@volter/supercode-orchestrator 0.5.227 → 0.5.229

package/board/dispatch.mjs

@@ -1,3 +1,5 @@
+import { registerWorkOperations, measureWork, stopWorkChild } from "@volter/supercode-harness-sdk/work-ledger";
+registerWorkOperations([{"kind":"pass","operation":"board.round"}]);
 // The board's dispatcher (docs/architecture/orchestrator.md §2.9): one tick reads the fleet through supercode,
 // supervises every running card, promotes cards whose parents are done, starts what capacity allows, and tells
 // subscribers what happened. Hermes's dispatcher is the behaviour it keeps parity with (claims, dependencies,
@@ -22,49 +24,54 @@ import { machineCall } from './doors.mjs';
 import { detachedCard, detachedSession, personCustody, personOf, sessionOperation, takeSessionCustody } from './custody.mjs';
 import { processSession } from './caller-session.mjs';
 import { callerOf, current, isCallersCall, ownCall } from './call.mjs';
-import { noteStep } from '@volter/supercode-harness-sdk/slow-log';
+import { noteStep, recordSlow, timed } from '@volter/supercode-harness-sdk/slow-log';
 import { monitorsRuns, recoversRuns, retainRecovery, failedObservation, surfaceIncident, auditEndedRuns, originOf } from './incidents.mjs';
-import { readMachineFleet } from './machine-fleet.mjs';
+import { heldPanes, readMachineFleet } from './machine-fleet.mjs';
+import { currentRecordChanges } from './current-records.mjs';
+import { listRevision } from './listing.mjs';
 import { homeFleetMachines } from './fleet-targets.mjs';
 import { delegatedWork, idleInterval, questionText, resumedWatch } from './session-work.mjs';
-import { localSessionDelegations } from '../agents.mjs';
-import { cardSectionHeading, creatorOf, sessionProgress } from './workflow.mjs';
+import { cardRoleAssignment, localSessionDelegations } from '../agents.mjs';
+import { cardSectionHeading, closeKeptReviewer, creatorOf, queueCleanup, sessionProgress } from './workflow.mjs';
 import { boardLabel, boardName } from '@volter/teams/board-name';
 let fleetRoot = null;
-import { inspectCompletionEvidence, returnedReview, noCodeChange, openReviewPullRequests, reviewDue, settledReviewDue, prReviewedHead, withCompletionEvidence, withFreshReviewReads, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
+import { discoverPullRequest, discoverQueuedPullRequest, openListObservedAt, redeclaredSince, inspectCompletionEvidence, returnedReview, noCodeChange, openReviewPullRequests, reviewDue, settledReviewDue, prReviewedHead, prDisposition, prIdentity, withCompletionEvidence, withFreshReviewReads, reviewCandidate, pendingReviewRequests, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { setImmediate as yieldToOwner } from 'node:timers/promises';
-import { ACTIVE_RUN_IDS, latestEvent, readRunPages } from './queries.mjs';
+import { ACTIVE_RUN_IDS, dispatchWait, latestEvent, latestEventIdSql } from './queries.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
-import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, recordUsageUnread, agentPreamble, agentEnvironment, recordAgentRun, cardAgentAssignments,renameCardAgent,handOffAgents, agentRunForSession } from '../agents.mjs';
+import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, pendingUsageOrgs, recordRunUsage, recordUsageUnread, agentPreamble, agentEnvironment, recordAgentRun, cardAgentAssignments,renameCardAgent,handOffAgents, agentRunForSession } from '../agents.mjs';
 import { finishCardAgentAssignment, recordCardAgentAssignment } from './agent-declarations.mjs';
+import { establishedSlot, replacementFor, issueReplacement, requireReplacementTeardown, continuationRefusal, closeRefused, slotGeneration } from './session-continuity.mjs';
+import { resolveAgentProfile } from '../agent-profiles.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
 import { installedAgentRecords } from '../installed-apps.mjs';
 import { memorySnapshot } from '../hermes-cli.mjs';
-import { hermesModel, codexPaneRoute } from '../worker-route.mjs';
+import { hermesModel, codexPaneRoute, codexPaneRouteArguments } from '../worker-route.mjs';
 import { refreshVault } from '../orchestration.mjs';
-import { projectCodexPaneResume } from '../codex-pane-resume.mjs';
 import { codexPaneInputs } from './codex-pane-inputs.mjs';
 import { declareWorkerHome } from '../activation.mjs';
 import { MODEL_ARGUMENTS, NAME_ARGUMENTS } from '../activation.mjs';
 import { createRequire } from 'node:module';
 import { spawn as spawnChild, execFile } from 'node:child_process';
-import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir, hostname, tmpdir, totalmem } from 'node:os';
-import { basename, dirname, join } from 'node:path';
+import { basename, dirname, join, win32 } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { view, boardCopyOf, boardKey, boardPath, cardHandleOf, readableIdOf, briefPath, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, NOTICE_RUN_IDS, openBoard, openBoardSnapshot, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
-import { doors, fire, ownCoder, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, unrelayedStateAnswers, transitionsFor, scopeOf, statusOf, projectStatus, storedStatus, templateValue, workflowFor } from './workflow.mjs';
-import { branchClaim, checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace, workspaceTask } from './workspace.mjs';
+import { view, boardCopyOf, boardKey, boardPath, cardHandleOf, CLOSE_OPEN_RUNS, runField, readableIdOf, briefPath, actorOf, claimer, claimHolds, copyRefusal, event, json, listBoards, logsDir, newClaim, now, NOTICE_RUN_IDS, openBoard, openBoardSnapshot, pendingLaunches, sessionBound, setActor, storageFault, tx } from './store.mjs';
+import { doors, fire, ownCoder, loadWorkflow, resumeOf, runSpec, runWorkingSeconds, requestSessionClose, retireSupersededRuns, refreshCardInputs, refreshRelationAnswers, unrelayedStateAnswers, transitionsFor, scopeOf, statusOf, projectStatus, storedAs, storedStatus, templateValue, workflowFor, settleExpiringFlags, nextFlagExpiry, ownerRule, requestDetail } from './workflow.mjs';
+import { branchClaim, checkWorkspace, assertWorkspaceOwner, notePresence, resolveWorkspace, reviewWorkspaces, workspaceTask } from './workspace.mjs';
 import { capacity, dispatched, executionHost, harnessDefaults, holdings } from './capacity.mjs';
 import { evaluate, holds, render } from './expr.mjs';
 import { cardName, cardNumber, identifyNotice, noticeName, numbered } from './notices.mjs';
 import { noticeReceiptsInTurns, noticeKey, requireNoticeBasis, noticeWriterBasis } from './notice-receipts.mjs';
-import { pendingRequestMail } from './request-mail.mjs';
+import { pendingRequestMail, pendingRequestRows } from './request-mail.mjs';
+import { deferredCloseCurrent, requireDeferredClose } from './close-current.mjs';
+import { currentAgentWork, latestAgentRow } from './agent-current.mjs';
 import {
   cardContext, cardLabel, claimTtl, currentRun, DEFAULT_FAILURE_LIMIT, extendClaim, getTask, lastSession,
-  recomputeReady, runEffects, queueEffects, setRunSession, subscribeIn, replaceWorkerSubscriptions, subscriptions, reconcileDependencySubscriptions, mentioned,
+  recomputeReady, runEffects, queueEffects, requestReview, acceptRequest, routeRequest, completeBacklogRequests, setRunSession, subscribeIn, replaceWorkerSubscriptions, subscriptions, reconcileDependencySubscriptions, mentioned,
 } from './engine.mjs';
 
 const WORKER = fileURLToPath(new URL('../bin/hermes-worker.mjs', import.meta.url));
@@ -117,7 +124,7 @@ function sc(args, { input = null, timeout = 120_000, as = null } = {}) {
     let stdout = '', stderr = '', done = false;
     const child = spawnChild(supercodeBin(), args, { cwd: tmpdir(), env, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
     const finish = (code, extra = '') => { if (done) return; done = true; clearTimeout(timer); noteStep(`supercode ${args[0]}`, performance.now() - started); resolve({ code, stdout, stderr: stderr + extra }); };
-    const timer = setTimeout(() => { child.kill('SIGKILL'); finish(null, `supercode ${args[0]} did not answer within ${timeout} ms`); }, timeout);
+    const timer = setTimeout(() => { stopWorkChild(child, () => child.kill('SIGKILL'), { signal: 'SIGKILL' }); finish(null, `supercode ${args[0]} did not answer within ${timeout} ms`); }, timeout);
     child.stdout.setEncoding('utf8').on('data', (chunk) => { stdout += chunk; });
     child.stderr.setEncoding('utf8').on('data', (chunk) => { stderr += chunk; });
     child.on('error', (error) => finish(null, error.message));
@@ -159,7 +166,8 @@ export function callerSession() {
 /** The fleet as the home's machines answer for themselves (machine-fleet.mjs): this machine, and every machine an open
  * card of the home names or one of its notice subscribers is on. */
 export async function observeFleet(root = fleetRoot) {
-  const machines = await homeFleetMachines(root, normalMachine);
+  // An unread or moved target set leaves presence unknown for the round, never the previous round's reading.
+  const machines = await homeFleetMachines(root, normalMachine).catch((error) => { presenceReading = null; notePresence(null); throw error; });
   const fleet = await readMachineFleet(machines, localMachine());
   presenceReading = { known: fleet.presenceKnown === true, online: new Set([...(fleet.unknown?.has(localMachine()) ? [] : [localMachine()]), ...fleet.online]), offline: fleet.offline ?? new Set(), unknown: fleet.unknown ?? new Set(), errors: fleet.errors ?? new Map() };
   notePresence(presenceReading);
@@ -168,7 +176,7 @@ export async function observeFleet(root = fleetRoot) {
 
 // how the launcher opens each harness a pane lane can run, and how it names the session: Claude Code is told the id
 // it will have (`--session-id`) and resumed by it (`--resume`); Codex names its own session, which the board reads from
-// the fleet by the pane it opened, and is resumed by it (`codex resume <id>`)
+// its keyed native launch receipt, and is resumed by it (`codex resume <id>`)
 const HARNESSES = {
   'claude-code': { program: 'claude', fresh: (sid) => ['--session-id', sid], resume: (sid) => ['--resume', sid], namesItself: false },
   codex: { program: 'codex', fresh: () => [], resume: (sid) => ['resume', sid], namesItself: true },
@@ -180,18 +188,43 @@ const HARNESSES = {
 // machine_offline; a stream that timed out, 504), says nothing about what it was asked: it is tried again next round.
 const doorTransient = (r) => r.code === null || ['unavailable', 'machine_offline', 'rate_limited', 504, '504', 'ETIMEDOUT', 'ECONNRESET', 'EAI_AGAIN'].includes(json(String(r.stderr ?? '').trim().split('\n').pop(), null)?.code);
 const adoptedOnly = (s) => s?.mode === 'adopt' && !s.launch_key && s.surface !== 'headless';
-/** A close the machine refused for good (not deferred): the board will not try it again, and the session runs on. */
-const closeRefused = (s) => Boolean(s?.close_failed_at && s.close_error && !/^close deferred/.test(s.close_error) && !s.close_confirmed_at);
 const addressOf = (s) => s?.address ?? (s?.session_id && s.machine ? `sc:${s.machine}:${s.harness ?? 'claude-code'}:${s.session_id}` : null);
 
-// A session in a live pane of its machine is the fleet's reading; any other run is read on its own machine: a headless
-// worker by its pid, a pane by that machine's pane list, a session in no pane (an adopted native one) by that machine's
-// harness discovery. Null only when the machine cannot answer.
+// Conversation presence requires the recorded physical store. A fleet row or scoped native activity identifies it;
+// a pane's absence identifies an ended instance, while its existence alone says nothing about its current session.
+// A headless worker is also read by its owned pid. Unread provenance or activity stays unknown.
 // A pane is read from the machine's record when the fleet reading holds its panes (current, or the machine is not in
 // it): the pane list asked through its door serves READING_MS, so a pane that ended since that reading was read live
 // for up to those 15 s more, and a session's loss was read that much late.
 const paneInRecord = (fleet, session) => session?.surface !== 'headless' && session?.pane && session.machine && fleet?.panes?.has(normalMachine(session.machine)) ? fleet.panes.get(normalMachine(session.machine)).has(session.pane) : null;
-const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ? fleet.native.get(addressOf(session)).alive : paneInRecord(fleet, session) ?? unpublishedAlive(session);
+/** Fleet rows of this retained conversation, including its physical native store. */
+const fleetSessionRows = (fleet, session) => {
+  const homes = nativeHome(session)?.homes;
+  return homes ? (fleet?.sessions ?? []).filter(row => row.address === addressOf(session) && inNativeHome(row, homes)) : [];
+};
+const fleetSessionRow = (fleet, session) => {
+  const rows = fleetSessionRows(fleet, session);
+  return rows.length === 1 ? rows[0] : rows.find(row => row.pane === session?.pane) ?? null;
+};
+const homeIdentity = (session) => {
+  const homes = nativeHome(session)?.homes;
+  return homes ? JSON.stringify(Object.entries(homes).sort(([a], [b]) => a.localeCompare(b))) : null;
+};
+const sameNativeSession = (left, right) => Boolean(addressOf(left) && addressOf(left) === addressOf(right) && homeIdentity(left) && homeIdentity(left) === homeIdentity(right));
+function sessionAlive(fleet, session) {
+  if (!session) return null;
+  if (session.surface === 'headless' && session.pid) return pidAlive(session.pid);
+  if (session.session_id && !nativeHome(session)) return null;
+  const published = fleetSessionRows(fleet, session);
+  if (published.some(row => row.state === 'running')) return true;
+  const native = unpublishedAlive(session);
+  if (native === true) return true;
+  if (published.length) return null;
+  if (native != null) return native;
+  const pane = paneInRecord(fleet, session);
+  // A live pane alone cannot identify the conversation now running in it.
+  return !session.session_id || pane === false ? pane : null;
+}
 /** A subscriber's address as the session it names, for sessionAlive (its machine, harness and native id). */
 const sessionAt = (address) => { const m = /^sc:([^:]+):([^:]+):(.+)$/.exec(String(address)); return m && HARNESSES[m[2]] ? { address, machine: normalMachine(m[1]), harness: m[2], session_id: m[3] } : null; };
 /** An agent's address (`sc:<machine>:agent:<name>`) as its machine and name, or null. */
@@ -231,45 +264,38 @@ async function subscriberAlive(fleet, address) {
   if (!session) return false;
   await readBefore(fleet, session);
   const alive = sessionAlive(fleet, session);
-  if (alive == null && subscriberGone(fleet, address)) return false;
   return alive ?? null;
 }
-/**
- * A subscriber that is gone: no transcript, no process and no pane. Its machine's discovery answered whole (no source
- * failed, nothing truncated) without the session, the fleet lists no pane for it, and the reading came from a daemon
- * whose index names a Claude subagent by its own file (#1423, marked `subagent_rows: 'own'` on its discovery): an older
- * daemon's index dropped a parent session that ran a subagent, so its absence there is never read as gone.
- */
-function subscriberGone(fleet, address) {
-  if (fleet.noticeAlive?.has(address) || fleet.alive.has(address) || fleet.native?.has(address)) return false;
-  const session = sessionAt(address);
-  const seen = session && discoveries.get(nativeKey(session.machine, session.harness, session.session_id));
-  if (!seen?.complete) return false;
-  return !seen.sessions.some((r) => r.locator?.session_id === session.session_id && r.locator?.harness === session.harness);
-}
 const paneLists = new Map();
 /** A session the fleet reading did not publish: alive by what was read of it before (readBefore), else unknown (null). */
 function unpublishedAlive(session) {
   if (!session) return null;
   if (session.surface === 'headless' && session.pid) return pidAlive(session.pid);
   if (!session.machine) return null;
-  if (!session.pane) {
-    if (!session.session_id) return null;
-    try { return nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code', session.session_id), session).alive; } catch { return null; }
-  }
+  if (session.session_id) try {
+    const reading = nativeReading(nativeSessions(session), session).alive;
+    if (reading != null) return reading;
+  } catch { /* unread native identity */ }
+  if (!session.pane) return null;
   const entry = paneLists.get(session.machine);
   if (!entry || Date.now() - entry.at > READING_MS) return null;
-  return entry.panes ? entry.panes.some((p) => p.pane === session.pane && !p.dead) : null;
+  if (!entry.panes) return null;
+  const present = entry.panes.some((p) => p.pane === session.pane && !p.dead);
+  return !session.session_id || !present ? present : null;
 }
-/** A machine's pane list, read through its door (one reading serves READING_MS). */
-async function readPaneList(machine) {
-  const entry = paneLists.get(machine);
-  if (entry && Date.now() - entry.at <= READING_MS) return entry;
-  const r = await doorOn(machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
-  const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
-  const read = { at: Date.now(), panes: Array.isArray(panes) ? panes : null };
-  paneLists.set(machine, read);
-  return read;
+/**
+ * A machine's panes as panes.list rows (`list`, null when unread, with `error` saying why): its held record's, read at
+ * this moment where that record is current (`held`: its rows and the session under each live pane, no door call), else
+ * its door's, as before (a record not current is no reading of the machine, and its door still answers, so a close,
+ * launch or adoption there acts as it did). A list asked as the board (`options.as`: a close) is always its door's, which
+ * lists only the panes the board's grants there let it observe.
+ */
+async function paneRows(machine, options = { timeout: 60_000 }) {
+  const held = options.as ? null : heldPanes(normalMachine(machine ?? localMachine()));
+  if (held) return { list: held.panes, held };
+  const r = await doorOn(machine, 'harness.v1.panes.list', {}, options);
+  const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
+  return { list: Array.isArray(list) ? list : null, held: null, error: (r.stderr || r.stdout).trim().slice(-300) };
 }
 
 /** Native activity comes from the machine's harness discovery, not catalogue age: each session the round reads is
@@ -278,7 +304,7 @@ async function readPaneList(machine) {
 const discoveries = new Map();
 // A machine's pane list and harness discovery are read before a board write opens, never inside one: a door that
 // takes seconds would hold the board's write lock past a worker's own command's busy wait. Reading is async (readNative,
-// readPaneList, readBefore: the doors in this process, never holding the event loop); every decision reads what was
+// paneRows, readBefore: the doors in this process, never holding the event loop); every decision reads what was
 // read (nativeSessions, unpublishedAlive, sessionAlive), and a reading not taken yet is unknown. One reading serves
 // READING_MS.
 const READING_MS = 15_000;
@@ -286,60 +312,99 @@ const txRead = (board, fn) => tx(board, fn);
 /** Take the readings a decision or a board write about `session` will need, before it. */
 async function readBefore(fleet, session) {
   if (!session?.machine || session.surface === 'headless') return;
-  // A pane may use a different Codex home than its daemon. Its native activity
-  // locator names the source to discover; the daemon's default can miss it.
-  const locator = fleet?.sessions?.find(row => row.address === addressOf(session))?.locator;
-  const codexHome = session.codex_home ?? (session.harness === 'codex' && locator?.storage?.kind === 'file'
-    ? /^(.*)[\\/]sessions[\\/]/.exec(locator.storage.path)?.[1] : null);
-  if (session.session_id) try { await readNative(session.machine, session.harness ?? 'claude-code', session.session_id, codexHome); } catch { /* unread: unknown */ }
-  if (session.pane && !fleet?.native?.has(addressOf(session))) await readPaneList(session.machine);
+  const homes = (await readNativeHome(session))?.homes;
+  if (session.session_id && homes) {
+    const harness = session.harness ?? 'claude-code', key = nativeKey(session.machine, harness, session.session_id, homes);
+    const held = discoveries.has(key) && discoveries.get(key).activity !== false ? null : heldNative(fleet, session.machine, harness, session.session_id, homes);
+    if (held) discoveries.set(key, { at: Date.now(), sessions: [held] });
+    else try { await readNative(session.machine, harness, session.session_id, homes); } catch { /* unread: unknown */ }
+  }
+  // a pane the round's fleet reading holds no session for, on a machine whose record that reading did not hold: its
+  // machine's pane list (one reading serves READING_MS), for unpublishedAlive
+  if (session.pane && paneInRecord(fleet, session) == null) {
+    const entry = paneLists.get(session.machine);
+    if (!entry || Date.now() - entry.at > READING_MS) paneLists.set(session.machine, { at: Date.now(), panes: (await paneRows(session.machine)).list });
+  }
+}
+/**
+ * A session's discovery row as its machine's record holds it (the fleet reading's `held`: the activity its machine
+ * follows of each live session, its locator, folder and last write), or null where the record holds none (a session
+ * not live there, one past the sessions its machine follows, a record not current): that one is discovered, as before.
+ * A held row says nothing of another session's absence.
+ * Codex activity is read through its own scoped discovery, including its app-server status.
+ */
+function heldNative(fleet, machine, harness, sessionId, homes) {
+  if (harness === 'codex') return null;
+  return fleet?.held?.get(`sc:${normalMachine(machine)}:${harness}:${sessionId}`)?.find(row =>
+    row.locator?.harness === harness && row.locator.session_id === sessionId && inNativeHome(row, homes)) ?? null;
+}
+
+/** Retained launch provenance, including the original Codex run contract. */
+const legacyNativeHomes = new Map();
+const legacyHomeKey = session => JSON.stringify([normalMachine(session.machine), session.session_id ?? session.launch_key, session.codex_home]);
+function nativeHome(session) {
+  if (session?.native_home) return session.native_home;
+  if (session?.codex_home && (session.harness ?? 'claude-code') === 'codex')
+    return legacyNativeHomes.get(legacyHomeKey(session)) ?? null;
+  return null;
+}
+/** The machine's file door resolves an existing legacy store, including aliases, without reading its transcript. */
+async function readNativeHome(session) {
+  const held = nativeHome(session);
+  if (held || !session?.codex_home || session.harness !== 'codex' || !session.machine) return held;
+  const path = (session.codex_home.includes('\\') ? win32.join : join)(session.codex_home, 'sessions');
+  const answer = await doorOn(session.machine, 'files.stat', { path }, { timeout: NATIVE_DISCOVERY_MS });
+  const source = answer.code === 0 ? lastJson(answer.stdout) : null;
+  if (source?.kind !== 'directory' || typeof source.path !== 'string') return null;
+  const home = { homes: { codex: source.path }, env: { CODEX_HOME: session.codex_home } };
+  legacyNativeHomes.set(legacyHomeKey(session), home);
+  return home;
+}
+function nativeHomes(session) {
+  const home = nativeHome(session);
+  if (!home) throw unavailable(`native home is unknown for ${addressOf(session)}; no default home was read`);
+  return home.homes;
+}
+function inNativeHome(row, homes) {
+  const path = row?.locator?.storage?.path;
+  return Boolean(homes && typeof path === 'string' && Object.values(homes).some(root => path === root || path.startsWith(root + '/') || path.startsWith(root + '\\')));
+}
+function locatorHome(locator) {
+  if (locator?.storage?.kind !== 'file' || !['claude-code', 'codex'].includes(locator.harness)) return null;
+  const codex = locator.harness === 'codex', folder = codex ? 'sessions' : 'projects';
+  const match = (codex ? /^(.*[\\/])sessions[\\/]/ : /^(.*[\\/])projects[\\/]/).exec(locator.storage.path);
+  if (!match) return null;
+  return { homes: { [codex ? 'codex' : 'claude_code']: match[1] + folder },
+    env: { [codex ? 'CODEX_HOME' : 'CLAUDE_CONFIG_DIR']: match[1].slice(0, -1) } };
 }
 /** A session's native discovery as this round read it (readNative); throws (unavailable) when it was not read. */
-function nativeSessions(machine, harness, sessionId) {
-  const seen = discoveries.get(nativeKey(machine, harness, sessionId));
+function nativeSessions(session) {
+  const seen = discoveries.get(nativeKey(session.machine, session.harness ?? 'claude-code', session.session_id, nativeHomes(session)));
   if (seen) return seen.sessions;
   throw unavailable('native liveness is read before it is used (readBefore), and was not');
 }
-/** Read a session's native discovery through its machine's door, once a round. */
-async function readNative(machine, harness, sessionId, codexHome = null) {
-  const key = nativeKey(machine, harness, sessionId), seen = discoveries.get(key);
-  const home = harness === 'codex' ? codexHome ?? seen?.codex_home ?? null : null;
-  if (seen && (seen.codex_home ?? null) === home) return seen.sessions;
-  const { sessions, complete } = await discoverNative(machine, harness, sessionId, home);
-  discoveries.set(key, { at: Date.now(), sessions, complete, codex_home: home });
+/** Read a session's native discovery through its machine's door, once a round. `activity: false`: only its rows (its
+ *  locator, folder, whether its machine's index holds it), read from the index with no activity read for them; a
+ *  reading kept without activity is read again, with it, by the next caller that needs its activity. */
+async function readNative(machine, harness, sessionId, homes = null, { activity = true } = {}) {
+  const key = nativeKey(machine, harness, sessionId, homes), seen = discoveries.get(key);
+  if (seen && (seen.activity !== false || !activity)) return seen.sessions;
+  const { sessions } = await discoverNative(machine, harness, sessionId, homes, { activity });
+  discoveries.set(key, { at: Date.now(), sessions, ...(activity ? {} : { activity: false }) });
   return sessions;
 }
 // A native discovery is bounded as the fleet reading is: one that does not answer in time is unknown, read next round.
 const NATIVE_DISCOVERY_MS = 15_000;
-const nativeKey = (machine, harness, sessionId) => `${normalMachine(machine)}\u0000${harness}\u0000${sessionId}`;
-async function discoverNative(machine, harness, sessionId, codexHome = null) {
+const nativeKey = (machine, harness, sessionId, homes = null) => JSON.stringify([normalMachine(machine), harness, sessionId, homes]);
+async function discoverNative(machine, harness, sessionId, homes = null, { activity = true } = {}) {
   if (offlineMachine(machine)) throw unavailable(`native liveness unavailable: machine ${normalMachine(machine)} is offline`);
   // the machine's own harness door, this one's or another's, as every other harness read here is
   // Liveness uses the native activity receipt, never transcript previews. A name miss can match many retained
   // rows; opening every one for its messages delays the board's liveness decision for data it never reads.
-  const result = await doorOn(machine, 'harness.v1.sessions.discover', { harnesses: [harness], query: sessionId, limit: 2000, include_latest_candidates: false, ...(harness === 'codex' && codexHome ? { homes: { codex: join(codexHome, 'sessions') } } : {}) }, { timeout: NATIVE_DISCOVERY_MS });
+  const result = await doorOn(machine, 'harness.v1.sessions.discover', { harnesses: [harness], query: sessionId, limit: 2000, include_child_sessions: true, include_latest_candidates: false, ...(activity ? {} : { include_activity: false }), ...(homes ? { homes } : {}) }, { timeout: NATIVE_DISCOVERY_MS });
   const page = result.code === 0 ? lastJson(result.stdout) : null;
   if (!Array.isArray(page?.sessions)) throw unavailable(`native liveness unavailable on ${machine}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
-  // whole: every source read and none still being reconciled, nothing truncated, from an index that keeps every
-  // session's own row (subscriberGone); a source still being read answers from the rows it held before
-  const complete = page.subagent_rows === 'own' && !(Array.isArray(page.failed) && page.failed.length) && !page.reconciling?.length
-    && !page.receipt?.truncated && page.next_cursor == null;
-  return { sessions: page.sessions, complete };
-}
-/**
- * Whether `session`'s machine holds no session of that id at all: its discovery was read whole (every source, nothing
- * truncated) and has no row for it. A launch that stopped before its first turn (a question on its screen that no
- * input answers) leaves a pane and no transcript, and a harness asked to resume that id exits at once. A reading not
- * taken, or not whole, says nothing.
- */
-async function nativeAbsent(session) {
-  if (!session?.session_id || !session.machine) return false;
-  const harness = session.harness ?? 'claude-code';
-  try {
-    const rows = await readNative(session.machine, harness, session.session_id, session.codex_home ?? null);
-    return discoveries.get(nativeKey(session.machine, harness, session.session_id))?.complete === true
-      && !rows.some((r) => r.locator?.session_id === session.session_id);
-  } catch { return false; }
+  return { sessions: homes ? page.sessions.filter(row => inNativeHome(row, homes)) : page.sessions };
 }
 function nativeReading(rows, session) {
   const row = rows.find(r => r.locator?.session_id === session.session_id && r.locator?.harness === session.harness);
@@ -350,8 +415,7 @@ function nativeReading(rows, session) {
 /** Match a manual continuation by the same harness identity and an actually live machine pane. */
 function continuationPane(fleet, session, panes) {
   if (!session?.session_id || !(panes instanceof Set)) return null;
-  const candidates = new Set((fleet.sessions ?? []).filter((s) => s.address === addressOf(session) && s.pane && panes.has(s.pane)).map((s) => s.pane));
-  if (session.pane && panes.has(session.pane)) candidates.add(session.pane);
+  const candidates = new Set(fleetSessionRows(fleet, session).filter((s) => s.pane && panes.has(s.pane)).map((s) => s.pane));
   if (candidates.size > 1) throw new Error(`session ${session.session_id} has multiple live panes: ${[...candidates].join(', ')}; close the extra pane before continuing`);
   return [...candidates][0] ?? null;
 }
@@ -359,7 +423,11 @@ function continuationPane(fleet, session, panes) {
 
 function pidAlive(pid) {
   if (!pid) return false;
-  try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; }
+  try { process.kill(pid, 0); return true; } catch (error) {
+    if (error.code === 'ESRCH') return false;
+    if (error.code === 'EPERM') return true;
+    throw new Error(`could not read worker pid ${pid}: ${error.message}`);
+  }
 }
 
 // ------------------------------------------------------------------ settings
@@ -431,7 +499,7 @@ const offlineMachine = (machine) => {
 // each), so a park that waited for them waited out most of the round, past the owner's 8 s wait for 'parked' (VO-3578
 // r2454 F11: 13.6 s and 13.0 s of held card verbs). A door that acts (a pane prepared, a session owned) is never cut: it
 // finishes and the park waits for it.
-const READ_DOORS = new Set(['harness.v1.agent.show', 'harness.v1.launches.get', 'harness.v1.panes.capture', 'harness.v1.panes.list',
+const READ_DOORS = new Set(['files.stat', 'harness.v1.agent.show', 'harness.v1.launches.get', 'harness.v1.panes.capture', 'harness.v1.panes.list', 'harness.v1.transcripts.models',
   'harness.v1.panes.presence', 'harness.v1.sessions.activity_under', 'harness.v1.sessions.discover', 'harness.v1.sessions.load']);
 const refusal = (code, message) => ({ code: 1, stdout: '', stderr: JSON.stringify({ code, message }) });
 /** A machine's public door (`harness.v1.*`), answered at once when the machine reads as offline. */
@@ -511,25 +579,84 @@ async function recordBounces(board, fleet, entry, report) {
       }
     }
   } catch (error) { report.undelivered?.push(['mail', 'bounces', String(error.message).slice(-200)]); }
-  // the first input of each session launched in the last ten minutes, until its machine's launch record settles it
-  const running = view(board, (db) => db.prepare('SELECT t.id, r.id run_id, r.metadata FROM tasks t JOIN task_runs r ON r.id = t.current_run_id WHERE r.ended_at IS NULL').all());
+  // The first input of each session launched within its launch window, until its machine's launch record settles it.
+  // A brief is owed until its session receives it: a first input that bounced is filed to that same session again,
+  // as its run's instruction, on this round; one still undelivered when the window ends is the launch's incident.
+  const { launchWindow } = boardSettings(entry.params);
+  const running = view(board, (db) => db.prepare('SELECT t.id, r.id run_id, r.task_id, r.ended_at, r.metadata FROM tasks t JOIN task_runs r ON r.id = t.current_run_id WHERE r.ended_at IS NULL').all());
   for (const row of running) {
     const session = json(row.metadata, {})?.supercode;
-    if (!session?.launch_key || session.first_input || !fleet?.ok || now() - Number(session.launched_at ?? 0) > 600) continue;
+    if (!session?.launch_key || session.first_input || !fleet?.ok || now() - Number(session.launched_at ?? 0) > launchWindow) continue;
     if (!fleet.capabilities?.get(normalMachine(session.machine ?? localMachine()))?.launches) continue;
     let receipt; try { receipt = await launchReceipt(board, session); } catch { continue; }
     const settled = receipt?.inputBounced ? 'bounced' : receipt?.inputDelivered === true ? 'delivered' : receipt?.inputRefused || receipt?.inputError ? 'undelivered' : null;
     if (!settled) continue;
+    if (settled === 'bounced' && session.launch_pending) {
+      const refiled = bindLaunch(board, { id: row.run_id, task_id: row.id, ended_at: row.ended_at }, session, receipt, { refile: (db, address) => {
+        const task = getTask(db, row.id), told = roleBrief(db, board, entry, task, statusOf(db, task));
+        if (!told) return;
+        const brief = queueBrief(db, board, task, row.run_id, address, told, 'started');
+        setRunSession(db, row.run_id, { first_input: 'refiled', brief_owed: brief });
+        event(db, row.id, 'first_input_refiled', { launch_key: session.launch_key, pane: session.pane ?? null, address, reason: receipt.inputError ?? null }, row.run_id);
+      } });
+      if (refiled) { (report.bounced ??= []).push([row.id, session.pane ?? session.launch_key, 'first input filed again']); continue; }
+    }
     tx(board, (db) => {
       const run = db.prepare('SELECT ended_at, metadata FROM task_runs WHERE id = ?').get(row.run_id);
       if (!run || run.ended_at || json(run.metadata, {})?.supercode?.first_input) return;
       setRunSession(db, row.run_id, { first_input: settled });
       if (settled !== 'bounced') return;
       event(db, row.id, 'first_input_bounced', { launch_key: session.launch_key, pane: session.pane ?? null, reason: receipt.inputError ?? null }, row.run_id);
-      tell(db, row.id, `${row.id}: the first input of the session the board launched for it${session.pane ? ` (pane ${session.pane})` : ''} bounced: ${receipt.inputError}. The session runs without its prompt; its quiet is not counted as idleness.`);
+      tell(db, row.id, `${row.id}: the first input of the session the board launched for it${session.pane ? ` (pane ${session.pane})` : ''} bounced: ${receipt.inputError}. It could not be filed to its session again; its launch becomes an incident if the launch window ends with its brief undelivered.`);
       (report.bounced ??= []).push([row.id, session.pane ?? session.launch_key, 'first input']);
     });
   }
+  await settleOwedBriefs(board, fleet, entry, report, launchWindow);
+}
+
+/**
+ * A re-filed brief is owed until its session receives it (ADR 0019): the session's own turn reading (its published fleet
+ * row, else its native discovery, as turnInFlight reads it) shows a turn state that began after the brief was filed. A
+ * session that cannot be read keeps it owed. When the launch window ends, a brief never filed, or a read session with no
+ * turn since its filing, makes the launch an incident with that reading as its evidence.
+ */
+async function settleOwedBriefs(board, fleet, entry, report, launchWindow) {
+  const owed = view(board, db => db.prepare(`SELECT t.id, r.id run_id, r.metadata FROM tasks t JOIN task_runs r ON r.id = t.current_run_id
+    WHERE r.ended_at IS NULL AND json_extract(r.metadata,'$.supercode.first_input')='refiled'`).all());
+  for (const row of owed) {
+    await yieldToOwner();
+    if (stopping) return;
+    const session = json(row.metadata, {})?.supercode ?? {};
+    const filed = view(board, db => db.prepare(`SELECT created_at, json_extract(payload,'$.message_id') AS message FROM task_events
+      WHERE task_id=? AND run_id=? AND kind='session_notice_filed' AND json_extract(payload,'$.source_event')=? ORDER BY id DESC LIMIT 1`)
+      .get(row.id, row.run_id, session.brief_owed ?? null));
+    let reading = null;
+    if (filed && fleet?.ok && session.session_id) {
+      reading = fleetSessionRow(fleet, session);
+      if (reading?.turn == null) try {
+        await readNativeHome(session);
+        const activity = nativeReading(await readNative(session.machine, session.harness ?? 'claude-code', session.session_id, nativeHomes(session)), session).row?.activity;
+        reading = activity ? { turn: activity.turn ?? null, turn_since_ms: activity.evidence?.native_state_since_ms ?? null, turn_source: activity.evidence?.source ?? null } : null;
+      } catch { reading = null; }
+      if (reading?.turn == null) reading = null;
+    }
+    if (reading && ['working', 'needs_input', 'idle'].includes(reading.turn) && Number(reading.turn_since_ms) > Number(filed.created_at) * 1000) {
+      tx(board, db => { if (currentRun(db, row.id)?.id === row.run_id) setRunSession(db, row.run_id, { first_input: 'delivered', brief_owed: null }); });
+      continue;
+    }
+    if (now() - Number(session.launched_at ?? 0) < launchWindow || (filed && !reading)) continue;
+    const error = filed ? `its re-filed brief ${filed.message} shows no turn in its session since it was filed when the launch window ended`
+      : 'its re-filed brief was never filed before the launch window ended';
+    const evidence = { error, brief_event: session.brief_owed ?? null, message_id: filed?.message ?? null, filed_at: filed?.created_at ?? null,
+      reading: reading ? { turn: reading.turn, turn_since_ms: reading.turn_since_ms ?? null, source: reading.turn_source ?? null } : null,
+      launch_key: session.launch_key ?? null, pane: session.pane ?? null, launch_window_seconds: launchWindow };
+    tx(board, db => {
+      if (currentRun(db, row.id)?.id !== row.run_id) return;
+      setRunSession(db, row.run_id, { first_input: 'undelivered', brief_owed: null });
+      surfaceIncident(db, board, entry, row.id, 'spawn_failed', evidence, row.run_id);
+    });
+    report.failed.push([row.id, error]);
+  }
 }
 
 /**
@@ -578,7 +705,7 @@ async function supervise(board, fleet, settings, report, entry, effects) {
     const run = currentRun(board.db, id), session = run?.metadata?.supercode;
     if (session?.harness !== 'claude-code' || session.mode !== 'fresh' || !session.launch_key || session.first_response || !session.session_id) continue;
     let locator;
-    try { locator = nativeReading(nativeSessions(session.machine, session.harness, session.session_id), session).row?.locator; } catch { continue; }
+    try { locator = nativeReading(nativeSessions(session), session).row?.locator; } catch { continue; }
     if (!locator) continue;
     const answer = await doorOn(session.machine, 'harness.v1.sessions.load', { locator, view: { first_response_only: true }, options: { include_subagents: false, message_limit: 0, inline_media: 'metadata' } }, { timeout: NATIVE_DISCOVERY_MS });
     const loaded = answer.code === 0 ? lastJson(answer.stdout) : null;
@@ -613,7 +740,8 @@ async function supervise(board, fleet, settings, report, entry, effects) {
       if (!task || (entry.workflow.run ? !task.current_run_id : task.status !== 'running')) return;
       const runRow = currentRun(db, id);
       let session = runRow?.metadata?.supercode ?? null;
-      const liveBinding=fleet.sessions?.find(item=>item.address===addressOf(session)&&item.state==='running'&&item.pane);
+      const liveBindings = fleetSessionRows(fleet, session).filter(item => item.state === 'running' && item.pane);
+      const liveBinding = new Set(liveBindings.map(item => item.pane)).size === 1 ? liveBindings[0] : null;
       if(liveBinding?.pane&&liveBinding.pane!==session.pane){
         session={...session,pane:liveBinding.pane,missing_since:null};setRunSession(db,runRow.id,session);
         event(db,id,'session_rebound',{session_id:session.session_id,pane:session.pane},runRow.id);
@@ -621,9 +749,9 @@ async function supervise(board, fleet, settings, report, entry, effects) {
       const t = now();
       if (runRow && session) {
         const alive = session.surface === 'headless' ? pidAlive(session.pid) : sessionAlive(fleet, session);
-        let native = fleet.sessions?.find(item => item.address === addressOf(session));
+        let native = fleetSessionRow(fleet, session);
         if (!native && session.session_id) try {
-          const row = nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code', session.session_id), session).row;
+          const row = nativeReading(nativeSessions(session), session).row;
           native = { turn: row?.activity?.turn };
         } catch { /* an unread turn stays unknown */ }
         // the session's machine as this round read it, so the card can say why a session reads unknown (executionOf)
@@ -682,7 +810,7 @@ async function supervise(board, fleet, settings, report, entry, effects) {
           const reason = session?.launch_deferred_error ?? session?.launch_error ?? 'no session or process was bound to the dispatched run';
           const error = `launch window ${settings.launchWindow}s expired after ${age}s: ${reason}`;
           if (!session?.launch_expired_at) {
-            // a fresh launch the reading never showed has no session to resume: its next run starts fresh
+            // An unbound launch retains its unknown conversation and needs deliberate disposition before replacement.
             setRunSession(db, runRow.id, { launch_expired_at: t, launch_error: error, ...(session?.launch_key && session.mode === 'fresh' ? { forgotten: true } : {}) });
             event(db, id, 'session_launch_expired', { error, age_seconds: age, window_seconds: settings.launchWindow, key: session?.launch_key ?? null, pane: session?.pane ?? null }, runRow.id);
           }
@@ -744,6 +872,14 @@ async function supervise(board, fleet, settings, report, entry, effects) {
         if (t - Number(session.launched_at ?? 0) < settings.crashGrace) return;
         // how the worker ended, from the exit code its wrapper wrote (Hermes reads its reaped children's)
         const code = session.exit_file && existsSync(session.exit_file) ? Number(readFileSync(session.exit_file, 'utf8').trim()) : null;
+        if (code === 78) {
+          const refusal = session.continuation_failure_file && existsSync(session.continuation_failure_file)
+            ? readFileSync(session.continuation_failure_file, 'utf8').trim() : null;
+          const error = refusal || `headless worker ${session.pid} could not continue or retain its native conversation; its refusal is in ${join(logsDir(board.root, board.slug), `${id}.log`)}`;
+          setRunSession(db, runRow.id, { continuation_required: true });
+          surfaceIncident(db, board, entry, id, 'exited', { code, worker_pid: session.pid, error }, runRow.id);
+          return;
+        }
         const why = code === 75 ? 'worker hit a rate limit (exit 75)' : code === 0 ? `worker ${session.pid} exited cleanly (rc=0) without completing or blocking the card` : `worker ${session.pid} exited${code === null ? '' : ` with ${code}`} without completing the card`;
         observe('exited', { code, worker_pid: session.pid, exit_code: code, protocol_violation: code === 0, error: why }, 'crashed');
         return;
@@ -771,9 +907,8 @@ async function supervise(board, fleet, settings, report, entry, effects) {
               return;
             } catch (error) { if (!error.noTransition) { report.failed.push([id, `session_closed: ${String(error.message).slice(-200)}`]); return; } }
           }
-          if (exit.failed && session.mode === 'resume' && !session.seen_at) {
-            setRunSession(db, runRow.id, { resumable: false, resume_failed_before_live: true });
-          }
+          if (exit.failed && session.mode === 'resume' && !session.seen_at)
+            setRunSession(db, runRow.id, { resume_failed_before_live: true });
           observe('exited', ended, 'crashed');
           return;
         }
@@ -798,9 +933,7 @@ async function supervise(board, fleet, settings, report, entry, effects) {
         if (alive) { next.seen_at ??= t; next.missing_since = null; }
         if (missing) next.missing_since ??= t;
         if (missing && (ended || t - next.missing_since >= Number(limits.grace ?? settings.grace))) {
-          // lost: its pane's end was seen, or it is gone from an online machine for the whole grace. A resume that never
-          // came up is not resumable.
-          if (next.mode === 'resume' && !next.seen_at) next.resumable = false;
+          // Loss, including a resume that never came up, retains the same conversation for deliberate disposition.
           setRunSession(db, runRow.id, next);
           observe('session_lost', { session_id: next.session_id, machine: next.machine, pane: next.pane, mode: next.mode, seen: Boolean(next.seen_at),
             never_came_up: next.mode === 'fresh' && !next.seen_at, ...(ended ? { pane_ended: ended } : {}),
@@ -824,7 +957,7 @@ async function supervise(board, fleet, settings, report, entry, effects) {
 /** A running card's limits: its status's `run.limits`, each evaluated for the card (seconds; null for none). */
 function limitsOf(db, board, entry, task, session) {
   const status = statusOf(db, task);
-  const scope = scopeOf(db, board, task, { params: entry.params, extra: { run: { surface: session?.surface ?? null, local: true } } });
+  const scope = scopeOf(db, board, task, { params: entry.params, lazy: true, extra: { run: { surface: session?.surface ?? null, local: true } } });
   const out = {};
   for (const [name, expr] of Object.entries({ ...entry.workflow.run?.limits, ...runSpec(entry, status, task)?.limits })) {
     const v = evaluate(expr, scope);
@@ -833,33 +966,42 @@ function limitsOf(db, board, entry, task, session) {
   return out;
 }
 
