connection, outside its write wrapper (ztrack.mjs vacuum); a plain store's is its db
   const vacuum = (sql) => { guard(); return typeof entry.board.vacuum === 'function' ? entry.board.vacuum(sql) : entry.board.db.exec(sql); };
@@ -649,14 +682,43 @@ function openBoardNow(root, slug, { create = false, backing = null, document = n
  * Run `fn(db)` in one write transaction of the board's backing: answers what `fn` answers; rolls back on a throw.
  * A read inside the transaction is the state it writes over.
  */
+const totalChanges = db => db.prepare('SELECT total_changes() AS n').get().n;
+// A held SQLite board's `PRAGMA data_version` as this process last saw it, and whether another connection committed
+// before one of its own transactions: SQLite moves the value only for another connection's commit, never its own.
+const dataVersions = new Map(); // slug → { seen, external }
+const dataVersion = db => Number(db.prepare('PRAGMA data_version').get().data_version);
+function noteDataVersion(board, db) {
+  if (board.backing !== 'sqlite' || holding === null || !heldBoards.has(board.slug)) return;
+  const now = dataVersion(db), state = dataVersions.get(board.slug);
+  dataVersions.set(board.slug, { seen: now, external: Boolean(state?.external || (state && state.seen !== now)) });
+}
+/** Whether a watched change of held board `slug`'s store or document (`key`, `path`) is this process's own commit, by
+ *  what was written: no other connection committed since its own last transaction (data_version), or the document
+ *  holds the text the board published itself. Anything else, or anything unknown, is another writer's (ADR 0003 c40). */
+export function ownBoardWrite(root, slug, key, path) {
+  if (holding === null || realRoot(root) !== holding) return false;
+  const board = heldBoards.get(slug)?.board;
+  if (!board) return false;
+  if (key === 'board-storage') {
+    const state = dataVersions.get(slug);
+    if (board.backing !== 'sqlite' || !state) return false;
+    const now = dataVersion(board.db);
+    if (now === state.seen && !state.external) return true;
+    dataVersions.set(slug, { seen: now, external: false });
+    return false;
+  }
+  return key.startsWith('document:') ? Boolean(board.ownDocument?.(path)) : false;
+}
 export const tx = (board, fn) => {
   // Each transaction is a step named by the function that asked for it, so a round's slow-log line says which of its
   // steps make its transactions (about a hundred a round, at 150 ms each, on 2026-10-02).
   const caller = /at (?:async )?([\w.$<>]+) /.exec(String(new Error().stack).split('\n')[2] ?? '')?.[1] ?? 'unknown';
   const started = performance.now();
   try {
-    const result = board.tx(db => {const result=fn(db);fillReadableIds(db);dropTaskNumbers(db, board);const began=performance.now();try{recordCardPublications(db,actorOf(),board.root,board.key);}finally{noteStep('board tx publications',performance.now()-began);}return result;});
-    signalBoardWrite(board.root, actorOf());
+    // A transaction whose own work changed nothing signals nothing; the dispatcher's own work signals nothing (wake.mjs).
+    let changed = false;
+    const result = board.tx(db => {noteDataVersion(board, db);const before=totalChanges(db);const result=fn(db);changed=totalChanges(db)!==before;fillReadableIds(db);dropTaskNumbers(db, board);const began=performance.now();try{recordCardPublications(db,actorOf(),board.root,board.key);}finally{noteStep('board tx publications',performance.now()-began);}return result;});
+    if (changed) signalBoardWrite(board.root, actorOf(), { own: current().kind === 'own' });
     return result;
   } finally { noteStep(`board tx from ${caller}`, performance.now() - started); }
 };
@@ -718,7 +780,7 @@ export function retryContention(fn) {
 }
 // A read that meets another process's write is retried as a write is (sqliteTx): a dispatcher service and a CLI share
 // the board, and a lost read must not become a launch failure. Inside a transaction its retry is the transaction's.
-export const view = (board, fn) => inTx.has(board.db) ? fn(board.db) : retryContention(() => fn(board.db));
+export const view = (board, fn) => readBoundary(board.db, () => inTx.has(board.db) ? fn(board.db) : retryContention(() => fn(board.db)));
 
