@volter/supercode-orchestrator 0.5.37 → 0.5.39

package/board/dispatch.mjs

@@ -16,11 +16,11 @@
 // subscriber's cursor moves only after its notice was delivered, so two dispatchers over one board never both
 // launch and a crash between the two steps is answered by the next tick.
 import { monitorsRuns, failedObservation, surfaceIncident, auditEndedRuns, originOf } from './incidents.mjs';
-import { readEventFleet } from './event-fleet.mjs';
-let eventFleetRoot = null;
+import { readMachineFleet } from './machine-fleet.mjs';
+let fleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
-import { agentScope, localCardAgent, localReaderContext, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, pendingAgentRuns, synchronizeAgentRun, abandonAgentRun,agentProfileMismatch,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds, agentRunForSession } from '../agents.mjs';
+import { agentScope, localCardAgent, localReaderContext, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, pendingAgentRuns, synchronizeAgentRun, claimAgentRun, releaseAgentRun, abandonAgentRun,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds, agentRunForSession } from '../agents.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
 import { memorySnapshotSync } from '../hermes-cli.mjs';
 import { createRequire } from 'node:module';
@@ -39,7 +39,7 @@ import { identifyNotice } from './notices.mjs';
 import { pendingRequestMail } from './request-mail.mjs';
 import {
   cardContext, claimTtl, currentRun, DEFAULT_FAILURE_LIMIT, extendClaim, getTask, lastSession,
-  recomputeReady, runEffects, setRunSession, subscribeIn, subscriptions, reconcileDependencySubscriptions,
+  recomputeReady, runEffects, queueEffects, setRunSession, subscribeIn, subscriptions, reconcileDependencySubscriptions,
 } from './engine.mjs';
 
 const WORKER = fileURLToPath(new URL('../bin/hermes-worker.mjs', import.meta.url));
@@ -115,9 +115,22 @@ export function callerSession() {
   return claude;
 }
 
-export function observeFleet(root = eventFleetRoot) {
-  const fleet = readEventFleet(root);
-  presenceReading = { known: fleet.presenceKnown === true, online: new Set([localMachine(), ...fleet.online]) };
+/** The fleet as the home's machines answer for themselves (machine-fleet.mjs): this machine, and every machine an open
+ * card of the home names or one of its notice subscribers is on. */
+export function observeFleet(root = fleetRoot) {
+  const machines = new Set();
+  for (const slug of root ? listBoards(root) : []) {
+    try {
+      const b = openBoard(root, slug);
+      try {
+        const live = "t.status NOT IN ('done', 'cancelled', 'archived') AND NOT COALESCE(c.archived, 0)";
+        for (const { machine } of b.db.prepare(`SELECT DISTINCT c.machine FROM supercode_cards c JOIN tasks t ON t.id = c.task_id WHERE c.machine IS NOT NULL AND c.machine != '' AND ${live}`).all()) machines.add(normalMachine(machine));
+        for (const { chat_id: address } of b.db.prepare(`SELECT DISTINCT s.chat_id FROM kanban_notify_subs s JOIN tasks t ON t.id = s.task_id JOIN supercode_cards c ON c.task_id = t.id WHERE s.platform = 'supercode' AND s.chat_id LIKE 'sc:%' AND ${live}`).all()) machines.add(normalMachine(address.split(':')[1]));
+      } finally { b.close(); }
+    } catch { /* its own tick reports it */ }
+  }
+  const fleet = readMachineFleet(machines, localMachine());
+  presenceReading = { known: fleet.presenceKnown === true, online: new Set([localMachine(), ...fleet.online]), unknown: fleet.unknown ?? new Set() };
   notePresence(presenceReading);
   return fleet;
 }
@@ -139,26 +152,30 @@ const adoptedOnly = (s) => s?.mode === 'adopt' && !s.launch_key && s.surface !==
 const addressOf = (s) => s?.address ?? (s?.session_id && s.machine ? `sc:${s.machine}:${s.harness ?? 'claude-code'}:${s.session_id}` : null);
 const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 
-// A run Teams never published (one outside a synced root, a scratch workspace's) is read on its own machine: a
-// headless worker by its pid, a pane by that machine's pane list. Null only when the machine cannot answer.
+// A session in a live pane of its machine is the fleet's reading; any other run is read on its own machine: a headless
+// worker by its pid, a pane by that machine's pane list, a session in no pane (an adopted native one) by that machine's
+// harness discovery. Null only when the machine cannot answer.
 const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ? fleet.native.get(addressOf(session)).alive : unpublishedAlive(session);
+/** A subscriber's address as the session it names, for sessionAlive (its machine, harness and native id). */
+const sessionAt = (address) => { const m = /^sc:([^:]+):([^:]+):(.+)$/.exec(String(address)); return m && HARNESSES[m[2]] ? { address, machine: normalMachine(m[1]), harness: m[2], session_id: m[3] } : null; };
+const subscriberAlive = (fleet, address) => fleet.alive.has(address) || (sessionAt(address) ? sessionAlive(fleet, sessionAt(address)) === true : false);
 const paneLists = new Map();
-// A run the agent sync holds names only its machine and native session (`harness:id`), never a pane or pid. Teams'
-// fleet answers for a session it published; one it never published (a gateway worker in its profile's directory,
-// outside every synced root) is read through its machine's native discovery, as a native close reads it.
+// A run the agent sync holds names only its machine and native session (`harness:id`), never a pane or pid.
 function syncRowAlive(fleet, row) {
   const machine = row.machine || localMachine(), at = row.session_ref.indexOf(':');
-  const session = { machine, harness: row.session_ref.slice(0, at), session_id: row.session_ref.slice(at + 1), address: `sc:${machine}:${row.session_ref}` };
-  const alive = sessionAlive(fleet, session);
-  if (alive !== null) return alive;
-  try { return nativeReading(nativeSessions(machine, session.harness), session).alive; } catch { return null; }
+  return sessionAlive(fleet, { machine, harness: row.session_ref.slice(0, at), session_id: row.session_ref.slice(at + 1), address: `sc:${machine}:${row.session_ref}` });
 }
 function unpublishedAlive(session) {
   if (!session) return null;
   if (session.surface === 'headless' && session.pid) return pidAlive(session.pid);
-  if (!session.pane || !session.machine) return null;
+  if (!session.machine) return null;
+  if (!session.pane) {
+    if (!session.session_id) return null;
+    try { return nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code'), session).alive; } catch { return null; }
+  }
   let entry = paneLists.get(session.machine);
-  if (!entry || Date.now() - entry.at > 5000) {
+  if (!entry || Date.now() - entry.at > READING_MS) {
+    if (readingsOnly) return null;
     const r = doorOn(session.machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
     const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
     entry = { at: Date.now(), panes: Array.isArray(panes) ? panes : null };
@@ -170,19 +187,34 @@ function unpublishedAlive(session) {
 /** Native activity comes from the machine's harness discovery, not catalogue age. One discovery (up to 2000
  * sessions, seconds each) serves a round's every native session on that machine, as paneLists serves its panes. */
 const discoveries = new Map();
+// A machine's pane list and harness discovery are read before a board write opens, never inside one: a door that
+// takes seconds would hold the board's write lock past a worker's own command's busy wait. A write that needs a
+// reading not taken yet reads it as unknown. One reading serves READING_MS.
+const READING_MS = 15_000;
+let readingsOnly = 0;
+const txRead = (board, fn) => { readingsOnly += 1; try { return tx(board, fn); } finally { readingsOnly -= 1; } };
+/** Take the readings a board write about `session` will need, before the write. */
+function readBefore(fleet, session) {
+  if (!session?.session_id || !session.machine || session.surface === 'headless') return;
+  try { nativeSessions(session.machine, session.harness ?? 'claude-code'); } catch { /* unread: unknown inside the write */ }
+  sessionAlive(fleet, session);
+}
 function nativeSessions(machine, harness) {
   const key = `${normalMachine(machine)}\u0000${harness}`, seen = discoveries.get(key);
-  if (seen && Date.now() - seen.at <= 5000) return seen.sessions;
+  if (seen && Date.now() - seen.at <= READING_MS) return seen.sessions;
+  if (readingsOnly) throw unavailable('native liveness is read before a board write, not inside it');
   const sessions = discoverNative(machine, harness);
   discoveries.set(key, { at: Date.now(), sessions });
   return sessions;
 }
+// A native discovery is bounded as the fleet reading is: one that does not answer in time is unknown, read next round.
+const NATIVE_DISCOVERY_MS = 15_000;
 function discoverNative(machine, harness) {
   if (offlineMachine(machine)) throw unavailable(`native liveness unavailable: machine ${normalMachine(machine)} is offline`);
   // This machine's discovery is its harness door, as every other harness read here is; another machine's is supercode's fleet arm
   const result = normalMachine(machine) === localMachine()
-    ? doorOn(machine, 'harness.v1.sessions.discover', { harnesses: [harness], limit: 2000 }, { timeout: 120_000 })
-    : sc(['discover', '--on', machine, '--harness', harness, '--limit', '2000'], { timeout: 120_000 });
+    ? doorOn(machine, 'harness.v1.sessions.discover', { harnesses: [harness], limit: 2000 }, { timeout: NATIVE_DISCOVERY_MS })
+    : sc(['discover', '--on', machine, '--harness', harness, '--limit', '2000'], { timeout: NATIVE_DISCOVERY_MS });
   const page = result.code === 0 ? lastJson(result.stdout) : null;
   if (!Array.isArray(page?.sessions)) throw unavailable(`native liveness unavailable on ${machine}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
   return page.sessions;
@@ -256,8 +288,9 @@ export function lanesOf(profiles = {}) {
   return out;
 }
 
