@volter/supercode-orchestrator 0.5.38 → 0.5.40

package/agents.mjs

@@ -38,6 +38,11 @@ function store(root){
   CREATE TABLE IF NOT EXISTS agent_end_outbox(org TEXT NOT NULL,agent_id TEXT NOT NULL,reason TEXT NOT NULL,created_at INTEGER NOT NULL,PRIMARY KEY(org,agent_id));
   CREATE TABLE IF NOT EXISTS agent_runtime_sessions(org TEXT NOT NULL,runtime_ref TEXT NOT NULL,session_ref TEXT NOT NULL,PRIMARY KEY(org,runtime_ref));
   CREATE TABLE IF NOT EXISTS agent_runs(org TEXT NOT NULL,agent_id TEXT NOT NULL,session_ref TEXT NOT NULL,machine TEXT,run_id TEXT,profile_json TEXT,published INTEGER NOT NULL DEFAULT 0,ended_at INTEGER,end_reason TEXT,main INTEGER NOT NULL DEFAULT 1,starter_session TEXT,usage_json TEXT,PRIMARY KEY(org,session_ref));`);
+  // A declaration Teams refused is asked again a bounded number of times (synchronizeLocalAgents), then left failed.
+  const columns=new Set(db.prepare('PRAGMA table_info(agent_intents)').all().map(c=>c.name));
+  for(const [column,type] of Object.entries({declare_attempts:'INTEGER NOT NULL DEFAULT 0',declare_next_at:'INTEGER NOT NULL DEFAULT 0',declare_failed_at:'INTEGER',declare_error:'TEXT'}))if(!columns.has(column))db.exec(`ALTER TABLE agent_intents ADD COLUMN ${column} ${type}`);
+  // An end is claimed by the pass sending it (synchronizeAgentEnds).
+  if(!new Set(db.prepare('PRAGMA table_info(agent_end_outbox)').all().map(c=>c.name)).has('claimed_at'))db.exec('ALTER TABLE agent_end_outbox ADD COLUMN claimed_at INTEGER');
   return db;
 }
 const digest=value=>createHash('sha256').update(value).digest('hex');
@@ -86,13 +91,16 @@ export function synchronizeAgentEnds(root,org,{context}={}){
   try{
     for(const row of db.prepare('SELECT * FROM agent_end_outbox WHERE org=? ORDER BY created_at LIMIT 100').all(org)){
       if(db.prepare("SELECT 1 FROM agent_assignments WHERE org=? AND agent_id=? AND state='active'").get(org,row.agent_id)){db.prepare('DELETE FROM agent_end_outbox WHERE org=? AND agent_id=?').run(org,row.agent_id);continue;}
-      if(db.prepare('SELECT 1 FROM agent_runs WHERE org=? AND agent_id=? AND published=0').get(org,row.agent_id)){pending.push({agent:row.agent_id,error:'session ownership publication remains pending'});continue;}
+      if(db.prepare('SELECT 1 FROM agent_runs WHERE org=? AND agent_id=? AND published<=0').get(org,row.agent_id)){pending.push({agent:row.agent_id,error:'session ownership publication remains pending'});continue;}
+      // claimed by compare-and-set on its claimed_at (free, or a claim older than SYNC_CLAIM_MS from a pass that died);
+      // deleted only after Teams ended the agent (the end is idempotent by its digest), handed back when it failed
+      if(db.prepare('UPDATE agent_end_outbox SET claimed_at=? WHERE org=? AND agent_id=? AND (claimed_at IS NULL OR claimed_at<?)').run(Date.now(),org,row.agent_id,Date.now()-SYNC_CLAIM_MS).changes!==1)continue;
       try{
         agentDoor('end',[row.agent_id,row.reason,digest(`${org}/${row.agent_id}/end/${row.created_at}`)],{context});
         db.prepare('UPDATE agent_runs SET ended_at=COALESCE(ended_at,?),end_reason=COALESCE(end_reason,?) WHERE org=? AND agent_id=?').run(Date.now(),row.reason,org,row.agent_id);
         db.prepare('DELETE FROM agent_end_outbox WHERE org=? AND agent_id=?').run(org,row.agent_id);
       }
-      catch(error){pending.push({agent:row.agent_id,error:error.message});}
+      catch(error){db.prepare('UPDATE agent_end_outbox SET claimed_at=NULL WHERE org=? AND agent_id=?').run(org,row.agent_id);pending.push({agent:row.agent_id,error:error.message});}
     }
     return pending;
   }finally{db.close();}
@@ -349,21 +357,36 @@ function adoptLocalOrg(root,scope){
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
 }
+const DECLARE_ATTEMPTS=6;
+// A sync claim outlasts one Teams call chain (each door call bounded at 25-60 s).
+const SYNC_CLAIM_MS=600000;
 /** Declare every locally minted identity once Teams is reachable, under the id its sessions already carry. */
 export function synchronizeLocalAgents({root,profiles,context,machine=null,declarations={}}){
   const scope=agentScope(context);if(scope.offline)return [];
   adoptLocalOrg(root,scope);
   const db=store(root);let rows;
-  try{rows=db.prepare('SELECT * FROM agent_intents WHERE org=? AND declared=0 AND declaration_json IS NOT NULL ORDER BY created_at').all(scope.org);}finally{db.close();}
+  try{rows=db.prepare('SELECT * FROM agent_intents WHERE org=? AND declared=0 AND declaration_json IS NOT NULL AND declare_failed_at IS NULL AND declare_next_at<=? ORDER BY created_at').all(scope.org,Date.now());}finally{db.close();}
   const pending=[],base={root,org:scope.org,server:scope.server,profiles,context,machine};
   for(const row of rows){
     const declaration=JSON.parse(row.declaration_json);
+    // claimed by compare-and-set on its own next attempt time, set ahead only while it is due: a second pass skips it
+    const claim=store(root);let claimed;
+    try{claimed=claim.prepare('UPDATE agent_intents SET declare_next_at=? WHERE org=? AND id=? AND declared=0 AND declare_failed_at IS NULL AND declare_next_at<=?').run(Date.now()+SYNC_CLAIM_MS,row.org,row.id,Date.now()).changes===1;}finally{claim.close();}
+    if(!claimed)continue;
     try{
       if(declaration.kind==='root')ensureRootAgent({...base,profile:declaration.profile});
       else if(declaration.kind==='card')ensureCardAgent({...base,profile:declaration.profile,card:declaration.card,role:declaration.role,sponsor:declaration.sponsor,starterSession:declaration.starterSession});
       else if(declaration.kind==='profile')ensureProfileAgent({...base,profile:declaration.profile});
       else if(declaration.kind==='declared')ensureProfileAgent({...base,profile:declaration.profile,agent:declaration.agent,declarations});
-    }catch(error){if(!teamsUnavailable(error))pending.push({agent:row.id,error:error.message});else return [...pending,{agent:row.id,error:error.message}];}
+    }catch(error){
+      // Teams unreachable is no answer about this declaration: the rest wait for the next pass, and no attempt is counted.
+      if(teamsUnavailable(error)){const db=store(root);try{db.prepare('UPDATE agent_intents SET declare_next_at=? WHERE org=? AND id=?').run(row.declare_next_at??0,row.org,row.id);}finally{db.close();}return [...pending,{agent:row.id,error:error.message}];}
+      // A refusal is this declaration's own: asked again after a doubling wait (one minute, at most an hour), and after
+      // DECLARE_ATTEMPTS refusals left failed, said once, and never asked again.
+      const made=Number(row.declare_attempts??0)+1,failed=made>=DECLARE_ATTEMPTS,db=store(root);
+      try{db.prepare('UPDATE agent_intents SET declare_attempts=?,declare_next_at=?,declare_failed_at=?,declare_error=? WHERE org=? AND id=?').run(made,Date.now()+Math.min(3600000,60000*2**(made-1)),failed?Date.now():null,String(error.message).slice(0,500),row.org,row.id);}finally{db.close();}
+      pending.push({agent:row.id,error:error.message,attempts:made,failed});
+    }
   }
   return pending;
 }
@@ -377,7 +400,7 @@ export function recordNativeAgentSession(root,runtimeRef,session) {
     db.exec('BEGIN IMMEDIATE');
     db.prepare('INSERT INTO agent_runtime_sessions(org,runtime_ref,session_ref) VALUES (?,?,?) ON CONFLICT(org,runtime_ref) DO UPDATE SET session_ref=excluded.session_ref').run(owner.org,runtimeRef,session);
     // A published native session remains history; an unpublished lease-only row is not a session.
-    db.prepare('DELETE FROM agent_runs WHERE org=? AND session_ref=? AND published=0').run(owner.org,runtimeRef);
+    db.prepare('DELETE FROM agent_runs WHERE org=? AND session_ref=? AND published<=0').run(owner.org,runtimeRef);
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
   return agentRunForSession(root,[runtimeRef]);
@@ -421,7 +444,13 @@ export function recordAgentRun(root,org,id,{session,machine=null,run,profile=nul
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
 }
-export function pendingAgentRuns(root,org){const db=store(root);try{return db.prepare('SELECT * FROM agent_runs WHERE org=? AND published=0 ORDER BY rowid LIMIT 100').all(org).filter(row=>!(retryOf(root,org,row)?.next_at>Date.now()));}finally{db.close();}}
+// A run waiting to be joined has published=0; a pass joining it holds published=-(the time it claimed it), by
+// compare-and-set, and a claim older than SYNC_CLAIM_MS (a pass that died) is free again.
+export function pendingAgentRuns(root,org){const db=store(root);try{return db.prepare('SELECT * FROM agent_runs WHERE org=? AND (published=0 OR (published<0 AND -published<?)) ORDER BY rowid LIMIT 100').all(org,Date.now()-SYNC_CLAIM_MS).filter(row=>!(retryOf(root,org,row)?.next_at>Date.now()));}finally{db.close();}}
+/** Claim one waiting run for this pass; false when another pass holds it. */
+export function claimAgentRun(root,org,row){const db=store(root);try{return db.prepare('UPDATE agent_runs SET published=? WHERE org=? AND session_ref=? AND published=?').run(-Date.now(),org,row.session_ref,row.published).changes===1;}finally{db.close();}}
+/** Give a claimed run back, unjoined. */
+export function releaseAgentRun(root,org,row){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=0 WHERE org=? AND session_ref=? AND published<0').run(org,row.session_ref);}finally{db.close();}}
 /** Session references come from the bound runtime, never from a model's requested agent id. */
 export function agentRunForSession(root, references) {
   const db = store(root);
@@ -468,7 +497,7 @@ export function runBudgetRefusal(root,agent,budgets,now){
   return null;
 }
 /** A run whose session Teams never had and that no longer runs here can never be owned there: it leaves the sync. */
-export function abandonAgentRun(root,org,session){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=2 WHERE org=? AND session_ref=? AND published=0').run(org,session);db.prepare('DELETE FROM agent_run_retries WHERE org=? AND session_ref=?').run(org,session);}finally{db.close();}}
+export function abandonAgentRun(root,org,session){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=2 WHERE org=? AND session_ref=? AND published<=0').run(org,session);db.prepare('DELETE FROM agent_run_retries WHERE org=? AND session_ref=?').run(org,session);}finally{db.close();}}
 export function publishAgentRun(root,org,session){const db=store(root);try{db.prepare('UPDATE agent_runs SET published=1 WHERE org=? AND session_ref=?').run(org,session);}finally{db.close();}}
 export function agentPreamble(agent,{main=true,previous=[]}={}){
   const {identity:a,intended,assignments=[]}=agent;

