@volter/supercode-orchestrator 0.5.23 → 0.5.24

package/agents.mjs

@@ -31,6 +31,7 @@ function store(root){
   mkdirSync(root,{recursive:true,mode:0o700});const db=new DatabaseSync(join(root,'agent-state.sqlite'));
   db.exec(`PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL;
   CREATE TABLE IF NOT EXISTS agent_intents(org TEXT NOT NULL,id TEXT NOT NULL,key TEXT NOT NULL,profile_ref TEXT NOT NULL,profile_json TEXT NOT NULL,declared INTEGER NOT NULL DEFAULT 0,declaration_json TEXT,created_at INTEGER NOT NULL,PRIMARY KEY(org,id),UNIQUE(org,key));
+  CREATE TABLE IF NOT EXISTS agent_run_retries(org TEXT NOT NULL,agent_id TEXT NOT NULL,session_ref TEXT NOT NULL,next_at INTEGER NOT NULL,wait_ms INTEGER NOT NULL,PRIMARY KEY(org,agent_id,session_ref));
   CREATE TABLE IF NOT EXISTS agent_declaration_heads(org TEXT NOT NULL,key TEXT NOT NULL,agent_id TEXT NOT NULL,generation INTEGER NOT NULL DEFAULT 0,PRIMARY KEY(org,key));
   CREATE TABLE IF NOT EXISTS agent_assignments(org TEXT NOT NULL,id TEXT NOT NULL,agent_id TEXT NOT NULL,kind TEXT NOT NULL,target TEXT NOT NULL,role TEXT NOT NULL,state TEXT NOT NULL,started_at INTEGER NOT NULL,ended_at INTEGER,PRIMARY KEY(org,id));
   CREATE INDEX IF NOT EXISTS agent_active_assignments ON agent_assignments(org,agent_id,state);
@@ -371,15 +372,22 @@ export function recordNativeAgentSession(root,runtimeRef,session) {
 // is asked again after a growing wait (two minutes, doubling to an hour), not every round: each ask spends the shared
 // credential's allowance. Anything else (the rate limit, a timeout, a 5xx, the local daemon's bind of a session just
 // spawned) is not the run's own and is asked again next round.
-const runRetry=new Map();
-const retryKey=(org,row)=>`${org}/${row.agent_id}/${row.session_ref}`;
+// The wait is kept in this home's agent store, not in the asking process: a one-shot `workflow dispatch` asked again
+// on every run when each process kept its own, and every ask spends the shared credential's allowance.
+const retryOf=(root,org,row)=>{const db=store(root);try{return db.prepare('SELECT next_at,wait_ms FROM agent_run_retries WHERE org=? AND agent_id=? AND session_ref=?').get(org,row.agent_id,row.session_ref)??null;}finally{db.close();}};
 const refused=error=>error?.status>=400&&error.status<500&&error.status!==408&&error.status!==429;
 export function synchronizeAgentRun(root,org,row,{context,intended}={}) {
-  try{const answer=joinAgentRun(root,org,row,{context,intended});runRetry.delete(retryKey(org,row));return answer;}
+  let answer;
+  try{answer=joinAgentRun(root,org,row,{context,intended});}
   catch(error){
-    if(error?.claimRefused){const wait=Math.min((runRetry.get(retryKey(org,row))?.wait??60000)*2,3600000);runRetry.set(retryKey(org,row),{at:Date.now()+wait,wait});}
+    if(error?.claimRefused){
+      const wait=Math.min((retryOf(root,org,row)?.wait_ms??60000)*2,3600000),db=store(root);
+      try{db.prepare('INSERT INTO agent_run_retries(org,agent_id,session_ref,next_at,wait_ms) VALUES (?,?,?,?,?) ON CONFLICT(org,agent_id,session_ref) DO UPDATE SET next_at=excluded.next_at,wait_ms=excluded.wait_ms').run(org,row.agent_id,row.session_ref,Date.now()+wait,wait);}finally{db.close();}
+    }
     throw error;
   }
+  const db=store(root);try{db.prepare('DELETE FROM agent_run_retries WHERE org=? AND agent_id=? AND session_ref=?').run(org,row.agent_id,row.session_ref);}finally{db.close();}
+  return answer;
 }
 function joinAgentRun(root,org,row,{context,intended}) {
   const claim=(...args)=>{try{return agentDoor(...args);}catch(error){throw Object.assign(error,{claimRefused:refused(error)});}};
@@ -398,7 +406,7 @@ export function recordAgentRun(root,org,id,{session,machine=null,run,profile=nul
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
 }
-export function pendingAgentRuns(root,org){const db=store(root);try{return db.prepare('SELECT * FROM agent_runs WHERE org=? AND published=0 ORDER BY rowid LIMIT 100').all(org).filter(row=>!(runRetry.get(retryKey(org,row))?.at>Date.now()));}finally{db.close();}}
+export function pendingAgentRuns(root,org){const db=store(root);try{return db.prepare('SELECT * FROM agent_runs WHERE org=? AND published=0 ORDER BY rowid LIMIT 100').all(org).filter(row=>!(retryOf(root,org,row)?.next_at>Date.now()));}finally{db.close();}}
 /** Session references come from the bound runtime, never from a model's requested agent id. */
 export function agentRunForSession(root, references) {
   const db = store(root);
@@ -444,6 +452,8 @@ export function runBudgetRefusal(root,agent,budgets,now){
   }
   return null;
 }
+/** A run whose session Teams never had and that no longer runs here can never be owned there: it leaves the sync. */
+export function abandonAgentRun(root,org,session){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=2 WHERE org=? AND session_ref=? AND published=0').run(org,session);db.prepare('DELETE FROM agent_run_retries WHERE org=? AND session_ref=?').run(org,session);}finally{db.close();}}
 export function publishAgentRun(root,org,session){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=1 WHERE org=? AND session_ref=?').run(org,session);}finally{db.close();}}
 export function agentPreamble(agent,{main=true,previous=[]}={}){
   const {identity:a,intended,assignments=[]}=agent;

package/board/ci.mjs

@@ -47,6 +47,35 @@ const pullRequest = (repository, p) => ({ url: p.html_url, number: p.number, sta
   headRefName: p.head.ref, baseRefName: p.base.ref, defaultBranch: p.base.repo?.default_branch ?? null, isCrossRepository: p.head.repo?.full_name?.toLowerCase() !== repository.toLowerCase(), isDraft: Boolean(p.draft) });
 const readPullRequest = (url) => pullRequest(repositoryOf(url), github(`/repos/${repositoryOf(url)}/pulls/${numberOf(url)}`));
 
+const GITHUB_MERGE = `
+const [path, sha] = process.argv.slice(1);
+const base = (process.env.GITHUB_API_URL || 'https://api.github.com').replace(/\\/$/, '');
+const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+const r = await fetch(base + path, { method: 'PUT', headers: { accept: 'application/vnd.github+json', 'content-type': 'application/json', 'user-agent': 'supercode-board', ...(token ? { authorization: 'Bearer ' + token } : {}) }, body: JSON.stringify({ sha, merge_method: 'merge' }) });
+const text = await r.text();
+process.stdout.write(JSON.stringify({ status: r.status, body: (() => { try { return JSON.parse(text); } catch { return { message: text.slice(0, 300) }; } })() }));`;
+/**
+ * Merge a reviewed PR at the head its review judged, and only there: GitHub refuses the merge when the PR's head is no
+ * longer that commit (409), so a head pushed after the verdict is never merged unreviewed. Answers
+ * `{ merged, sha }` (already merged answers its merge commit), `{ moved, head }` when the head is not the reviewed one,
+ * or throws on anything GitHub did not decide (the caller tries again).
+ */
+export function mergeReviewedPullRequest(url, reviewed) {
+  const pr = github(`/repos/${repositoryOf(url)}/pulls/${numberOf(url)}`);
+  if (pr.merged_at) return { merged: true, sha: pr.merge_commit_sha, already: true };
+  if (pr.head?.sha !== reviewed) return { moved: true, head: pr.head?.sha ?? null };
+  if (String(pr.state).toLowerCase() !== 'open') return { closed: true };
+  const fixed = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || null;
+  if (!fixed && !loginToken) try { loginToken = run('gh', ['auth', 'token']) || null; } catch { loginToken = null; }
+  const token = fixed ?? loginToken;
+  const result = spawnSync(process.execPath, ['--input-type=module', '-e', GITHUB_MERGE, `/repos/${repositoryOf(url)}/pulls/${numberOf(url)}/merge`, reviewed], { env: token ? { ...process.env, GH_TOKEN: token } : process.env, encoding: 'utf8', timeout: 60_000 });
+  if (result.status !== 0) throw new Error(`GitHub merge: ${(result.stderr || result.error?.message || 'failed').trim().slice(-300)}`);
+  const answer = JSON.parse(result.stdout);
+  if (answer.status === 200 && answer.body?.merged) return { merged: true, sha: answer.body.sha };
+  if (answer.status === 409) return { moved: true, head: null, message: answer.body?.message ?? null };
+  throw new Error(`GitHub merge ${answer.status}: ${answer.body?.message ?? 'not merged'}`);
+}
+
 const observations = new Map();
 const key = (board, id) => `${board.root}\0${board.slug}\0${id}`;
 const run = (program, args, cwd) => {

package/board/cli.mjs

@@ -14,7 +14,7 @@ import { actorOf, view, backingPaths, layOut, backingOf, boardExists, boardPath,
 import { isLocalWorkspace } from './workspace.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
-import { requestAdoption, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, supercodeBin, tick } from './dispatch.mjs';
+import { requestAdoption, alertManagers, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, supercodeBin, tick } from './dispatch.mjs';
 import { watchBoard } from './wake.mjs';
 import { streamBoardPublications } from './event-stream.mjs';
 import { completionOwnerOf, isLatestReviewer, loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
@@ -23,7 +23,7 @@ import { agentDoor,agentScope,activeAgentAssignments,reassignAgent,agentUsage,lo
 
 const HELP = `supercode workflow <verb> [--root <home>] [--board <slug>] [--json]
 