-// The latest presence reading (observeFleet). A machine it reads as offline is not asked: each remote call would
-// wait out its timeout, and one offline machine held every close and launch on this one.
+// The latest presence reading (observeFleet). A machine that did not answer it (offline, or unread this round) is not
+// asked again until the next reading: each remote call would wait out its timeout, and one silent machine held every
+// close and launch on this one. Its door answers `machine_offline`, which every caller tries again next round.
 let presenceReading = null;
 const offlineMachine = (machine) => {
   const m = normalMachine(machine ?? localMachine());
@@ -265,7 +298,7 @@ const offlineMachine = (machine) => {
 };
 /** A machine's public door (`harness.v1.*`), answered at once when the machine reads as offline. */
 const doorOn = (machine, method, params, options) => offlineMachine(machine)
-  ? { code: 1, stdout: '', stderr: `machine ${normalMachine(machine)} is offline` }
+  ? { code: 1, stdout: '', stderr: JSON.stringify({ code: 'machine_offline', message: `machine ${normalMachine(machine)} did not answer the fleet reading` }) }
   : runtimeDoor(normalMachine(machine ?? localMachine()) === localMachine() ? null : machine, method, params, options);
 const unavailable = message => Object.assign(new Error(message), { launchDeferred: true });
 
@@ -282,8 +315,9 @@ function supervise(board, fleet, settings, report, entry, effects) {
     try { const receipt = launchReceipt(board, session); if (receipt?.live === false && receipt.exit) exits.set(id, receipt.exit); }
     catch (error) { report.failed.push([id, `exit receipt unavailable; retaining liveness observation: ${error.message}`]); }
   }
+  for (const { id } of rows) readBefore(fleet, currentRun(board.db, id)?.metadata?.supercode);
   for (const { id } of rows) {
-    tx(board, (db) => {
+    txRead(board, (db) => {
       const task = getTask(db, id);
       if (!task || (entry.workflow.run ? !task.current_run_id : task.status !== 'running')) return;
       const runRow = currentRun(db, id);
@@ -329,11 +363,11 @@ function supervise(board, fleet, settings, report, entry, effects) {
         } else extendClaim(db, id, { ttl: settings.ttl, reason: 'launch_receipt_pending' });
         return;
       }
-      // Availability is the same retained linked/unlinked feed subscribers hear.
-      // A failed stream is unknown, not evidence that every remote machine left.
+      // Availability is the machine's own door (observeFleet). A machine whose door did not answer is unknown, not
+      // evidence that it left: its run is kept. Only a relay's positive answer that it is not linked reads as offline.
       if (session?.session_id && session.surface !== 'headless') {
         const reachable = fleet.online.has(session.machine);
-        if (!reachable && !fleet.presenceKnown) return;
+        if (!reachable && (!fleet.presenceKnown || fleet.unknown?.has(session.machine))) return;
         if (!reachable) {
           const next = {...session, offline_since: session.offline_since ?? t};
           setRunSession(db,runRow.id,next);
@@ -736,7 +770,7 @@ export function launchRun(board, entry, id, lane, fleet, settings) {
 export async function startCard(board, id, { roles = ['manager'], lanes, settings } = {}) {
   // the board's own published fleet projection, as a tick reads it: a manager's or creator's start that continues the
   // slot's session checks that session through it
-  eventFleetRoot = board.root;
+  fleetRoot = board.root;
   const entry = await loadWorkflow(board.root);
   const fleet = observeFleet();
   const before = getTaskNow(board, id), checked = checkWorkspace(board, before);
@@ -925,16 +959,21 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
     return Number(discovered.get(key)?.find((row) => row.locator?.session_id === session.session_id)?.updated_at_ms) || null;
   };
   const managers = [].concat(entry.params.managers ?? []).filter(Boolean);
-  for (const { id } of board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all()) {
-    tx(board, (db) => {
+  const running = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
+  for (const { id } of running) { const session = currentRun(board.db, id)?.metadata?.supercode; readBefore(fleet, session); if (session?.session_id) updatedAt(session); }
+  for (const { id } of running) {
+    txRead(board, (db) => {
       const task = getTask(db, id);
       const status = statusOf(db, task);
       if (!(entry.workflow.statuses[status]?.on?.session_idle || entry.workflow.on?.session_idle || entry.workflow.run?.on?.session_idle)) return;
       const runRow = currentRun(db, id);
       const session = runRow?.metadata?.supercode;
       if (!session?.session_id || !['pane', 'native'].includes(session.surface) || session.offline_since != null) return;
-      if (session.surface === 'native' && fleet.native?.get(addressOf(session))?.alive !== true) return;
-      const live = fleet.sessions.find((x) => x.address === addressOf(session));
+      if (session.surface === 'native' && sessionAlive(fleet, session) !== true) return;
+      // a session in no pane has its turn on its machine's discovery row, which sessionAlive just read
+      let nativeRow = null;
+      if (session.surface === 'native') try { nativeRow = nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code'), session).row; } catch { /* unread: no turn */ }
+      const live = fleet.sessions.find((x) => x.address === addressOf(session)) ?? (nativeRow ? { address: addressOf(session), turn: nativeRow.activity?.turn ?? null } : undefined);
