@volter/supercode-orchestrator 0.5.227 → 0.5.229

package/board/cli.mjs

@@ -1,3 +1,8 @@
+import { registerWorkService, closeWorkLedger } from '@volter/supercode-harness-sdk/work-ledger';
+import { registerWorkOperations, measureWork } from "@volter/supercode-harness-sdk/work-ledger";
+registerWorkOperations([{"kind":"door","operation":"board.command"}]);
+import { measureSyncChild } from '@volter/supercode-harness-sdk/work-ledger';
+const spawnSync = (...args) => measureSyncChild(() => workLedgerNativeSpawnSync(...args));
 // `supercode workflow <verb>` (docs/architecture/orchestrator.md §2.9): supercode's own board, in Hermes Kanban's
 // format, and its dispatcher. Every verb of `hermes kanban` is here under its own name, with its own flags and its own
 // output lines, so a caller of Hermes's CLI calls this one unchanged; supercode's own verbs (`set`, `adopt`, `detach`, `close`,
@@ -7,11 +12,12 @@
 import { machineCall, closeDoors, onLocalReopen } from './doors.mjs';
 import { createHash } from 'node:crypto';
 import { DatabaseSync } from 'node:sqlite';
-import { homeOf, parse } from './args.mjs';
+import { assertWorkflowVerb, homeOf, parse } from './args.mjs';
 import { BOARD_OPERATION_VERBS, boardHome, boardOwnerSocket, CALLER_FACTS } from '@volter/teams/board-owner';
-import { current, isCallersCall, ownCall, within } from './call.mjs';
+import { current, isCallersCall, ownCall, refuseUnreadManager, requestReceiptEnvelope, within } from './call.mjs';
 import { cardState, holdDescription } from './card-state.mjs';
-import { detachSession } from './custody.mjs';
+import { breakGlassLog, breakGlassReason, guardRefusal, recordBreakGlass } from '@volter/teams/break-glass';
+import { detachSession, sessionOperation } from './custody.mjs';
 import { reclaimSpace, taskStatusOf, trimDue, trimPublications } from './published.mjs';
 import { executionOf, readingContext } from './session-work.mjs';
 import { attachmentRecord, readAttachment } from './attachment-read.mjs';
@@ -22,46 +28,45 @@ import { openOwnerDoor } from './owner-door.mjs';
 import { inBoardGeneration, generationWork, admitGeneration, grantGenerationWriter, parkGeneration, stopGeneration, tellOwner, admittedWork, GENERATION_STOPPED } from './generation.mjs';
 import { existsSync, mkdirSync, readdirSync, realpathSync, renameSync, rmSync, statSync, statfsSync, unlinkSync, copyFileSync, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
 import { notRuntime, ownHome } from './owner-files.mjs';
-import { execFile, spawnSync } from 'node:child_process';
-import { supercodeInvocation } from '@volter/supercode-harness-sdk/supercode-program';
+import { spawnSync as workLedgerNativeSpawnSync } from 'node:child_process';
 import { holdLock } from './lock-holder.mjs';
 import { takeEpoch } from './fence.mjs';
-import { dispatcherNotice, holdOwnerHealth, holdRound, holdSwitch, watchOwnerHealth } from './owner-health.mjs';
+import { dispatcherDiagnostics, holdOwnerHealth, holdRound, holdSwitch } from './owner-health.mjs';
 import { boardTool } from './tools.mjs';
 import { arcSources, assertSourceReceipt } from './ci.mjs';
-import { noteStep, recordSlow, takeSteps } from '@volter/supercode-harness-sdk/slow-log';
+import { noteStep, recordSlow, takeSteps, timed } from '@volter/supercode-harness-sdk/slow-log';
 // read by name, so an older harness SDK without them still loads: the owner then keeps no per-verb or loop lines
 import * as slowLog from '@volter/supercode-harness-sdk/slow-log';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir, tmpdir, userInfo } from 'node:os';
+import { prepareBoardRestingAdmission } from './resting-admission.mjs';
+import { resolveNativeSessionHome } from '@volter/supercode-interchange';
 import { storageContract } from './storage-contract.mjs';
-import { boardKey, cardRef, actorOf, CALLER_RUN_ADDRESS, CALLER_RUN_AGENT, SESSION_CURRENT_RUNS, SESSION_RUNS, sessionIndexed, heldConfigWatched, heldDocumentsChanged, heldDocumentsWatched, holdBoards, retireHeldBoards, releaseHeldBoards, publishMarked, view, backingPaths, layOut, backingOf, boardExists, boardCopyOf, boardPath, briefPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, setPrincipal, principalOf, isCaller, tx } from './store.mjs';
-import { isLocalWorkspace } from './workspace.mjs';
+import { boardKey, cardRef, actorOf, CALLER_RUN_ADDRESS, CALLER_RUN_AGENT, SESSION_CURRENT_RUNS, SESSION_RUNS, sessionIndexed, heldConfigWatched, heldDocumentsChanged, ownBoardWrite, heldDocumentsWatched, holdBoards, retireHeldBoards, releaseHeldBoards, publishMarked, view, backingPaths, layOut, backingOf, boardExists, boardCopyOf, boardPath, briefPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, setPrincipal, principalOf, isCaller, tx } from './store.mjs';
+import { cardWorktrees, isLocalWorkspace } from './workspace.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
 import { recordCardAgentChanges } from './agent-declarations.mjs';
 
-// A mailbox read through the mailbox's own command, awaited (never a wait that holds the event loop). Gap A31: a
-// helper process until the daemon owns mail (order 3 PR 4).
-const mailRead = (verb) => new Promise((resolve) => {
-  const env = commandEnv(), selected = supercodeInvocation(supercodeBin(), ['message', verb, '--json'], env);
-  execFile(selected.program, selected.arguments, { encoding: 'utf8', env, timeout: 15_000, maxBuffer: 64 * 1024 * 1024 }, (_, stdout) => resolve(stdout ?? ''));
-});
+// A mailbox read through this machine's daemon's mail door (in this process, over its held channel), as `supercode
+// message waiting|expired --json` reads it: its rows, or none when the daemon does not answer.
+const mailRows = async (verb) => {
+  try { const { rows } = await machineCall(null, `harness.v1.mail.${verb}`, {}, { timeoutMs: 15_000 }); return Array.isArray(rows) ? rows : []; }
+  catch { return []; }
+};
 
-/** The messages on this machine the mailbox still has to deliver (`supercode message waiting`), by message id. */
+/** The messages on this machine the mailbox still has to deliver (`harness.v1.mail.waiting`), by message id. */
 async function mailWaiting() {
-  const stdout = await mailRead('waiting');
-  try { return new Map((JSON.parse(stdout) ?? []).map((mail) => [mail.id, mail])); } catch { return new Map(); }
+  return new Map((await mailRows('waiting')).map((mail) => [mail.id, mail]));
 }
 
 /**
- * The messages on this machine whose delivery the mailbox gave up on (`supercode message expired`), by message id:
+ * The messages on this machine whose delivery the mailbox gave up on (`harness.v1.mail.expired`), by message id:
  * filed by the board, never delivered within the mailbox's bound, kept unread. Empty when the mailbox does not answer.
  */
 async function mailExpiries() {
-  const stdout = await mailRead('expired');
-  try { return new Map((JSON.parse(stdout) ?? []).map((expiry) => [expiry.id, expiry])); } catch { return new Map(); }
+  return new Map((await mailRows('expired')).map((expiry) => [expiry.id, expiry]));
 }
 
 /**
@@ -76,7 +81,7 @@ async function boardPublishing(root) {
   const board = listed?.boards?.find((b) => b.root === here);
   return board ? { ...board, refused: listed.refused ?? null } : null;
 }
-import { answerQuestion, dispatchingOf, knowLocalMachine, requestAdoption, alertManagers, boardAddress, boardLabel, boardSettings, boardCaller, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, closeEnded, lanesOf, localMachine, observeFleet, paused, plan, startCard, releaseClaims, stopDispatching, resumeDispatching, supercodeBin, tick, deliver, startDelivery } from './dispatch.mjs';
+import { answerQuestion, assertHeadlessBinding, dispatchingOf, knowLocalMachine, requestAdoption, alertManagers, boardAddress, boardLabel, boardSettings, boardCaller, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, closeEnded, lanesOf, localMachine, normalMachine, observeFleet, paused, plan, startCard, releaseClaims, stopDispatching, resumeDispatching, supercodeBin, tick, deliver, startDelivery } from './dispatch.mjs';
 import { watchBoard } from './wake.mjs';
 import { attachSideSession, releaseSideSession, sideArcs, sideSessions } from './side-sessions.mjs';
 import { onPanesChanged, onRecordsChanged, readFleetRecords, fleetRecordsCurrent } from './machine-fleet.mjs';
@@ -86,7 +91,7 @@ import { drainAgentCredentials, fileFleetNotice } from './dispatch.mjs';
 import { streamBoardPublications } from './event-stream.mjs';
 import { completionOwnerOf, followHome, isLatestReviewer, loadWorkflow, readHome, requestSessionClose, scopeOf, statusOf, timeOf, useWorkflow, workflowEntry, workflowFor, watchWorkflows } from './workflow.mjs';
 import { evaluate } from './expr.mjs';
-import { agentDoor,agentScope,activeAgentAssignments,reassignAgent,agentUsage,localAgentRecord,agentRunForSession } from '../agents.mjs';
+import { agentDoor,agentScope,activeAgentAssignments,cardRoleAssignment,reassignAgent,agentUsage,localAgentRecord,agentRunForSession } from '../agents.mjs';
 
 // Text a verb stores, read from --file/--body-file PATH (`-` for stdin) when given: a shell never expands what it
 // never sees, as it does `$(...)` and `$VAR` in an argument.
@@ -119,7 +124,7 @@ The board's verbs, with their flags:
   set <id> <assignee|machine|model|every|reviewer> <value|none> [--provider] [--ids ...]   assign <id> <profile|none>   set-model <id> [model] [--provider]   set-goal <id>... [--goal-max-turns N] [--off]
   reassign <id> --agent AGENT [--role implementer]   (moves a card role's assignment to another agent; sessions keep their identity)
   claim <id> [--ttl]   reclaim <id> [--reason]   heartbeat <id> [--note] [--until <time|30m>]   link|unlink <parent> <child>
-  comment <id> (<text> | --file PATH|-) [--author] [--max-len] [(--pr URL --pr-head SHA)... | --pr none] [--source owner/repo:branch... | --source none]   attach <id> <path> [--name] [--content-type]   attachments <id>   attach-rm <n>
+  comment <id> (<text> | --file PATH|-) [--author] [--max-len] [(--pr URL --pr-head SHA)... | --pr none] [--source owner/repo:branch... | --source none] [--pr-disposition merge|release-only [--release-target TARGET] --reason TEXT | --release-target TARGET --released-artifact SHA --release-evidence POINTER [--attest-release] --reason TEXT]   attach <id> <path> [--name] [--content-type]   attachments <id>   attach-rm <n>
   attachment-read <id> <attachment-id> [--offset N --length N --version V]   bounded base64/metadata JSON, including through --at
   complete <id>... [--result] [--summary] [--metadata JSON] [--commit SHA]   edit <id> --result [--summary] [--metadata]
   person-done <id> --person person:<principal> (--result <answer> | --result-file PATH|-) [--workplace-task <Task id>]
@@ -127,9 +132,11 @@ The board's verbs, with their flags:
          integration reports it from the home; the board checks it names the card's person. Never a session's verb.
   finish <id> --result TEXT   (when declared: end your completed attempt; the board selects review)
   block <id> [reason] (--on <card> | --waiting-on <message id>) [--ids ...]   schedule <id> [reason] [--ids ...]
-  pause <id> --reason <why>   resume <id>   cancel <id> --reason <why>
+  pause <id> --reason <why> --until <UTC time|2h>   resume <id>
+  backlog <id> --reason <why> [--pause-revision <generation|legacy event id>]   plan <id>
+  cancel <id> --reason <why>
   request-state <id> --state block|pause|done|cancelled --reason <why> [--on <card>|--waiting-on <message>] [--evidence <pointers>]
-  unblock <id>... --on <blocker> --reason <what arrived>   request-review <id> [--plan] --pr URL --pr-head SHA [--summary] [--reviewer] [--force] [--commit SHA]   request-changes <id> <reason> [--finding <finding>]...   reopen-review <id>... --reason <why> (voids the verdict, or restarts a review run that has none)   return-review <id> --reason <why> (manager: back to its coder, no verdict)   reopen <id>... [--reason]
+  unblock <id>... --on <blocker> --reason <what arrived>   request-review <id> [--plan] --pr URL --pr-head SHA [--supersedes QUEUED_EVENT] [--summary] [--reviewer] [--force] [--commit SHA]   request-changes <id> <reason> [--finding <finding>]...   reopen-review <id>... --reason <why> (voids the verdict, or restarts a review run that has none; returns it when the arc re-declared its sources since its request)   return-review <id> --reason <why> (manager: back to its coder, no verdict)   reopen <id>... [--reason]
   promote <id> [reason] [--ids ...] [--force] [--dry-run]   archive <id>... --reason <why> [--rm <id>...]
   specify <id> [--readable-id ID] [--title --body | --body-file PATH|-] [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch NAME] [--machine M|none] [--all]
   decompose <id> [--child "<title>[@<profile>]"]... [--all]  file the card's subtasks atomically, if its workflow allows
@@ -176,6 +183,7 @@ And:
   comment <id> TEXT (--pr URL --pr-head SHA)...: the card's implementer or the manager adds PRs (including merged ones) to the arc's discovered source set, in the arc's repositories (its workspace, its declared sources, its tasks'), each followed at its current head; each declaration adds to the earlier ones, on any run, and --pr none alone clears them. This records evidence; only the board starts its review.
   comment <arc> TEXT --source owner/repo:branch...: the arc's implementer or the manager declares every repository and branch the arc changes, on the arc itself; its review discovers PRs from them and accepts --pr declarations in them, with no task registered there. Each declaration adds to the earlier ones, and --source none alone clears them.
   request-review <id> --pr URL --pr-head SHA [--summary "<what the PR does>"]: hand one ready PR to its PR review at its pushed head, whatever other PRs the arc has; merge it at that head once the review passes. A request naming its PR is a PR review.
+  request-review <id> --supersedes QUEUED_EVENT --pr URL --pr-head SHA: explicitly replace that card's pending queued request after fresh admission; preserve its receipt and FIFO position, without changing the active review.
   request-review <id> --plan --pr URL --pr-head SHA: a big arc's plan review, of the proposed ADR's PR at its pushed head, before any code. The arc's final review (of every PR not merged at a PR-reviewed head, with its Acceptance) is the board's.
   request-state <id> --state done (--reviewed-sha SHA)...: record the verdict on every requested PR head.
   request-state <id>... --state STATE --reason REASON: request several decisions in one retained manager mail.
@@ -185,6 +193,11 @@ And:
   heartbeat and request review of its card, specify or decompose it in triage, and work its subtasks. A side session
   (adopt --side) works the arc's subtasks and comments on the arc; the arc's run and state stay its main session's. The home's
   workflow declares who may block, pause or finish a card; request-state mails its manager without changing state.
+  A card's session writes outside its own card (another card, a board verb, --all) only on purpose: with
+  --break-glass "<why it is needed>" it passes that guard (and the manager check adopt, release and detach repeat) and is
+  recorded in the machine's break-glass journal with the session, what it wrote and the reason, followed there by its
+  outcome when it was refused or failed; without one nothing is written and the board says why the write is guarded.
+  The workflow's own rules for who may make each transition still apply.
 `;
 