package/board/cli.mjs

@@ -15,7 +15,7 @@ import { actorOf, view, backingPaths, layOut, backingOf, boardExists, boardPath,
 import { isLocalWorkspace } from './workspace.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
-import { requestAdoption, alertManagers, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, stopDispatching, supercodeBin, tick } from './dispatch.mjs';
+import { requestAdoption, alertManagers, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, stopDispatching, supercodeBin, tick, deliver, startDelivery } from './dispatch.mjs';
 import { watchBoard } from './wake.mjs';
 import { streamBoardPublications } from './event-stream.mjs';
 import { completionOwnerOf, isLatestReviewer, loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
@@ -950,6 +950,14 @@ export async function runWorkflow(argv) {
       process.stdout.write(`${lines.join('\n')}\n`);
       return 0;
     }
+    case 'deliver': {
+      // the delivery pass: due effects, board mail, subscription notices and the agent records' Teams sync (serve
+      // starts it after each round in a process of its own; never part of a round)
+      const reports = await deliver({ root, slugs: args.board ? [slug] : null });
+      if (args.json) say(args, '', reports);
+      else for (const r of reports) process.stdout.write(`${r.board}: ${r.error ? `error: ${r.error}` : `${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good, ${r.notified.length} notified`}\n`);
+      return reports.some((r) => r.error) ? 1 : 0;
+    }
     case 'daemon': case 'serve': return serve(root, args);
 
     case 'gc': {
@@ -1488,6 +1496,8 @@ async function serve(root, args = {}) {
         interval = settings.interval;
         const reports = await tick({ root, lanes: state.lanes, settings, params, deploymentReceipt: true });
         round += 1;
+        // what the round recorded is delivered by a pass of its own, which this loop never waits for
+        if (!stopped) startDelivery(root, { log: (level, line) => { if (level === 'warn' || args.verbose) log(line); } });
         if (!stopped) await watchRounds(reports);
         for (const r of reports) {
           nextMailAt = Math.min(nextMailAt, r.next_mail_at ?? Infinity);

package/board/dispatch.mjs

@@ -20,7 +20,7 @@ import { readMachineFleet } from './machine-fleet.mjs';
 let fleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
-import { agentScope, localCardAgent, localReaderContext, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, pendingAgentRuns, synchronizeAgentRun, abandonAgentRun,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds, agentRunForSession } from '../agents.mjs';
+import { agentScope, localCardAgent, localReaderContext, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, pendingAgentRuns, synchronizeAgentRun, claimAgentRun, releaseAgentRun, abandonAgentRun,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds, agentRunForSession } from '../agents.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
 import { memorySnapshotSync } from '../hermes-cli.mjs';
 import { createRequire } from 'node:module';
@@ -39,7 +39,7 @@ import { identifyNotice } from './notices.mjs';
 import { pendingRequestMail } from './request-mail.mjs';
 import {
   cardContext, claimTtl, currentRun, DEFAULT_FAILURE_LIMIT, extendClaim, getTask, lastSession,
-  recomputeReady, runEffects, setRunSession, subscribeIn, subscriptions, reconcileDependencySubscriptions,
+  recomputeReady, runEffects, queueEffects, setRunSession, subscribeIn, subscriptions, reconcileDependencySubscriptions,
 } from './engine.mjs';
 