-async function stopSession(board, session) {
+async function stopSession(board, session, revalidate = () => {}) {
   if (!session) return;
   if (view(board, db => detachedSession(db, session))) throw Object.assign(new Error('close deferred: session was detached to a person'), { sessionDetached: true });
-  return sessionOperation(board, { address: addressOf(session), kind: 'session close' }, () => stopOwnedSession(board, session));
+  return sessionOperation(board, { address: addressOf(session), kind: 'session close' }, () => stopOwnedSession(board, session, revalidate));
 }
 
-async function stopOwnedSession(board, session) {
+async function stopOwnedSession(board, session, revalidate = () => {}) {
   if (boardCopyOf(board)) throw copyRefusal(board, 'closes no session');
-  if (session.surface === 'headless' && pidAlive(session.pid)) {
+  if (session.surface === 'headless') {
+    if (normalMachine(session.machine ?? localMachine()) !== localMachine()) throw new Error(`close deferred: headless worker ${session.pid} is not on this machine`);
+    if (!session.pid) throw new Error('close deferred: headless launch has no confirmed worker pid');
+    if (!pidAlive(session.pid)) return;
     // SIGTERM to the worker's process group, then SIGKILL if it is still there after a grace, as Hermes stops its own
-    const signal = (sig) => { try { process.kill(-session.pid, sig); } catch { try { process.kill(session.pid, sig); } catch { /* gone */ } } };
-    signal('SIGTERM');
+    const signal = (sig) => { try { stopWorkChild(session.pid, () => process.kill(-session.pid, sig), { signal: sig }); } catch { try { stopWorkChild(session.pid, () => process.kill(session.pid, sig), { signal: sig }); } catch { /* gone */ } } };
+    revalidate(); signal('SIGTERM');
     for (let waited = 0; waited < 10 && pidAlive(session.pid); waited += 1) await new Promise((resolve) => setTimeout(resolve, 500));
-    if (pidAlive(session.pid)) signal('SIGKILL');
+    if (pidAlive(session.pid)) {
+      revalidate(); signal('SIGKILL');
+      for (let waited = 0; waited < 10 && pidAlive(session.pid); waited += 1) await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    if (pidAlive(session.pid)) throw new Error(`close deferred: headless worker ${session.pid} is still present after SIGKILL`);
     return;
   }
   if (session.surface !== 'headless' && offlineMachine(session.machine)) throw new Error(`close deferred: machine ${normalMachine(session.machine)} is offline`);
   if (!session.pane && session.surface === 'native') {
+    revalidate();
     const r = await sc(['close', addressOf(session)], { timeout: 120_000, as: boardAddress(board.label) });
     if (r.code !== 0) throw new Error(`${doorTransient(r) ? 'close deferred: ' : ''}closing native session ${addressOf(session)}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
     // the close's receipt is a discovery taken after it, never the round's cached one from before
-    discoveries.delete(nativeKey(session.machine, session.harness, session.session_id));
-    const reading = nativeReading(await readNative(session.machine, session.harness, session.session_id, session.codex_home ?? null), session);
+    discoveries.delete(nativeKey(session.machine, session.harness, session.session_id, nativeHomes(session)));
+    const reading = nativeReading(await readNative(session.machine, session.harness, session.session_id, nativeHomes(session)), session);
     if (reading.alive !== false) throw new Error(`native close has no confirmed stopped receipt for ${addressOf(session)}`);
     return;
   }
   if (session.pane) {
+    revalidate();
     const r = await runtimeDoor(normalMachine(session.machine??localMachine())===localMachine()?null:session.machine,'harness.v1.panes.close',{pane:session.pane,...(session.launch_key?{launch:session.launch_key}:{})},{env:commandEnv(),timeout:60_000,as:boardAddress(board.label)});
     // a door that timed out or could not be reached says nothing about the pane: the close waits for the next round
     const transient = doorTransient(r);
@@ -912,77 +1054,120 @@ export function whereOf(board, task) {
 // what the platform tells expressions about this machine and this tick
 const hostOf = (pressure) => ({ memory_pressure: pressure, max_in_progress: derivedMaxInProgress() });
 
-/** What every board of the home at `root` holds now, counted for its caps (capacity.mjs). */
-async function homeHoldings(root, slugs, lanes, fleet, entry) {
-  const live = (s) => fleet.sessions?.find((x) => x.address === addressOf(s)) ?? null;
-  const out = [];
-  for (const slug of slugs) {
-    try {
-      // Capacity spans awaits. It needs its own committed snapshot, not the shared writer's total_changes counter:
-      // unrelated owner calls and delivery writes used to invalidate all three attempts at this read.
-      let b;
-      try { b = openBoardSnapshot(root, slug); }
-      catch (error) {
-        if (error.code !== 'board_read_by_owner') throw error;
-        b = openBoard(root, slug); // files/non-WAL backings retain their guarded optimistic read
-      }
+/**
+ * What every board of the home at `root` holds now, counted for its caps (capacity.mjs). A counted session's model is
+ * the one its transcript last names (transcriptOf), as this machine's daemon holds it: asked once a round, for the
+ * sessions counted, through harness.v1.transcripts.models. The count is taken with the answers the last round had; where
+ * this round's answers differ, it is taken again with them, so it always counts this round's. With `retainRevisions`,
+ * each board read by the count returned stays open with its revision (`revisions`, closed by `releaseRevisions`), so a
+ * start's admission can check nothing changed since.
+ */
+async function homeHoldings(root, slugs, lanes, fleet, entry, { retainRevisions = false } = {}) {
+  const live = (s) => fleetSessionRow(fleet, s);
+  const count = async (modelOf, read) => {
+    const out = [];
+    out.revisions = new Map();
+    out.releaseRevisions = () => { for (const held of out.revisions.values()) held.board.close(); out.revisions.clear(); };
+    for (const slug of slugs) {
       try {
-        b.slug ??= slug; b.label ??= boardLabel(root, slug);
-        // each run's session read before it is counted live or not (unknown stays unknown)
-        for (const r of b.db.prepare('SELECT r.metadata FROM tasks t JOIN task_runs r ON r.id = t.current_run_id').all()) await readBefore(fleet, json(r.metadata, {})?.supercode);
-        const storedOf = (id) => storedStatus(b.db, b, entry, id).stored;
-        // a session on a machine whose record is not current is not known gone: it keeps its place in the caps
-        out.push(...await holdings(b, { lanes, fleetOk: fleet.ok,
-          alive: (s) => sessionAlive(fleet, s) ?? (s?.surface !== 'headless' && s?.machine && fleet.unknown?.has(normalMachine(s.machine)) ? true : null), liveRecord: live, modelOf: transcriptModel, storedOf, machineOf: normalMachine, home: localMachine(),
-          runLaneOf: row => runLane(b.db, b, entry, getTask(b.db, row.id), lanes) }));
-      }
-      finally { b.close(); }
-    } catch (error) { error.capacityUnread = true; throw error; }
+        // The owner holds this connection and its current-row projection. Capacity validates its
+        // optimistic revision across yields; an unstable read still admits nothing.
+        const b = openBoard(root, slug);
+        try {
+          b.slug ??= slug; b.label ??= boardLabel(root, slug);
+          // each run's session read before it is counted live or not (unknown stays unknown)
+          if (read) for (const r of b.db.prepare('SELECT r.metadata FROM tasks t JOIN task_runs r ON r.id = t.current_run_id').all()) await readBefore(fleet, json(r.metadata, {})?.supercode);
+          const storedOf = (id, row) => {
+            // The usual native hold mapping depends only on this card's retained columns. Custom
+            // stored_as expressions retain their ordinary authoritative evaluation.
+            if (entry.workflow.stored_as?.length) return storedStatus(b.db, b, entry, id).stored;
+            if (entry.workflow.flags?.paused && !row.archived) {
+              if (json(row.paused, null)) return 'paused';
+              if ((json(row.blocked_by, []) ?? []).length) return 'blocked';
+            }
+            return entry.workflow.flags?.paused ? storedAs(entry.workflow,row.stage) : row.status;
+          };
+          // a session on a machine whose record is not current is not known gone: it keeps its place in the caps
+          out.push(...await holdings(b, { lanes, fleetOk: fleet.ok,
+            alive: (s) => sessionAlive(fleet, s) ?? (s?.surface !== 'headless' && s?.machine && fleet.unknown?.has(normalMachine(s.machine)) ? true : null), liveRecord: live, modelOf, storedOf, machineOf: normalMachine, home: localMachine(),
+            runLaneOf: row => runLane(b.db, b, entry, getTask(b.db, row.id), lanes) }));
+          if (retainRevisions) out.revisions.set(slug, { board: b, revision: currentRecordChanges(b.db).token });
+        }
+        finally { if (!retainRevisions || !out.revisions.has(slug)) b.close(); }
+      } catch (error) { out.releaseRevisions(); error.capacityUnread = true; throw error; }
+    }
+    return out;
+  };
+  const asked = new Map();
+  const transcriptKey = (t) => JSON.stringify([t.address, t.locator.storage]);
+  const modelOf = (s) => { const t = transcriptOf(fleet, s); if (!t) return null; const key = transcriptKey(t); asked.set(key, t.locator); return transcriptModels.get(key) ?? null; };
+  let out = await count(modelOf, true);
+  let answered;
+  try { answered = asked.size ? await readTranscriptModels(asked) : new Map(); }
+  catch (error) { out.releaseRevisions(); throw error; }
+  const changed = [...new Set([...asked.keys(), ...transcriptModels.keys()])].some((key) => (answered.get(key) ?? null) !== (transcriptModels.get(key) ?? null));
+  transcriptModels = answered;
+  if (changed) {
+    // the count taken again holds its own boards' revisions, read with it
+    out.releaseRevisions();
+    out = await count((s) => { const t = transcriptOf(fleet, s); return t ? transcriptModels.get(transcriptKey(t)) ?? null : null; }, false);
   }
   out.defaults = harnessDefaults(out);
   return out;
 }
 
-// where each session's transcript is, once found (a session's file does not move)
-const transcripts = new Map();
+/** The models this machine's daemon last answered, by address and transcript storage (homeHoldings). */
+let transcriptModels = new Map();
+/** One ask of this machine's daemon for the model each of `asked` (identity → transcript locator) last names: a map of
+ *  the answers (a model or null); empty when the daemon did not answer, so each reads as unknown (null). */
+async function readTranscriptModels(asked) {
+  const entries = [...asked];
+  const r = await doorOn(localMachine(), 'harness.v1.transcripts.models', { locators: entries.map(([, locator]) => locator) }, { timeout: NATIVE_DISCOVERY_MS });
+  const models = r.code === 0 ? lastJson(r.stdout)?.models : null;
+  if (!Array.isArray(models) || models.length !== entries.length) return new Map();
+  return new Map(entries.map(([key], index) => [key, typeof models[index] === 'string' ? models[index] : null]));
+}
 
 /**
- * The model a session on this machine runs, as its own transcript reports it (Claude Code's assistant messages and
- * Codex's turn contexts both carry `"model"`): the last one written, so a model changed mid-session is the one read.
- * Null for another machine's session, or one whose transcript cannot be found or names none.
+ * The transcript a session on this machine runs in, whose model (the last one its transcript's last 512 KiB names,
+ * interchange transcript-model.mjs) its machine's daemon holds: `{ address, locator }`, the locator from the round's
+ * fleet reading (the record's sessions) or this round's discovery of the session, and only for the transcript the board
+ * has always read: Claude Code's under this process's own CLAUDE_CONFIG_DIR (or ~/.claude), `projects/<folder>/<id>.jsonl`;
+ * Codex's rollout under its own CODEX_HOME (or ~/.codex), `sessions/<year>/<month>/<day>/…-<id>.jsonl`, the home and
+ * the transcript compared by real path (realOf). Null for another machine's session, another harness's, a transcript
+ * elsewhere (another home, a compressed rollout), or one neither reading holds.
  */
-function transcriptModel(session) {
+// each path as its real path (symlinks resolved), kept once resolved: a home and a transcript are compared by where
+// they are, however either is spelled; a path that does not resolve stands as written, and is resolved again next time
+const realPaths = new Map();
+const realOf = (path) => {
+  if (realPaths.has(path)) return realPaths.get(path);
+  try { const real = realpathSync(path); realPaths.set(path, real); return real; } catch { return path; }
+};
+function transcriptOf(fleet, session) {
   if (!session?.session_id || normalMachine(session.machine ?? localMachine()) !== localMachine()) return null;
-  const sid = session.session_id;
-  let file = transcripts.get(sid);
-  if (file === undefined) {
-    file = null;
-    try {
-      if ((session.harness ?? 'claude-code') === 'claude-code') {
-        const projects = join(process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude'), 'projects');
-        for (const dir of readdirSync(projects)) { const f = join(projects, dir, `${sid}.jsonl`); if (existsSync(f)) { file = f; break; } }
-      } else if (session.harness === 'codex') {
-        // Codex files its rollouts by day: sessions/YYYY/MM/DD/rollout-<time>-<id>.jsonl, newest days first
-        const root = join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'sessions');
-        const sorted = (dir) => readdirSync(dir).sort().reverse();
-        search: for (const y of sorted(root)) for (const m of sorted(join(root, y))) for (const d of sorted(join(root, y, m))) {
-          const hit = readdirSync(join(root, y, m, d)).find((f) => f.endsWith(`-${sid}.jsonl`));
-          if (hit) { file = join(root, y, m, d, hit); break search; }
-        }
-      }
-    } catch { file = null; }
-    if (file) transcripts.set(sid, file);
-  }
-  if (!file) return null;
-  try {
-    const size = statSync(file).size;
-    const fd = openSync(file, 'r');
-    const length = Math.min(size, 512 * 1024);
-    const buf = Buffer.alloc(length);
-    try { readSync(fd, buf, 0, length, size - length); } finally { closeSync(fd); }
-    const models = [...buf.toString('utf8').matchAll(/"model":"([^"]+)"/g)].map((m) => m[1]).filter((m) => !m.startsWith('<'));
-    return models.at(-1) ?? null;
-  } catch { return null; }
+  const harness = session.harness ?? 'claude-code', sid = session.session_id;
+  if (harness !== 'claude-code' && harness !== 'codex') return null;
+  const homes = nativeHome(session)?.homes;
+  if (!homes) return null;
+  const address = `sc:${localMachine()}:${harness}:${sid}`;
+  const named = (row) => row?.locator?.harness === harness && row.locator.session_id === sid ? row : null;
+  const read = (row) => {
+    const path = row?.locator?.storage?.kind === 'file' ? row.locator.storage.path : null;
+    if (typeof path !== 'string') return null;
+    const real = realOf(path);
+    if (harness === 'claude-code') {
+      const projects = realOf(homes.claude_code);
+      if (dirname(dirname(real)) !== projects || basename(real) !== `${sid}.jsonl`) return null;
+    } else {
+      const root = realOf(homes.codex);
+      if (dirname(dirname(dirname(dirname(real)))) !== root || !basename(real).endsWith(`-${sid}.jsonl`)) return null;
+    }
+    return { address, locator: row.locator };
+  };
+  // the record's row, else this round's discovery of the session
+  return fleet?.transcripts?.get(address)?.map(named).map(read).find(Boolean)
+    ?? read(discoveries.get(nativeKey(localMachine(), harness, sid, homes))?.sessions.find(named));
 }
 
 /**
@@ -1000,7 +1185,24 @@ async function startCards(board, fleet, lanes, settings, report, entry, effects,
   const pressure = memoryPressure();
   const tickState = { local_started: 0 };
   const startable = new Set(Object.keys(workflow.statuses).filter((status) => transitionsFor(workflow, status, d.start).length));
-  const everyCard = board.db.prepare("SELECT id FROM tasks WHERE status != 'archived'").all().map((r) => getTask(board.db, r.id));
+  // These exclusions are unconditional below; workflow guards, priority, dependencies and
+  // clocks still decide over the resulting current candidates on every round.
+  const everyCard = [];
+  let startCursor = '';
+  for (;;) {
+    const page = view(board, db => db.prepare(`SELECT t.id FROM supercode_cards c CROSS JOIN tasks t ON t.id=c.task_id
+      WHERE c.subtask_of IS NULL AND c.stage NOT IN ('done','cancelled') AND t.current_run_id IS NULL
+        AND t.status!='archived' AND t.id>?${only ? ' AND t.id=?' : ''}
+      UNION ALL SELECT t.id FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id
+      WHERE t.current_run_id IS NULL AND t.status NOT IN ('archived','done','cancelled') AND c.stage IS NULL
+        AND c.subtask_of IS NULL AND t.id>?${only ? ' AND t.id=?' : ''} ORDER BY id LIMIT 32`)
+      .all(startCursor, ...(only ? [only] : []), startCursor, ...(only ? [only] : [])));
+    if (!page.length) break;
+    everyCard.push(...page);
+    startCursor = page.at(-1).id;
+    if (page.length < 32) break;
+    await yieldToOwner();
+  }
   const scopeFor = (task, extra = {}) => scopeOf(board.db, board, task, { params, lazy: true, extra: { host: hostOf(pressure), tick: tickState, ...extra } });
   // who would run it: the role of the status its start moves it to, and that role's lane
   const planOf = (task, scope) => {
@@ -1017,34 +1219,41 @@ async function startCards(board, fleet, lanes, settings, report, entry, effects,
     report.queued.push([task.id, why]);
     if (!dry && !guardNoted(board.db, task.id, why)) tx(board, db => noteGuard(db, task.id, why));
   };
-  for (const task of everyCard) {
+  const selectionWait = (task, state) => {
+    if (state.person) return `assigned to ${state.person}: a person's card runs no session; it closes when that person completes it`;
+    if (state.status === 'running' && completedWork(board.db, task.id)) return 'work is complete; the board must select its independent review before another implementer run';
+    if (state.detached) return `session belongs to ${state.detached.person}; verified adoption is required`;
+    if (state.dispatch_hold) return 'dispatch held: an explicit start or verified adoption must release it';
+    if (state.backlog) return `backlog: ${state.backlog.reason ?? 'not planned to start'}`;
+    if (workflow.run && state.paused) return `paused: ${state.paused.reason ?? 'manager pause'}`;
+    if (workflow.run && state.blocked_by.length) return `blocked by ${state.blocked_by.map(b => b.id).join(', ')}`;
+    if (workflow.run && state.every && state.next_run_at > now()) return `next scheduled run at ${state.next_run_at}`;
+    if (!startable.has(state.status)) return `no ${d.start} transition from ${state.status}`;
+    return null;
+  };
+  for (const { id } of everyCard) {
+    await yieldToOwner();
+    if (stopping) return;
+    const task = view(board, db => getTask(db, id));
+    if (!task) continue;
     if (only && task.id !== only) continue;
     // a subtask or a card with a run is never started here, whatever its scope says: no scope is built to learn it (the
     // scope of each of a board's 2,155 unarchived cards, 2,039 of them subtasks or running, was 0.8 s of every round)
     if (task.subtask_of || task.current_run_id) continue;
     const state = scopeFor(task).card;
     if (state.archived || ['done', 'cancelled'].includes(state.status)) continue;
-    // A person's card is a dependency on that person, never work for a session: the board starts none for it, whatever
-    // its workflow's start would allow, and it closes when that person completes it (person-done).
-    if (state.person) { waiting(task, `assigned to ${state.person}: a person's card runs no session; it closes when that person completes it`); continue; }
-    if (state.status === 'running' && completedWork(board.db, task.id)) {
-      waiting(task, 'work is complete; the board must select its independent review before another implementer run'); continue;
-    }
-    if (state.detached) { waiting(task, `session belongs to ${state.detached.person}; verified adoption is required`); continue; }
-    if (state.dispatch_hold) { waiting(task, 'dispatch held: an explicit start or verified adoption must release it'); continue; }
-    if (workflow.run && state.paused) { waiting(task, `paused: ${state.paused.reason ?? 'manager pause'}`); continue; }
-    if (workflow.run && state.blocked_by.length) { waiting(task, `blocked by ${state.blocked_by.map(b => b.id).join(', ')}`); continue; }
-    if (workflow.run && state.every && state.next_run_at > now()) { waiting(task, `next scheduled run at ${state.next_run_at}`); continue; }
-    if (!startable.has(state.status)) { waiting(task, `no ${d.start} transition from ${state.status}`); continue; }
+    const selectionReason = selectionWait(task, state);
+    if (selectionReason) { waiting(task, selectionReason); continue; }
     const plan = planOf(task, scopeFor(task));
     if (!plan) { waiting(task, `start guard refused: ${transitionsFor(workflow, state.status, d.start).map(t => t.guard ?? 'sender role').join(' | ')}`); continue; }
     const scope = scopeFor(task, { lane: plan.lane ?? {}, run: { surface: plan.lane?.surface ?? null, local: executionHost(plan.lane, task.machine, localMachine(), normalMachine) === localMachine() } });
     if (!holds(d.eligible ?? null, scope)) { waiting(task, `dispatch eligibility refused (memory ${pressure}, local starts ${tickState.local_started}): ${d.eligible}`); continue; }
-    candidates.push({ task, plan, scope });
+    candidates.push({ task, plan, status: state.status,
+      slot: String(templateValue(plan.runSpec?.session ?? 'worker', scope) ?? 'worker'),
+      order: (d.order ?? []).map((o) => { const desc = o.startsWith('-'); return { v: evaluate(desc ? o.slice(1) : o, scope), desc }; }) });
   }
-  const keyOf = (c) => (d.order ?? []).map((o) => { const desc = o.startsWith('-'); const v = evaluate(desc ? o.slice(1) : o, c.scope); return { v, desc }; });
   candidates.sort((a, b) => {
-    const ka = keyOf(a); const kb = keyOf(b);
+    const ka = a.order; const kb = b.order;
     for (let i = 0; i < ka.length; i += 1) {
       if (ka[i].v === kb[i].v) continue;
       const lt = (ka[i].v ?? -Infinity) < (kb[i].v ?? -Infinity);
@@ -1055,16 +1264,23 @@ async function startCards(board, fleet, lanes, settings, report, entry, effects,
   // the caps, over what the home holds now; what each candidate would be once started
   const caps = capacity(d.capacity, held, evaluate);
   const entryOf = (c) => ({ card: c.task.id, board: board.slug, machine: executionHost(c.plan.lane, c.task.machine, localMachine(), normalMachine), assignee: c.plan.profile ?? null,
-    dispatch: true, slot: String(templateValue(c.plan.runSpec?.session ?? 'worker', c.scope) ?? 'worker'),
+    dispatch: true, slot: c.slot,
     status: c.plan.target, stored: c.plan.target, model: c.task.model_override ?? c.plan.lane?.model ?? held.defaults?.[c.plan.lane?.harness] ?? null, harness: c.plan.lane?.harness ?? null });
   const waitingEntries = candidates.map(entryOf);
   // a dry run (dispatch --dry-run) plans the same way and writes nothing: no notes, no moves, no launches
   const note = (id, why) => { if (!dry && !guardNoted(board.db, id, why)) tx(board, (db) => noteGuard(db, id, why)); };
   for (const [i, c] of candidates.entries()) {
-    const { task, plan, scope } = c;
+    await yieldToOwner();
+    if (stopping) return;
+    const { task, plan } = c;
     if (!plan.profile) { report.unassigned.push(task.id); note(task.id, 'no profile runs it (no assignee, and the workflow names none)'); continue; }
     if (!plan.lane) { report.nonspawnable.push(task.id); note(task.id, `${plan.profile} is no lane of this home`); continue; }
-    const capped = caps.admit(waitingEntries[i], scope, waitingEntries);
+    const capped = view(board, db => {
+      const current = getTask(db, task.id);
+      return current ? caps.admit(waitingEntries[i], scopeFor(current, { lane: plan.lane,
+        run: { surface: plan.lane.surface, local: executionHost(plan.lane, current.machine, localMachine(), normalMachine) === localMachine() } }), waitingEntries)
+        : { why: 'the selected card no longer exists' };
+    });
     let why = capped?.why ?? null;
     // the launcher's own conditions: a lane that can start this card where it names
     if (!why) why = launcherCheck(board.db, task, plan.lane, fleet);
@@ -1076,13 +1292,23 @@ async function startCards(board, fleet, lanes, settings, report, entry, effects,
     }
     let moved, checked;
     try {
-      checked = await checkWorkspace(board, task);
+      checked = await checkWorkspace(board, task, await workspaceForRun(board, task, { role: plan.runSpec?.role, slot: c.slot, lane: plan.lane }));
       moved = tx(board, (db) => {
         // The claim: another round (a second serve, a one-shot dispatch) may have started this card, or others that count
         // against the same caps, since this round read the board. Its starts are counted, and this card starts only if it
         // still waits where it did and still fits.
         const now = getTask(db, task.id);
-        if (!now || now.current_run_id || now.archived || statusOf(db, now) !== scope.card.status) throw Object.assign(new Error('started or moved by another round'), { claimedElsewhere: true });
+        if (!now || now.subtask_of || now.current_run_id || now.archived || statusOf(db, now) !== c.status) throw Object.assign(new Error('started or moved by another round'), { claimedElsewhere: true });
+        const scope = scopeFor(now, { lane: plan.lane, run: { surface: plan.lane.surface, local: executionHost(plan.lane, now.machine, localMachine(), normalMachine) === localMachine() } });
+        const selectionReason = selectionWait(now, scope.card);
+        if (selectionReason) throw Object.assign(new Error(selectionReason), { claimedElsewhere: true });
+        const currentPlan = planOf(now, scope);
+        if (!currentPlan || currentPlan.target !== plan.target || currentPlan.profile !== plan.profile
+          || ['model_override', 'provider_override', 'reasoning_effort', 'machine', 'workspace_kind', 'workspace_path', 'workspace_anchor', 'branch_name'].some(field => now[field] !== task[field])
+          || executionHost(plan.lane, now.machine, localMachine(), normalMachine) !== waitingEntries[i].machine
+          || String(templateValue(currentPlan.runSpec?.session ?? 'worker', scope) ?? 'worker') !== c.slot
+          || !holds(d.eligible ?? null, scope))
+          throw Object.assign(new Error('start selection changed while the owner answered other work'), { claimedElsewhere: true });
         for (const row of db.prepare('SELECT t.id, t.assignee, t.model_override, c.machine, r.metadata FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id JOIN task_runs r ON r.id=t.current_run_id WHERE t.current_run_id IS NOT NULL').all()) {
           const lane = lanes[row.assignee] ?? {}, status = statusOf(db, row);
           const session = json(row.metadata, {})?.supercode ?? {};
@@ -1093,9 +1319,9 @@ async function startCards(board, fleet, lanes, settings, report, entry, effects,
         }
         const refused = caps.admit(waitingEntries[i], scope, waitingEntries);
         if (refused) throw Object.assign(new Error(refused.why), { claimedElsewhere: true });
-        assertWorkspaceOwner(db, task, checked);
+        assertWorkspaceOwner(db, now, checked);
         if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.workspaceRoot, task.id);
-        if (!task.assignee && plan.profile) {
+        if (!now.assignee && plan.profile) {
           db.prepare('UPDATE tasks SET assignee = ? WHERE id = ?').run(plan.profile, task.id);
           event(db, task.id, 'assigned', { assignee: plan.profile, source: 'workflow role' });
         }
@@ -1142,6 +1368,8 @@ const superseded = (taskId, runId) => Object.assign(new Error(`run ${runId} of $
 /** A launch's preparation awaits (minting, workspace, doors) while the owner answers verbs: after each await, and right
  *  before it is issued, the run must still be the card's current, unended one (a cancel or restart meanwhile ends it). */
 function assertRunCurrent(board, taskId, runId) {
+  const task = view(board, db => getTask(db, taskId));
+  if (task?.backlog) throw Object.assign(new Error(`${taskId} is in backlog; plan it before launching work`), { launchSuperseded: true });
   if (!view(board, (db) => runCurrent(db, taskId, runId))) throw superseded(taskId, runId);
 }
 /** A write a launch makes for its run: made only while that run is still the card's current one, checked in the same
@@ -1155,7 +1383,10 @@ function runTx(board, taskId, runId, fn) {
 function launchFailed(board, entry, id, error, payload) {
   return tx(board, (db) => {
     if (!runCurrent(db, id, error.launchRun)) return null;
-    if (monitorsRuns(entry)) { surfaceIncident(db, board, entry, id, 'spawn_failed', payload, error.launchRun); return { effects: [] }; }
+    if (monitorsRuns(entry) || error.continuationRequired) {
+      if (error.continuationRequired) setRunSession(db, error.launchRun, { continuation_required: true });
+      surfaceIncident(db, board, entry, id, 'spawn_failed', payload, error.launchRun); return { effects: [] };
+    }
     if (recoversRuns(entry)) retainRecovery(db, id, 'spawn_failed', payload, error.launchRun);
     return fire(db, board, entry, id, 'spawn_failed', { roles: ['platform'], payload });
   });
@@ -1175,12 +1406,8 @@ export async function launchRun(board, entry, id, lane, fleet, settings) {
 
 async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
   let task = getTaskNow(board, id);
+  assertRunCurrent(board, id, runId);
   if (task.current_run_id !== runId) throw superseded(id, runId);
-  const checked = await checkWorkspace(board, task);
-  if (checked) runTx(board, id, runId, (db) => {
-    assertWorkspaceOwner(db, task, checked);
-    db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.workspaceRoot, id);
-  });
   const status = view(board, (db) => statusOf(db, task));
   const spec = runSpec(entry, status, task);
   if (!spec) return null;
@@ -1192,6 +1419,12 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
   // the run's session record knows its status, role and slot (a reviewer's slot is never the implementer's); the slot
   // is a template, so a step can ask for isolation by naming a new one
   const slot = String(templateValue(spec.session ?? 'worker', scope) ?? 'worker');
+  const workspaceOptions = await workspaceForRun(board, task, { role: spec.role, slot, lane, runId });
+  const checked = await checkWorkspace(board, task, workspaceOptions);
+  if (checked) runTx(board, id, runId, (db) => {
+    assertWorkspaceOwner(db, task, checked);
+    db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.workspaceRoot, id);
+  });
   // Explicit starts and deferred/resumed launches reach this path without startCards. Recheck the dispatcher-session
   // caps here too, excluding this attempt's own reservation. Other cap kinds keep their existing admission rules.
   const sessionCaps = entry.workflow.dispatch.capacity?.filter(cap => cap.counts === 'sessions' && cap.where?.dispatch === true) ?? [];
@@ -1234,16 +1467,29 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
   if (spec.role === 'reviewer') {
     const worker = view(board, (db) => lastSession(db, id, 'worker'));
     const reviewer = view(board, (db) => lastSession(db, id, slot));
-    if (slot === 'worker' || (worker?.session_id && worker.session_id === reviewer?.session_id)) throw new Error('a reviewer must have a different session from the implementer');
+    if (slot === 'worker' || (worker?.session_id && worker.session_id === reviewer?.session_id)) throw ownerRule('a reviewer must have a different session from the implementer');
   }
   // the model it runs is recorded with the session, for caps that count by model
-  const meta = { status, role: spec.role, slot, model: task.model_override ?? lane.model ?? null, prompt_digest: told.digest, ...(spec.role === 'reviewer' ? { review_candidate: reviewCandidate(board, id) } : {}) };
+  const meta = { status, role: spec.role, slot, continuation_required: false, model: task.model_override ?? lane.model ?? null, prompt_digest: told.digest, ...(spec.role === 'reviewer' ? { review_candidate: reviewCandidate(board, id) } : {}) };
+  await retireUnissuedSlotLaunch(board, id, runId, slot);
+  assertRunCurrent(board, id, runId);
   try {
     // Teams is never on a launch's path: the card's agent is its identity minted on this host under its retained intent,
     // and its sessions are joined to it off this path, after the launch. No Teams answer starts, stops or holds a card.
     const context=current().facts.SUPERCODE_CONTEXT,team=agentScope(context);
-    const agent=await localCardAgent({root:board.root,org:team.org,server:team.server,profiles:entry.profiles,
-      profile:lane.name,card:id,handle:cardHandleOf(board,id),readableId:readableIdOf(board,id),role:spec.role??slot});
+    const decision = continuationDecision(board, task, runId, slot, lane, spec.role ?? slot);
+    meta.slot_generation = decision.authorization ? randomUUID() : decision.prior?.generation ?? randomUUID();
+    // Adoption never transfers ownership or creates launch identity. A later continuation keeps that policy.
+    let agent = null;
+    if (decision.prior && adoptedOnly(decision.prior.session) && !decision.authorization) {
+      Object.assign(meta, { agent_id: null, agent_org: null, agent_context: null, agent_env: {},
+        agent_profile_intent: structuredClone(resolveAgentProfile(entry.profiles, lane.name).resolved) });
+    } else {
+    agent=await localCardAgent({root:board.root,org:team.org,server:team.server,profiles:entry.profiles,
+      profile:lane.name,card:id,handle:cardHandleOf(board,id),readableId:readableIdOf(board,id),role:spec.role??slot,
+      // an authorized replacement binds only the agent its decision names; one naming none mints the role's next generation
+      ...((decision.authorization ? decision.authorization.target?.agent : decision.prior?.session?.agent_id)
+        ? { existingAgent: decision.authorization ? decision.authorization.target.agent : decision.prior.session.agent_id } : {})});
     assertRunCurrent(board,id,runId);
     recordCardAgentAssignment(board,cardAgentAssignments(board.root,id).find(assignment=>assignment.org===team.org&&assignment.id===agent.assignment));
     // G3: a run of an agent over its budget does not start; the reason waits on the card until the window passes
@@ -1261,15 +1507,16 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
     assertRunCurrent(board,id,runId);
     if(surface==='headless')meta.agent_env.HERMES_HOME=agentHome;
     else{const memory=await memorySnapshot(agentHome).catch(()=>'');assertRunCurrent(board,id,runId);if(memory)prompt=`${prompt}\n\n${memory}`;}
+    }
     const result = surface === 'pane'
-      ? await launchPane(board, task, runId, lane, fleet, { input: briefByReference(board, task, runId, spec.role ?? slot, where, prompt), slot, meta, orchestration: entry.orchestration ?? { profiles: entry.profiles } })
-      : await launchHeadless(board, task, runId, lane, settings, { prompt, skills: spec.skills ?? [], meta });
+      ? await launchPane(board, task, runId, lane, fleet, { input: briefByReference(board, task, runId, spec.role ?? slot, where, prompt), slot, meta, workspaceOptions, orchestration: entry.orchestration ?? { profiles: entry.profiles } })
+      : await launchHeadless(board, task, runId, lane, settings, { prompt, skills: spec.skills ?? [], meta, workspaceOptions });
     tx(board,db=>{
       if(!runCurrent(db,id,runId))return; // replaced once launched: its session is the ended run's, closed as one
       setRunSession(db,runId,{launch_deferred:false,launch_deferred_error:null,restart_authorized:false});
       event(db,id,'restart_authorization_consumed',{},runId);
     });
-    if(result?.session_id)recordAgentRun(board.root,team.org,agent.identity.id,{session:`${result.harness}:${result.session_id}`,machine:result.machine,run:runId});
+    if(result?.session_id&&agent)recordAgentRun(board.root,team.org,agent.identity.id,{session:`${result.harness}:${result.session_id}`,machine:result.machine,run:runId});
     return result;
   } catch(error) {
     // An issued asynchronous launch may bind later. Its original permission
@@ -1294,6 +1541,25 @@ async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
   }
 }
 
+function continuationDecision(board, task, runId, slot, lane, role, agent = undefined) {
+  const assignment = cardAgentAssignments(board.root, task.id).find(item => item.id === cardRoleAssignment(task.id, role) && item.state === 'active');
+  const decision = view(board, db => replacementFor(db, task.id, slot, { harness: lane.harness, cardMachine: task.machine,
+    agent, assignment, beforeRun: runId }));
+  const previous = decision.prior?.session;
+  if (previous && !decision.authorization) {
+    if (!previous.session_id) throw continuationRefusal(decision.prior, 'its issued launch has no known native conversation id');
+    if (previous.forgotten) throw continuationRefusal(decision.prior, 'a forgotten marker has no current deliberate replacement decision');
+    if ((previous.harness ?? 'claude-code') !== lane.harness) throw continuationRefusal(decision.prior, 'the configured harness changed without a matching manager decision');
+    if (normalMachine(previous.machine) !== executionHost(lane, task.machine, localMachine(), normalMachine))
+      throw continuationRefusal(decision.prior, 'the configured machine changed without a matching manager decision');
+    if (assignment && previous.agent_id && assignment.agent_id !== previous.agent_id)
+      throw continuationRefusal(decision.prior, 'the role owner changed without a matching assignment decision');
+    if (agent !== undefined && previous.agent_id && previous.agent_id !== agent)
+      throw continuationRefusal(decision.prior, 'the established conversation belongs to a different agent');
+  }
+  return { ...decision, assignment };
+}
+
 /**
  * What the board types into a pane session to start a run: one short line in the board's own words naming the role,
  * the card and where the run's brief is, with the brief itself kept in a file. A terminal harness takes its input as a
@@ -1324,16 +1590,16 @@ export function roleBrief(db, board, entry, task, status, surface = 'pane') {
   if (!spec) return null;
   const where = whereOf(board, task);
   const nativeHolds = Boolean(entry.workflow.flags?.paused);
-  const scope = scopeOf(db, board, task, { params: entry.params });
+  const scope = scopeOf(db, board, task, { params: entry.params, lazy: true });
   // a subtask's run also sees its arc: the arc's text, tasks and thread (where its owner's rulings are)
-  const prompt = render(spec.prompt, { ...scope, where, context: cardContext(db, task.id, { nativeHolds }),
+  const prompt = render(spec.prompt, { ...scope, where, context: cardContext(db, task.id, { nativeHolds, review: spec.role === 'reviewer' }),
     arc_context: task.subtask_of ? cardContext(db, task.subtask_of, { nativeHolds }) : '', doors: doors(entry.workflow, status, spec.role, task.id, where, surface) });
   return { spec, where, prompt, digest: promptDigest(spec) };
 }
 const promptDigest = (spec) => spec?.prompt ? createHash('sha256').update(String(spec.prompt)).digest('hex').slice(0, 16) : null;
 