 
@@ -340,7 +353,23 @@ async function requester(args) {
 
 const tagsOf = (card) => { const tags = Array.isArray(card.tags) ? card.tags : json(card.tags, null); return Array.isArray(tags) ? tags : card.tenant ? [card.tenant] : []; };
 
-const say = (args, human, value) => { current().out(args.json ? `${JSON.stringify(value, null, 2)}\n` : `${human}\n`); };
+const say = (args, human, value) => {
+  const requests = current().routedRequests?.splice(0) ?? [];
+  const accepted = current().acceptedRequests?.splice(0) ?? [];
+  const queued = current().queuedRequests?.splice(0) ?? [];
+  const unqueued = current().unqueuedReviews?.splice(0) ?? [];
+  const receipts = requestReceiptEnvelope({ requests, accepted, queued, unqueued });
+  if (receipts) {
+    value = receipts;
+    human = [
+      ...requests.map(request => `Retained ${request.requested} for ${request.manager} (request ${request.message_id}).`),
+      ...queued.map(request => `${request.already ? 'Already queued' : 'Queued'} review of ${request.pr ?? request.requested ?? 'the PR'} after the current review.${request.pending ? ` Waiting: ${request.reason}` : ''}`),
+      ...accepted.map(request => `Recorded ${request.requested}${request.from ? `; card remains ${request.to}` : ''}: ${request.reason}`),
+      ...unqueued.map(request => request.reason),
+    ].join('\n');
+  }
+  current().out(args.json ? `${JSON.stringify(value, null, 2)}\n` : `${human}\n`);
+};
 
 // Hermes's own output lines, so a reader of `hermes kanban list` reads this one
 const ICONS = { todo: '◻', ready: '▶', running: '●', scheduled: '⏱', blocked: '⊘', paused: '⏸', done: '✓', archived: '—' };
@@ -351,7 +380,8 @@ const ts = (t) => {
   return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}`;
 };
 // a card's status is the workflow's (triaging, reviewing, …); kanban.db stores the Hermes status it maps to
-const line = (key) => (t) => `${ICONS[t.status] ?? '?'} ${engine.cardLabel(key, t.number, t.id, t.number ? t.readable_id : null).padEnd(32)}  ${(['paused','blocked'].includes(t.status) ? t.status : t.stage ?? t.status).padEnd(8)}${holdDescription(t) ? ` [${holdDescription(t)}]` : t.detached ? ` [session belongs to ${t.detached.person}]` : ['running','review'].includes(t.status) ? ` [session ${t.execution?.state ?? 'unknown'}${t.execution?.reason ? ` — ${t.execution.reason}` : ''}]` : ''}  ${(t.assignee || '(unassigned)').padEnd(20)}${t.tenant ? ` [${t.tenant}]` : ''}  ${t.title}${t.machine ? `  @${t.machine}` : ''}`;
+const hasExecution = (t) => ['running', 'review'].includes(t.status) || (t.execution?.state === 'awaiting_session' && t.execution.since != null);
+const line = (key) => (t) => `${ICONS[t.status] ?? '?'} ${engine.cardLabel(key, t.number, t.id, t.number ? t.readable_id : null).padEnd(32)}  ${(['paused','blocked'].includes(t.status) ? t.status : t.stage ?? t.status).padEnd(8)}${holdDescription(t) ? ` [${holdDescription(t)}]` : t.detached ? ` [session belongs to ${t.detached.person}]` : hasExecution(t) ? ` [session ${t.execution?.state ?? 'unknown'}${t.execution?.reason ? ` — ${t.execution.reason}` : ''}]` : ''}  ${(t.assignee || '(unassigned)').padEnd(20)}${t.tenant ? ` [${t.tenant}]` : ''}  ${t.title}${t.machine ? `  @${t.machine}` : ''}`;
 // `key` is the card's board's (store.mjs boardKey); `ref` the card as a person names it (`VO-856`)
 const stateOptions = root => ({ nativeHolds: Boolean(workflowFor(root).workflow.flags?.paused) });
 const cardDict = (raw, key, options) => { const t = cardState(raw, options); return ({
@@ -362,19 +392,10 @@ const cardDict = (raw, key, options) => { const t = cardState(raw, options); ret
   session_id: t.session_id, workflow_template_id: t.workflow_template_id, current_step_key: t.current_step_key,
   machine: t.machine ?? null, subtask_of: t.subtask_of ?? null, execution: t.execution ?? null, detached: t.detached ?? null,
   reviewer: t.reviewer ?? null,
-  paused: t.paused, blocked_by: t.blocked_by,
+  paused: t.paused, backlog: t.backlog ?? null, blocked_by: t.blocked_by,
 }); };
 
 /** Hermes's durations: seconds, or 30s / 5m / 2h / 1d. */
-// a moment the caller names: an ISO time, or a duration from now (30m, 2h); epoch seconds, or null
-function untilOf(v) {
-  if (v === undefined || v === null || v === '' || v === true) return null;
-  if (/^\d+(?:\.\d+)?[smhd]?$/i.test(String(v).trim())) return now() + duration(v);
-  const t = Date.parse(String(v));
-  if (Number.isNaN(t)) throw new Error(`malformed --until ${v} (expected an ISO time such as 2026-09-29T04:35Z, or a duration such as 2h)`);
-  return Math.floor(t / 1000);
-}
-
 function duration(v) {
   if (v === undefined || v === null || v === '') return null;
   const s = String(v).trim().toLowerCase();
@@ -429,13 +450,130 @@ function resolveCardNumbers(verb, rest, args, withBoard, keyOf, exists) {
   }));
 }
 
-/** One verb in full, in the call it runs in (call.mjs): a caller's in the owner, or the process's own here. */
+const isServiceVerb = verb => ['serve', 'daemon'].includes(verb);
+const localServiceDoorError = () => Object.assign(new Error('ERR_BOARD_SERVICE_LOCAL_ONLY: a resident board starts through its local stable owner door'), { code: 'ERR_BOARD_SERVICE_LOCAL_ONLY' });
+
+/** Admit only the scoped session guard for a new owner. The caller keeps its outcome open through the actual
+ * owner lifetime and cleanup; admitting a service alone never completes a break-glass act.
+ * An incomplete request is retained and returns null without admitting a service. */
+export async function admitBoardService(argv) {
+  let args;
+  try {
+    args = parse(argv);
+    assertSourceReceipt(args);
+  } catch (error) {
+    await retainUnappliedRequest(argv, error);
+    return null;
+  }
+  const [verb, ...rest] = args._;
+  if (!isServiceVerb(verb)) throw localServiceDoorError();
+  const root = homeOf(args);
+  let glass = null;
+  const admission = { root, args, finish(failure, code) {
+    if (glass) followBreakGlass(glass, failure, code);
+  } };
+  try {
+    const sid = callerSession();
+    if (!sid) return admission;
+    const named = boardOf(root, args), slug = isView(root, named) ? DEFAULT_BOARD : named;
+    if (!boardExists(root, slug)) return admission;
+    const board = openBoard(root, slug);
+    try {
+      const guard = scopedSessionGuard(board, { root, slug, verb, rest, args, sid });
+      if (!guard) return admission;
+      const entry = await loadWorkflow(root);
+      if (managerSession(sid, entry.params, false)) return admission;
+      // Explicit break glass authorizes this scope crossing without pretending an unread agent main was resolved.
+      const explicit = typeof args['break-glass'] === 'string' && args['break-glass'].trim();
+      if (!explicit) {
+        const managers = Array.isArray(entry.params?.managers) ? entry.params.managers : [];
+        if (managers.some(address => /^sc:([^:\s]+):agent:([^:\s]+)$/.test(String(address)))) {
+          await ownerStep('machine identity', () => knowLocalMachine());
+          await ownerStep('manager main sessions', () => readAgentMains(root));
+          if (managerSession(sid, entry.params)) return admission;
+        }
+        breakGlassOrRefuse(guard.refused, guard.scope);
+      }
+      breakGlassReason(explicit, {});
+      current().recorded = board.db.prepare(CALLER_RUN_ADDRESS).get(sid)?.address ?? null;
+      if (!current().recorded && !boardCaller()) await ownerStep('machine identity', () => knowLocalMachine());
+      setActor(callerAddress());
+      glass = breakGlassOrRefuse(guard.refused, guard.scope);
+      return admission;
+    } finally { board.close(); }
+  } catch (error) {
+    admission.finish(error, 1);
+    throw error;
+  }
+}
+
+/** One verb in full, in the call it runs in (call.mjs): a caller's in the owner, or the process's own here. A card's
+ *  session's write that broke glass (breakGlassOrRefuse) is followed in the journal by what became of it, unless it
+ *  was simply done: the journal never shows an act as done that was refused or failed after its entry was written. */
 export async function runVerb(argv) {
+  const context = parse(argv, { contextOnly: true });
+  if (isServiceVerb(context._[0]) && !context.help) throw localServiceDoorError();
+  const call = current();
+  call.glass = null;
+  call.routedRequests = [];
+  call.acceptedRequests = [];
+  call.queuedRequests = [];
+  call.unqueuedReviews = [];
+  call.boardCommand = null;
+  let code, failure = null;
+  try {
+    code = await runVerbBody(argv);
+    if (call.routedRequests.length || call.acceptedRequests.length || call.queuedRequests.length || call.unqueuedReviews.length) say(parse(argv, { contextOnly: true }), '', null);
+    return code;
+  } catch (error) {
+    failure = error;
+    code = await retainUnappliedRequest(argv, error);
+    return code;
+  }
+  finally { if (call.glass) followBreakGlass(call.glass, failure, code); }
+}
+
+// Ordinary verbs and local service admission retain incomplete input through
+// one owner, while the caller still holds this home's writer authority.
+async function retainUnappliedRequest(argv, error) {
+  const call = current();
+  if (call.readOnly) throw Object.assign(error, { code: READ_BY_OWNER });
+  // an unread manager identity is answered to its caller as itself, never handed to the manager
+  if (error.code === 'manager_identity_unavailable') throw error;
+  // Earlier doors (argument parsing, caller scope, attachments and starts) can
+  // discover a request they cannot apply before the workflow sees its event.
+  // Record incomplete detail locally or route an explicitly reserved act.
+  // No restricted action is retried here and no manager role is inferred.
+  const args = parse(argv, { contextOnly: true });
+  const root = call.boardCommand?.root ?? homeOf({ ...args, root: args.root ?? call.facts.SUPERCODE_AGENT_HOME });
+  await loadWorkflow(root);
+  const named = call.boardCommand?.slug ?? boardOf(root, args);
+  const slug = isView(root, named) ? DEFAULT_BOARD : named;
+  const board = openBoard(root, slug);
+  try {
+    if (!actorOf()) setActor(callerAddress() ?? 'unresolved board caller');
+    let id = NO_CARD_WORDS.has(args._[0]) ? null : call.boardCommand?.id ?? args._[1] ?? null;
+    if (id && !engine.getTask(board.db, id)) id = engine.cardByReadableId(board.db, id) ?? null;
+    const ownerRule = error.ownerRule || error.code === 'forbidden'
+      || /only the manager|only .*manager.*creator|scoped to|outside.*own card|person's completion.*never by a session/i.test(error.message ?? '');
+    if (!ownerRule && (error.errcode != null || /^(?:E[A-Z_]+|ERR_)/.test(error.code ?? '') || error instanceof TypeError || error instanceof ReferenceError)) throw error;
+    const receipt = await (ownerRule ? engine.routeRequest : engine.acceptRequest)(board, { id, name: args._[0] ?? 'workflow', payload: { argv }, reason: String(error.message ?? error) });
+    say(args, '', null);
+    return receipt.ok === false ? 1 : 0;
+  } catch (handoffError) {
+    if (handoffError === error || handoffError.code === 'manager_identity_unavailable') throw handoffError;
+    // A failed store or mailbox enqueue is a technical failure, never a
+    // successful handoff. Keep both exact paths visible to the caller.
+    throw new Error(`${error.message}; board request could not be retained: ${handoffError.message}`, { cause: handoffError });
+  } finally { board.close(); }
+}
+
+async function runVerbBody(argv) {
   const args = parse(argv);
   assertSourceReceipt(args);
-  await ownerStep('machine identity', () => knowLocalMachine());
   const [verb, ...rest] = args._;
   if (!verb || verb === 'help' || args.help) { current().out(HELP); return 0; }
+  await ownerStep('machine identity', () => knowLocalMachine());
   const root = homeOf(args);
   if (verb === 'events') return streamBoardPublications({root,after:args.after,once:args.once});
   if (verb === 'listeners') {
@@ -456,26 +594,29 @@ export async function runVerb(argv) {
   }
   const viewTag = isView(root, named) ? named : null;
   const slug = viewTag ? DEFAULT_BOARD : named;
+  current().boardCommand = { root, slug, id: rest[0] ?? null };
   const open = (create = false) => { const b = openBoard(root, slug, { create, document: args.document ?? null, backing: create ? args.backing ?? null : null }); b.label = boardLabel(root, slug); return b; };
   const withBoard = (fn, create = false) => { const b = open(create); try { return fn(b); } finally { b.close(); } };
   const withBoardAsync = async (fn, create = false) => { const b = open(create); try { return await fn(b); } finally { b.close(); } };
   // the board's key (store.mjs boardKey), read when a card is named or shown by its number
   const keyOf = () => boardKey(root, slug);
-  resolveCardNumbers(verb, rest, args, withBoard, keyOf, () => boardExists(root, slug));
-  const id = rest[0];
-  const need = (n, what) => { if (rest.length < n) throw new Error(`${verb} needs ${what}`); };
-  const ids = (first = rest) => [...first, ...(args.ids ?? [])];
 