 const WORKER = fileURLToPath(new URL('../bin/hermes-worker.mjs', import.meta.url));
@@ -174,7 +174,8 @@ function unpublishedAlive(session) {
     try { return nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code'), session).alive; } catch { return null; }
   }
   let entry = paneLists.get(session.machine);
-  if (!entry || Date.now() - entry.at > 5000) {
+  if (!entry || Date.now() - entry.at > READING_MS) {
+    if (readingsOnly) return null;
     const r = doorOn(session.machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
     const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
     entry = { at: Date.now(), panes: Array.isArray(panes) ? panes : null };
@@ -186,9 +187,22 @@ function unpublishedAlive(session) {
 /** Native activity comes from the machine's harness discovery, not catalogue age. One discovery (up to 2000
  * sessions, seconds each) serves a round's every native session on that machine, as paneLists serves its panes. */
 const discoveries = new Map();
+// A machine's pane list and harness discovery are read before a board write opens, never inside one: a door that
+// takes seconds would hold the board's write lock past a worker's own command's busy wait. A write that needs a
+// reading not taken yet reads it as unknown. One reading serves READING_MS.
+const READING_MS = 15_000;
+let readingsOnly = 0;
+const txRead = (board, fn) => { readingsOnly += 1; try { return tx(board, fn); } finally { readingsOnly -= 1; } };
+/** Take the readings a board write about `session` will need, before the write. */
+function readBefore(fleet, session) {
+  if (!session?.session_id || !session.machine || session.surface === 'headless') return;
+  try { nativeSessions(session.machine, session.harness ?? 'claude-code'); } catch { /* unread: unknown inside the write */ }
+  sessionAlive(fleet, session);
+}
 function nativeSessions(machine, harness) {
   const key = `${normalMachine(machine)}\u0000${harness}`, seen = discoveries.get(key);
-  if (seen && Date.now() - seen.at <= 5000) return seen.sessions;
+  if (seen && Date.now() - seen.at <= READING_MS) return seen.sessions;
+  if (readingsOnly) throw unavailable('native liveness is read before a board write, not inside it');
   const sessions = discoverNative(machine, harness);
   discoveries.set(key, { at: Date.now(), sessions });
   return sessions;
@@ -301,8 +315,9 @@ function supervise(board, fleet, settings, report, entry, effects) {
     try { const receipt = launchReceipt(board, session); if (receipt?.live === false && receipt.exit) exits.set(id, receipt.exit); }
     catch (error) { report.failed.push([id, `exit receipt unavailable; retaining liveness observation: ${error.message}`]); }
   }
+  for (const { id } of rows) readBefore(fleet, currentRun(board.db, id)?.metadata?.supercode);
   for (const { id } of rows) {
-    tx(board, (db) => {
+    txRead(board, (db) => {
       const task = getTask(db, id);
       if (!task || (entry.workflow.run ? !task.current_run_id : task.status !== 'running')) return;
       const runRow = currentRun(db, id);
@@ -944,8 +959,10 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
     return Number(discovered.get(key)?.find((row) => row.locator?.session_id === session.session_id)?.updated_at_ms) || null;
   };
   const managers = [].concat(entry.params.managers ?? []).filter(Boolean);
-  for (const { id } of board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all()) {
-    tx(board, (db) => {
+  const running = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
+  for (const { id } of running) { const session = currentRun(board.db, id)?.metadata?.supercode; readBefore(fleet, session); if (session?.session_id) updatedAt(session); }
+  for (const { id } of running) {
+    txRead(board, (db) => {
       const task = getTask(db, id);
       const status = statusOf(db, task);
       if (!(entry.workflow.statuses[status]?.on?.session_idle || entry.workflow.on?.session_idle || entry.workflow.run?.on?.session_idle)) return;
@@ -1056,7 +1073,9 @@ export async function sessionNotice(board, e) {
         : { lifecycle_notice_error: null, ...(session.lifecycle_notice_pending === e.durableId ? { lifecycle_notice_pending: null } : {}) }) });
     if (!error || session?.lifecycle_notice_error !== error) event(db, e.id, error ? 'session_notice_failed' : receipt?.delivered ? 'session_notice_delivered' : 'session_notice_queued', { address: e.address, verb: e.verb, source_event: e.sourceEvent, notice: e.durableId, receipt, ...(error ? { error, retry: true } : {}) }, e.runId);
   });
-  return !error;
+  // the attempt's reason goes with it, onto the effect's row (runEffects counts the attempt)
+  if (error) throw new Error(error);
+  return true;
 }
 
 /** A session effect a committed move asked for: a message to the card's current actor, or closing a slot's pane. */
@@ -1076,7 +1095,10 @@ export async function sessionEffect(board, e) {
       const payload = { notice: e.durableId, address, receipt };
       if (previous?.kind !== kind || JSON.stringify(json(previous?.payload, {})?.receipt) !== JSON.stringify(receipt)) event(db, e.id, kind, payload, e.runId);
     });
-    return receipt.delivered;
+    // a send its recipient's mailbox took (filed, or queued for a session between turns) is accepted: the mailbox
+    // delivers it from there, and the board does not send it again
+    if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'the actor notice was not filed');
+    return true;
   }
   if (e.kind === 'close_session' || e.kind === 'run_ended') {
     tx(board, (db) => requestSessionClose(db, e.id, e.kind === 'run_ended' ? { runId: e.runId } : { slot: e.slot, through: e.runId }));
@@ -1091,6 +1113,7 @@ export async function sessionEffect(board, e) {
  * Once every PR is merged the card is sent `reviewed_merged` with the merge commits. Answers false (kept, tried again
  * next round) on anything GitHub did not decide.
  */
+const MERGE_BUDGET_MS = 300_000;
 export async function mergeReviewed(board, e) {
   const { candidatePullRequests, mergeReviewedPullRequest } = await import('./ci.mjs');
   const pass = view(board, (db) => db.prepare("SELECT id, payload FROM task_events WHERE task_id = ? AND kind = 'review_pass' ORDER BY id DESC LIMIT 1").get(e.id));
@@ -1098,11 +1121,16 @@ export async function mergeReviewed(board, e) {
   const ci = typeof recorded === 'string' ? json(recorded, null) : recorded;
   const prs = candidatePullRequests(ci).filter((p) => p?.pr?.url && p.commit);
   const merges = [];
+  // a merge attempt spends at most MERGE_BUDGET on starting GitHub calls (each bounded by its own timeout), inside its
+  // effect's claim; what is left is the next attempt's
+  const began = Date.now();
   for (const p of prs) {
+    if (Date.now() - began > MERGE_BUDGET_MS) throw new Error(`the merge attempt spent its ${MERGE_BUDGET_MS / 1000} s; the rest is merged next attempt`);
     let answer;
     try { answer = mergeReviewedPullRequest(p.pr.url, p.commit); } catch (error) {
-      tx(board, (db) => event(db, e.id, 'merge_pending', { pr: p.pr.url, reviewed: p.commit, reason: String(error.message).slice(-300) }));
-      return false;
+      const reason = String(error.message).slice(-300);
+      tx(board, (db) => event(db, e.id, 'merge_pending', { pr: p.pr.url, reviewed: p.commit, reason }));
+      throw new Error(`merging ${p.pr.url} at ${p.commit}: ${reason}`);
     }
     if (answer.merged) { merges.push({ pr: p.pr.url, reviewed: p.commit, merge: answer.sha }); continue; }
     const reason = answer.moved ? `${p.pr.url} is no longer at its reviewed head ${p.commit}${answer.head ? ` (now ${answer.head})` : ''}; what was pushed after the verdict needs its own review` : `${p.pr.url} was closed without merging`;
@@ -1312,7 +1340,9 @@ export function reconcileCallerLaunch(board, sid) {
   }
 }
 