 // A deferred native transaction, with the whole operation retried on an optimistic conflict.
 // There is no separate application writer lock or contention timeout. A write inside one is part of it.

package/board/tools.mjs

@@ -10,6 +10,7 @@ import * as engine from './engine.mjs';
 import { assertSourceReceipt } from './ci.mjs';
 import { completionOwnerOf, isLatestReviewer, loadWorkflow } from './workflow.mjs';
 import { attachmentRecord, readAttachment } from './attachment-read.mjs';
+import { current, requestReceiptEnvelope } from './call.mjs';
 
 const ok = (fields = {}) => JSON.stringify({ ok: true, ...fields });
 const error = (message) => JSON.stringify({ error: message });
@@ -28,15 +29,44 @@ export function redact(value) {
 }
 
 const LIFECYCLE = new Set(['kanban_complete', 'kanban_block', 'kanban_request_state', 'kanban_request_review', 'kanban_request_changes', 'kanban_heartbeat', 'kanban_attach', 'kanban_attach_url', 'kanban_unblock']);
-const ORCHESTRATOR_ONLY = new Set(['kanban_list', 'kanban_unblock']);
 
 /** One board tool call. `root` is the home; `env` the worker's task environment (`HERMES_KANBAN_*`). */
 export async function boardTool(root, name, args = {}, env = {}) {
+  const firstRequest = current().routedRequests?.length ?? 0;
+  const firstAccepted = current().acceptedRequests?.length ?? 0;
+  const firstQueued = current().queuedRequests?.length ?? 0;
+  const firstUnqueued = current().unqueuedReviews?.length ?? 0;
+  const answer = await boardToolBody(root, name, args, env);
+  const result = JSON.parse(answer);
+  if (result.error) {
+    // Tool scoping routes reserved acts; missing detail is recorded locally as
+    // CLI admission does. A stale worker never acquires a current worker's role.
+    try {
+      await loadWorkflow(root);
+      const board = openBoard(root, args.board || env.HERMES_KANBAN_BOARD || DEFAULT_BOARD);
+      try {
+        const run = env.HERMES_KANBAN_RUN_ID && json(board.db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(Number(env.HERMES_KANBAN_RUN_ID))?.metadata, {})?.supercode;
+        setActor(run?.address ?? actorOf() ?? `worker:${env.HERMES_PROFILE || 'unknown'}`);
+        const target = args.task_id || args.task_ids?.[0] || env.HERMES_KANBAN_TASK;
+        const id = target && engine.getTask(board.db, target) ? target : null;
+        const ownerRule = result.ownerRule || /orchestrator's|scoped to task|no longer its current run|only .*manager|person.*completion/i.test(result.error);
+        await (ownerRule ? engine.routeRequest : engine.acceptRequest)(board, { id, name, payload: args, reason: result.error });
+      } finally { board.close(); }
+    } catch (e) { return error(`${result.error}; board request could not be retained: ${e.message}`); }
+  }
+  const requests = current().routedRequests?.splice(firstRequest) ?? [];
+  const accepted = current().acceptedRequests?.splice(firstAccepted) ?? [];
+  const queued = current().queuedRequests?.splice(firstQueued) ?? [];
+  const unqueued = current().unqueuedReviews?.splice(firstUnqueued) ?? [];
+  const receipts = requestReceiptEnvelope({ requests, accepted, queued, unqueued });
+  return receipts ? JSON.stringify(receipts) : answer;
+}
+
+async function boardToolBody(root, name, args = {}, env = {}) {
   try { assertSourceReceipt(args); } catch (e) { return error(e.message); }
   const own = env.HERMES_KANBAN_TASK || null;
   const runId = env.HERMES_KANBAN_RUN_ID ? Number(env.HERMES_KANBAN_RUN_ID) : null;
   const author = env.HERMES_PROFILE || 'worker';
-  if (own && ORCHESTRATOR_ONLY.has(name)) return error(`${name} is the orchestrator's; read kanban_show for your task's declared doors, or use kanban_request_state, kanban_heartbeat or kanban_comment`);
   if (args.task_ids !== undefined && (!Array.isArray(args.task_ids) || !args.task_ids.length || args.task_ids.some(id => typeof id !== 'string' || !id.trim()))) return error('task_ids is a nonempty array of card ids.');
   const tid = args.task_id || args.task_ids?.[0] || own;
   if (!['kanban_list', 'kanban_create', 'kanban_link'].includes(name) && !tid) return error('task_id is required (or HERMES_KANBAN_TASK in the environment)');