-/** File a role's brief (roleBrief) to the session at `address` on run `runId`, by reference, as a session notice in the
- *  caller's transaction, and record which prompt it was. */
+/** File a role's brief (roleBrief) to the session at `address` on run `runId`, by reference, as a session notice effect
+ *  in the caller's transaction (sessionNotice files it as the run's instruction), and record which prompt it was. */
 function queueBrief(db, board, task, runId, address, told, how) {
   const role = told.spec.role ?? 'implementer';
   const text = briefByReference(board, task, runId, role, told.where, told.prompt, how);
@@ -1342,6 +1608,7 @@ function queueBrief(db, board, task, runId, address, told, how) {
     messageKey: `board-brief-${task.id}-${runId}-${told.digest}-${how}-${createHash('sha256').update(address).digest('hex').slice(0, 12)}` };
   db.prepare('INSERT INTO supercode_effects (effect) VALUES (?)').run(JSON.stringify(effect));
   setRunSession(db, runId, { prompt_digest: told.digest });
+  return source;
 }
 
 /**
@@ -1349,16 +1616,19 @@ function queueBrief(db, board, task, runId, address, told, how) {
  * it was told (its run's `prompt_digest`; a run that records none was never told this one), as a room's guidance is told
  * again on every change. A session being launched, closed, released or in a person's hands is told nothing here.
  */
-function retellBriefs(board, entry, report) {
+async function retellBriefs(board, entry, report) {
   // each card in its own write: a brief that cannot be told (its prompt unreadable, its card changed) is said in the
   // round's report and stops no other card's
   for (const { id } of view(board, (db) => db.prepare('SELECT id FROM tasks WHERE current_run_id IS NOT NULL').all())) {
+    await yieldToOwner();
+    if (stopping) return;
     try {
       tx(board, (db) => {
         const run = currentRun(db, id), session = run?.metadata?.supercode, address = addressOf(session);
         if (!run || run.ended_at != null || !address || session.surface === 'headless' || session.launch_pending || session.launch_deferred
           || session.close_requested || session.close_confirmed_at || session.released || detachedSession(db, session)) return;
         const task = getTask(db, id), status = statusOf(db, task);
+        if (task.backlog || task.paused || task.blocked_by.length || scopeOf(db, board, task, { params: entry.params, lazy: true }).card.dispatch_hold) return;
         if (promptDigest(runSpec(entry, status, task)) === (session.prompt_digest ?? null)) return;
         const told = roleBrief(db, board, entry, task, status, 'pane');
         if (!told?.digest) return;
@@ -1384,38 +1654,101 @@ function pendingBrief(board, task, runId, where) {
   return existsSync(file) ? `Run ${runId}'s instructions from the board are its brief ${briefFrom(board, task, file, where)}, and carry it out.` : null;
 }
 
-/** Start one card now by a person's word (a triage card's session, a manager's start): the workflow's start event. */
-export async function startCard(board, id, { roles = ['manager'], lanes, settings } = {}) {
+/** Start one card now, or retain the exact unmet admission detail without claiming a launch. */
+export async function startCard(board, id, options = {}) {
+  try { return await startCardNow(board, id, options); }
+  catch (error) {
+    if (error.ownerRule) return routeRequest(board, { id, name: 'start', payload: {}, reason: error });
+    if (!error.boardDetail && !error.refusal && !error.noTransition && !error.continuationRequired
+        && !error.launchDeferred && !error.launchPending && error.code !== 'review_refused') throw error;
+    return acceptRequest(board, { id, name: 'start', payload: {}, reason: error });
+  }
+}
+
+async function startCardNow(board, id, { roles = ['manager'], lanes, settings } = {}) {
   // the board's own published fleet projection, as a tick reads it: a manager's or creator's start that continues the
   // slot's session checks that session through it
   fleetRoot = board.root;
   const entry = await loadWorkflow(board.root);
+  if (!roles.some(role => ['manager', 'creator'].includes(role))) throw ownerRule('Only the manager or creator starts a held card; request its decision.');
+  lanes ??= lanesOf(entry.profiles);
+  settings ??= boardSettings(entry.params);
+  const expiryEffects = tx(board, db => { const effects = []; settleExpiringFlags(db, board, entry, effects); return effects; });
+  queueEffects(board, expiryEffects);
+  const stop = paused(board.root);
+  if (stop) throw requestDetail(`the board is stopped: ${stop.reason ?? stop}`);
+  const before = getTaskNow(board, id);
+  if (!before) throw requestDetail(`no card ${id}`);
   const fleet = await observeFleet();
-  const before = getTaskNow(board, id), checked = await checkWorkspace(board, before);
+  const pressure = memoryPressure(), tickState = { local_started: 0 };
+  const planOf = (db, task) => {
+    if (!task) throw requestDetail(`no card ${id}`);
+    const scope = scopeOf(db, board, task, { params: entry.params, extra: { sender: roles, verb: entry.workflow.dispatch.start,
+      event: { lock: claimer() }, host: hostOf(pressure), tick: tickState } });
+    // Explicit start releases this hold in the admitted transaction below. Preview that same transition.
+    scope.card.dispatch_hold = null;
+    const status = statusOf(db, task);
+    const transition = transitionsFor(entry.workflow, status, entry.workflow.dispatch.start)
+      .find(t => (!t.by?.length || t.by.some(role => roles.includes(role))) && holds(t.guard ?? null, scope));
+    if (!transition) throw requestDetail(`${id} has no admitted ${entry.workflow.dispatch.start} transition from ${status}`);
+    const target = transition.target ? String(templateValue(transition.target, scope)) : status;
+    const spec = runSpec(entry, target, scope.card);
+    const profile = spec ? evaluate(entry.workflow.roles?.[spec.role] ?? 'card.assignee', scope) : null;
+    const lane = profile ? lanes[profile] : null;
+    if (spec && !lane) throw requestDetail(`${id} would be ${target}, run by ${spec.role} (${profile ?? 'nobody'}), which is no lane of this home`);
+    return { task, scope, target, spec, profile, lane, key: JSON.stringify([status, task.current_run_id, task.assignee, task.machine,
+      task.model_override, task.provider_override, target, spec?.role, spec?.session, profile, lane?.harness, lane?.surface]) };
+  };
+  const plan = view(board, db => planOf(db, getTask(db, id)));
+  const checked = await checkWorkspace(board, before, await workspaceForRun(board, before, { role: plan.spec?.role,
+    slot: String(templateValue(plan.spec?.session ?? 'worker', plan.scope) ?? 'worker'), lane: plan.lane }));
+  const held = await homeHoldings(board.root, listBoards(board.root), lanes, fleet, entry, { retainRevisions: true });
+  try {
+  const admissionOf = p => ({ card: id, board: board.slug, machine: executionHost(p.lane, p.task.machine, localMachine(), normalMachine),
+    assignee: p.profile ?? null, status: p.target, stored: p.target, dispatch: true,
+    slot: String(templateValue(p.spec?.session ?? 'worker', p.scope) ?? 'worker'),
+    model: p.task.model_override ?? p.lane?.model ?? held.defaults?.[p.lane?.harness] ?? null, harness: p.lane?.harness ?? null });
+  const caps = capacity(entry.workflow.dispatch.capacity, held, evaluate);
+  const refused = caps.admit(admissionOf(plan), { ...plan.scope, lane: plan.lane ?? {} });
+  if (refused) throw requestDetail(refused.why);
   const moved = tx(board, (db) => {
-    if (detachedCard(db, id)) throw new Error(`${id} is detached to a person; request and verify adoption before starting it`);
+    const task = getTask(db, id);
+    if (task?.backlog) throw requestDetail(`${id} is in backlog; plan it before starting it`);
+    const currentPlan = planOf(db, task);
+    if (currentPlan.key !== plan.key) throw requestDetail(`${id}'s role or configuration changed during start admission; retry its current plan`);
+    // The full home projection, including stopped card holdings, must still be the one admitted above.
+    for (const [slug, { board: reading, revision }] of held.revisions) {
+      const change = currentRecordChanges(reading.db, revision);
+      // Owner fencing updates board state at transaction entry; only current card/run/event changes invalidate capacity.
+      if (change.reset || change.cards.length || change.eventsRewritten)
+        throw requestDetail(`capacity of board ${slug} changed during start admission; retry against its current holdings`);
+    }
+    const capped = caps.admit(admissionOf(currentPlan), { ...currentPlan.scope, lane: currentPlan.lane ?? {} });
+    if (capped) throw requestDetail(capped.why);
+    if (detachedCard(db, id)) throw requestDetail(`${id} is detached to a person; request and verify adoption before starting it`);
     const person = personOf(getTask(db, id)?.assignee);
-    if (person) throw new Error(`${id} is assigned to ${person}: a person's card runs no session; it closes when that person completes it`);
+    if (person) throw requestDetail(`${id} is assigned to ${person}: a person's card runs no session; it closes when that person completes it`);
     assertWorkspaceOwner(db, before, checked);
     if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.workspaceRoot, id);
-    if (!roles.some(role => ['manager', 'creator'].includes(role))) throw new Error('Only the manager or creator starts a held card; request its decision.');
     event(db, id, 'dispatch_released', { reason: 'explicit start' });
     requestSessionClose(db,id);
     const moved = fire(db, board, entry, id, entry.workflow.dispatch.start, { roles, payload: { lock: claimer() } });
     setRunSession(db, getTask(db,id).current_run_id, { restart_authorized: true });
     return moved;
   });
+  queueEffects(board, moved.effects);
   const task = getTaskNow(board, id);
   const spec = runSpec(entry, moved.to, task);
   const profile = spec ? view(board, (db) => evaluate(entry.workflow.roles?.[spec.role] ?? 'card.assignee', scopeOf(db, board, task, { params: entry.params }))) : null;
   const lane = profile ? lanes[profile] : null;
-  if (spec && !lane) throw new Error(`${id} is ${moved.to}, run by ${spec.role} (${profile ?? 'nobody'}), which is no lane of this home`);
+  if (spec && !lane) throw requestDetail(`${id} is ${moved.to}, run by ${spec.role} (${profile ?? 'nobody'}), which is no lane of this home`);
   if (!lane) return null;
   try { return await launchRun(board,entry,id,lane,fleet,settings); }
   catch (error) {
-    if (monitorsRuns(entry) && !error.launchPending && !error.launchSuperseded) launchFailed(board, entry, id, error, { error: error.message, origin: originOf(error) });
+    if ((monitorsRuns(entry) || error.continuationRequired) && !error.launchPending && !error.launchSuperseded) launchFailed(board, entry, id, error, { error: error.message, origin: originOf(error) });
     throw error;
   }
+  } finally { held.releaseRevisions(); }
 }
 
 /** Reconcile durable close intent and ended runs, including old unverified closed_at records.
@@ -1442,6 +1775,9 @@ const TURN_IN_PROGRESS = new Set(['working', 'needs_input']);
  * A harness's own blocking prompt on the pane's screen, which no input from the board answers: the session is stopped,
  * not between turns. Claude Code's usage limit ("What do you want to do? 1. Stop and wait for limit to reset …") is
  * one; its reset time is said when the prompt names it. Null when the screen shows none.
+ *
+ * Read off the pane's screen through its door at the decision (turnAtClose), never from the held record: a held
+ * reading lags the host by the record's cycle, and a limit screen read a round late closes the session a round late.
  */
 const BLOCKING_PROMPTS = [
   { reason: 'provider-limit', harness: 'claude-code', test: /Stop and wait for limit to reset/i, resets: /continue automatically at ([^\n│]+?)\s*(?:│|$)/im },
@@ -1468,19 +1804,34 @@ function unreadWatch(held, mark, gap, at = now()) {
 }
 async function turnAtClose(session, pane = null, { launchWindow = null, quiet = null, gap = 0, inputAbandonment = null } = {}) {
   const machine = session.machine ?? localMachine();
-  const recordOf = (rows, id, harness) => rows.find((row) => row.locator?.session_id === id && row.locator?.harness === harness);
   let activity, rows = null;
-  // A Codex pane may run under its own Codex home (a pane route's CODEX_HOME, recorded on the run as codex_home), which
-  // the machine's default sources do not hold: every read of its session here names that home, as readNative does.
-  const codexHome = (session.harness ?? 'claude-code') === 'codex' ? session.codex_home ?? null : null;
+  const homes = (await readNativeHome(session))?.homes;
+  // A home the board never recorded never holds a close: the pane's own door (its machine's listing) reads the turn
+  // from the harness lifecycle under the pane, which its machine knows without the home (ADR 0019).
+  if (!homes) {
+    if (!pane) return { why: `the native home of ${addressOf(session)} is unknown and no pane of it is listed to read` };
+    if (unboundLaunch(session, launchWindow)) return null;
+    const evidence = pane.evidence ?? {};
+    if (evidence.liveness === 'ended') return null;
+    if (evidence.liveness === 'running') return { why: `pane ${session.pane} is in a turn, as its pane's own reading says` };
+    if (evidence.signal === 'asking') return { why: `pane ${session.pane} waits on a question, as its pane's own reading says` };
+    if (evidence.liveness === 'waiting' && evidence.livenessSource === 'cooperative') return null;
+    const command = String(pane.command ?? '').split(/[\\/]/).pop().toLowerCase();
+    if (command && !HARNESS_COMMANDS.has(command)) return null;
+    return { why: `pane ${session.pane}'s turn could not be read through its pane's door (${evidence.liveness ?? 'no reading'})` };
+  }
   if (pane?.pid) {
-    const r = await doorOn(machine, 'harness.v1.sessions.activity_under', { pids: [pane.pid], ...(codexHome ? { homes: { codex: join(codexHome, 'sessions') } } : {}) }, { timeout: NATIVE_DISCOVERY_MS });
+    const r = await doorOn(machine, 'harness.v1.sessions.activity_under', { pids: [pane.pid], homes }, { timeout: NATIVE_DISCOVERY_MS });
     const page = r.code === 0 ? lastJson(r.stdout) : null;
     if (!Array.isArray(page?.activities)) return { why: `the session in pane ${session.pane} could not be read just now (${(r.stderr || r.stdout).trim().slice(-160)})` };
-    activity = page.activities.find((item) => item.pid === pane.pid)?.activity ?? null;
+    const observed = page.activities.find((item) => item.pid === pane.pid);
+    activity = observed?.activity ?? null;
+    if (activity && (!inNativeHome(observed, homes) || (session.session_id &&
+      (activity.session_id !== session.session_id || activity.harness !== session.harness))))
+      return { why: `pane ${session.pane} has no verified activity for this native identity` };
     // No session read under the pane is no absence (a registry it could not read, another config home, a failed process
     // read, a process walk cut short): the pane's own foreground program says whether a harness runs there. A pane
-    // running none is closed; one running a harness is read by the session id the run holds.
+    // running none is closed; one running a harness requires its own process/source receipt.
     if (!activity) {
       // A pane the board launched whose session no reading ever found (the fleet's never bound it, and none runs under
       // its process now) past the launch window holds a harness that never started a session: nothing is cut by its
@@ -1488,19 +1839,13 @@ async function turnAtClose(session, pane = null, { launchWindow = null, quiet =
       if (unboundLaunch(session, launchWindow)) return null;
       const command = String(pane.command ?? '').split(/[\\/]/).pop().toLowerCase();
       if (command && !HARNESS_COMMANDS.has(command)) return null;
-      const unfound = `pane ${session.pane} runs ${command || 'a program it does not name'}, whose session could not be read`;
-      if (!session.session_id) return { why: unfound };
-      try { rows = (await discoverNative(machine, session.harness ?? 'claude-code', session.session_id, codexHome)).sessions; }
-      catch (error) { return { why: `${unfound} (${String(error.message).slice(0, 160)})` }; }
-      activity = recordOf(rows, session.session_id, session.harness ?? 'claude-code')?.activity ?? null;
-      // a row that shows no live owner beside a pane that runs a harness places nothing: another session may run there
-      if (activity?.presence !== 'running') return { why: unfound };
+      return { why: `pane ${session.pane} runs ${command || 'a program it does not name'}, whose native identity could not be read` };
     }
   } else if (pane) {
     return { why: `pane ${session.pane} names no process to read` };
   } else {
     if (!session.session_id) return { why: 'its session is not known yet' };
-    try { rows = (await discoverNative(machine, session.harness ?? 'claude-code', session.session_id, codexHome)).sessions; }
+    try { rows = (await discoverNative(machine, session.harness ?? 'claude-code', session.session_id, homes)).sessions; }
     catch (error) { return { why: `its session could not be read just now (${String(error.message).slice(0, 160)})` }; }
     activity = nativeReading(rows, session).row?.activity ?? null;
     if (!activity) return { why: `its session ${addressOf(session)} is not in its machine's discovery` };
@@ -1524,9 +1869,9 @@ async function turnAtClose(session, pane = null, { launchWindow = null, quiet =
   if (blocked) return { stopped: blocked };
   const sessionId = activity.session_id ?? session.session_id, harness = activity.harness ?? session.harness ?? 'claude-code';
   if (!sessionId || !quiet) return { why: unknown };
-  if (!rows) try { rows = (await discoverNative(machine, harness, sessionId, codexHome)).sessions; }
+  if (!rows) try { rows = (await discoverNative(machine, harness, sessionId, homes)).sessions; }
     catch (error) { return { why: `${unknown}, and its record could not be read just now (${String(error.message).slice(0, 160)})` }; }
-  const record = recordOf(rows, sessionId, harness);
+  const record = nativeReading(rows, { session_id: sessionId, harness }).row;
   if (TURN_IN_PROGRESS.has(record?.activity?.turn)) return inTurn(record.activity.turn);
   const mark = Math.max(Number(record?.updated_at_ms) || 0, Number(activity.evidence?.native_state_since_ms) || 0);
   if (!mark) return { why: `${unknown}, and its record shows no write to count from` };
@@ -1587,21 +1932,46 @@ function recordInputClose(board, row, session, reading) {
   });
 }
 
+/** Pending close candidates only, in finite indexed pages. */
+async function* closeCandidates(board, taskId) {
+  let cursor = 0;
+  const high = view(board, db => Number(db.prepare('SELECT MAX(id) AS id FROM task_runs').get()?.id ?? 0));
+  for (;;) {
+    const rows = view(board, db => db.prepare(`SELECT id,task_id,profile,ended_at,metadata FROM task_runs
+      WHERE ${CLOSE_OPEN_RUNS} AND id>? AND id<=?${taskId ? ' AND task_id=?' : ''} ORDER BY id LIMIT 32`)
+      .all(cursor, high, ...(taskId ? [taskId] : [])));
+    if (!rows.length) return;
+    for (const row of rows) yield row;
+    cursor = rows.at(-1).id;
+    if (rows.length < 32) return;
+    await yieldToOwner();
+  }
+}
+
 /** The closes this process is making now, by run: each one's outcome, for a pass that meets it under way. */
 const closesUnderway = new Map();
 export async function closeRequested(board, report, { taskId = null, caller = null, ttl = null, fleet = null } = {}) {
-  const rows = await readRunPages(board.db, 'id, task_id, profile, ended_at, metadata', { task: taskId, where: 'metadata IS NOT NULL' });
-  // Repair pre-transfer history once: only identities with an older unended reference need a write.
-  const latest = new Map(), transfers = new Map();
-  for (const row of [...rows].sort((a,b) => b.id-a.id)) {
-    const s = json(row.metadata, {})?.supercode;
-    if (!s) continue;
-    for (const identity of [s.session_id && `sid:${s.session_id}`, s.pane && `pane:${s.pane}`].filter(Boolean)) {
-      const key = `${row.task_id}:${s.machine}:${identity}`;
-      const successor = latest.get(key);
-      if (successor && !row.ended_at) transfers.set(successor.id, successor);
-      else if (!successor) latest.set(key, row);
+  const onTask = taskId ? ' AND task_id=?' : '';
+  // Only unended references can need transfer repair. Seek each one's latest successor by
+  // its indexed identity, instead of decoding every historical run to discover the same fact.
+  const transfers = new Map();
+  let repairCursor = 0;
+  for (;;) {
+    const page = view(board, db => db.prepare(`SELECT id,task_id,metadata FROM task_runs
+      WHERE ended_at IS NULL AND id>?${onTask} ORDER BY id LIMIT 32`).all(repairCursor, ...(taskId ? [taskId] : [])));
+    if (!page.length) break;
+    for (const row of page) {
+      const session = json(row.metadata, {})?.supercode;
+      for (const name of ['session_id', 'pane']) if (session?.[name]) {
+        const successor = view(board, db => db.prepare(`SELECT id,task_id,metadata FROM task_runs WHERE task_id=?
+          AND ${runField('machine')} IS ? AND ${runField(name)}=? AND id>? ORDER BY id DESC LIMIT 1`)
+          .get(row.task_id, session.machine ?? null, session[name], row.id));
+        if (successor) transfers.set(successor.id, successor);
+      }
     }
+    repairCursor = page.at(-1).id;
+    if (page.length < 32) break;
+    await yieldToOwner();
   }
   if (transfers.size) tx(board, (db) => {
     for (const row of transfers.values()) {
@@ -1613,15 +1983,15 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
   // Each machine's pane list, read once per pass: its live panes, and its dead ones. A dead pane is still the machine's
   // until it is closed (a pane whose program failed is kept, marked dead, for its last screen), so it is closed as any.
   const panes = new Map();
+  // asked of the machine's door as this board, which lists the panes the board's grants there let it observe
   const paneListOn = async (machine) => {
     if (!panes.has(machine)) {
-      const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000, as: boardAddress(board.label) });
-      const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
-      panes.set(machine, Array.isArray(list) ? { live: new Map(list.filter(p => !p.dead).map((p) => [p.pane, { pid: p.pid ?? null, command: p.activeCommand ?? null }])), dead: new Set(list.filter(p => p.dead).map((p) => p.pane)) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
+      const { list, error } = await paneRows(machine, { timeout: 60_000, as: boardAddress(board.label) });
+      panes.set(machine, list ? { live: new Map(list.filter(p => !p.dead).map((p) => [p.pane, { pid: p.pid ?? null, command: p.activeCommand ?? null, evidence: p.evidence ?? null }])), dead: new Set(list.filter(p => p.dead).map((p) => p.pane)) } : { error: `cannot read panes on ${machine}: ${error}` });
     }
     return panes.get(machine);
   };
-  for (const row of rows) {
+  for await (const row of closeCandidates(board, taskId)) {
     await yieldToOwner();
     let session = json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
     if (!session || detachedSession(board.db, session) || session.close_transferred_to || session.close_confirmed_at) continue;
@@ -1634,17 +2004,17 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       if (session.mode === 'adopt' && session.address) {
         tx(board, (db) => setRunSession(db, row.id, { launch_pending: false, launch_key: null, launch_error: null }));
         session = json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
-      } else if (!session.pane && !session.address && !session.pid) {
+      } else if ((!session.pane && !session.address && !session.pid) || (session.launch_not_issued && session.mode === 'fresh')) {
         // settled only on a fleet reading that shows no session with its id on its machine; a lost open answer may
-        // have opened one, and that is closed as its own once it is bound
-        if (launchReading(fleet, session) !== 'absent') { report.undelivered.push([row.task_id, session.launch_key, 'close waits for a fleet reading that shows its launch absent', 'close']); continue; }
+        // have opened one, and that is closed as its own once it is bound. A machine-cancelled absent key cannot arrive late.
+        if (!session.launch_not_issued && launchReading(fleet, session) !== 'absent') { report.undelivered.push([row.task_id, session.launch_key, 'close waits for a fleet reading that shows its launch absent', 'close']); continue; }
         const settled = tx(board, (db) => {
           const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
-          if (!current || current.launch_key !== session.launch_key || current.pane || current.close_confirmed_at) return false;
+          if (!current || current.launch_key !== session.launch_key || (current.pane && !current.launch_not_issued) || current.close_confirmed_at) return false;
           const at = now();
           setRunSession(db, row.id, { launch_pending: false, close_requested: current.close_requested ?? at, closed_at: at, close_confirmed_at: at, close_error: null,
             launch_error: current.launch_error ?? 'no pane was bound to its launch', forgotten: current.mode === 'fresh' ? true : Boolean(current.forgotten) });
-          event(db, row.task_id, 'session_closed', { key: session.launch_key, machine: session.machine, reason: 'no pane was bound to its launch, and the fleet reading shows neither a pane nor its session' }, row.id);
+          event(db, row.task_id, 'session_closed', { key: session.launch_key, machine: session.machine, reason: session.launch_not_issued ? 'the machine retired its absent launch key as not issued' : 'no pane was bound to its launch, and the fleet reading shows neither a pane nor its session' }, row.id);
           return true;
         });
         if (settled) (report.closed ??= []).push({ task_id: row.task_id, ...session });
@@ -1652,7 +2022,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       }
     }
     if ((session?.monitor_held || session?.retain_after_run) && !session.close_requested) continue; // only an explicit close action ends this process
-    if ((!session?.pane && session?.surface !== 'native') || session.close_transferred_to || session.close_confirmed_at || (!row.ended_at && !session.close_requested)) continue;
+    if ((!session?.pane && !['native', 'headless'].includes(session?.surface)) || session.close_transferred_to || session.close_confirmed_at || (!row.ended_at && !session.close_requested)) continue;
     if (caller && session.session_id === caller) continue; // let the command that ended its own run return
     // The board closes only what it launched. An adopted session (a person's own thread, a hook session the card was
     // given) is released instead: left running, its slot freed. Closing one failed on every round for a session no close
@@ -1688,6 +2058,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       else if ((await paneListOn(session.machine ?? localMachine())).dead?.has(session.pane)) continue;
     }
     const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.id IN (${ACTIVE_RUN_IDS})`).all());
+    for (const run of active) await readNativeHome(json(run.metadata, {})?.supercode);
     // Persist retries even for historical ends that did not have a close_session action. The close is claimed in the
     // same transaction, before the pane or process is touched: of two rounds (or a round and a verb) that read one close,
     // only the one whose claim committed closes it, and the other never records the pane it finds gone as a failure.
@@ -1711,25 +2082,35 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
     try {
     const claimed = tx(board, (db) => {
       const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
-      if (!current || detachedSession(db, current) || current.close_confirmed_at || current.close_transferred_to || current.pane !== session.pane || current.session_id !== session.session_id || claimHolds(current.close_claim)) return false;
+      if (!current || detachedSession(db, current) || current.close_confirmed_at || current.close_transferred_to || current.pane !== session.pane || current.session_id !== session.session_id || current.pid !== session.pid
+        || homeIdentity(current) !== homeIdentity(session) || claimHolds(current.close_claim)) return false;
       requestSessionClose(db, row.task_id, { runId: row.id });
       // a close this process already claims, with a minute of its claim left, is tried again without a new claim
       const own = current.close_claim?.lock === claimer() && Number(current.close_claim.expires) > now() + 60;
       if (!own) setRunSession(db, row.id, { close_claim: newClaim(ttl ?? boardSettings(workflowFor(board.root).params).ttl) });
-      return true;
+      const retained = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(row.id)?.metadata, {})?.supercode;
+      return { lock: retained.close_claim.lock, expires: retained.close_claim.expires, requested: retained.close_requested,
+        monitor: retained.monitor_held, retained: retained.retain_after_run };
     });
     if (!claimed) continue;
     noteClaim(board, 'runs', row.id);
+    const revalidate = () => requireDeferredClose(board, row, session, claimed);
     try {
       const machine = session.machine ?? localMachine();
-      if (session.surface === 'native' && !session.pane) {
-        const reading = nativeReading(await readNative(machine, session.harness, session.session_id, session.codex_home ?? null), session);
+      if (session.surface === 'headless') {
+        await stopSession(board, session, revalidate);
+      } else if (session.surface === 'native' && !session.pane) {
+        const reading = nativeReading(await readNative(machine, session.harness, session.session_id, nativeHomes(session)), session);
         if (reading.alive == null) throw new Error(`close deferred: native liveness unknown for ${addressOf(session)}`);
         if (reading.alive) {
-          const protectedNow = active.some(r => addressOf(json(r.metadata, {})?.supercode) === addressOf(session));
+          const protectedNow = active.some(r => {
+            const current = json(r.metadata, {})?.supercode;
+            return addressOf(current) === addressOf(session)
+              && (!homeIdentity(current) || !homeIdentity(session) || sameNativeSession(current, session));
+          });
           if (protectedNow) throw new Error('close deferred: native session is owned by an unended run');
           if (row.ended_at) { const { idleQuiet: quiet, interval } = boardSettings(workflowFor(board.root).params); await holdForTurn(session, null, { quiet, gap: Math.max(3 * interval, quiet / 2) }); }
-          await stopSession(board, session);
+          await stopSession(board, session, revalidate);
         }
       } else if (!finalFailure) {
       const observed = await paneListOn(machine);
@@ -1741,7 +2122,7 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
         if (protectedNow) throw new Error(`close deferred: pane ${session.pane} is owned by an unended run`);
       }
       // a dead pane's program has ended: it has no turn to close between, and is closed at once
-      if (dead) { await stopSession(board, session); observed.dead.delete(session.pane); }
+      if (dead) { await stopSession(board, session, revalidate); observed.dead.delete(session.pane); }
       else if (observed.live.has(session.pane)) {
         // An ended run's session is closed only between its turns, read last, after the claim and the pane list (a pane
         // already gone is settled above with no reading; t_f34710bc's coder was cut mid-proof at 15:01:13Z, 2026-10-04).
@@ -1759,10 +2140,11 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
           } else if (reading && !recordInputClose(board, row, session, reading))
             throw new Error('close deferred: ownership changed before ending its input dialog');
         }
-        await stopSession(board, session); observed.live.delete(session.pane);
+        await stopSession(board, session, revalidate); observed.live.delete(session.pane);
       }
       }
     } catch (e) {
+      if (e.closeSuperseded) { report.undelivered.push([row.task_id, addressOf(session), e.message, 'close']); continue; }
       // a deferred close (an unreachable door, an unread pane list or session discovery) waits for the next round;
       // the prefix is decided on the whole message, before it is cut to size
       const message = String(e.message), deferred = Boolean(e.launchDeferred) || /^close deferred: /.test(message);
@@ -1770,7 +2152,8 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
       // the watch a turn reading left (or ended: a turn read in progress); an attempt that took none keeps the last
       if ('closeUnread' in e) unread = e.closeUnread;
     }
-    tx(board, (db) => {
+    const confirmed = tx(board, (db) => {
+      if (!deferredCloseCurrent(board, row, session, claimed)) return false;
       const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
       if (!current || detachedSession(db, current) || current.pane !== session.pane || current.session_id !== session.session_id) return;
       const at = now();
@@ -1798,18 +2181,64 @@ export async function closeRequested(board, report, { taskId = null, caller = nu
         event(db, row.task_id, 'session_closed', { session_id: session.session_id, pane: session.pane, machine: session.machine, unsubscribed,
           ...(finalFailure ? { reason: 'authorized pane presence observed absence after an earlier close refusal' } : {}) }, row.id);
       }
+      return true;
     });
     if (error) report.undelivered.push([row.task_id, addressOf(session), error, 'close']);
-    else { closed = true; (report.closed ??= []).push({ task_id: row.task_id, ...session }); }
+    else if (confirmed) { closed = true; (report.closed ??= []).push({ task_id: row.task_id, ...session }); }
     } finally { closesUnderway.delete(flight); settle({ error, closed }); }
   }
+  // A backlog request that first met a busy or unread native session remains its dispatch hold. Once the existing
+  // close pass records every stop/release receipt, apply that retained request as its original sender.
+  const backlogged = await completeBacklogRequests(board, { taskId });
+  if (backlogged.length) (report.backlogged ??= []).push(...backlogged);
 }
 