   // a caller that is a card's own session (its harness names it; the board recorded which session it launched)
   const listing = ['list','ls'].includes(verb);
   const readingDispatching = verb === 'dispatching' && rest.length === 0;
-  const reading = READS.has(verb) || readingDispatching;
+  const reading = READS.has(verb) || readingDispatching || (verb === 'dispatch' && args['dry-run']);
   // a listing on the owner's read door reads the workflow the owner holds (owner-door.mjs), and names no session: it
   // records nothing, and `--mine` is the caller's profile
   const readDoor = Boolean(current().readOnly);
   if (!readDoor) await ownerStep('workflow', () => loadWorkflow(root)).catch((error) => { if (verb !== 'init' && verb !== 'boards') throw error; });
-  // A listing does not authorize a transition and needs no manager's main session.
-  if (!listing && !readingDispatching) await ownerStep('manager main sessions', () => readAgentMains(root));
+  assertWorkflowVerb(args, workflowFor(root, { optional: true })?.workflow);
+  resolveCardNumbers(verb, rest, args, withBoard, keyOf, () => boardExists(root, slug));
+  const id = rest[0];
+  current().boardCommand.id = id ?? null;
+  const need = (n, what) => { if (rest.length < n) throw new Error(`${verb} needs ${what}`); };
+  const ids = (first = rest) => [...first, ...(args.ids ?? [])];
+  // Read-only answers grant no transition. Init still admits the initial board write.
+  if (!reading || verb === 'init') await ownerStep('manager main sessions', () => readAgentMains(root));
   const sid = listing && (!args.mine || readDoor) ? null : callerSession();
   // what this command records is the calling session's act (its address, as its subscriptions name it)
   current().recorded = sid && boardExists(root, slug) ? withBoard((b) => b.db.prepare(CALLER_RUN_ADDRESS).get(sid)?.address) ?? null : null;
@@ -483,19 +624,16 @@ export async function runVerb(argv) {
   const recordedAgent = sid && boardExists(root, slug)
     ? await ownerStep('committed native agent ownership', () => withBoard((b) => recordedRunAgent(b.db, sid, callerAddress()))) : null;
   setPrincipal(await ownerStep('caller principal', () => callerPrincipal(root, sid, { teams: !sid && !reading, recordedAgent })));
-  // the dispatcher as the owner holds it, said once per call (owner-health.mjs; nothing is read for it)
-  if (!current().said.has(`dispatcher:${slug}`)) { current().said.add(`dispatcher:${slug}`); for (const line of dispatcherNotice(slug)) current().err(`${line}\n`); }
   if (sid && !reading && boardExists(root, slug)) {
     // binding the caller's launch is a write: only the owner, answering the caller's own verb, makes it (a local read
     // never writes)
     await withBoardAsync(async (b) => {
       if (isCallersCall()) await reconcileCallerLaunch(b, sid);
-      const own = { ...ownCards(b.db, sid), side: sideArcs(b.db, sid) };
-      if (!own.worked.size && !own.side.size) return;
-      // A copied home owns no live sessions or manager addresses. Its owner may
-      // answer local verbs while every board's dispatching remains off.
-      const copyServe = verb === 'serve' && Boolean(boardCopyOf(b)) && listBoards(root).every(board => !dispatchingOf(root, board).on);
-      authorize(b.db, verb, rest, args, own, { copyServe });
+      // Working a card does not take away a workflow-declared manager's board authority. Adoption keeps identity;
+      // the ordinary transition checks below still admit each act against that manager role.
+      if (rolesFor(b.db, '', sid, workflowFor(root).params).includes('manager')) return;
+      const guard = scopedSessionGuard(b, { root, slug, verb, rest, args, sid });
+      if (guard) current().glass = breakGlassOrRefuse(guard.refused, guard.scope);
     });
   }
   // the board's workflow (the IR's): what each verb does, and who may send it, is its
@@ -604,9 +742,10 @@ export async function runVerb(argv) {
       })), true);
       await withBoardAsync(b=>engine.runEffects(b,created.effects??[]));
       let answer = { id: created.id, existing: created.existing };
+      if (current().glass) current().glass.created = created.id;
       if (args.adopt) {
-        withBoard(b => { if (!rolesFor(b.db, created.id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
-        withBoard(b => requestAdoption(b, created.id, args.adopt));
+        withBoard(b => { if (!current().glass && !rolesFor(b.db, created.id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
+        await withBoardAsync(b => requestAdoption(b, created.id, args.adopt));
         answer = { ...answer, adoption_requested: args.adopt };
       }
       // Starting a card is the dispatcher's: this write's wake hint reaches it, and the card's
@@ -637,8 +776,9 @@ export async function runVerb(argv) {
 
     case 'list': case 'ls': {
       const assignee = args.assignee ?? (args.mine ? callerName() : null);
+      if (args.backlog != null && !['true', 'false'].includes(String(args.backlog))) throw new Error('--backlog takes true or false');
       const cards = await withBoardAsync(b => listCardsInTurns(b.db, { ...stateOptions(root), detailed: Boolean(args.json), status: args.status, assignee, machine: args.machine, includeArchived: args.archived || args.all, includeSubtasks: args.subtasks || args.all,
-        tenant: args.tenant, session: args.session, workflowTemplateId: args['workflow-template-id'], stepKey: args['step-key'], tags: [...(viewTag ? [viewTag] : []), ...(args.tag ?? [])] }));
+        backlog: args.backlog == null ? null : args.backlog === 'true', tenant: args.tenant, session: args.session, workflowTemplateId: args['workflow-template-id'], stepKey: args['step-key'], tags: [...(viewTag ? [viewTag] : []), ...(args.tag ?? [])] }));
       const sorters = {
         assignee: (a, b) => String(a.assignee ?? '').localeCompare(String(b.assignee ?? '')), created: (a, b) => a.created_at - b.created_at,
         'created-desc': (a, b) => b.created_at - a.created_at, priority: (a, b) => a.priority - b.priority, 'priority-desc': (a, b) => b.priority - a.priority,
@@ -665,7 +805,8 @@ export async function runVerb(argv) {
       need(1, 'a card id');
       const { settings } = await laneState(root).catch(() => ({ settings: boardSettings({}) }));
       const card = withBoard((b) => {
-        const got = engine.showCard(b.db, id, stateOptions(root));
+        const got = engine.showCard(b.db, id, { ...stateOptions(root), review: engine.reviewsCard(b.db, id, { sessionId: sid, runId: workerRun(b.db, id, sid) }) });
+        if (got.review_request) return got;
         got.runs = engine.runs(b.db, id, { stateType: args['state-type'] ?? null, stateName: args['state-name'] ?? null });
         got.task.execution = executionOf(engine.currentRun(b.db, id), readingContext(b.db, got.task.id, got.task.current_run_id));
         got.runs = got.runs.map(run => ({ ...run, execution: executionOf(run) }));
@@ -679,6 +820,11 @@ export async function runVerb(argv) {
           : timeOf(b.db, got.task);
         return got;
       });
+      if (card.review_request) {
+        if (args.json) say(args, '', card);
+        else current().out(`${withBoard((b) => view(b, (db) => engine.cardContext(db, id, { review: true })))}\n`);
+        return 0;
+      }
       const t = cardState({ ...card.task, stage: card.stage }, stateOptions(root));
       const latest = [...card.runs].reverse().find((r) => r.summary)?.summary ?? null;
       if (args.json) {
@@ -694,7 +840,7 @@ export async function runVerb(argv) {
       if (t.reviewer) out.push(`  reviewer:  ${t.reviewer} (card override)`);
       if (t.detached) out.push(`  session:   ${t.detached.session.address} belongs to ${t.detached.person} (detached ${ts(t.detached.at)}; dispatcher does not own it)`);
       // what the card's session is doing as the board last read it, beside the lane (ADR 0024)
-      else if (['running', 'review'].includes(t.status)) out.push(`  session:   ${card.task.execution?.state ?? 'unknown'}${card.task.execution?.reason ? ` — ${card.task.execution.reason}` : ''}`);
+      else if (hasExecution(t)) out.push(`  session:   ${card.task.execution?.state ?? 'unknown'}${card.task.execution?.reason ? ` — ${card.task.execution.reason}` : ''}`);
       // the question the card's session shows on its pane, while it shows (VO-3395), with the door that answers it
       const asked = card.runs.find((r) => r.id === t.current_run_id)?.metadata?.supercode?.question;
       if (asked?.options?.length) {
@@ -781,7 +927,7 @@ export async function runVerb(argv) {
       return 0;
     }
 
-    case 'context': need(1, 'a card id'); current().out(`${withBoard((b) => view(b, (db) => engine.cardContext(db, id)))}\n`); return 0;
+    case 'context': need(1, 'a card id'); current().out(`${withBoard((b) => view(b, (db) => engine.cardContext(db, id, { review: engine.reviewsCard(db, id, { sessionId: sid, runId: workerRun(db, id, sid) }) })))}\n`); return 0;
 
     case 'runs': {
       need(1, 'a card id');
@@ -810,7 +956,7 @@ export async function runVerb(argv) {
       if(!task)throw new Error(`no card ${id}`);
       withBoard(b=>{if(!rolesFor(b.db,id,sid,workflowFor(root).params).includes('manager'))throw new Error('Only the manager moves a card assignment between agents.');});
       const role=args.role??'implementer';
-      const assignment=activeAgentAssignments(root).find(item=>item.org===scope.org&&item.kind==='card'&&item.target===id&&item.role===role);
+      const assignment=activeAgentAssignments(root).find(item=>item.org===scope.org&&item.id===cardRoleAssignment(id,role));
       if(!assignment)throw new Error('declare the card role before reassigning its assignment');
       const changed=await reassignAgent(root,scope.org,assignment.id,args.agent,{context});
       withBoard(b=>recordCardAgentChanges(b,id));
@@ -842,10 +988,10 @@ export async function runVerb(argv) {
       return 0;
     }
     case 'reclaim': need(1, 'a card id'); await withBoardAsync((b) => engine.reclaim(b, id, args.reason ?? (rest.slice(1).join(' ') || null))); say(args, `Reclaimed ${id}`, { ok: true }); return 0;
-    case 'heartbeat': need(1, 'a card id'); await withBoardAsync((b) => engine.heartbeat(b, id, args.note ?? null, { until: untilOf(args.until) })); say(args, `Heartbeat recorded for ${id}`, { ok: true }); return 0;
+    case 'heartbeat': need(1, 'a card id'); await withBoardAsync((b) => engine.heartbeat(b, id, args.note ?? null, { until: args.until ?? null })); say(args, `Heartbeat recorded for ${id}${args.until != null ? `; wait recorded until ${args.until}` : ''}`, { ok: true, ...(args.until != null ? { until: args.until } : {}) }); return 0;
 
     case 'link': need(2, 'a parent and a child'); await withBoardAsync((b) => engine.link(b, rest[0], rest[1])); say(args, `Linked ${rest[0]} -> ${rest[1]}`, { ok: true }); return 0;
-    case 'unlink': { need(2, 'a parent and a child'); const gone = await withBoardAsync((b) => engine.unlink(b, rest[0], rest[1])); say(args, gone ? `Unlinked ${rest[0]} -> ${rest[1]}` : `no link ${rest[0]} -> ${rest[1]}`, { ok: gone }); return gone ? 0 : 1; }
+    case 'unlink': { need(2, 'a parent and a child'); const gone = await withBoardAsync((b) => engine.unlink(b, rest[0], rest[1])); say(args, gone ? `Unlinked ${rest[0]} -> ${rest[1]}` : `Link ${rest[0]} -> ${rest[1]} is already absent`, { ok: true, already: !gone }); return 0; }
 