@@ -72,7 +102,17 @@ export async function boardTool(root, name, args = {}, env = {}) {
   const ownRun = () => {
     if (!own) return null;
     const t = engine.getTask(board.db, own);
-    const r = runId && board.db.prepare('SELECT task_id, ended_at FROM task_runs WHERE id=?').get(runId);
+    const r = runId && board.db.prepare('SELECT task_id, ended_at, profile FROM task_runs WHERE id=?').get(runId);
+    // Blocking ends a run and a PR review retains its coder's conversation.
+    // The most recent worker can still lift its own blocker or queue its next PR;
+    // this never grants a superseded worker the current reviewer's run.
+    if (r?.task_id === own && r.ended_at != null && ['kanban_unblock', 'kanban_request_review'].includes(name)) {
+      const latest = board.db.prepare("SELECT id FROM task_runs WHERE task_id=? AND COALESCE(json_extract(metadata,'$.supercode.slot'),'worker')='worker' ORDER BY id DESC LIMIT 1").get(own);
+      if (latest?.id === runId && name === 'kanban_unblock' && t?.current_run_id == null) return null;
+      const review = name === 'kanban_request_review' && t?.stage === 'review'
+        ? json(board.db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='review_requested' ORDER BY id DESC LIMIT 1").get(own)?.payload, {}) : null;
+      if (latest?.id === runId && review?.implementer === r.profile) return null;
+    }
     return !r || r.task_id !== own || r.ended_at != null || Number(t?.current_run_id) !== runId
       ? `run ${runId ?? '(missing)'} of ${own} is no longer its current run; nothing was changed` : null;
   };
@@ -80,14 +120,17 @@ export async function boardTool(root, name, args = {}, env = {}) {
     if (name !== 'kanban_show' && name !== 'kanban_list' && !(name === 'kanban_comment' && isLatestReviewer(board.db, tid, actorOf()))) { const stale = ownRun(); if (stale) return error(stale); }
     switch (name) {
       case 'kanban_show': {
-        const card = tx(board, (db) => { const c = engine.showCard(db, tid, stateOptions); c.context = engine.cardContext(db, tid, stateOptions); return c; });
+        const card = tx(board, (db) => {
+          const review = own === tid && engine.reviewsCard(db, tid, { runId });
+          const c = engine.showCard(db, tid, { ...stateOptions, review }); c.context = engine.cardContext(db, tid, { ...stateOptions, review }); return c;
+        });
         const t = card.task;
         return JSON.stringify({
           task: { id: t.id, readable_id: t.readable_id, title: t.title, body: t.body, assignee: t.assignee, status: t.status, tenant: t.tenant, priority: t.priority, workspace_kind: t.workspace_kind,
             workspace_path: t.workspace_path, created_by: t.created_by, created_at: t.created_at, started_at: t.started_at, completed_at: t.completed_at, result: t.result,
             current_run_id: t.current_run_id, model_override: t.model_override, provider_override: t.provider_override },
           parents: card.parents.map((p) => p.id), children: card.children, subtasks: card.subtasks,
-          comments: card.comments, events: card.events.slice(-50), runs: card.runs.map((r) => ({ id: r.id, profile: r.profile, status: r.status, outcome: r.outcome, summary: r.summary, error: r.error, metadata: r.metadata, started_at: r.started_at, ended_at: r.ended_at })),
+          ...(card.review_request ? { review_request: card.review_request } : {}), pr_evidence: card.pr_evidence, comments: card.comments, events: card.events.slice(-50), runs: card.runs.map((r) => ({ id: r.id, profile: r.profile, status: r.status, outcome: r.outcome, summary: r.summary, error: r.error, metadata: r.metadata, started_at: r.started_at, ended_at: r.ended_at })),
           worker_context: card.context,
         });
       }
@@ -102,9 +145,8 @@ export async function boardTool(root, name, args = {}, env = {}) {
         const stale = ownRun(); if (stale) return error(stale);
         const summary = args.summary ? redact(String(args.summary)) : null;
         const result = args.result ? redact(String(args.result)) : null;
-        if (!summary && !result) return error('provide at least one of: summary (preferred), result');
         let metadata = args.metadata === undefined || args.metadata === null ? null : redact(args.metadata);