-Hermes Kanban's verbs, with their flags:
+The board's verbs, with their flags:
   init [--backing sqlite|files|ztrack] [--document <arcs.md>]
   migrate --backing ztrack --document <arcs.md> --status-map <json>
   boards list|create|rm|switch|show|rename|set-default-workdir|export|import
@@ -38,28 +38,28 @@ Hermes Kanban's verbs, with their flags:
   comment <id> <text> [--author] [--max-len]   attach <id> <path> [--name] [--content-type]   attachments <id>   attach-rm <n>
   complete <id>... [--result] [--summary] [--metadata JSON]   edit <id> --result [--summary] [--metadata]
   block <id> [reason] (--on <card> | --waiting-on <message id>) [--ids ...]   schedule <id> [reason] [--ids ...]
-  pause <id> --reason <why>   resume <id>   cancel <id>
+  pause <id> --reason <why>   resume <id>   cancel <id> --reason <why>
   request-state <id> --state block|pause|done|cancelled --reason <why> [--on <card>|--waiting-on <message>] [--evidence <pointers>]
   unblock <id>... --on <blocker> --reason <what arrived>   request-review <id> (--pr URL --pr-head SHA)... [--summary] [--reviewer] [--force]   request-changes <id> <reason> [--finding <finding>]...   reopen-review <id>...   reopen <id>... [--reason]
-  promote <id> [reason] [--ids ...] [--force] [--dry-run]   archive <id>... [--rm <id>...]
+  promote <id> [reason] [--ids ...] [--force] [--dry-run]   archive <id>... --reason <why> [--rm <id>...]
   specify <id> [--title --body] [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch NAME] [--machine M|none] [--all]
   decompose <id> [--child "<title>[@<profile>]"]... [--all]
   diagnostics [--task] [--severity]   stats   assignees   log <id> [--tail N]   tail <id>   watch [--assignee] [--kinds]
   notify-subscribe <id> --platform P --chat-id C [--thread-id]   notify-list [<id>]   notify-unsubscribe <id> --platform P --chat-id C
   capacity   (each cap's count against its max, and why each card waits; docs/adr/0009-board-capacity.md)
   dispatch [--dry-run] [--max N] [--failure-limit N]   daemon [--interval S] [--max N] [--failure-limit N] [--pidfile F] [--verbose]   gc [--event-retention-days] [--log-retention-days]   repair
-  pause [reason] · resume   (Hermes's emergency stop, the ESTOP file: new starts stop, running sessions go on)
+  pause [reason] · resume   (the board's emergency stop: new starts stop, running sessions go on)
 
-supercode's own:
+And:
   events [--after <cursor>] [--once] --json
       Native retained card snapshots, then committed changes; a changed source requests resynchronization.
   usage [--agent AGENT] [--sponsor PERSON] [--json]
       Tokens each agent's ended card sessions recorded (the harness's own records), per model, summed on its sponsor.
   init --backing sqlite|files · boards create <slug>
-      Where the Org's one task store is kept: sqlite is Hermes's kanban.db (the default); files is one JSON file per
+      Where the Org's one task store is kept: sqlite is one database file, kanban.db (the default); files is one JSON file per
       card. A board is a saved view over that store: the cards carrying its slug as a tag (create --tag, tag/untag).
   create … --tag T… --sponsor PERSON | --requested-by <platform>:<user> [--request <message ref>]
-      Tags are ordered (Hermes's tenant is the first). A proven requester sponsors the card with the request as
+      Tags are ordered (the first is the tenant). A proven requester sponsors the card with the request as
       evidence; an unproven one is recorded as requested by (unverified) and the sponsor stays inherited.
   tag <id> <tag>…   untag <id> <tag>…
   create … --machine M --subtask-of ARC --notify ADDRESS|--no-notify --no-start
@@ -297,11 +297,40 @@ const metadataOf = (v) => {
   return got;
 };
 
+/**
+ * Every workflow call says when this orchestrator is not the published release: a build no release names (a hand
+ * install of a branch) or one older than npm's latest. Action is required until it is installed; the latest is read
+ * from the registry at most once an hour.
+ */
+function sayReleaseBehind() {
+  let running;
+  try { running = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version; } catch { return; }
+  const cache = join(tmpdir(), 'supercode-orchestrator-latest.json');
+  let latest = null;
+  let fresh = false;
+  try { const seen = JSON.parse(readFileSync(cache, 'utf8')); if (Date.now() - seen.at < 3_600_000) { fresh = true; latest = seen.latest; } } catch { /* read below */ }
+  if (!fresh) {
+    // a failed read is kept for the hour too: offline, no call waits on the registry more than once an hour
+    const r = spawnSync('npm', ['view', '@volter/supercode-orchestrator', 'version'], { encoding: 'utf8', timeout: 5000 });
+    latest = r.status === 0 ? r.stdout.trim() || null : null;
+    try { writeFileSync(cache, JSON.stringify({ at: Date.now(), latest })); } catch { /* read again next call */ }
+  }
+  if (!latest || running === latest) return;
+  const parts = (v) => v.split('-')[0].split('.').map(Number);
+  const [a, b] = [parts(running), parts(latest)];
+  const older = a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+  const fix = `npm install -g @volter/supercode-orchestrator@${latest} (and each install's pinned copy)`;
+  if (running.includes('-')) process.stderr.write(`board: error: orchestrator ${running} is not a published release (latest ${latest}); action required: ${fix}\n`);
+  else if (older < 0) process.stderr.write(`board: error: orchestrator ${running} is behind the published ${latest}; action required: ${fix}\n`);
+}
+
 export async function runWorkflow(argv) {
   const args = parse(argv);
   const [verb, ...rest] = args._;
   if (!verb || verb === 'help' || args.help) { process.stdout.write(HELP); return 0; }
   const root = homeOf(args);
+  // the dispatcher's own verbs run every round; its serve says it once when it starts
+  if (!['dispatch', 'events'].includes(verb)) sayReleaseBehind();
   if (verb === 'events') return streamBoardPublications({root,after:args.after,once:args.once});
   // C4: one task store per Org. A named board without a store of its own is a saved view over it: its tag selects
   // the cards it shows, and a card filed through it carries that tag.
@@ -346,12 +375,14 @@ export async function runWorkflow(argv) {
       const mapping = JSON.parse(readFileSync(args['status-map'], 'utf8'));
       const source = openBoard(root, slug);
       try {
-        const migrated = openZtrackBoard(preparing, { create: true, document: args.document, seed: { db: source.db, mapping }, init: layOut, root, slug, compatPath: paths.sqlite });
+        const migrated = openZtrackBoard(preparing, { create: true, document: args.document, seed: { db: source.db, mapping }, init: layOut, root, slug });
         migrated.close();
       } finally { source.close(); }
       renameSync(`${preparing}.board.db`, `${paths.ztrack}.board.db`);
       renameSync(preparing, paths.ztrack);
-      say(args, `Board migrated to ${args.document}; kanban.db is now a Hermes export`, { ok: true, backing: 'ztrack', document: args.document });
+      // The board's tables were seeded from the old store, which nothing reads now.
+      for (const file of [paths.sqlite, `${paths.sqlite}-wal`, `${paths.sqlite}-shm`]) rmSync(file, { force: true });
+      say(args, `Board migrated to ${args.document}`, { ok: true, backing: 'ztrack', document: args.document });
       return 0;
     }
     case 'init': {
@@ -742,7 +773,7 @@ export async function runWorkflow(argv) {
       say(args, targets.map((t) => `Promoted ${t} → ready`).join('\n'), { ok: true }); return 0;
     }
     case 'archive': {
-      for (const t of rest) await withBoardAsync((b) => engine.archive(b, t));
+      for (const t of rest) await withBoardAsync((b) => engine.archive(b, t, { reason: args.reason }));
       const purged = [];
       for (const t of args.rm ?? []) {
         withBoard((b) => tx(b, (db) => {
@@ -1355,6 +1386,38 @@ async function serve(root, args = {}) {
   // the orchestrator this serve runs, as installed: a newer install ends the serve after its tick, so whatever keeps it
   // running starts it again on the new code (a fix reaches the board with no hand relaunch)
   const installed = () => { try { return JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version ?? null; } catch { return null; } };
+  // The dispatcher's own health, readable from outside it: after every round in which no board failed it writes its
+  // heartbeat (the time, the round, what each board reported), so a watcher that finds it old knows the rounds stopped
+  // succeeding, whatever the dispatcher can still say. A board whose rounds keep failing is also told to the workflow's
+  // managers after FAILED_ROUNDS_ALERT in a row, and again each half hour while it lasts.
+  const heartbeat = join(root, 'dispatcher-heartbeat.json');
+  const FAILED_ROUNDS_ALERT = 5;
+  const failing = new Map();
+  let round = 0;
+  const watchRounds = async (reports) => {
+    if (reports.every((r) => !r.error)) {
+      const temporary = `${heartbeat}.${process.pid}.tmp`;
+      try {
+        writeFileSync(temporary, `${JSON.stringify({ at: new Date().toISOString(), round, pid: process.pid, version: installed(), boards: reports.map((r) => ({ board: r.board, started: r.started?.length ?? 0, queued: r.queued?.length ?? 0, failed: r.failed?.length ?? 0, ms: r.ms ?? null })), errors: reports.flatMap((r) => [...(r.failed ?? []), ...(r.unsettled ?? [])].map(([t, why]) => `${r.board} ${t}: ${String(why).split('\n')[0].slice(0, 300)}`)).slice(0, 20) })}\n`);
+        renameSync(temporary, heartbeat);
+      } catch { /* the next round writes it */ }
+    }
+    for (const r of reports) {
+      const run = failing.get(r.board) ?? { count: 0, since: Date.now(), told: 0 };
+      if (!r.error) {
+        if (run.count >= FAILED_ROUNDS_ALERT) await alertManagers(root, r.board === '*' ? 'default' : r.board, `The dispatcher's rounds on board ${r.board} succeed again after ${run.count} failed rounds since ${new Date(run.since).toISOString()}.`, `dispatcher-recovered-${r.board}-${run.since}`);
+        failing.delete(r.board);
+        continue;
+      }
+      run.count += 1; run.last = String(r.error).split('\n')[0].slice(0, 300);
+      failing.set(r.board, run);
+      if (run.count >= FAILED_ROUNDS_ALERT && Date.now() - run.told >= 1_800_000) {
+        run.told = Date.now();
+        const told = await alertManagers(root, r.board === '*' ? 'default' : r.board, `The dispatcher's rounds on board ${r.board} have failed ${run.count} times in a row since ${new Date(run.since).toISOString()}: ${run.last}\nNothing starts, moves or is supervised on it until a round succeeds. Its heartbeat (${heartbeat}) stopped at the last good round.`, `dispatcher-failing-${r.board}-${run.since}-${run.count}`);
+        log(`rounds on board ${r.board} failing ${run.count} in a row; ${told} manager(s) told`);
+      }
+    }
+  };
   const running = installed();
   log(`dispatching the boards of ${root} from ${localMachine()} (orchestrator ${running ?? 'unknown'})`);
   events = watchBoard({ root, binary: supercodeBin(), env: commandEnv(), log });
@@ -1402,7 +1465,10 @@ async function serve(root, args = {}) {
         const state = await laneState(root);
         const settings = { ...state.settings, ...override };
         interval = settings.interval;
-        for (const r of await tick({ root, lanes: state.lanes, settings, params, deploymentReceipt: true })) {
+        const reports = await tick({ root, lanes: state.lanes, settings, params, deploymentReceipt: true });
+        round += 1;
+        await watchRounds(reports);
+        for (const r of reports) {
           nextMailAt = Math.min(nextMailAt, r.next_mail_at ?? Infinity);
           const said = summary(r);
           if (r.deployment) log(`runtime deployed ${r.deployment.repository}@${r.deployment.head}; workflow ${r.deployment.workflow_hash}; tick ${r.deployment.completed_at}`);
@@ -1420,6 +1486,7 @@ async function serve(root, args = {}) {
         }
       } catch (error) {
         log(`tick failed: ${error.message}`);
+        await watchRounds([{ board: '*', error: `tick failed: ${error.message}` }]);
       }
       // a newer install is looked for after each tick and through the wait before the next
       const newer = () => { const now = installed(); return running && now && now !== running ? now : null; };