 // When this process last read each run's turn (run id → seconds). Kept in memory on purpose: a board that restarted
 // has read nothing itself, and its first reading of a run is where that run's watch resumes (resumedWatch).
 const idleWatch = new Map();
+// When this process last read each run's turn as unreadable (run id → seconds): its unread clock (`unknown_since`)
+// runs only across rounds this process read without a break, whether or not the run's machine read online.
+const turnUnreadWatch = new Map();
 /** Native idle intervals are independent of dispatch cadence and transcript writes.
  * Keep bounded readings on the run so an ordinary quiet stretch can be reviewed later. */
+/**
+ * The oldest message each running card's session on this machine has waiting undelivered, with its mailbox's reason
+ * (`harness.v1.mail.waiting` for those mailboxes alone), by session address: `{ message_id, since_ms, attempts, reason }`,
+ * or `{ unread }` when this machine's daemon did not answer. One call for the local sessions whose stall notice is due,
+ * and none on an observation that has no such session.
+ * Another machine's sessions add nothing: that door answers only its own machine's processes.
+ */
+async function undeliveredMail(board, running) {
+  const here = localMachine(), addresses = new Set();
+  for (const { id } of running) {
+    const address = addressOf(currentRun(board.db, id)?.metadata?.supercode);
+    if (address && address.split(':')[1] === here) addresses.add(address);
+  }
+  const out = new Map();
+  if (!addresses.size) return out;
+  const asked = [...addresses].slice(0, 256);
+  for (const address of asked) out.set(address, null);
+  for (const address of addresses) if (!out.has(address)) out.set(address, { unread: 'the due stall mailboxes exceeded the bounded mail read' });
+  let rows;
+  try {
+    rows = (await machineCall(null, 'harness.v1.mail.waiting', { addresses: asked }, { timeoutMs: 5_000 }))?.rows;
+    if (!Array.isArray(rows)) throw new Error('this machine answered without its waiting-mail rows');
+  }
+  catch (error) {
+    const unread = String(error?.message ?? error).slice(0, 300);
+    for (const address of addresses) out.set(address, { unread });
+    return out;
+  }
+  const text = (value, bound) => typeof value === 'string' && value ? value.slice(0, bound) : null;
+  for (const row of Array.isArray(rows) ? rows : []) {
+    const to = text(row?.to, 512), message = text(row?.id, 128), reason = text(row?.last_error, 2_000);
+    if (!to || !addresses.has(to) || !message || !reason || out.get(to) != null) continue;
+    out.set(to, { message_id: message, since_ms: Number.isFinite(row.since_ms) ? row.since_ms : null,
+      attempts: Number.isInteger(row.attempts) && row.attempts >= 0 ? row.attempts : 0, reason });
+  }
+  return out;
+}
+
 async function observeIdle(board, fleet, settings, report, entry, effects) {
   if (!fleet.ok) return;
   // The published fleet says whether a session runs and its turn, not when it last wrote: that is the session's own
@@ -1817,84 +2246,284 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
   // Without it every reading was 'no_timestamp' and no session was ever found idle.
   const updatedAt = (session) => {
     let rows = null;
-    try { rows = nativeSessions(session.machine ?? localMachine(), session.harness ?? 'claude-code', session.session_id); } catch { /* unread: no timestamp */ }
+    try { rows = nativeSessions(session); } catch { /* unread: no timestamp */ }
     return Number(rows?.find((row) => row.locator?.session_id === session.session_id)?.updated_at_ms) || null;
   };
   const managers = [].concat(entry.params.managers ?? []).filter(Boolean);
-  const running = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
-  const edges = localSessionDelegations(board.root, localMachine());
-  const reached = new Set(running.map(({ id }) => addressOf(currentRun(board.db, id)?.metadata?.supercode)).filter(Boolean));
+  const running = board.db.prepare(entry.workflow.run ? 'SELECT id FROM tasks WHERE current_run_id IS NOT NULL' : "SELECT id FROM tasks WHERE status = 'running'").all();
+  const idleSubject = (db, id) => {
+    const run = currentRun(db, id);
+    const session = run?.metadata?.supercode;
+    if (!session?.session_id || !['pane', 'native'].includes(session.surface) || session.offline_since != null || run.ended_at != null) return null;
+    const task = getTask(db, id), status = statusOf(db, task);
+    const handles = name => entry.workflow.statuses[status]?.on?.[name] || entry.workflow.on?.[name] || entry.workflow.run?.on?.[name];
+    if (!handles('session_idle') && !handles('session_stalled')) return null;
+    const held = task.backlog || task.paused || task.blocked_by.length || task.archived || task.detached
+      || scopeOf(db, board, task, { params: entry.params, lazy: true }).card.dispatch_hold;
+    return { run, session, task, status, handles, held };
+  };
+  const cardsOf = new Map(), retained = new Map(), sources = new Map(), listedSources = new Map();
+  for (const row of fleet.sessions) {
+    await yieldToOwner();
+    if (stopping) return;
+    const identity = homeIdentity({ ...row, native_home: locatorHome(row.locator) });
+    const homes = listedSources.get(row.address) ?? new Set(); homes.add(identity); listedSources.set(row.address, homes);
+  }
+  for (const { id } of running) {
+    await yieldToOwner();
+    if (stopping) return;
+    const session = view(board, db => currentRun(db, id)?.metadata?.supercode);
+    if (!session) continue;
+    await timed('idle native preparation', () => readBefore(fleet, session));
+    if (stopping) return;
+    const consumesCommits = view(board, db => {
+      const subject = idleSubject(db, id);
+      if (!subject || subject.held || !subject.handles('session_idle') || subject.session.role === 'reviewer') return false;
+      const current = subject.session;
+      if (current.machine && !fleet.online.has(current.machine) || current.surface === 'native' && sessionAlive(fleet, current) !== true) return false;
+      return true;
+    });
+    if (consumesCommits) await timed('idle commit preparation', () => refreshCardInputs(board, id, { commits: 'cached' }));
+    const address = addressOf(session);
+    if (!address) continue;
+    cardsOf.set(address, [...(cardsOf.get(address) ?? []), id]);
+    retained.set(address, [...(retained.get(address) ?? []), session]);
+    const identity = homeIdentity(session), prior = sources.get(address);
+    sources.set(address, prior === undefined || prior === identity ? identity : null);
+  }
+  const edges = await timed('idle local delegations', () => localSessionDelegations(board.root, localMachine(), () => !stopping));
+  if (stopping) return;
+  for (const row of fleet.sessions) {
+    await yieldToOwner();
+    if (stopping) return;
+    if (row.starter_session?.startsWith('sc:')) edges.push({ starter: row.starter_session, session: row.address });
+  }
+  for (const { id } of running) {
+    await yieldToOwner();
+    if (stopping) return;
+    const edge = view(board, db => {
+      const session = currentRun(db, id)?.metadata?.supercode;
+      return session ? { starter: creatorOf(db, id)?.replace(/^session:/, ''), target: addressOf(session) } : null;
+    });
+    const { starter, target } = edge ?? {};
+    if (starter?.startsWith('sc:') && target) edges.push({ starter, session: target });
+  }
+  const reached = new Set(retained.keys());
   const delegations = [];
   const pending = [...reached];
   const byStarter = new Map();
-  for (const edge of edges) { const children = byStarter.get(edge.starter) ?? []; children.push(edge); byStarter.set(edge.starter, children); }
+  for (const edge of edges) {
+    await yieldToOwner();
+    if (stopping) return;
+    const children = byStarter.get(edge.starter) ?? []; children.push(edge); byStarter.set(edge.starter, children);
+  }
   while (pending.length) for (const edge of byStarter.get(pending.pop()) ?? []) {
+    await yieldToOwner();
+    if (stopping) return;
     delegations.push(edge);
     if (!reached.has(edge.session)) { reached.add(edge.session); pending.push(edge.session); }
   }
   report.idle_delegations = { recorded: edges.length, reachable: delegations.length };
-  const delegatedReadings = [...fleet.sessions];
+  const delegatedReadings = [], delegatedReadAddresses = new Set();
   // Forks and concurrent sessions need not have a pane. Read only the exact
   // native identities this home's starter receipts name, before any write.
   for (const { session: address } of delegations) {
-    if (delegatedReadings.some(row => row.address === address)) continue;
-    const match = /^sc:([^:]+):(claude-code|codex):([^:]+)$/.exec(address);
+    await yieldToOwner();
+    if (stopping) return;
+    if (delegatedReadAddresses.has(address)) continue;
+    delegatedReadAddresses.add(address);
+    const match = /^sc:([^:]+):([^:]+):(.+)$/.exec(address);
     if (!match) continue;
     const [, machine, harness, session_id] = match;
-    const child = { machine, harness, session_id, surface: 'native' };
-    await readBefore(fleet, child);
+    if (!retained.has(address)) {
+      const saved = await timed('idle delegated provenance', async () => {
+        const revision = listRevision(board.db), sessions = [];
+        let after = 0;
+        for (;;) {
+          const rows = board.db.prepare(`SELECT id,metadata FROM task_runs WHERE id IN (${NOTICE_RUN_IDS})
+            AND id>? ORDER BY id LIMIT 64`).all(session_id, address, after);
+          for (const row of rows) {
+            const session = json(row.metadata, {})?.supercode;
+            if (session && (session.address === address || session.machine === machine && session.session_id === session_id
+              && (session.harness ?? 'claude-code') === harness)) sessions.push(session);
+          }
+          if (rows.length < 64) break;
+          after = rows.at(-1).id;
+          await yieldToOwner();
+          if (stopping) return null;
+        }
+        const current = listRevision(board.db);
+        return Object.keys(revision).every(key => revision[key] === current[key]) ? sessions : null;
+      });
+      if (stopping) return;
+      if (saved === null) { retained.set(address, []); sources.set(address, null); continue; }
+      if (saved.length) {
+        for (const session of saved) {
+          await yieldToOwner();
+          if (stopping) return;
+          await timed('idle delegated native home', () => readNativeHome(session));
+        }
+        retained.set(address, saved);
+        const homes = new Set(saved.map(homeIdentity));
+        sources.set(address, homes.size === 1 ? [...homes][0] : null);
+      }
+    }
+    if (!retained.has(address) && !['claude-code', 'codex'].includes(harness)) {
+      const published = fleet.sessions.filter(row => row.address === address);
+      const stores = new Set(published.map(row => row.locator?.storage ? JSON.stringify(row.locator.storage) : null));
+      if (stores.size === 1 && !stores.has(null)) {
+        sources.set(address, [...stores][0]); listedSources.set(address, stores);
+        delegatedReadings.push(published.find(row => row.state === 'running' && row.turn === 'working') ?? published[0]);
+      }
+      continue;
+    }
+    const child = retained.get(address)?.[0] ?? { machine, harness, session_id, surface: 'native' };
+    if (retained.has(address) && !sources.get(address)) continue;
+    if (!retained.has(address)) try {
+      const rows = (await timed('idle delegated native home', () => readNative(machine, harness, session_id, null, { activity: false })))
+        .filter(row => row.locator?.harness === harness && row.locator.session_id === session_id);
+      const homes = new Map(rows.map(row => { const home = locatorHome(row.locator); return [JSON.stringify(home?.homes), home]; }));
+      if (homes.size === 1) child.native_home = [...homes.values()][0];
+    } catch { /* source unknown */ }
+    await timed('idle delegated activity', () => readBefore(fleet, child));
+    if (stopping) return;
+    const identity = homeIdentity(child);
+    if (!identity) continue;
+    sources.set(address, identity);
+    const published = fleetSessionRow(fleet, child);
+    if (published) { delegatedReadings.push(published); continue; }
     try {
-      const { row } = nativeReading(nativeSessions(machine, harness, session_id), child);
+      const { row } = nativeReading(nativeSessions(child), child);
       if (row?.activity) delegatedReadings.push({ address, state: row.activity.presence, turn: row.activity.turn });
     } catch { /* an unread child is never called working */ }
   }
-  // every running card a session is on: a session waiting on its user is told once, naming them all
-  const cardsOf = new Map();
-  for (const { id } of running) {
-    const session = currentRun(board.db, id)?.metadata?.supercode; await readBefore(fleet, session);
-    await refreshCardInputs(board, id, { commits: true });
-    if (addressOf(session)) cardsOf.set(addressOf(session), [...(cardsOf.get(addressOf(session)) ?? []), id]);
+  const liveOf = (session) => {
+    const published = fleetSessionRow(fleet, session);
+    let nativeRow = null;
+    if (!published && (session.surface === 'native' || sessionAlive(fleet, session) === true)) try { nativeRow = nativeReading(nativeSessions(session), session).row; } catch { /* unread: no turn */ }
+    return published ?? (nativeRow ? { address: addressOf(session), turn: nativeRow.activity?.turn ?? null, waiting_for: nativeRow.activity?.evidence?.waiting_for ?? null,
+      turn_source: nativeRow.activity?.evidence?.source ?? null, turn_since_ms: nativeRow.activity?.evidence?.native_state_since_ms ?? null } : undefined);
+  };
+  const scopedAddress = target => sources.get(target) && (!listedSources.has(target)
+    || listedSources.get(target).size === 1 && listedSources.get(target).has(sources.get(target)));
+  // Starter receipts name addresses; they cannot disambiguate an address observed in multiple stores.
+  const scopedEdges = delegations.filter(edge => scopedAddress(edge.starter) && scopedAddress(edge.session));
+  const delegatedOf = (session) => {
+    const address = addressOf(session);
+    if (!homeIdentity(session) || sources.get(address) !== homeIdentity(session)) return [];
+    return delegatedWork(address, scopedEdges, delegatedReadings);
+  };
+  const unreadClock = (session, run, observedAt) => {
+    const last = turnUnreadWatch.get(run.id);
+    return last != null && observedAt - last <= Math.max(3 * settings.interval, settings.idleQuiet / 2) && Number(session.unknown_since) > 0 ? Number(session.unknown_since) : observedAt;
+  };
+  const resumedClock = (session, run, live, observedAt) => {
+    const last = idleWatch.get(run.id);
+    return last == null || observedAt - last > Math.max(3 * settings.interval, settings.idleQuiet / 2)
+      ? resumedWatch(session, live, run, fleet.linkedSince?.get(session.machine ?? localMachine()), observedAt) : null;
+  };
+  const noticeDue = (limits, quiet, prior, observedAt) => Number(limits.idle_notice) > 0 && quiet >= Number(limits.idle_notice)
+    && (!prior || (Number(limits.idle_notice_repeat) > 0 && observedAt - prior.at >= Number(limits.idle_notice_repeat)));
+  // A mailbox read explains a due notice; it is not part of every idle reading.
+  // Preview only the existing clock/eligibility rules, without writes. The
+  // transaction below rechecks them after the one bounded door read.
+  const dueMail = [];
+  for (const row of running) {
+    await yieldToOwner();
+    if (stopping) return;
+    const due = view(board, (db) => {
+      const { id } = row;
+      const subject = idleSubject(db, id);
+      if (!subject || subject.held || !subject.handles('session_stalled') || addressOf(subject.session)?.split(':')[1] !== localMachine()) return false;
+      const { task, run } = subject;
+      let { session } = subject;
+      const observedAt = now(), limits = limitsOf(db, board, entry, task, session);
+      if (session.machine && !fleet.online.has(session.machine) || sessionAlive(fleet, session) !== true) return false;
+      const live = liveOf(session);
+      if (live?.turn !== 'idle') return false;
+      const resumed = resumedClock(session, run, live, observedAt);
+      if (resumed !== null) session = { ...session, watch_since: resumed };
+      if (session.unknown_since != null) session = { ...session, watch_since: observedAt };
+      const prior = session.idle_notice?.native_since_ms === (live?.turn_since_ms ?? null) ? session.idle_notice : null;
+      const due = noticeDue(limits, idleInterval(session, live, observedAt).quiet, prior, observedAt);
+      return due && !delegatedOf(session).length;
+    });
+    if (due) dueMail.push(row);
   }
+  const undelivered = await undeliveredMail(board, dueMail);
+  const mailOf = (address) => undelivered.has(address) ? undelivered.get(address) : address?.split(':')[1] === localMachine()
+    ? { unread: 'the session became due after this observation selected its mailboxes' } : null;
   for (const { id } of running) {
-    let staged = [], watched = null;
+    await yieldToOwner();
+    if (stopping) return;
+    let staged = [], watched = null, unread = null;
     txRead(board, (db) => {
-      staged = []; watched = null;
-      const task = getTask(db, id);
-      const status = statusOf(db, task);
-      const handles = name => entry.workflow.statuses[status]?.on?.[name] || entry.workflow.on?.[name] || entry.workflow.run?.on?.[name];
-      if (!handles('session_idle') && !handles('session_stalled')) return;
-      const runRow = currentRun(db, id);
-      let session = runRow?.metadata?.supercode;
-      if (!session?.session_id || !['pane', 'native'].includes(session.surface) || session.offline_since != null) return;
-      if (task.paused || task.archived || task.detached || runRow.ended_at != null) {
+      staged = []; watched = null; unread = null;
+      const subject = idleSubject(db, id);
+      if (!subject) return;
+      const { task, status, handles, run: runRow } = subject;
+      let { session } = subject;
+      if (subject.held) {
         if (session.idle_since != null || session.idle_notice) setRunSession(db, runRow.id, { idle_since: null, idle_notice: null, watch_since: now() });
         return;
       }
-      // a machine this round did not read as online (offline, or its door silent) shows nothing of its session: no
-      // clock of the run moves on a round that could not see it
-      if (session.machine && !fleet.online.has(session.machine)) return;
-      if (session.surface === 'native' && sessionAlive(fleet, session) !== true) return;
+      // Unknown is an observation failure, never a workflow stall or work reminder (ADR 0073).
+      const reportUnread = (observedAt, why, live = null) => {
+        unread = [runRow.id, observedAt];
+        const since = unreadClock(session, runRow, observedAt);
+        if (session.unknown_since !== since) setRunSession(db, runRow.id, { unknown_since: since });
+        if (session.idle_since != null || session.idle_notice) setRunSession(db, runRow.id, { idle_since: null, idle_notice: null });
+        const quiet = Math.max(0, observedAt - since);
+        const machineReadable = !session.machine || fleet.online.has(session.machine);
+        const address = addressOf(session), identity = homeIdentity(session), key = JSON.stringify([address, identity, machineReadable]);
+        if (quiet < settings.idleQuiet || session.unknown_notice?.key === key && session.unknown_notice.since === since) return;
+        const sinceAt = new Date(since * 1000).toISOString().replace(/\.\d{3}Z$/, 'Z');
+        const observation = { decision: 'turn_unknown_reported', session: address, run_id: runRow.id, observed_at: observedAt, quiet_seconds: quiet, turn: live?.turn ?? null,
+          turn_readable: false, unreadable_since: since, unreadable_since_at: sinceAt, unreadable_reason: why,
+          idle_since: null, idle_since_at: null, last_turn_at: null, last_turn_at_ms: null, last_turn_time_source: null,
+          status: live?.status ?? null, turn_source: live?.turn_source ?? null, waiting_for: live?.waiting_for ?? null, native_since_ms: live?.turn_since_ms ?? null };
+        const told = identity && db.prepare(`SELECT r.metadata FROM task_runs r WHERE r.id != ? AND r.id IN (${ACTIVE_RUN_IDS})`).all(runRow.id)
+          .some(r => {
+            const other = json(r.metadata, {})?.supercode;
+            return other?.unknown_notice?.key === key && other.unknown_since === since && other.unknown_notice.since === since;
+          });
+        setRunSession(db, runRow.id, { unknown_notice: { key, since, at: observedAt }, idle_observation: observation });
+        event(db, id, 'session_turn_unknown', observation, runRow.id);
+        const to = managers[0] ?? null;
+        if (to && !told && machineReadable) {
+          const others = (cardsOf.get(address) ?? []).filter(card => card !== id);
+          event(db, id, 'board_message', { to, text: `${id}: its session ${address} cannot be read since ${sinceAt}: ${why}. Read status=${JSON.stringify(observation.status)}, turn=${JSON.stringify(observation.turn)}, source=${JSON.stringify(observation.turn_source)}, waiting_for=${JSON.stringify(observation.waiting_for)}, native_since_ms=${JSON.stringify(observation.native_since_ms)}.${others.length ? ` It is also on ${others.join(', ')}.` : ''} This is an unknown observation; it authorizes no stall, work reminder, reclaim or replacement.` }, null);
+        }
+        (report.held ??= []).push([id, 'turn_unknown', address]);
+      };
+      // A machine read offline is its run's machine wait (machine_offline), which speaks for it. One read but not current
+      // (its record's panes or sessions unread) shows nothing of the session's turn: that turn is unreadable.
+      if (session.machine && !fleet.online.has(session.machine)) {
+        if (fleet.offline?.has(normalMachine(session.machine)) || sessionAlive(fleet, session) === false) return;
+        const error = fleet.errors?.get(normalMachine(session.machine)) ?? fleet.error ?? null;
+        reportUnread(now(), `machine ${session.machine} cannot be read${error ? `: ${String(error).split('\n')[0].slice(0, 300)}` : ''}`);
+        return;
+      }
+      if (sessionAlive(fleet, session) !== true) {
+        if (sessionAlive(fleet, session) === false) return;
+        reportUnread(now(), `its session on ${session.machine ?? 'its machine'} could not be read`);
+        return;
+      }
       // A session the machine's record publishes no activity for has its turn on its machine's discovery row, which
       // readBefore read: a session in no pane, and a live pane whose record names no session in it (a Codex pane on its
       // own Codex home, VO-3259 run 2408: supervise read its turn idle there while this read none, so its run took the
       // unknown-turn notice once and was never reminded or reclaimed). A pane is read so only while its record shows it.
-      const published = fleet.sessions.find((x) => x.address === addressOf(session));
-      let nativeRow = null;
-      if (!published && (session.surface === 'native' || sessionAlive(fleet, session) === true)) try { nativeRow = nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code', session.session_id), session).row; } catch { /* unread: no turn */ }
-      const live = published ?? (nativeRow ? { address: addressOf(session), turn: nativeRow.activity?.turn ?? null, waiting_for: nativeRow.activity?.evidence?.waiting_for ?? null,
-        turn_source: nativeRow.activity?.evidence?.source ?? null, turn_since_ms: nativeRow.activity?.evidence?.native_state_since_ms ?? null } : undefined);
+      const live = liveOf(session);
       const observedAt = now();
       // Quiet time is time the board watched. A run this process has not read for a while (the board restarted, was
       // paused, could not read the fleet or the machine) resumes its idle clock where resumedWatch reads it: from the
       // harness's own idle-since where its session reads idle with one and its machine's record was current over it,
       // else from this reading, so a gap the board could not see is not idleness and no reminder is spent on it
       // (volter-org t_9a9c2a9c: reminder 1 in the second its machine came back, the run reclaimed 45 minutes later).
-      // The unknown-turn clock starts here.
-      const lastWatched = idleWatch.get(runRow.id);
-      if (lastWatched == null || observedAt - lastWatched > Math.max(3 * settings.interval, settings.idleQuiet / 2)) {
-        const resumed = resumedWatch(session, live, runRow, fleet.linkedSince?.get(session.machine ?? localMachine()), observedAt);
-        setRunSession(db, runRow.id, { watch_since: resumed, unknown_since: null });
-        session = { ...session, watch_since: resumed, unknown_since: null };
+      const resumed = resumedClock(session, runRow, live, observedAt);
+      if (resumed !== null) {
+        setRunSession(db, runRow.id, { watch_since: resumed });
+        session = { ...session, watch_since: resumed };
       }
       watched = [runRow.id, observedAt];
       // A reviewer's work is its verdict, and its verdict ends its run: nothing the card shows while the review runs is
@@ -1933,15 +2562,12 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       // put to its user is its harness's to say (`needs_input`); what it waits for is carried as it was read.
       const address = addressOf(session);
       const asked = live?.turn === 'needs_input';
-      const edges = [...delegations, ...fleet.sessions.filter(row => row.starter_session?.startsWith('sc:')).map(row => ({ starter: row.starter_session, session: row.address }))];
-      for (const child of db.prepare('SELECT id,current_run_id FROM tasks WHERE current_run_id IS NOT NULL').all()) {
-        const starter = creatorOf(db, child.id)?.replace(/^session:/, '');
-        const target = addressOf(currentRun(db, child.id)?.metadata?.supercode);
-        if (starter?.startsWith('sc:') && target) edges.push({ starter, session: target });
-      }
-      const delegated = delegatedWork(address, edges, delegatedReadings);
+      const delegated = delegatedOf(session);
       if (live?.turn === 'idle' || asked || live?.turn === 'working' || delegated.length) {
-        if (session.unknown_since != null || session.unknown_notice) setRunSession(db, runRow.id, { unknown_since: null, unknown_notice: null });
+        if (session.unknown_since != null || session.unknown_notice) {
+          setRunSession(db, runRow.id, { unknown_since: null, unknown_notice: null, watch_since: observedAt });
+          session = { ...session, watch_since: observedAt };
+        }
       }
       // a reading that shows the session no longer waiting ends the prompt; a round that did not read it does not
       if (session.held_notice && live && !asked) setRunSession(db, runRow.id, { held_notice: null });
@@ -1982,29 +2608,8 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
         retain(delegated.length ? 'delegated_work' : 'working', { delegated_sessions: delegated });
         return;
       }
-      // An unread or unknown turn does not prove idle, but cannot remain silent
-      // indefinitely. Bound the observed interval independently of transcript
-      // writes, and tell the manager once with the native facts we actually read.
       if (live?.turn !== 'idle') {
-        if (session.idle_since != null || session.idle_notice) setRunSession(db, runRow.id, { idle_since: null, idle_notice: null });
-        const since = Number(session.unknown_since ?? observedAt);
-        reading.unknown_since = since;
-        reading.quiet_seconds = Math.max(0, observedAt - since);
-        if (session.unknown_since !== since) setRunSession(db, runRow.id, { unknown_since: since });
-        if (reading.quiet_seconds < settings.idleQuiet) { retain('turn_unknown'); return; }
-        if (session.unknown_notice) return;
-        const key = [address, live?.turn_since_ms ?? 'unknown'].join('|');
-        const told = db.prepare(`SELECT r.metadata FROM task_runs r WHERE r.id != ? AND r.id IN (${ACTIVE_RUN_IDS})`).all(runRow.id)
-          .some(r => json(r.metadata, {})?.supercode?.unknown_notice?.key === key);
-        setRunSession(db, runRow.id, { unknown_notice: { key, at: observedAt, since } });
-        const observation = retain('turn_unknown_reported', { waiting_for: live?.waiting_for ?? null, turn_source: live?.turn_source ?? null, since_ms: live?.turn_since_ms ?? null });
-        event(db, id, 'session_turn_unknown', observation, runRow.id);
-        const to = managers[0] ?? null;
-        if (to && !told) {
-          const others = (cardsOf.get(address) ?? []).filter(card => card !== id);
-          event(db, id, 'board_message', { to, text: `${id}: its session ${address} has no known native turn after ${reading.quiet_seconds}s of observation (threshold ${settings.idleQuiet}s). Read status=${JSON.stringify(reading.status)}, turn=${JSON.stringify(reading.turn)}, source=${JSON.stringify(live?.turn_source ?? null)}, waiting_for=${JSON.stringify(live?.waiting_for ?? null)}, native_since_ms=${JSON.stringify(live?.turn_since_ms ?? null)}, last_message_at_ms=${JSON.stringify(reading.last_message_at_ms)}.${others.length ? ` It is also on ${others.join(', ')}.` : ''} Its liveness needs a decision; no idle state or permission answer was inferred.` }, null);
-        }
-        (report.held ??= []).push([id, 'turn_unknown', address]);
+        reportUnread(observedAt, 'its session has no known native turn', live);
         return;
       }
       // A native idle receipt also works without a transcript timestamp.
@@ -2019,15 +2624,15 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       let stalled = false;
       if (handles('session_stalled')) {
         const limits = limitsOf(db, board, entry, task, session);
-        const first = Number(limits.idle_notice), repeat = Number(limits.idle_notice_repeat);
         const nativeIdle = live?.turn_since_ms ?? null;
         const prior = session.idle_notice?.native_since_ms === nativeIdle ? session.idle_notice : null;
-        const due = first > 0 && interval.quiet >= first && (!prior || (repeat > 0 && observedAt - prior.at >= repeat));
+        const due = noticeDue(limits, interval.quiet, prior, observedAt);
         if (due) try {
           const turnAt = Number(live?.turn_since_ms) || (lastAt > 0 ? Number(lastAtMs) : null);
           const payload = { ...reading, session: address, run_id: runRow.id, last_turn_at_ms: turnAt,
             last_turn_at: turnAt ? new Date(turnAt).toISOString() : null,
-            last_turn_time_source: Number(live?.turn_since_ms) > 0 ? 'native_idle_since' : turnAt ? 'last_session_update' : null, repeat: Boolean(prior) };
+            last_turn_time_source: Number(live?.turn_since_ms) > 0 ? 'native_idle_since' : turnAt ? 'last_session_update' : null, repeat: Boolean(prior),
+            undelivered: mailOf(address) };
           const result = fire(db, board, entry, id, 'session_stalled', { roles: ['platform'], payload });
           staged.push(...result.effects);
           stalled = true;
@@ -2053,7 +2658,12 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
         const said = doors(entry.workflow, status, session.role ?? runSpec(entry, status)?.role ?? 'implementer', id, where, session.surface !== 'headless' ? 'pane' : 'headless');
         const brief = pendingBrief(board, task, runRow.id, where);
         const r = fire(db, board, entry, id, 'session_idle', { roles: ['platform'], payload: { ...reading, turns: reading.turns_before, worked }, extra: { where, doors: said, pending_brief: brief } });
-        // a reminder wakes the session with what its run is for: send_to_actor saves it with the run's pending brief
+        // a reminder wakes the session with what its run is for: send_to_actor saves it with the run's pending brief, and
+        // one that carries the brief is filed as the run's instruction, as the brief itself is, never as a notice
+        if (brief) for (const effect of r.effects) if (effect.kind === 'send_to_actor' && effect.durableId) {
+          effect.as = 'instruction';
+          db.prepare("UPDATE supercode_effects SET effect = json_set(effect, '$.as', 'instruction') WHERE id = ?").run(effect.durableId);
+        }
         staged.push(...r.effects);
         const after = currentRun(db, id);
         const stored = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runRow.id)?.metadata, {})?.supercode;
@@ -2080,9 +2690,10 @@ async function observeIdle(board, fleet, settings, report, entry, effects) {
       }
     });
     if (watched) idleWatch.set(...watched);
+    if (unread) turnUnreadWatch.set(...unread);
     effects.push(...staged);
   }
-  for (const [runId, at] of idleWatch) if (now() - at > 86_400) idleWatch.delete(runId);
+  for (const watch of [idleWatch, turnUnreadWatch]) for (const [runId, at] of watch) if (now() - at > 86_400) watch.delete(runId);
 }
 
 function effectMessageKey(effect) {
@@ -2110,11 +2721,13 @@ export async function sessionNotice(board, e) {
   if (!address) throw new Error('lifecycle notice awaits the owned launch session identity');
   const card = view(board, (db) => getTask(db, e.id));
   const subject = numbered(boardKey(board.root, board.slug), card?.number, `${String(e.verb ?? 'run_changed').replaceAll('_', ' ')} · run ${e.runId} · event ${e.sourceEvent ?? 'none'} · ${card?.title || e.id}`, noticeName(card));
-  const filed = await fileMail(board, address, e.text, effectMessageKey(e), { subject });
+  // a role's brief (queueBrief: an adopted session's, or one told again when its prompt changed) is the run's instruction
+  const as = ['brief', 'brief_changed'].includes(e.verb) ? 'instruction' : 'notice';
+  const filed = await fileMail(board, address, e.text, effectMessageKey(e), { as, subject });
   tx(board, (db) => {
     const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(e.runId)?.metadata, {})?.supercode;
     if (session?.lifecycle_notice_pending === e.durableId) setRunSession(db, e.runId, { lifecycle_notice_pending: null });
-    if (filed.detached) event(db, e.id, 'session_notice_not_required', { address, notice: e.durableId, reason: 'session detached to a person' }, e.runId);
+    if (filed.detached) event(db, e.id, 'session_notice_not_required', { address, verb: e.verb, notice: e.durableId, reason: 'session detached to a person' }, e.runId);
     if (filed.new) event(db, e.id, 'session_notice_filed', { address, verb: e.verb, source_event: e.sourceEvent, notice: e.durableId, message_id: filed.message_id }, e.runId);
   });
   return true;
@@ -2132,7 +2745,7 @@ export async function sessionEffect(board, e) {
     if (!address) throw new Error('actor session identity unavailable');
     // filed in the actor's mailbox, which delivers it
     const card = view(board, (db) => getTask(db, e.id));
-    const filed = await fileMail(board, address, e.text, effectMessageKey(e), { subject: numbered(boardKey(board.root, board.slug), card?.number, `actor notice · run ${e.runId ?? 'none'} · ${card?.title || e.id}`, noticeName(card)) });
+    const filed = await fileMail(board, address, e.text, effectMessageKey(e), { as: e.as === 'instruction' ? 'instruction' : 'notice', subject: numbered(boardKey(board.root, board.slug), card?.number, `actor notice · run ${e.runId ?? 'none'} · ${card?.title || e.id}`, noticeName(card)) });
     if (filed.new) tx(board, db => event(db, e.id, 'actor_notice_filed', { notice: e.durableId, address, message_id: filed.message_id }, e.runId));
     return true;
   }
@@ -2151,7 +2764,7 @@ export async function sessionEffect(board, e) {
  */
 const MERGE_BUDGET_MS = 300_000;
 export async function mergeReviewed(board, e) {
-  const { candidatePullRequests, mergeReviewedPullRequest } = await import('./ci.mjs');
+  const { candidatePullRequests, mergeReviewedPullRequest, verifiedReleaseReadback } = await import('./ci.mjs');
   const pass = view(board, (db) => db.prepare("SELECT id, payload FROM task_events WHERE task_id = ? AND kind = 'review_pass' ORDER BY id DESC LIMIT 1").get(e.id));
   const recorded = json(pass?.payload, {})?.ci ?? null;
   const ci = typeof recorded === 'string' ? json(recorded, null) : recorded;
@@ -2161,6 +2774,14 @@ export async function mergeReviewed(board, e) {
   // effect's claim; what is left is the next attempt's
   const began = Date.now();
   for (const p of prs) {
+    if (prDisposition(board,e.id,p.pr.url,p.commit).disposition === 'release-only') {
+      // This head must never reach the merge door. Settlement independently rechecks its
+      // current PR head and the retained disposition/verdict/readback binding.
+      const readback = await verifiedReleaseReadback(board,e.id,p.pr.url,p.commit);
+      if (!readback) return false;
+      merges.push({ pr: p.pr.url, reviewed: p.commit, release_only: true, target: readback.target, artifact: readback.artifact });
+      continue;
+    }
     if (Date.now() - began > MERGE_BUDGET_MS) throw new Error(`the merge attempt spent its ${MERGE_BUDGET_MS / 1000} s; the rest is merged next attempt`);
     let answer;
     try { answer = await mergeReviewedPullRequest(p.pr.url, p.commit); } catch (error) {
@@ -2183,10 +2804,12 @@ export async function mergeReviewed(board, e) {
   // A fault other than the card's refusal keeps the effect for the next round, and the round goes on past it.
   try { tx(board, (db) => {
     event(db, e.id, 'reviewed_merged', { merges });
+    // a closed card's kept worktree, or a closed subtask's, is read again now that its merge has landed
+    for (const row of db.prepare("SELECT t.id FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id WHERE (t.id = ? OR c.subtask_of = ?) AND t.status IN ('done', 'cancelled', 'archived') AND t.workspace_kind = 'worktree'").all(e.id, e.id)) queueCleanup(db, row.id);
     // A card that moved after its pass cannot take the event: that is said to the manager once, never thrown, so the
     // kept effect does not stop every round after it (as merge_refused, above).
     let r;
-    try { r = fire(db, board, entry, e.id, 'reviewed_merged', { roles: ['platform'], payload: { merges, summary: merges.length ? `Merged at the reviewed heads: ${merges.map((m) => `${m.pr} (${m.reviewed.slice(0, 8)} → ${String(m.merge).slice(0, 8)})`).join(', ')}` : 'The pass named no PR to merge.' } }); }
+    try { r = fire(db, board, entry, e.id, 'reviewed_merged', { roles: ['platform'], payload: { merges, summary: merges.length ? `Settled at the reviewed heads: ${merges.map((m) => m.release_only ? `${m.pr} (released ${m.artifact} on ${m.target})` : `${m.pr} (${m.reviewed.slice(0, 8)} → ${String(m.merge).slice(0, 8)})`).join(', ')}` : 'The pass named no PR to merge.' } }); }
     catch (error) {
       // only the card's refusal is said and consumed; anything else (a write contention, a fault) is thrown and retried
       if (!error.noTransition && !error.refusal && !/does not apply|there is for/.test(error.message)) throw error;
@@ -2262,13 +2885,10 @@ function noteGuard(db, id, reason) {
   if (guardNoted(db, id, reason)) return;
   event(db, id, 'respawn_guarded', { reason });
 }
-/** Whether `reason` is already noted: once per reason per entry into the status (a card back in ready, a new `since`, is
- *  noted again, so the workflow's after-timers that read the reason, card.queue_reason, see it). Read before a write
- *  is opened too: a card that waits for the same reason round after round costs no transaction. */
+/** Whether `reason` is already noted since this stage entry and latest run. Read before a write is opened too:
+ * a card that waits for the same reason round after round costs no transaction. */
 function guardNoted(db, id, reason) {
-  const since = Number(db.prepare('SELECT since FROM supercode_cards WHERE task_id = ?').get(id)?.since ?? 0);
-  const last = db.prepare("SELECT payload FROM task_events WHERE task_id = ? AND kind IN ('respawn_guarded', 'claimed') AND created_at >= ? ORDER BY id DESC LIMIT 1").get(id, since);
-  return json(last?.payload, {})?.reason === reason;
+  return dispatchWait(db, id)?.reason === reason;
 }
 
 /** Hermes's emergency stop: the `ESTOP` sentinel in the home or in `~/.hermes` stops new starts (running ones go on). */
@@ -2286,14 +2906,15 @@ const getTaskNow = (board, id) => view(board, (db) => getTask(db, id));
 
 /** A transport error is not a negative launch receipt. The key remains owned by its run. */
 /**
- * Where the round's fleet reading puts a launch's session: 'present' when its machine lists the launch's pane or a
- * session with its id, 'absent' when its machine answered and lists neither, null when its machine was not read.
+ * A bound launch's scoped conversation presence, or its pane presence before binding. Unread source/activity is null.
  */
 function launchReading(fleet, session) {
   const machine = normalMachine(session?.machine ?? localMachine());
   if (!fleet?.ok || !fleet.online?.has(machine) || !fleet.panes?.has(machine)) return null;
-  const sessionSeen = session.session_id && fleet.sessions?.some((f) => f.machine === machine && f.session_id === session.session_id);
-  return (session.pane && fleet.panes.get(machine).has(session.pane)) || sessionSeen ? 'present' : 'absent';
+  if (!session.session_id) return session.pane && fleet.panes.get(machine).has(session.pane) ? 'present' : 'absent';
+  if (!nativeHome(session)) return null;
+  const alive = sessionAlive(fleet, session);
+  return alive === true ? 'present' : alive === false ? 'absent' : null;
 }
 
 /** How a keyed launch ended, as its machine recorded it; read only where the machine has the door (supervise). */
@@ -2307,21 +2928,67 @@ async function launchReceipt(board, session, timeout = 30_000) {
   return receipt;
 }
 
-function bindLaunch(board, row, session, pane, sid) {
+/** Retire only a fresh attempt the machine positively records as never issued; its intended id is no conversation. */
+async function retireUnissuedSlotLaunch(board, taskId, runId, slot) {
+  for (;;) {
+    const prior = view(board, db => establishedSlot(db, taskId, slot, runId));
+    const session = prior?.session;
+    if (!session?.launch_key || session.mode !== 'fresh' || session.surface !== 'pane' || session.address || session.seen_at) return;
+    const result = await doorOn(session.machine, 'harness.v1.launches.cancel', { key: session.launch_key },
+      { timeout: 5_000, as: boardAddress(board.label) });
+    const receipt = result.code === 0 ? lastJson(result.stdout) : null;
+    if (receipt?.key !== session.launch_key || receipt.by !== boardAddress(board.label) || receipt.status !== 'cancelled'
+      || receipt.outcome !== 'not_issued' || receipt.pane || receipt.native_session || receipt.live !== false) return;
+    const retired = tx(board, db => {
+      if (!runCurrent(db, taskId, runId)) throw superseded(taskId, runId);
+      const current = establishedSlot(db, taskId, slot, runId);
+      if (current?.run !== prior.run || current.session.launch_key !== session.launch_key || current.session.address || current.session.seen_at) return false;
+      setRunSession(db, prior.run, { launch_not_issued: true, launch_pending: !current.session.close_confirmed_at });
+      requestSessionClose(db, taskId, { runId: prior.run });
+      event(db, taskId, 'session_launch_not_issued', { key: session.launch_key, machine: session.machine,
+        intended_session: session.session_id ?? null, receipt }, prior.run);
+      return true;
+    });
+    if (!retired) return;
+    await closeRequested(board, { undelivered: [] }, { taskId });
+    if (view(board, db => establishedSlot(db, taskId, slot, runId))?.run === prior.run) return;
+  }
+}
+
+function bindLaunch(board, row, session, receipt, { refile = null } = {}) {
+  if (receipt?.key !== session.launch_key || receipt.by !== boardAddress(board.label) || receipt.pane !== session.pane
+    || (refile ? receipt.inputBounced !== true : receipt.inputDelivered !== true || receipt.inputReceipt !== 'native-user-message')
+    || typeof receipt.native_session !== 'string' || !receipt.native_session) return false;
+  const pane = receipt.pane, sid = receipt.native_session;
+  const home = receipt.native_home ?? nativeHome(session);
+  if (nativeHome(session) && home && JSON.stringify(nativeHome(session).homes) !== JSON.stringify(home.homes))
+    throw unavailable(`launch ${session.launch_key} returned a different native home; its identity was not bound`);
   return tx(board, (db) => {
     const current = db.prepare('SELECT ended_at, metadata FROM task_runs WHERE id=?').get(row.id);
     const saved = json(current?.metadata, {})?.supercode;
     // a launch another round already bound, or whose session was closed, is not bound again
     if (!saved || saved.launch_key !== session.launch_key || !saved.launch_pending || saved.close_confirmed_at || (saved.session_id && sid && saved.session_id !== sid)) return false;
-    const address = sid ? `sc:${session.machine}:${session.harness}:${sid}` : null;
-    setRunSession(db, row.id, { ...saved, pane, session_id: sid ?? saved.session_id,
-      ...(address ? { address, launch_pending: false, launch_error: null, seen_at: now() } : {}) });
-    if (current.ended_at) requestSessionClose(db, row.task_id, { runId: row.id });
-    else if (address && getTask(db, row.task_id)?.current_run_id === row.id) {
+    const task = getTask(db, row.task_id);
+    let refused = null;
+    if (!current.ended_at && task?.current_run_id === row.id && !task.backlog) {
+      try { assertHeadlessBinding(board, row.task_id, row.id, saved.harness, sid); }
+      catch (error) { refused = error; }
+    }
+    if (nativeHome(saved) && home && JSON.stringify(nativeHome(saved).homes) !== JSON.stringify(home.homes))
+      throw unavailable(`launch ${session.launch_key} changed its retained native home before binding`);
+    const address = `sc:${session.machine}:${session.harness}:${sid}`;
+    setRunSession(db, row.id, { ...saved, pane, session_id: sid, native_home: home,
+      address, launch_pending: false, launch_error: null, seen_at: now() });
+    if (current.ended_at || task?.backlog || refused) requestSessionClose(db, row.task_id, { runId: row.id });
+    if (refused) {
+      setRunSession(db, row.id, { continuation_required: true });
+      surfaceIncident(db, board, workflowFor(board.root), row.task_id, 'spawn_failed', { error: refused.message, origin: originOf(refused) }, row.id);
+    } else if (!task?.backlog && getTask(db, row.task_id)?.current_run_id === row.id) {
       replaceWorkerSubscriptions(db, row.task_id, address);
       for (const p of db.prepare('SELECT parent_id FROM task_links WHERE child_id=?').all(row.task_id)) subscribeIn(db, p.parent_id, address, 'dependency');
     }
-    if (sid && saved.launch_pending) event(db, row.task_id, 'session_launch_reconciled', { key: session.launch_key, pane, session_id: sid, role: saved.role }, row.id);
+    event(db, row.task_id, 'session_launch_reconciled', { key: session.launch_key, pane, session_id: sid, role: saved.role }, row.id);
+    if (refile && !current.ended_at && !refused && getTask(db, row.task_id)?.current_run_id === row.id) refile(db, address);
     return true;
   });
 }
@@ -2338,12 +3005,11 @@ export async function reconcileCallerLaunch(board, sid) {
     return s?.machine === machine && s.harness === harness && (!s.session_id || s.session_id === sid);
   });
   if (!candidates.length) return;
-  const pane = process.env.SUPERCODE_TEAMS_PANE || (await observeFleet()).sessions?.find((s) => s.address === `sc:${machine}:${harness}:${sid}`)?.pane;
-  if (!pane) return;
-  // the caller's own pane (its environment, or this machine's reading) binds the run whose launch recorded that pane
   for (const row of candidates) {
     const s = json(row.metadata, {})?.supercode;
-    if ((s.pane === pane || s.session_id === sid) && bindLaunch(board, row, s, pane, sid)) return;
+    await readNativeHome(s);
+    const receipt = await launchReceipt(board, s, 5000);
+    if (receipt?.native_session === sid && bindLaunch(board, row, s, receipt)) return;
   }
 }
 