       const observedAt = now();
       const lastAtMs = Number(live?.last_message_at_ms) || updatedAt(session);
       const lastAt = Math.floor(Number(lastAtMs) / 1000);
@@ -989,7 +1028,7 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
         const observation = retain('dispatched', { turns_after: Number(stored?.goal_turns ?? 0), nudge_queued: r.effects.some(e => e.kind === 'send_to_actor'), run_ended: after?.id !== runRow.id });
         event(db, id, 'session_idle_observed', observation, runRow.id);
         if (after?.id === runRow.id) setRunSession(db, runRow.id, { goal_nudged_at: observedAt });
-        report.notified.push([id, 'session_idle', live.address]);
+        report.notified.push([id, 'session_idle', addressOf(session)]);
       } catch (error) {
         retain('dispatch_failed', { error: String(error.message).slice(-200) });
         report.failed.push([id, `session_idle: ${String(error.message).slice(-200)}`]);
@@ -1034,7 +1073,9 @@ export async function sessionNotice(board, e) {
         : { lifecycle_notice_error: null, ...(session.lifecycle_notice_pending === e.durableId ? { lifecycle_notice_pending: null } : {}) }) });
     if (!error || session?.lifecycle_notice_error !== error) event(db, e.id, error ? 'session_notice_failed' : receipt?.delivered ? 'session_notice_delivered' : 'session_notice_queued', { address: e.address, verb: e.verb, source_event: e.sourceEvent, notice: e.durableId, receipt, ...(error ? { error, retry: true } : {}) }, e.runId);
   });
-  return !error;
+  // the attempt's reason goes with it, onto the effect's row (runEffects counts the attempt)
+  if (error) throw new Error(error);
+  return true;
 }
 
 /** A session effect a committed move asked for: a message to the card's current actor, or closing a slot's pane. */
@@ -1054,7 +1095,10 @@ export async function sessionEffect(board, e) {
       const payload = { notice: e.durableId, address, receipt };
       if (previous?.kind !== kind || JSON.stringify(json(previous?.payload, {})?.receipt) !== JSON.stringify(receipt)) event(db, e.id, kind, payload, e.runId);
     });
-    return receipt.delivered;
+    // a send its recipient's mailbox took (filed, or queued for a session between turns) is accepted: the mailbox
+    // delivers it from there, and the board does not send it again
+    if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'the actor notice was not filed');
+    return true;
   }
   if (e.kind === 'close_session' || e.kind === 'run_ended') {
     tx(board, (db) => requestSessionClose(db, e.id, e.kind === 'run_ended' ? { runId: e.runId } : { slot: e.slot, through: e.runId }));
@@ -1069,6 +1113,7 @@ export async function sessionEffect(board, e) {
  * Once every PR is merged the card is sent `reviewed_merged` with the merge commits. Answers false (kept, tried again
  * next round) on anything GitHub did not decide.
  */
+const MERGE_BUDGET_MS = 300_000;
 export async function mergeReviewed(board, e) {
   const { candidatePullRequests, mergeReviewedPullRequest } = await import('./ci.mjs');
   const pass = view(board, (db) => db.prepare("SELECT id, payload FROM task_events WHERE task_id = ? AND kind = 'review_pass' ORDER BY id DESC LIMIT 1").get(e.id));
@@ -1076,11 +1121,16 @@ export async function mergeReviewed(board, e) {
   const ci = typeof recorded === 'string' ? json(recorded, null) : recorded;
   const prs = candidatePullRequests(ci).filter((p) => p?.pr?.url && p.commit);
   const merges = [];
+  // a merge attempt spends at most MERGE_BUDGET on starting GitHub calls (each bounded by its own timeout), inside its
+  // effect's claim; what is left is the next attempt's
+  const began = Date.now();
   for (const p of prs) {
+    if (Date.now() - began > MERGE_BUDGET_MS) throw new Error(`the merge attempt spent its ${MERGE_BUDGET_MS / 1000} s; the rest is merged next attempt`);
     let answer;
     try { answer = mergeReviewedPullRequest(p.pr.url, p.commit); } catch (error) {
-      tx(board, (db) => event(db, e.id, 'merge_pending', { pr: p.pr.url, reviewed: p.commit, reason: String(error.message).slice(-300) }));
-      return false;
+      const reason = String(error.message).slice(-300);
+      tx(board, (db) => event(db, e.id, 'merge_pending', { pr: p.pr.url, reviewed: p.commit, reason }));
+      throw new Error(`merging ${p.pr.url} at ${p.commit}: ${reason}`);
     }
     if (answer.merged) { merges.push({ pr: p.pr.url, reviewed: p.commit, merge: answer.sha }); continue; }
     const reason = answer.moved ? `${p.pr.url} is no longer at its reviewed head ${p.commit}${answer.head ? ` (now ${answer.head})` : ''}; what was pushed after the verdict needs its own review` : `${p.pr.url} was closed without merging`;
@@ -1121,7 +1171,7 @@ function launcherCheck(db, task, lane, fleet) {
   if (!task.machine) return 'the card names no machine; a pane session runs on the machine its card names';
   const machine = normalMachine(task.machine);
   if (!fleet.ok) return `supercode could not read the fleet: ${fleet.error}`;
-  if (machine !== localMachine() && !fleet.presenceKnown) return 'machine event stream unavailable; launch waits for a current availability reading';
+  if (fleet.unknown?.has(machine)) return `machine ${machine}'s door did not answer; the card starts when it does`;
   if (!fleet.online.has(machine)) return `machine ${machine} is offline; the card starts when it is back`;
   // a card on this machine gets its workspace made here (scratch, dir or worktree, as Hermes makes it); another
   // machine's card names its directory there
@@ -1266,7 +1316,7 @@ function bindLaunch(board, row, session, pane, sid) {
 