package/board/dispatch.mjs

@@ -20,7 +20,7 @@ import { readEventFleet } from './event-fleet.mjs';
 let eventFleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
-import { agentDoor, agentScope, teamsUnavailable, ensureCardAgent, localCardAgent, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, pendingAgentRuns, synchronizeAgentRun,agentProfileMismatch,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds } from '../agents.mjs';
+import { agentDoor, agentScope, teamsUnavailable, ensureCardAgent, localCardAgent, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, pendingAgentRuns, synchronizeAgentRun, abandonAgentRun,agentProfileMismatch,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds, agentRunForSession } from '../agents.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
 import { memorySnapshotSync } from '../hermes-cli.mjs';
 import { createRequire } from 'node:module';
@@ -130,6 +130,12 @@ const HARNESSES = {
   codex: { program: 'codex', fresh: () => [], resume: (sid) => ['resume', sid], namesItself: true },
 };
 /** A recorded session's fleet address (older records carry no harness: those were Claude Code's). */
+// A session the board launched (a pane by its launch key, or a headless process) keeps that whatever its mode: a kept
+// worker is marked 'adopt' when its card's next run takes it over, and is still the board's to close.
+// A door call that timed out, or whose machine or daemon could not be reached (a daemon between restarts answers
+// machine_offline; a stream that timed out, 504), says nothing about what it was asked: it is tried again next round.
+const doorTransient = (r) => r.code === null || ['unavailable', 'machine_offline', 'rate_limited', 504, '504', 'ETIMEDOUT', 'ECONNRESET', 'EAI_AGAIN'].includes(json(String(r.stderr ?? '').trim().split('\n').pop(), null)?.code);
+const adoptedOnly = (s) => s?.mode === 'adopt' && !s.launch_key && s.surface !== 'headless';
 const addressOf = (s) => s?.address ?? (s?.session_id && s.machine ? `sc:${s.machine}:${s.harness ?? 'claude-code'}:${s.session_id}` : null);
 const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 
@@ -151,8 +157,17 @@ function unpublishedAlive(session) {
   return entry.panes ? entry.panes.some((p) => p.pane === session.pane && !p.dead) : null;
 }
 
-/** Native activity comes from the machine's harness discovery, not catalogue age. */
+/** Native activity comes from the machine's harness discovery, not catalogue age. One discovery (up to 2000
+ * sessions, seconds each) serves a round's every native session on that machine, as paneLists serves its panes. */
+const discoveries = new Map();
 function nativeSessions(machine, harness) {
+  const key = `${normalMachine(machine)}\u0000${harness}`, seen = discoveries.get(key);
+  if (seen && Date.now() - seen.at <= 5000) return seen.sessions;
+  const sessions = discoverNative(machine, harness);
+  discoveries.set(key, { at: Date.now(), sessions });
+  return sessions;
+}
+function discoverNative(machine, harness) {
   if (offlineMachine(machine)) throw unavailable(`native liveness unavailable: machine ${normalMachine(machine)} is offline`);
   // This machine's discovery is its harness door, as every other harness read here is; another machine's is supercode's fleet arm
   const result = normalMachine(machine) === localMachine()
@@ -427,14 +442,18 @@ function stopSession(board, session) {
   if (session.surface !== 'headless' && offlineMachine(session.machine)) throw new Error(`close deferred: machine ${normalMachine(session.machine)} is offline`);
   if (!session.pane && session.surface === 'native') {
     const r = sc(['close', addressOf(session)], { timeout: 120_000, as: boardAddress(board.label) });
-    if (r.code !== 0) throw new Error(`closing native session ${addressOf(session)}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
+    if (r.code !== 0) throw new Error(`${doorTransient(r) ? 'close deferred: ' : ''}closing native session ${addressOf(session)}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
+    // the close's receipt is a discovery taken after it, never the round's cached one from before
+    discoveries.delete(`${normalMachine(session.machine)}\u0000${session.harness}`);
     const reading = nativeReading(nativeSessions(session.machine, session.harness), session);
     if (reading.alive !== false) throw new Error(`native close has no confirmed stopped receipt for ${addressOf(session)}`);
     return;
   }
   if (session.pane) {
     const r = runtimeDoor(normalMachine(session.machine??localMachine())===localMachine()?null:session.machine,'harness.v1.panes.close',{pane:session.pane},{env:commandEnv(),timeout:60_000,as:boardAddress(board.label)});
-    if (r.code !== 0 || json(r.stdout.trim(), null)?.closed !== session.pane) throw new Error(`closing pane ${session.pane}: ${(r.stderr || r.stdout || `exit ${r.code}`).trim().slice(-500)}`);
+    // a door that timed out or could not be reached says nothing about the pane: the close waits for the next round
+    const transient = doorTransient(r);
+    if (r.code !== 0 || json(r.stdout.trim(), null)?.closed !== session.pane) throw new Error(`${transient ? 'close deferred: ' : ''}closing pane ${session.pane}: ${(r.stderr || r.stdout || `exit ${r.code}`).trim().slice(-500)}`);
   }
 }
 
@@ -796,6 +815,23 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
     if (session?.monitor_held && !session.close_requested) continue; // only an explicit close action ends this process
     if ((!session?.pane && session?.surface !== 'native') || session.close_transferred_to || session.close_confirmed_at || (!row.ended_at && !session.close_requested)) continue;
     if (caller && session.session_id === caller) continue; // let the command that ended its own run return
+    // The board closes only what it launched. An adopted session (a person's own thread, a hook session the card was
+    // given) is released instead: left running, its slot freed. Closing one failed on every round for a session no close
+    // could name, and could have ended the owner's own thread.
+    if (adoptedOnly(session)) {
+      tx(board, (db) => {
+        const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
+        if (!current || current.session_id !== session.session_id || current.close_confirmed_at) return;
+        const at = now();
+        setRunSession(db, row.id, { ...current, close_requested: current.close_requested ?? at, closed_at: at, close_confirmed_at: at, close_error: null, released: true });
+        event(db, row.task_id, 'session_released', { session_id: session.session_id, pane: session.pane ?? null, machine: session.machine, reason: 'the board did not launch it; it is left running' }, row.id);
+      });
+      (report.closed ??= []).push({ task_id: row.task_id, ...session, released: true });
+      continue;
+    }
+    // A close that failed for a reason another attempt cannot change is tried once and raised as an incident, not tried
+    // every round (each attempt is a process). A deferred close (an offline machine, a run that still owns the pane) waits.
+    if (session.close_failed_at && session.close_error && !/^close deferred/.test(session.close_error)) continue;
     const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all());
     // Persist retries even for historical ends that did not have a close_session action.
     tx(board, (db) => requestSessionClose(db, row.task_id, { runId: row.id }));
@@ -817,7 +853,7 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         panes.set(machine, Array.isArray(list) ? { live: new Set(list.filter(p => !p.dead).map((p) => p.pane)) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
       }
       const observed = panes.get(machine);
-      if (observed.error) throw new Error(observed.error);
+      if (observed.error) throw new Error(`close deferred: ${observed.error}`); // an unread pane list is no verdict on the pane
       if (observed.live.has(session.pane)) {
         const protectedNow = view(board, (db) => db.prepare(`SELECT metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all())
           .some((r) => { const s = json(r.metadata, {})?.supercode; return s?.pane === session.pane && normalMachine(s.machine) === normalMachine(session.machine); });
@@ -825,15 +861,22 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         stopSession(board, session); observed.live.delete(session.pane);
       }
       }
-    } catch (e) { error = String(e.message).slice(-500); }
+    } catch (e) {
+      // a deferred close (an unreachable door, an unread pane list or session discovery) waits for the next round;
+      // the prefix is decided on the whole message, before it is cut to size
+      const message = String(e.message), deferred = Boolean(e.launchDeferred) || /^close deferred: /.test(message);
+      error = `${deferred ? 'close deferred: ' : ''}${message.replace(/^close deferred: /, '').slice(-480)}`;
+    }
     tx(board, (db) => {
       const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
       if (!current || current.pane !== session.pane || current.session_id !== session.session_id) return;
       const at = now();
       if (error) {
-        setRunSession(db, row.id, { ...current, close_attempted_at: at, close_attempts: Number(current.close_attempts ?? 0) + 1, close_error: error });
+        const final = !/^close deferred/.test(error);
+        setRunSession(db, row.id, { ...current, close_attempted_at: at, close_attempts: Number(current.close_attempts ?? 0) + 1, close_error: error, ...(final ? { close_failed_at: at } : {}) });
         // Retain every attempt's latest fact, but avoid an unbounded thread of identical failures.
-        if (current.close_error !== error) event(db, row.task_id, 'session_close_failed', { session_id: session.session_id, pane: session.pane, error, retry: true }, row.id);
+        if (current.close_error !== error) event(db, row.task_id, 'session_close_failed', { session_id: session.session_id, pane: session.pane, error, retry: !final }, row.id);
+        if (final) event(db, row.task_id, 'run_incident', { observation: 'close_failed', run: row.id, reason: `the board could not close ${addressOf(session)} and will not try again: ${error}`, session: session.session_id, machine: session.machine, pane: session.pane ?? null, evidence: { error } }, row.id);
       } else {
         const { close_error: _error, ...rest } = current;
         setRunSession(db, row.id, { ...rest, close_error: null, closed_at: at, close_confirmed_at: at });
@@ -852,6 +895,16 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
  * Keep bounded readings on the run so an ordinary quiet stretch can be reviewed later. */
 function observeIdle(board, fleet, settings, report, entry, effects) {
   if (!fleet.ok) return;
+  // The published fleet says whether a session runs and its turn, not when it last wrote: that is the session's own
+  // record, read from its machine's discovery (one read per machine and harness a round, only when a card needs it).
+  // Without it every reading was 'no_timestamp' and no session was ever found idle.
+  const discovered = new Map();
+  const updatedAt = (session) => {
+    const key = `${session.machine}|${session.harness ?? 'claude-code'}`;
+    if (!discovered.has(key)) { try { discovered.set(key, nativeSessions(session.machine ?? localMachine(), session.harness ?? 'claude-code')); } catch { discovered.set(key, null); } }
+    return Number(discovered.get(key)?.find((row) => row.locator?.session_id === session.session_id)?.updated_at_ms) || null;
+  };
+  const managers = [].concat(entry.params.managers ?? []).filter(Boolean);
   for (const { id } of board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all()) {
     tx(board, (db) => {
       const task = getTask(db, id);
@@ -863,12 +916,13 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
       if (session.surface === 'native' && fleet.native?.get(addressOf(session))?.alive !== true) return;
       const live = fleet.sessions.find((x) => x.address === addressOf(session));
       const observedAt = now();
-      const lastAt = Math.floor(Number(live?.last_message_at_ms) / 1000);
+      const lastAtMs = Number(live?.last_message_at_ms) || updatedAt(session);
+      const lastAt = Math.floor(Number(lastAtMs) / 1000);
       const reading = {
         session_id: session.session_id, observed_at: observedAt,
         last_message_at: lastAt > 0 ? lastAt : null,
-        last_message_at_ms: lastAt > 0 ? Number(live.last_message_at_ms) : null,
-        status: live?.status ?? null, quiet_seconds: lastAt > 0 ? observedAt - lastAt : null,
+        last_message_at_ms: lastAt > 0 ? Number(lastAtMs) : null,
+        status: live?.status ?? null, turn: live?.turn ?? null, quiet_seconds: lastAt > 0 ? observedAt - lastAt : null,
         threshold_seconds: settings.idleQuiet, turns_before: Number(session.goal_turns ?? 0),
       };
       const retain = (decision, extra = {}) => {
@@ -882,6 +936,23 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
         setRunSession(db, runRow.id, patch);
         return observation;
       };
+      // A session its harness holds (a question or permission prompt, a dialog such as the usage limit, a hang) is told to
+      // the manager with what its screen shows, once per state: a reminder typed into a dialog goes nowhere. Waiting on
+      // its user is known at once; working without writing past the quiet threshold is held.
+      const held = live?.turn === 'needs_input' ? 'waiting_on_user' : live?.turn === 'working' && lastAt > 0 && observedAt - lastAt >= settings.idleQuiet ? 'working_silent' : null;
+      if (held) {
+        if (session.idle_observation?.decision === held && session.idle_observation.last_message_at_ms === reading.last_message_at_ms) return;
+        let screen = null;
+        if (session.pane) { const r = doorOn(session.machine ?? localMachine(), 'panes.capture', { pane: session.pane, lines: 25 }, { timeout: 20_000 }); screen = r.code === 0 ? String(json(r.stdout.trim(), {})?.text ?? '').trim().split('\n').slice(-25).join('\n') : null; }
+        const observation = retain(held, { screen });
+        const why = held === 'waiting_on_user' ? 'is waiting on its user (a question or a permission prompt)' : `has reported working without writing anything for ${Math.round((observedAt - lastAt) / 60)} min`;
+        const text = `${id}: its session ${addressOf(session)} ${why}; nothing it is sent reaches it until that is answered.${screen ? `\nIts screen:\n${screen}` : ''}`;
+        event(db, id, 'session_held', observation, runRow.id);
+        const to = managers[0] ?? null;
+        if (to) event(db, id, 'board_message', { to, text }, null);
+        (report.held ??= []).push([id, held, addressOf(session)]);
+        return;
+      }
       // No timestamp is no reading, and no reading gives no verdict.
       if (!(lastAt > 0)) { retain('no_timestamp'); return; }
       if (reading.quiet_seconds < settings.idleQuiet) { retain('below_threshold'); return; }
@@ -971,6 +1042,46 @@ export async function sessionEffect(board, e) {
   }
 }
 