     // C4: a card's ordered tags; Hermes's tenant follows the first, and a board view selects by tag
     case 'tag': case 'untag': {
@@ -870,7 +1016,7 @@ export async function runVerb(argv) {
       if (args.file !== undefined && rest.length > 1) throw new Error(`comment ${id} takes its text from --file or from words, not both; unexpected: ${JSON.stringify(rest.slice(1).join(' ').slice(0, 120))}. Nothing was recorded.`);
       let text = textFrom(args.file, rest.slice(1).join(' '));
       if (args['max-len']) text = text.slice(0, Number(args['max-len']));
-      const n = await withBoardAsync((b) => engine.comment(b, id, isLatestReviewer(b.db, id, actorOf()) ? actorOf() : args.author ?? callerAddress() ?? callerName(), text, { pr: args.pr ?? null, pr_head: args['pr-head'] ?? null, source: args.source ?? null }));
+      const n = await withBoardAsync((b) => engine.comment(b, id, isLatestReviewer(b.db, id, actorOf()) ? actorOf() : args.author ?? callerAddress() ?? callerName(), text, { pr: args.pr ?? null, pr_head: args['pr-head'] ?? null, source: args.source ?? null, disposition: args['pr-disposition'] ?? null, release_target: args['release-target'] ?? null, reason: args.reason ?? null, readback: !args['pr-disposition'] && (args['release-target'] || args['released-artifact'] || args['release-evidence'] || args['attest-release']) ? { target: args['release-target'], artifact: args['released-artifact'], evidence: args['release-evidence'], attest: Boolean(args['attest-release']) } : null }));
       say(args, `Comment added to ${id}`, { ok: true, comment: n }); return 0;
     }
     case 'attach': {
@@ -880,7 +1026,7 @@ export async function runVerb(argv) {
         withBoard(b => { if (!engine.getTask(b.db, id)) throw new Error(`no card ${id}`); });
         const directory = join(slug === DEFAULT_BOARD ? join(root, 'kanban', 'attachments') : join(boardDir(root, slug), 'attachments'), id);
         const result = receiveAttachment({ directory, upload: args.upload, caller: callerAddress() ?? actorOf(), input: current().stdin,
-          add: (file, name) => withBoard(b => engine.addAttachment(b, id, { file, name, contentType: args['content-type'] ?? null, author: args.author ?? callerName() })) });
+          add: (file, name) => withBoard(b => engine.addAttachment(b, id, { file, name, contentType: args['content-type'] ?? null, author: args.author ?? callerAddress() ?? callerName() })) });
         say(args, result.id ? `Attached ${result.name} to ${id} (#${result.id}, sha256 ${result.sha256})` : `Upload ${args.upload}: ${result.received ?? 'aborted'}`, result);
         return 0;
       }
@@ -892,7 +1038,7 @@ export async function runVerb(argv) {
       let target = join(dir, name);
       for (let n = 1; existsSync(target); n += 1) target = join(dir, `${n}-${name}`);
       copyFileSync(source, target);
-      const n = withBoard((b) => engine.addAttachment(b, id, { file: { path: target, size: statSync(target).size }, name, contentType: args['content-type'] ?? null, author: args.author ?? callerName() }));
+      const n = withBoard((b) => engine.addAttachment(b, id, { file: { path: target, size: statSync(target).size }, name, contentType: args['content-type'] ?? null, author: args.author ?? callerAddress() ?? callerName() }));
       say(args, `Attached ${name} to ${id} (#${n})`, { ok: true, id: n, path: target }); return 0;
     }
     case 'attachments': {
@@ -928,17 +1074,7 @@ export async function runVerb(argv) {
     case 'person-done': {
       need(1, 'a card id');
       if (sid) throw new Error('A person\'s completion is reported by the Workplace integration from the home, never by a session; nothing was done.');
-      // The board's refusal (the card is no person's, or another person's, or already ended) is said with exit code 2: the
-      // reporter does not send it again. Any other failure is the reporter's to retry; the same report again is `already`.
-      let done;
-      try { done = await withBoardAsync((b) => engine.personDone(b, id, { person: args.person ?? null, result: textFrom(args['result-file'], args.result), task: args['workplace-task'] ?? null })); }
-      catch (error) {
-        // the card's refusal is final, as dispatch.mjs takes a moved card's (a transition that does not apply there), and
-        // so is an answer refused as a credential dump: sent again, it is refused again
-        if (!error.refusal && !error.noTransition && !/does not apply|there is for/.test(String(error.message)) && error.code !== 'credential_dump') throw error;
-        say(args, `${id} refused ${args.person ?? 'the person'}'s completion: ${error.message}`, { ok: false, card: id, person: args.person ?? null, refused: error.message });
-        return 2;
-      }
+      const done = await withBoardAsync((b) => engine.personDone(b, id, { person: args.person ?? null, result: textFrom(args['result-file'], args.result), task: args['workplace-task'] ?? null }));
       say(args, done.already ? `${id} was already completed by ${args.person}` : `Completed ${id} for ${args.person}`, { ok: true, card: id, person: args.person, already: done.already });
       return 0;
     }
@@ -964,42 +1100,56 @@ export async function runVerb(argv) {
     case 'unblock': {
       need(1, 'a card id');
       const results = [];
-      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.unblock(b, t, { reason: args.reason ?? null, on: args.on ?? args['waiting-on'] ?? null }))).to]);
+      const applied = [];
+      for (const t of ids()) {
+        const result = await withBoardAsync((b) => engine.unblock(b, t, { reason: args.reason ?? null, on: args.on ?? args['waiting-on'] ?? null }));
+        results.push([t, result.to]);
+        if (!result.routed && !result.accepted) applied.push(t);
+      }
       // Hermes records the reason as a comment on each card it unblocks
-      if (args.reason) for (const [t] of results) await withBoardAsync((b) => engine.comment(b, t, callerName(), `UNBLOCK: ${args.reason}`));
+      if (args.reason) for (const t of applied) await withBoardAsync((b) => engine.comment(b, t, callerAddress() ?? callerName(), `UNBLOCK: ${args.reason}`));
       say(args, results.map(([t, s]) => `Unblocked ${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
     }
-    case 'request-review': need(1, 'a card id'); await withBoardAsync((b) => engine.requestReview(b, id, { summary: args.summary ?? null, reviewer: args.reviewer ?? null, metadata: metadataOf(args.metadata) ?? null, commit: args.commit ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args['pr-head'] ?? args.head ?? args.commit ?? null, plan: Boolean(args.plan), force: Boolean(args.force), expectedRunId: workerRun(b.db, id, sid) })); say(args, `${id} → review`, { ok: true }); return 0;
+    case 'request-review': {
+      need(1, 'a card id');
+      const result = await withBoardAsync((b) => engine.requestReview(b, id, { summary: args.summary ?? null, reviewer: args.reviewer ?? null, metadata: metadataOf(args.metadata) ?? null, commit: args.commit ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args['pr-head'] ?? args.head ?? args.commit ?? null, plan: Boolean(args.plan), force: Boolean(args.force), supersedes: args.supersedes ?? null, expectedRunId: workerRun(b.db, id, sid) }));
+      say(args, `${id} → review`, result);
+      return result.ok === false ? 1 : 0;
+    }
     case 'request-changes': {
-      need(2, 'a card id and the reason');
+      need(1, 'a card id');
       // each finding is filed as a task on the arc first: the arc's review is due again once every one is closed (ci.mjs answeredChanges)
       const findings = [].concat(args.finding ?? []).map((f) => String(f).trim()).filter(Boolean);
       const filed = [];
       for (const finding of findings) filed.push((await withBoardAsync((b) => engine.createCard(b, { title: finding, subtaskOf: id }))).id);
-      await withBoardAsync((b) => engine.requestChanges(b, id, { reason: rest.slice(1).join(' '), reviewer: args.reviewer ?? null }));
+      await withBoardAsync((b) => engine.requestChanges(b, id, { reason: args.reason ?? (rest.slice(1).join(' ') || 'none given'), reviewer: args.reviewer ?? null }));
       say(args, `${id} sent back for changes${filed.length ? `; findings filed as ${filed.join(', ')}` : ''}`, { ok: true, findings: filed }); return 0;
     }
     case 'reopen': {
       // a done card back to work; the cards that built on it are invalidated with it (Hermes's reopen)
       need(1, 'a card id');
       const results = [];
-      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.reopen(b, t, { author: callerName(), reason: args.reason ?? null }))).to]);
+      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.reopen(b, t, { author: callerAddress() ?? callerName(), reason: args.reason ?? null }))).to]);
       say(args, results.map(([t, s]) => `Reopened ${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
     }
     case 'reopen-review': {
       need(1, 'a card id');
       const results = [];
-      for (const t of ids()) { const moved = await withBoardAsync((b) => engine.reopenReview(b, t, { reason: args.reason ?? null })); results.push([t, moved.to, moved.restarted_run ?? null]); }
+      for (const t of ids()) { const moved = await withBoardAsync((b) => engine.reopenReview(b, t, { reason: args.reason ?? null })); results.push([t, moved.to, moved.restarted_run ?? null, moved.returned_run ?? null]); }
       // a review still running with no verdict is restarted, not voided: its run ends, its reviewer session is closed and
-      // the board's next review run resumes that same session with the round's brief
-      say(args, results.map(([t, s, run]) => run ? `Restarted ${t}'s review: run ${run} ended with no verdict and its reviewer session was closed; the board's next review run resumes it (${s}). No verdict was voided.` : `Reopened ${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
+      // the board's next review run resumes that same session with the round's brief; an arc re-declared since its request
+      // is returned to its coder instead. A PR with a newer queued request returns only its obsolete execution; the
+      // retained queue owns that PR's next review through ordinary admission.
+      say(args, results.map(([t, s, run, returned, queued]) => queued ? `Returned ${t}'s obsolete review: run ${returned} ended with no verdict. Newest queued request ${queued} for that PR retains its receipt and position for ordinary review admission.`
+        : returned ? `Returned ${t}'s review to its coder (${s}): run ${returned} ended with no verdict, since the arc re-declared its sources after its review request. Its next review is of the declared set, requested only when the ordinary review rules make one due (for example a declared PR at a head no verdict has judged, or the final review once every PR is merged at the head its PR review passed). No verdict was voided.`
+        : run ? `Restarted ${t}'s review: run ${run} ended with no verdict and its reviewer session was closed; the board's next review run resumes it (${s}). No verdict was voided.` : `Reopened ${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
     }
     case 'return-review': {
       // the manager's door out of review: a card there by mistake goes back to its coder, its review run ending as returned
       need(1, 'a card id');
       const reason = args.reason ?? (rest.slice(1).join(' ') || null);
       const moved = await withBoardAsync((b) => engine.returnReview(b, id, { reason }));
-      say(args, `Returned ${id} from review → ${moved.to}: its review run ended as returned with no verdict; its coder continues, and the board reviews again once a pushed PR head changes.`, { ok: true, ...moved }); return 0;
+      say(args, `Returned ${id} from review → ${moved.to}: its review run ended as returned with no verdict; its coder continues, and the board reviews again once a pushed PR head changes or the arc re-declares its sources (comment --pr, --pr none, --source, --source none).`, { ok: true, ...moved }); return 0;
     }
     case 'promote': {
       need(1, 'a card id');
@@ -1012,14 +1162,17 @@ export async function runVerb(argv) {
           const ok = ['todo', 'blocked'].includes(card.task.status) && (!open.length || args.force);
           return { id: t, ok, reason: ok ? null : !['todo', 'blocked'].includes(card.task.status) ? `${t} is ${card.task.status}` : `parents not done: ${open.join(', ')}` };
         }));
-        say(args, verdicts.map((v) => `${v.ok ? 'would promote' : 'would refuse'} ${v.id}${v.reason ? `: ${v.reason}` : ''}`).join('\n'), verdicts);
+        say(args, verdicts.map((v) => `${v.ok ? 'would promote' : 'would record request'} ${v.id}${v.reason ? `: ${v.reason}` : ''}`).join('\n'), verdicts);
         return 0;
       }
-      for (const t of targets) await withBoardAsync((b) => engine.promote(b, t, { actor: callerName(), reason, force: args.force }));
+      for (const t of targets) await withBoardAsync((b) => engine.promote(b, t, { actor: callerAddress() ?? callerName(), reason, force: args.force }));
       say(args, targets.map((t) => `Promoted ${t} → ready`).join('\n'), { ok: true }); return 0;
     }
     case 'archive': {
-      for (const t of rest) await withBoardAsync((b) => engine.archive(b, t, { reason: args.reason }));
+      for (const t of rest) {
+        const result = await withBoardAsync((b) => engine.archive(b, t, { reason: args.reason }));
+        if (result.routed || result.accepted) { say(args, '', null); return 0; }
+      }
       const purged = [];
       for (const t of args.rm ?? []) {
         withBoard((b) => tx(b, (db) => {
@@ -1049,6 +1202,7 @@ export async function runVerb(argv) {
           results.push({ id: t, children: await withBoardAsync((b) => engine.decompose(b, t, children, { author: args.author ?? callerAddress() ?? callerName() })) });
         } else {
           const session = await withBoardAsync((b) => startCard(b, t, { lanes, settings, roles: rolesFor(b.db, t, sid, workflowFor(root).params) }));
+          if (session?.routed) { results.push({ id: t, ...session }); continue; }
           results.push({ id: t, session: session.address, mode: session.mode });
         }
       }
@@ -1064,7 +1218,7 @@ export async function runVerb(argv) {
       const order = ['info', 'warning', 'error', 'critical'];
       const found = withBoard((b) => {
         const cards = args.task ? [engine.getTask(b.db, args.task)].filter(Boolean) : engine.listCards(b.db, stateOptions(root));
-        return [...(args.task ? [] : engine.diagnosePublishing(publishing).map((d) => ({ task: '(board)', title_of_task: null, ...d }))),
+        return [...[...dispatcherDiagnostics(slug), ...(args.task ? [] : engine.diagnosePublishing(publishing))].map((d) => ({ task: '(board)', title_of_task: null, ...d })),
           ...cards.flatMap((t) => engine.diagnose(b.db, t, { ...stateOptions(root), failureLimit: settings.failureLimit, fleet, launchWindowSeconds: settings.launchWindow, publishing, expiredMail, waitingMail }).map((d) => ({ task: t.id, title_of_task: t.title, ...d })))]
           .filter((d) => !args.severity || order.indexOf(d.severity) >= order.indexOf(args.severity));
       });
@@ -1219,22 +1373,35 @@ export async function runVerb(argv) {
       else for (const r of reports) current().out(`${r.board}: ${r.error ? `error: ${r.error}` : `${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good, ${r.notified.length} notified`}\n`);
       return reports.some((r) => r.error) ? 1 : 0;
     }
-    case 'daemon': case 'serve': return serve(root, args);
-
     case 'gc': {
       const eventDays = Number(args['event-retention-days'] ?? 30);
       const logDays = Number(args['log-retention-days'] ?? 30);
       let removedWs = 0;
       const scratchRoot = slug === DEFAULT_BOARD ? join(root, 'kanban', 'workspaces') : join(boardDir(root, slug), 'workspaces');
-      const archived = withBoard((b) => b.db.prepare("SELECT t.id,t.workspace_kind,t.workspace_path,c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.status = 'archived'").all());
+      // archived cards, and closed cards whose worktree was last kept (its merge may have landed since); a worktree
+      // last removed, or last refused (a folder the board never removes), is not read again
+      const archived = withBoard((b) => {
+        const last = b.db.prepare("SELECT kind, json_extract(payload, '$.refused') AS refused FROM task_events WHERE task_id = ? AND kind IN ('worktree_kept', 'worktree_removed') AND json_extract(payload,'$.path')=? ORDER BY id DESC LIMIT 1");
+        return b.db.prepare(`SELECT t.id,t.status,t.workspace_kind,t.workspace_path,c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id
+          WHERE t.status = 'archived' OR (t.workspace_kind = 'worktree' AND t.status IN ('done', 'cancelled'))`).all().filter((t) => {
+          if (t.workspace_kind !== 'worktree') return t.status === 'archived';
+          return cardWorktrees(b.db, t).some(allocation => {
+            const seen = last.get(t.id, allocation.path);
+            return !seen || seen.kind === 'worktree_kept' && !seen.refused;
+          });
+        });
+      });
+      const unread = [];
       for (const t of archived) {
-        if (!isLocalWorkspace(t)) continue;
-        if (t.workspace_kind === 'worktree' && t.workspace_path && existsSync(t.workspace_path)) {
-          // an archived card's worktree goes, as Hermes's gc removes it (the branch stays)
-          const r = spawnSync('git', ['-C', t.workspace_path, 'worktree', 'remove', '--force', t.workspace_path], { encoding: 'utf8' });
-          if (r.status === 0) removedWs += 1;
+        if (t.workspace_kind === 'worktree') {
+          // a closed card's worktree goes as the delivery pass retires it: only when its branch is merged, its tree clean
+          // and its sessions closed, else kept and described on the card (engine cleanupWorkspace; the branch stays); a
+          // card in a person's custody is theirs, and one card's failure leaves the rest of gc to run
+          try { if (await withBoardAsync((b) => sessionOperation(b, { taskId: t.id, kind: 'workflow gc workspace cleanup' }, () => engine.cleanupWorkspace(b, t.id)))) removedWs += 1; }
+          catch (error) { unread.push(`${t.id}: ${String(error?.message ?? error).slice(0, 200)}`); }
           continue;
         }
+        if (!isLocalWorkspace(t) || t.status !== 'archived') continue;
         if (t.workspace_kind !== 'scratch') continue;
         const dir = resolve(t.workspace_path || join(scratchRoot, t.id));
         if (!dir.startsWith(`${resolve(scratchRoot)}/`) || !existsSync(dir)) continue;
@@ -1245,7 +1412,7 @@ export async function runVerb(argv) {
       let logs = 0;
       const logDir = logsDir(root, slug);
       if (existsSync(logDir)) for (const f of readdirSync(logDir)) { const p = join(logDir, f); if (statSync(p).isFile() && statSync(p).mtimeMs < Date.now() - logDays * 86400_000) { unlinkSync(p); logs += 1; } }
-      say(args, `GC complete: ${removedWs} workspace(s), ${events} event row(s), ${logs} log file(s) removed`, { workspaces: removedWs, events, logs });
+      say(args, `GC complete: ${removedWs} workspace(s), ${events} event row(s), ${logs} log file(s) removed${unread.length ? `; worktrees not retired now: ${unread.join('; ')}` : ''}`, { workspaces: removedWs, events, logs, workspaces_kept: unread });
       return 0;
     }
     case 'compact': {
@@ -1282,7 +1449,7 @@ export async function runVerb(argv) {
         for (let tries = 0; tries < 5 && sized(`${path}-wal`) > 0; tries++) { vacuum('PRAGMA wal_checkpoint(TRUNCATE)'); if (sized(`${path}-wal`) > 0) await new Promise((done) => setTimeout(done, 1000)); }
         return { trimmed, reclaimed_bytes: before.bytes - onDisk(), wal_bytes: sized(`${path}-wal`), pages_before: before.pages, free_before: before.free, pages_after: pages(), free_after: free(), seconds: Math.round((performance.now() - began) / 100) / 10 };
       });
-      if (report.refused) { say(args, `${report.trimmed} older change(s) cut; no rebuild: ${report.refused}`, report); return 1; }
+      if (report.refused) throw new Error(`${report.trimmed} older change(s) cut; rebuild needs the manager to resolve: ${report.refused}`);
       say(args, `${report.trimmed} older change(s) cut; the store and its WAL are ${Math.round(report.reclaimed_bytes / 1048576)} MB smaller on disk after ${report.seconds} s (${report.pages_before} pages, ${report.free_before} free, to ${report.pages_after}, ${report.free_after} free; WAL ${report.wal_bytes} bytes)`, report);
       return 0;
     }
@@ -1313,40 +1480,61 @@ export async function runVerb(argv) {
       // A headless worker records its harness session on its run (kanban-worker.mjs), through the owner like every board
       // write. Only the run the owner launched for this worker: the launch's secret (in the worker's environment alone,
       // its hash kept on the run), its card and its run are checked at the write, against the card's current, unended run.
-      need(2, 'a run id and a session id');
+      need(1, 'a run id');
       // the secret is the worker's own environment (SUPERCODE_RUN_LAUNCH, sent as a caller fact), never an argument
-      const runId = Number(id), harness = args.harness ?? null, launch = current().facts.SUPERCODE_RUN_LAUNCH ?? '', card = typeof args.task === 'string' ? args.task : '';
-      if (!Number.isSafeInteger(runId) || !SAFE_SESSION.test(rest[1]) || (harness !== null && !SAFE_SESSION.test(harness)) || !launch || !card) throw new Error('run-session takes a run id, a session id, --harness and --task, from a worker the owner launched');
+      const runId = Number(id), sessionId = rest[1] ?? null, harness = args.harness ?? null, launch = current().facts.SUPERCODE_RUN_LAUNCH ?? '', card = typeof args.task === 'string' ? args.task : '';
+      if (!Number.isSafeInteger(runId) || (sessionId !== null && !SAFE_SESSION.test(sessionId)) || typeof harness !== 'string' || !SAFE_SESSION.test(harness) || !launch || !card || (sessionId === null && args['native-home'] == null)) throw new Error('run-session takes a run id, a session id or --native-home, --harness and --task, from a worker the owner launched');
+      let nativeHome;
+      if (args['native-home'] != null) {
+        nativeHome = json(args['native-home'], null);
+        const env = nativeHome?.env, homes = nativeHome?.homes;
+        if (!env || typeof env !== 'object' || Array.isArray(env) || !homes || typeof homes !== 'object' || Array.isArray(homes)
+          || Object.values(env).some(value => value !== null && typeof value !== 'string')) throw new Error('native-home must name the native store and its path selectors');
+        const canonical = await resolveNativeSessionHome(harness, env, process.cwd());
+        const same = (left, right) => Object.keys(left).length === Object.keys(right).length && Object.entries(left).every(([key, value]) => Object.hasOwn(right, key) && right[key] === value);
+        if (!canonical || !same(homes, canonical.homes) || !same(env, canonical.env) || Object.keys(nativeHome).length !== 2) throw new Error('native-home must contain only the absolute native store and its canonical path selectors');
+        nativeHome = canonical;
+      }
       const refused = withBoard((b) => tx(b, (db) => {
         const row = db.prepare('SELECT r.task_id, r.ended_at, r.metadata, t.current_run_id FROM task_runs r JOIN tasks t ON t.id = r.task_id WHERE r.id = ?').get(runId);
         const saved = json(row?.metadata, {})?.supercode ?? {};
         if (!row || row.task_id !== card || row.ended_at != null || Number(row.current_run_id) !== runId || saved.surface !== 'headless' || !saved.launch_secret
-          || saved.launch_secret !== createHash('sha256').update(launch).digest('hex') || (saved.session_id && saved.session_id !== rest[1])) return `run ${runId} is not a launch this worker holds; nothing was recorded`;
-        engine.setRunSession(db, runId, { ...saved, session_id: rest[1], harness });
+          || saved.launch_secret !== createHash('sha256').update(launch).digest('hex') || (sessionId && saved.session_id && saved.session_id !== sessionId)) return `run ${runId} is not a launch this worker holds; nothing was recorded`;
+        if (nativeHome && saved.native_home && JSON.stringify(saved.native_home) !== JSON.stringify(nativeHome)) return `run ${runId} already names another native home; nothing was recorded`;
+        assertHeadlessBinding(b, card, runId, harness, sessionId ?? saved.session_id ?? null);
+        engine.setRunSession(db, runId, { ...saved, ...(sessionId ? { session_id: sessionId, launch_pending: false } : {}), harness, ...(nativeHome ? { native_home: nativeHome } : {}) });
         return null;
       }));
       if (refused) throw new Error(refused);
-      say(args, `run ${runId}: session ${rest[1]}`, { ok: true }); return 0;
+      say(args, `run ${runId}: ${sessionId ? `session ${sessionId}` : 'native home recorded'}`, { ok: true }); return 0;
     }
     case 'dispatching': {
       // the board's dispatching switch (its owner's controller): `dispatching` says it, `dispatching on|off` sets it
       if (id && !['on', 'off'].includes(id)) throw new Error('dispatching takes on or off');
       // switching it is the manager's: a caller outside any session, or a session the workflow's params.managers names
-      if (id && sid && !withBoard((b) => rolesFor(b.db, '', sid, workflowFor(root).params)).includes('manager')) throw new Error(`switching dispatching is the manager's act; ${callerAddress()} is not a manager of this board (params.managers)`);
+      if (id && sid && !withBoard((b) => rolesFor(b.db, '', sid, workflowFor(root).params)).includes('manager')) {
+        refuseUnreadManager();
+        throw new Error(`switching dispatching is the manager's act; ${callerAddress()} is not a manager of this board (params.managers)`);
+      }
       const state = id ? setDispatching(root, slug, id === 'on', args.reason ?? rest.slice(1).join(' ')) : dispatchingOf(root, slug);
       say(args, `board ${slug}: dispatching ${state.on ? 'on' : 'off'}${state.at ? ` since ${state.at}` : ''}${state.by ? ` by ${state.by}` : ''}${state.reason ? ` (${state.reason})` : ''}`, { board: slug, ...state });
       return 0;
     }
     case 'pause': {
       if (id) {
-        await withBoardAsync((b) => engine.act(b, id, 'pause', { payload: { reason: args.reason ?? rest.slice(1).join(' ') } }));
+        await withBoardAsync((b) => engine.act(b, id, 'pause', { payload: { reason: args.reason ?? rest.slice(1).join(' '), until: args.until } }));
         say(args, `${id} paused`, { ok: true }); return 0;
       }
       // Hermes's emergency stop: new starts stop on every board of the home; running sessions go on
-      writeFileSync(join(root, 'ESTOP'), `${JSON.stringify({ engaged_at: new Date().toISOString(), reason: rest.join(' ') || null })}\n`);
+      writeFileSync(join(root, 'ESTOP'), `${JSON.stringify({ engaged_at: new Date().toISOString(), reason: args.reason ?? (rest.join(' ') || null) })}\n`);
       say(args, `New starts paused (${join(root, 'ESTOP')}); \`supercode workflow resume\` lifts it`, { ok: true, paused: join(root, 'ESTOP') });
       return 0;
     }
+    case 'backlog': case 'plan': {
+      need(1, 'a card id');
+      await withBoardAsync(b => engine.act(b, id, verb, { payload: { reason: args.reason ?? null, ...(args['pause-revision'] ? { pause_revision: args['pause-revision'] } : {}) } }));
+      say(args, `${id} ${verb === 'backlog' ? 'placed in backlog' : 'planned into Todo'}`, { ok: true }); return 0;
+    }
     case 'resume': {
       if (id) {
         await withBoardAsync((b) => engine.act(b, id, 'resume'));
@@ -1368,7 +1556,7 @@ export async function runVerb(argv) {
       const person = args.to ?? (principalOf()?.startsWith('person:') ? principalOf() : null);
       const detached = withBoard(b => {
         const roles = rolesFor(b.db, id, sid, workflowFor(root).params);
-        if (!roles.includes('manager') && !(roles.includes('creator') && principalOf()?.startsWith('person:') && person === principalOf())) throw new Error('Only the manager or the signed-in person who created the card detaches its session.');
+        if (!current().glass && !roles.includes('manager') && !(roles.includes('creator') && principalOf()?.startsWith('person:') && person === principalOf())) throw new Error('Only the manager or the signed-in person who created the card detaches its session.');
         return detachSession(b, id, person);
       });
       say(args, `${id}: ${detached.session.address} belongs to ${detached.person}; the dispatcher no longer owns it`, { ok: true, detached });
@@ -1392,27 +1580,29 @@ export async function runVerb(argv) {
     }
     case 'adopt': {
       need(2, 'a card id and a session');
-      withBoard(b => { if (!rolesFor(b.db, id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
+      // a card's session that broke glass passed this same guard in authorize (its board-verb clause), recorded
+      withBoard(b => { if (!current().glass && !rolesFor(b.db, id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
       if (args.side) {
         withBoard((b) => attachSideSession(b, id, rest[1]));
         say(args, `${rest[1]} is a side session of ${id}: it works ${id}'s subtasks and comments on ${id}; ${id}'s run and state stay its main session's`, { ok: true, side: rest[1] });
         return 0;
       }
-      withBoard((b) => requestAdoption(b, id, rest[1], { workspace: args.workspace ?? null, assignee: args.assignee ?? null, role: args.role ?? null }));
+      await withBoardAsync((b) => requestAdoption(b, id, rest[1], { workspace: args.workspace ?? null, assignee: args.assignee ?? null, role: args.role ?? null }));
       say(args, `${id} is held for ${rest[1]}; the dispatcher verifies and binds it on its next tick (session_adopted, or adoption_failed with the reason)`, { ok: true, requested: rest[1] });
       return 0;
     }
     case 'release': {
       need(2, 'a card id and its side session');
-      withBoard(b => { if (!rolesFor(b.db, id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager releases a side session.'); });
+      withBoard(b => { if (!current().glass && !rolesFor(b.db, id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager releases a side session.'); });
       withBoard((b) => releaseSideSession(b, id, rest[1]));
       say(args, `${rest[1]} is no longer a side session of ${id}`, { ok: true, released: rest[1] });
       return 0;
     }
     case 'goto': {
       need(2, 'a card id and the status to take it to');
-      const { _: _words, root: _r, board: _b, json: _j, at: _a, ...fields } = args;
+      const { _: _words, root: _r, board: _b, json: _j, at: _a, 'break-glass': _g, ...fields } = args;
       const moved = await withBoardAsync((b) => engine.goto(b, id, rest[1], { payload: { ...fields, reason: args.reason ?? (rest.slice(2).join(' ') || null) } }));
+      if (moved.accepted) { say(args, '', null); return 0; }
       say(args, moved.event ? `${id} → ${moved.to} (${moved.event.replace(/_/g, '-')})` : `${id} is already ${moved.to}`, { ok: true, ...moved }); return 0;
     }
     case 'close': {
@@ -1426,11 +1616,8 @@ export async function runVerb(argv) {
       // any other event the board's workflow declares is a verb of its own: `<event> <id>... [reason] [--<field> value]`,
       // the flags its payload (the doors a session is told name these)
       const name = verb.replace(/-/g, '_');
-      const { workflow } = workflowFor(root);
-      const declared = Object.values(workflow.statuses).some((s) => s.on?.[name]) || Boolean(workflow.on?.[name] || workflow.verbs?.[name] || workflow.run?.on?.[name]);
-      if (!declared) throw new Error(`no workflow verb ${verb}; \`supercode workflow help\` lists them`);
       need(1, 'a card id');
-      const { _: _words, root: _r, board: _b, json: _j, at: _a, ids: _i, ...fields } = args;
+      const { _: _words, root: _r, board: _b, json: _j, at: _a, 'break-glass': _g, ids: _i, ...fields } = args;
       const payload = { ...fields, reviewed_sha: args['reviewed-sha'] ?? fields.reviewed_sha, pr_head: args['pr-head'] ?? fields.pr_head, waiting_on: args['waiting-on'] ?? fields.waiting_on, reason: args.reason ?? (name === 'request_state' ? null : rest.slice(1).join(' ') || null) };
       const results = [];
       if (name === 'request_state') results.push(...await withBoardAsync(board => engine.requestStateMany(board, [...rest, ...(args.ids ?? [])], payload)));
@@ -1553,13 +1740,17 @@ function scrub(db) {
 // Only the transfer copy is lowered. Keep supercode_cards.paused (actor/reason)
 // and add Hermes's ordinary blocked event so its own tools can explain/unblock it.
 function lowerHermesHolds(db) {
-  const rows = db.prepare(`SELECT t.id,c.paused FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id
-    WHERE t.status = 'paused' OR (t.status NOT IN ('done','archived','cancelled') AND c.paused IS NOT NULL AND c.paused != 'null')`).all();
+  const rows = db.prepare(`SELECT t.id,c.paused,c.backlog FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id
+    WHERE t.status = 'paused' OR (t.status NOT IN ('done','archived','cancelled') AND (
+      (c.paused IS NOT NULL AND c.paused != 'null') OR (c.backlog IS NOT NULL AND c.backlog != 'null')))` ).all();
   for (const row of rows) {
     const pause = json(row.paused, {}) ?? {};
+    const backlog = json(row.backlog, null);
     db.prepare("UPDATE tasks SET status='blocked',block_kind='needs_input' WHERE id=?").run(row.id);
     db.prepare('INSERT INTO task_events(task_id,kind,payload,created_at) VALUES (?,?,?,?)').run(row.id, 'blocked',
-      JSON.stringify({ kind: 'needs_input', reason: pause.reason ?? 'Paused on the native board', by: pause.by ?? null, source: 'native_pause_export' }), now());
+      JSON.stringify({ kind: 'needs_input', reason: backlog?.reason ?? pause.reason ?? 'Paused on the native board', by: backlog?.by ?? pause.by ?? null,
+        source: backlog ? 'native_backlog_export' : 'native_pause_export', loss: ['backlog and bounded pause are native flags; Hermes receives a needs_input block'],
+        native: { paused: json(row.paused, null), backlog } }), now());
   }
 }
 