 /** A fast worker can reach its first board door before open's reply. Bind only the daemon's keyed pane. */
 export function reconcileCallerLaunch(board, sid) {
-  eventFleetRoot = board.root;
+  fleetRoot = board.root;
   if (view(board, (db) => db.prepare(`SELECT 1 FROM task_runs r JOIN tasks t ON t.current_run_id=r.id
     WHERE json_extract(r.metadata, '$.supercode.session_id')=? AND COALESCE(json_extract(r.metadata, '$.supercode.launch_pending'),0)=0`).get(sid))) return;
   const rows = view(board, (db) => db.prepare(`SELECT r.id, r.task_id, r.metadata FROM task_runs r
@@ -1290,7 +1340,9 @@ export function reconcileCallerLaunch(board, sid) {
   }
 }
 
-function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
+/** The board's agent records joined to Teams: declarations, ends, session ownership and usage. Teams I/O, so it runs in
+ * the delivery pass (`deliver`), never in a dispatch round. */
+function synchronizeAgents(board, fleet, report, entry) {
   // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
   // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
   const agentRuns=[...new Map(view(board,db=>db.prepare("SELECT id,task_id,metadata,ended_at FROM task_runs WHERE json_extract(metadata,'$.supercode.agent_id') IS NOT NULL ORDER BY id").all())
@@ -1299,15 +1351,6 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
   for(const row of agentRuns){
     const session=json(row.metadata,{})?.supercode;
     if(!session?.session_id||!session.agent_org)continue;
-    const observation=fleet.sessions?.find(item=>item.address===addressOf(session))?.identity;
-    if(observation?.agent?.id===session.agent_id&&session.agent_profile_revision!==observation.revision){
-      const mismatch=agentProfileMismatch(session.agent_profile_intent,observation.resolved);
-      tx(board,db=>{
-        // Rule 4: a run whose recorded profile differs from its agent's intent is shown and not counted.
-        setRunSession(db,row.id,{agent_profile_recorded:observation.resolved,agent_profile_revision:observation.revision,agent_profile_mismatch:mismatch,counted:!mismatch.differences.length});
-        event(db,row.task_id,mismatch.differences.length?'agent_profile_drift':'agent_profile_recorded',{agent:session.agent_id,session:session.session_id,comparison:mismatch},row.id);
-      });
-    }
     const ref=`${session.harness}:${session.session_id}`;
     // An ended run whose session the agent store already holds, published, for another agent lost that claim when it
     // ran: no round can change an ended run or a published owner, so the disagreement is history. It is said once on
@@ -1327,10 +1370,11 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
     orgs.set(session.agent_org,session.agent_context);
   }
   // Identities minted while Teams was absent are declared under their ids before their sessions are joined.
-  const context=process.env.SUPERCODE_CONTEXT,scope=agentScope(context);
+  const context=process.env.SUPERCODE_CONTEXT;
+  let scope;try{scope=agentScope(context);}catch(error){scope={offline:true};report.failed.push(['agents',`agent declarations wait: ${error.message}`]);}
   if(!scope.offline){
     orgs.set(scope.org,orgs.get(scope.org)??context);
-    for(const pending of synchronizeLocalAgents({root:board.root,profiles:entry.profiles,context}))report.queued.push([pending.agent,`agent declaration pending: ${pending.error}`]);
+    for(const pending of synchronizeLocalAgents({root:board.root,profiles:entry.profiles,context}))(pending.failed?report.failed:report.queued).push([pending.agent,`agent declaration ${pending.failed?`failed for good after ${pending.attempts} refusals`:'pending'}: ${pending.error}`]);
   }
   orgs.delete('local');
   // G3: an ended run's session usage, read once from its harness's own records on its machine
@@ -1357,9 +1401,14 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
   for(const [org,context] of orgs)for(const pending of synchronizeAgentEnds(board.root,org,{context}))report.queued.push([pending.agent,`agent end synchronization pending: ${pending.error}`]);
   for(const [org,context] of orgs)for(const row of pendingAgentRuns(board.root,org)){
     const launch=agentRuns.find(run=>String(run.id)===String(row.run_id));
+    // each run is claimed by compare-and-set on its own `published` before it is joined; another pass's claim skips it
+    if(!claimAgentRun(board.root,org,row))continue;
     try{synchronizeAgentRun(board.root,org,row,{context,intended:json(launch?.metadata,{})?.supercode?.agent_profile_intent});}
-    catch(error){if(error.code==='rate_limited'){report.queued.push([row.run_id,`agent session sync pending: ${error.message}`]);break;}const gone=error.claimRefused&&error.status===404&&fleet.ok&&syncRowAlive(fleet,row)===false;if(gone)abandonAgentRun(board.root,org,row.session_ref);report.failed.push([row.run_id,`agent session sync failed: ${error.message}${gone?`; ${row.session_ref} is stopped and Teams refuses it, so it leaves the sync`:''}`]);}
+    catch(error){releaseAgentRun(board.root,org,row);if(error.code==='rate_limited'){report.queued.push([row.run_id,`agent session sync pending: ${error.message}`]);break;}const gone=error.claimRefused&&error.status===404&&fleet.ok&&syncRowAlive(fleet,row)===false;if(gone)abandonAgentRun(board.root,org,row.session_ref);report.failed.push([row.run_id,`agent session sync failed: ${error.message}${gone?`; ${row.session_ref} is stopped and Teams refuses it, so it leaves the sync`:''}`]);}
   }
+}
+
+function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
   const deferred=view(board,db=>db.prepare("SELECT t.id,r.id run_id,COALESCE(json_extract(r.metadata,'$.supercode.launched_at'),r.started_at) launched_at FROM tasks t JOIN task_runs r ON r.id=t.current_run_id WHERE r.ended_at IS NULL AND json_extract(r.metadata,'$.supercode.launch_deferred')=1").all());
   // A deferred launch was never issued (a reading or door was not yet available): it is the start its manager, creator
   // or workflow asked for, carried out within the launch window; supervise surfaces it once when the window ends. The
@@ -1436,7 +1485,8 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   if (lane.harness === 'codex' && lane.reasoning_effort) tail.push('-c', `model_reasoning_effort=${JSON.stringify(lane.reasoning_effort)}`);
   const harness = HARNESSES[lane.harness] ? lane.harness : 'claude-code';
   const how = HARNESSES[harness];
-  const base = ['open', '--new', how.program, '--detach', `--window=${window}`, '--on', task.machine, '--cwd', task.workspace_path, '--env', 'SUPERCODE_BOARD_PROCESS_GUARD=1',
+  // A card on this machine opens through this machine's own daemon; only another machine is reached with `--on`.
+  const base = ['open', '--new', how.program, '--detach', `--window=${window}`, ...(machine === localMachine() ? [] : ['--on', task.machine]), '--cwd', task.workspace_path, '--env', 'SUPERCODE_BOARD_PROCESS_GUARD=1',
     ...Object.entries(meta.agent_env??{}).flatMap(([key,value])=>['--env',`${key}=${value}`])];
   // the slot's last session: kept when live, resumed when lost, never another slot's (a reviewer's is its own)
   // a close its session's own command asked for is carried out first, so its pane is gone before the slot's next
@@ -1497,10 +1547,14 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   };
   let session = null;
   let replaced = null;
-  if (prev?.surface === 'native' && !prev.pane && !prev.close_confirmed_at) {
+  // A session in no pane is read on its machine before anything replaces it. One the board released (an adopted
+  // session it did not launch, left running at its run's end) is its owner's while it runs: it is never resumed beside
+  // itself, and the launch waits for the owner to end it.
+  if (prev?.surface === 'native' && !prev.pane && (!prev.close_confirmed_at || prev.released)) {
     const reading = nativeReading(nativeSessions(prev.machine, prev.harness), prev);
     if (reading.alive == null) throw unavailable(`cannot establish native continuation liveness for ${addressOf(prev)}`);
     fleet.native ??= new Map(); fleet.native.set(addressOf(prev), reading);
+    if (reading.alive && prev.released) throw unavailable(`released session ${addressOf(prev)} still runs; the launch waits for its owner to end it`);
     if (reading.alive && (prev.closed_at || prev.close_requested || prev.forgotten)) throw unavailable(`native session ${addressOf(prev)} is still live; its close must finish before replacement`);
   }
   if (prev?.forgotten) {
@@ -1750,25 +1804,13 @@ function adoptionOpenTo(db, id, request, open) {
   return Boolean(claim) && claim.request === request && claim.lock === claimer();
 }
 