-function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
+/** The board's agent records joined to Teams: declarations, ends, session ownership and usage. Teams I/O, so it runs in
+ * the delivery pass (`deliver`), never in a dispatch round. */
+function synchronizeAgents(board, fleet, report, entry) {
   // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
   // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
   const agentRuns=[...new Map(view(board,db=>db.prepare("SELECT id,task_id,metadata,ended_at FROM task_runs WHERE json_extract(metadata,'$.supercode.agent_id') IS NOT NULL ORDER BY id").all())
@@ -1344,7 +1374,7 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
   let scope;try{scope=agentScope(context);}catch(error){scope={offline:true};report.failed.push(['agents',`agent declarations wait: ${error.message}`]);}
   if(!scope.offline){
     orgs.set(scope.org,orgs.get(scope.org)??context);
-    for(const pending of synchronizeLocalAgents({root:board.root,profiles:entry.profiles,context}))report.queued.push([pending.agent,`agent declaration pending: ${pending.error}`]);
+    for(const pending of synchronizeLocalAgents({root:board.root,profiles:entry.profiles,context}))(pending.failed?report.failed:report.queued).push([pending.agent,`agent declaration ${pending.failed?`failed for good after ${pending.attempts} refusals`:'pending'}: ${pending.error}`]);
   }
   orgs.delete('local');
   // G3: an ended run's session usage, read once from its harness's own records on its machine
@@ -1371,9 +1401,14 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
   for(const [org,context] of orgs)for(const pending of synchronizeAgentEnds(board.root,org,{context}))report.queued.push([pending.agent,`agent end synchronization pending: ${pending.error}`]);
   for(const [org,context] of orgs)for(const row of pendingAgentRuns(board.root,org)){
     const launch=agentRuns.find(run=>String(run.id)===String(row.run_id));
+    // each run is claimed by compare-and-set on its own `published` before it is joined; another pass's claim skips it
+    if(!claimAgentRun(board.root,org,row))continue;
     try{synchronizeAgentRun(board.root,org,row,{context,intended:json(launch?.metadata,{})?.supercode?.agent_profile_intent});}
-    catch(error){if(error.code==='rate_limited'){report.queued.push([row.run_id,`agent session sync pending: ${error.message}`]);break;}const gone=error.claimRefused&&error.status===404&&fleet.ok&&syncRowAlive(fleet,row)===false;if(gone)abandonAgentRun(board.root,org,row.session_ref);report.failed.push([row.run_id,`agent session sync failed: ${error.message}${gone?`; ${row.session_ref} is stopped and Teams refuses it, so it leaves the sync`:''}`]);}
+    catch(error){releaseAgentRun(board.root,org,row);if(error.code==='rate_limited'){report.queued.push([row.run_id,`agent session sync pending: ${error.message}`]);break;}const gone=error.claimRefused&&error.status===404&&fleet.ok&&syncRowAlive(fleet,row)===false;if(gone)abandonAgentRun(board.root,org,row.session_ref);report.failed.push([row.run_id,`agent session sync failed: ${error.message}${gone?`; ${row.session_ref} is stopped and Teams refuses it, so it leaves the sync`:''}`]);}
   }
+}
+
+function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
   const deferred=view(board,db=>db.prepare("SELECT t.id,r.id run_id,COALESCE(json_extract(r.metadata,'$.supercode.launched_at'),r.started_at) launched_at FROM tasks t JOIN task_runs r ON r.id=t.current_run_id WHERE r.ended_at IS NULL AND json_extract(r.metadata,'$.supercode.launch_deferred')=1").all());
   // A deferred launch was never issued (a reading or door was not yet available): it is the start its manager, creator
   // or workflow asked for, carried out within the launch window; supervise surfaces it once when the window ends. The
@@ -1925,7 +1960,7 @@ function reconnectContinuedSessions(board, fleet, entry, report) {
       // Preserve the ended interval as evidence before reopening supervision on the same run.
       event(db,row.task_id,'session_continued',{session_id:saved.session_id,from_pane:saved.pane,pane,prior_outcome:row.outcome,prior_ended_at:row.ended_at,incident:saved.incident??null},row.id);
       db.prepare("UPDATE task_runs SET ended_at=NULL,status='running',outcome=NULL,error=NULL,metadata=?,claim_lock=?,claim_expires=? WHERE id=?")
-        .run(JSON.stringify({...json(row.metadata,{}),supercode:session}),claimer(),now()+900,row.id);
+        .run(JSON.stringify({...json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(row.id)?.metadata,{}),supercode:session}),claimer(),now()+900,row.id); // re-read: the run's observations just recorded stay
       db.prepare('UPDATE tasks SET current_run_id=?,claim_lock=?,claim_expires=? WHERE id=?').run(row.id,claimer(),now()+900,row.task_id);
       projectStatus(db,board,entry,row.task_id);
       event(db,row.task_id,'dispatch_released',{reason:'verified manual continuation',session:addressOf(session),incident:saved.incident??null});
@@ -1990,10 +2025,43 @@ export async function alertManagers(root, slug, text, key) {
  * and marked board_message_sent. A question goes under the id its card waits on; a resend of a sent one is a no-op
  * (the id is the send's idempotency key). One that fails is tried again next tick.
  */
+const MAIL_READY_SECONDS = 300;
+/** Each board message not yet sent nor abandoned gets its effect row (once: the insert reads that none exists). */
+export function queueBoardMail(db) {
+  db.prepare(`INSERT INTO supercode_effects (effect)
+    SELECT json_object('kind', 'board_message', 'id', original.task_id, 'event', original.id) FROM task_events original
+    WHERE original.kind = 'board_message'
+      AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind = 'board_message_sent' AND sent.task_id = original.task_id AND json_extract(sent.payload, '$.event') = original.id)
+      AND NOT EXISTS (SELECT 1 FROM task_events gone WHERE gone.kind = 'board_message_abandoned' AND gone.task_id = original.task_id AND json_extract(gone.payload, '$.event') = original.id)
+      AND NOT EXISTS (SELECT 1 FROM supercode_effects e WHERE json_extract(e.effect, '$.kind') = 'board_message' AND json_extract(e.effect, '$.event') = original.id)`).run();
+}
+
+/**
+ * One board message's effect: its mail (with any batch it is in) sent under its fixed message id, so a second sender
+ * is dropped by the mailbox. Answers true once it is sent, 'wait' while its batch window is open; throws the failure.
+ */
+export async function sendBoardMessage(board, e) {
+  const state = () => view(board, (db) => db.prepare(`SELECT
+    EXISTS (SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?) AS sent,
+    EXISTS (SELECT 1 FROM task_events WHERE kind='board_message_abandoned' AND task_id=? AND json_extract(payload,'$.event')=?) AS gone`).get(e.id, e.event, e.id, e.event));
+  if (state().sent || state().gone || !e.event) return true;
+  const report = { undelivered: [] };
+  await sendBoardMessages(board, report, e.id);
+  if (state().sent) return true;
+  const failed = report.undelivered.find(([task]) => task === e.id);
+  if (failed) throw new Error(failed[2]);
+  // a mail waits for its batch window (at most a minute); one still not ready well after that is an attempt that failed
+  const recorded = view(board, (db) => db.prepare('SELECT created_at FROM task_events WHERE id = ?').get(e.event)?.created_at);
+  if (recorded && now() - Number(recorded) > MAIL_READY_SECONDS) throw new Error(`the mail was not ready to send ${now() - Number(recorded)} s after it was recorded`);
+  return 'wait';
+}
+
 export async function sendBoardMessages(board, report, taskId = null) {
   const pending = view(board, db => db.prepare(`SELECT 1 FROM task_events original WHERE kind='board_message'
     AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind='board_message_sent'
-      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id) LIMIT 1`).get());
+      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id)
+    AND NOT EXISTS (SELECT 1 FROM task_events gone WHERE gone.kind='board_message_abandoned'
+      AND gone.task_id=original.task_id AND json_extract(gone.payload,'$.event')=original.id) LIMIT 1`).get());
   if (!pending) return;
   const planned = tx(board, db => pendingRequestMail(db, taskId));
   if (Number.isFinite(planned.nextAt)) report.next_mail_at = Math.min(report.next_mail_at ?? Infinity, planned.nextAt);
@@ -2006,17 +2074,13 @@ export async function sendBoardMessages(board, report, taskId = null) {
       const receipt = await send(board, boardAddress(board.label), board.label, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
       if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'message was not filed');
       tx(board, db => {
-        for (const member of mail.members) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, receipt, ...(mail.message_id ? { message_id: mail.message_id, request_id: member.message_id ?? mail.message_id } : {}) });
+        for (const member of mail.members) if (!db.prepare("SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?").get(member.task_id, member.id)) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, receipt, ...(mail.message_id ? { message_id: mail.message_id, request_id: member.message_id ?? mail.message_id } : {}) });
       });
     } catch (error) {
       const reason = String(error.message).slice(-200);
       for (const member of mail.members) report.undelivered.push([member.task_id, mail.to, reason]);
       tx(board, db => {
-        for (const member of mail.members) {
-          const previous = db.prepare("SELECT payload,created_at FROM task_events WHERE task_id=? AND kind='board_message_failed' AND json_extract(payload,'$.event')=? ORDER BY id DESC LIMIT 1").get(member.task_id, member.id);
-          if (json(previous?.payload, {})?.reason !== reason || now() - (previous?.created_at ?? 0) >= 60)
-            event(db, member.task_id, 'board_message_failed', { event: member.id, to: mail.to, message_id: mail.message_id, reason });
-        }
+        for (const member of mail.members) event(db, member.task_id, 'board_message_failed', { event: member.id, to: mail.to, message_id: mail.message_id, reason });
       });
     }
   }
@@ -2025,8 +2089,10 @@ export async function sendBoardMessages(board, report, taskId = null) {
 /** The board's own address: where its notices come from and where card updates are mailed. */
 export const boardAddress = (label) => `sc:${localMachine()}:board:${label.replace(/[^A-Za-z0-9_.-]/g, '-')}`;
 