@@ -1720,33 +1911,55 @@ function ownCards(db, sessionId) {
 
 const READS = new Set(['list', 'ls', 'show', 'context', 'brief', 'runs', 'log', 'tail', 'watch', 'stats', 'assignees', 'diagnostics', 'diag', 'attachments', 'attachment-read', 'github-usage', 'notify-list', 'capacity', 'help', 'init']);
 
-/** The main session of each agent the workflow names a manager (`sc:<machine>:agent:<name>`), asked of this machine's
+/** The main session of each agent the workflow names a manager (`sc:<machine>:agent:<name>`), asked of that machine's
  *  daemon, which keeps agents' records (mail step 1c), once per call before its verb runs: a manager named by its agent
- *  address is that agent's main session on the board. Only a positive not-declared answer means no main; an unread
- *  identity stops the call before authorization, rather than denying a role it could not establish. */
+ *  address is that agent's main session on the board. Only a positive not-declared answer means no main. An unread
+ *  manager identity decides nothing: it is recorded for this call, unread, and the caller's roles from its own run, its
+ *  creator record or its arc are computed without it. A call those roles allow proceeds; only a call that would be
+ *  refused for want of a role, asked by a session that might be that manager, stops with `manager_identity_unavailable`
+ *  (call.mjs refuseUnreadManager), and is never granted by guess. */
 async function readAgentMains(root) {
   // A lookup belongs to this call, including a refusal. A startup miss must not become the resident owner's
   // permanent answer, and a replacement main must revoke the old main's manager role on the next call.
-  const agentMains = current().agentMains = new Map();
+  const call = current(), agentMains = call.agentMains;
   const managers = [(await loadWorkflow(root).catch(() => null))?.params?.managers ?? []].flat().map(String);
-  for (const address of managers) {
-    const name = /^sc:[^:\s]+:agent:([^:\s]+)$/.exec(address)?.[1];
-    if (!name || agentMains.has(address)) continue;
-    try {
-      const answer = await machineCall(null, 'harness.v1.agent.show', { name, records_only: true, claim: { pid: process.pid, ppid: process.ppid, session: null, named: null, owner: null } }, { timeoutMs: 5_000 });
-      // EXIT_UNKNOWN is the daemon's explicit answer that this named agent is not declared.
-      if (answer?.code === 3) { agentMains.set(address, null); continue; }
-      const agent = answer?.agents?.[0];
-      if (answer?.code !== 0 || answer.agents?.length !== 1 || agent?.name !== name ||
-          typeof agent.main_session !== 'string' || !/^sc:[^:\s]+:[^:\s]+:[^:\s]+$/.test(agent.main_session))
-        throw new Error(answer?.text ?? 'the daemon returned no valid named agent and main session');
-      agentMains.set(address, agent.main_session);
-    } catch (cause) {
-      throw Object.assign(new Error(`Could not read who the caller is: manager ${address} could not be looked up (${cause.message ?? cause}). No role decision was made.`, { cause }), { code: 'manager_identity_unavailable' });
-    }
-  }
+  call.managerDeadline ??= performance.now() + 5_000;
+  await Promise.all([...new Set(managers)].map(async address => {
+    const matched = /^sc:([^:\s]+):agent:([^:\s]+)$/.exec(address);
+    if (!matched || agentMains.has(address)) return agentMains.get(address);
+    const [, machine, name] = matched;
+    const local = normalMachine(machine) === localMachine();
+    const reading = (async () => {
+      try {
+        const timeoutMs = call.managerDeadline - performance.now();
+        if (timeoutMs <= 0) throw new Error('the call\'s manager identity allowance expired before this lookup');
+        const answer = await machineCall(local ? null : machine, 'harness.v1.agent.show', { name, records_only: true,
+          ...(local ? { claim: { pid: process.pid, ppid: process.ppid, session: null, named: null, owner: null } } : {}) }, { timeoutMs });
+        // EXIT_UNKNOWN is the daemon's explicit answer that this named agent is not declared.
+        if (answer?.code === 3) return null;
+        const agent = answer?.agents?.[0];
+        if (answer?.code !== 0 || answer.agents?.length !== 1 || agent?.name !== name ||
+            typeof agent.main_session !== 'string' || !/^sc:[^:\s]+:[^:\s]+:[^:\s]+$/.test(agent.main_session))
+          throw new Error(answer?.text ?? 'the daemon returned no valid named agent and main session');
+        return agent.main_session;
+      } catch (cause) {
+        // a caller outside any session is no agent's main, so an unread main cannot be its identity
+        if (callerSession()) call.managerUnread ??= Object.assign(new Error(`Could not read who the caller is: manager ${address} could not be looked up (${cause.message ?? cause}). No role decision was made.`, { cause }), { code: 'manager_identity_unavailable' });
+        return UNREAD;
+      }
+    })();
+    agentMains.set(address, reading);
+    agentMains.set(address, await reading);
+  }));
+}
+const UNREAD = Object.freeze({ unread: true });
+// an unread main is no main for granting: it names no session
+function agentMain(address) { const main = current().agentMains.get(address); return typeof main === 'string' ? main : null; }
+
+function managerSession(sessionId, params = {}, resolved = true) {
+  const managers = Array.isArray(params.managers) ? params.managers.map(String) : [];
+  return managers.some(m => m === sessionId || m.endsWith(`:${sessionId}`) || (resolved && agentMain(m)?.endsWith(`:${sessionId}`)));
 }
-function agentMain(address) { return current().agentMains.get(address) ?? null; }
 