-/**
- * A session on this machine that Teams never published (one outside every synced root: a profile's own directory) is
- * found through this machine's own doors: its panes, and the native session each pane's process runs. Only a full
- * address is looked up here; liveness is still verified below as for any other session.
- */
-function localListing(who) {
+/** A session in no pane (a native process its machine's harness discovery holds as running), by its full address. */
+function nativeListing(who) {
   const m = /^sc:([^:]+):([^:]+):(.+)$/.exec(String(who));
-  if (!m || normalMachine(m[1]) !== localMachine()) return null;
-  const [, , harness, sessionId] = m;
-  const listed = runtimeDoor(null, 'harness.v1.panes.list', {}, { timeout: 60_000 });
-  const panes = (listed.code === 0 ? json(listed.stdout.trim(), []) : []) ?? [];
-  const live = panes.filter((p) => !p.dead && p.pid);
-  if (!live.length) return null;
-  const r = runtimeDoor(null, 'harness.v1.sessions.activity_under', { pids: live.map((p) => p.pid) }, { timeout: 30_000 });
-  const row = (r.code === 0 ? json(r.stdout.trim(), {})?.activities ?? [] : []).find((a) => a.activity?.session_id === sessionId && (a.activity?.harness ?? harness) === harness);
-  // Not found in a pane of this machine: not listed, so a session opened moments ago is looked for again next tick.
-  const pane = row ? live.find((p) => p.pid === row.pid)?.pane ?? null : null;
-  if (!pane) return null;
-  return { address: `sc:${localMachine()}:${harness}:${sessionId}`, machine: localMachine(), harness, session_id: sessionId, pane, name: null };
+  if (!m || !HARNESSES[m[2]]) return null;
+  const [, host, harness, session_id] = m;
+  try { return nativeReading(nativeSessions(host, harness), { session_id, harness }).alive === true ? { address: who, machine: normalMachine(host), harness, session_id, pane: null, name: null } : null; }
+  catch { return null; }
 }
 