@@ -2355,11 +3021,13 @@ const SESSION_UNREADABLE=-32050;
  * file's size and time here, what discovery says of it on another machine), and asked again once either differs: the
  * same bytes get the same answer only from the same reader. Every other failure (no answer, a timeout, a fault in the
  * door, a daemon that does not say which it is) says nothing of the record, and the read is made again. */
-async function readRunUsage(root,org,row,endedAt){
+async function readRunUsage(root,org,row,endedAt,session){
   const [harness,...rest]=row.session_ref.split(':'),machine=row.machine&&normalMachine(row.machine)!==localMachine()?row.machine:null;
+  const home = await readNativeHome(session);
+  if (!home) return;
   // the usage door loads the session by its whole locator, which discovery names
-  const sessionId=rest.join(':'),found=await runtimeDoor(machine,'harness.v1.sessions.discover',{query:sessionId,harnesses:[harness],limit:200},{timeout:30_000});
-  const descriptor=found.code===0?json(found.stdout.trim(),{})?.sessions?.find(item=>item.locator?.harness===harness&&item.locator?.session_id===sessionId):null,locator=descriptor?.locator??null;
+  const sessionId=rest.join(':'),found=await runtimeDoor(machine,'harness.v1.sessions.discover',{query:sessionId,harnesses:[harness],homes:home.homes,limit:200,include_activity:false},{timeout:30_000});
+  const descriptor=found.code===0?json(found.stdout.trim(),{})?.sessions?.find(item=>item.locator?.harness===harness&&item.locator?.session_id===sessionId&&inNativeHome(item,home.homes)):null,locator=descriptor?.locator??null;
   let stamp=null;
   if(locator){
     const described=await runtimeDoor(machine,'harness.v1.machine.describe',{},{timeout:15_000}),reader=described.code===0?json(described.stdout.trim(),{}):null;
@@ -2378,19 +3046,21 @@ async function readRunUsage(root,org,row,endedAt){
  * handed to this machine's daemon, and usage read from each machine's own doors. No Teams call: the daemon declares and
  * ends agents and binds their sessions (D137). It runs in the delivery pass (`deliver`), never in a dispatch round. */
 async function synchronizeAgents(board, report, fleet = null) {
-  // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
-  // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
-  const agentRuns=[...new Map((await readRunPages(board.db, 'id,task_id,metadata,ended_at', { where: "json_extract(metadata,'$.supercode.agent_id') IS NOT NULL" }))
-    .map(row=>{const session=json(row.metadata,{})?.supercode;return [session?.session_id?addressOf(session):`run:${row.id}`,row];})).values()];
-  const live=new Map();
-  for(const scanned of agentRuns){
+  const work = await currentAgentWork(board);
+  const live = new Map();
+  // Credential decisions depend on fleet/custody too, but only current retained credentials
+  // enter this pass; settled ended history does not.
+  for (const ref of work.credentials) {
+    const row = work.rows.get(ref), session = row?.session;
+    if (row && credentialsWanted(board,row,session,fleet)) live.set(credentialsKey(session.machine,session.agent_id),{task:row.task_id,run:row.id});
+  }
+  for (const key of [...work.pending]) {
     await yieldToOwner();
-    const row=view(board,db=>db.prepare('SELECT id,task_id,metadata,ended_at FROM task_runs WHERE id=?').get(scanned.id));
-    if(!row)continue;
-    const session=json(row.metadata,{})?.supercode;
-    if(credentialsWanted(board,row,session,fleet))live.set(credentialsKey(session.machine,session.agent_id),{task:row.task_id,run:row.id});
-    if(!session?.session_id||!session.agent_org||view(board,db=>detachedSession(db,session)))continue;
-    const ref=`${session.harness}:${session.session_id}`;
+    // A yielded projection is advisory. Resolve its current latest identity again before
+    // recording ownership, just as launch/close effects reread their target.
+    const row = latestAgentRow(board,key), session = row?.session;
+    if (!row || !session?.session_id || !session.agent_org || view(board,db => detachedSession(db,session))) { work.pending.delete(key); continue; }
+    const ref = `${session.harness}:${session.session_id}`;
     // An ended run whose session the agent store already holds for another agent lost that claim when it ran: no round
     // can change an ended run, so the disagreement is history. It is said once on its card (agent_ownership_conflict)
     // and the run is not recorded again. A live run is never history: it is recorded below every round, and a conflict
@@ -2400,31 +3070,40 @@ async function synchronizeAgents(board, report, fleet = null) {
       if(owner&&owner.org===session.agent_org&&owner.agent_id!==session.agent_id){
         const said=db=>db.prepare("SELECT 1 FROM task_events WHERE task_id=? AND run_id=? AND kind='agent_ownership_conflict' LIMIT 1").get(row.task_id,row.id);
         if(!view(board,said))tx(board,db=>{if(!said(db))event(db,row.task_id,'agent_ownership_conflict',{session:ref,run_agent:session.agent_id,owner:owner.agent_id,owner_run:owner.run_id},row.id);});
-        continue;
+        work.pending.delete(key); continue;
       }
     }
     // One run whose session another agent already owns is that card's problem, said on it; the round goes on for the rest.
     try{recordAgentRun(board.root,session.agent_org,session.agent_id,{session:ref,machine:session.machine,run:row.id});}
     catch(error){report.queued.push([row.task_id,`run ${row.id}: ${error.message}`]);continue;}
+    work.pending.delete(key);
   }
   await keepAgentCredentialsCurrent(board,live,report);
-  // G3: an ended run's session usage, read once from its harness's own records on its machine
-  for(const org of new Set(agentRuns.map(row=>json(row.metadata,{})?.supercode?.agent_org).filter(Boolean))){
-    let read=0;
-    for(const row of runsAwaitingUsage(board.root,org)){
-      const run=agentRuns.find(item=>String(item.id)===String(row.run_id));
-      if(!run?.ended_at||read>=5||view(board,db=>detachedSession(db,json(run.metadata,{})?.supercode)))continue;
-      await readRunUsage(board.root,org,row,run.ended_at);read++;
+  // Outstanding usage remains due work. A refused reader is retried at a bounded cadence,
+  // independently of new events, instead of rediscovering settled history each idle pass.
+  const runsById = new Map([...work.rows.values()].map(row => [String(row.id),row]));
+  for (const org of pendingUsageOrgs(board.root)) {
+    let read = 0;
+    for (const row of runsAwaitingUsage(board.root,org)) {
+      const run = runsById.get(String(row.run_id)), key = `${org}\0${row.session_ref}`;
+      if (!run?.ended_at || read >= 5 || (work.usageDue.get(key) ?? 0) > Date.now()
+        || view(board,db => detachedSession(db,run.session))) continue;
+      // Failed calls remain pending in the authoritative agent store, including across restart.
+      work.usageDue.set(key,Date.now()+60_000);
+      await readRunUsage(board.root,org,row,run.ended_at,run.session); read++;
     }
   }
-  for(const assignment of cardAgentAssignments(board.root)){
+  for (const target of [...work.assignments]) {
     await yieldToOwner();
-    const task=getTaskNow(board,assignment.target);
-    if(task&&(assignment.state==='ended'||task.archived||['done','cancelled'].includes(task.status)))finishCardAgentAssignment(board,assignment,`card ${assignment.target} ${task.archived?'archived':task.status}`);
-    else if(task){
-      if(task.readable_id)renameCardAgent(board.root,assignment,task.readable_id);
-      recordCardAgentAssignment(board,assignment);
+    const task = getTaskNow(board,target);
+    for (const assignment of cardAgentAssignments(board.root,target)) {
+      if (task && (assignment.state==='ended' || task.archived || ['done','cancelled'].includes(task.status))) finishCardAgentAssignment(board,assignment,`card ${target} ${task.archived?'archived':task.status}`);
+      else if (task) {
+        if (task.readable_id) renameCardAgent(board.root,assignment,task.readable_id);
+        recordCardAgentAssignment(board,assignment);
+      }
     }
+    work.assignments.delete(target);
   }
   // What a creating or closing verb could not hand on (no daemon running then) is handed on here.
   try{for(const pending of await handOffAgents(board.root))report.queued.push([pending.agent,pending.error]);}
@@ -2434,22 +3113,33 @@ async function synchronizeAgents(board, report, fleet = null) {
 async function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
   const deferred=view(board,db=>db.prepare("SELECT t.id,r.id run_id,COALESCE(json_extract(r.metadata,'$.supercode.launched_at'),r.started_at) launched_at FROM tasks t JOIN task_runs r ON r.id=t.current_run_id WHERE r.ended_at IS NULL AND json_extract(r.metadata,'$.supercode.launch_deferred')=1").all());
   // A deferred launch was never issued (a reading or door was not yet available): it is the start its manager, creator
-  // or workflow asked for, carried out within the launch window; supervise surfaces it once when the window ends. The
-  // window counts only time the fleet could be read: a launch waiting on an unreadable fleet was never tried, so its
-  // clock moves with the wait instead of running out (every resumed card failed so in the 22:17Z event-stream outage).
+  // or workflow asked for, carried out within the launch window that began when the run started; supervise surfaces it
+  // once when the window ends. A round that cannot carry it out says why, reads nothing for it and leaves that clock
+  // where it is: a wait never restarts the window.
   for(const {id,run_id,launched_at} of deferred) {
+    await yieldToOwner();
+    if (stopping) return;
     if (now() - launched_at >= settings.launchWindow) continue;
     // the run's launch is claimed before anything is done for it: another round's claim, or its launch, skips it here
-    const stillDeferred=db=>{const run=db.prepare('SELECT ended_at,metadata FROM task_runs WHERE id=?').get(run_id);return Boolean(run&&!run.ended_at&&getTask(db,id)?.current_run_id===run_id&&json(run.metadata,{})?.supercode?.launch_deferred);};
-    if (!fleet.ok) { tx(board,db=>{if(stillDeferred(db))setRunSession(db,run_id,{launched_at:now()});}); report.queued.push([id,`launch waits for the fleet: ${fleet.error}`]); continue; }
+    const stillDeferred = db => {
+      const run = currentRun(db, id), session = run?.metadata?.supercode;
+      return run?.id === run_id && session?.launch_deferred && !getTask(db, id)?.backlog ? session : null;
+    };
+    const wait = reason => {
+      const needsWait = db => Boolean(stillDeferred(db) && stillDeferred(db).launch_deferred_error !== reason);
+      if (view(board, needsWait)) tx(board, db => { if (needsWait(db)) setRunSession(db, run_id, { launch_deferred_error: reason }); });
+      report.queued.push([id, reason]);
+    };
     try {
       const task=getTaskNow(board,id),status=view(board,db=>statusOf(db,task)),spec=runSpec(entry,status,task);
-      const profile=spec&&view(board,db=>evaluate(entry.workflow.roles?.[spec.role]??'card.assignee',scopeOf(db,board,task,{params:entry.params})));
-      const lane=lanes?.[profile];if(!lane){report.queued.push([id,'launch waits for its configured lane']);continue;}
-      // a launch bound to a machine whose record is not current was not tried either: its clock moves with the wait too
+      if (task.backlog) { report.queued.push([id, 'backlog: its deferred launch is not admitted']); continue; }
+      assertRunCurrent(board,id,run_id);
+      const profile=spec&&view(board,db=>evaluate(entry.workflow.roles?.[spec.role]??'card.assignee',scopeOf(db,board,task,{params:entry.params,lazy:true})));
+      const lane=lanes?.[profile];if(!lane){wait('launch waits for its configured lane');continue;}
+      if (lane.surface === 'pane' && !fleet.ok) { wait(`launch waits for the fleet: ${fleet.error}`); continue; }
       const host=lane.surface==='pane'&&task.machine?executionHost(lane,task.machine,localMachine(),normalMachine):null;
-      if(host&&fleet.unknown?.has(host)){tx(board,db=>{if(stillDeferred(db))setRunSession(db,run_id,{launched_at:now()});});report.queued.push([id,`launch waits for machine ${host}'s fleet record: ${fleet.errors?.get(host)??'no current record'}`]);continue;}
-      const why=launcherCheck(board.db,task,lane,fleet);if(why){report.queued.push([id,why]);continue;}
+      if(host&&fleet.unknown?.has(host)){wait(`launch waits for machine ${host}'s fleet record: ${fleet.errors?.get(host)??'no current record'}`);continue;}
+      const why=launcherCheck(board.db,task,lane,fleet);if(why){wait(why);continue;}
       const claimed=tx(board,db=>{if(!stillDeferred(db))return false;setRunSession(db,run_id,{launch_deferred:false});return true;});
       if(!claimed){report.queued.push([id,'its launch was taken by another round']);continue;}
       const session=await launchRun(board,entry,id,lane,fleet,settings);
@@ -2467,27 +3157,15 @@ async function reconcileLaunches(board, fleet, report, entry, effects, settings,
   const rows = view(board, (db) => db.prepare(`SELECT id, task_id, started_at, ended_at, metadata FROM task_runs
     WHERE json_extract(metadata, '$.supercode.launch_pending') = 1
     AND json_extract(metadata, '$.supercode.close_confirmed_at') IS NULL`).all());
-  // A keyed launch is bound from the fleet reading, or its machine's exact native first-input receipt. A launch with
+  // A keyed launch is bound only from its machine's exact native first-input receipt. A launch with
   // no pane waits for its launch window (supervise surfaces it then); a pane read absent on its online machine after
   // the grace ended before its session was bound.
   for (const row of rows) {
     const s = json(row.metadata, {})?.supercode;
     try {
-      // found by its pane (chosen before open) or by its session id (named before open, for Claude Code)
-      const found = fleet.sessions?.find((f) => f.machine === normalMachine(s.machine) && String(f.address).startsWith(`sc:${s.machine}:${s.harness}:`)
-        && ((s.pane && f.pane === s.pane) || (s.session_id && f.session_id === s.session_id)));
-      const sid = s.session_id ?? found?.address.split(':')[3];
-      if (found && sid) { bindLaunch(board, row, s, found.pane ?? s.pane, sid); continue; }
-      // An app-server-owned Codex thread can confirm its first input before process discovery knows that thread.
-      // Bind only this board's live issuance, its exact pane and the native user-message receipt, never a title match.
-      if (!row.ended_at && s.launch_key && launchReading(fleet, s) === 'present') {
-        const receipt = await launchReceipt(board, s, 5000);
-        if (receipt?.by === boardAddress(board.label) && receipt.pane === s.pane && receipt.live === true
-            && receipt.inputDelivered === true && receipt.inputReceipt === 'native-user-message'
-            && typeof receipt.native_session === 'string' && receipt.native_session) {
-          bindLaunch(board, row, s, s.pane, receipt.native_session); continue;
-        }
-      }
+      await readNativeHome(s);
+      const receipt = await launchReceipt(board, s, 5000);
+      if (bindLaunch(board, row, s, receipt)) continue;
       // An ended run's launch that bound no session within its window awaits nothing: the run is over, and its pane's
       // close (closeRequested) needs no session. It was reported as awaiting its session every round, for good, once
       // its machine refused that close (t_7ec85b6b run 1203, 2026-10-09).
@@ -2504,7 +3182,7 @@ async function reconcileLaunches(board, fleet, report, entry, effects, settings,
           // another round may have bound this launch since the reading: only a launch still pending fails here
           const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(row.id)?.metadata, {})?.supercode;
           if (!current?.launch_pending || current.launch_key !== s.launch_key || current.address) return null;
-          // a fresh launch that never showed in a reading has no session to resume: its next run starts fresh
+          // An unbound fresh launch is unusable; its next run requires a deliberate replacement disposition.
           setRunSession(db, row.id, { launch_pending: false, ...(s.mode === 'fresh' ? { forgotten: true } : {}) });
           const payload = { error: `launch ${s.launch_key} ended before session binding` };
           if (monitorsRuns(entry)) { surfaceIncident(db, board, entry, row.task_id, 'spawn_failed', payload); return { effects: [] }; }
@@ -2512,7 +3190,7 @@ async function reconcileLaunches(board, fleet, report, entry, effects, settings,
           return fire(db, board, entry, row.task_id, 'spawn_failed', { roles: ['platform'], payload });
         });
         if (moved) effects.push(...moved.effects);
-      } else report.queued.push([row.task_id, `launch ${s.launch_key}${s.pane ? ` (pane ${s.pane})` : ''} awaits its ${s.harness} session in the fleet reading`]);
+      } else report.queued.push([row.task_id, `launch ${s.launch_key}${s.pane ? ` (pane ${s.pane})` : ''} awaits its native session receipt`]);
     } catch (error) { report.failed.push([row.task_id, `launch reconciliation retained: ${error.message}`]); }
   }
 }
@@ -2555,9 +3233,8 @@ function credentialsWanted(board, row, session, fleet) {
   if (!session?.agent_id || !session.machine || normalMachine(session.machine) === localMachine()) return false;
   if (!row.ended_at) return true;
   if (!view(board, (db) => detachedSession(db, session) && personCustody(db, addressOf(session)))) return false;
-  const address = addressOf(session);
   if (!fleet?.ok || fleet.unknown?.has(normalMachine(session.machine))) return true;
-  return Boolean(address && (fleet.alive?.has(address) || (fleet.native?.has(address) && fleet.native.get(address).alive !== false)));
+  return sessionAlive(fleet, session) !== false;
 }
 const UNREACHABLE = new Set(['machine_offline', 'REQUEST_TIMEOUT', 'unavailable', 504, '504', 'ETIMEDOUT', 'ECONNRESET']);
 /** One keep (records) or removal (none) in the home of `scope` on `machine`: `{ home, leaseUntil }`, or `{ why }`. A
@@ -2657,21 +3334,15 @@ export async function drainAgentCredentials(root, slug) {
   } finally { board.close(); }
 }
 
-async function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'worker', meta = {}, orchestration } = {}) {
+async function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'worker', meta = {}, workspaceOptions, orchestration } = {}) {
   const machine = executionHost(lane, task.machine, localMachine(), normalMachine);
   // Whether a board session opens a terminal window on its machine is the workflow's choice, stated on every launch;
   // no machine default decides it.
   const window = workflowFor(board.root).params.session_window;
   if (typeof window !== 'boolean') throw unavailable('the workflow declares no params.session_window (true or false): whether a board session opens a window on its machine is the workflow\'s choice');
-  {
-    const made = await resolveLocalWorkspace(board, task);
-    runTx(board, task.id, runId, (db) => {
-      db.prepare('UPDATE tasks SET workspace_path=?, branch_name=COALESCE(branch_name,?) WHERE id=?').run(made, task.workspace_kind === 'worktree' ? `wt/${task.id}` : null, task.id);
-    });
-    task = { ...task, workspace_path: made };
-  }
+  const workspace = await prepareRunWorkspace(board, task, runId, meta, workspaceOptions);
   const model = task.model_override ?? lane.model;
-  if(meta.agent_profile_intent)meta.agent_profile_intent.worker={...meta.agent_profile_intent.worker,harness:lane.harness,model:model??null,cwd:task.workspace_path};
+  if(meta.agent_profile_intent)meta.agent_profile_intent.worker={...meta.agent_profile_intent.worker,harness:lane.harness,model:model??null,cwd:workspace};
   const tail = model ? ['--model', model] : [];
   if (lane.harness === 'codex' && lane.reasoning_effort) tail.push('-c', `model_reasoning_effort=${JSON.stringify(lane.reasoning_effort)}`);
   const harness = HARNESSES[lane.harness] ? lane.harness : 'claude-code';
@@ -2685,7 +3356,7 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     else runTx(board, task.id, runId, (db) => event(db, task.id, 'agent_credentials_unkept', { machine, reason: kept.why }, runId));
   }
   // A card on this machine opens through this machine's own daemon; only another machine is reached with `--on`.
-  const base = ['open', '--new', how.program, '--detach', `--window=${window}`, ...(machine === localMachine() ? [] : ['--on', task.machine]), '--cwd', task.workspace_path, '--env', 'SUPERCODE_BOARD_PROCESS_GUARD=1',
+  const base = ['open', '--new', how.program, '--detach', `--window=${window}`, ...(machine === localMachine() ? [] : ['--on', task.machine]), '--cwd', workspace, '--env', 'SUPERCODE_BOARD_PROCESS_GUARD=1',
     ...Object.entries(meta.agent_env??{}).flatMap(([key,value])=>['--env',`${key}=${value}`])];
   // the slot's last session: kept when live, resumed when lost, never another slot's (a reviewer's is its own)
   // a close its session's own command asked for is carried out first, so its pane is gone before the slot's next
@@ -2695,16 +3366,39 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   // The slot's own last session whose close was refused for good is not waited on: it runs on, and is continued below
   // (continuationOf), never started beside.
   const last = view(board, (db) => lastSession(db, task.id, slot));
+  await readNativeHome(last);
+  // The slot's own last session, whose close a transition asked for as its run ended (a handoff the slot's next run
+  // resumes, ADR 0019) and which is still open only because it is in a turn, is working as the slot's role: this run takes
+  // it over rather than waiting for the turn to end and failing its launch window on that wait. The close is withdrawn
+  // and the ended run retains the session, so it is kept below (continuationOf) and the binding transfers it
+  // (retireSupersededRuns). An explicit start still settles the former slot first, and another agent's session or a
+  // forgotten or incident-held one is never taken over.
+  if (last?.session_id && last.pane && last.machine === machine && (last.harness ?? 'claude-code') === harness && last.close_requested
+    && !last.closed_at && !last.close_confirmed_at && !last.close_transferred_to && !last.forgotten && !last.monitor_held
+    && /^close deferred: its session \S+ is in a turn \(/.test(last.close_error ?? '') && !(meta.agent_id && otherAgent(board, last, meta))
+    && !view(board, (db) => currentRun(db, task.id)?.metadata?.supercode?.restart_authorized)) {
+    tx(board, (db) => {
+      if (!runCurrent(db, task.id, runId)) throw Object.assign(new Error(`run ${runId} of ${task.id} ended or was replaced while its launch was prepared; nothing was started`), { launchSuperseded: true });
+      for (const r of db.prepare('SELECT id, ended_at, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId)) {
+        const s = json(r.metadata, {})?.supercode;
+        if (!r.ended_at || !sameNativeSession(s, last) || s.pane !== last.pane || s.machine !== machine || (s.slot ?? 'worker') !== slot
+          || !s.close_requested || s.closed_at || s.close_confirmed_at || s.close_transferred_to || claimHolds(s.close_claim)) continue;
+        setRunSession(db, r.id, { close_requested: null, close_error: null, close_claim: null, close_unread: null, retain_after_run: true });
+        event(db, task.id, 'session_close_withdrawn', { successor: runId, session_id: s.session_id, pane: s.pane, reason: s.close_error }, r.id);
+      }
+    });
+  }
   const pending = view(board, (db) => db.prepare('SELECT id, ended_at, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId))
     .map((r) => ({ ...r, session: json(r.metadata, {})?.supercode }))
     .find((r) => (r.session?.pane || r.session?.launch_key || r.session?.surface === 'native') && !r.session.close_transferred_to && (r.session.slot ?? 'worker') === slot && (r.ended_at || r.session.close_requested) && !r.session.close_confirmed_at
       // Deliberate retention owes no close. Only this slot's latest identity may reach the liveness/continuation
       // checks below; an explicit close or another unresolved identity still holds the slot.
       && !(r.session.retain_after_run && !r.session.close_requested && !r.session.forgotten && last?.session_id
-        && r.session.session_id === last.session_id && r.session.pane === last.pane && r.session.machine === machine && (r.session.harness ?? 'claude-code') === harness)
-      && !(closeRefused(r.session) && last?.session_id && r.session.session_id === last.session_id));
+        && sameNativeSession(r.session, last) && r.session.pane === last.pane && r.session.machine === machine && (r.session.harness ?? 'claude-code') === harness)
+      && !(closeRefused(r.session) && last?.session_id && sameNativeSession(r.session, last)));
   if (pending) throw unavailable(`slot ${slot} still owns pane ${pending.session.pane} from run ${pending.id}; closure must be confirmed before another session starts: ${pending.session.close_error ?? 'close pending'}`);
   let prev = view(board, (db) => lastSession(db, task.id, slot));
+  await readNativeHome(prev);
   if (prev?.session_id && !prev.forgotten && (prev.harness ?? 'claude-code') === harness && prev.machine === machine) {
     // the round's own fleet reading: a launch never reads the fleet again
     const fresh = fleet;
@@ -2712,9 +3406,8 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     // a machine whose record is not current lists no session (continuationPane reads fleet.sessions): no continuation
     // can be ruled out there, so nothing is resumed beside one
     if (fresh.unknown?.has(normalMachine(machine))) throw unavailable(`cannot check for a manual continuation of ${prev.session_id}: machine ${machine}'s fleet record is not current: ${fresh.errors?.get(normalMachine(machine)) ?? 'no current record'}`);
-    const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
-    const listed = r.code === 0 ? json(r.stdout.trim(), null) : null;
-    if (!Array.isArray(listed)) throw unavailable(`cannot read panes before continuing ${prev.session_id}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
+    const { list: listed, error } = await paneRows(machine);
+    if (!listed) throw unavailable(`cannot read panes before continuing ${prev.session_id}: ${error}`);
     const pane = continuationPane(fresh, prev, new Set(listed.filter(p => !p.dead).map((p) => p.pane)));
     if (pane && pane !== prev.pane) prev = { ...prev, pane, close_requested: null, closed_at: null, close_confirmed_at: null, close_error: null };
     fleet = fresh;
@@ -2723,15 +3416,15 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     const report = { undelivered: [] };
     await closeRequested(board, report, { taskId: task.id });
     prev = view(board, (db) => lastSession(db, task.id, slot));
+    await readNativeHome(prev);
     // a pane that could not be closed still holds the session: no second process is started on it
     if (prev?.close_requested && !prev.closed_at) throw unavailable(`the slot's session ${prev.session_id} asked to be closed and its pane ${prev.pane} could not be: ${report.undelivered.map((u) => u[2]).join('; ') || 'no reason given'}`);
   }
   // The machine was checked before the card was claimed (launcherCheck: its board process guard and keyed launch door,
-  // from the round's fleet reading); the launch asks no door of it. Open's reply names the pane; a session named at
-  // launch (Claude Code's) is bound with it, one that names itself (Codex) is bound from a later round's fleet reading.
-  // The pane id is chosen from the launch key and recorded before open runs, so a launch whose answer is lost (a
-  // timeout, a closed stream) is still found by its pane in a later round's fleet reading, and by its session id.
+  // from the round's fleet reading). The pane id is recorded before open runs; the keyed native receipt binds
+  // every harness's session, including when open's reply is lost.
   const openOwned = async (key, sid, mode, args) => {
+    assertRunCurrent(board, task.id, runId);
     // Keeping a live pane never prepares or mutates a different route/home.
     if (harness === 'codex') {
       const profile = meta.agent_profile_intent;
@@ -2740,43 +3433,69 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
       refreshVault(orchestration, vault);
       const selected = { ...profile, name: lane.name, dir: lane.dir };
       const worker = { ...profile.worker, harness: 'codex', model: model ?? undefined };
-      let resume = null;
-      if (mode === 'resume') {
-        const rows = await readNative(machine, 'codex', sid, prev?.codex_home ?? null);
-        const paths = [...new Set(rows.filter(row => row.locator?.harness === 'codex' && row.locator?.session_id === sid
-          && row.locator.storage?.kind === 'file').map(row => row.locator.storage.path))];
-        if (paths.length !== 1) throw unavailable('the resumed Codex has no unique physical transcript source; no pane was launched');
-        resume = { source: paths[0], id: sid };
-      }
       let route;
-      if (machine === localMachine()) {
+      if (mode === 'resume') {
+        route = codexPaneRouteArguments(selected, worker, vault);
+        route.env = { ...route.env, ...nativeHome(prev).env };
+      } else if (machine === localMachine()) {
         route = codexPaneRoute(selected, worker, vault);
-        if (resume) projectCodexPaneResume(route.env.CODEX_HOME, resume.source, resume.id);
       } else {
         const prepared = await doorOn(machine, 'harness.v1.codex.pane.prepare', {
           scope: `${localMachine()}:${board.root}:${lane.name}`, machine: localMachine(),
-          cwd: task.workspace_path,
-          ...codexPaneInputs(selected, worker, vault), ...(resume ? { resume } : {}),
+          cwd: workspace,
+          ...codexPaneInputs(selected, worker, vault),
         }, { timeout: 30_000, as: boardAddress(board.label) });
         route = prepared.code === 0 ? json(prepared.stdout.trim(), null) : null;
         if (!route?.env?.CODEX_HOME || !Array.isArray(route.args))
           throw unavailable(`the destination did not prepare the login-free Codex route: ${prepared.stderr.trim() || 'invalid route receipt'}`);
       }
       meta.codex_home = route.env.CODEX_HOME;
+      meta.native_home = mode === 'resume' ? nativeHome(prev) : null;
       const separator = args.indexOf('--');
       if (separator < 0) throw unavailable('the headful Codex launch has no native argument boundary');
       args = [...args.slice(0, separator), ...Object.entries(route.env).flatMap(([name, value]) => ['--env', `${name}=${value}`]),
         ...args.slice(separator), ...route.args];
-      if (machine === localMachine()) declareWorkerHome({ harness: 'codex', env: route.env, cwd: task.workspace_path });
+      if (machine === localMachine()) declareWorkerHome({ harness: 'codex', env: route.env, cwd: workspace });
+    }
+    if (mode === 'resume' && harness !== 'codex') {
+      meta.native_home = nativeHome(prev);
+      const separator = args.indexOf('--');
+      args = [...args.slice(0, separator), ...Object.entries(meta.native_home.env).flatMap(([name, value]) => ['--env', `${name}=${value}`]), ...args.slice(separator)];
     }
     const chosen = `p_${createHash('sha256').update(key).digest('hex').slice(0, 16)}`;
     tx(board, (db) => {
       if (!runCurrent(db, task.id, runId)) throw Object.assign(new Error(`run ${runId} of ${task.id} ended or was replaced while its launch was prepared; nothing was started`), { launchSuperseded: true });
+      if (getTask(db, task.id)?.backlog) throw superseded(task.id, runId);
+      const currentDecision = continuationDecision(board, getTask(db, task.id), runId, slot, lane, meta.role ?? slot, meta.agent_id);
+      if (mode === 'fresh' && currentDecision.prior) {
+        if (!currentDecision.authorization) throw continuationRefusal(currentDecision.prior, 'no current replacement decision was retained');
+        requireReplacementTeardown(db, task.id, slot, runId);
+        issueReplacement(db, task.id, slot, currentDecision.authorization, { run: runId, key, session: sid, harness,
+          cardMachine: getTask(db, task.id).machine, agent: meta.agent_id, assignment: currentDecision.assignment });
+      }
       setRunSession(db, runId, { ...meta, surface: 'pane', machine, harness, slot,
         session_id: sid, mode, launch_key: key, pane: chosen, launch_pending: true, launched_at: now() });
     });
     const result = await sc([...args.slice(0, args.indexOf('--key')), '--pane', chosen, ...args.slice(args.indexOf('--key'))], { timeout: 180_000, as: boardAddress(board.label) });
-    const pane = lastJson(result.stdout)?.pane ?? chosen;
+    const reply = lastJson(result.stdout), pane = reply?.pane ?? chosen;
+    // Every launch records its native home before its session is bound, local or remote: a reply that omits it (a
+    // remote or recovered answer) is completed from the machine's own launch receipt, which the daemon recorded with
+    // the home before it created the session.
+    const launchedHome = reply?.native_home
+      ?? (await launchReceipt(board, { machine, launch_key: key }, 10_000).catch(() => null))?.native_home ?? null;
+    const changedHome = launchedHome && tx(board, db => {
+      const saved = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runId)?.metadata, {})?.supercode;
+      if (nativeHome(saved) && JSON.stringify(nativeHome(saved).homes) !== JSON.stringify(launchedHome.homes)) {
+        requestSessionClose(db, task.id, { runId });
+        return true;
+      }
+      setRunSession(db, runId, { native_home: launchedHome });
+      return false;
+    });
+    if (changedHome) {
+      try { await stopSession(board, { surface: 'pane', machine, harness, pane, session_id: sid, launch_key: key }); } catch { /* retained close request retries */ }
+      throw unavailable(`launch ${key} returned a different native home; continuation was not bound`);
+    }
     // the run ended while its pane opened: the pane it opened is closed, never left working for an ended run
     if (!view(board, (db) => runCurrent(db, task.id, runId))) {
       try { await stopSession(board, { surface: 'pane', machine, harness, pane, session_id: sid, launch_key: key }); } catch { /* the slot's next launch settles it */ }
@@ -2786,12 +3505,8 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
       const before = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runId)?.metadata, {})?.supercode ?? {};
       setRunSession(db, runId, { ...before, pane });
     });
-    if (pane && sid && result.code === 0) {
-      return { surface: 'pane', session_id: sid, machine, harness, pane, mode, launch_key: key,
-        launch_pending: false, launch_error: null, launched_at: now() };
-    }
-    const reason = result.code === 0 ? `launch ${key} opened pane ${pane}; its ${harness} session is bound from the fleet reading` :
-      `launch ${key} (pane ${pane}) gave no answer; it is bound from the fleet reading if it opened: ${(result.stderr || result.stdout).trim().slice(-300)}`;
+    const reason = result.code === 0 ? `launch ${key} opened pane ${pane}; its ${harness} session awaits its native launch receipt` :
+      `launch ${key} (pane ${pane}) gave no answer; its native launch receipt will reconcile it: ${(result.stderr || result.stdout).trim().slice(-300)}`;
     tx(board, (db) => {
       if (!runCurrent(db, task.id, runId)) return;
       setRunSession(db, runId, { launch_pending: true, launch_error: reason });
@@ -2800,105 +3515,55 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     throw Object.assign(new Error(reason), { launchPending: true });
   };
   let session = null;
-  let replaced = null, predecessor = null;
-  // A session in no pane is read on its machine before anything replaces it. One the board released (an adopted
-  // session it did not launch, left running at its run's end) is never resumed beside itself: while it runs it is kept,
-  // and the card's next run is delivered into it, as into any kept session.
-  if (prev?.surface === 'native' && !prev.pane && (!prev.close_confirmed_at || prev.released)) {
-    const reading = nativeReading(await readNative(prev.machine, prev.harness, prev.session_id, prev.codex_home ?? null), prev);
-    if (reading.alive == null) throw unavailable(`cannot establish native continuation liveness for ${addressOf(prev)}`);
-    fleet.native ??= new Map(); fleet.native.set(addressOf(prev), reading);
-    if (reading.alive && !prev.released && (prev.closed_at || prev.close_requested || prev.forgotten)) throw unavailable(`native session ${addressOf(prev)} is still live; its close must finish before replacement`);
-  }
-  // A forgotten session the board released (an adopted one, left running) is still the arc's while it runs: only the
-  // manager's explicit replace_session lets a live one go. Every other forget (a retarget recorded before openCoder kept
-  // the coder) leaves it kept below, as any released session is, and the run is delivered into it; never a fresh
-  // implementer beside it (VO-3755 t_c2d5d21b run 2736). One that is gone is replaced as before.
-  const liveForgotten = prev?.forgotten && prev.released && prev.machine === machine && (prev.harness ?? 'claude-code') === harness
-    && !view(board, (db) => Number(latestEvent(db, task.id, ['session_forgotten'], 'created_at')?.created_at ?? 0) >= Number(prev.forgotten))
-    && (prev.pane ? await panePresent(prev.machine, prev.pane) : sessionAlive(fleet, prev)) === true;
-  if (prev?.forgotten && !liveForgotten) {
-    if (!prev.close_confirmed_at && prev.pane && await panePresent(prev.machine, prev.pane)) throw new Error(`forgotten session ${prev.session_id} still has live pane ${prev.pane}; close it before replacement`);
-    replaced = { session_id: prev.session_id, why: 'the workflow let it go' };
-  }
-  else if (prev && meta.agent_id && (predecessor = otherAgent(board, prev, meta))) {
-    // A session is continued only as the agent it belongs to: the daemon refuses any other ("session … is agent …'s;
-    // nothing resumes it as agent …"), and keeping it would deliver this run into another agent's session. A card's role
-    // agent ends with the card (finishCardAgentAssignment) and an ended agent is never started again (agents.mjs
-    // localAgent: the key's next generation is minted in its place, with fresh memory), so a reopened card's run is a new
-    // agent, as is one the manager reassigned to another agent. Its predecessor's session is let go and the run starts
-    // fresh from the card's text and thread, as a lane of another harness does (VO-2858 t_cc590655: reopened at 22:57Z on
-    // 2026-10-17, runs 1545 and 1546 ended spawn_failed resuming codex 01a14bac, agent_21e274c9's, as agent_00246aaa).
-    // Nothing is closed here: every ended run's pane was confirmed closed above (`pending`), so a session still open at
-    // this point is one the board does not close (a close refused for good, which runs on; a pane a person continued by
-    // hand, swapped in above), and is released as an adopted one is (closeRequested), never closed. The release is
-    // written to the runs that hold it before the fresh session starts, so the slot's next launch, which reads the fresh
-    // session as the slot's last, finds no pane of them still owed a close (`pending`); a Codex launch binds from a later
-    // round's reading, so the release cannot wait for this launch's own record.
-    tx(board, (db) => {
-      if (!runCurrent(db, task.id, runId)) throw Object.assign(new Error(`run ${runId} of ${task.id} ended or was replaced while its launch was prepared; nothing was started`), { launchSuperseded: true });
-      for (const r of db.prepare('SELECT id, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId)) {
-        const held = json(r.metadata, {})?.supercode;
-        if (held?.session_id !== prev.session_id || (held.slot ?? 'worker') !== slot || held.close_confirmed_at || held.close_transferred_to) continue;
-        const at = now();
-        setRunSession(db, r.id, { ...held, close_requested: held.close_requested ?? at, closed_at: held.closed_at ?? at, close_confirmed_at: at, close_error: null, released: true });
-        event(db, task.id, 'session_released', { session_id: held.session_id, pane: held.pane ?? null, machine: held.machine ?? null, reason: `it is agent ${predecessor}'s; run ${runId} is agent ${meta.agent_id}'s and starts fresh, and it is left running` }, r.id);
-      }
-    });
-    replaced = { session_id: prev.session_id, why: `it is agent ${predecessor}'s, and this run is agent ${meta.agent_id}'s`, letGo: true };
-  }
-  else if (prev && (prev.harness ?? 'claude-code') !== harness) {
-    // the card was reassigned to a lane of another harness: that harness starts it fresh (the card's text and thread
-    // are its context), and the last session, if still open, is closed so two harnesses never work one card
-    if (prev.pane && !prev.closed_at && !adoptedOnly(prev)) await stopSession(board, prev); // an adopted session is released, never closed
-    replaced = { session_id: prev.session_id, why: `the card's lane runs ${harness}, not ${prev.harness ?? 'claude-code'}`, letGo: true };
-  } else if (prev && prev.machine === machine) {
-    // a session the board closed, or one whose close its own command asked for (the next tick's sweep closes that
-    // run's pane), is not kept, whatever a fleet reading taken before the close still lists
-    const next = continuationOf(prev, prev.pane ? await panePresent(prev.machine, prev.pane) : sessionAlive(fleet, prev));
-    if (next === 'refuse') throw new Error(`session ${prev.session_id} still has live pane ${prev.pane}; cannot resume or replace it`);
+  const decision = continuationDecision(board, getTaskNow(board, task.id), runId, slot, lane, meta.role ?? slot, meta.agent_id);
+  if (!prev && decision.prior) prev = decision.prior.session;
+  await readNativeHome(prev);
+  let replaced = null;
+  if (decision.authorization) {
+    view(board, db => requireReplacementTeardown(db, task.id, slot, runId));
+    replaced = { session_id: decision.prior.session.session_id ?? null, why: decision.authorization.reason,
+      authorization: decision.authorization.id, source: decision.authorization.source };
+  } else if (prev) {
+    if (!prev.session_id) throw continuationRefusal(decision.prior, 'the previous launch never supplied a native conversation id');
+    if (meta.agent_id && otherAgent(board, prev, meta)) throw continuationRefusal(decision.prior, 'the conversation belongs to another agent');
+    // A released adopted instance is still kept while alive. An unread native result is never absence.
+    if (prev.surface === 'native' && !prev.pane && (!prev.close_confirmed_at || prev.released)) {
+      const reading = nativeReading(await readNative(prev.machine, prev.harness, prev.session_id, nativeHomes(prev)), prev);
+      if (reading.alive == null) throw unavailable(`cannot establish native continuation liveness for ${addressOf(prev)}`);
+      if (reading.alive && !prev.released && (prev.closed_at || prev.close_requested))
+        throw unavailable(`native session ${addressOf(prev)} is still live; its close must finish before continuation`);
+    }
+    await readBefore(fleet, prev);
+    const alive = sessionAlive(fleet, prev);
+    if (alive == null) throw unavailable(`cannot establish continuation liveness for ${addressOf(prev)}`);
+    if (alive && prev.pane && !fleetSessionRows(fleet, prev).some(row => row.pane === prev.pane))
+      throw unavailable(`pane ${prev.pane} has no verified binding to ${addressOf(prev)} in its native home`);
+    const next = continuationOf(prev, alive);
+    if (next === 'wait') throw unavailable(`pane ${prev.pane} of ${addressOf(prev)} is still live; its close must be confirmed before continuation`);
+    // the round's reading predates a close confirmed since: the pane door, read now, decides (ADR 0003)
+    if (next === 'closed' && await panePresent(prev.machine, prev.pane))
+      throw continuationRefusal(decision.prior, `its pane ${prev.pane} is still live after its close was confirmed`);
     if (next === 'keep') {
-      // the session is kept; the heartbeat's count belongs to the run that ended, so the new run starts it again
-      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_since: _is, idle_notice: _in, unknown_since: _us, unknown_notice: _un, work_progress: _wp, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, close_failed_at: _cf, close_unread: _cu, close_claim: _cl, monitor_held: _mh, released: _rl, review_held: _rh, retain_after_run: _rr, handed_back_from: _hf, handed_back_run: _hr, forgotten: _fg, resumable: _rs, ...kept } = prev;
-      session = { ...kept, mode: 'adopt', launched_at: now(), seen_at: now() };
-      // The common binding below transfers ownership and subscriptions before filing the continuation prompt.
-    } else if (prev.resumable !== false && await nativeAbsent(prev)) {
-      // its transcript is gone (never written, or removed): nothing to resume and no context to keep, so the slot's next
-      // session starts fresh, and the run's session_replaced event says why
-      replaced = { session_id: prev.session_id, why: `its transcript is gone: ${prev.machine}'s complete ${prev.harness ?? 'claude-code'} discovery lists no session of that id`, letGo: true };
-    } else if (prev.resumable !== false) {
+      const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_since: _is, idle_notice: _in, unknown_since: _us, unknown_notice: _un, work_progress: _wp, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, close_failed_at: _cf, close_unread: _cu, close_claim: _cl, monitor_held: _mh, released: _rl, review_held: _rh, retain_after_run: _rr, handed_back_from: _hf, handed_back_run: _hr, forgotten: _fg, resumable: _rs, replacement_authorization: _ra, ...kept } = prev;
+      session = { ...kept, native_home: nativeHome(prev), mode: 'adopt', launched_at: now(), seen_at: now() };
+    } else {
+      nativeHomes(prev);
       const authorization = view(board, db => currentRun(db,task.id)?.metadata?.supercode?.restart_authorized);
-      const released = view(board,db=>{
-        const last = latestEvent(db, task.id, ['dispatch_held', 'dispatch_released', 'restart_authorization_consumed'], 'id,kind');
-        return last?.kind === 'dispatch_released';
-      });
-      // Only a session whose run ended in a monitored incident waits for its manager or creator; one a workflow
-      // transition closed (a reviewer after its verdict, an implementer whose card came back) is the slot's deliberate
-      // handoff, resumed for the slot's next run: a card has one session per slot, and every round of that slot runs in
-      // it with the context of the rounds before
-      if (monitorsRuns(workflowFor(board.root)) && prev.monitor_held && !authorization && !released) throw new Error(`session ${prev.session_id} is stopped by incident ${prev.incident ?? 'unknown'}; only its manager or creator may restart it with workflow start`);
-      // a resumed session is told what this run is for, as a kept one is: the run's own prompt (a reviewer resumed for
-      // its next round gets that round's brief and PR heads), not only that it was resumed
-      const told = input ? `The board resumed this session for this run of card ${task.id}. ${input}` : `The board resumed this session after it was lost; you are still on card ${task.id}: ${task.title}. Carry on.`;
-      // a session is resumed in its own harness, whatever the lane's is now
-      const its = HARNESSES[prev.harness ?? 'claude-code'] ?? HARNESSES['claude-code'];
+      const released = view(board,db => latestEvent(db, task.id, ['dispatch_held', 'dispatch_released', 'restart_authorization_consumed'], 'id,kind')?.kind === 'dispatch_released');
+      if (monitorsRuns(workflowFor(board.root)) && prev.monitor_held && !authorization && !released)
+        throw continuationRefusal(decision.prior, `incident ${prev.incident ?? 'unknown'} still needs its manager's restart decision`);
+      const told = input ? `The board resumed this session for this run of card ${task.id}. ${input}` : `The board resumed this session after it stopped; you are still on card ${task.id}: ${task.title}. Carry on.`;
+      const its = HARNESSES[prev.harness ?? 'claude-code'];
+      if (!its?.resume) throw continuationRefusal(decision.prior, 'its harness publishes no native resume door');
       const launchKey = `board-${task.id}-r${runId}-resume`;
       session = await openOwned(launchKey, prev.session_id, 'resume', ['open', '--new', its.program, ...base.slice(3),
         '--key', launchKey, '--input', told, '--', ...its.resume(prev.session_id), ...tail]);
-    } else replaced = { session_id: prev.session_id, why: 'its resume never came up',
-      letGo: recoversRuns(workflowFor(board.root)) && Boolean(prev.resume_failed_before_live) && Boolean(prev.close_confirmed_at) };
-  } else if (prev) replaced = { session_id: prev.session_id, why: `the card moved from ${prev.machine} to ${machine}` };
-  // a card keeps its context: a slot's session that cannot be kept or resumed stops the launch, and only a session the
-  // workflow let go (`forget_session`), its manager did (a reassignment to another harness's lane), or that belongs to
-  // another agent than the run's (otherAgent) is replaced
-  if (replaced && !prev?.forgotten && !replaced.letGo) {
-    const failed = new Error(`session ${replaced.session_id} (${slot}) could not be continued: ${replaced.why}. The board keeps a card's context and starts a new session only when the workflow lets this one go`);
-    failed.resumeFailed = { session_id: replaced.session_id, slot, why: replaced.why };
-    throw failed;
+    }
   }
   if (!session) {
-    const sid = how.namesItself ? null : randomUUID();
-    const launchKey = `board-${task.id}-r${runId}-${(sid ?? randomUUID()).slice(0,8)}`;
+    const issued = decision.authorization?.issued;
+    const sid = issued ? issued.session : how.namesItself ? null : randomUUID();
+    const launchKey = issued?.key ?? `board-${task.id}-r${runId}-${(sid ?? randomUUID()).slice(0,8)}`;
     // A fresh session is named for its card by its readable id (`voice-calls-3f`; a reviewer's `voice-calls-reviewer-3f`),
     // else its handle (`vo-856-3f`), where its harness takes a name, with the start of its id after it as the name's own
     // suffix; a kept or resumed session keeps its name.
@@ -2917,13 +3582,14 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
   const kind = { adopt: 'session_adopted', resume: 'session_resumed', fresh: replaced ? 'session_replaced' : 'session_started' }[session.mode];
   const recorded = tx(board, (db) => {
     const row = db.prepare('SELECT ended_at, metadata FROM task_runs WHERE id = ?').get(runId);
-    if (row?.ended_at || getTask(db, task.id)?.current_run_id !== runId) {
+    if (row?.ended_at || getTask(db, task.id)?.current_run_id !== runId || getTask(db, task.id)?.backlog) {
       requestSessionClose(db, task.id, { runId });
       return false;
     }
+    continuationDecision(board, getTask(db, task.id), runId, slot, lane, meta.role ?? slot, meta.agent_id);
     // this session recorded on the run already (by a binding that got here first) is said once
     const saved = json(row?.metadata, {})?.supercode;
-    if (saved?.address === session.address && !saved.launch_pending) return true;
+    if (sameNativeSession(saved, session) && !saved.launch_pending) return true;
     setRunSession(db, runId, session);
     transferRetainedSession(db, task.id, runId, session);
     event(db, task.id, kind, { session_id: session.session_id, machine, pane: session.pane, address: session.address, mode: session.mode, ...(replaced ? { replaced } : {}) }, runId);
@@ -2937,9 +3603,11 @@ async function launchPane(board, task, runId, lane, fleet, { input = null, slot
     return true;
   });
   if (!recorded) return { ...session, mode: 'finished_during_launch' };
+  // A kept session takes this run's input as the run's instruction, as a launched or resumed one takes it as its first
+  // prompt: never as a notice, which its harness reads as no instruction.
   if (session.mode === 'adopt' && input) {
     assertRunCurrent(board, task.id, runId);
-    await fileMail(board, session.address, input, `board-run-${task.id}-r${runId}`);
+    await fileMail(board, session.address, input, `board-run-${task.id}-r${runId}`, { as: 'instruction' });
   }
   return session;
 }
@@ -2951,7 +3619,7 @@ function transferRetainedSession(db, id, runId, session) {
   for (const row of db.prepare('SELECT id,metadata FROM task_runs WHERE task_id=? AND id<? AND ended_at IS NOT NULL').all(id, runId)) {
     const old = json(row.metadata, {})?.supercode;
     if (!old?.retain_after_run || old.close_requested || old.close_confirmed_at || old.close_transferred_to || old.forgotten
-      || old.session_id !== session.session_id || old.machine !== session.machine || (old.slot ?? 'worker') !== (session.slot ?? 'worker')) continue;
+      || !sameNativeSession(old, session) || (old.slot ?? 'worker') !== (session.slot ?? 'worker')) continue;
     setRunSession(db, row.id, { close_transferred_to: runId });
     event(db, id, 'session_transferred', { successor: runId, session_id: old.session_id, pane: old.pane ?? null }, row.id);
   }
@@ -2969,36 +3637,76 @@ function otherAgent(board, prev, meta) {
 