-        if (metadata !== null && (typeof metadata !== 'object' || Array.isArray(metadata))) return error('metadata must be an object');
+        if (metadata !== null && (typeof metadata !== 'object' || Array.isArray(metadata))) metadata = null;
         const artifacts = [args.artifacts].flat().filter((a) => typeof a === 'string' && a.trim()).map((a) => a.trim());
         if (artifacts.length) metadata = { ...(metadata ?? {}), artifacts: [...new Set([...(metadata?.artifacts ?? []), ...artifacts])] };
         // cards the handoff says it created must exist (Hermes refuses a handoff naming cards nobody made)
@@ -132,7 +174,7 @@ export async function boardTool(root, name, args = {}, env = {}) {
       }
       case 'kanban_request_review': {
         const stale = ownRun(); if (stale) return error(stale);
-        await engine.requestReview(board, tid, { summary: args.summary ? redact(String(args.summary)) : null, metadata: args.metadata ? redact(args.metadata) : null, commit: args.commit ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args.pr_head ?? args.commit ?? null, plan: args.plan === true, reviewer: args.reviewer ?? null, expectedRunId: own === tid && runId ? runId : null });
+        await engine.requestReview(board, tid, { summary: args.summary ? redact(String(args.summary)) : null, metadata: args.metadata ? redact(args.metadata) : null, commit: args.commit ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args.pr_head ?? args.commit ?? null, plan: args.plan === true, reviewer: args.reviewer ?? null, supersedes: args.supersedes ?? null, expectedRunId: own === tid && runId ? runId : null });
         return ok({ task_id: tid, status: 'review' });
       }
       case 'kanban_request_changes': {
@@ -145,12 +187,12 @@ export async function boardTool(root, name, args = {}, env = {}) {
       }
       case 'kanban_heartbeat': {
         const stale = ownRun(); if (stale) return error(stale);
-        await engine.heartbeat(board, tid, args.note ?? null);
-        return ok({ task_id: tid });
+        await engine.heartbeat(board, tid, args.note ?? null, { until: args.until ?? null });
+        return ok({ task_id: tid, ...(args.until != null ? { until: args.until } : {}) });
       }
       case 'kanban_comment': {
         if (!String(args.body ?? '').trim()) return error('body is required');
-        const n = await engine.comment(board, tid, isLatestReviewer(board.db, tid, actorOf()) ? actorOf() : author, redact(String(args.body)));
+        const n = await engine.comment(board, tid, isLatestReviewer(board.db, tid, actorOf()) ? actorOf() : author, redact(String(args.body)), { pr: args.pr ?? null, pr_head: args.pr_head ?? null, source: args.source ?? null, disposition: args.pr_disposition ?? null, release_target: args.release_target ?? null, readback: args.release_readback ?? null, reason: args.reason ?? null });
         return ok({ task_id: tid, comment_id: n });
       }
       case 'kanban_attach': case 'kanban_attach_url': {
@@ -194,7 +236,7 @@ export async function boardTool(root, name, args = {}, env = {}) {
         return ok({ task_id: made.id, existing: made.existing, status: tx(board, (db) => engine.getTask(db, made.id)).status });
       }
       case 'kanban_unblock':
-        return ok({ task_id: tid, status: (await engine.unblock(board, tid)).to });
+        return ok({ task_id: tid, status: (await engine.unblock(board, tid, { on: args.on ?? null, reason: args.reason ?? null })).to });
       case 'kanban_link':
         if (!args.parent_id || !args.child_id) return error('parent_id and child_id are required');
         await engine.link(board, args.parent_id, args.child_id);
@@ -203,7 +245,8 @@ export async function boardTool(root, name, args = {}, env = {}) {
         return error(`no board tool ${name}`);
     }
   } catch (e) {
-    return error(`${name}: ${e.message}`);
+    if (e.errcode != null || /^(?:E[A-Z_]+|ERR_)/.test(e.code ?? '') || e instanceof TypeError || e instanceof ReferenceError) throw e;
+    return JSON.stringify({ error: `${name}: ${e.message}`, ...(e.ownerRule ? { ownerRule: true } : {}) });
   } finally {
     board.close();
   }