-/** Consecutive failed sends after which a subscription is dropped (Hermes's notifier drops a dead chat after 12). */
+/** Consecutive failed sends after which a chat-platform subscription is dropped (Hermes's notifier drops a dead chat after 12). */
 const MAX_SEND_FAILURES = 12;
+/** Attempts a supercode notice gets before it is abandoned (its subscription stays). */
+const NOTICE_ATTEMPTS = 6;
 
 /**
  * What an audience is told of an event: the workflow's `notify[audience][kind]` template over the card, the event's
@@ -2106,13 +2172,16 @@ function nativeEnded(address, discovered) {
  * A creator's or manager's subscription is never ended here: its notices wait for the session to come back.
  */
 function endWorkerSubscriptions(board, fleet, report, natively = new Map()) {
+  // each worker subscriber's liveness is read before the write
+  const aliveNow = new Map();
+  if (fleet.ok) for (const { chat_id: address } of board.db.prepare("SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) aliveNow.set(address, subscriberAlive(fleet, address));
   tx(board, (db) => {
     const { held, latest } = sessionRecord(db);
     const remove = db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?");
     const ended = new Map();
     for (const row of db.prepare("SELECT task_id, chat_id, thread_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) {
       const address = row.chat_id, record = latest.get(address);
-      if (!record || record.session.released || held.has(address) || (fleet.ok && subscriberAlive(fleet, address))) continue;
+      if (!record || record.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) === true)) continue;
       const evidence = record.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at } : natively.get(address);
       if (!evidence || !remove.run(row.task_id, address, row.thread_id).changes) continue;
       if (!ended.has(address)) ended.set(address, { record, evidence, cards: [] });
@@ -2135,6 +2204,8 @@ async function notify(board, fleet, report, entry) {
   // each subscription's notices go in order; different subscribers are told side by side
   await pool(subscriptions(board.db).filter((sub) => sub.platform === 'supercode'), SEND_CONCURRENCY, async (sub) => {
     if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) return;
+    // a subscription whose last send failed waits out its retry time (as an effect does) before the next attempt
+    if (Number(sub.delivery_metadata?.next_at ?? 0) > now()) return;
     const role = ['worker', 'dependency', 'manager'].includes(sub.delivery_metadata?.role) ? sub.delivery_metadata.role : 'creator';
     // a session the fleet does not list this tick is told next tick: one reading is not a loss (a loaded box drops
     // sessions from a read, and a dropped subscription never came back), and a session that is replaced on its card
@@ -2151,7 +2222,13 @@ async function notify(board, fleet, report, entry) {
     // the one the next run gets): the notice is filed in its mailbox, read when it next works
     const working = role !== 'worker' || view(board, (db) => addressOf(currentRun(db, sub.task_id)?.metadata?.supercode) === sub.chat_id);
     let cursor = Number(sub.last_event_id);
-    let failed = null, untried = false;
+    // A notice is sent first, under its fixed key (the mailbox drops a second send of it), and the cursor then only moves
+    // forward past it: two passes may both send one notice, and its recipient gets it once; a send that fails, or a pass
+    // that dies before its send, leaves the cursor behind the notice, so it is sent again.
+    const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
+    const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
+    const forward = (to) => tx(board, (db) => db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(to, ...identity, to));
+    let failed = null, untried = false, trying = null;
     try {
       // an event older than the workflow's notice_max_age_seconds is history, not news: it is passed over, never mailed
       const maxAge = Number(entry.params.notice_max_age_seconds) || null;
@@ -2160,9 +2237,12 @@ async function notify(board, fleet, report, entry) {
       // and answers, each its own message, in full. A notice the board already recorded as taken by this address is never sent again.
       // only events that would be told count: a stale one or the recipient's own act never supersedes one that would be
       const sendable = (ev) => { const p = json(ev.payload, {}) ?? {}; return !(maxAge && now() - Number(ev.created_at) > maxAge) && !(p.by && p.by === sub.chat_id); };
-      const latest = new Map(events.filter((ev) => !['commented', 'answered'].includes(ev.kind) && sendable(ev)).map((ev) => [ev.kind, ev.id]));
+      // News is coalesced by its subject, not its kind alone: a later `assigned` says what an earlier one did, but each
+      // subtask added, dependency linked or unlinked is its own fact, keyed by the card it names; a comment or an
+      // answer is always its own message.
+      const subjectOf = (ev) => { const p = json(ev.payload, {}) ?? {}; return ['commented', 'answered'].includes(ev.kind) ? `${ev.kind}:${ev.id}` : `${ev.kind}:${p.subtask ?? p.parent ?? p.child ?? ''}`; };
+      const latest = new Map(events.filter((ev) => sendable(ev)).map((ev) => [subjectOf(ev), ev.id]));
       const sentBefore = board.db.prepare("SELECT 1 FROM task_events WHERE task_id = ? AND kind IN ('notice_delivered', 'notice_filed') AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') = ? LIMIT 1");
-      const advance = (id) => tx(board, (db) => db.prepare("UPDATE kanban_notify_subs SET last_event_id = ? WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ? AND last_event_id < ?").run(id, sub.task_id, sub.chat_id, sub.thread_id ?? '', id));
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
         if (maxAge && now() - Number(ev.created_at) > maxAge) { cursor = ev.id; (report.stale_notices_passed ??= 0); report.stale_notices_passed += 1; continue; }
@@ -2170,7 +2250,7 @@ async function notify(board, fleet, report, entry) {
         if (sentBefore.get(sub.task_id, ev.id, sub.chat_id)) { cursor = ev.id; continue; }
         // nobody is told of their own act
         if (p.by && p.by === sub.chat_id) { cursor = ev.id; continue; }
-        if (latest.has(ev.kind) && latest.get(ev.kind) !== ev.id) { cursor = ev.id; (report.superseded_notices_passed ??= 0); report.superseded_notices_passed += 1; continue; }
+        if (latest.has(subjectOf(ev)) && latest.get(subjectOf(ev)) !== ev.id) { cursor = ev.id; (report.superseded_notices_passed ??= 0); report.superseded_notices_passed += 1; continue; }
         let text;
         if (ev.kind === 'commented') {
           if (p.author === sub.chat_id) { cursor = ev.id; continue; }
@@ -2180,6 +2260,7 @@ async function notify(board, fleet, report, entry) {
         if (text) {
           const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
           if (refused.has(sub.chat_id) || stopping) { untried = true; break; }
+          trying = ev.id;
           let receipt;
           try {
             receipt = await send(board, from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: String(sub.chat_id).includes(':claude-code:') ? false : !working || (!entry.workflow.run && sub.delivery_mode === 'notify'), subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
@@ -2187,13 +2268,16 @@ async function notify(board, fleet, report, entry) {
             // board does not send it again.
             if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'notice was not filed');
           } catch (error) {
+            // two passes may send one notice at once, and the second send can fail while the first is taken: a notice
+            // another pass already recorded as taken is no failure
+            if (sentBefore.get(sub.task_id, ev.id, sub.chat_id)) { cursor = ev.id; forward(ev.id); continue; }
             if (!refused.has(sub.chat_id)) refused.set(sub.chat_id, error);
             throw error;
           }
-          tx(board, (db) => event(db, sub.task_id, receipt.delivered ? 'notice_delivered' : 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }));
+          // recorded once, whichever pass's send the mailbox took
+          tx(board, (db) => { if (!db.prepare("SELECT 1 FROM task_events WHERE task_id = ? AND kind IN ('notice_delivered', 'notice_filed') AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') = ?").get(sub.task_id, ev.id, sub.chat_id)) event(db, sub.task_id, receipt.delivered ? 'notice_delivered' : 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }); });
           report.notified.push([sub.task_id, ev.kind, sub.chat_id]);
-          // the cursor follows each notice sent, so a restart mid-backlog resumes after it
-          advance(ev.id);
+          forward(ev.id);
         }
         cursor = ev.id;
       }
@@ -2216,16 +2300,23 @@ async function notify(board, fleet, report, entry) {
       });
       report.undelivered.push([sub.task_id, sub.chat_id, failed]);
     }
-    // the cursor moves past what was delivered (a failed delivery is retried next tick; the mail id dedupes)
+    // the cursor moves forward past what was passed over (a failed delivery is retried next pass)
+    forward(cursor);
     tx(board, (db) => {
-      const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
-      const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
-      db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(cursor, ...identity, cursor);
       // a round that left this subscription untried (a delivery to its recipient failed on another card) says nothing of it
       if (untried) return;
-      const failures = failed ? Number(sub.delivery_metadata?.failures ?? 0) + 1 : 0;
-      if (failures >= MAX_SEND_FAILURES) { db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity); return; }
-      if (failures !== Number(sub.delivery_metadata?.failures ?? 0)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures }), ...identity);
+      // A notice is tried NOTICE_ATTEMPTS times, waiting as an effect does between attempts. After its last failed
+      // attempt it is abandoned (its terminal state, `notice_abandoned`, recorded once) and the cursor moves past it;
+      // the subscription stays, so the notices after it are still told (dropping it lost them when the round
+      // subscribed the session again from the card's newest event).
+      // failures are counted per notice: a failure of a later notice starts its own count
+      const failures = failed ? (Number(sub.delivery_metadata?.failing_event) === trying ? Number(sub.delivery_metadata?.failures ?? 0) : 0) + 1 : 0;
+      if (failed && failures >= NOTICE_ATTEMPTS && trying) {
+        event(db, sub.task_id, 'notice_abandoned', { source_event: trying, address: sub.chat_id, attempts: failures, error: failed });
+        db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ?, delivery_metadata = ? ${where} AND last_event_id < ?`).run(trying, JSON.stringify({ ...sub.delivery_metadata, failures: 0, next_at: 0 }), ...identity, trying);
+        return;
+      }
+      if (failures !== Number(sub.delivery_metadata?.failures ?? 0) || (failed && Number(sub.delivery_metadata?.failing_event) !== trying)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures, failing_event: failed ? trying : null, next_at: failed ? now() + Math.min(1800, 30 * 2 ** (failures - 1)) : 0 }), ...identity);
       if (task?.status === 'archived' && cursor >= events.at(-1).id) db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity);
     });
   });
@@ -2566,17 +2657,78 @@ function capMax(cap, group, entry, lanes) {
   catch { return null; }
 }
 