 /** The verb an adoption with no current run fires: the workflow's own `adopt` where it declares one, else its dispatch start. */
@@ -1790,7 +1832,7 @@ function adoptedRole(db, board, entry, task, run) {
 function adoptSession(board, id, who, { request = null, open = request, progress = {}, workspace = null, ttl, assignee = null, role = null, fleet = null, lanes = null } = {}) {
   fleet ??= observeFleet();
   if (!fleet.ok) throw new Error(`supercode could not read the fleet: ${fleet.error}`);
-  const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who) ?? localListing(who);
+  const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who) ?? nativeListing(who);
   if (!found) throw Object.assign(new Error(`the fleet lists no live session ${who}`), { notListed: true });
   const [, host, harness, sessionId] = found.address.split(':');
   if (!HARNESSES[harness]) throw new Error(`${found.address} is ${harness}; the board keeps and resumes ${Object.keys(HARNESSES).join(' and ')} sessions`);
@@ -1918,7 +1960,7 @@ function reconnectContinuedSessions(board, fleet, entry, report) {
       // Preserve the ended interval as evidence before reopening supervision on the same run.
       event(db,row.task_id,'session_continued',{session_id:saved.session_id,from_pane:saved.pane,pane,prior_outcome:row.outcome,prior_ended_at:row.ended_at,incident:saved.incident??null},row.id);
       db.prepare("UPDATE task_runs SET ended_at=NULL,status='running',outcome=NULL,error=NULL,metadata=?,claim_lock=?,claim_expires=? WHERE id=?")
-        .run(JSON.stringify({...json(row.metadata,{}),supercode:session}),claimer(),now()+900,row.id);
+        .run(JSON.stringify({...json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(row.id)?.metadata,{}),supercode:session}),claimer(),now()+900,row.id); // re-read: the run's observations just recorded stay
       db.prepare('UPDATE tasks SET current_run_id=?,claim_lock=?,claim_expires=? WHERE id=?').run(row.id,claimer(),now()+900,row.task_id);
       projectStatus(db,board,entry,row.task_id);
       event(db,row.task_id,'dispatch_released',{reason:'verified manual continuation',session:addressOf(session),incident:saved.incident??null});
@@ -1983,10 +2025,43 @@ export async function alertManagers(root, slug, text, key) {
  * and marked board_message_sent. A question goes under the id its card waits on; a resend of a sent one is a no-op
  * (the id is the send's idempotency key). One that fails is tried again next tick.
  */
+const MAIL_READY_SECONDS = 300;
+/** Each board message not yet sent nor abandoned gets its effect row (once: the insert reads that none exists). */
+export function queueBoardMail(db) {
+  db.prepare(`INSERT INTO supercode_effects (effect)
+    SELECT json_object('kind', 'board_message', 'id', original.task_id, 'event', original.id) FROM task_events original
+    WHERE original.kind = 'board_message'
+      AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind = 'board_message_sent' AND sent.task_id = original.task_id AND json_extract(sent.payload, '$.event') = original.id)
+      AND NOT EXISTS (SELECT 1 FROM task_events gone WHERE gone.kind = 'board_message_abandoned' AND gone.task_id = original.task_id AND json_extract(gone.payload, '$.event') = original.id)
+      AND NOT EXISTS (SELECT 1 FROM supercode_effects e WHERE json_extract(e.effect, '$.kind') = 'board_message' AND json_extract(e.effect, '$.event') = original.id)`).run();
+}
+
+/**
+ * One board message's effect: its mail (with any batch it is in) sent under its fixed message id, so a second sender
+ * is dropped by the mailbox. Answers true once it is sent, 'wait' while its batch window is open; throws the failure.
+ */
+export async function sendBoardMessage(board, e) {
+  const state = () => view(board, (db) => db.prepare(`SELECT
+    EXISTS (SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?) AS sent,
+    EXISTS (SELECT 1 FROM task_events WHERE kind='board_message_abandoned' AND task_id=? AND json_extract(payload,'$.event')=?) AS gone`).get(e.id, e.event, e.id, e.event));
+  if (state().sent || state().gone || !e.event) return true;
+  const report = { undelivered: [] };
+  await sendBoardMessages(board, report, e.id);
+  if (state().sent) return true;
+  const failed = report.undelivered.find(([task]) => task === e.id);
+  if (failed) throw new Error(failed[2]);
+  // a mail waits for its batch window (at most a minute); one still not ready well after that is an attempt that failed
+  const recorded = view(board, (db) => db.prepare('SELECT created_at FROM task_events WHERE id = ?').get(e.event)?.created_at);
+  if (recorded && now() - Number(recorded) > MAIL_READY_SECONDS) throw new Error(`the mail was not ready to send ${now() - Number(recorded)} s after it was recorded`);
+  return 'wait';
+}
+
 export async function sendBoardMessages(board, report, taskId = null) {
   const pending = view(board, db => db.prepare(`SELECT 1 FROM task_events original WHERE kind='board_message'
     AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind='board_message_sent'
-      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id) LIMIT 1`).get());
+      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id)
+    AND NOT EXISTS (SELECT 1 FROM task_events gone WHERE gone.kind='board_message_abandoned'
+      AND gone.task_id=original.task_id AND json_extract(gone.payload,'$.event')=original.id) LIMIT 1`).get());
   if (!pending) return;
   const planned = tx(board, db => pendingRequestMail(db, taskId));
   if (Number.isFinite(planned.nextAt)) report.next_mail_at = Math.min(report.next_mail_at ?? Infinity, planned.nextAt);
@@ -1999,17 +2074,13 @@ export async function sendBoardMessages(board, report, taskId = null) {
       const receipt = await send(board, boardAddress(board.label), board.label, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
       if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'message was not filed');
       tx(board, db => {
-        for (const member of mail.members) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, receipt, ...(mail.message_id ? { message_id: mail.message_id, request_id: member.message_id ?? mail.message_id } : {}) });
+        for (const member of mail.members) if (!db.prepare("SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?").get(member.task_id, member.id)) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, receipt, ...(mail.message_id ? { message_id: mail.message_id, request_id: member.message_id ?? mail.message_id } : {}) });
       });
     } catch (error) {
       const reason = String(error.message).slice(-200);
       for (const member of mail.members) report.undelivered.push([member.task_id, mail.to, reason]);
       tx(board, db => {
-        for (const member of mail.members) {
-          const previous = db.prepare("SELECT payload,created_at FROM task_events WHERE task_id=? AND kind='board_message_failed' AND json_extract(payload,'$.event')=? ORDER BY id DESC LIMIT 1").get(member.task_id, member.id);
-          if (json(previous?.payload, {})?.reason !== reason || now() - (previous?.created_at ?? 0) >= 60)
-            event(db, member.task_id, 'board_message_failed', { event: member.id, to: mail.to, message_id: mail.message_id, reason });
-        }
+        for (const member of mail.members) event(db, member.task_id, 'board_message_failed', { event: member.id, to: mail.to, message_id: mail.message_id, reason });
       });
     }
   }
@@ -2018,8 +2089,10 @@ export async function sendBoardMessages(board, report, taskId = null) {
 /** The board's own address: where its notices come from and where card updates are mailed. */
 export const boardAddress = (label) => `sc:${localMachine()}:board:${label.replace(/[^A-Za-z0-9_.-]/g, '-')}`;
 
-/** Consecutive failed sends after which a subscription is dropped (Hermes's notifier drops a dead chat after 12). */
+/** Consecutive failed sends after which a chat-platform subscription is dropped (Hermes's notifier drops a dead chat after 12). */
 const MAX_SEND_FAILURES = 12;
+/** Attempts a supercode notice gets before it is abandoned (its subscription stays). */
+const NOTICE_ATTEMPTS = 6;
 