 /**
  * What a slot's last session on the card's machine is to the card's next run, given whether it is live (its pane, else
- * its native process): an open session that is live is kept, and the run is delivered into it; a live pane holding a
- * session the board closed refuses the launch; anything else is resumed. A released session is open: its release only
- * freed the slot, and the session was left running. So is one whose close the machine refused for good.
+ * its native process): an open session that is live is kept, and the run is delivered into it; a live pane whose close
+ * is requested and not yet confirmed waits for it ('wait'); a live pane whose close was confirmed is judged by its
+ * machine's pane door read after that close ('closed'), since the reading it was found live in may predate it; anything
+ * else is resumed. A released session is open: its release only freed the slot, and the session was left running. So is
+ * one whose close the machine refused for good.
  */
 export function continuationOf(prev, live) {
   const open = Boolean(prev.released) || closeRefused(prev) || (!prev.closed_at && !prev.close_requested);
   if (open) return live ? 'keep' : 'resume';
-  return live && prev.pane ? 'refuse' : 'resume';
+  if (!live || !prev.pane) return 'resume';
+  return prev.close_confirmed_at ? 'closed' : 'wait';
+}
+
+/** The live panes on `machine` working at or under folder `path`, read from the machine now (a closing card's worktree
+ *  is retired only when none is: engine cleanupWorkspace). `also` names the same folder as its machine resolved it (its
+ *  links followed there), so a pane whose directory reads resolved still matches. Throws when the machine could not be
+ *  read. */
+export async function panesUnder(machine, path, also = []) {
+  const r = await doorOn(machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
+  const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
+  if (!Array.isArray(panes)) throw new Error(`cannot read the panes on ${normalMachine(machine ?? localMachine())}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
+  const local = normalMachine(machine ?? localMachine()) === localMachine();
+  const real = (at) => { if (local) { try { return realpathSync(at); } catch { /* read as written */ } } return String(at).replace(/\/+$/, ''); };
+  const roots = [...new Set([path, ...also].filter(Boolean).map(real))];
+  return panes.filter((p) => !p.dead && typeof p.cwd === 'string' && p.cwd && roots.some((root) => real(p.cwd) === root || real(p.cwd).startsWith(`${root}/`))).map((p) => p.pane);
+}
+
+/** Whether a card session whose record never said it closed (held after its run, monitored, or closed by hand outside
+ *  the board) is gone, as its machine reads it now: its pane not live there, and its process not running (a headless
+ *  worker's pid on this machine; a native session's own activity reading, `persisted` and not `running`). Anything not
+ *  read, or read alive, is not gone. */
+export async function sessionGone(session) {
+  await readNativeHome(session);
+  const machine = session?.machine ?? localMachine();
+  if (session?.launch_pending) return false;
+  if (session?.surface === 'headless' && session.pid) return normalMachine(machine) === localMachine() && !pidAlive(session.pid);
+  if (session?.pane) {
+    const r = await doorOn(machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
+    const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
+    if (!Array.isArray(panes) || panes.some((p) => p.pane === session.pane && !p.dead)) return false;
+  }
+  if (session?.session_id) {
+    const harness = session.harness ?? 'claude-code';
+    try {
+      const { sessions } = await discoverNative(machine, harness, session.session_id, nativeHomes(session), { activity: true });
+      const reading = nativeReading(sessions, { ...session, harness });
+      return reading.alive === false;
+    } catch { return false; }
+  }
+  return Boolean(session?.pane);
 }
 
 /** A machine reading, not a missing catalog entry, establishes whether a pane is alive. */
 async function panePresent(machine, pane) {
-  const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
+  // a liveness decision about one pane (a resume, a replacement, a launch that must have survived) asks the daemon now:
+  // the held record (paneRows) lags the host by its cycle, and a pane the board itself closed this round still reads
+  // live there, which refused the resume of a timed-out card twice and gave the card up
+  const r = await doorOn(machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
   const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
   if (!Array.isArray(panes)) throw unavailable(`cannot establish pane ${pane} liveness on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
   return panes.some((p) => p.pane === pane && !p.dead);
 }
 
-/** Whether a pane just launched is still there after the harness had a moment to start. */
-async function paneSurvives(machine, pane) {
-  // a timer, never a blocking wait: the owner answers verbs while the harness starts
-  await new Promise((resolve) => setTimeout(resolve, 6000));
-  return await panePresent(machine, pane);
-}
-
 /** Hermes's own worker argv and task environment, run on this machine; watched by its pid. */
-async function launchHeadless(board, task, runId, lane, settings, { prompt = null, skills: runSkills = [], meta = {} } = {}) {
-  const workspace = await resolveLocalWorkspace(board, task);
+async function launchHeadless(board, task, runId, lane, settings, { prompt = null, skills: runSkills = [], meta = {}, workspaceOptions } = {}) {
+  const workspace = await prepareRunWorkspace(board, task, runId, meta, workspaceOptions);
+  assertRunCurrent(board, task.id, runId);
+  await closeRequested(board, { undelivered: [] }, { taskId: task.id });
+  assertRunCurrent(board, task.id, runId);
   if(meta.agent_profile_intent)meta.agent_profile_intent.worker={...meta.agent_profile_intent.worker,harness:lane.harness,model:task.model_override??lane.model??null,cwd:workspace};
-  runTx(board, task.id, runId, (db) => db.prepare('UPDATE tasks SET workspace_path=?,branch_name=COALESCE(branch_name,?) WHERE id=?').run(workspace, task.workspace_kind === 'worktree' ? `wt/${task.id}` : null, task.id));
   // the card's own skills and the ones its status's run names (a reviewer's, for one)
   const skills = [...new Set([...task.skills, ...runSkills])];
   const args = ['-p', lane.name, '--cli', '--accept-hooks', ...skills.flatMap((s) => ['--skills', s]),
@@ -3008,40 +3716,99 @@ async function launchHeadless(board, task, runId, lane, settings, { prompt = nul
   mkdirSync(logDir, { recursive: true });
   const logFile = join(logDir, `${task.id}.log`);
   rotateLog(logFile, settings.logRotateBytes, settings.logBackups);
-  const out = openSync(logFile, 'a');
   const exitFile = join(logDir, `${task.id}.r${runId}.exit`);
+  await readNativeHome(view(board, db => lastSession(db, task.id, meta.slot)));
   // the launch's secret, given to this worker alone: the run keeps its hash, and the worker's session record must name it
   const launchSecret = randomUUID() + randomUUID();
+  const session = tx(board, db => {
+    assertRunCurrent(board, task.id, runId);
+    const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runId)?.metadata, {})?.supercode;
+    if (current?.launch_key || current?.pid) throw continuationRefusal({ run: runId, session: current }, 'this attempt already issued its headless worker; its retained launch must be reconciled');
+    const decision = continuationDecision(board, getTask(db, task.id), runId, meta.slot, lane, meta.role ?? meta.slot, meta.agent_id);
+    if (decision.authorization) requireReplacementTeardown(db, task.id, meta.slot, runId);
+    else if (decision.prior) {
+      const previous = decision.prior.session;
+      nativeHomes(previous);
+      // a close under way is waited for; only one that is not, or was refused for good, needs the manager (ADR 0003)
+      const closing = previous.close_requested && !previous.close_confirmed_at && !closeRefused(previous);
+      if (previous.surface === 'headless' && previous.pid && pidAlive(previous.pid))
+        throw closing ? unavailable(`its previous headless worker ${previous.pid} is still closing; its close must finish before headless resume`)
+          : continuationRefusal(decision.prior, 'its previous headless worker is still present');
+      if (previous.surface !== 'headless' && !previous.close_confirmed_at && !previous.close_transferred_to)
+        throw closing ? unavailable(`its previous execution ${addressOf(previous) ?? previous.pane ?? previous.launch_key} is still closing; its close must be confirmed before headless resume`)
+          : continuationRefusal(decision.prior, 'its previous execution has no confirmed close before headless resume');
+    }
+    const launchKey = randomUUID();
+    if (decision.authorization) issueReplacement(db, task.id, meta.slot, decision.authorization, { run: runId,
+      key: launchKey, session: null, harness: lane.harness, cardMachine: task.machine, agent: meta.agent_id, assignment: decision.assignment });
+    const prepared = { ...meta, surface: 'headless', harness: lane.harness,
+      ...(decision.prior && !decision.authorization ? { native_home: nativeHome(decision.prior.session) } : {}),
+      machine: executionHost(lane, task.machine, localMachine(), normalMachine), mode: decision.prior && !decision.authorization ? 'resume' : 'fresh',
+      session_id: decision.prior && !decision.authorization ? decision.prior.session.session_id : null,
+      launch_key: launchKey, launch_pending: false, launched_at: now(), exit_file: exitFile,
+      continuation_failure_file: `${exitFile}.continuation`,
+      launch_secret: createHash('sha256').update(launchSecret).digest('hex'),
+      replacement_authorization_id: decision.authorization?.id ?? null };
+    setRunSession(db, runId, prepared);
+    return prepared;
+  });
+  const out = openSync(logFile, 'a');
   // the worker runs under a shell that records its exit code, so a later tick can tell a clean exit from a crash
-  const child = spawnChild('/bin/sh', ['-c', '"$0" "$@"; echo $? > "$SUPERCODE_BOARD_EXIT_FILE"', process.execPath, WORKER, ...args], {
+  let child;
+  try { child = spawnChild('/bin/sh', ['-c', '"$0" "$@"; echo $? > "$SUPERCODE_BOARD_EXIT_FILE"', process.execPath, WORKER, ...args], {
     cwd: workspace, detached: true, stdio: ['ignore', out, out],
     env: {
-      SUPERCODE_BOARD_EXIT_FILE: exitFile,
       ...(task.goal_mode ? { HERMES_KANBAN_GOAL_MODE: '1', ...(task.goal_max_turns ? { HERMES_KANBAN_GOAL_MAX_TURNS: String(task.goal_max_turns) } : {}) } : {}),
       ...process.env, ...meta.agent_env, SUPERCODE_ORCHESTRATOR_HOME: board.root, HERMES_HOME: meta.agent_env?.HERMES_HOME??lane.dir, HERMES_PROFILE: lane.name, HERMES_KANBAN_TASK: task.id, HERMES_KANBAN_WORKSPACE: workspace,
+      SUPERCODE_BOARD_EXIT_FILE: exitFile, SUPERCODE_BOARD_FAILURE_FILE: session.continuation_failure_file,
       HERMES_KANBAN_RUN_ID: String(runId), SUPERCODE_RUN_LAUNCH: launchSecret, HERMES_KANBAN_DB: board.path, HERMES_KANBAN_BOARD: board.slug, HERMES_SESSION_SOURCE: 'kanban',
       HERMES_KANBAN_CLAIM_LOCK: claimer(), ...(prompt ? { SUPERCODE_BOARD_PROMPT: prompt } : {}), ...(task.tenant ? { HERMES_TENANT: task.tenant } : {}),
       ...(task.branch_name ? { HERMES_KANBAN_BRANCH: task.branch_name } : {}),
+      SUPERCODE_BOARD_RESUME_SESSION: session.mode === 'resume' ? session.session_id : '',
+      SUPERCODE_BOARD_NATIVE_HOME: session.mode === 'resume' ? JSON.stringify(session.native_home) : '',
     },
-  });
+  }); } finally { closeSync(out); }
+  child.once('error', error => tx(board, db => setRunSession(db, runId, { launch_error: `spawning headless worker: ${error.message}` })));
   child.unref();
-  const session = { surface: 'headless', pid: child.pid, machine: executionHost(lane, task.machine, localMachine(), normalMachine), mode: 'fresh', launched_at: now(), exit_file: exitFile, launch_secret: createHash('sha256').update(launchSecret).digest('hex'), ...meta };
+  session.pid = child.pid;
+  // Keep the physical process reference even when a concurrent manager act invalidated this attempt.
+  tx(board, db => setRunSession(db, runId, { pid: child.pid }));
   // recorded against this run only while it is still the card's current one; a run ended meanwhile gets no worker
+  let refused;
   const recorded = tx(board, (db) => {
-    if (!runCurrent(db, task.id, runId)) return false;
+    if (!runCurrent(db, task.id, runId) || getTask(db, task.id)?.backlog) return false;
+    try { continuationDecision(board, getTask(db, task.id), runId, meta.slot, lane, meta.role ?? meta.slot, meta.agent_id); }
+    catch (error) { refused = error; return false; }
     db.prepare('UPDATE tasks SET worker_pid = ? WHERE id = ? AND current_run_id = ?').run(child.pid, task.id, runId);
     db.prepare('UPDATE task_runs SET worker_pid = ? WHERE id = ?').run(child.pid, runId);
-    setRunSession(db, runId, session);
     event(db, task.id, 'spawned', { pid: child.pid }, runId);
     return true;
   });
   if (!recorded) {
-    try { process.kill(-child.pid, 'SIGTERM'); } catch { try { process.kill(child.pid, 'SIGTERM'); } catch { /* already gone */ } }
+    try { stopWorkChild(child, () => process.kill(-child.pid, 'SIGTERM'), { signal: 'SIGTERM' }); } catch { try { stopWorkChild(child, () => process.kill(child.pid, 'SIGTERM'), { signal: 'SIGTERM' }); } catch { /* already gone */ } }
+    if (refused) throw refused;
     throw Object.assign(new Error(`run ${runId} of ${task.id} ended while its worker started; the worker was stopped`), { launchSuperseded: true });
   }
   return session;
 }
 
+/** The worker's native identity is bound only while this exact role/configuration still owns its launch. */
+export function assertHeadlessBinding(board, taskId, runId, harness, sessionId) {
+  assertRunCurrent(board, taskId, runId);
+  const task = getTaskNow(board, taskId), entry = workflowFor(board.root);
+  const session = currentRun(board.db, taskId)?.metadata?.supercode;
+  const spec = runSpec(entry, statusOf(board.db, task), task);
+  const scope = scopeOf(board.db, board, task, { params: entry.params });
+  const profile = spec ? evaluate(entry.workflow.roles?.[spec.role] ?? 'card.assignee', scope) : null;
+  const lane = lanesOf(entry.profiles)[profile];
+  if (!lane || lane.harness !== harness || session?.harness !== harness) throw continuationRefusal({ run: runId, session }, 'the worker harness/configuration changed before native binding');
+  const decision = continuationDecision(board, task, runId, session.slot ?? 'worker', lane, session.role ?? spec?.role ?? 'implementer', session.agent_id);
+  if (decision.prior && !decision.authorization && sessionId !== decision.prior.session.session_id)
+    throw continuationRefusal(decision.prior, 'the native resume door returned a different conversation id');
+  if (decision.authorization && decision.authorization.issued?.key !== session.launch_key)
+    throw continuationRefusal(decision.prior, 'the native binding belongs to a different replacement issuance');
+}
+
 /** Hermes's worker log rotation: past `max` bytes the log moves to `.1` (… `.n`), the oldest dropped. */
 function rotateLog(file, max, backups) {
   try {
@@ -3052,19 +3819,48 @@ function rotateLog(file, max, backups) {
   } catch { /* a log that cannot rotate keeps growing */ }
 }
 
-/** A headless card's directory on this machine, made as Hermes makes it (scratch, dir, or a git worktree). */
-async function resolveLocalWorkspace(board, task) {
+/** Select the slot's native launch directory before both admission and launch, without consulting the author's branch. */
+async function workspaceForRun(board, task, { role, slot, lane, runId = null }) {
+  if (role !== 'reviewer' || task.workspace_kind !== 'worktree') return { role };
+  const decision = continuationDecision(board, task, runId, slot, lane, role);
+  const previous = decision.authorization ? null : decision.prior?.session;
+  let cwd = previous?.cwd ?? previous?.agent_profile_intent?.worker?.cwd ?? null;
+  if (previous && !cwd) {
+    await readNativeHome(previous);
+    cwd = nativeReading(await readNative(previous.machine, previous.harness ?? 'claude-code', previous.session_id, nativeHomes(previous)), previous).row?.cwd;
+    if (!cwd) throw unavailable(`reviewer session ${addressOf(previous)} has no readable launch directory; its continuation waits for its native cwd`);
+  }
+  const reviewWorkspace = view(board, db => reviewWorkspaces(db, task.id)).find(row =>
+    row.slot === slot && normalMachine(row.machine ?? localMachine()) === normalMachine(task.machine ?? localMachine()) && row.repository === task.workspace_anchor) ?? null;
+  return { role, cwd, reviewWorkspace };
+}
+
+/** Prepare and retain the run's directory before open/spawn. A reviewer's allocation never retargets its author. */
+async function prepareRunWorkspace(board, task, runId, meta, options) {
+  const made = await resolveLocalWorkspace(board, task, options);
+  Object.assign(meta, { cwd: made.path, review_workspace: made.reviewWorkspace ?? null });
+  runTx(board, task.id, runId, db => {
+    assertWorkspaceOwner(db, task, { ...made, workspaceRoot: task.workspace_kind === 'worktree' ? made.path : made.root });
+    setRunSession(db, runId, { cwd: meta.cwd, review_workspace: meta.review_workspace });
+    if (!(task.workspace_kind === 'worktree' && meta.role === 'reviewer'))
+      db.prepare('UPDATE tasks SET workspace_path=?,branch_name=COALESCE(branch_name,?) WHERE id=?').run(made.path, task.workspace_kind === 'worktree' ? `wt/${task.id}` : null, task.id);
+  });
+  return made.path;
+}
+
+/** A run's directory on its execution machine, made through that machine's workspace door. */
+async function resolveLocalWorkspace(board, task, options) {
   const root = board.root;
   if (task.workspace_kind !== 'scratch') {
     // A branch the board named for the card is claimed until its worktree is made, and the making is recorded once.
     const facts = view(board, () => workspaceTask(board, task, { claims: true })), claim = facts.branch_claim;
-    const made = await resolveWorkspace(facts, true);
-    if (claim) tx(board, (db) => { if (branchClaim(db, task.id, task.branch_name)) event(db, task.id, 'worktree_made', { branch: task.branch_name, repository: task.workspace_anchor ?? null, path: made.path }); });
-    return made.path;
+    const made = await resolveWorkspace(facts, true, options);
+    if (claim && options.role !== 'reviewer') tx(board, (db) => { if (branchClaim(db, task.id, task.branch_name)) event(db, task.id, 'worktree_made', { branch: task.branch_name, repository: task.workspace_anchor ?? null, path: made.path }); });
+    return made;
   }
   const dir = task.workspace_path || (board.slug === 'default' ? join(root, 'kanban', 'workspaces', task.id) : join(root, 'kanban', 'boards', board.slug, 'workspaces', task.id));
   mkdirSync(dir, { recursive: true });
-  return dir;
+  return { path: dir, root: dir };
 }
 
 // ------------------------------------------------------------------ attach
@@ -3080,26 +3876,34 @@ async function resolveLocalWorkspace(board, task) {
  * launched), and the dispatcher's next tick verifies the session from the fleet reading it already takes and binds
  * it (`completeAdoptions`). The verb does no process I/O, so it answers as fast as any board write.
  */
-export function requestAdoption(board, id, who, { workspace = null, assignee = null, role = null } = {}) {
-  if (!who) throw new Error('name the session to adopt');
-  if (boardCopyOf(board)) throw copyRefusal(board, 'adopts no session');
-  tx(board, db => {
-    if (!getTask(db, id)) throw new Error(`no card ${id}`);
-    // a session named by its address or id is checked now; one named otherwise is checked when it is bound
-    const named = /^sc:[^:]+:[^:]+:(.+)$/.exec(String(who))?.[1] ?? (/^[0-9a-f-]{8,}$/i.test(String(who)) ? String(who) : null);
-    const why = coderAsReviewer(db, board, id, { sessionId: named, assignee, role });
-    if (why) throw new Error(coderAsReviewerRefusal(id, statusOf(db, getTask(db, id)), why));
-    event(db, id, 'dispatch_held', { session: who, reason: 'adoption requested', workspace, assignee, role });
-  });
+export async function requestAdoption(board, id, who, { workspace = null, assignee = null, role = null } = {}) {
+  try {
+    if (!who) throw requestDetail('name the session to adopt');
+    if (boardCopyOf(board)) throw requestDetail(copyRefusal(board, 'adopts no session').message);
+    tx(board, db => {
+      const task = getTask(db, id);
+      if (!task) throw requestDetail(`no card ${id}`);
+      if (task.backlog) throw requestDetail(`${id} is in backlog; plan it before adopting a session`);
+      // A session named by its address or id is checked now; one named otherwise is checked when it is bound.
+      const named = /^sc:[^:]+:[^:]+:(.+)$/.exec(String(who))?.[1] ?? (/^[0-9a-f-]{8,}$/i.test(String(who)) ? String(who) : null);
+      const why = coderAsReviewer(db, board, id, { sessionId: named, assignee, role });
+      if (why) throw ownerRule(coderAsReviewerRefusal(id, statusOf(db, task), why));
+      event(db, id, 'dispatch_held', { session: who, reason: 'adoption requested', workspace, assignee, role });
+    });
+    return { requested: who, held: true };
+  } catch (error) {
+    if (!error.ownerRule && !error.boardDetail) throw error;
+    return (error.ownerRule ? routeRequest : acceptRequest)(board, { id, name: 'adopt', payload: { session: who ?? '', workspace, assignee, role }, reason: error });
+  }
 }
 
 /**
  * Why adopting a session onto card `id` would make the card's own coder its reviewer, or null. A session adopted onto a
  * card whose run is its reviewer's (a card in review) is bound as that reviewer, and a reviewer is never the card's own
- * coder (ADR 0001 rule 8; ADR 0019: an implementer adopted as reviewer is refused). Its coder is a worker-slot session of
+ * coder (ADR 0001 rule 8; ADR 0019). Its coder is a worker-slot session of
  * any of its runs or one of its side sessions (`sessionId`), a profile any of its worker runs ran as or its implementer
- * (`assignee`), or a request for another role (`role`). The adoption is refused, never turned into a return: taking a
- * card out of review is the manager's own act (`return-review`), recorded with its reason.
+ * (`assignee`), or a request for another role (`role`). An adoption that needs this decision is handed to the manager;
+ * it never returns the card from review implicitly. The manager's `return-review` records that decision and reason.
  */
 function coderAsReviewer(db, board, id, { sessionId = null, assignee = null, role = null, assigneeBefore = undefined } = {}) {
   const card = getTask(db, id);
@@ -3108,7 +3912,7 @@ function coderAsReviewer(db, board, id, { sessionId = null, assignee = null, rol
   const held = assigneeBefore === undefined ? card.assignee : assigneeBefore;
   const entry = workflowFor(board.root);
   const bound = currentRun(db, id)?.metadata?.supercode;
-  const slot = bound?.slot ?? String(templateValue(runSpec(entry, statusOf(db, card), card)?.session ?? 'worker', scopeOf(db, board, card, { params: entry.params })));
+  const slot = bound?.slot ?? String(templateValue(runSpec(entry, statusOf(db, card), card)?.session ?? 'worker', scopeOf(db, board, card, { params: entry.params, lazy: true })));
   if (slot !== 'reviewer') return null;
   if (role && role !== 'reviewer') return `the adoption asks for its ${role} role`;
   if (sessionId && ownCoder(db, id, sessionId)) return `${sessionId} is its own coder (a worker or side session of ${id})`;
@@ -3132,8 +3936,8 @@ const ADOPTION_LISTING_WINDOW_S = 180;
  * The events that answer an adoption request, or hold it: a request is open while it is the card's latest of these, and
  * a round that acts on it first records `adoption_claimed` (the request, its claim lock and when the claim expires).
  */
-const ADOPTION_ANSWERS = "('dispatch_held','dispatch_released','session_adopted','adoption_failed','adoption_claimed')";
-const latestAnswer = (db, id) => db.prepare(`SELECT id, kind, payload FROM task_events WHERE task_id = ? AND kind IN ${ADOPTION_ANSWERS} ORDER BY id DESC LIMIT 1`).get(id) ?? null;
+const ADOPTION_ANSWERS = ['dispatch_held', 'dispatch_released', 'session_adopted', 'adoption_failed', 'adoption_claimed'];
+const latestAnswer = (db, id) => latestEvent(db, id, ADOPTION_ANSWERS, 'id,kind,payload') ?? null;
 
 /**
  * Adoptions the manager requested and no tick has answered yet, completed from this tick's fleet reading. A round claims
@@ -3146,7 +3950,7 @@ export async function completeAdoptions(board, fleet, settings, report) {
     FROM (SELECT DISTINCT task_id FROM task_events) cards CROSS JOIN task_events e ON e.task_id=cards.task_id
     WHERE e.kind IN ('dispatch_held','adoption_claimed')
     AND ((e.kind = 'dispatch_held' AND json_extract(e.payload, '$.reason') = 'adoption requested') OR e.kind = 'adoption_claimed')
-    AND e.id = (SELECT MAX(id) FROM task_events l WHERE l.task_id = e.task_id AND l.kind IN ${ADOPTION_ANSWERS})`).all());
+    AND e.id = ${latestEventIdSql('e.task_id', ADOPTION_ANSWERS)}`).all());
   for (const row of pending) {
     // a request another round has claimed is that round's while its claim holds; a claim whose round died is open again
     let request = row;
@@ -3201,7 +4005,7 @@ export async function completeAdoptions(board, fleet, settings, report) {
  */
 const ADOPTION_HOLDS = new Set(['adoption requested', 'awaiting adoption']);
 export function restoreHoldBefore(db, id, request) {
-  const before = db.prepare("SELECT kind, payload FROM task_events WHERE task_id = ? AND id < ? AND kind IN ('dispatch_held','dispatch_released','session_adopted') ORDER BY id DESC LIMIT 1").get(id, request);
+  const before = latestEvent(db, id, ['dispatch_held', 'dispatch_released', 'session_adopted'], 'kind,payload', 'id < ?', [request]);
   const held = before?.kind === 'dispatch_held' ? json(before.payload, {}) ?? {} : null;
   if (held && !ADOPTION_HOLDS.has(held.reason)) { const { by: _by, ...kept } = held; event(db, id, 'dispatch_held', { ...kept, restored_after: request }); }
   else event(db, id, 'dispatch_released', { reason: 'adoption failed', request });
@@ -3222,8 +4026,14 @@ async function nativeListing(who) {
   if (!m || !HARNESSES[m[2]]) return null;
   const [, host, harness, session_id] = m;
   // a discovery its machine did not answer is unknown, not absent: it is thrown (unread), never taken as no listing
-  try { return nativeReading(await readNative(host, harness, session_id), { session_id, harness }).alive === true ? { address: who, machine: normalMachine(host), harness, session_id, pane: null, name: null } : null; }
-  catch (error) { if (error.launchDeferred) throw error; return null; }
+  try {
+    const rows = (await readNative(host, harness, session_id)).filter(row => row.locator?.harness === harness && row.locator.session_id === session_id);
+    const stores = new Set(rows.map(row => JSON.stringify(locatorHome(row.locator)?.homes ?? null)));
+    if (stores.size > 1) throw Object.assign(new Error(`${who} exists in multiple native homes; an address alone cannot select its conversation`), { ambiguous: true });
+    const reading = nativeReading(rows, { session_id, harness });
+    return reading.alive === true ? { address: who, machine: normalMachine(host), harness, session_id, pane: null, name: null, locator: reading.row.locator } : null;
+  }
+  catch (error) { if (error.launchDeferred || error.ambiguous) throw error; return null; }
 }
 
 /** The verb an adoption with no current run fires: the workflow's own `adopt` where it declares one, else its dispatch start. */
@@ -3236,7 +4046,9 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
   // A session no current machine lists may be one of a machine whose record is not current: the one its address names,
   // or any, for a bare name. Its native listing is not taken there (it knows no pane, and the session may run in one).
   const named = /^sc:([^:]+):/.exec(String(who))?.[1], machines = named ? [normalMachine(named)].filter((machine) => fleet.unknown?.has(machine)) : [...(fleet.unknown ?? [])];
-  const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who) ?? (named && machines.length ? null : await nativeListing(who));
+  const matches = fleet.sessions.filter((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who);
+  if (matches.length > 1) throw new Error(`${who} matches ${matches.length} live sessions or panes (${matches.map((s) => s.address).join(', ')}); select one by its address`);
+  const found = matches[0] ?? (named && machines.length ? null : await nativeListing(who));
   if (!found) {
     // said, and waited on as an unlisted session is, within the listing window
     const unread = machines.map((machine) => `machine ${machine}'s record is not current: ${fleet.errors?.get(machine) ?? 'no current record'}`).join('; ');
@@ -3244,43 +4056,50 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
   }
   const [, host, harness, sessionId] = found.address.split(':');
   if (!HARNESSES[harness]) throw new Error(`${found.address} is ${harness}; the board keeps and resumes ${Object.keys(HARNESSES).join(' and ')} sessions`);
-  const native = found.pane ? null : nativeReading(await readNative(host, harness, sessionId), { session_id: sessionId, harness });
+  const home = locatorHome(found.locator);
+  if (!home) throw unavailable(`native home is unknown for ${found.address}; adoption did not bind an unspecified store`);
+  const native = found.pane ? null : nativeReading(await readNative(host, harness, sessionId, home?.homes), { session_id: sessionId, harness });
   if (found.pane ? !await panePresent(host, found.pane) : native.alive !== true) throw new Error(`${found.address} has no verified live native process or pane`);
   const beforeRun = view(board, (db) => currentRun(db, id));
   const beforeCustody = view(board, db => JSON.stringify(detachedCard(db, id)));
   const beforeSession = beforeRun?.metadata?.supercode;
   const entry0 = workflowFor(board.root), card0 = view(board, (db) => getTask(db, id));
   const adoptionSlot = beforeSession?.slot ?? view(board, db => {
-    const scope = scopeOf(db, board, card0, { params: entry0.params });
+    const scope = scopeOf(db, board, card0, { params: entry0.params, lazy: true });
     return String(templateValue(runSpec(entry0, statusOf(db, card0), card0)?.session ?? 'worker', scope));
   });
   const predecessor = view(board, db => lastSession(db, id, adoptionSlot));
-  const sameIdentity = session => addressOf(session) === found.address;
+  await readNativeHome(beforeSession);
+  await readNativeHome(predecessor);
+  const incoming = { ...found, native_home: home };
+  const sameIdentity = session => sameNativeSession(session, incoming);
   // A deferred run has issued no different identity. Bind its own slot's live predecessor, or the session
   // discovered in its keyed pane, without ending the run or opening another process.
   const unissued = !beforeSession?.session_id && !beforeSession?.pane && !beforeSession?.launch_key && !beforeSession?.pid && !beforeSession?.launch_pending;
   const keyedPane = !beforeSession?.session_id && found.pane && beforeSession?.pane === found.pane
-    && beforeSession?.machine === host && beforeSession?.harness === harness;
+    && beforeSession?.machine === host && beforeSession?.harness === harness
+    && homeIdentity(beforeSession) === homeIdentity(incoming);
   if (beforeRun && !sameIdentity(beforeSession) && !keyedPane && !(unissued && sameIdentity(predecessor))) throw new Error(`${id} has another active run/session; end it before adopting a different identity`);
   if (beforeSession?.pane && beforeSession.pane !== found.pane && await panePresent(beforeSession.machine, beforeSession.pane)) throw new Error(`${id} still has live pane ${beforeSession.pane}; close the extra pane before rebinding ${sessionId}`);
 
   // the session's own working directory, as discovery records it (where `--resume` finds it), else its pane's
   let dir = workspace ?? native?.row?.cwd;
   if (!dir) {
-    dir = (await readNative(host, harness, sessionId)).find((x) => x.locator?.session_id === sessionId)?.cwd ?? null;
+    dir = (await readNative(host, harness, sessionId, home?.homes, { activity: false })).find((x) => x.locator?.session_id === sessionId)?.cwd ?? null;
   }
   if (!dir && found.pane) {
-    const r = await runtimeDoor(normalMachine(host)===localMachine()?null:host,'harness.v1.panes.list',{}, { timeout: 60_000 });
-    dir = (json(r.stdout.trim(), []) ?? []).find((p) => p.pane === found.pane)?.cwd ?? null;
+    dir = ((await paneRows(host)).list ?? []).find((p) => p.pane === found.pane)?.cwd ?? null;
   }
   // Agents are started, not attached (owner, VO-3751). Adoption records card work only: the session
   // keeps its original identity, profile, hooks, MCP and folder, including when another card's agent owns it.
   // Claim the request before reading its slot again, so another round cannot bind the same request meanwhile.
   const stale = (db) => {
+    if (getTask(db, id)?.backlog) return new Error(`${id} moved to backlog during adoption; plan it before binding a session`);
     if (request !== null && !adoptionOpenTo(db, id, request, open)) return Object.assign(new Error(`${id}'s adoption request was answered or claimed meanwhile`), { superseded: true });
     if ((getTask(db, id)?.current_run_id ?? null) !== (beforeRun?.id ?? null)) return new Error(`${id} changed runs during adoption; retry against its current run`);
     const binding = currentRun(db, id)?.metadata?.supercode;
-    if (['session_id', 'pane', 'launch_key', 'launch_pending', 'launch_deferred'].some(key => (binding?.[key] ?? null) !== (beforeSession?.[key] ?? null))) return new Error(`${id}'s session binding changed during adoption; retry against its current session`);
+    if (['session_id', 'pane', 'launch_key', 'launch_pending', 'launch_deferred'].some(key => (binding?.[key] ?? null) !== (beforeSession?.[key] ?? null))
+      || homeIdentity(binding) !== homeIdentity(beforeSession)) return new Error(`${id}'s session binding changed during adoption; retry against its current session`);
     if (JSON.stringify(detachedCard(db, id)) !== beforeCustody) return new Error(`${id} changed session custody during adoption; request adoption again`);
     return null;
   };
@@ -3305,13 +4124,11 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
     const was = lastSession(db, id, adoptionSlot);
     // a session whose close the board confirmed is not live, whatever a fleet reading still lists (a released one was
     // left running, and is read)
-    if (was && !sameIdentity(was) && !(was.close_confirmed_at && !was.released) && sessionAlive(fleet, was)) throw new Error(`${id} already has a live session, ${was.address}`);
+    if (was && !sameIdentity(was) && !(was.close_confirmed_at && !was.released) && sessionAlive(fleet, was) !== false)
+      throw new Error(`${id} already has a live or unread session, ${was.address}`);
     if (!task.machine) db.prepare('INSERT INTO supercode_cards (task_id, machine) VALUES (?, ?) ON CONFLICT(task_id) DO UPDATE SET machine = excluded.machine').run(id, host);
     // the lane that resumes it if it is lost, set in the same transaction (assigning first would let a tick start another)
     if (assignee && assignee !== task.assignee) { db.prepare('UPDATE tasks SET assignee = ? WHERE id = ?').run(assignee, id); event(db, id, 'assigned', { assignee }); }
-    if (dir && !task.workspace_anchor && !(task.workspace_kind === 'dir' && task.workspace_path)) {
-      db.prepare("UPDATE tasks SET workspace_kind = 'dir', workspace_path = ? WHERE id = ?").run(dir.replace(/^dir:/, ''), id);
-    }
     const entry = workflowFor(board.root);
     takeSessionCustody(db, id, found.address);
     event(db, id, 'dispatch_released', { reason: 'verified adoption', session: found.address });
@@ -3332,9 +4149,13 @@ async function adoptSession(board, id, who, { request = null, open = request, pr
       const why = coderAsReviewer(db, board, id, { sessionId, assignee, role, assigneeBefore: task.assignee ?? null });
       if (why) throw new Error(coderAsReviewerRefusal(id, statusOf(db, task), why));
     }
-    const session = { surface: found.pane ? 'pane' : 'native', session_id: sessionId, harness, machine: host, pane: found.pane ?? null, address: found.address, mode: 'adopt', launched_at: now(), seen_at: now() };
+    if (runRole !== 'reviewer' && dir && !task.workspace_anchor && !(task.workspace_kind === 'dir' && task.workspace_path)) {
+      db.prepare("UPDATE tasks SET workspace_kind = 'dir', workspace_path = ? WHERE id = ?").run(dir.replace(/^dir:/, ''), id);
+    }
+    const session = { surface: found.pane ? 'pane' : 'native', session_id: sessionId, harness, machine: host, pane: found.pane ?? null, address: found.address, mode: 'adopt', launched_at: now(), seen_at: now(), native_home: home, cwd: dir?.replace(/^dir:/, '') ?? null };
     // a deferred launch was never issued: the adopted session is the run's, and no later round launches another
     const owned = [beforeSession, was].find(s => s && s.pane === session.pane && (sameIdentity(s) || s === beforeSession && keyedPane));
+    session.native_home ??= nativeHome(owned);
     setRunSession(db, runId, { ...(currentRun(db, id)?.metadata?.supercode ?? {}), ...session,
       // A deferred or rebound run may retain launch intent. It must not make the delivery pass bind this
       // attached session to that intent's agent; the session's existing ownership stays with its starter.
@@ -3366,21 +4187,22 @@ async function reconnectContinuedSessions(board, fleet, entry, report) {
     const saved = json(row.metadata,{})?.supercode;
     if (!saved?.session_id || saved.forgotten || saved.close_transferred_to || view(board, db => detachedCard(db, row.task_id) || detachedSession(db, saved))) continue;
     if (!saved.monitor_held && !['crashed','closed','reclaimed','failed'].includes(row.outcome)) continue;
-    const live = fleet.sessions?.find(s => s.address === addressOf(saved) && s.state === 'running' && s.pane);
+    await readNativeHome(saved);
+    const candidates = fleetSessionRows(fleet, saved).filter(s => s.state === 'running' && s.pane);
+    const live = new Set(candidates.map(s => s.pane)).size === 1 ? candidates[0] : null;
     if (!live) continue;
     if (!panes.has(saved.machine)) {
-      const answer = await doorOn(saved.machine,'harness.v1.panes.list',{}, {timeout:60000});
-      const list = answer.code === 0 ? json(answer.stdout,null) : null;
-      panes.set(saved.machine,Array.isArray(list) ? new Set(list.filter(p=>!p.dead).map(p=>p.pane)) : null);
+      const { list } = await paneRows(saved.machine);
+      panes.set(saved.machine,list ? new Set(list.filter(p=>!p.dead).map(p=>p.pane)) : null);
     }
     const pane = live.pane;
     if (!pane || !panes.get(saved.machine)?.has(pane)) continue;
     // A surviving timed-out process is not a manual restart. It needs a new pane.
     if (pane === saved.pane && !saved.closed_at && !['crashed','closed','reclaimed'].includes(row.outcome)) continue;
     tx(board, db => {
-      const task = getTask(db,row.task_id), scope = scopeOf(db,board,task,{params:entry.params});
+      const task = getTask(db,row.task_id), scope = scopeOf(db,board,task,{params:entry.params,lazy:true});
       const automaticPause = scope.card.paused?.reason?.startsWith('its session ended cleanly (');
-      if (task.detached || detachedSession(db, saved) || task.current_run_id || (scope.card.paused && !automaticPause) || scope.card.blocked_by.length || scope.card.archived || statusOf(db,task) !== saved.status) return;
+      if (task.backlog || task.detached || detachedSession(db, saved) || task.current_run_id || (scope.card.paused && !automaticPause) || scope.card.blocked_by.length || scope.card.archived || statusOf(db,task) !== saved.status) return;
       if (automaticPause) db.prepare('UPDATE supercode_cards SET paused=NULL WHERE task_id=?').run(row.task_id);
       const session = { ...saved,pane,mode:'manual-continuation',state:entry.workflow.run?.initial ?? 'active',monitor_held:false,
         prior_intervals:[...(saved.prior_intervals??[]),{ended_at:row.ended_at,outcome:row.outcome,error:row.error}],
@@ -3408,31 +4230,48 @@ async function reconnectContinuedSessions(board, fleet, entry, report) {
  * writes it through the mailbox's filing door, idempotent by the message id `key` fixes. Nothing here waits on the
  * event loop. The mailbox delivers it: the machine daemon's watch loop hands it to its session by the session's own
  * door, and carries mail for another machine there through Teams. `wake: false` leaves it for the session's next turn.
- * A question the board waits on (`ask`) is answered by a reply to the board's address; a notice is not. Throws only
- * when the filing failed.
+ * `as` says what it is: a `notice` (the default) is filed as the mailbox's notice, which its receiver reads as no
+ * instruction and answers nowhere; a `question` the board waits on, and a run's `instruction` (an adopted session's run
+ * input or brief, the text a launched or resumed session takes as its first prompt, carried as it is), are ordinary mail
+ * a session can reply to; the board's mailbox takes a reply and marks it read (readMailbox).
+ * Throws only when the filing failed.
  */
-async function fileMail(board, to, body, key, { ask = false, wake = true, subject, eligible = null } = {}) {
+async function fileMail(board, to, body, key, { as = 'notice', wake = true, subject, eligible = null } = {}) {
   if (boardCopyOf(board)) throw copyRefusal(board, 'files no mail for sessions or managers');
+  // Every filing is recorded with where its time went (ADR 0066's delivery latency): its custody transactions around
+  // the door, the door's round trip, and the daemon's own phases (its answer's `timing`).
+  const began = performance.now();
+  let doorMs = null, daemon = null;
   const perform = async () => {
     if (eligible && !eligible()) return { filed: false, new: false, skipped: true };
     const request = {
-      from: boardAddress(board.label), from_name: `${board.label} board`, to, id: key, wake, notice: !ask, subject: String(subject ?? String(body).split('\n')[0]).slice(0, 160),
-      body: ask ? `[A question from the ${board.label} board] ${body}` : `[Board notice from the ${board.label} board] ${body}\n\n(An automated notice from the board's dispatcher; replies to this address go nowhere.)`,
+      from: boardAddress(board.label), from_name: `${board.label} board`, to, id: key, wake, notice: as === 'notice', subject: String(subject ?? String(body).split('\n')[0]).slice(0, 160),
+      body: as === 'instruction' ? String(body) : as === 'question' ? `[A question from the ${board.label} board] ${body}` : `[Board notice from the ${board.label} board] ${body}\n\n(An automated notice from the board's dispatcher; replies to this address go nowhere.)`,
       // the board's own Teams context (the call it files in): the sender is observed in that team, never the daemon's
       context: current().facts.SUPERCODE_CONTEXT ?? null,
     };
-    const r = await runtimeDoor(null, 'harness.v1.mail.file', request, { timeout: 30_000 });
+    const doorBegan = performance.now();
+    const r = await runtimeDoor(null, 'harness.v1.mail.file', { ...request, sent_at_ms: Date.now() }, { timeout: 30_000 });
+    doorMs = performance.now() - doorBegan;
     const answer = r.code === 0 ? lastJson(r.stdout) : null;
+    daemon = answer?.timing ?? null;
     if (answer?.code !== 0) throw new Error((answer?.text || (lastJson(r.stderr)?.message ?? r.stderr) || 'no answer from the mailbox\'s filing door').trim().slice(-300));
     return { filed: true, message_id: answer.message_id, new: answer.new === true };
   };
   // Dispatcher mail reserves this exact identity before entering the mailbox door.
   if (!board.db) throw new Error('mail filing requires the board custody store');
+  let outcome = 'ok';
   try { return await sessionOperation(board, { address: to, kind: 'mail filing' }, perform); }
   catch (error) {
+    outcome = error.sessionDetached ? 'detached' : 'failed';
     if (!error.sessionDetached) throw error;
     return { filed: false, new: false, detached: true };
   }
+  finally {
+    const ms = performance.now() - began;
+    recordSlow({ kind: 'call', name: 'board mail.file', ms, outcome, includeFast: true, extra: { as,
+      door_ms: doorMs === null ? null : Math.round(doorMs), custody_ms: doorMs === null ? null : Math.round(ms - doorMs), daemon } });
+  }
 }
 