 /**
  * Who a caller is on card `cardId`, in the workflow's roles: a signed-in terminal person retains their creator role;
@@ -1756,8 +1969,7 @@ function agentMain(address) { return current().agentMains.get(address) ?? null;
  */
 function rolesFor(db, cardId, sessionId, params = {}) {
   // a session the workflow names as the board's manager (params.managers: its addresses) is the manager on every card
-  const managers = Array.isArray(params.managers) ? params.managers.map(String) : [];
-  if (managers.some((m) => m === sessionId || m.endsWith(`:${sessionId}`) || agentMain(m)?.endsWith(`:${sessionId}`))) return ['manager'];
+  if (managerSession(sessionId, params)) return ['manager'];
   const task = engine.getTask(db, cardId);
   if (!task) return [];
   const roles = [];
@@ -1768,36 +1980,54 @@ function rolesFor(db, cardId, sessionId, params = {}) {
   if (current?.session_id === sessionId) roles.push(current.role ?? 'implementer');
   else if (engine.lastSession(db, cardId)?.session_id === sessionId) roles.push('implementer');
   if (task.subtask_of) {
+    // the arc's working session stays its own while another run (its reviewer's) holds the arc, so it still closes the
+    // arc's subtasks, whoever filed them (a reviewer's finding included)
     const parent = engine.getTask(db, task.subtask_of);
-    const worker = parent?.current_run_id ? engine.currentRun(db, parent.id)?.metadata?.supercode : engine.lastSession(db, task.subtask_of);
-    if (worker?.session_id === sessionId || sideSessions(db, task.subtask_of).some((s) => s.session === sessionId)) roles.push('arc');
+    const running = parent?.current_run_id ? engine.currentRun(db, parent.id)?.metadata?.supercode : null;
+    const working = running?.session_id === sessionId || engine.lastSession(db, task.subtask_of)?.session_id === sessionId;
+    if (working || sideSessions(db, task.subtask_of).some((s) => s.session === sessionId)) roles.push('arc');
   }
   return roles;
 }
 
+/** The same card-scope guard for an ordinary write and local service admission. Manager authority is resolved by
+ * each caller before it applies this refusal; a service can first discover that no such authority is needed. */
+function scopedSessionGuard(board, { root, slug, verb, rest, args, sid }) {
+  const own = { ...ownCards(board.db, sid), side: sideArcs(board.db, sid) };
+  if (!own.worked.size && !own.side.size) return null;
+  const copyServe = isServiceVerb(verb) && Boolean(boardCopyOf(board)) && listBoards(root).every(board => !dispatchingOf(root, board).on);
+  const refused = authorize(board.db, verb, rest, args, own, { copyServe });
+  return refused.length ? { refused, scope: { verb, args, own, slug, sid } } : null;
+}
+
 /**
  * What a session that works a card, or is a side session of an arc (`own.side`), may name: its own cards and their
  * subtasks, and the subtasks of the arcs it is a side session of, and those arcs themselves only to comment on. What it
- * may do to them is the workflow's (rolesFor).
+ * may do to them is the workflow's (rolesFor). Answers every guard the write passes outside that, each as
+ * `{ why, card }` (the card it names, or null for a board verb); none is an ordinary write. A guarded write is not
+ * forbidden: given on purpose with a reason it goes ahead and is recorded (breakGlassOrRefuse).
  */
-function authorize(db, verb, rest, args, own, { copyServe = false } = {}) {
+function authorize(db, verb, rest, args, own, { copyServe }) {
   const cards = [...new Set([...own.worked, ...own.side])];
-  const named = cards.join(', ');
-  const refuse = (why) => { throw new Error(`the session working ${named} ${why}`); };
-  if (verb === 'serve' && copyServe) return;
+  const refused = [];
+  const refuse = (why, card = null) => { if (!refused.some((r) => r.why === why)) refused.push({ why, card }); };
+  if (copyServe) return refused;
   if (verb === 'create') {
-    if (!own.worked.has(args['subtask-of']) && !own.side.has(args['subtask-of'])) refuse(`files subtasks of its own card only (--subtask-of ${cards.join(' or ')})`);
-    return;
+    // a subtask of its own card's subtask is inside its card: the engine answers it (subtasks are one level deep), not this guard
+    const named = args['subtask-of'] ? engine.getTask(db, args['subtask-of']) : null;
+    const ownArc = (id) => own.worked.has(id) || own.side.has(id);
+    if (!ownArc(args['subtask-of']) && !(named?.subtask_of && ownArc(named.subtask_of))) refuse(`files subtasks of its own card only (--subtask-of ${cards.join(' or ')})`, args['subtask-of'] ?? null);
+    return refused;
   }
-  if (verb === 'boards') { if (!['list', 'ls', 'show', 'current', undefined].includes(rest[0])) refuse('does not change the home\'s boards'); return; }
+  if (verb === 'boards') { if (!['list', 'ls', 'show', 'current', undefined].includes(rest[0])) refuse('does not change the home\'s boards'); return refused; }
   // verbs that act on the board rather than on a card are the manager's and the board's, never a card's session's
   // (what a session may do to a card is its workflow's: each transition's `by`)
-  if ((['pause', 'resume'].includes(verb) && !rest[0]) || ['swarm', 'dispatch', 'daemon', 'serve', 'gc', 'compact', 'repair', 'adopt', 'release', 'detach', 'close', 'claim', 'attach-rm', 'migrate'].includes(verb)) refuse(`does not ${verb}; the fleet's manager does`);
-  if (verb === 'set' && !(own.worked.has(rest[0]) && rest[1] === 'every')) refuse("sets only Every on its own auditor card; other properties are the manager's");
+  if ((['pause', 'resume'].includes(verb) && !rest[0]) || ['swarm', 'dispatch', 'daemon', 'serve', 'gc', 'compact', 'repair', 'adopt', 'release', 'detach', 'close', 'claim', 'attach-rm', 'migrate'].includes(verb)) refuse(`does not ${verb}; the fleet's manager does`, rest[0] ?? null);
+  if (verb === 'set' && !(own.worked.has(rest[0]) && rest[1] === 'every')) refuse("sets only Every on its own auditor card; other properties are the manager's", rest[0] ?? null);
   if (args.all) refuse(`does not ${verb} every card; only its own`);
   if (['notify-subscribe', 'notify-unsubscribe'].includes(verb) && args['for-card']) {
-    if (!own.worked.has(args['for-card'])) refuse(`subscribes only its own arc (--for-card ${[...own.worked].join(' or ')})`);
-    return;
+    if (!own.worked.has(args['for-card'])) refuse(`subscribes only its own arc (--for-card ${[...own.worked].join(' or ')})`, args['for-card']);
+    return refused;
   }
   const targets = verb === 'request-state' ? [...rest, ...(args.ids ?? [])] : [rest[0], ...(args.ids ?? [])];
   for (const target of targets) {
@@ -1807,9 +2037,62 @@ function authorize(db, verb, rest, args, own, { copyServe = false } = {}) {
     if (verb === 'comment' && isLatestReviewer(db, card.id, actorOf())) continue;
     // the card it names is the one it addresses: any card it holds, or a subtask of one it works
     // a side session names its arc only to comment on it; the arc's other verbs are its main session's
-    if (own.side.has(card.id) && !own.held.has(card.id) && verb !== 'comment') refuse(`only comments on ${card.id}, which it is a side session of; the arc's other verbs are its main session's and the manager's`);
-    if (!own.held.has(card.id) && !own.worked.has(card.subtask_of) && !own.side.has(card.id) && !own.side.has(card.subtask_of)) refuse(`writes only its own card${cards.length > 1 ? 's' : ''} and ${cards.length > 1 ? 'their' : 'its'} subtasks, not ${card.id}`);
+    if (own.side.has(card.id) && !own.held.has(card.id) && verb !== 'comment') refuse(`only comments on ${card.id}, which it is a side session of; the arc's other verbs are its main session's and the manager's`, card.id);
+    if (!own.held.has(card.id) && !own.worked.has(card.subtask_of) && !own.side.has(card.id) && !own.side.has(card.subtask_of)) refuse(`writes only its own card${cards.length > 1 ? 's' : ''} and ${cards.length > 1 ? 'their' : 'its'} subtasks, not ${card.id}`, card.id);
+  }
+  return refused;
+}
+
+/** Why a card's session's writes outside its own card are guarded, said with every refusal (owner, VO-3793: "the
+ *  purpose of this is to prevent the agents from adopting bad behaviors - so what we should do is allow it to be done
+ *  but require a reason flag and if that's not provided we complain instead of doing it - explaining why"). */
+const OUTSIDE_OWN_CARD = 'A card\'s session reports to the fleet\'s manager and writes its own card; a write outside it is '
+  + 'reserved so agents do not drift into the habit of steering other cards and the board around the manager. If this write '
+  + 'is needed, repeat it on purpose with --break-glass "<why it is needed>": this guard then lets it through and records it '
+  + 'with this session, what it wrote and the reason. The workflow\'s own rules for who may make each transition still apply.';
+
+/**
+ * A card's session's write that authorize() guards: with `--break-glass "<reason>"` it passes this guard (and the
+ * manager checks adopt, release and detach repeat), recorded as one entry in the machine's break-glass journal
+ * (@volter/teams/break-glass, the record every other supercode guard's deliberate act keeps) naming the session, the
+ * cards or verb it wrote outside its own card, every guard it passed and the reason. Answers that entry; runVerb follows
+ * it with what became of the act when it was not simply done. Without a reason nothing is written, and the refusal
+ * says what was refused, why that write is guarded and how to give the reason. An empty reason is no reason; the flag
+ * alone opens it, never an inherited environment variable. The workflow's `by` roles are not this guard: a transition
+ * they refuse is refused whatever the reason.
+ */
+function breakGlassOrRefuse(refused, { verb, args, own, slug, sid }) {
+  const named = [...new Set([...own.worked, ...own.side])].join(', ');
+  const guards = refused.map((r) => `the session working ${named} ${r.why}`);
+  const given = typeof args['break-glass'] === 'string' ? args['break-glass'].trim() : '';
+  if (!given) {
+    refuseUnreadManager();
+    throw guardRefusal(`the session working ${named} ${refused.map((r) => r.why).join('; ')}. Nothing was done`, { refused: refused.map((r) => r.why) }, OUTSIDE_OWN_CARD);
   }
+  const reason = breakGlassReason(given, {});
+  const cards = [...new Set(refused.map((r) => r.card).filter(Boolean))];
+  // the journal is this machine's; the agent is the caller's own (its facts), never the board owner's environment
+  const env = { ...process.env };
+  delete env.SUPERCODE_AGENT_ID;
+  const entry = recordBreakGlass({ act: `workflow ${verb}${cards.length ? ` ${cards.join(' ')}` : ''}`,
+    actor: { agent: current().facts?.SUPERCODE_AGENT_ID || null, session: callerAddress() ?? sid },
+    actedFor: cards.length === 1 ? { kind: 'card', id: cards[0] } : cards.length ? { kind: 'cards', id: cards.join(',') } : { kind: 'board', id: slug },
+    reason, detail: { board: slug, own_cards: named, guards } }, { env, stderr: { write: (text) => current().err(text) } });
+  return { entry, env, created: null };
+}
+
+/** What became of a break-glass act, appended to its journal entry's file: refused or failed (with why), or for a card
+ *  filed through it, done with the card's id. An act simply done adds nothing. */
+function followBreakGlass({ entry, env, created }, failure, code) {
+  const outcome = failure
+    ? (failure.code === 'forbidden' || /\bonly\b[^.]*\b(?:manager|implementer|creator|reviewer)|not authori[sz]ed|may not/i.test(failure.message ?? '') ? 'refused' : 'failed')
+    : code ? 'failed' : 'done';
+  if (outcome === 'done' && !created) return;
+  const follow = { at: new Date().toISOString(), follows: entry.at, act: entry.act, actor: entry.actor, acted_for: entry.acted_for, outcome,
+    ...(failure ? { error: String(failure.message ?? failure).slice(0, 500) } : code ? { exit: code } : {}), ...(created ? { created } : {}) };
+  try { appendFileSync(breakGlassLog(env), `${JSON.stringify(follow)}\n`, { mode: 0o600 }); }
+  catch (error) { current().err(`supercode: break glass: the outcome of ${entry.act} (${outcome}) could not be recorded: ${error.message}\n`); }
+  if (outcome !== 'done') current().err(`supercode: break glass: ${entry.act} was ${outcome}; recorded in ${breakGlassLog(env)}\n`);
 }
 