 /**
  * What an audience is told of an event: the workflow's `notify[audience][kind]` template over the card, the event's
@@ -2099,13 +2172,16 @@ function nativeEnded(address, discovered) {
  * A creator's or manager's subscription is never ended here: its notices wait for the session to come back.
  */
 function endWorkerSubscriptions(board, fleet, report, natively = new Map()) {
+  // each worker subscriber's liveness is read before the write
+  const aliveNow = new Map();
+  if (fleet.ok) for (const { chat_id: address } of board.db.prepare("SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) aliveNow.set(address, subscriberAlive(fleet, address));
   tx(board, (db) => {
     const { held, latest } = sessionRecord(db);
     const remove = db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?");
     const ended = new Map();
     for (const row of db.prepare("SELECT task_id, chat_id, thread_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) {
       const address = row.chat_id, record = latest.get(address);
-      if (!record || record.session.released || held.has(address) || (fleet.ok && fleet.alive.has(address))) continue;
+      if (!record || record.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) === true)) continue;
       const evidence = record.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at } : natively.get(address);
       if (!evidence || !remove.run(row.task_id, address, row.thread_id).changes) continue;
       if (!ended.has(address)) ended.set(address, { record, evidence, cards: [] });
@@ -2128,11 +2204,13 @@ async function notify(board, fleet, report, entry) {
   // each subscription's notices go in order; different subscribers are told side by side
   await pool(subscriptions(board.db).filter((sub) => sub.platform === 'supercode'), SEND_CONCURRENCY, async (sub) => {
     if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) return;
+    // a subscription whose last send failed waits out its retry time (as an effect does) before the next attempt
+    if (Number(sub.delivery_metadata?.next_at ?? 0) > now()) return;
     const role = ['worker', 'dependency', 'manager'].includes(sub.delivery_metadata?.role) ? sub.delivery_metadata.role : 'creator';
     // a session the fleet does not list this tick is told next tick: one reading is not a loss (a loaded box drops
     // sessions from a read, and a dropped subscription never came back), and a session that is replaced on its card
     // has its subscription moved when the new one starts
-    if (role !== 'creator' && fleet.ok && !fleet.alive.has(sub.chat_id)) return;
+    if (role !== 'creator' && fleet.ok && !subscriberAlive(fleet, sub.chat_id)) return;
     const kinds = heardBy(entry, role);
     if (!kinds.length) return;
     const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id`)
@@ -2144,7 +2222,13 @@ async function notify(board, fleet, report, entry) {
     // the one the next run gets): the notice is filed in its mailbox, read when it next works
     const working = role !== 'worker' || view(board, (db) => addressOf(currentRun(db, sub.task_id)?.metadata?.supercode) === sub.chat_id);
     let cursor = Number(sub.last_event_id);
-    let failed = null, untried = false;
+    // A notice is sent first, under its fixed key (the mailbox drops a second send of it), and the cursor then only moves
+    // forward past it: two passes may both send one notice, and its recipient gets it once; a send that fails, or a pass
+    // that dies before its send, leaves the cursor behind the notice, so it is sent again.
+    const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
+    const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
+    const forward = (to) => tx(board, (db) => db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(to, ...identity, to));
+    let failed = null, untried = false, trying = null;
     try {
       // an event older than the workflow's notice_max_age_seconds is history, not news: it is passed over, never mailed
       const maxAge = Number(entry.params.notice_max_age_seconds) || null;
@@ -2155,7 +2239,6 @@ async function notify(board, fleet, report, entry) {
       const sendable = (ev) => { const p = json(ev.payload, {}) ?? {}; return !(maxAge && now() - Number(ev.created_at) > maxAge) && !(p.by && p.by === sub.chat_id); };
       const latest = new Map(events.filter((ev) => !['commented', 'answered'].includes(ev.kind) && sendable(ev)).map((ev) => [ev.kind, ev.id]));
       const sentBefore = board.db.prepare("SELECT 1 FROM task_events WHERE task_id = ? AND kind IN ('notice_delivered', 'notice_filed') AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') = ? LIMIT 1");
-      const advance = (id) => tx(board, (db) => db.prepare("UPDATE kanban_notify_subs SET last_event_id = ? WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ? AND last_event_id < ?").run(id, sub.task_id, sub.chat_id, sub.thread_id ?? '', id));
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
         if (maxAge && now() - Number(ev.created_at) > maxAge) { cursor = ev.id; (report.stale_notices_passed ??= 0); report.stale_notices_passed += 1; continue; }
@@ -2173,6 +2256,7 @@ async function notify(board, fleet, report, entry) {
         if (text) {
           const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
           if (refused.has(sub.chat_id) || stopping) { untried = true; break; }
+          trying = ev.id;
           let receipt;
           try {
             receipt = await send(board, from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: String(sub.chat_id).includes(':claude-code:') ? false : !working || (!entry.workflow.run && sub.delivery_mode === 'notify'), subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
@@ -2180,13 +2264,16 @@ async function notify(board, fleet, report, entry) {
             // board does not send it again.
             if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'notice was not filed');
           } catch (error) {
+            // two passes may send one notice at once, and the second send can fail while the first is taken: a notice
+            // another pass already recorded as taken is no failure
+            if (sentBefore.get(sub.task_id, ev.id, sub.chat_id)) { cursor = ev.id; forward(ev.id); continue; }
             if (!refused.has(sub.chat_id)) refused.set(sub.chat_id, error);
             throw error;
           }
-          tx(board, (db) => event(db, sub.task_id, receipt.delivered ? 'notice_delivered' : 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }));
+          // recorded once, whichever pass's send the mailbox took
+          tx(board, (db) => { if (!db.prepare("SELECT 1 FROM task_events WHERE task_id = ? AND kind IN ('notice_delivered', 'notice_filed') AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') = ?").get(sub.task_id, ev.id, sub.chat_id)) event(db, sub.task_id, receipt.delivered ? 'notice_delivered' : 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }); });
           report.notified.push([sub.task_id, ev.kind, sub.chat_id]);
-          // the cursor follows each notice sent, so a restart mid-backlog resumes after it
-          advance(ev.id);
+          forward(ev.id);
         }
         cursor = ev.id;
       }
@@ -2209,16 +2296,22 @@ async function notify(board, fleet, report, entry) {
       });
       report.undelivered.push([sub.task_id, sub.chat_id, failed]);
     }
-    // the cursor moves past what was delivered (a failed delivery is retried next tick; the mail id dedupes)
+    // the cursor moves forward past what was passed over (a failed delivery is retried next pass)
+    forward(cursor);
     tx(board, (db) => {
-      const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
-      const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
-      db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(cursor, ...identity, cursor);
       // a round that left this subscription untried (a delivery to its recipient failed on another card) says nothing of it
       if (untried) return;
+      // A notice is tried NOTICE_ATTEMPTS times, waiting as an effect does between attempts. After its last failed
+      // attempt it is abandoned (its terminal state, `notice_abandoned`, recorded once) and the cursor moves past it;
+      // the subscription stays, so the notices after it are still told (dropping it lost them when the round
+      // subscribed the session again from the card's newest event).
       const failures = failed ? Number(sub.delivery_metadata?.failures ?? 0) + 1 : 0;
-      if (failures >= MAX_SEND_FAILURES) { db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity); return; }
-      if (failures !== Number(sub.delivery_metadata?.failures ?? 0)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures }), ...identity);
+      if (failed && failures >= NOTICE_ATTEMPTS && trying) {
+        event(db, sub.task_id, 'notice_abandoned', { source_event: trying, address: sub.chat_id, attempts: failures, error: failed });
+        db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ?, delivery_metadata = ? ${where} AND last_event_id < ?`).run(trying, JSON.stringify({ ...sub.delivery_metadata, failures: 0, next_at: 0 }), ...identity, trying);
+        return;
+      }
+      if (failures !== Number(sub.delivery_metadata?.failures ?? 0)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures, next_at: failed ? now() + Math.min(1800, 30 * 2 ** (failures - 1)) : 0 }), ...identity);
       if (task?.status === 'archived' && cursor >= events.at(-1).id) db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity);
     });
   });
@@ -2459,7 +2552,7 @@ const CORRUPT = /malformed|not a database|corrupt|disk image/i;
 
 /** What a tick would start on each board of the home, planned through the workflow's `dispatch`, writing nothing. */
 export async function plan({ root, lanes, settings, slugs = null, params = {} }) {
-  eventFleetRoot = root;
+  fleetRoot = root;
   const loaded = await loadWorkflow(root, { fresh: true });
   const entry = { ...loaded, params: { ...loaded.params, ...params } };
   const fleet = Object.values(lanes).some((l) => l.surface === 'pane') ? observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
@@ -2559,20 +2652,81 @@ function capMax(cap, group, entry, lanes) {
   catch { return null; }
 }
 