 /** Fleet listener mail uses the owner's ordinary filing door, including board-copy refusal and sender custody. */
@@ -3475,8 +4314,7 @@ export async function fileBoardMail(board, report, taskId = null) {
   // upgrade or a long stop): it is passed over, recorded once, never filed
   const maxAge = Number(workflowFor(board.root)?.params?.notice_max_age_seconds) || null;
   if (maxAge) tx(board, db => {
-    for (const row of db.prepare(`SELECT id, task_id FROM task_events original WHERE kind='board_message' AND created_at < ?
-      AND NOT EXISTS (SELECT 1 FROM task_events done WHERE done.kind IN ('board_message_sent', 'board_message_passed') AND done.task_id=original.task_id AND json_extract(done.payload,'$.event')=original.id)`).all(now() - maxAge))
+    for (const row of pendingRequestRows(db).pending.filter(row => row.created_at < now() - maxAge))
       event(db, row.task_id, 'board_message_passed', { event: row.id, reason: `older than notice_max_age_seconds (${maxAge})` });
   });
   const planned = tx(board, db => pendingRequestMail(db, taskId));
@@ -3488,13 +4326,13 @@ export async function fileBoardMail(board, report, taskId = null) {
       const task = view(board, db => getTask(db, first.task_id));
       const several = mail.requester && !mail.message_id && new Set(mail.members.map((m) => m.task_id)).size > 1;
       const subject = numbered(boardKey(board.root, board.slug), several ? null : task?.number, mail.requester ? (mail.message_id ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${mail.title ?? mail.requester} · ${mail.members.length} card(s)`) : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`, several ? null : noticeName(task));
-      const filed = await fileMail(board, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
+      const filed = await fileMail(board, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { as: mail.message_id ? 'question' : 'notice', subject });
       tx(board, db => {
         if (filed.detached) {
           for (const member of mail.members) event(db, member.task_id, 'board_message_passed', { event: member.id, to: mail.to, reason: 'session detached to a person' });
           return;
         }
-        for (const member of mail.members) if (!db.prepare("SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?").get(member.task_id, member.id)) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, message_id: filed.message_id, ...(mail.message_id ? { request_id: member.message_id ?? mail.message_id } : {}) });
+        for (const member of mail.members) if (!db.prepare("SELECT 1 FROM task_events WHERE kind IN ('board_message_sent','board_message_passed') AND task_id=? AND json_extract(CASE WHEN json_valid(payload) THEN payload END,'$.event')=?").get(member.task_id, member.id)) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, message_id: filed.message_id, ...(mail.message_id ? { request_id: member.message_id ?? mail.message_id } : {}) });
       });
       if (filed.filed) (report.mailed ??= []).push([first.task_id, mail.to]);
     } catch (error) {
@@ -3506,14 +4344,12 @@ export async function fileBoardMail(board, report, taskId = null) {
 /** The board's own address: where its notices come from and where card updates are mailed. */
 export const boardAddress = (label) => `sc:${localMachine()}:board:${boardName(label)}`;
 
-/** Consecutive failed sends after which a chat-platform subscription is dropped (Hermes's notifier drops a dead chat after 12). */
-const MAX_SEND_FAILURES = 12;
-
 /**
  * What an audience is told of an event: the workflow's `notify[audience][kind]` template over the card, the event's
  * payload and (for a comment) the comment; null when the workflow names no such notice.
  */
 export function noticeOf(entry, audience, kind, task, payload, comment = null, recipient = null) {
+  if (kind === 'session_stalled' && payload?.turn_readable === false) return null;
   const template = entry.workflow.notify?.[audience]?.[kind];
   if (template === undefined || template === null) return null;
   const cut = (text, n) => String(text ?? '').slice(0, Number(n));
@@ -3528,36 +4364,59 @@ export function noticeOf(entry, audience, kind, task, payload, comment = null, r
  * launch or a missed fleet read lost comes back), and each of the workflow's managers (`params.managers`) hears every
  * open arc (not its subtasks) as the `manager` audience, whoever filed it, when the workflow's notify names one.
  */
-function ensureSubscriptions(board, entry) {
+const inheritedSubtaskFollower = `platform = 'supercode' AND thread_id = ''
+  AND task_id IN (SELECT task_id FROM supercode_cards WHERE subtask_of IS NOT NULL)
+  AND ((json_extract(delivery_metadata, '$.role') = 'manager' AND json_extract(delivery_metadata, '$.own') IS NULL)
+    OR (COALESCE(json_extract(delivery_metadata, '$.role'), 'creator') = 'creator'
+      AND json_extract(delivery_metadata, '$.own') IS NULL
+      AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.id = kanban_notify_subs.task_id AND t.created_by IN (kanban_notify_subs.chat_id, 'session:' || kanban_notify_subs.chat_id))
+      AND NOT EXISTS (SELECT 1 FROM task_events e WHERE e.task_id = kanban_notify_subs.task_id AND e.kind = 'created'
+        AND json_extract(e.payload, '$.creator') IN (kanban_notify_subs.chat_id, 'session:' || kanban_notify_subs.chat_id))
+      AND EXISTS (SELECT 1 FROM kanban_notify_subs arc JOIN supercode_cards c ON c.subtask_of = arc.task_id
+        WHERE c.task_id = kanban_notify_subs.task_id AND arc.chat_id = kanban_notify_subs.chat_id AND arc.platform = 'supercode')))`;
+async function ensureSubscriptions(board, entry) {
   const managers = Array.isArray(entry.params.managers) ? entry.params.managers.map(String) : [];
   const toManagers = Object.keys(entry.workflow.notify?.manager ?? {}).length > 0;
-  tx(board, (db) => {
-    reconcileDependencySubscriptions(db);
-    // A subtask's watchers are its own (its creator, its worker, whoever comments on it or is mentioned there), as an
-    // issue tracker's sub-task's are: the manager follows arcs, and an arc's follower is not copied onto its subtasks.
-    // Such copies made before are removed here.
-    db.prepare(`DELETE FROM kanban_notify_subs WHERE platform = 'supercode' AND thread_id = ''
-      AND task_id IN (SELECT task_id FROM supercode_cards WHERE subtask_of IS NOT NULL)
-      AND ((json_extract(delivery_metadata, '$.role') = 'manager' AND json_extract(delivery_metadata, '$.own') IS NULL)
-        OR (COALESCE(json_extract(delivery_metadata, '$.role'), 'creator') = 'creator'
-          AND json_extract(delivery_metadata, '$.own') IS NULL
-          AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.id = kanban_notify_subs.task_id AND t.created_by IN (kanban_notify_subs.chat_id, 'session:' || kanban_notify_subs.chat_id))
-          AND NOT EXISTS (SELECT 1 FROM task_events e WHERE e.task_id = kanban_notify_subs.task_id AND e.kind = 'created'
-            AND json_extract(e.payload, '$.creator') IN (kanban_notify_subs.chat_id, 'session:' || kanban_notify_subs.chat_id))
-          AND EXISTS (SELECT 1 FROM kanban_notify_subs arc JOIN supercode_cards c ON c.subtask_of = arc.task_id
-            WHERE c.task_id = kanban_notify_subs.task_id AND arc.chat_id = kanban_notify_subs.chat_id AND arc.platform = 'supercode')))`).run();
-    for (const t of db.prepare(`SELECT t.id, t.current_run_id, c.subtask_of FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id
-      WHERE t.status NOT IN ('done', 'archived')`).all()) {
-      if (toManagers && !t.subtask_of) for (const m of managers) subscribeIn(db, t.id, m, 'manager');
-      if (!t.current_run_id) continue;
-      const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(t.current_run_id)?.metadata, {})?.supercode;
-      const address = addressOf(session);
-      if (!address || (session.slot ?? 'worker') !== 'worker') continue;
-      replaceWorkerSubscriptions(db, t.id, address);
-    }
-  });
+  const cards = view(board, db => db.prepare(`SELECT DISTINCT task_id AS id FROM kanban_notify_subs
+      WHERE platform='supercode' AND json_extract(delivery_metadata,'$.dependent_card') IS NOT NULL
+    UNION SELECT DISTINCT task_id AS id FROM kanban_notify_subs WHERE ${inheritedSubtaskFollower}
+    UNION SELECT t.id FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id
+      WHERE ? AND t.status NOT IN ('done','archived') AND c.subtask_of IS NULL`).all(toManagers ? 1 : 0));
+  for (const { id } of cards) {
+    await yieldToOwner();
+    if (stopping) return;
+    const needed = view(board, db => {
+      if (db.prepare(`SELECT 1 FROM kanban_notify_subs WHERE task_id=? AND ${inheritedSubtaskFollower} LIMIT 1`).get(id)
+        || reconcileDependencySubscriptions(db, id, { check: true })) return true;
+      const task = toManagers && getTask(db, id);
+      return task && !task.subtask_of && !['done', 'archived'].includes(task.status)
+        && managers.some(address => subscribeIn(db, id, address, 'manager', { check: true }));
+    });
+    if (!needed) continue;
+    tx(board, (db) => {
+      reconcileDependencySubscriptions(db, id);
+      // A subtask's watchers are its own (its creator, its worker, whoever comments on it or is mentioned there), as an
+      // issue tracker's sub-task's are: the manager follows arcs, and an arc's follower is not copied onto its subtasks.
+      // Such copies made before are removed here.
+      db.prepare(`DELETE FROM kanban_notify_subs WHERE task_id=? AND ${inheritedSubtaskFollower}`).run(id);
+      const task = getTask(db, id);
+      if (toManagers && task && !task.subtask_of && !['done', 'archived'].includes(task.status))
+        for (const m of managers) subscribeIn(db, id, m, 'manager');
+    });
+  }
+  for (const { id, run_id } of view(board, db => db.prepare('SELECT id, current_run_id AS run_id FROM tasks WHERE current_run_id IS NOT NULL').all())) {
+    await yieldToOwner();
+    if (stopping) return;
+    const binding = db => {
+      if (!runCurrent(db, id, run_id)) return null;
+      const session = currentRun(db, id)?.metadata?.supercode;
+      return (session?.slot ?? 'worker') === 'worker' ? addressOf(session) : null;
+    };
+    const needed = view(board, db => { const address = binding(db); return address && replaceWorkerSubscriptions(db, id, address, { check: true }); });
+    if (!needed) continue;
+    tx(board, db => { const address = binding(db); if (address) replaceWorkerSubscriptions(db, id, address); });
+  }
 }
-
 /**
  * Whether the session at `address` is known to have ended: one of card `taskId`'s runs carried it, and no run (of any
  * card) carrying it is unended or keeps it open after its run (retain_after_run, not since closed or handed on). One
@@ -3623,15 +4482,21 @@ async function noticeSessions() {
 /** Retain a subscription's wait across passes and owner restarts; only transitions enter the log report. */
 function noticeWait(board, sub, report, reason = null) {
   if (reason === null && !sub.delivery_metadata?.notice_wait) return;
-  const changed = tx(board, db => {
-    const where = "WHERE task_id=? AND platform='supercode' AND chat_id=? AND thread_id=?";
-    const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
+  const where = "WHERE task_id=? AND platform='supercode' AND chat_id=? AND thread_id=?";
+  const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
+  // the retained wait, when this reason would change it (ADR 0247: an unchanged wait opens no transaction)
+  const transition = db => {
     const row = db.prepare(`SELECT delivery_metadata FROM kanban_notify_subs ${where}`).get(...identity);
-    if (!row) return false;
+    if (!row) return null;
     const metadata = json(row.delivery_metadata, {}) ?? {};
-    if ((metadata.role ?? 'creator') !== (sub.delivery_metadata?.role ?? 'creator')) return false;
+    if ((metadata.role ?? 'creator') !== (sub.delivery_metadata?.role ?? 'creator')) return null;
+    return (metadata.notice_wait?.reason ?? null) === reason ? null : metadata;
+  };
+  if (!view(board, transition)) return;
+  const changed = tx(board, db => {
+    const metadata = transition(db);
+    if (!metadata) return false;
     const previous = metadata.notice_wait;
-    if ((previous?.reason ?? null) === reason) return false;
     if (reason === null) delete metadata.notice_wait;
     else metadata.notice_wait = { reason, since: now() };
     db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata=? ${where}`).run(JSON.stringify(metadata), ...identity);
@@ -3705,15 +4570,13 @@ const followerRole = (sub) => ['worker', 'dependency', 'manager', 'participant']
 async function endEndedSubscriptions(board, fleet, report) {
   const followers = "platform = 'supercode' AND json_extract(delivery_metadata, '$.dependent_card') IS NULL AND COALESCE(json_extract(delivery_metadata, '$.role'), 'creator') != 'dependency'";
   // each native subscriber's liveness is read before the write
-  const aliveNow = new Map(), goneNow = new Map();
+  const aliveNow = new Map();
   if (fleet.ok) for (const { chat_id: address } of board.db.prepare(`SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE ${followers}`).all()) {
     if (!sessionAt(address)) continue;
     aliveNow.set(address, await subscriberAlive(fleet, address));
-    if (aliveNow.get(address) === false && subscriberGone(fleet, address)) goneNow.set(address, now());
   }
-  tx(board, (db) => {
-    const remove = db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?");
-    const ended = new Map(), records = new Map();
+  const pending = db => {
+    const selected = [], records = new Map();
     for (const row of db.prepare(`SELECT task_id, chat_id, thread_id, delivery_metadata FROM kanban_notify_subs WHERE ${followers}`).all()) {
       const address = row.chat_id;
       if (!sessionAt(address)) continue;
@@ -3722,10 +4585,19 @@ async function endEndedSubscriptions(board, fleet, report) {
       const record = latest.get(address);
       // a session alive, or whose liveness could not be read (unknown, never taken as ended), keeps its subscription
       if (record?.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) !== false)) continue;
-      // the board closed it, or it is gone (no transcript, process or pane, read whole: subscriberGone)
-      const evidence = record?.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at }
-        : goneNow.has(address) ? { by: 'gone', run: record?.run ?? null, read_at: goneNow.get(address), machine: sessionAt(address)?.machine ?? null } : null;
-      if (!evidence || !remove.run(row.task_id, address, row.thread_id).changes) continue;
+      // Only a confirmed native close ends a retained subscription.
+      const evidence = record?.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at } : null;
+      if (evidence) selected.push({ row, record, evidence });
+    }
+    return selected;
+  };
+  if (!view(board, db => pending(db).length)) return;
+  tx(board, (db) => {
+    const remove = db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?");
+    const ended = new Map();
+    for (const { row, record, evidence } of pending(db)) {
+      const address = row.chat_id;
+      if (!remove.run(row.task_id, address, row.thread_id).changes) continue;
       if (!ended.has(address)) ended.set(address, { record, evidence, cards: [], roles: new Set() });
       ended.get(address).cards.push(row.task_id);
       ended.get(address).roles.add(json(row.delivery_metadata, {})?.role ?? 'creator');
@@ -3753,13 +4625,14 @@ async function foldAgentSessions(board, entry, report) {
     for (const session of agentMains.get(agent)?.sessions ?? []) if (sessionAt(session) && !agentOf.has(session)) agentOf.set(session, agent);
   }
   if (!agentOf.size) return;
+  const sessions = [...agentOf.keys()];
+  const pending = db => db.prepare(`SELECT task_id, chat_id, thread_id, delivery_metadata FROM kanban_notify_subs WHERE platform = 'supercode' AND chat_id IN (${sessions.map(() => '?').join(', ')})`).all(...sessions)
+    .map(row => ({ row, metadata: json(row.delivery_metadata, {}) ?? {} }))
+    .filter(({ metadata }) => !['worker', 'dependency'].includes(metadata.role) && !metadata.dependent_card);
+  if (!view(board, db => pending(db).length)) return;
   tx(board, (db) => {
-    const sessions = [...agentOf.keys()];
-    const rows = db.prepare(`SELECT task_id, chat_id, thread_id, delivery_metadata FROM kanban_notify_subs WHERE platform = 'supercode' AND chat_id IN (${sessions.map(() => '?').join(', ')})`).all(...sessions);
     const moved = new Map();
-    for (const row of rows) {
-      const metadata = json(row.delivery_metadata, {}) ?? {};
-      if (['worker', 'dependency'].includes(metadata.role) || metadata.dependent_card) continue;
+    for (const { row, metadata } of pending(db)) {
       const agent = agentOf.get(row.chat_id);
       const head = db.prepare('SELECT COALESCE(MAX(id), 0) AS c FROM task_events WHERE task_id = ?').get(row.task_id).c;
       const { notice_wait: _wait, failures: _failures, ...kept } = metadata;
@@ -3827,7 +4700,7 @@ async function notify(board, fleet, report, entry) {
   const NOTICE_CEILING = Math.max(Number(entry.params.notice_ceiling) || NOTICE_CEILING_DEFAULT, 1);
   const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
   const identityOf = (sub) => [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
-  const forward = (db, sub, to) => db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(to, ...identityOf(sub), to);
+  const forward = (db, sub, to) => db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND created_at = ? AND last_event_id < ?`).run(to, ...identityOf(sub), sub.created_at, to);
   const rank = (sub) => NOTICE_RANK.indexOf(followerRole(sub));
   // cursors moved past what was read with nothing to tell, written together after the pass
   const quiet = [];
@@ -3842,8 +4715,6 @@ async function notify(board, fleet, report, entry) {
   for (const sub of subscriptions(board.db).filter((s) => s.platform === 'supercode').sort((a, b) => rank(a) - rank(b))) {
     await yieldToOwner();
     if (stopping) break;
-    if (view(board, db => personCustody(db, sub.chat_id))) continue;
-    if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) continue;
     // an unsubscribed follower is told nothing until a mention or its own comment brings it back (engine.follow)
     if (sub.delivery_metadata?.unsubscribed) continue;
     const role = followerRole(sub);
@@ -3854,8 +4725,9 @@ async function notify(board, fleet, report, entry) {
     const toldAs = (kind) => roles.find((r) => heardBy(entry, r).includes(kind)) ?? role;
     // the card's last event, read before its news: the cursor moves to it past every event, heard or not
     const head = Number(board.db.prepare('SELECT COALESCE(MAX(id), 0) AS c FROM task_events WHERE task_id = ?').get(sub.task_id).c);
-    if (!kinds.length) { if (head > Number(sub.last_event_id)) quiet.push({ sub, through: head }); noticeWait(board, sub, report); continue; }
-    // Read pending news before liveness: a subscription with nothing to file is not waiting on delivery.
+    if (!kinds.length) { if (head > Number(sub.last_event_id)) quiet.push({ sub, through: head }); continue; }
+    // Read pending news before liveness: a subscription with nothing to file is not waiting on delivery, and its
+    // retained wait stays as it was until a filing clears it.
     // the page starts past every event already history (older than liveSeconds), so a long backlog never holds back
     // what is news now
     // A follower's news is history past liveSeconds; a worker's or a dependency's (a verdict it must act on, its run
@@ -3866,7 +4738,10 @@ async function notify(board, fleet, report, entry) {
     const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND id <= ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id LIMIT 64`)
       .all(sub.task_id, Math.max(Number(sub.last_event_id), historyThrough), head, ...kinds);
     const through = events.length === 64 ? events[63].id : head;
-    if (!events.length) { if (head > Number(sub.last_event_id)) quiet.push({ sub, through: head }); noticeWait(board, sub, report); continue; }
+    if (!events.length) { if (head > Number(sub.last_event_id)) quiet.push({ sub, through: head }); continue; }
+    // The first obstruction this pass reads is the wait it records; the subscription keeps its cursor.
+    if (view(board, db => personCustody(db, sub.chat_id))) { noticeWait(board, sub, report, "its session is in a person's custody; its notices wait"); continue; }
+    if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) { noticeWait(board, sub, report, 'its dependency recipient is not bound; its notices wait'); continue; }
     const record = view(board, db => sessionRecord(db, sub.chat_id));
     // Events name the acting native session; subscriptions may name its agent.
     // Use the daemon's retained binding, including former mains, for both
@@ -3904,7 +4779,7 @@ async function notify(board, fleet, report, entry) {
       if (alive === false) { noticeWait(board, sub, report, 'its session is not running; its notices wait'); continue; }
       // unknown is not absent: its notices wait, and the wait is said, until its liveness can be read
       if (alive === null) { noticeWait(board, sub, report, 'its liveness could not be read; its notices wait until it can be'); continue; }
-    } else if (!sessionAt(sub.chat_id) && ended) continue; // native sessions already required a current live observation
+    } else if (!sessionAt(sub.chat_id) && ended) { noticeWait(board, sub, report, 'its session has ended; its notices wait'); continue; } // native sessions already required a current live observation
     // the card as the workflow names it (its status the workflow's: triaging, reviewing, stopped; `stored_as` kanban.db's;
     // `person` the person it is assigned to, if any)
     const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, key: boardKey(board.root, board.slug), status: statusOf(db, t), stored_as: t.status, person: personOf(t.assignee) } : t; });
@@ -3945,7 +4820,7 @@ async function notify(board, fleet, report, entry) {
     }
     read.push({ sub, role, task, kinds });
     // nothing to tell: its cursor moves past what was read
-    if (!items.length) { quiet.push({ sub, through }); noticeWait(board, sub, report); continue; }
+    if (!items.length) { quiet.push({ sub, through }); continue; }
     const digest = digests.get(recipient) ?? { recipient, to: sub.chat_id, cards: new Map() };
     // a recipient that follows as its agent is mailed at its agent's address, as it subscribed
     if (agentAt(sub.chat_id) && !agentAt(digest.to)) digest.to = sub.chat_id;
@@ -3964,23 +4839,22 @@ async function notify(board, fleet, report, entry) {
     try {
       const filed = await fileMail(board, digest.to, body, key, { wake, subject,
         eligible: () => view(board, db => subs.some(({ sub, through }) => {
-          const row = db.prepare(`SELECT last_event_id FROM kanban_notify_subs ${where}`).get(...identityOf(sub));
+          const row = db.prepare(`SELECT last_event_id FROM kanban_notify_subs ${where} AND created_at = ?`).get(...identityOf(sub), sub.created_at);
           return Boolean(row) && Number(row.last_event_id) < through;
         })) });
       tx(board, (db) => {
         for (const { sub, through } of subs) forward(db, sub, through);
-        if (filed.filed) {
-          state.sent.push(passAt);
-          for (const c of cards) state.cards[c.task_id] = passAt;
-          db.prepare('INSERT INTO supercode_board_state (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(state.key, JSON.stringify({ sent: state.sent, cards: state.cards }));
-        }
-        if (filed.new) for (const i of items) event(db, i.sub.task_id, 'notice_filed', { source_event: i.ev.id, kind: i.ev.kind, address: digest.to, message_id: filed.message_id, wake, ...(items.length > 1 ? { batched: items.length } : {}), ...(kind === 'summary' ? { summary: true } : {}) });
+        state.sent.push(passAt);
+        for (const c of cards) state.cards[c.task_id] = passAt;
+        db.prepare('INSERT INTO supercode_board_state (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(state.key, JSON.stringify({ sent: state.sent, cards: state.cards }));
+        if (filed.new) for (const i of items) event(db, i.sub.task_id, 'notice_filed', { source_event: i.ev.id, kind: i.ev.kind, address: digest.to, message_id: filed.message_id, wake,
+          ...(items.length > 1 ? { batched: items.length } : {}), ...(kind === 'summary' ? { summary: true } : {}) });
         if (filed.new && kind === 'summary') event(db, cards[0].task_id, 'notice_flood_collapsed', { address: digest.to, recipient: digest.recipient, notices: items.length,
           cards: cards.map((c) => c.task_id).slice(0, 50), card_count: cards.length, ceiling: NOTICE_CEILING, window_seconds: window, message_id: filed.message_id,
           reason: `more than ${NOTICE_CEILING} notice messages in ${window} s for one recipient: the rest are one summary` });
       });
-      if (filed.filed) for (const i of items) report.notified.push([i.sub.task_id, i.ev.kind, digest.to]);
-      if (filed.filed && kind === 'summary') (report.notices_collapsed ??= []).push([digest.to, items.length, cards.length]);
+      for (const i of items) report.notified.push([i.sub.task_id, i.ev.kind, digest.to]);
+      if (kind === 'summary') (report.notices_collapsed ??= []).push([digest.to, items.length, cards.length]);
       for (const { sub } of subs) noticeWait(board, sub, report);
     } catch (error) {
       for (const { sub } of subs) noticeWait(board, sub, report, String(error.message).slice(-200));
@@ -4028,7 +4902,11 @@ async function notify(board, fleet, report, entry) {
       await file(digest, state, { cards: rest, body, subject: numbered(boardKey(board.root, board.slug), null, `${count} updates on ${rest.length} cards`), kind: 'summary' });
     }
   }
-  if (quiet.length) tx(board, (db) => { for (const { sub, through } of quiet) forward(db, sub, through); });
+  const quietPending = (db, { sub, through }) => Boolean(db.prepare(`SELECT 1 FROM kanban_notify_subs ${where} AND created_at = ? AND last_event_id < ?`)
+    .get(...identityOf(sub), sub.created_at, through));
+  if (view(board, db => quiet.some(item => quietPending(db, item)))) tx(board, db => {
+    for (const item of quiet) if (quietPending(db, item)) forward(db, item.sub, item.through);
+  });
   // a subscription past its card's last event ends with the card: a worker's when the card is done or archived (its
   // work is over, and its session may never run again), anyone's when it is archived
   for (const { sub, role, task, kinds } of read) {
@@ -4047,86 +4925,6 @@ async function notify(board, fleet, report, entry) {
   }
 }
 
-// Hermes's terminal kinds for a chat subscriber, in its order of silence: archived and unblocked move the cursor and say nothing
-
-/**
- * A chat-platform subscription's events, sent through the orchestrator's own channel adapters (the daemon hosts them;
- * `serve` hosts none, as a Hermes CLI without its gateway delivers none). Answers what was sent and what failed.
- */
-export async function notifyChats(root, adapters, log = () => {}, wake = null) {
-  const sent = [];
-  // what a chat is told is the workflow's (notify.chat)
-  const entry = await loadWorkflow(root);
-  const kinds = heardBy(entry, 'chat');
-  if (!kinds.length) return sent;
-  for (const slug of listBoards(root)) {
-    const board = openBoard(root, slug);
-    board.label = boardLabel(root, slug);
-    try {
-      for (const sub of subscriptions(board.db)) {
-        const adapter = adapters?.[sub.platform];
-        if (sub.platform === 'supercode' || !adapter) continue;
-        const events = board.db.prepare(`SELECT id, kind, payload FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id`).all(sub.task_id, sub.last_event_id, ...kinds);
-        if (!events.length) continue;
-        const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, key: boardKey(board.root, board.slug) } : t; });
-        let cursor = Number(sub.last_event_id);
-        let failed = false;
-        for (const ev of events) {
-          const payload = json(ev.payload, {}) ?? {};
-          const text = noticeOf(entry, 'chat', ev.kind, task, payload);
-          if (text) {
-            // a completed card's deliverables go with it as uploads, as Hermes's notifier sends them
-            const files = ev.kind === 'completed' ? artifactsOf(payload, task).map((path) => ({ path })) : [];
-            const mode = sub.delivery_mode || 'notify';
-            // `wake`/`notify+wake`: the chat's own session gets the event as a turn (Hermes's wake), through the daemon
-            if (mode !== 'notify' && wake) {
-              try { await wake(sub, `${slug !== 'default' ? `[${slug}] ` : ''}${text}`); } catch (error) { log('warn', `board ${slug}: waking ${sub.platform}:${sub.chat_id} for ${sub.task_id} failed: ${error.message}`); }
-            }
-            if (mode === 'wake') { sent.push([sub.task_id, ev.kind, `${sub.platform}:${sub.chat_id} (wake)`]); cursor = ev.id; continue; }
-            try {
-              await adapter.send({ kind: 'explicit', platform: sub.platform, chat_id: sub.chat_id, ...(sub.thread_id ? { thread_id: sub.thread_id } : {}) }, { text: `${slug !== 'default' ? `[${slug}] ` : ''}${text}`, ...(files.length ? { files } : {}) });
-              sent.push([sub.task_id, ev.kind, `${sub.platform}:${sub.chat_id}`]);
-            } catch (error) {
-              failed = true;
-              log('warn', `board ${slug}: a notice for ${sub.task_id} to ${sub.platform}:${sub.chat_id} failed: ${error.message}`);
-              break;
-            }
-          }
-          cursor = ev.id;
-        }
-        tx(board, (db) => {
-          const where = 'WHERE task_id = ? AND platform = ? AND chat_id = ? AND thread_id = ?';
-          const key = [sub.task_id, sub.platform, sub.chat_id, sub.thread_id ?? ''];
-          db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(cursor, ...key, cursor);
-          const failures = failed ? Number(sub.delivery_metadata?.failures ?? 0) + 1 : 0;
-          if (failures >= MAX_SEND_FAILURES) db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...key);
-          else if (failures !== Number(sub.delivery_metadata?.failures ?? 0)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures }), ...key);
-          if (task?.status === 'archived' && !failed) db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...key);
-        });
-      }
-    } finally {
-      board.close();
-    }
-  }
-  return sent;
-}
-
-/** A completed card's artifact files: its completion's `artifacts`, then absolute paths its summary or result names that exist. */
-function artifactsOf(payload, task) {
-  const seen = new Set();
-  const out = [];
-  const add = (p) => {
-    const path = String(p ?? '').replace(/^~(?=\/)/, process.env.HOME ?? '~');
-    if (!path.startsWith('/') || seen.has(path)) return;
-    try { if (!statSync(path).isFile()) return; } catch { return; }
-    seen.add(path);
-    out.push(path);
-  };
-  for (const p of Array.isArray(payload.artifacts) ? payload.artifacts : []) add(p);
-  for (const text of [payload.summary, task?.result]) for (const m of String(text ?? '').matchAll(/(?:^|\s)(~?\/[^\s'"`]+\.[A-Za-z0-9]{1,8})/g)) add(m[1]);
-  return out;
-}
-
 // ------------------------------------------------------------------ hooks
 
 // Hermes's lifecycle hooks, from the board's own events (so a change any writer made fires them, Hermes's CLI's too)
@@ -4369,9 +5167,8 @@ function outcomeTicked(body) {
 /** An opened PR asks for the declared review transition once the arc's tasks are closed. */
 // A task written in the card's own Tasks section that did not become a subtask holds its review too.
 /** The arc's session still in a turn: its review, and the close of that session the request brings (end_run), wait for
- *  the turn to end, so work in flight is never cut and the reviewer never starts in the coder's checkout beside a turn
- *  still running there (t_f34710bc's coder had a proof take running when its review was requested at 15:01:13Z on
- *  2026-10-04, and the close ended it). A session the reading cannot place waits on nothing.
+ *  the turn to end so work in flight is never cut. The reviewer owns a separate checkout (ADR 0262); the transition's
+ *  close still must not interrupt the author's turn. A session the reading cannot place waits on nothing.
  *
  *  A Codex session with an active thread goal is never read between turns: the goal starts the next turn the moment one
  *  ends (t_374d7f70, codex 01a108b7, 2026-10-14). For it the turn boundary is the one its harness records: the open turn
@@ -4384,9 +5181,10 @@ async function turnInFlight(board, id, fleet, heldSince = null) {
   if (!fleet?.ok) return null;
   const session = reviewTurnRun(board.db, id)?.metadata?.supercode;
   if (!session?.session_id || session.surface === 'headless' || session.close_requested) return null;
-  let live = fleet.sessions?.find((x) => x.address === addressOf(session)) ?? null;
+  await readNativeHome(session);
+  let live = fleetSessionRow(fleet, session);
   if (live?.turn == null && session.surface === 'native') try {
-    const activity = nativeReading(await readNative(session.machine, session.harness ?? 'claude-code', session.session_id, session.codex_home ?? null), session).row?.activity;
+    const activity = nativeReading(await readNative(session.machine, session.harness ?? 'claude-code', session.session_id, nativeHomes(session)), session).row?.activity;
     live = activity ? { turn: activity.turn ?? null, turn_trigger: activity.evidence?.turn_trigger ?? null, turn_since_ms: activity.evidence?.native_state_since_ms ?? null } : live;
   } catch { /* unread: waits on nothing */ }
   const turn = live?.turn ?? null;
@@ -4409,25 +5207,175 @@ function reviewDueKey(board, id, payload) {
 
 const PASSED_WAITS = 'its review passed and no PR head is unjudged since: no review is due; the arc waits on `complete`';
 