+const ORCHESTRATOR_ENTRY = fileURLToPath(new URL('../bin/orchestrator.mjs', import.meta.url));
+const deliveries = new Map();
+/**
+ * Start the home's delivery pass (`workflow deliver`) in a process of its own, unless one is already running: the
+ * dispatcher's loop calls this after each round and never waits for it. `log(level, line)` hears what it failed at.
+ * Answers whether one was started.
+ */
+export function startDelivery(root, { log = () => {} } = {}) {
+  if (deliveries.has(root)) return false;
+  const child = spawnChild(process.execPath, [ORCHESTRATOR_ENTRY, 'workflow', 'deliver', '--root', root, '--json'], { stdio: ['ignore', 'pipe', 'pipe'], env: process.env });
+  deliveries.set(root, child);
+  let out = '', err = '';
+  child.stdout.setEncoding('utf8').on('data', (c) => { out += c; });
+  child.stderr.setEncoding('utf8').on('data', (c) => { err = (err + c).slice(-2000); });
+  const done = () => {
+    deliveries.delete(root);
+    let reports = null; try { reports = JSON.parse(out); } catch { log('warn', `delivery pass failed: ${(err || out).trim().slice(-300) || 'no answer'}`); return; }
+    for (const r of reports) {
+      if (r.error) log('warn', `delivery on board ${r.board} failed: ${r.error}`);
+      for (const [task, to, why] of r.undelivered ?? []) log('warn', `board ${r.board}: a delivery for ${task} to ${to} waits: ${why}`);
+      log('info', `delivery on board ${r.board}: ${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good; took ${Object.entries(r.ms ?? {}).map(([k, v]) => `${k} ${(v / 1000).toFixed(1)}s`).join(', ')}`);
+    }
+  };
+  child.on('error', (error) => { log('warn', `delivery pass did not start: ${error.message}`); deliveries.delete(root); });
+  child.on('close', done);
+  return true;
+}
+
+/**
+ * The delivery pass over every board of the home at `root`: what rounds recorded for after them (each due effect, with
+ * its bounded attempts), board mail, subscription notices, and the board's agent records joined to Teams. It runs in
+ * its own process (`workflow deliver`, started by serve after a round, one at a time), never inside a dispatch round,
+ * so no recipient, door or Teams answer holds a round. Answers one report per board.
+ */
+export async function deliver({ root, slugs = null }) {
+  fleetRoot = root;
+  const entry = await loadWorkflow(root, { fresh: true });
+  const fleet = observeFleet();
+  const out = [];
+  for (const slug of slugs ?? listBoards(root)) {
+    const report = { board: slug, ms: {}, mailed: [], queued: [], failed: [], notified: [], undelivered: [], fleet: fleet.ok ? 'read' : fleet.error };
+    let board;
+    try {
+      board = openBoard(root, slug);
+      board.label = boardLabel(root, slug);
+      setActor(boardAddress(board.label));
+      let mark = Date.now();
+      const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
+      // board mail is sent as effect rows, one per message, each claimed as any effect is
+      tx(board, (db) => queueBoardMail(db)); phase('mail');
+      report.effects = await runEffects(board, [], { pending: true }); phase('effects');
+      await notify(board, fleet, report, entry); phase('notify');
+      synchronizeAgents(board, fleet, report, entry); phase('agents');
+      report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
+      report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);
+    } catch (error) { report.error = error.message; }
+    finally { board?.close(); }
+    out.push(report);
+  }
+  return out;
+}
+
 /**
  * One tick over every board of the home at `root`. `lanes` from `lanesOf`, `settings` from `boardSettings`.
  * `only` limits starting to one card (a create that answers whether its card started). Each board is ticked under its
  * version-checked card claims; no dispatcher file lock. Two rounds may run at once (the dispatcher's and a one-shot
  * `workflow dispatch`). An adoption request and a session close are claimed in a transaction (`newClaim`) before
  * anything is done for them outside the board; card starts, supervision, review requests, mailed verbs and manual
- * continuations rely on their per-card transactions. Two rounds on one board at once can still both act on: queued
- * effects in `runEffects` (send_to_actor, session_notice, merge_reviewed, declare_card_agent), board mail,
- * subscription notices (a doubled notice_delivered has been seen live), deferred-launch retries (two panes),
- * launch-receipt work (cancelUnissuedLaunch, bindLaunch), the Teams agent-run sync in reconcileLaunches, and
- * board-only writes that do not re-check. Answers one report per board.
+ * continuations rely on their per-card transactions. Two rounds on one board at once can still both act on:
+ * deferred-launch retries (two panes), launch-receipt work (cancelUnissuedLaunch, bindLaunch), and board-only writes
+ * that do not re-check. A round runs no effect and delivers nothing: it records effects (`queueEffects`) and the
+ * delivery pass (`deliver`) carries them out. Answers one report per board.
  */
 export async function tick({ root, lanes, settings, only = null, slugs = null, dispatch = true, params = {}, deploymentReceipt = false }) {
   fleetRoot = root;
@@ -2618,20 +2770,18 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       readMailbox(board, boardAddress(board.label), report); phase('mailbox');
       await refreshRelationAnswers(board); phase('answers');
       const effects = [];
-      completeAdoptions(board, fleet, settings, report, lanes); reconnectContinuedSessions(board, fleet, entry, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); await runEffects(board, effects.splice(0), { retryNotices: true }); closeRequested(board, report, { ttl: settings.ttl }); phase('supervise');
+      completeAdoptions(board, fleet, settings, report, lanes); reconnectContinuedSessions(board, fleet, entry, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); closeRequested(board, report, { ttl: settings.ttl }); phase('supervise');
       report.unsettled = [];
       report.promoted = recomputeReady(board, effects, report.unsettled);
       tx(board,db=>auditEndedRuns(db,board,entry));
       if (dispatch) await activatePullRequestReviews(board, entry, report, effects, { only });
-      await sendBoardMessages(board, report);
       if (dispatch && !stopping) startCards(board, fleet, lanes, settings, report, entry, effects, { only, held });
       phase('start');
       if (dispatch && !only && !report.paused) observeIdle(board, fleet, settings, report, entry, effects);
-      // what the moves asked for, once they are committed (messages to actors, closed panes, cleaned workspaces)
-      await runEffects(board, effects);
+      // what the moves asked for is recorded with them; the delivery pass (`deliver`) carries it out, outside the round
+      queueEffects(board, effects);
       phase('goals');
       ensureSubscriptions(board, entry);
-      await notify(board, fleet, report, entry); phase('notify');
       fireHooks(board, settings, report);
       if (String(board.db.prepare('PRAGMA journal_mode').get()?.journal_mode).toLowerCase() === 'wal') board.db.prepare('PRAGMA wal_checkpoint(PASSIVE)').get();
       report.ready_waiting = Number(board.db.prepare("SELECT COUNT(*) AS n FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id WHERE t.status = 'ready' AND t.assignee IS NOT NULL AND c.subtask_of IS NULL").get().n);