package/board/wake.mjs

@@ -5,8 +5,13 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
-export function signalBoardWrite(root, actor) {
-  if (!root || actor?.includes(':board:')) return;
+// The homes this process dispatches (watchBoard). Its own work there (a round, a delivery pass) is the dispatcher's
+// bookkeeping and wakes nothing, whatever actor its transaction records (ADR 0003, c40).
+const dispatching = new Set();
+
+/** Hint the home's dispatcher that a committed transaction changed its board. `own`: the process's own work. */
+export function signalBoardWrite(root, actor, { own = false } = {}) {
+  if (!root || (own && dispatching.has(resolve(root)))) return;
   const path = join(root, '.dispatch-wake.json');
   const temporary = `${path}.${randomUUID()}.tmp`;
   try {
@@ -15,8 +20,13 @@ export function signalBoardWrite(root, actor) {
   } catch { try { unlinkSync(temporary); } catch { /* hints cannot fail a committed verb */ } }
 }
 
-/** One coalescing queue shared by standalone serve and the hosted dispatcher. */
-export function watchBoard({ root, binary, env, log = () => {}, onEvent = () => {}, mailWaiter = null }) {
+/** One coalescing queue shared by standalone serve and the hosted dispatcher. `ownWrite(key, board, path)` says whether a
+ *  store or document change is this dispatcher's own commit, by what was written (store.mjs ownBoardWrite): such a
+ *  change still reaches the observer, so a held board reads it again, and only its wake is passed over (ADR 0003, c40). */
+export function watchBoard({ root, binary, env, log = () => {}, onEvent = () => {}, mailWaiter = null, ownWrite = () => false }) {
+  const home = resolve(root);
+  dispatching.add(home);
+  const source = key => key === 'board-storage' || key.startsWith('document:');
   const watchers = new Map();
   let pending = null, waiter = null, closed = false;
   const wake = (source, at = Date.now(), info = {}) => {
@@ -45,7 +55,9 @@ export function watchBoard({ root, binary, env, log = () => {}, onEvent = () =>
     try {
       const handle = watch(path, (_event, filename) => {
         if (filename == null) { tell(key, { uncertain: true, board }); wake(key, undefined, { board }); return; }
-        if (accept(String(filename))) wake(key, undefined, { board });
+        if (!accept(String(filename))) return;
+        if (source(key) && ownWrite(key, board, join(path, String(filename)))) { tell(key, { board }); return; }
+        wake(key, undefined, { board });
       });
       handle.on('error', error => {
         handle.close(); watchers.delete(id); unwatched.add(id);
@@ -130,6 +142,7 @@ export function watchBoard({ root, binary, env, log = () => {}, onEvent = () =>
     },
     close() {
       closed = true; waiter?.();
+      dispatching.delete(home);
       for (const handle of watchers.values()) handle.close();
       watchers.clear();
     },