+/**
+ * A review's pass merged by the board itself, not left for a coder session that may be gone or busy: every PR the pass
+ * judged (its `review_pass` record's ci), merged at the head it judged. A head that moved after the verdict is never
+ * merged; the card is sent `merge_refused` and its managers are told, so new work is new review, not a silent one.
+ * Once every PR is merged the card is sent `reviewed_merged` with the merge commits. Answers false (kept, tried again
+ * next round) on anything GitHub did not decide.
+ */
+export async function mergeReviewed(board, e) {
+  const { candidatePullRequests, mergeReviewedPullRequest } = await import('./ci.mjs');
+  const pass = view(board, (db) => db.prepare("SELECT id, payload FROM task_events WHERE task_id = ? AND kind = 'review_pass' ORDER BY id DESC LIMIT 1").get(e.id));
+  const recorded = json(pass?.payload, {})?.ci ?? null;
+  const ci = typeof recorded === 'string' ? json(recorded, null) : recorded;
+  const prs = candidatePullRequests(ci).filter((p) => p?.pr?.url && p.commit);
+  const merges = [];
+  for (const p of prs) {
+    let answer;
+    try { answer = mergeReviewedPullRequest(p.pr.url, p.commit); } catch (error) {
+      tx(board, (db) => event(db, e.id, 'merge_pending', { pr: p.pr.url, reviewed: p.commit, reason: String(error.message).slice(-300) }));
+      return false;
+    }
+    if (answer.merged) { merges.push({ pr: p.pr.url, reviewed: p.commit, merge: answer.sha }); continue; }
+    const reason = answer.moved ? `${p.pr.url} is no longer at its reviewed head ${p.commit}${answer.head ? ` (now ${answer.head})` : ''}; what was pushed after the verdict needs its own review` : `${p.pr.url} was closed without merging`;
+    const entry = await loadWorkflow(board.root);
+    tx(board, (db) => {
+      event(db, e.id, 'merge_refused', { pr: p.pr.url, reviewed: p.commit, head: answer.head ?? null, reason, merged: merges });
+      try { const r = fire(db, board, entry, e.id, 'merge_refused', { roles: ['platform'], payload: { reason, pr: p.pr.url } }); for (const eff of r.effects) db.prepare('INSERT INTO supercode_effects (effect) VALUES (?)').run(JSON.stringify(eff)); } catch { /* a workflow without merge_refused keeps the card where it is */ }
+      const to = [].concat(entry.params.managers ?? []).find(Boolean);
+      if (to) event(db, e.id, 'board_message', { to, text: `${e.id}: the passed review was not merged: ${reason}. Merged so far: ${merges.map((m) => m.pr).join(', ') || 'none'}.` }, null);
+    });
+    return true;
+  }
+  const entry = await loadWorkflow(board.root);
+  tx(board, (db) => {
+    event(db, e.id, 'reviewed_merged', { merges });
+    const r = fire(db, board, entry, e.id, 'reviewed_merged', { roles: ['platform'], payload: { merges, summary: merges.length ? `Merged at the reviewed heads: ${merges.map((m) => `${m.pr} (${m.reviewed.slice(0, 8)} → ${String(m.merge).slice(0, 8)})`).join(', ')}` : 'The pass named no PR to merge.' } });
+    for (const eff of r.effects) db.prepare('INSERT INTO supercode_effects (effect) VALUES (?)').run(JSON.stringify(eff));
+  });
+  return true;
+}
+
 // ------------------------------------------------------------------ start
 
 /** What the launcher itself needs to start this card (the caps are the workflow's `dispatch.capacity`). */
@@ -1154,7 +1265,9 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
         event(db,row.task_id,mismatch.differences.length?'agent_profile_drift':'agent_profile_recorded',{agent:session.agent_id,session:session.session_id,comparison:mismatch},row.id);
       });
     }
-    recordAgentRun(board.root,session.agent_org,session.agent_id,{session:`${session.harness}:${session.session_id}`,machine:session.machine,run:row.id});
+    // One run whose session another agent already owns is that card's problem, said on it; the round goes on for the rest.
+    try{recordAgentRun(board.root,session.agent_org,session.agent_id,{session:`${session.harness}:${session.session_id}`,machine:session.machine,run:row.id});}
+    catch(error){report.queued.push([row.task_id,`run ${row.id}: ${error.message}`]);continue;}
     orgs.set(session.agent_org,session.agent_context);
   }
   // Identities minted while Teams was absent are declared under their ids before their sessions are joined.
@@ -1189,7 +1302,7 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
   for(const [org,context] of orgs)for(const row of pendingAgentRuns(board.root,org)){
     const launch=agentRuns.find(run=>String(run.id)===String(row.run_id));
     try{synchronizeAgentRun(board.root,org,row,{context,intended:json(launch?.metadata,{})?.supercode?.agent_profile_intent});}
-    catch(error){report.queued.push([row.run_id,`agent session sync pending: ${error.message}`]);if(error.code==='rate_limited')break;}
+    catch(error){if(error.code==='rate_limited'){report.queued.push([row.run_id,`agent session sync pending: ${error.message}`]);break;}const gone=error.claimRefused&&error.status===404&&fleet.ok&&sessionAlive(fleet,{address:`sc:${row.machine||localMachine()}:${row.session_ref}`,machine:row.machine||localMachine()})===false;if(gone)abandonAgentRun(board.root,org,row.session_ref);report.failed.push([row.run_id,`agent session sync failed: ${error.message}${gone?`; ${row.session_ref} is stopped and Teams refuses it, so it leaves the sync`:''}`]);}
   }
   const deferred=view(board,db=>db.prepare("SELECT t.id,r.started_at FROM tasks t JOIN task_runs r ON r.id=t.current_run_id WHERE r.ended_at IS NULL AND json_extract(r.metadata,'$.supercode.launch_deferred')=1").all());
   // A deferred launch was never issued (a reading or door was not yet available): it is the start its manager, creator
@@ -1338,7 +1451,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   else if (prev && (prev.harness ?? 'claude-code') !== harness) {
     // the card was reassigned to a lane of another harness: that harness starts it fresh (the card's text and thread
     // are its context), and the last session, if still open, is closed so two harnesses never work one card
-    if (prev.pane && !prev.closed_at) stopSession(board, prev);
+    if (prev.pane && !prev.closed_at && !adoptedOnly(prev)) stopSession(board, prev); // an adopted session is released, never closed
     replaced = { session_id: prev.session_id, why: `the card's lane runs ${harness}, not ${prev.harness ?? 'claude-code'}`, letGo: true };
   } else if (prev && prev.machine === machine) {
     // a session the board closed, or one whose close its own command asked for (the next tick's sweep closes that
@@ -1598,6 +1711,10 @@ function adoptSession(board, id, who, { workspace = null, ttl, assignee = null,
     try { agent = ensureCardAgent({ root: board.root, org: team.org, server: team.server, profiles: entry0.profiles, profile: lane.name, card: id, role: spec0?.role ?? 'implementer', sponsor: card0?.sponsor ?? null, machine: normalMachine(host) === localMachine() ? null : host, context }); }
     catch (error) { if (!teamsUnavailable(error)) throw error; }
   }
+  // A session another agent already owns is refused before anything is recorded: the run would name one agent and the
+  // agent store another, and every round after would trip on it.
+  const owner = agent ? agentRunForSession(board.root, [`${harness}:${sessionId}`]) : null;
+  if (owner && owner.agent_id !== agent.identity.id) throw new Error(`${found.address} already works for agent ${owner.agent_id} (run ${owner.run_id}); it cannot be adopted as ${agent.identity.id}`);
   const adopted = tx(board, (db) => {
     const task = getTask(db, id);
     if (!task) throw new Error(`no card ${id}`);
@@ -1714,6 +1831,21 @@ async function send(board, from, label, to, body, key, { queue = false, ask = fa
   return answer.receipt ?? { delivered: false, reason: 'mail door returned no delivery receipt' };
 }
 