+const ORCHESTRATOR_ENTRY = fileURLToPath(new URL('../bin/orchestrator.mjs', import.meta.url));
+const deliveries = new Map();
+/**
+ * Start the home's delivery pass (`workflow deliver`) in a process of its own, unless one is already running: the
+ * dispatcher's loop calls this after each round and never waits for it. `log(level, line)` hears what it failed at.
+ * Answers whether one was started.
+ */
+export function startDelivery(root, { log = () => {} } = {}) {
+  if (deliveries.has(root)) return false;
+  const child = spawnChild(process.execPath, [ORCHESTRATOR_ENTRY, 'workflow', 'deliver', '--root', root, '--json'], { stdio: ['ignore', 'pipe', 'pipe'], env: process.env });
+  deliveries.set(root, child);
+  let out = '', err = '';
+  child.stdout.setEncoding('utf8').on('data', (c) => { out += c; });
+  child.stderr.setEncoding('utf8').on('data', (c) => { err = (err + c).slice(-2000); });
+  const done = () => {
+    deliveries.delete(root);
+    let reports = null; try { reports = JSON.parse(out); } catch { log('warn', `delivery pass failed: ${(err || out).trim().slice(-300) || 'no answer'}`); return; }
+    for (const r of reports) {
+      if (r.error) log('warn', `delivery on board ${r.board} failed: ${r.error}`);
+      for (const [task, to, why] of r.undelivered ?? []) log('warn', `board ${r.board}: a delivery for ${task} to ${to} waits: ${why}`);
+      log('info', `delivery on board ${r.board}: ${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good; took ${Object.entries(r.ms ?? {}).map(([k, v]) => `${k} ${(v / 1000).toFixed(1)}s`).join(', ')}`);
+    }
+  };
+  child.on('error', (error) => { log('warn', `delivery pass did not start: ${error.message}`); deliveries.delete(root); });
+  child.on('close', done);
+  return true;
+}
+
+/**
+ * The delivery pass over every board of the home at `root`: what rounds recorded for after them (each due effect, with
+ * its bounded attempts), board mail, subscription notices, and the board's agent records joined to Teams. It runs in
+ * its own process (`workflow deliver`, started by serve after a round, one at a time), never inside a dispatch round,
+ * so no recipient, door or Teams answer holds a round. Answers one report per board.
+ */
+export async function deliver({ root, slugs = null }) {
+  fleetRoot = root;
+  const entry = await loadWorkflow(root, { fresh: true });
+  const fleet = observeFleet();
+  const out = [];
+  for (const slug of slugs ?? listBoards(root)) {
+    const report = { board: slug, ms: {}, mailed: [], queued: [], failed: [], notified: [], undelivered: [], fleet: fleet.ok ? 'read' : fleet.error };
+    let board;
+    try {
+      board = openBoard(root, slug);
+      board.label = boardLabel(root, slug);
+      setActor(boardAddress(board.label));
+      let mark = Date.now();
+      const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
+      // board mail is sent as effect rows, one per message, each claimed as any effect is
+      tx(board, (db) => queueBoardMail(db)); phase('mail');
+      report.effects = await runEffects(board, [], { pending: true }); phase('effects');
+      await notify(board, fleet, report, entry); phase('notify');
+      synchronizeAgents(board, fleet, report, entry); phase('agents');
+      report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
+      report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);
+    } catch (error) { report.error = error.message; }
+    finally { board?.close(); }
+    out.push(report);
+  }
+  return out;
+}
+
 /**
  * One tick over every board of the home at `root`. `lanes` from `lanesOf`, `settings` from `boardSettings`.
  * `only` limits starting to one card (a create that answers whether its card started). Each board is ticked under its
  * version-checked card claims; no dispatcher file lock. Two rounds may run at once (the dispatcher's and a one-shot
  * `workflow dispatch`). An adoption request and a session close are claimed in a transaction (`newClaim`) before
  * anything is done for them outside the board; card starts, supervision, review requests, mailed verbs and manual
- * continuations rely on their per-card transactions. Two rounds on one board at once can still both act on: queued
- * effects in `runEffects` (send_to_actor, session_notice, merge_reviewed, declare_card_agent), board mail,
- * subscription notices (a doubled notice_delivered has been seen live), deferred-launch retries (two panes),
- * launch-receipt work (cancelUnissuedLaunch, bindLaunch), the Teams agent-run sync in reconcileLaunches, and
- * board-only writes that do not re-check (a doubled agent_profile_recorded). Answers one report per board.
+ * continuations rely on their per-card transactions. Two rounds on one board at once can still both act on:
+ * deferred-launch retries (two panes), launch-receipt work (cancelUnissuedLaunch, bindLaunch), and board-only writes
+ * that do not re-check. A round runs no effect and delivers nothing: it records effects (`queueEffects`) and the
+ * delivery pass (`deliver`) carries them out. Answers one report per board.
  */
 export async function tick({ root, lanes, settings, only = null, slugs = null, dispatch = true, params = {}, deploymentReceipt = false }) {
-  eventFleetRoot = root;
+  fleetRoot = root;
   // a verb's flags (dispatch --max, --failure-limit) are params of this tick, read by the workflow as its own
   const deployment = deploymentReceipt ? workflowRevision(root) : null;
   const loaded = await loadWorkflow(root, { fresh: true });
@@ -2611,20 +2765,18 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       readMailbox(board, boardAddress(board.label), report); phase('mailbox');
       await refreshRelationAnswers(board); phase('answers');
       const effects = [];
-      completeAdoptions(board, fleet, settings, report, lanes); reconnectContinuedSessions(board, fleet, entry, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); await runEffects(board, effects.splice(0), { retryNotices: true }); closeRequested(board, report, { ttl: settings.ttl }); phase('supervise');
+      completeAdoptions(board, fleet, settings, report, lanes); reconnectContinuedSessions(board, fleet, entry, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); closeRequested(board, report, { ttl: settings.ttl }); phase('supervise');
       report.unsettled = [];
       report.promoted = recomputeReady(board, effects, report.unsettled);
       tx(board,db=>auditEndedRuns(db,board,entry));
       if (dispatch) await activatePullRequestReviews(board, entry, report, effects, { only });
-      await sendBoardMessages(board, report);
       if (dispatch && !stopping) startCards(board, fleet, lanes, settings, report, entry, effects, { only, held });
       phase('start');
       if (dispatch && !only && !report.paused) observeIdle(board, fleet, settings, report, entry, effects);
-      // what the moves asked for, once they are committed (messages to actors, closed panes, cleaned workspaces)
-      await runEffects(board, effects);
+      // what the moves asked for is recorded with them; the delivery pass (`deliver`) carries it out, outside the round
+      queueEffects(board, effects);
       phase('goals');
       ensureSubscriptions(board, entry);
-      await notify(board, fleet, report, entry); phase('notify');
       fireHooks(board, settings, report);
       if (String(board.db.prepare('PRAGMA journal_mode').get()?.journal_mode).toLowerCase() === 'wal') board.db.prepare('PRAGMA wal_checkpoint(PASSIVE)').get();
       report.ready_waiting = Number(board.db.prepare("SELECT COUNT(*) AS n FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id WHERE t.status = 'ready' AND t.assignee IS NOT NULL AND c.subtask_of IS NULL").get().n);