package/board/engine.mjs

@@ -463,41 +463,105 @@ export async function goto(board, id, status, { roles = null, payload = {} } = {
   return { ...(await act(board, id, name, { roles, payload })), event: name };
 }
 
-/** The I/O a committed move asked for. */
-export async function runEffects(board, effects = [], { retryNotices = false } = {}) {
+// A delivery (a notice, an actor message, an agent declaration) is tried at most EFFECT_ATTEMPTS times, waiting twice as
+// long after each failed attempt (from 30 s, at most 30 min). Its last failed attempt is its terminal state: the row
+// keeps `failed_at` and the error, the card records `effect_failed` once, diagnose shows it, and nothing tries it again.
+// A board-state effect the dispatcher owns (OWNED: merging the reviewed PRs, cleaning a workspace) is never abandoned:
+// it keeps trying at the capped wait, and at EFFECT_ATTEMPTS failed attempts its card records `effect_stalled` and the
+// managers are mailed once, so a passed card whose merge keeps failing is seen, and still heals when the cause clears.
+export const EFFECT_ATTEMPTS = 6;
+const OWNED = new Set(['merge_reviewed', 'cleanup_workspace']);
+const effectWait = (attempts) => Math.min(1800, 30 * 2 ** Math.max(0, attempts - 1));
+// A delivery pass claims a row by compare-and-set on its next_at (set ahead only while the row is due) before trying it,
+// so two passes (serve's, the hosted loop's, a person's `workflow deliver`, a verb's own) never try one effect at once.
+// The claim outlasts any one attempt: each effect's I/O is bounded by its own timeouts (a send's 180 s, a merge's
+// MERGE_BUDGET plus one in-flight GitHub call), all well inside EFFECT_CLAIM.
+const EFFECT_CLAIM = 900;
+
+/**
+ * The effects a committed move asked for. Board writes the round owns (invalidating descendants, asking a session's
+ * close, stopping a local worker) are made here, in the round; everything that reaches outside the board is recorded
+ * to run after it, in the delivery pass, never inside a dispatch round.
+ */
+export function queueEffects(board, effects = []) {
+  // a board message is its own effect row (dispatch.mjs queueBoardMail), so the move's mail hint is not recorded
+  const fresh = effects.filter((e) => !e.durableId && e.kind !== 'run' && !(e.kind === 'board_message' && !e.event));
+  const now_ = fresh.filter((e) => ['invalidate_descendants', 'close_session', 'run_ended', 'stop_run'].includes(e.kind));
+  const later = fresh.filter((e) => !now_.includes(e));
+  for (const e of now_) {
+    if (e.kind === 'invalidate_descendants') tx(board, (db) => invalidateDescendants(db, board, e.id));
+    else if (e.kind === 'close_session') tx(board, (db) => requestSessionClose(db, e.id, { slot: e.slot, through: e.runId }));
+    else if (e.kind === 'run_ended') { if (e.outcome === 'reclaimed') stopWorker(board, e.runId); tx(board, (db) => requestSessionClose(db, e.id, { runId: e.runId })); }
+    else if (e.kind === 'stop_run') stopWorker(board, e.runId);
+  }
+  if (later.length) tx(board, (db) => { for (const e of later) db.prepare('INSERT INTO supercode_effects (effect) VALUES (?)').run(JSON.stringify(e)); });
+}
+
+/** The I/O a committed move asked for: the move's own `effects`, and with `pending` every recorded effect that is due. */
+export async function runEffects(board, effects = [], { pending: due = false } = {}) {
   const requested = new Set(effects.map((e) => e.durableId).filter(Boolean));
-  const pending = board.db.prepare('SELECT id, effect FROM supercode_effects ORDER BY id').all()
-    .filter((p) => retryNotices || requested.has(p.id));
-  const durable = new Set(pending.map((p) => p.id));
-  const combined = [...pending.map((p) => ({ ...json(p.effect, {}), durableId: p.id })), ...effects.filter((e) => !e.durableId || !durable.has(e.durableId))];
+  const t = now();
+  const rows = board.db.prepare('SELECT id, effect, attempts, next_at FROM supercode_effects WHERE failed_at IS NULL ORDER BY id').all()
+    .filter((p) => (requested.has(p.id) || due) && Number(p.next_at ?? 0) <= t);
+  const durable = new Set(rows.map((p) => p.id));
+  const attempts = new Map(rows.map((p) => [p.id, Number(p.attempts ?? 0)]));
+  const combined = [...rows.map((p) => ({ ...json(p.effect, {}), durableId: p.id })), ...effects.filter((e) => !e.durableId || (!durable.has(e.durableId) && !requested.has(e.durableId)))];
   combined.sort((a,b) => Number(b.kind === 'session_notice') - Number(a.kind === 'session_notice'));
+  // what this call did, for its caller's report: effect ids done, tried and kept, and skipped as another's claim
+  const did = { done: [], kept: [], claimed_elsewhere: [] };
   for (const e of combined) {
-    if (e.kind === 'session_notice') {
-      const { sessionNotice } = await import('./dispatch.mjs');
-      if (!await sessionNotice(board, e)) continue;
-    }
-    else if (e.kind === 'cleanup_workspace') cleanupWorkspace(board, e.id);
-    else if (e.kind === 'declare_card_agent') {
-      const {declareCardAgentEffect}=await import('./agent-declarations.mjs');
-      if(!declareCardAgentEffect(board,e))continue;
-    }
-    else if (e.kind === 'board_message') {
-      const { sendBoardMessages } = await import('./dispatch.mjs');
-      await sendBoardMessages(board, { undelivered: [] }, e.id);
-    }
-    else if (e.kind === 'merge_reviewed') {
-      const { mergeReviewed } = await import('./dispatch.mjs');
-      if (await mergeReviewed(board, e) === false) continue;
-    }
-    else if (e.kind === 'invalidate_descendants') tx(board, (db) => invalidateDescendants(db, board, e.id));
-    else if (e.kind === 'stop_run') stopWorker(board, e.runId);
-    else if (e.kind === 'close_session' || e.kind === 'send_to_actor' || e.kind === 'run_ended') {
-      if (e.kind === 'run_ended' && e.outcome === 'reclaimed') stopWorker(board, e.runId);
-      const { sessionEffect } = await import('./dispatch.mjs');
-      if (await sessionEffect(board, e) === false) continue;
-    }
-    if (e.durableId) tx(board, (db) => db.prepare('DELETE FROM supercode_effects WHERE id = ?').run(e.durableId));
+    // the claim: taken only while the row is due and not failed; another pass holding it answers no change
+    if (e.durableId && !tx(board, (db) => db.prepare('UPDATE supercode_effects SET next_at = ? WHERE id = ? AND failed_at IS NULL AND next_at <= ?').run(now() + EFFECT_CLAIM, e.durableId, now()).changes)) { did.claimed_elsewhere.push(e.durableId); continue; }
+    let done, error = null;
+    try { done = await runEffect(board, e); } catch (thrown) { done = false; error = String(thrown?.message ?? thrown).slice(0, 500); }
+    if (!e.durableId) continue;
+    // a mail inside its batch window is not an attempt: it is looked at again in a few seconds
+    if (done === 'wait') { tx(board, (db) => db.prepare('UPDATE supercode_effects SET next_at = ? WHERE id = ?').run(now() + 5, e.durableId)); did.kept.push(e.durableId); continue; }
+    if (done) { tx(board, (db) => db.prepare('DELETE FROM supercode_effects WHERE id = ?').run(e.durableId)); did.done.push(`${e.durableId}:${e.kind}`); continue; }
+    did.kept.push(e.durableId);
+    const made = (attempts.get(e.durableId) ?? 0) + 1;
+    tx(board, (db) => {
+      const row = db.prepare('SELECT failed_at, last_error FROM supercode_effects WHERE id = ?').get(e.durableId);
+      if (!row || row.failed_at) return;
+      const reason = error ?? row.last_error ?? `${e.kind} was not accepted`;
+      const card = e.id && db.prepare('SELECT 1 FROM tasks WHERE id = ?').get(e.id) ? e.id : null;
+      if (OWNED.has(e.kind)) {
+        db.prepare('UPDATE supercode_effects SET attempts = ?, next_at = ?, last_error = ? WHERE id = ?').run(made, now() + effectWait(made), reason, e.durableId);
+        if (made === EFFECT_ATTEMPTS && card) {
+          event(db, card, 'effect_stalled', { effect: e.durableId, kind: e.kind, attempts: made, error: reason, retry_every_seconds: effectWait(made) }, e.runId ?? null);
+          const to = [].concat(workflowFor(board.root).params?.managers ?? []).find(Boolean);
+          if (to) event(db, card, 'board_message', { to, text: `${card}: the board's ${e.kind.replace('_', ' ')} has failed ${made} times and keeps trying every ${effectWait(made) / 60} min: ${reason}` }, null);
+        }
+      } else if (made >= EFFECT_ATTEMPTS) {
+        db.prepare('UPDATE supercode_effects SET attempts = ?, failed_at = ?, last_error = ? WHERE id = ?').run(made, now(), reason, e.durableId);
+        if (card) event(db, card, 'effect_failed', { effect: e.durableId, kind: e.kind, attempts: made, error: reason, address: e.address ?? null }, e.runId ?? null);
+        if (card && e.kind === 'board_message' && e.event) event(db, card, 'board_message_abandoned', { event: e.event, attempts: made, reason });
+      } else db.prepare('UPDATE supercode_effects SET attempts = ?, next_at = ?, last_error = ? WHERE id = ?').run(made, now() + effectWait(made), reason, e.durableId);
+    });
+  }
+  return did;
+}
+
+/** One effect's I/O: true when it is done, false when it is not done yet (the caller counts the attempt). */
+async function runEffect(board, e) {
+  if (e.kind === 'session_notice') { const { sessionNotice } = await import('./dispatch.mjs'); return await sessionNotice(board, e) !== false; }
+  if (e.kind === 'cleanup_workspace') { cleanupWorkspace(board, e.id); return true; }
+  if (e.kind === 'declare_card_agent') { const { declareCardAgentEffect } = await import('./agent-declarations.mjs'); return declareCardAgentEffect(board, e) !== false; }
+  if (e.kind === 'board_message') {
+    const { sendBoardMessage, sendBoardMessages } = await import('./dispatch.mjs');
+    // a verb's own ask sends its card's mail at once; the mail's own effect row then finds it sent
+    if (!e.event) { await sendBoardMessages(board, { undelivered: [] }, e.id); return true; }
+    return await sendBoardMessage(board, e);
   }
+  if (e.kind === 'merge_reviewed') { const { mergeReviewed } = await import('./dispatch.mjs'); return await mergeReviewed(board, e) !== false; }
+  if (e.kind === 'invalidate_descendants') { tx(board, (db) => invalidateDescendants(db, board, e.id)); return true; }
+  if (e.kind === 'stop_run') { stopWorker(board, e.runId); return true; }
+  if (e.kind === 'close_session' || e.kind === 'send_to_actor' || e.kind === 'run_ended') {
+    if (e.kind === 'run_ended' && e.outcome === 'reclaimed') stopWorker(board, e.runId);
+    const { sessionEffect } = await import('./dispatch.mjs');
+    return await sessionEffect(board, e) !== false;
+  }
+  return true;
 }
 