+/**
+ * Mail the workflow's managers (`params.managers`) about the dispatcher itself, not a card: its rounds failing, for one.
+ * Answers how many took it; a manager that cannot be reached is skipped, never a reason to fail the caller.
+ */
+export async function alertManagers(root, slug, text, key) {
+  let managers = [];
+  try { const entry = await loadWorkflow(root, { fresh: true }); managers = Array.isArray(entry.params.managers) ? entry.params.managers.map(String) : []; } catch { /* a workflow that cannot load names nobody */ }
+  const label = boardLabel(root, slug);
+  let told = 0;
+  for (const to of managers) {
+    try { const receipt = await send({ root }, boardAddress(label), label, to, text, key, { subject: text.split('\n')[0] }); if (receipt.delivered || receipt.queued) told += 1; } catch { /* the next alert tries again */ }
+  }
+  return told;
+}
+
 /**
  * The messages the workflow has the board send (`tell`, `ask`: board_message events) that it has not sent yet, sent now
  * and marked board_message_sent. A question goes under the id its card waits on; a resend of a sent one is a no-op
@@ -1821,16 +1953,19 @@ async function notify(board, fleet, report, entry) {
       // A backlog (a restart, a recipient that could not be reached) is told as it stands now: of one kind of news about
       // the card, only the latest (a later adoption_failed, blocked or moved says what the earlier one did); comments
       // and answers, each its own message, in full. A notice the board already recorded as taken by this address is never sent again.
-      const latest = new Map(events.filter((ev) => !['commented', 'answered'].includes(ev.kind)).map((ev) => [ev.kind, ev.id]));
+      // only events that would be told count: a stale one or the recipient's own act never supersedes one that would be
+      const sendable = (ev) => { const p = json(ev.payload, {}) ?? {}; return !(maxAge && now() - Number(ev.created_at) > maxAge) && !(p.by && p.by === sub.chat_id); };
+      const latest = new Map(events.filter((ev) => !['commented', 'answered'].includes(ev.kind) && sendable(ev)).map((ev) => [ev.kind, ev.id]));
       const sentBefore = board.db.prepare("SELECT 1 FROM task_events WHERE task_id = ? AND kind IN ('notice_delivered', 'notice_filed') AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') = ? LIMIT 1");
       const advance = (id) => tx(board, (db) => db.prepare("UPDATE kanban_notify_subs SET last_event_id = ? WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ? AND last_event_id < ?").run(id, sub.task_id, sub.chat_id, sub.thread_id ?? '', id));
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
         if (maxAge && now() - Number(ev.created_at) > maxAge) { cursor = ev.id; (report.stale_notices_passed ??= 0); report.stale_notices_passed += 1; continue; }
-        if (latest.has(ev.kind) && latest.get(ev.kind) !== ev.id) { cursor = ev.id; (report.superseded_notices_passed ??= 0); report.superseded_notices_passed += 1; continue; }
+
         if (sentBefore.get(sub.task_id, ev.id, sub.chat_id)) { cursor = ev.id; continue; }
         // nobody is told of their own act
         if (p.by && p.by === sub.chat_id) { cursor = ev.id; continue; }
+        if (latest.has(ev.kind) && latest.get(ev.kind) !== ev.id) { cursor = ev.id; (report.superseded_notices_passed ??= 0); report.superseded_notices_passed += 1; continue; }
         let text;
         if (ev.kind === 'commented') {
           if (p.author === sub.chat_id) { cursor = ev.id; continue; }

package/board/engine.mjs

@@ -485,6 +485,10 @@ export async function runEffects(board, effects = [], { retryNotices = false } =
       const { sendBoardMessages } = await import('./dispatch.mjs');
       await sendBoardMessages(board, { undelivered: [] }, e.id);
     }
+    else if (e.kind === 'merge_reviewed') {
+      const { mergeReviewed } = await import('./dispatch.mjs');
+      if (await mergeReviewed(board, e) === false) continue;
+    }
     else if (e.kind === 'invalidate_descendants') tx(board, (db) => invalidateDescendants(db, board, e.id));
     else if (e.kind === 'stop_run') stopWorker(board, e.runId);
     else if (e.kind === 'close_session' || e.kind === 'send_to_actor' || e.kind === 'run_ended') {
@@ -566,7 +570,7 @@ export const reopenReview = (board, id, { roles, reason = null } = {}) => act(bo
 export const schedule = (board, id, reason = null, { roles } = {}) => act(board, id, 'schedule', { roles, payload: { reason } });
 export const promote = (board, id, { actor = 'user', reason = null, force = false, roles } = {}) => act(board, id, 'promote', { roles, payload: { actor, reason, force } });
 export const reclaim = (board, id, reason = null, { roles } = {}) => act(board, id, 'reclaim', { roles, payload: { reason } });
-export const archive = (board, id, { roles } = {}) => act(board, id, 'archive', { roles });
+export const archive = (board, id, { roles, reason } = {}) => act(board, id, 'archive', { roles, payload: { reason } });
 export async function specify(board, id, { title = null, body = null, workspace = null, branch = null, machine = null, author = 'user', roles } = {}) {
   let declaration = null;
   if (workspace != null || branch != null || machine != null) {

package/board/event-fleet.mjs

@@ -52,7 +52,7 @@ export function readEventFleet(root){
       const previous=native.get(address),states=[...(previous?.states??[]),state];
       const combined=states.includes(true)?true:states.includes(null)?null:states.every(value=>value===false)?false:null;
       native.set(address,{alive:combined,states});if(combined===true)alive.add(address);
-      sessions.push({address,machine,harness:binding.harness,session_id:binding.native_session_id,pane:binding.pane??null,name:binding.name??null,state:binding.state,identity:value.data.agent_identity??null});
+      sessions.push({address,machine,harness:binding.harness,session_id:binding.native_session_id,pane:binding.pane??null,name:binding.name??null,state:binding.state,turn:binding.turn??null,native_state:binding.evidence?.native_state??null,identity:value.data.agent_identity??null});
     }
   }
   return {ok:!!cache.connected,presenceKnown:!!cache.connected,online,alive,native,sessions,error:cache.connected?null:'published session events disconnected'};

package/board/git-document.mjs

@@ -60,10 +60,12 @@ export class GitDocument {
   // not land (refused: something was pushed meanwhile) takes what was pushed now and pushes before writing again.
   pull() {
     if (!this.usable) return;
+    // Every board transaction pulls (about a hundred a dispatcher round): inside the fetch interval nothing is read,
+    // not even the branch, so a round no longer spends seconds on git subprocesses that decide nothing.
+    if (Date.now() - fetchedAt(this.root) < FETCH_EVERY_MS) return;
     const branch = this.branch();
     if (!branch) return this.detached();
     if (this.unpushed(branch)) return this.pushing ? undefined : this.publish(branch, 'board');
-    if (Date.now() - fetchedAt(this.root) < FETCH_EVERY_MS) return;
     if (quiet(this.root, ['fetch', '--quiet', 'origin', branch]) === null) return; // offline: the next write tries again
     const behind = Number(git(this.root, ['rev-list', '--count', `HEAD..origin/${branch}`]).trim());
     if (behind === 0) return;

package/board/store.mjs

@@ -169,7 +169,7 @@ export function openBoard(root, slug = DEFAULT_BOARD, { create = false, backing
   const use = kept ?? backing ?? 'sqlite';
   if (!BACKINGS.includes(use)) throw new Error(`a board's backing is ${BACKINGS.join(' | ')}, not ${use}`);
   const path = backingPaths(root, slug)[use];
-  if (use === 'ztrack') return { ...openZtrackBoard(path, { create, document, init: layOut, root, slug, compatPath: backingPaths(root, slug).sqlite }), root, slug, path, backing: use };
+  if (use === 'ztrack') return { ...openZtrackBoard(path, { create, document, init: layOut, root, slug }), root, slug, path, backing: use };
   if (use === 'files') return { ...openFilesBoard(path, { create, init: layOut }), root, slug, path, backing: use };
   if (!kept) mkdirSync(dirname(path), { recursive: true });
   const db = new DatabaseSync(path);