+/** The latest wait recorded for queued review `queued` (`review_queue_waiting`), with its event id, or null. */
+function queueWait(db, id, queued) {
+  const row = latestEvent(db, id, ['review_queue_waiting'], 'id,payload', "json_extract(payload,'$.queued_event')=?", [queued]);
+  return row ? { ...(json(row.payload, {}) ?? {}), event: row.id } : null;
+}
+/** A queued request's PR as discovery last saw it: what a wait on that PR compares. */
+const observedOf = pr => pr ? { state: pr.state ?? null, head: pr.headRefOid ?? null, draft: Boolean(pr.isDraft), base: pr.baseRefName ?? null } : null;
+const sameObservation = (observed, pr) => JSON.stringify(observed ?? null) === JSON.stringify(observedOf(pr));
+// Refusal kinds (ci.mjs) by the input that can change them (ADR 0252).
+const PR_STATE_REFUSALS = new Set(['moved', 'draft', 'state', 'release']);
+const SOURCE_REFUSALS = new Set(['undeclared', 'head', 'unpushed', 'uncommitted']);
+const FINAL_REFUSALS = new Set(['foreign', 'judged']);
+/** What a failed admission waits on (ADR 0252), or `{ refused }` for a request that can never be admitted. */
+async function admissionWait(result, url, seen) {
+  const kinds = Array.isArray(result?.refusals) ? result.refusals.map(refusal => refusal?.kind) : [];
+  if (kinds.some(kind => FINAL_REFUSALS.has(kind))) return { refused: kinds.filter(kind => FINAL_REFUSALS.has(kind)) };
+  if (kinds.length && kinds.every(kind => PR_STATE_REFUSALS.has(kind))) return { on: 'pr', observed: observedOf(seen) };
+  if (kinds.length && kinds.every(kind => PR_STATE_REFUSALS.has(kind) || SOURCE_REFUSALS.has(kind))) return { on: 'source', observed: observedOf(seen) };
+  if (Number(result?.retry_at) > 0) return { on: 'budget', until: Number(result.retry_at) };
+  return { on: 'list', listed_at: url ? await openListObservedAt(url) : 0 };
+}
+/** Whether the one input a recorded wait names has changed since it was recorded. */
+async function waitOver(board, id, wait, url, seen) {
+  if (wait.on === 'pr') return !sameObservation(wait.observed, seen);
+  if (wait.on === 'source') return !sameObservation(wait.observed, seen) || Boolean(view(board, db => redeclaredSince(db, id, wait.event)));
+  if (wait.on === 'budget') return Date.now() >= Number(wait.until);
+  if (wait.on === 'list') return (url ? await openListObservedAt(url) : 0) > Number(wait.listed_at ?? 0);
+  return true;
+}
+function recordQueueWait(db, id, queued, reason, wait) {
+  const prior = queueWait(db, id, queued);
+  const { event: _event, queued_event: _queued, reason: priorReason, ...priorWait } = prior ?? {};
+  if (prior && priorReason === reason && JSON.stringify(priorWait) === JSON.stringify(wait)) return;
+  event(db, id, 'review_queue_waiting', { queued_event: queued, reason, ...wait });
+}
+/** A queued PR that discovery sees merged or closed unmerged is settled once a fresh reading confirms it. */
+async function settleQueuedPullRequest(board, id, url, report) {
+  const confirmed = await discoverPullRequest(url, { fresh: true });
+  const disposition = confirmed.state === 'MERGED' ? 'merged' : confirmed.state === 'CLOSED' ? 'closed' : null;
+  if (!disposition) { report.queued.push([id, `${url} reads ${confirmed.state} on a fresh reading; its queued requests remain pending`]); return; }
+  const settled = tx(board, db => {
+    const ids = [];
+    for (const request of pendingReviewRequests(db, id)) {
+      const named = [].concat(request.pr ?? []);
+      if (named.length !== 1 || prIdentity(named[0]) !== prIdentity(url)) continue;
+      event(db, id, 'review_queue_settled', { queued_event: request.id, disposition, pr: url, head: confirmed.headRefOid });
+      ids.push(request.id);
+    }
+    // a queue settled empty closes the reviewer its last verdict kept (ADR 0019)
+    if (ids.length && !pendingReviewRequests(db, id).length) closeKeptReviewer(db, id);
+    return ids;
+  });
+  if (settled.length) (report.queue_settled ??= []).push([id, url, disposition, settled]);
+}
+
 /** Review selection shared by rounds and read-only inspection (`dry: true`). */
-export async function activatePullRequestReviews(board, entry, report, effects, { only = null, dry = false, fleet = null } = {}) {
+export async function activatePullRequestReviews(board, entry, report, effects, { only = null, dry = false, fleet = null, held = null, lanes = null } = {}) {
+  // Capacity for an arc's next review, from this round's holdings: a queue whose review could not start reads nothing.
+  const caps = held && lanes ? capacity(entry.workflow.dispatch.capacity, held, evaluate) : null;
+  const reviewCapacity = caps ? (db, task) => {
+    const scope = scopeOf(db, board, task, { params: entry.params, lazy: true });
+    const transition = transitionsFor(entry.workflow, statusOf(db, task), 'request_review').find(t => t.target);
+    const target = transition ? String(templateValue(transition.target, scope)) : null;
+    const spec = target ? runSpec(entry, target, task) : null;
+    const profile = spec ? evaluate(entry.workflow.roles?.[spec.role] ?? 'card.assignee', scope) : null;
+    const lane = profile ? lanes[profile] : null;
+    if (!lane) return null;
+    const candidate = { card: task.id, board: board.slug, machine: executionHost(lane, task.machine, localMachine(), normalMachine), assignee: profile,
+      dispatch: true, slot: String(templateValue(spec.session ?? 'worker', scope) ?? 'worker'), status: target, stored: target,
+      model: lane.model ?? held.defaults?.[lane.harness] ?? null, harness: lane.harness ?? null };
+    return caps.admit(candidate, { ...scope, lane, run: { surface: lane.surface, local: candidate.machine === localMachine() } }, [candidate])?.why ?? null;
+  } : null;
   const candidates = view(board, db => db.prepare(`SELECT t.id FROM tasks t JOIN supercode_cards c ON c.task_id=t.id
     WHERE c.subtask_of IS NULL AND c.every IS NULL
     ${only ? 'AND t.id=?' : ''}`).all(...(only ? [only] : [])));
   // Review waits only someone's act clears, and the cards read this round in a state that is no such wait (surfaceReviewStalls)
   const stalls = [], settled = [];
   for (const { id } of candidates) {
+    // The arc's one review queue (ADR 0252), oldest first. Every local check comes before any provider read: the arc's
+    // status and holds, its reviewer free (no review runs), capacity for that review and no native turn in flight. Only
+    // the round that can admit an entry reads it fresh; an entry refused for its PR's own state waits on that
+    // observation and is read again only when discovery sees its PR change (ADR 0247).
+    if (view(board, db => pendingReviewRequests(db, id).length)) {
+      const local = view(board, db => {
+        const task = getTask(db, id);
+        if (!task) return { why: 'the card no longer exists' };
+        const status = statusOf(db, task), card = scopeOf(db, board, task, { params: entry.params, lazy: true }).card;
+        if (status === 'review') return { why: "the arc's review in progress" };
+        if (status !== 'running' || card.backlog || card.dispatch_hold || card.paused || card.blocked_by.length || card.archived) return { why: "the arc's status or holds" };
+        return { task, why: reviewCapacity?.(db, task) ?? null };
+      });
+      const why = local.why ?? (await turnInFlight(board, id, fleet))?.why ?? null;
+      if (why) {
+        report.queued.push([id, `its queued reviews wait on ${why}`]);
+        settled.push(id); continue;
+      }
+      let admitted = false;
+      for (const queued of view(board, db => pendingReviewRequests(db, id))) {
+        await yieldToOwner();
+        if (stopping) return;
+        if (!view(board, db => pendingReviewRequests(db, id).some(row => row.id === queued.id))) continue;
+        const url = [].concat(queued.pr ?? [])[0] ?? null;
+        let seen = null;
+        try { seen = url ? await discoverQueuedPullRequest(url) : null; }
+        catch (error) { report.queued.push([id, `queued review ${queued.id} waits on its PR's observation: ${String(error.message).slice(-200)}`]); continue; }
+        if (seen && ['MERGED', 'CLOSED'].includes(seen.state)) {
+          if (dry) (report.would_settle ??= []).push({ id, pr: url, disposition: seen.state === 'MERGED' ? 'merged' : 'closed' });
+          else await settleQueuedPullRequest(board, id, url, report);
+          continue;
+        }
+        const waiting = view(board, db => queueWait(db, id, queued.id));
+        if (waiting && !await waitOver(board, id, waiting, url, seen)) {
+          report.queued.push([id, `queued review ${queued.id} waits on its ${waiting.on === 'pr' ? 'PR' : waiting.on}: ${waiting.reason}`]);
+          if (['budget', 'list'].includes(waiting.on)) break;
+          continue;
+        }
+        if (dry) {
+          (report.would_review ??= []).push({ id, prs: [].concat(queued.pr ?? []), heads: [].concat(queued.pr_head ?? []), queued_event: queued.id });
+          admitted = true; break;
+        }
+        // The board acts as itself; the request's sender and requester travel in its payload, never as the board's actor.
+        const previousActor = actorOf();
+        let result;
+        try {
+          setActor(boardAddress(board.label));
+          result = await requestReview(board, id, { ...queued, roles: Array.isArray(queued.sender) ? queued.sender : [],
+            requester: queued.requester ?? queued.by ?? null, expectedRunId: local.task.current_run_id, queuedEvent: queued.id });
+        } catch (error) { result = { reason: String(error.message).slice(-300), retry_at: error.retry_at ?? null, refusals: error.refusals ?? null }; }
+        finally { setActor(previousActor); }
+        if (!result.routed && !result.accepted && !result.pending && !result.queued && result.moved && result.to === 'review') {
+          effects.push(...(result.effects ?? []));
+          (report.review_requested ??= []).push({ id, prs: [].concat(queued.pr ?? []), heads: [].concat(queued.pr_head ?? []), queued_event: queued.id });
+          admitted = true; break;
+        }
+        // A failed admission waits on the one input that can change its answer, never on the round; one that can never
+        // be admitted settles refused by name (ADR 0252). A budget or transport wait holds every later request too.
+        const reason = result.reason ?? result.disposition ?? 'its candidate could not be admitted';
+        const wait = await admissionWait(result, url, seen);
+        if (wait.refused) {
+          tx(board, db => {
+            event(db, id, 'review_queue_settled', { queued_event: queued.id, disposition: 'refused', refusals: wait.refused, reason, pr: url });
+            if (!pendingReviewRequests(db, id).length) closeKeptReviewer(db, id);
+          });
+          report.queued.push([id, `queued review ${queued.id} settled refused: ${reason}`]);
+          continue;
+        }
+        report.queued.push([id, `queued review ${queued.id} waits on its ${wait.on === 'pr' ? 'PR' : wait.on}: ${reason}`]);
+        tx(board, db => recordQueueWait(db, id, queued.id, reason, wait));
+        if (['budget', 'list'].includes(wait.on)) break;
+      }
+      settled.push(id);
+      if (admitted) continue;
+      // The final review starts only once nothing is pending.
+      if (view(board, db => pendingReviewRequests(db, id).length)) { report.queued.push([id, 'final review waits on pending PR review requests']); continue; }
+    }
     const eligible = db => {
       const task = getTask(db, id);
       if (!task) return false;
       // a status the platform cannot request a review from needs no scope built to say so
       if (!transitionsFor(entry.workflow, statusOf(db, task), 'request_review').some(t => !t.by || t.by.includes('platform'))) return false;
       const scope = scopeOf(db, board, task, { params: entry.params, lazy: true });
-      if (scope.card.dispatch_hold || scope.card.paused || scope.card.blocked_by.length) return false;
+      if (scope.card.backlog || scope.card.dispatch_hold || scope.card.paused || scope.card.blocked_by.length) return false;
       // A person's card needs no review: it closes on that person's completion.
       if (scope.card.person) return false;
-      // The card's Tasks are its subtasks; an open one holds the review, and says so. A paused one holds nothing.
-      const open = scope.card.subtasks.filter(t => !['done', 'cancelled'].includes(t.status) && !t.paused);
+      // Final review closes recorded work: a taskless card has not planned its work yet, even if its branch has a PR.
+      const subtasks = scope.card.subtasks;
+      if (!subtasks.length) return false;
+      // An open task holds the final review, and says so, paused or not: the review comes when every task is done or cancelled.
+      const open = subtasks.filter(t => !['done', 'cancelled'].includes(t.status));
       return open.length ? open : true;
     };
     const ready = view(board, eligible);
@@ -4460,20 +5408,45 @@ export async function activatePullRequestReviews(board, entry, report, effects,
       }
       // An arc whose every PR merged at the head its PR review passed (`pr_reviewed`) still gets its final review, of its
       // Acceptance against them, once that is due (settledReviewDue).
-      const settledOnly = !payload.no_code && !payload.pr.length && !payload.stacked?.length && Boolean(payload.pr_reviewed?.length);
-      if (settledOnly && !settledReviewDue(board, id)) { report.queued.push([id, passedReview(board, id) ? PASSED_WAITS : `review waits: every PR of the arc (${payload.pr_reviewed.map((p) => p.url).join(', ')}) merged at the head its PR review passed, and no final review is due since its last one`]); continue; }
-      // A PR of the arc proposed to a branch other than main is refused below, whatever the others' verdicts.
-      if (!settledOnly && !payload.no_code && !payload.stacked?.length && !await reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
+      const settledOnly = !payload.no_code && !payload.pr.length && Boolean(payload.pr_reviewed?.length);
+      if (settledOnly && !settledReviewDue(board, id, payload.pr_reviewed)) { report.queued.push([id, passedReview(board, id) ? PASSED_WAITS : `review waits: every PR of the arc (${payload.pr_reviewed.map((p) => p.url).join(', ')}) merged at the head its PR review passed, and no final review is due since its last one`]); continue; }
+      if (!settledOnly && !payload.no_code && !await reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
         // An arc whose last verdict is a pass, with nothing unjudged since, waits on no review: what is left is its
         // session's done request and the manager's or creator's `complete`, and the round says that (volter-org
         // t_b499d0cf and t_a2bd2a5f were logged as waiting for a review every round for hours after theirs passed).
         if (passedReview(board, id)) { report.queued.push([id, PASSED_WAITS]); continue; }
         // a review the manager returned waits on its coder's next pushed head, which the coder is due to push
-        if (returnedReview(board, id)) { report.queued.push([id, 'review waits: the manager returned it from review with no verdict; the next review starts once a pushed PR head changes']); continue; }
-        // a PR whose PR review passed at its head waits on its coder's merge at that head, which settles it
+        if (returnedReview(board, id)) { report.queued.push([id, 'review waits: the manager returned it from review with no verdict; the next review starts once a pushed PR head changes or the arc re-declares its sources']); continue; }
+        // A PR whose PR review passed at its head waits on its coder's merge at that head, which settles it: an act due
+        // from the arc's implementer, whatever its tasks say, so its session is woken and told to merge (tellMergeDue).
+        // Only an arc with no implementer session to tell, or one told MERGE_TOLD_WAIT_SECONDS ago that has not merged,
+        // is the manager's to hear.
         const passedOpen = payload.pr.filter((url, index) => prReviewedHead(board, id, payload.pr_head[index]));
-        const why = passedOpen.length ? `${passedOpen.join(', ')} passed its PR review and waits on its merge at its reviewed head; every other PR head has a verdict, carries the source tree its verdict judged, or predates it`
-          : `every PR head (${payload.pr.join(', ')}) has a verdict, carries the source tree its verdict judged, or predates it; push a commit that changes the source, or close the tasks that own the last verdict's findings`;
+        if (passedOpen.length) {
+          const due = passedOpen.map((url) => { const head = payload.pr_head[payload.pr.indexOf(url)]; return { url, head, ...prDisposition(board,id,url,head) }; });
+          // read first (a dry plan and a round with nothing new to tell write nothing), then file in a write of its own
+          const read = view(board, (db) => mergeDue(db, id, due));
+          const told = read?.address && !read.prior && !dry ? tx(board, (db) => tellMergeDue(db, board, id, due)) : read && { ...read, at: read.prior?.at ?? null };
+          const waiting = due.map(d => `${d.url} passed its PR review and waits on ${d.disposition === 'release-only' ? `its verified release readback on ${d.target}` : 'its merge'} at its reviewed head`).join('; ');
+          if (told?.address && !told.overdue) {
+            report.queued.push([id, `review waits: ${waiting}; its implementer ${told.address} is ${told.now ? 'woken and told' : read.prior ? 'told' : 'to be woken and told'} to settle it`]);
+            if (told.now) (report.merges_told ??= []).push([id, told.address]);
+            settled.push(id);
+            continue;
+          }
+          // The pass ends the reviewer's run in the round's own review step, before startCards gives the implementer its
+          // next run: an arc whose pass is newer than MERGE_TOLD_WAIT_SECONDS with no implementer session yet is waiting
+          // on that start, not on anyone's act.
+          if (!told?.address && now() - lastPrReviewPass(board, id) <= MERGE_TOLD_WAIT_SECONDS) {
+            report.queued.push([id, `review waits: ${waiting}; its implementer's next run is told to settle it once it starts`]);
+            continue;
+          }
+          const why = told?.address ? `${waiting}; its implementer ${told.address} was told to settle it at ${new Date(told.at * 1000).toISOString()} and has not` : `${waiting}; the arc has no implementer session to tell`;
+          report.queued.push([id, `review waits: ${why}`]);
+          if (!dry) stalls.push({ id, key: `merge:${due.map((d) => `${d.url}@${d.head}`).sort().join(' ')}:${told?.address ?? 'none'}`, why: `its review waits: ${why}.` });
+          continue;
+        }
+        const why = `every PR head (${payload.pr.join(', ')}) has a verdict, carries the source tree its verdict judged, or predates it; push a commit that changes the source, or close the tasks that own the last verdict's findings`;
         report.queued.push([id, `review waits: ${why}`]);
         // A verdict other than a pass that nothing answered waits on an act
         stalls.push({ id, key: `verdict:${lastReviewEvent(board, id)}`, why: `its review waits: ${why}. Every task is closed, so no session of the arc is due to act on it.` });
@@ -4503,7 +5476,7 @@ export async function activatePullRequestReviews(board, entry, report, effects,
       if (!dry) await refreshCardInputs(board, id, { commits: true });
       // Cached draft/closed exclusions are useful while waiting, but cannot define a committed review's set.
       const observed = await withFreshReviewReads(async () => {
-        const candidate = await openReviewPullRequests(board, id, { fresh: true, refuseStacked: true, repositories: payload.review_repositories ?? [] })
+        const candidate = await openReviewPullRequests(board, id, { fresh: true, repositories: payload.review_repositories ?? [] })
           ?? (noCodeReviewDue(board, id) ? await noCodeChange(board, id, { fresh: true }) : null);
         const evidence = !candidate || candidate.waits ? null : candidate.no_code
           ? { required: false, ready: true, reason: null, phase: 'source', no_code: candidate.no_code }
@@ -4542,6 +5515,47 @@ export async function activatePullRequestReviews(board, entry, report, effects,
   if (!dry) surfaceReviewStalls(board, entry, stalls, settled, report);
 }
 
+/** How long an implementer told to merge a passed PR has before its arc's wait is the manager's to hear. */
+const MERGE_TOLD_WAIT_SECONDS = 1800;
+/** When the arc's latest PR review pass was recorded (seconds), or 0. */
+const lastPrReviewPass = (board, id) => Number(board.db.prepare("SELECT MAX(created_at) AS at FROM task_events WHERE task_id = ? AND kind = 'pr_review_pass'").get(id)?.at ?? 0);
+
+/**
+ * Who is told that `due` (each a PR and the head its PR review passed) waits on its merge: the arc's current, unended
+ * run's worker that the board has not closed or been asked to close, as a read. `prior` is the telling already filed to
+ * that session for those heads (a `merge_due_told` whose notice was filed, not dropped as not required). Answers
+ * { address, run, key, prior, overdue }, or null when there is no such session.
+ */
+function mergeDue(db, id, due) {
+  const run = currentRun(db, id), session = run?.metadata?.supercode, address = addressOf(session);
+  if (!run || run.ended_at != null || !address || (session.slot ?? 'worker') !== 'worker' || session.close_requested || session.close_confirmed_at || session.released || detachedSession(db, session)) return null;
+  const key = `${due.map((d) => `${d.url}@${d.head}:${d.disposition ?? 'merge'}:${d.event ?? ''}`).sort().join(' ')} ${address}`;
+  const told = db.prepare(`SELECT t.id, t.created_at FROM task_events t WHERE t.task_id = ? AND t.kind = 'merge_due_told' AND json_extract(t.payload, '$.key') = ?
+    AND NOT EXISTS (SELECT 1 FROM task_events n WHERE n.task_id = t.task_id AND n.kind = 'session_notice_not_required' AND n.id > t.id AND json_extract(n.payload, '$.verb') = 'merge_due'
+      AND n.run_id IS t.run_id) ORDER BY t.id DESC LIMIT 1`).get(id, key);
+  const prior = told ? { at: Number(told.created_at) } : null;
+  return { address, run, key, prior, overdue: Boolean(prior) && now() - prior.at > MERGE_TOLD_WAIT_SECONDS };
+}
+
+/**
+ * Tell the arc's implementer session (mergeDue) that `due` waits on its merge at its reviewed heads, in the caller's
+ * transaction: a session notice through the effect queue (sessionNotice files it with a wake), once per set of heads and
+ * session, recorded as `merge_due_told`. Answers { address, at, now, overdue }, or null when there is no such session.
+ */
+function tellMergeDue(db, board, id, due) {
+  const task = getTask(db, id), read = mergeDue(db, id, due);
+  if (!task || !read) return null;
+  if (read.prior) return { address: read.address, at: read.prior.at, now: false, overdue: read.overdue };
+  const lines = due.map((d) => d.disposition === 'release-only'
+    ? `- ${d.url}: its PR review passed at ${d.head}. It is release-only; record the verified release readback for ${d.target} at that head through workflow comment --pr ${d.url} --pr-head ${d.head} --release-target ${d.target} --released-artifact ${d.head} --release-evidence POINTER --reason TEXT (a non-machine target requires the manager's --attest-release). Its release permission is separate.`
+    : `- ${d.url}: its PR review passed at ${d.head}. Merge it at that head now: gh pr merge ${d.url} --merge --match-head-commit ${d.head}`);
+  const text = `${numbered(boardKey(board.root, board.slug), cardNumber(db, id), id, noticeName(task))} ${task.title}: a PR review passed and its reviewed obligation is outstanding.\n${lines.join('\n')}\nOnce every PR is merged or settled by its verified release-only readback and every task is closed, the board starts the arc's final review of its Acceptance.`;
+  const source = event(db, id, 'merge_due_told', { key: read.key, address: read.address, prs: due }, read.run.id);
+  db.prepare('INSERT INTO supercode_effects (effect) VALUES (?)').run(JSON.stringify({ kind: 'session_notice', id, runId: read.run.id, address: read.address, text, sourceEvent: source, verb: 'merge_due',
+    messageKey: `board-merge-due-${id}-${createHash('sha256').update(read.key).digest('hex').slice(0, 16)}` }));
+  return { address: read.address, at: now(), now: true, overdue: false };
+}
+
 /** The id of the arc's last review event (requested, changes requested, passed, voided, returned), or 0: a review wait's key
  *  carries it, so the wait a new verdict or request leaves is a new wait. */
 const lastReviewEvent = (board, id) => board.db.prepare("SELECT MAX(id) AS id FROM task_events WHERE task_id = ? AND kind IN ('review_requested', 'changes_requested', 'review_pass', 'review_voided', 'review_returned')").get(id)?.id ?? 0;
@@ -4601,6 +5615,77 @@ function surfaceReviewStalls(board, entry, stalls, settled, report) {
   });
 }
 
+/** The board's record of each machine whose fleet record reads not current: since when, the error, whether it was told. */
+const FLEET_STALE_KEY = 'fleet_records_stale';
+/**
+ * A machine whose fleet record stays not current reaches the board's manager through the board's own mail
+ * (`board_message`, filed by the delivery pass's fileBoardMail), once per stretch. While its record is not current the
+ * board launches nothing there and checks none of its sessions (readOne, launcherCheck), and before this only the
+ * board's log said why: volter-desktop's record read not current from 09:22:56Z 2026-10-29, and a person noticed about
+ * 20 minutes later.
+ *
+ * A stretch runs across rounds that read the machine not current without a break (a gap longer than an unread clock's,
+ * max(3 × interval, idleQuiet / 2), starts a new one); once it has lasted the board's idle bound (`settings.idleQuiet`,
+ * the same bound an unreadable session turn waits before its unknown diagnostic), the manager is told once, on the oldest open
+ * card that names the machine (its own machine or its current run's), with every such card listed. Nothing is told
+ * again until the machine reads current (which ends the stretch) and a new stretch lasts the bound. A machine no open
+ * card names is kept untold. A round that read no fleet (no pane lanes) neither tells nor ends a stretch.
+ * A reading this machine's daemon did not give at all (`fleet.ok` false: every machine reads unknown with that one
+ * local error) is one stretch, this machine's, told once with every open card that names any machine; the other
+ * machines' stretches are kept as they stood, neither told nor ended by it.
+ */
+export function surfaceStaleRecords(board, entry, fleet, settings, report) {
+  const to = [].concat(entry.params.managers ?? []).find(Boolean);
+  if (!to || !(fleet?.unknown instanceof Set)) return;
+  const at = now(), gap = Math.max(3 * settings.interval, settings.idleQuiet / 2);
+  let stored = {};
+  // a board that never kept state has no table yet: it holds no stretch
+  try { stored = view(board, (db) => json(db.prepare('SELECT value FROM supercode_board_state WHERE key = ?').get(FLEET_STALE_KEY)?.value, null)) ?? {}; } catch { /* none kept */ }
+  const local = localMachine(), whole = fleet.ok === false;
+  if (!whole && !fleet.unknown.size && !Object.keys(stored).length) return;
+  const next = {}, due = [];
+  // no reading at all: this machine's daemon is the one stretch; the others' stretches stand as they were, read again
+  // (their seen_at moves on), so an outage longer than the gap neither restarts them nor tells them twice
+  if (whole) for (const [machine, kept] of Object.entries(stored)) if (machine !== local) next[machine] = { ...kept, seen_at: at };
+  for (const machine of whole ? [local] : fleet.unknown) {
+    const kept = stored[machine];
+    const since = kept && at - Number(kept.seen_at) <= gap && Number(kept.since) > 0 ? Number(kept.since) : at;
+    const error = String((whole ? fleet.error : fleet.errors?.get(machine)) ?? fleet.error ?? 'no current record').split('\n')[0].slice(0, 300);
+    // a stretch that changes kind (no reading at all, then this machine's own record not current) keeps its clock (the
+    // machine was never current) but not its telling: what is told now is a different failure
+    const told = kept?.told_at && Number(kept.since) === since && Boolean(kept.whole) === whole && Boolean(kept.targets) === Boolean(whole && fleet.targetsUnread);
+    next[machine] = { since, seen_at: at, error, ...(whole ? { whole: true } : {}), ...(whole && fleet.targetsUnread ? { targets: true } : {}), ...(told ? { told_at: kept.told_at, told_on: kept.told_on } : {}) };
+    if (!next[machine].told_at && at - since >= settings.idleQuiet) due.push(machine);
+  }
+  const iso = (seconds) => new Date(seconds * 1000).toISOString().replace(/\.\d{3}Z$/, 'Z');
+  tx(board, (db) => {
+    db.exec('CREATE TABLE IF NOT EXISTS supercode_board_state (key TEXT PRIMARY KEY, value TEXT)');
+    const open = db.prepare(`SELECT t.id, t.current_run_id, c.machine FROM tasks t JOIN supercode_cards c ON c.task_id = t.id
+      WHERE c.subtask_of IS NULL AND NOT COALESCE(c.archived, 0) AND t.status NOT IN ('done', 'cancelled', 'archived') ORDER BY t.created_at, t.id`).all();
+    for (const machine of due) {
+      const runMachine = (card) => card.current_run_id ? currentRun(db, card.id)?.metadata?.supercode?.machine ?? null : null;
+      // this machine's daemon gave no reading: every card that names a machine waits on it
+      const cards = open.filter((card) => next[machine].whole ? Boolean(card.machine || runMachine(card))
+        : (card.machine && normalMachine(card.machine) === machine) || normalMachine(runMachine(card) ?? '') === machine);
+      if (!cards.length) continue;
+      const stale = next[machine], minutes = Math.round((at - stale.since) / 60);
+      const names = cards.map((card) => { const task = getTask(db, card.id); return numbered(boardKey(board.root, board.slug), task?.number, card.id, noticeName(task)); });
+      event(db, cards[0].id, 'board_message', { to, fleet_stale: `${machine}:${stale.since}`,
+        text: stale.targets
+          ? `The board could not read its fleet targets since ${iso(stale.since)} (${minutes} min): ${stale.error}. Every machine reads not current: until a reading completes, the board launches nothing and checks no session anywhere. Open cards on machines: ${names.slice(0, 20).join(', ')}${names.length > 20 ? `, and ${names.length - 20} more` : ''}.`
+          : stale.whole
+          ? `This machine's (${machine}) daemon has given no fleet records since ${iso(stale.since)} (${minutes} min): ${stale.error}. Every machine reads not current: until it answers, the board launches nothing and checks no session anywhere. Open cards on machines: ${names.slice(0, 20).join(', ')}${names.length > 20 ? `, and ${names.length - 20} more` : ''}. Told once for this stretch.`
+          : `Machine ${machine}'s fleet record has not been current since ${iso(stale.since)} (${minutes} min): ${stale.error}. Until it is, the board launches nothing there and checks none of its sessions. Open cards on it: ${names.slice(0, 20).join(', ')}${names.length > 20 ? `, and ${names.length - 20} more` : ''}. Told once for this stretch.` }, null);
+      Object.assign(stale, { told_at: at, told_on: cards[0].id });
+      (report.fleet_records_told ??= []).push([machine, iso(stale.since), cards[0].id]);
+    }
+    db.prepare('INSERT INTO supercode_board_state (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(FLEET_STALE_KEY, JSON.stringify(next));
+  });
+  const stretches = Object.entries(next);
+  if (stretches.length) report.fleet_records_stale = stretches.map(([machine, stale]) => [machine, iso(stale.since), stale.told_at ? 'told' : 'untold', stale.error]);
+  for (const machine of Object.keys(stored)) if (!next[machine] || (stored[machine].whole && !next[machine].whole)) (report.fleet_records_current ??= []).push(machine);
+}
+
 /**
  * A cap's max for one of its groups, for the capacity view: what a card in that group would be held to. A max read
  * from the card or its lane (a machine's or a profile's own capacity) is evaluated for that group's machine or profile.
@@ -4621,8 +5706,14 @@ const deliveries = new Map();
 export function startDelivery(root, { slugs = null, log = () => {} } = {}) {
   // the controller's delivery pass, run here by the owner (no process of its own), never two at once for a home; the
   // round never waits for it
-  if (deliveries.has(root)) return false;
-  const pass = ownCall(() => deliver({ root, slugs, controller: true }), 'a delivery pass').then((reports) => {
+  // Every pass is recorded, fast ones included (its start, end, duration and steps), and so is a round that started
+  // none because one still ran: a delivery bar is read from these rows, never from the round count.
+  if (deliveries.has(root)) {
+    recordSlow({ kind: 'call', name: 'board delivery pass skipped', ms: 0, includeFast: true, extra: { running_since: deliveries.get(root).started } });
+    return false;
+  }
+  const started = new Date().toISOString();
+  const pass = timed('board delivery pass', () => ownCall(() => deliver({ root, slugs, controller: true }), 'a delivery pass'), { scope: 'delivery', includeFast: true }).then((reports) => {
     for (const r of reports) {
       if (r.error) log('warn', `delivery on board ${r.board} failed: ${r.error}`);
       for (const [task, to, why] of r.undelivered ?? []) log('warn', `board ${r.board}: a delivery for ${task} to ${to} waits: ${why}`);
@@ -4630,7 +5721,7 @@ export function startDelivery(root, { slugs = null, log = () => {} } = {}) {
       log('info', `delivery on board ${r.board}: ${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good; took ${Object.entries(r.ms ?? {}).map(([k, v]) => `${k} ${(v / 1000).toFixed(1)}s`).join(', ')}`);
     }
   }, (error) => error?.code === GENERATION_STOPPED ? log('info', `delivery pass not run: ${error.message}`) : log('warn', `delivery pass failed: ${error?.message ?? error}`)).finally(() => deliveries.delete(root));
-  deliveries.set(root, pass);
+  deliveries.set(root, { pass, started });
   return true;
 }
 
@@ -4660,28 +5751,27 @@ export async function deliver({ root, slugs = null, controller = false }) {
   const entry = await loadWorkflow(root);
   // the owner's controller delivers only for boards whose dispatching is on, read as each board is reached (a pass
   // already under way when a board is switched off leaves it); `workflow deliver`, an operator's act, delivers as asked
-  const boards = (slugs ?? listBoards(root)).filter((slug) => !controller || dispatchingOf(root, slug).on);
+  const boards = slugs ?? listBoards(root);
   if (!boards.length) return [];
   const fleet = await observeFleet();
   fleet.noticeAlive = await noticeSessions();
   const out = [];
   for (const slug of boards) {
-    if (controller && !dispatchingOf(root, slug).on) continue;
     const report = { board: slug, ms: {}, mailed: [], queued: [], failed: [], notified: [], undelivered: [], fleet: fleet.ok ? 'read' : fleet.error };
     let board;
     try {
       board = openBoard(root, slug);
       board.label = boardLabel(root, slug);
       setActor(boardAddress(board.label));
-      let mark = Date.now();
-      const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; roundStep(`${slug} ${name}`); };
+      const phase = phaseClock(report, `delivery ${slug}`);
       // board mail and notices are filed in their receivers' mailboxes (local writes); the mailbox delivers them
       // a controller's pass reads the board's switch before each phase and each effect: switched off meanwhile, what had
       // not begun is left (an operator's `workflow deliver` delivers as asked)
       const on = () => !controller || dispatchingOf(root, slug).on;
       if (on()) { await fileBoardMail(board, report); phase('mail'); }
       if (on()) { report.effects = await runEffects(board, [], { pending: true, eligible: controller ? on : null }); phase('effects'); }
-      if (on()) { await notify(board, fleet, report, entry); phase('notify'); }
+      // A due resume is announced even with dispatching off. This read/delivery never launches work.
+      await notify(board, fleet, report, entry); phase('notify');
       if (on()) { await synchronizeAgents(board, report, fleet); phase('agents'); }
       report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
       report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);
@@ -4702,6 +5792,7 @@ export async function deliver({ root, slugs = null, controller = false }) {
 export async function closeEnded({ root, slugs, settings }) {
   fleetRoot = root;
   if (stopping || !slugs.length || boardCopyOf({ root })) return [];
+  const entry = await loadWorkflow(root);
   // a session's native discovery is read once a pass, as once a round (readNative)
   discoveries.clear();
   // the fleet reading settles a launch that never bound a pane; one unread leaves that close waiting, as a round's does
@@ -4718,6 +5809,10 @@ export async function closeEnded({ root, slugs, settings }) {
       board = openBoard(root, slug);
       board.label = boardLabel(root, slug);
       setActor(boardAddress(board.label));
+      const expiry = tx(board, db => { const effects = []; const count = settleExpiringFlags(db, board, entry, effects); return { effects, count }; });
+      queueEffects(board, expiry.effects);
+      report.resumed = expiry.count;
+      report.next_pause_at = nextFlagExpiry(board.db, entry);
       await closeRequested(board, report, { ttl: settings.ttl, fleet });
     } catch (error) { report.error = error.message; }
     finally { board?.close(); }
@@ -4750,21 +5845,35 @@ export async function closeEnded({ root, slugs, settings }) {
 // nothing settles is not. It is the round's own: a card verb this process answers meanwhile says nothing of it.
 const roundProgress = new AsyncLocalStorage();
 const roundStep = (step) => { try { roundProgress.getStore()?.(step); } catch { /* the round goes on unsaid */ } };
+const phaseClock = (report, prefix) => {
+  let mark = performance.now();
+  return (name) => {
+    const ended = performance.now(), ms = ended - mark;
+    report.ms[name] = Math.round(ms); mark = ended;
+    noteStep(`${prefix}: ${name}`, ms);
+    roundStep(`${report.board ?? 'home'} ${name}`);
+  };
+};
 export function tick({ progress = null, ...options }) {
   return roundProgress.run(progress, () => boardRound(options));
 }
 async function boardRound({ root, lanes, settings, only = null, slugs = null, dispatch = true, params = {}, deploymentReceipt = false }) {
+    return measureWork("pass", "board.round", async () => {
   fleetRoot = root;
   discoveries.clear();
+  const preparation = { ms: {} }, preparedPhase = phaseClock(preparation, 'dispatch home');
   // a verb's flags (dispatch --max, --failure-limit) are params of this tick, read by the workflow as its own
   const deployment = deploymentReceipt ? await workflowRevision(root) : null;
   const loaded = await loadWorkflow(root);
   const entry = { ...loaded, params: { ...loaded.params, ...params } };
+  preparedPhase('workflow');
   const needFleet = Object.values(lanes).some((l) => l.surface === 'pane');
-  const fleetAt = Date.now();
-  const fleet = needFleet ? await untilParked(observeFleet(), () => null) : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
-  const fleetMs = Date.now() - fleetAt;
-  roundStep('the fleet read');
+  // An unread fleet is one of the round's inputs, as the delivery pass reads it: what needs it waits, the rest runs
+  // (ADR-0247), and its stretch is told once with its reason (surfaceStaleRecords' whole-outage path).
+  const fleet = needFleet
+    ? await untilParked(observeFleet(), () => null).catch((error) => ({ ok: false, alive: new Set(), online: new Set(), unknown: new Set(), sessions: [], error: error.message, targetsUnread: error.fleetTargetsUnread === true }))
+    : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
+  preparedPhase('fleet');
   // A park (stopDispatching) ends the round at its next step, not at its end: the successor's first round does the rest,
   // and every act re-reads its basis in its own transaction, so a round cut between steps leaves nothing half done. A
   // round that only read has nothing to keep; one that moved cards keeps the effects those moves asked for (queueEffects
@@ -4772,21 +5881,24 @@ async function boardRound({ root, lanes, settings, only = null, slugs = null, di
   // owner's 8 s wait for 'parked', and the handover rolled back (VO-3578, pin V, 21:53Z).
   if (stopping) return cutRound([]);
   await readMemoryPressure();
+  preparedPhase('memory');
   const boards = slugs ?? listBoards(root);
   // what every board of the home holds, for caps whose scope is the whole home (kanban.max_in_progress counts so): every
   // board, including one whose dispatching is off, whose live workers still hold their places
   const held = dispatch ? await homeHoldings(root, listBoards(root), lanes, fleet, entry) : [];
+  preparedPhase('holdings');
   if (stopping) return cutRound([]);
   const out = [];
   for (const slug of boards) {
     if (stopping) break;
-    const report = { board: slug, ms: { fleet: fleetMs }, mailed: [], started: [], queued: [], failed: [], lost: [], crashed: [], timed_out: [], reclaimed: [], auto_blocked: [], promoted: 0, unassigned: [], nonspawnable: [], notified: [], undelivered: [], fleet: fleet.ok ? 'read' : fleet.error };
+    const report = { board: slug, ms: { ...preparation.ms }, mailed: [], started: [], queued: [], failed: [], lost: [], crashed: [], timed_out: [], reclaimed: [], auto_blocked: [], promoted: 0, unassigned: [], nonspawnable: [], notified: [], undelivered: [], fleet: fleet.ok ? 'read' : fleet.error };
     const path = boardPath(root, slug);
     const marker = `${path}.corrupt-seen`;
     if (existsSync(marker) && readFileSync(marker, 'utf8').trim() === fingerprint(path)) { report.error = 'skipped: the board file was corrupt and has not changed since (`supercode workflow repair`)'; out.push(report); continue; }
     // a copy of a home dispatches nothing: its runs, sessions and managers are the original's
     if (boardCopyOf({ root })) { report.error = `skipped: ${copyRefusal({ root }, 'starts, supervises, adopts and mails nothing').message}`; out.push(report); continue; }
     let board;
+    const phase = phaseClock(report, `dispatch ${slug}`);
     try {
       board = openBoard(root, slug);
       board.label = boardLabel(root, slug);
@@ -4795,9 +5907,7 @@ async function boardRound({ root, lanes, settings, only = null, slugs = null, di
       try { board.publishPending?.(); } catch (error) { report.queued.push(['board document', `push pending: ${error.message}`]); }
       // what the dispatcher records on its own is the board's act
       setActor(boardAddress(board.label));
-      // where the tick's time goes, phase by phase (ms), printed by `serve --verbose` and in `--json`
-      let mark = Date.now();
-      const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
+      phase('open');
 
       // each step after a park is skipped (above); the effects of what moved are still recorded (queueEffects)
       const going = () => !stopping;
@@ -4806,28 +5916,42 @@ async function boardRound({ root, lanes, settings, only = null, slugs = null, di
       const effects = [];
       if (going()) await completeAdoptions(board, fleet, settings, report); if (going()) await reconnectContinuedSessions(board, fleet, entry, report); if (going()) await reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); if (going()) await recordBounces(board, fleet, entry, report); if (going()) await supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); if (going()) await closeRequested(board, report, { ttl: settings.ttl, fleet }); phase('supervise');
       report.unsettled = [];
+      const startAt = Date.now();
       report.promoted = recomputeReady(board, effects, report.unsettled);
+      report.next_pause_at = nextFlagExpiry(board.db, entry);
       tx(board,db=>auditEndedRuns(db,board,entry));
-      if (dispatch && going()) await activatePullRequestReviews(board, entry, report, effects, { only, fleet });
+      phase('start_settle');
+      if (dispatch && going()) await activatePullRequestReviews(board, entry, report, effects, { only, fleet, held, lanes });
+      phase('start_reviews');
       if (dispatch && going()) await startCards(board, fleet, lanes, settings, report, entry, effects, { only, held });
-      phase('start');
+      phase('start_cards');
+      report.ms.start = Date.now() - startAt;
+      const idleAt = Date.now();
       if (dispatch && !only && !report.paused && going()) await observeIdle(board, fleet, settings, report, entry, effects);
-      if (dispatch && !only && !report.paused && going()) retellBriefs(board, entry, report);
+      phase('idle_sessions');
+      if (dispatch && !only && !report.paused && going()) await retellBriefs(board, entry, report);
+      phase('idle_briefs');
+      if (dispatch && !only && going()) surfaceStaleRecords(board, entry, fleet, settings, report);
       // what the moves asked for is recorded with them; the delivery pass (`deliver`) carries it out, outside the round
       queueEffects(board, effects);
-      phase('idle');
-      ensureSubscriptions(board, entry);
+      phase('idle_notices');
+      report.ms.idle = Date.now() - idleAt;
+      if (going()) await ensureSubscriptions(board, entry);
+      phase('subscriptions');
       fireHooks(board, settings, report);
       if (String(board.db.prepare('PRAGMA journal_mode').get()?.journal_mode).toLowerCase() === 'wal') board.db.prepare('PRAGMA wal_checkpoint(PASSIVE)').get();
       report.ready_waiting = Number(board.db.prepare("SELECT COUNT(*) AS n FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id WHERE t.status = 'ready' AND t.assignee IS NOT NULL AND c.subtask_of IS NULL").get().n);
       // what a Hermes gateway serves around its dispatcher and this one does not: said by the caller
       report.chat_subscriptions = Number(board.db.prepare("SELECT COUNT(*) AS n FROM kanban_notify_subs WHERE platform != 'supercode'").get().n);
       if (existsSync(marker)) unlinkSync(marker);
+      phase('finalize');
     } catch (error) {
+      phase('refused');
       report.error = error.message;
       if (CORRUPT.test(error.message)) writeFileSync(marker, fingerprint(path));
     } finally {
       board?.close();
+      phase('close');
     }
     out.push(report);
   }
@@ -4837,4 +5961,7 @@ async function boardRound({ root, lanes, settings, only = null, slugs = null, di
     if (receipt && out[0]) out[0].deployment = receipt;
   }
   return out;
-}
+
+
+    });
+  }