 /** Close the live sessions of a card that is not running (its worker's and its reviewers'), freeing its machine's place. */
@@ -1877,7 +2160,11 @@ async function answerVerbs(root, log) {
   // naming the lock or socket as its input is refused (owner-files.mjs)
   let lock;
   try { lock = await holdLock(lockPath, { onLost: (error) => { log(`${error.message}: this home has no owner now; stopping`); process.exit(1); } }); }
-  catch (error) { throw new Error(`the boards of ${root} already have their owner (${lockPath} is held: ${error.message}); one serve per home`); }
+  catch (error) {
+    if (error?.code !== 'EHELD') throw new Error(`the boards of ${root} cannot be owned: ${lockPath} could not be locked (${error.message})`, { cause: error });
+    throw new Error(`the boards of ${root} already have their owner (${lockPath} is held: ${error.message}); one serve per home`);
+  }
+  try {
   ownHome(home);
   // the lock held, this owner takes its fencing epoch and fences every board, before it answers anything (fence.mjs)
   const epoch = takeEpoch(root, () => listBoards(root).map((slug) => openBoard(root, slug)));
@@ -1888,11 +2175,21 @@ async function answerVerbs(root, log) {
   log(`owner epoch ${epoch}`);
   const path = boardOwnerSocket(root);
   try { unlinkSync(path); } catch { /* none left */ }
-  let closeDoor;
-  try { closeDoor = await openOwnerDoor(root, { machine: localMachine(), answer: (line) => answerOne(root, line), log }); }
-  catch (error) { lock.release(); throw error; }
+  const closeDoor = await openOwnerDoor(root, { machine: localMachine(), answer: (line) => answerOne(root, line), log });
   log(`answering the card verbs of ${root} at ${path}`);
-  return () => { closeDoor(); try { unlinkSync(path); } catch { /* gone */ } lock.release(); };
+  let closing;
+  return () => closing ??= (async () => {
+    const errors = [];
+    try { await closeDoor(); } catch (error) { errors.push(error); }
+    try { unlinkSync(path); } catch (error) { if (error.code !== 'ENOENT') errors.push(error); }
+    try { await lock.release(); } catch (error) { errors.push(error); }
+    if (errors.length) throw new AggregateError(errors, 'board command door shutdown failed', { cause: errors[0] });
+  })();
+  } catch (error) {
+    try { await lock.release(); }
+    catch (cleanup) { throw new AggregateError([error, cleanup], 'board door startup and lock cleanup failed', { cause: error }); }
+    throw error;
+  }
 }
 
 /** One request's own steps and the separate process activity during its wait.
@@ -1904,6 +2201,7 @@ export async function answerOne(root, line, { readOnly = false } = {}) {
 }
 
 async function answerOneAdmitted(root, line, { readOnly = false } = {}) {
+    return measureWork("door", "board.command", async () => {
   const scoped = typeof slowLog.withStepScope === 'function';
   // The owner's receipt includes asynchronous custody preparation too: it is part of the caller's wait.
   const began = performance.now(), before = slowLog.processCounters?.() ?? null;
@@ -1945,7 +2243,10 @@ async function answerOneAdmitted(root, line, { readOnly = false } = {}) {
     }
   };
   return scoped ? slowLog.withStepScope(guarded) : guarded();
-}
+
+
+    });
+  }
 
 /** One request answered in a call of its own; on the read door (`readOnly`) a listing only, and `{ byOwner: true }` for
  *  one the owner is to answer (listing.mjs byOwner). */
@@ -1955,22 +2256,43 @@ async function answerRequest(root, line, naming, { readOnly = false } = {}) {
     const tool = request?.tool && typeof request.tool.name === 'string' ? request.tool : null;
     const argv = tool ? ['tool'] : Array.isArray(request?.argv) && request.argv.every((arg) => typeof arg === 'string') ? request.argv : null;
     if (request?.v !== 1 || !argv?.length) return { code: 1, stdout: '', stderr: 'supercode workflow: a request names a verb\n' };
-    const verb = parse(argv)._[0];
+    const args = parse(argv, { contextOnly: true }), verb = args._[0];
     if (readOnly && (tool || !['list', 'ls'].includes(verb))) return { byOwner: true };
-    if (BOARD_OPERATION_VERBS.has(verb)) return { code: 1, stdout: '', stderr: `supercode workflow: ${verb} is run on the board's machine as its own act, not sent to the owner\n` };
     const session = request.session && typeof request.session.id === 'string' && ['claude-code', 'codex'].includes(request.session.harness) ? request.session : null;
     const caller = typeof request.caller === 'string' ? request.caller : session ? `sc:${localMachine()}:${session.harness}:${session.id}` : null;
     naming(tool ? `tool ${tool.name}` : verb, caller);
     const facts = Object.fromEntries(Object.entries(request.facts ?? {}).filter(([key, value]) => CALLER_FACTS.includes(key) && typeof value === 'string'));
-    // a caller names its Teams context (the CLI and the daemon always do): one that names none is refused before anything
-    // is done, never answered with the owner's
-    if (!facts.SUPERCODE_CONTEXT) return { code: 1, stdout: '', stderr: 'supercode workflow: the request names no Teams context (facts.SUPERCODE_CONTEXT); nothing was done\n' };
+    // Route a contextless request under its own caller, without borrowing the owner's context.
     const cwd = typeof request.cwd === 'string' && request.cwd ? request.cwd : root;
     const stdin = typeof request.stdin === 'string' ? request.stdin : null;
     const stdout = [];
     const stderr = [];
     let code, byOwner = false;
     await within({ caller, facts, cwd, stdin, readOnly, out: (text) => { stdout.push(text); return true; }, err: (text) => { stderr.push(text); return true; } }, async () => {
+      if (!tool && isServiceVerb(verb)) {
+        let malformed;
+        try { parse(argv); } catch (error) { malformed = error; }
+        if (!malformed) throw localServiceDoorError();
+        const named = typeof request.board === 'string' && request.board ? request.board : boardOf(root, {});
+        current().boardCommand = { root, slug: named };
+        code = await retainUnappliedRequest(argv, malformed);
+        return;
+      }
+      const ownerOperation = BOARD_OPERATION_VERBS.has(verb) && !(verb === 'dispatch' && args['dry-run']);
+      if (!facts.SUPERCODE_CONTEXT || ownerOperation) {
+        if (readOnly) { byOwner = true; return; }
+        await loadWorkflow(root);
+        const named = typeof request.board === 'string' && request.board ? request.board : DEFAULT_BOARD;
+        const board = openBoard(root, isView(root, named) ? DEFAULT_BOARD : named);
+        try {
+          setActor(caller ?? 'unresolved board caller');
+          await engine.routeRequest(board, { name: tool?.name ?? verb, payload: tool ? { tool, argv } : { argv }, reason: ownerOperation
+            ? 'This operation needs the board machine to settle its running owner before it can act.'
+            : 'The caller context needs to be resolved before the requested act can run.' });
+          say(args, '', null); code = 0;
+        } finally { board.close(); }
+        return;
+      }
       // a worker's board tool (mcp/server.mjs), answered by the board's tools in this call (board/tools.mjs)
       if (tool) { stdout.push(await boardTool(root, tool.name, tool.args && typeof tool.args === 'object' ? tool.args : {}, Object.fromEntries(Object.entries(tool.env ?? {}).filter(([key, value]) => /^HERMES_(KANBAN_TASK|KANBAN_RUN_ID|KANBAN_BOARD|PROFILE)$/.test(key) && typeof value === 'string')))); code = 0; return; }
       try { code = await runVerb([...argv, '--root', root, ...(typeof request.board === 'string' && request.board ? ['--board', request.board] : [])]); }
@@ -1988,32 +2310,59 @@ async function answerRequest(root, line, naming, { readOnly = false } = {}) {
 
 // Prepared children import and read their declarations without writer authority. Activation and parking are ordered
 // on one control chain, so a late park acknowledgement can never park a generation after rollback resumed it.
-export async function serveBoardGeneration(root, args = {}, argv = ['serve', '--root', root]) {
+export async function serveBoardGeneration(root, argv) {
   if (!inBoardGeneration) throw new Error('a board generation requires its stable owner IPC connection');
+  const args = parse(argv);
+  assertSourceReceipt(args);
+  if (!['serve', 'daemon'].includes(args._[0]) || homeOf(args) !== root)
+    throw new Error('a board generation starts only its stable owner\'s admitted home');
+  // Watch before the preparatory read and keep that watch across activation. The serving loop attaches its own
+  // callbacks to this same watch, so its first stats read reuses the prepared home unless an actual file changed.
+  const unfollow = followHome(root, { onLost: error => {
+    process.stderr.write(`board generation: the home's files can no longer be watched (${error.message})\n`);
+    process.exit(1);
+  } });
+  try { return await serveWatchedBoardGeneration(root, args); }
+  finally { unfollow(); }
+}
+
+async function serveWatchedBoardGeneration(root, args) {
   // The direct parent has already resolved the machine identity. An unavailable daemon must not consume a second
   // fifteen-second lookup before this child can report preparation through its eight-second owner door.
   await knowLocalMachine(process.env.SUPERCODE_BOARD_GENERATION_MACHINE);
   // readHome owns an SDK transport startup and one orchestration.load, each with its existing 30-second bound.
   tellOwner({ type: 'startup-step', step: 'reading the home through its orchestration door', budget_ms: 65000 });
   await readHome(root);
+  const restingAdmission = await prepareBoardRestingAdmission(root);
   tellOwner({ type: 'startup-step', step: 'reading board storage without writer authority', budget_ms: 8000 });
+  // These substeps name the work inside the same eight-second preparation boundary. They carry no budget,
+  // so progress cannot re-arm that boundary and turn one bounded read into several allowances.
+  const preparedStep = (step, began) => {
+    const ms = performance.now() - began;
+    noteStep(`board preparation: ${step}`, ms);
+    process.stdout.write(`${new Date().toISOString()} board generation ${process.pid}: preparation: ${step} ${Math.round(ms)}ms\n`);
+  };
   await within({ cwd: root, readOnly: true, out: () => {}, err: () => {} }, async () => {
     for (const slug of listBoards(root)) {
+      const step = `reading board ${slug} storage without writer authority`, began = performance.now();
+      tellOwner({ type: 'startup-step', step });
       let board;
       try { board = openBoard(root, slug); board.db.prepare('SELECT 1').get(); }
       catch (error) { if (error?.code !== READ_BY_OWNER) throw error; }
-      finally { board?.close(); }
+      finally { try { board?.close(); } finally { preparedStep(step, began); } }
     }
   });
   // Hermes's install is located once per process (hermes-cli.mjs), a read of PATH and its files: here, before this
   // generation is prepared, so its activation does not spend it while the public door routes nowhere.
+  const hermesBegan = performance.now();
+  tellOwner({ type: 'startup-step', step: 'locating Hermes for this board generation' });
   try { (await import('../hermes-cli.mjs')).hermesInstall(); } catch { /* none installed */ }
+  finally { preparedStep('locating Hermes for this board generation', hermesBegan); }
   // Each activation and park step in the owner's log (the generation's output is that log), so a reading accounts
   // for every second the public door routes nowhere (ADR 0080, "Board ownership").
   const say = text => process.stdout.write(`${new Date().toISOString()} board generation ${process.pid}: ${text}\n`);
   let begin, started = false, controls = Promise.resolve();
   const activation = new Promise(done => { begin = done; });
-  const unwatchHealth = watchOwnerHealth(value => tellOwner({ type: 'health', ...value }));
   const unwatchWorkflow = watchWorkflows((at, { workflow, params, profiles }) => tellOwner({ type: 'workflow', root: at, entry: { workflow, params, profiles } }));
   const receive = frame => {
     if (frame?.type === 'request') {
@@ -2051,7 +2400,9 @@ export async function serveBoardGeneration(root, args = {}, argv = ['serve', '--
         tellOwner({ type: 'parked' });
         say('park: parked');
       } else {
+        restingAdmission.preflight();
         grantGenerationWriter();
+        await restingAdmission.activateWriter();
         if (!started) {
           say('activation: the writer granted; the native board dispatcher starts');
           tellOwner({ type: 'startup-step', phase: 'serving', step: 'starting the native board dispatcher', budget_ms: 65000 });
@@ -2076,15 +2427,21 @@ export async function serveBoardGeneration(root, args = {}, argv = ['serve', '--
   process.on('message', receive); process.once('disconnect', disconnected);
   // A transition cannot restore database files over committed card writes: retained generations must write the same
   // storage format (storage-contract.mjs), and a format change waits for a compatible migration with its own protocol.
-  tellOwner({ type: 'prepared', ...storageContract() });
-  try { await activation; return await runVerb(argv); }
-  finally { process.off('message', receive); process.off('disconnect', disconnected); unwatchHealth(); unwatchWorkflow(); }
+  const contractBegan = performance.now();
+  tellOwner({ type: 'startup-step', step: 'computing the board storage contract' });
+  let contract;
+  try { contract = storageContract({ restingAdmission: restingAdmission.firstReader ? 'first-reader' : restingAdmission.compatible ? 'compatible-reader' : 'legacy-reader' }); }
+  finally { preparedStep('computing the board storage contract', contractBegan); }
+  tellOwner({ type: 'prepared', ...contract, ...restingAdmission.contract });
+  try { await activation; await loadWorkflow(root); return await serve(root, args); }
+  finally { process.off('message', receive); process.off('disconnect', disconnected); unwatchWorkflow(); }
 }
 