package/board/workflow.mjs

@@ -420,6 +420,9 @@ function declaredStatus(db, board, entry, task) {
     record(db, task.id, 'status_adopted', { from, to: fits[0], reason: `${from} is how this board's workflow stores ${fits[0]} for this card` });
     return fits[0];
   }
+  // A card a board store marks stopped or held (`archived`, `blocked`) is never taken for a new one, whichever workflow
+  // reads it: entering at the start would dispatch it again.
+  if (['archived', 'blocked'].includes(from)) throw new Error(`${task.id} is ${from}, which the board's workflow does not declare; move it with the verb for the status it means`);
   const scope = scopeOf(db, board, task, { params: entry.params, event: {}, extra: { lanes: lanesIn(entry) } });
   const start = entry.workflow.initial?.find((x) => holds(x.guard ?? null, scope));
   const to = start?.target ? String(templateValue(start.target, scope)) : null;
@@ -435,7 +438,13 @@ function declaredStatus(db, board, entry, task) {
  * `{ from, to, effects }`; throws the refusal when no transition applies or a validator fails.
  */
 export function fire(db, board, entry, id, name, { roles = [], payload = {}, extra = {} } = {}) {
-  if (db.boardErrors?.has(id)) throw new Error(`${id}: ${db.boardErrors.get(id)}`);
+  // A card ends with its reason: a cancel or archive that says nothing why is refused, whoever sends it, the manager
+  // included. The reason is all the next reader of an ended card has (an empty-reason cancel once ended an arc that had
+  // shipped half, and nothing on the card said so).
+  if ((name === 'cancel' || name === 'archive') && !String(payload?.reason ?? '').trim()) throw new Error(`${id}: ${name} needs a reason (--reason <why>)`);
+  // A card the document no longer lists (a removal the document cannot make) still takes the manager's cancel or
+  // archive: that ends it the way the document already has, and is the one way a manager clears it.
+  if (db.boardErrors?.has(id) && !(/cannot change card removal/.test(db.boardErrors.get(id)) && ['cancel', 'archive'].includes(name) && roles.includes('manager'))) throw new Error(`${id}: ${db.boardErrors.get(id)}`);
   const { workflow, params } = entry;
   if (workflow.run && (workflow.run.on?.[name] || Object.values(workflow.run.states ?? {}).some((s) => s.on?.[name]))) return fireRun(db, board, entry, id, name, { roles, payload, extra });
   const task = cardOf(db, id);
@@ -700,6 +709,10 @@ const ACTIONS = {
     cardField(ctx, 'next_run_at', interval == null ? null : now());
   },
   card_event(ctx, { name, payload = {}, as = ['platform'] }) {
+    // a cancel or archive a workflow fires from another (an archive of a live card cancels it first) carries that
+    // event's reason when it names none of its own: the reason is required on every end
+    const reason = payload?.reason ?? ctx.scope.event?.reason;
+    if (['cancel', 'archive'].includes(name) && reason != null && payload?.reason == null) payload = { ...payload, reason };
     const result = fire(ctx.db, ctx.board, ctx.entry, ctx.id, name, { roles: [].concat(as), payload, extra: { lanes: lanesIn(ctx.entry) } });
     ctx.effects.push(...result.effects);
   },
@@ -867,6 +880,14 @@ const ACTIONS = {
   },
   cleanup_workspace(ctx) { ctx.effects.push({ kind: 'cleanup_workspace', id: ctx.id }); },
   stop_run(ctx) { ctx.effects.push({ kind: 'stop_run', id: ctx.id, runId: ctx.runId }); },
+  // A review's pass is the work locked in: the dispatcher merges every PR the verdict judged, at the head it judged
+  // (dispatch.mjs mergeReviewed), and sends the card `reviewed_merged` once all are, or `merge_refused` when a head moved.
+  merge_reviewed(ctx) {
+    // kept until it is done: a merge GitHub did not answer is tried again next round
+    const effect = { kind: 'merge_reviewed', id: ctx.id };
+    const inserted = run(ctx.db, 'INSERT INTO supercode_effects (effect) VALUES (?)', JSON.stringify(effect));
+    ctx.effects.push({ ...effect, durableId: Number(inserted.lastInsertRowid) });
+  },
   // the run leaving the status is the one whose session closes, never a run started after it (a reclaim's successor)
   close_session(ctx, slot) {
     const through = ctx.runId ?? one(ctx.db, 'SELECT MAX(id) AS id FROM task_runs WHERE task_id = ?', ctx.id)?.id ?? 0;
@@ -1083,6 +1104,10 @@ function settleRelations(db, board, entry, id, effects) {
     // a block that has aged is told once, not every age interval for as long as it lasts
     else if (policy.aged && policy.age_seconds != null && !block.aged_at) {
       const seconds = Number(evaluate(String(policy.age_seconds), { params: entry.params }));
+      // The card's own history says whether this block was already told: `aged_at` lives in a row a board rebuilds
+      // from its document (which does not carry it), so a restart forgot it and every unchanged block aged again.
+      const told = one(db, `SELECT 1 FROM task_events WHERE task_id = ? AND kind IN (?, 'block_aged') AND json_extract(payload, '$.on') = ? AND created_at >= ? LIMIT 1`, id, policy.aged, block.id, Number(block.since ?? 0));
+      if (told) { const current = json(one(db, 'SELECT blocked_by FROM supercode_cards WHERE task_id = ?', id)?.blocked_by, []); run(db, 'UPDATE supercode_cards SET blocked_by = ? WHERE task_id = ?', JSON.stringify(current.map((b) => b.id === block.id ? { ...b, aged_at: now() } : b)), id); continue; }
       if (seconds > 0 && now() - Number(block.notified_at ?? block.since ?? now()) >= seconds) {
         const current = json(one(db, 'SELECT blocked_by FROM supercode_cards WHERE task_id = ?', id)?.blocked_by, []);
         run(db, 'UPDATE supercode_cards SET blocked_by = ? WHERE task_id = ?', JSON.stringify(current.map((b) => b.id === block.id ? { ...b, aged_at: now() } : b)), id);

package/board/workspace.mjs

@@ -2,6 +2,7 @@
 import { existsSync } from 'node:fs';
 import { basename, dirname } from 'node:path';
 import { runtimeDoor } from './runtime-door.mjs';
+import { inspectCheckout } from '@volter/teams/checkout';
 import { localMachine, normalMachine, commandEnv } from './dispatch.mjs';
 
 // Repository identities are portable input values; the daemon owns their checkout resolution.
@@ -22,9 +23,14 @@ function workspaceDoor(machine, verb, value, options = {}) {
     throw new Error(`workspace on ${machine}: machine ${normalMachine(machine)} is offline`);
   }
   const local = !machine || normalMachine(machine) === localMachine();
+  // A path on this machine is read by the process asking, with its own file access: the daemon (a launchd job) may have
+  // none on a volume macOS guards, where the session that named the path does, and a verdict waited on the daemon's
+  // EPERM. The daemon is asked when this process cannot read it.
+  let own = null;
+  if (local && verb === 'inspect') { try { return inspectCheckout(value); } catch (error) { own = error; } }
   const params = verb === 'list' ? {} : verb === 'inspect' || verb === 'register' ? {path:value} : {repository:value,...options};
   const r = runtimeDoor(local?null:machine,`harness.v1.workspaces.${verb}`,params,{env:commandEnv()});
-  if (r.code !== 0) throw new Error(`workspace on ${machine}: ${(r.stderr || r.stdout || r.error?.message).trim()}`);
+  if (r.code !== 0) throw new Error(`workspace on ${machine}: ${own ? `${own.message}; the machine daemon: ` : ''}${(r.stderr || r.stdout || r.error?.message).trim()}`);
   return JSON.parse(r.stdout);
 }
 export function declareWorkspace(kind, value, machine, branch = null) {

package/board/ztrack.mjs

@@ -1,5 +1,5 @@
 // The document is card state. One SQLite file beside it keeps the runtime tables the engine speaks
-// (Hermes's, with supercode's own) and an index of the document's card spans. ADR 0001 and 0003.
+// and an index of the document's card spans. ADR 0001 and 0003.
 // All markdown interpretation belongs to ztrack's public codec and kanban preset.
 //
 // A write is SQLite's own deferred transaction, retried whole when another writer committed first
@@ -10,16 +10,15 @@
 import { createRequire } from 'node:module';
 import { createHash, randomBytes } from 'node:crypto';
 import { existsSync, linkSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
-import { basename, dirname, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
-import { actorOf, contention, event, json, now, principalOf, retryContention, setActor } from './store.mjs';
+import { actorOf, contention, event, json, now, principalOf } from './store.mjs';
 import { GitDocument } from './git-document.mjs';
 import { noteStep, recordSlow } from '@volter/supercode-harness-sdk/slow-log';
 
 /** Run `fn` as a named step of the running command (the slow log names its slowest step). */
 const timedStep = (step, fn) => { const started = performance.now(); try { return fn(); } finally { noteStep(step, performance.now() - started); } };
-import { fire, statusOf, storedStatus, workflowFor } from './workflow.mjs';
-import { completionPhase, inspectCompletionEvidence, withCompletionEvidence } from './ci.mjs';
+import { fire, workflowFor } from './workflow.mjs';
 
 const require = createRequire(import.meta.url);
 const hash = (text) => createHash('sha256').update(text).digest('hex');
@@ -53,30 +52,28 @@ CREATE TABLE IF NOT EXISTS board_chunks (cid INTEGER PRIMARY KEY AUTOINCREMENT,
 CREATE TABLE IF NOT EXISTS board_tasks (id TEXT PRIMARY KEY, key TEXT NOT NULL, sources TEXT);
 CREATE INDEX IF NOT EXISTS board_tasks_key ON board_tasks(key);
 CREATE TABLE IF NOT EXISTS board_errors (id TEXT PRIMARY KEY, reason TEXT NOT NULL);
-CREATE TABLE IF NOT EXISTS board_export (name TEXT NOT NULL, key TEXT NOT NULL, rev INTEGER NOT NULL DEFAULT 0, PRIMARY KEY (name, key));`;
+DROP TABLE IF EXISTS board_export;`;
 // board_state: `published` (each document's hash as the tables describe it), `chunks:<role>` (the
 // document's spans in order: chunk id, card id, heading level, length, and the hash of the card
 // record the span reads as), `pending` and `pending_hashes` (a publication committed but not yet
-// written to the document), `hermes_cursor`. board_tasks: a subtask's key on its arc's Tasks list
+// written to the document). board_tasks: a subtask's key on its arc's Tasks list
 // (`<arc>:c3`) and its `source:` lines, which live only in the document.
 
-export function openZtrackBoard(marker, { create = false, document = null, seed = null, init, root, slug, compatPath }) {
+export function openZtrackBoard(marker, { create = false, document = null, seed = null, init, root, slug }) {
   if (!existsSync(marker)) {
     if (!create) throw new Error(`no ztrack board ${marker}`);
     mkdirSync(dirname(marker), { recursive: true });
     atomic(marker, JSON.stringify({ format: 1, document: resolve(document ?? resolve(dirname(marker), 'arcs.md')) }) + '\n');
   }
   const config = JSON.parse(read(marker));
-  const backing = new ZtrackBoard({ ...config, seed, marker, init, root, slug, compatPath });
-  // A board made here is in Hermes's kanban.db at once, not after its first write.
-  if (create) backing.exportFollowing();
+  const backing = new ZtrackBoard({ ...config, seed, marker, init, root, slug });
   return { db: backing.db, tx: (fn) => backing.tx(fn), publishPending: () => backing.git?.publishPending(), close: () => backing.close(), document: backing.path };
 }
 
-const behindSaid = new Set();
+const behindSaid = new Set(), heartbeatSaid = new Set();
 
 class ZtrackBoard {
-  constructor({ document, seed, marker, init, root, slug, compatPath, commit = false, manager = null, archive = {} }) {
+  constructor({ document, seed, marker, init, root, slug, commit = false, manager = null, archive = {} }) {
     this.path = resolve(dirname(marker), document);
     this.archive = `${this.path}.archive.md`;
     this.baseDocs = [{ role: 'open', path: this.path }, { role: 'archived', path: this.archive }];
@@ -98,7 +95,18 @@ class ZtrackBoard {
       // A push younger than a minute is still on its way.
       if (late && Date.now() - late.since > 60_000) process.stderr.write(`board: warning: ${late.commits} board document commit${late.commits === 1 ? '' : 's'} not published since ${new Date(late.since).toISOString().slice(0, 16)}Z${late.error ? ` (last push: ${late.error})` : ''}; the dispatcher's next round retries\n`);
     }
-    this.seed = seed; this.root = root; this.slug = slug; this.init = init; this.compatPath = compatPath;
+    // The dispatcher's standing errors are said the same way, on every workflow call until a round clears them: a round
+    // that has not completed in five minutes, and each card or run the last round could not start, read or sync.
+    if (root && !heartbeatSaid.has(root)) {
+      heartbeatSaid.add(root);
+      try {
+        const beat = JSON.parse(readFileSync(join(root, 'dispatcher-heartbeat.json'), 'utf8'));
+        const age = Date.now() - Date.parse(beat.at);
+        if (age > 300_000) process.stderr.write(`board: error: the dispatcher has completed no round since ${String(beat.at).slice(0, 16)}Z; nothing starts, moves or is supervised\n`);
+        for (const error of beat.errors ?? []) process.stderr.write(`board: error: ${error}\n`);
+      } catch { /* a board no dispatcher serves yet has no heartbeat */ }
+    }
+    this.seed = seed; this.root = root; this.slug = slug; this.init = init;
     this.file = `${marker}.board.db`;
     mkdirSync(dirname(this.path), { recursive: true });
     const legacy = `${marker}.runtime.db`;
@@ -164,8 +172,7 @@ class ZtrackBoard {
       try { this.init(this.conn, { fresh: true }); this.conn.exec(BOARD_TABLES); break; }
       catch (error) { if (!sqliteContention(error)) throw error; backoff(attempt); }
     }
-    // What a transaction touched, for the Hermes export (every row) and the renderer (cards whose
-    // text may change: anything beyond run fields and scheduling clocks). Plain inserts: a trigger's
+    // What a transaction touched, for the renderer (cards whose text may change: anything beyond run fields and scheduling clocks). Plain inserts: a trigger's
     // own conflict clause yields to the outer statement's, so duplicates are removed when read.
     this.conn.exec('CREATE TEMP TABLE IF NOT EXISTS board_dirty (name TEXT NOT NULL, key TEXT NOT NULL); CREATE TEMP TABLE IF NOT EXISTS board_touched (id TEXT)');
     this.tables = new Map();
@@ -267,9 +274,7 @@ class ZtrackBoard {
     const snapshot = state('snapshot') ?? {};
     for (const [key, id] of Object.entries(snapshot.taskIds ?? {})) db.prepare('INSERT OR REPLACE INTO board_tasks (id, key) VALUES (?, ?)').run(id, key);
     for (const [id, reason] of snapshot.errors ?? []) db.prepare('INSERT OR REPLACE INTO board_errors VALUES (?, ?)').run(id, reason);
-    for (const change of state('export_pending') ?? []) if (change.source) db.prepare('INSERT OR IGNORE INTO board_export (name, key) VALUES (?, ?)').run(change.source.name, change.source.key);
     const put = (key, value) => db.prepare('INSERT OR REPLACE INTO board_state VALUES (?, ?)').run(key, JSON.stringify(value));
-    put('hermes_cursor', state('hermes_cursor') ?? 0);
     // The document as the tables last described it is indexed now, with each task's sources. A
     // document edited since is left unindexed, so the first write reads all of it as an edit.
     const published = {};
@@ -373,30 +378,26 @@ class ZtrackBoard {
     try { timedStep('board git pull', () => this.git?.pull()); } catch (error) { process.stderr.write(`board: ${error.message}\n`); }
     let txStarted = 0;
     for (let attempt = 0; ; attempt++) {
-      let outcome, hermes = null;
+      let outcome;
       try {
         txStarted = performance.now();
-        // Reading Hermes's export meets its writer (another process exporting) as contention, retried with the write.
-        hermes = this.seed ? null : this.prepareHermes();
         this.dropOverlay();
         this.conn.exec('BEGIN');
         this.active = true; this.contended = false;
         this.conn.exec('DELETE FROM temp.board_dirty; DELETE FROM temp.board_touched');
         this.refused = new Set();
-        this.loadErrors();
-        this.recover();
+        timedStep('board tx errors', () => this.loadErrors());
+        timedStep('board tx recover', () => this.recover());
         if (this.seed) this.indexForSeed();
         else {
-          const stale = this.staleDocuments({ pending: false });
-          if (stale.length) this.applyPlan(this.observe(stale), { overlay: false });
+          const stale = timedStep('board tx stale check', () => this.staleDocuments({ pending: false }));
+          if (stale.length) timedStep('board tx reread', () => this.applyPlan(this.observe(stale), { overlay: false }));
         }
-        if (hermes && hermes.cursor !== this.get('hermes_cursor', 0)) throw RETRY;
-        if (this.seed) this.seedRows(); else this.lift(hermes);
-        this.snapshotHeld();
-        const result = fn(this.db);
+        if (this.seed) this.seedRows();
+        timedStep('board tx snapshot', () => this.snapshotHeld());
+        const result = timedStep('board tx body', () => fn(this.db));
         if (this.contended) throw RETRY;
-        const files = this.render();
-        this.statement('INSERT INTO main.board_export (name, key) SELECT DISTINCT name, key FROM temp.board_dirty WHERE true ON CONFLICT(name, key) DO UPDATE SET rev = rev + 1').run();
+        const files = timedStep('board tx render', () => this.render());
         const intent = files.length ? randomBytes(16).toString('hex') : null;
         if (intent) {
           this.put('pending', { intent, files });
@@ -424,7 +425,6 @@ class ZtrackBoard {
         if (!byManager) try { timedStep('board git commit and push', () => this.git?.commit(actorOf(), `board: ${outcome.files.map((file) => basename(file.path)).join(', ')} written for ${actorOf() ?? 'the board'}`)); }
         catch (error) { process.stderr.write(`board: ${error.message}\n`); }
       }
-      this.exportFollowing();
       return outcome.result;
     }
   }
@@ -1028,196 +1028,6 @@ class ZtrackBoard {
         this.statement('UPDATE main.task_runs SET metadata = ? WHERE id = ?').run(JSON.stringify(meta), task.current_run_id);
       }
     }
-    this.put('hermes_cursor', Number(source.db.prepare('SELECT COALESCE(MAX(id),0) AS id FROM task_events').get().id));
-  }
-
-  // ------------------------------------------------------------------ Hermes compatibility
-
-  prepareHermes() {
-    if (!this.compatLaidOut()) return null;
-    let entry; try { entry = workflowFor(this.root); } catch { return null; }
-    const compat = new DatabaseSync(this.compatPath, { readOnly: true });
-    try {
-      const cursor = this.get('hermes_cursor', 0);
-      const prepared = { entry, evidence: new Map(), cursor };
-      prepared.rows = compat.prepare('SELECT * FROM task_events WHERE id > ? ORDER BY id').all(cursor);
-      for (const row of prepared.rows) {
-        const payload = json(row.payload, {}) ?? {};
-        if (row.kind !== 'completed' || payload.__supercode_export || !this.db.prepare('SELECT 1 FROM tasks WHERE id=?').get(row.task_id)) continue;
-        prepared.evidence.set(row.id, inspectCompletionEvidence(this.board(), row.task_id, entry, payload, completionPhase(this.board(), row.task_id, entry, 'complete', payload, ['hermes'])));
-      }
-      return prepared;
-    } finally { compat.close(); }
-  }
-
-  lift(prepared) {
-    if (!prepared?.rows.length) return;
-    const { entry, rows, evidence } = prepared;
-    const before = actorOf();
-    try {
-      for (const row of rows) {
-        const payload = json(row.payload, {}) ?? {};
-        if (payload.__supercode_export) continue;
-        const task = this.one('SELECT * FROM main.tasks WHERE id = ?', row.task_id);
-        if (!task) continue;
-        this.conn.exec('SAVEPOINT hermes_card');
-        try {
-          const roles = ['manager', 'reviewer', 'platform', 'hermes'];
-          setActor(payload.by ?? 'hermes');
-          let name = null; let words = { ...payload, reason: payload.reason ?? 'unblocked in Hermes' };
-          if (row.kind === 'unblocked') { name = 'unblock'; words = { ...words, reason: 'unblocked in Hermes', hermes: true }; }
-          else if (row.kind === 'completed') { name = 'complete'; words.summary = payload.summary ?? task.result; words.ci = evidence.get(row.id); }
-          else if (row.kind === 'blocked' || row.kind === 'dependency_wait') { name = 'block'; words.on = payload.on ?? payload.parent ?? null; words.hermes = true; }
-          else if (row.kind === 'archived' && statusOf(this.db, task) !== 'done') name = 'cancel';
-          if (row.kind === 'unblocked' && entry.workflow.verbs?.hermes_unpause) {
-            const resumed = fire(this.db, this.board(), entry, task.id, 'hermes_unpause', { roles, payload: { hermes: true, reason: 'unblocked in Hermes' } });
-            for (const effect of resumed.effects) this.statement('INSERT INTO main.supercode_effects (effect) VALUES (?)').run(JSON.stringify(effect));
-          }
-          if (name) {
-            const apply = () => fire(this.db, this.board(), entry, task.id, name, { roles, payload: words });
-            const result = name === 'complete' ? withCompletionEvidence(this.board(), task.id, words.ci, apply) : apply();
-            for (const effect of result.effects) this.statement('INSERT INTO main.supercode_effects (effect) VALUES (?)').run(JSON.stringify(effect));
-          }
-          event(this.db, task.id, 'hermes_lifted', { by: 'hermes', source_event: row.id, verb: name, kind: row.kind });
-          this.conn.exec('RELEASE hermes_card');
-        } catch (error) {
-          this.conn.exec('ROLLBACK TO hermes_card; RELEASE hermes_card');
-          event(this.db, task.id, 'hermes_refused', { by: 'hermes', source_event: row.id, kind: row.kind, reason: error.message });
-        }
-      }
-    } finally { setActor(before); }
-    this.put('hermes_cursor', rows.at(-1).id);
-  }
-
-  // Changed rows reach kanban.db after their commit; a key stays queued until an export consumed
-  // the revision it read.
-  // The Hermes projection follows a committed write and never fails it. A failure keeps the queue for the next
-  // write and is recorded as `export_error` (with a line on stderr) until an export succeeds.
-  exportFollowing() {
-    try {
-      this.flushExport();
-      if (this.get('export_error', null)) this.small(() => this.drop('export_error'));
-    } catch (error) {
-      process.stderr.write(`supercode workflow: kanban.db export deferred: ${error.message}\n`);
-      try { this.small(() => this.put('export_error', { at: Date.now(), message: error.message })); } catch { /* the board itself is busy; the next write retries */ }
-    }
-  }
-
-  flushExport() {
-    if (!this.compatPath) return;
-    const queued = this.statement('SELECT name, key, rev FROM main.board_export').all();
-    // A kanban.db that does not exist yet, or that Hermes has not laid out, is written whole: every card and row.
-    const whole = !this.compatLaidOut();
-    if (!whole && !queued.length) return;
-    this.export(whole ? this.everyRow() : queued);
-    if (queued.length) this.small(() => { for (const q of queued) this.statement('DELETE FROM main.board_export WHERE name = ? AND key = ? AND rev = ?').run(q.name, q.key, q.rev); });
-  }
-
-  // Whether kanban.db exists with Hermes's tables.
-  compatLaidOut() {
-    if (!this.compatPath || !existsSync(this.compatPath)) return false;
-    let compat;
-    try {
-      compat = new DatabaseSync(this.compatPath, { readOnly: true });
-      // a moment of another process's export is not an absent export
-      return retryContention(() => compat.prepare("SELECT COUNT(*) AS n FROM sqlite_master WHERE type = 'table' AND name IN ('tasks', 'task_events')").get().n) === 2;
-    } catch { return false; } finally { compat?.close(); }
-  }
-
-  everyRow() {
-    const rows = [];
-    for (const table of this.tables.values()) {
-      for (const row of this.statement(`SELECT ${table.keys.map(quote).join(',')} FROM main.${quote(table.name)}`).all()) rows.push({ name: table.name, key: JSON.stringify(table.keys.map((k) => row[k])) });
-    }
-    return rows;
   }
 