 let generationServingDue = true;
 let wakeGeneration = () => {};
 let registerGenerationOwner = async () => {};
-async function serve(root, args = {}) {
+async function serve(root, args) {
+  registerWorkService({role:'board-generation',scope:{kind:'install',id:root}});
   // Hermes's daemon flags: --interval seconds, --max starts per tick, --failure-limit, --pidfile, --verbose
   const override = Number(args.interval) > 0 ? { interval: Number(args.interval) } : {};
   // --max and --failure-limit are params of every tick, read by the workflow as its own
@@ -2117,7 +2474,7 @@ async function serve(root, args = {}) {
   const watchRounds = async (reports, began) => {
     if (reports.every((r) => !r.error)) {
       // A publication the team refused holds this home's publishing where it is (nothing after it is skipped): a fact of
-      // the same kind as rounds that stopped, so it goes where every board verb's error line reads it. Only a refusal
+      // the same kind as rounds that stopped, so it goes to the held dispatcher diagnostics. Only a refusal
       // in hand counts: the team's 4xx answer, which the daemon records with the publication (from supercode-teams
       // 0.3.44). An attempt still being retried, or a daemon that records no answer, says nothing here.
       const held = (await boardPublishing(root))?.failing;
@@ -2184,7 +2541,8 @@ async function serve(root, args = {}) {
   const boardMailboxes = () => ['default', ...(existsSync(join(root, 'kanban', 'boards')) ? readdirSync(join(root, 'kanban', 'boards')) : [])].map((slug) => boardAddress(boardLabel(root, slug)));
   // Installed daemons bound an ordinary node request at 30s: finish a quiet poll before that server deadline.
   const mailWaiter = async () => (await machineCall(null, 'harness.v1.mail.board_wait', { boards: boardMailboxes(), timeout: 20 }, { timeoutMs: 90_000 }))?.woken ?? [];
-  events = watchBoard({ root, binary: supercodeBin(), env: commandEnv(), log, mailWaiter, onEvent: (key, { uncertain = false, watched, id, board = null } = {}) => {
+  events = watchBoard({ root, binary: supercodeBin(), env: commandEnv(), log, mailWaiter,
+    ownWrite: (key, board, path) => Boolean(board) && ownBoardWrite(root, board, key, path), onEvent: (key, { uncertain = false, watched, id, board = null } = {}) => {
     if (key === 'board-registry') { retireHeldBoards(); refreshNow(); return; }
     if (key === 'board-config') {
       if (watched !== undefined && board) heldConfigWatched(board, id ?? key, watched);
@@ -2214,18 +2572,43 @@ async function serve(root, args = {}) {
   // lock. It names it again to each daemon that starts while it serves: the owner a restarted daemon restores from its
   // file stands only if the kernel probe at its start agreed, and an owner it dropped lost the board's authority over the
   // panes the board launched (a close refused as "not started by this command").
-  const registerOwner = async () => {
-    let named = null, refusal = null;
-    try { named = await machineCall(null, 'harness.v1.boards.register', { root, claim: { pid: process.pid, ppid: process.ppid } }, { timeoutMs: inBoardGeneration ? 2000 : 30_000 }); } catch (error) { refusal = error.message; }
+  // A registration that did not land is made again on a later round until one does (registerDue), as an owner the
+  // daemon never took has every board close refused, final: the daemon read nothing of who is registering (`unavailable`:
+  // its peer proof or lock reading did not answer; the home is published, no owner taken), this call's own bound ended
+  // first (REQUEST_TIMEOUT, 504: a generation waits 2 s, under the daemon's 5 s proofs, so whether it took the owner is not
+  // known), no daemon answered (machine_offline, ECONNRESET), or the daemon was not serving yet (503: preparing its mail
+  // at its start, or stopping, as on the reopen after a restart), or it answered but took no owner (`owner: false`: its
+  // proof read the lock and found this process not holding it). An answer that says nothing of an owner (where the
+  // daemon cannot read the lock or prove the peer, as on Windows) is taken as it always was, and never asked again for
+  // that. Any other refusal lasts and is not asked again until the daemon reopens. A retry waits first (registerAt),
+  // 15 s doubling to 5 min, and the wait resets when one lands: a retry under
+  // slowness costs its round the generation's 2 s or a daemon's proofs, so it is never paid on every round. A retry says
+  // its outcome only when it changed. A reopen registers at once, after any call in flight (which went to the daemon
+  // that closed), its wait reset. Meanwhile the daemon takes the owner from the home's lock on the board's own calls
+  // (live-sessions.mjs boardOwnerOf), so this is the second way back, not the first.
+  let registerDue = false, registerAt = 0, registerWait = 0, registering = null, registerSaid = null;
+  const registerOwner = (retry = false) => registering ??= (async () => {
+    let named = null, refusal = null, code = null;
+    try { named = await machineCall(null, 'harness.v1.boards.register', { root, claim: { pid: process.pid, ppid: process.ppid } }, { timeoutMs: inBoardGeneration ? 2000 : 30_000 }); } catch (error) { refusal = error.message; code = error?.code ?? null; }
+    const ownerless = refusal === null && named?.owner === false;
+    registerDue = ownerless || (refusal !== null && ['unavailable', 'REQUEST_TIMEOUT', 504, 'machine_offline', 'ECONNRESET', 503].includes(code));
+    registerWait = registerDue ? Math.min(registerWait ? registerWait * 2 : 15_000, 300_000) : 0;
+    registerAt = Date.now() + registerWait;
+    const again = registerDue ? '; registering again on a later round (15 s, doubling to 5 min)' : '';
     const refused = named?.refused ?? null;
-    log(refusal ? `board events: not published; the machine daemon did not take this home: ${refusal}`
+    const line = code === 'unavailable' ? `board ownership: this home is published, but the machine daemon could not read which process is registering, so it took no owner for it (${refusal})${again}`
+      : code === 'REQUEST_TIMEOUT' || code === 504 ? `board ownership: the machine daemon did not answer the registration in time (${refusal}); whether it published this home and took this owner is not known${again}`
+      : refusal ? `board events: not published; the machine daemon did not take this home: ${refusal}${again}`
+      : ownerless ? `board ownership: this home is registered, but the machine daemon did not find this process holding its board lock, so it took no owner for it${again}`
       : refused ? `board events: registered, but the team refused this machine's credential (${refused.status}); nothing is published until it is re-enrolled`
       : named?.published === false ? `board ownership: registered locally; this machine has no team connector to publish events`
-      : `board events: this home is published by the machine's connector`);
-  };
+      : `board events: this home is published by the machine's connector`;
+    if (retry !== true || line !== registerSaid) log(line);
+    registerSaid = line;
+  })().finally(() => { registering = null; });
   registerGenerationOwner = registerOwner;
   await registerOwner();
-  onLocalReopen(registerOwner);
+  onLocalReopen(async () => { await registering; registerWait = 0; registerAt = 0; return registerOwner(); });
   activationSaid('registered with the machine daemon');
   // Its writer epoch taken, work admitted and the home registered, this generation answers verbs: its owner routes
   // public requests to it now, and its first clean round below gates the activation, never the routing.
@@ -2233,14 +2616,15 @@ async function serve(root, args = {}) {
   let listenerRecords = {}, listenerReloading = null, listenerReloadDue = false, listenerReading = null;
   const listenerErrors = new Set();
   const listenerLog = text => { if (!listenerErrors.has(text)) { if (listenerErrors.size >= 128) listenerErrors.clear(); listenerErrors.add(text); log(text); } };
+  const listenerSteps = (name, work) => timed(name, work, { scope: 'listener' });
   const scanListeners = async ({ waiting = true } = {}) => {
     if (stopped || !fleetListeners.enabled || !listenerBootstrapped || !fleetRecordsCurrent()) return;
     const revision = listenerRevision;
     try {
-      await ownCall(function listenerScan() {
+      await listenerSteps('board listener scan', () => ownCall(function listenerScan() {
         if (stopped || revision !== listenerRevision || !fleetListeners.enabled || !fleetRecordsCurrent()) return;
         observeRoleFleet(root, fleetListeners, listenerRecords, listenerLog, { waiting });
-      });
+      }));
     } catch (error) {
       // A scan its stopping generation refused never ran, and this generation scans nothing again: said as that.
       if (error?.code === GENERATION_STOPPED) { listenerLog(`fleet listener scan not run: ${error.message}`); return; }
@@ -2252,7 +2636,7 @@ async function serve(root, args = {}) {
   const readListenerRecords = () => {
     if (!fleetListeners.enabled || stopped || listenerReading) return listenerReading;
     const revision = listenerRevision;
-    listenerReading = readFleetRecords().then(records => {
+    listenerReading = listenerSteps('board listener records', () => readFleetRecords()).then(records => {
       if (revision !== listenerRevision || !fleetListeners.enabled || stopped) return;
       listenerRecords = records;
       if (!listenerBootstrapped) { fleetListeners.bootstrap(records); listenerBootstrapped = true; scanListeners(); }
@@ -2262,17 +2646,17 @@ async function serve(root, args = {}) {
     return listenerReading;
   };
   fleetListeners = new FleetListenerRouter({ root, log: listenerLog,
-    file: (to, body, key) => ownCall(() => fileFleetNotice(root, to, body, key), 'a fleet notice'),
+    file: (to, body, key) => listenerSteps('board listener filing', () => ownCall(() => fileFleetNotice(root, to, body, key), 'a fleet notice')),
     // The scan/flush prepares custody once; enqueue needs the event synchronously before committing its cursor.
     enrich: event => enrichFleetEvent(root, event),
-    work: fn => ownCall(fn, 'the listener flush'),
+    work: fn => listenerSteps('board listener flush', () => ownCall(fn, 'the listener flush')),
     retry: () => scanListeners({ waiting: false }),
   });
   const unfollowRecords = onRecordsChanged(records => { listenerRecords = records; scanListeners(); });
   reloadListeners = () => {
     listenerReloadDue = true;
     if (listenerReloading || stopped) return listenerReloading;
-    listenerReloading = (async () => {
+    listenerReloading = listenerSteps('board listener configuration', async () => {
       while (listenerReloadDue && !stopped) {
         listenerReloadDue = false;
         const revision = listenerRevision;
@@ -2291,7 +2675,7 @@ async function serve(root, args = {}) {
           listenerReloadDue = true; break;
         }
       }
-    })().finally(() => { listenerReloading = null; });
+    }).finally(() => { listenerReloading = null; });
     return listenerReloading;
   };
   if (inBoardGeneration && generationServingDue) tellOwner({ type: 'startup-step', phase: 'serving', step: 'reading the listener configuration through its orchestration door', budget_ms: 65000 });
@@ -2311,8 +2695,11 @@ async function serve(root, args = {}) {
   // a board whose cards name an assignee that is no profile of this home is said once, until it has none
   const laneSaid = new Set();
   let wakeReason = null;
+  let failure, failed = false;
   try {
     while (!stopped) {
+      // an owner not yet taken is registered before a round once its wait is over (registerOwner)
+      if (registerDue && Date.now() >= registerAt) await registerOwner(true);
       if (listenerReloadDue) void reloadListeners();
       if (fleetListeners.enabled) scanListeners();
       // A serve never ticks on code older than the installed orchestrator: after its round it stops, and its keeper
@@ -2322,6 +2709,7 @@ async function serve(root, args = {}) {
       pausedSaid = Boolean(paused(root)) && pausedSaid;
       let interval = 60;
       let nextMailAt = Infinity;
+      let nextPauseAt = Infinity;
       const began = Date.now();
       if (inBoardGeneration && generationServingDue) {
         tellOwner({ type: 'startup-step', phase: 'serving', step: 'completing the first native board round', budget_ms: 65000 });
@@ -2330,6 +2718,7 @@ async function serve(root, args = {}) {
       if (wakeReason) log(`dispatch wake ${wakeReason.sources.join(', ')}; event age ${began - wakeReason.at}ms`);
       wakeReason = null;
       const loopStep = async (name, fn) => { const at = performance.now(); try { return await fn(); } finally { noteStep(`owner loop: ${name}`, performance.now() - at); } };
+      const runRound = async () => {
       try {
         const state = await loopStep('lane state', () => ownCall(() => laneState(root), 'the lane state'));
         const settings = { ...state.settings, ...override };
@@ -2344,7 +2733,7 @@ async function serve(root, args = {}) {
         // with the step's budget, so a round slow only on another machine's answers is not ended for its length.
         const progress = inBoardGeneration && generationServingDue
           ? (step) => tellOwner({ type: 'startup-step', phase: 'serving', step: `completing the first native board round (${step})`, budget_ms: 65000 }) : null;
-        const reports = dispatching.length ? await ownCall(() => tick({ root, lanes: state.lanes, settings, params, slugs: dispatching, deploymentReceipt: true, progress }), 'the dispatch round') : [];
+        const reports = dispatching.length ? await loopStep('dispatch', () => ownCall(() => tick({ root, lanes: state.lanes, settings, params, slugs: dispatching, deploymentReceipt: true, progress }), 'the dispatch round')) : [];
         if (inBoardGeneration && generationServingDue && !reports.cut && reports.every(report => !report.error)) {
           activationSaid(`the first native board round is clean (${dispatching.length} dispatching board(s))`);
           generationServingDue = false;
@@ -2355,16 +2744,18 @@ async function serve(root, args = {}) {
         const resting = listBoards(root).filter((slug) => !dispatching.includes(slug));
         const closes = resting.length && !stopped ? await loopStep('close pass', () => ownCall(() => closeEnded({ root, slugs: resting, settings }), 'the close pass')) : [];
         for (const r of closes) {
+          nextPauseAt = Math.min(nextPauseAt, r.next_pause_at == null ? Infinity : r.next_pause_at * 1000);
           if (r.error || r.closed.length || args.verbose) log(summary(r));
           for (const [t, to, why] of r.undelivered) log(`  close of ${to} for ${t} waits: ${why}`);
         }
         if (dispatching.length) {
           round += 1;
           // what the round recorded is delivered by a pass of its own, which this loop never waits for
-          if (!stopped) startDelivery(root, { slugs: dispatching, log: (level, line) => { if (level === 'warn' || args.verbose) log(line); } });
-          if (!stopped) await watchRounds(reports, began);
+          if (!stopped) await loopStep('round health', () => watchRounds(reports, began));
         }
+        if (!stopped) startDelivery(root, { slugs: [...dispatching, ...resting], log: (level, line) => { if (level === 'warn' || args.verbose) log(line); } });
         for (const r of reports) {
+          nextPauseAt = Math.min(nextPauseAt, r.next_pause_at == null ? Infinity : r.next_pause_at * 1000);
           nextMailAt = Math.min(nextMailAt, r.next_mail_at ?? Infinity);
           const said = summary(r);
           if (r.deployment) log(`runtime deployed ${r.deployment.repository}@${r.deployment.head}; workflow ${r.deployment.workflow_hash}; tick ${r.deployment.completed_at}`);
@@ -2389,15 +2780,15 @@ async function serve(root, args = {}) {
           if (!stopped) await watchRounds([{ board: '*', error: `tick failed: ${error.message}` }], began);
         }
       }
-      // each round is a line of its own in the slow log, with the steps it spent its time on
-      recordSlow({ kind: 'call', name: 'dispatch round', ms: Date.now() - began, slowest: null, extra: { steps: takeSteps() } });
+      };
+      await timed('dispatch round', runRound, { scope: 'round' });
       // a newer install is looked for after each tick and through the wait before the next
       const newer = () => { const now = installed(); return running && now && now !== running ? now : null; };
       let moved = newer();
       // the next tick is due an interval after this one began (a long tick is not followed by a full interval's wait)
       await loopStep('wake refresh', () => refreshNow());
       if (!stopped && !moved) {
-        wakeReason = await events.wait(Math.max(0, Math.min(interval * 1000 - (Date.now() - began), nextMailAt - Date.now())));
+        wakeReason = await events.wait(Math.max(0, Math.min(interval * 1000 - (Date.now() - began), nextMailAt - Date.now(), nextPauseAt - Date.now())));
         // A busy event stream is coalesced to at most one tick per second.
         const remaining = 1000 - (Date.now() - began);
         if (remaining > 0 && !stopped) await new Promise(done => setTimeout(done, remaining));
@@ -2405,19 +2796,33 @@ async function serve(root, args = {}) {
       }
       if (moved && !inBoardGeneration) { log(`orchestrator ${moved} is installed (this serve runs ${running}); stopping, for its keeper to start the new one`); break; }
     }
+  } catch (error) {
+    failed = true; failure = error; throw error;
   } finally {
-    fleetListeners.suspend(); clearInterval(listenerTimer); unfollowRecords(); unfollowPanes();
-    await listenerReloading;
-    await listenerReading;
+    const errors = [];
+    const attempt = async work => { try { await work(); } catch (error) { errors.push(error); } };
+    await attempt(() => fleetListeners.suspend());
+    clearInterval(listenerTimer);
+    await attempt(() => unfollowRecords());
+    await attempt(() => unfollowPanes());
+    await attempt(() => listenerReloading);
+    await attempt(() => listenerReading);
     try { await fleetListeners.close(); } catch (error) { log(`fleet listener shutdown: retained filing outcome unknown (${String(error.message).slice(0, 300)})`); }
     // a fetch in flight lands, and what it brought is merged, while this owner still holds the home's lock
     try { const { settleDocuments } = await import('./git-document.mjs'); await settleDocuments(); } catch { /* nothing in flight */ }
-    unwatchLoop?.(); releaseHeldBoards(); closeVerbs();
-    unfollowHome();
-    await closeDoors();
-    events?.close();
+    await attempt(() => unwatchLoop?.());
+    await attempt(() => releaseHeldBoards());
+    await attempt(() => closeVerbs());
+    await attempt(() => unfollowHome());
+    await attempt(() => closeDoors());
+    // The home reader owns a harness process too. Its idle timer cannot join that child's exit after this
+    // generation checkpoints and exits; close its shared transport while observation is still open.
+    await attempt(async () => { const { closeWorld } = await import('../orchestration.mjs'); await closeWorld(); });
+    await attempt(() => events?.close());
     for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.off(signal, stop);
     if (args.pidfile) { try { unlinkSync(args.pidfile); } catch { /* gone */ } }
+    await closeWorkLedger();
+    if (errors.length) throw new AggregateError([...(failed ? [failure] : []), ...errors], 'board dispatcher shutdown failed', { cause: failed ? failure : errors[0] });
   }
   log(stopped ? 'stopped (a signal)' : 'stopped');
   return 0;