-  rowOf(name, key) {
-    const table = this.tables.get(name);
-    if (!table) return null;
-    return this.one(`SELECT * FROM main.${quote(name)} WHERE ${table.keys.map((k) => `${quote(k)} IS ?`).join(' AND ')}`, ...JSON.parse(key)) ?? null;
-  }
-
-  export(queued) {
-    let entry; try { entry = workflowFor(this.root); } catch { return; }
-    const stored = (id) => storedStatus(this.db, this.board(), entry, id);
-    const projected = new Set(queued.filter((q) => ['tasks', 'supercode_cards'].includes(q.name)).map((q) => JSON.parse(q.key)[0]));
-    const compat = new DatabaseSync(this.compatPath);
-    try {
-      compat.exec('BEGIN'); this.init(compat, { fresh: true });
-      // Native events and Hermes events share an export database, not an id sequence.
-      // Bootstrap the old identity mapping once; new exports allocate independent Hermes ids.
-      if (!compat.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='supercode_export_events'").get()) {
-        compat.exec('CREATE TABLE supercode_export_events (source_id INTEGER PRIMARY KEY, event_id INTEGER NOT NULL UNIQUE)');
-        compat.exec("INSERT INTO supercode_export_events SELECT id, id FROM task_events WHERE json_extract(payload, '$.__supercode_export') = 1");
-        // Repair existing lowered holds on upgrade, once; subsequent exports stay proportional to changes.
-        for (const state of this.statement('SELECT task_id, paused, blocked_by FROM main.supercode_cards').all()) {
-          if (json(state.paused, null) || json(state.blocked_by, []).some((b) => b.kind === 'message')) projected.add(state.task_id);
-        }
-      }
-      // Every import is event-based. Existing unconsumed acts must never be erased by an export race.
-      const cursor = this.get('hermes_cursor', 0);
-      const unseen = compat.prepare('SELECT payload FROM task_events WHERE id > ?').all(cursor).some((r) => !json(r.payload, {})?.__supercode_export);
-      if (unseen) throw new Error('Hermes wrote during board export; retained its events for the next read');
-      const sources = new Map(queued.map((q) => [`${q.name}:${q.key}`, { name: q.name, key: q.key, row: this.rowOf(q.name, q.key) }]));
-      for (const id of projected) {
-        const row = this.rowOf('tasks', JSON.stringify([id]));
-        const state = this.rowOf('supercode_cards', JSON.stringify([id]));
-        const status = row ? stored(id) : null;
-        sources.set(`tasks:${JSON.stringify([id])}`, { name: 'tasks', key: JSON.stringify([id]), row: row && { ...row, status: status.stored } });
-        if (state || !row) sources.set(`supercode_cards:${JSON.stringify([id])}`, { name: 'supercode_cards', key: JSON.stringify([id]), row: state && { ...state, stage: status?.status ?? state.stage } });
-      }
-      for (const { name, key, row: source } of sources.values()) {
-        if (name === 'sqlite_sequence') continue;
-        if (!compat.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?").get(name)) continue;
-        const table = this.tables.get(name);
-        if (name === 'task_events') {
-          const sourceId = JSON.parse(key)[0];
-          const mapped = compat.prepare('SELECT event_id FROM supercode_export_events WHERE source_id = ?').get(sourceId);
-          if (!source) {
-            if (mapped) compat.prepare('DELETE FROM task_events WHERE id = ?').run(mapped.event_id);
-            compat.prepare('DELETE FROM supercode_export_events WHERE source_id = ?').run(sourceId);
-            continue;
-          }
-          const row = { ...source, payload: JSON.stringify({ ...json(source.payload, {}), __supercode_export: true }) };
-          delete row.id;
-          const keys = Object.keys(row);
-          if (mapped) {
-            const previous = compat.prepare('SELECT * FROM task_events WHERE id = ?').get(mapped.event_id);
-            if (previous && keys.every((k) => previous[k] === row[k])) continue;
-            compat.prepare(`UPDATE task_events SET ${keys.map((k) => `${quote(k)} = ?`).join(',')} WHERE id = ?`).run(...keys.map((k) => row[k]), mapped.event_id);
-          } else {
-            const inserted = compat.prepare(`INSERT INTO task_events (${keys.map(quote)}) VALUES (${keys.map(() => '?')})`).run(...keys.map((k) => row[k]));
-            compat.prepare('INSERT INTO supercode_export_events (source_id, event_id) VALUES (?, ?)').run(sourceId, inserted.lastInsertRowid);
-          }
-          continue;
-        }
-        const where = table.keys.map((k) => `${quote(k)} IS ?`).join(' AND ');
-        if (!source) { compat.prepare(`DELETE FROM ${quote(name)} WHERE ${where}`).run(...JSON.parse(key)); continue; }
-        const columns = new Set(compat.prepare(`PRAGMA table_info(${quote(name)})`).all().map((c) => c.name));
-        const keys = Object.keys(source).filter((k) => columns.has(k));
-        const previous = compat.prepare(`SELECT * FROM ${quote(name)} WHERE ${where}`).get(...JSON.parse(key));
-        if (previous && keys.every((k) => previous[k] === source[k])) continue;
-        compat.prepare(`INSERT OR REPLACE INTO ${quote(name)} (${keys.map(quote)}) VALUES (${keys.map(() => '?')})`).run(...keys.map((k) => source[k]));
-      }
-      // Hermes recomputes ready on read. Its sticky block is the last blocked/unblocked event,
-      // so lowering the status alone cannot preserve a pause (including one made by a document edit).
-      for (const id of projected) {
-        const state = compat.prepare('SELECT t.status, c.stage, c.paused, c.blocked_by FROM tasks t JOIN supercode_cards c ON c.task_id = t.id WHERE t.id = ?').get(id);
-        if (!state) continue;
-        const sticky = state.status === 'blocked' && (json(state.paused, null) || json(state.blocked_by, []).some((b) => b.kind === 'message'));
-        const last = compat.prepare("SELECT kind, payload FROM task_events WHERE task_id = ? AND kind IN ('blocked','unblocked') ORDER BY id DESC LIMIT 1").get(id);
-        if (sticky) compat.prepare("UPDATE tasks SET block_kind = 'needs_input' WHERE id = ?").run(id);
-        const cleared = !sticky && json(last?.payload, {})?.__supercode_sticky;
-        if ((sticky && last?.kind !== 'blocked') || (cleared && last?.kind === 'blocked')) {
-          const payload = { __supercode_export: true, __supercode_sticky: true, block_kind: 'needs_input', source_status: state.stage,
-            reason: json(state.paused, null)?.reason ?? (sticky ? 'waiting on a message' : 'lowered hold cleared') };
-          compat.prepare('INSERT INTO task_events (task_id, kind, payload, created_at) VALUES (?, ?, ?, ?)').run(id, sticky ? 'blocked' : 'unblocked', JSON.stringify(payload), now());
-        }
-      }
-      compat.exec('COMMIT');
-      // Exported events carry an origin marker and never advance the Hermes input cursor.
-    } catch (error) { try { compat.exec('ROLLBACK'); } catch { /* not begun */ } throw error; }
-    finally { compat.close(); }
-  }
 }

package/index.d.ts

@@ -123,6 +123,7 @@ export function finishAgentAssignment(root: Path, org: string, assignment: strin
 export function synchronizeAgentEnds(root: Path, org: string, options?: {context?: string}): Array<{agent: string; error: string}>;
 export function recordAgentRun(root: Path, org: string, id: string, run: {session: string; machine?: string | null; run: string | number; profile?: unknown; main?: boolean; starterSession?: string | null}): void;
 export function pendingAgentRuns(root: Path, org: string): Array<Record<string, unknown>>;
+export function abandonAgentRun(root: Path, org: string, session: string): void;
 export function synchronizeAgentRun(root: Path, org: string, row: {agent_id: string; session_ref: string; machine?: string | null; main?: boolean | number; starter_session?: string | null}, options?: {context?: string; intended?: unknown}): import('@volter/teams/http-client').SessionIdentity & {runtime: unknown};
 export function agentRunForSession(root: Path, references: Array<string | null | undefined>): Record<string, unknown> | null;
 export function agentPreamble(agent: ReturnType<typeof ensureCardAgent>, options?: {main?: boolean; previous?: Array<{session: string; machine?: string | null; ended_at?: number | null; end_reason?: string | null}>}): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.23",
+  "version": "0.5.24",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@volter/supercode-harness-sdk": "^0.3.58",
-    "@volter/teams": "0.2.10",
+    "@volter/teams": "0.2.11",
     "@volter/ztrack": "^2.4.23",
     "yaml": "^2.9.0"
   },