 // a run taken back stops its one-shot worker on this host (Hermes's _terminate_reclaimed_worker); a pane session is
@@ -903,6 +967,18 @@ export function diagnose(db, task, { failureLimit = DEFAULT_FAILURE_LIMIT, stran
     const session = lastSession(db, task.id);
     if (session?.machine && !fleet.online.has(session.machine) && !fleet.unknown?.has(session.machine)) out.push({ kind: 'machine_offline', severity: 'warning', title: `its machine ${session.machine} is offline`, data: { machine: session.machine }, actions: [] });
   }
+  // what the board could not carry out for the card: a delivery failed for good, or a board effect that keeps failing
+  for (const row of all(db, "SELECT id, effect, attempts, failed_at, last_error FROM supercode_effects WHERE json_extract(effect, '$.id') = ? AND (failed_at IS NOT NULL OR attempts >= ?)", task.id, EFFECT_ATTEMPTS)) {
+    const kind = json(row.effect, {})?.kind ?? 'effect';
+    out.push(row.failed_at
+      ? { kind: 'effect_failed', severity: 'warning', title: `its ${kind} failed for good after ${row.attempts} attempts: ${row.last_error ?? 'no reason recorded'}`, data: { effect: row.id, kind, attempts: row.attempts }, actions: [] }
+      : { kind: 'effect_stalled', severity: 'error', title: `its ${kind} has failed ${row.attempts} times and is still tried: ${row.last_error ?? 'no reason recorded'}`, data: { effect: row.id, kind, attempts: row.attempts }, actions: [] });
+  }
+  // notices the board gave up on: each one, with the event it was about and who was not told
+  for (const row of all(db, "SELECT payload FROM task_events WHERE task_id = ? AND kind = 'notice_abandoned' ORDER BY id DESC LIMIT 20", task.id)) {
+    const p = json(row.payload, {}) ?? {};
+    out.push({ kind: 'notice_abandoned', severity: 'warning', title: `the notice of event ${p.source_event} to ${p.address} was abandoned after ${p.attempts} attempts: ${p.error ?? 'no reason recorded'}`, data: { event: p.source_event, address: p.address, attempts: p.attempts }, actions: [] });
+  }
   const order = ['critical', 'error', 'warning'];
   return out.sort((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity));
 }

package/board/request-mail.mjs

@@ -3,7 +3,9 @@ import { event, json, now } from './store.mjs';
 export function pendingRequestMail(db, taskId = null) {
   const pending = db.prepare(`SELECT id, task_id, payload, created_at FROM task_events original
     WHERE kind='board_message' AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind='board_message_sent'
-      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id) ORDER BY id`).all()
+      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id)
+    AND NOT EXISTS (SELECT 1 FROM task_events gone WHERE gone.kind='board_message_abandoned'
+      AND gone.task_id=original.task_id AND json_extract(gone.payload,'$.event')=original.id) ORDER BY id`).all()
     .map(row => ({ ...row, mail: json(row.payload, {}) ?? {} }));
   if (!pending.length) return { ready: [], nextAt: Infinity };
   const batches = db.prepare("SELECT payload FROM task_events WHERE kind='board_message_batch' AND id>=? ORDER BY id").all(pending[0].id)

package/board/store.mjs

@@ -76,6 +76,9 @@ CREATE TABLE IF NOT EXISTS supercode_effects (id INTEGER PRIMARY KEY AUTOINCREME
 // `stage`: the card's workflow status where kanban.db stores another (a `reviewing` card is `running` to Hermes)
 // `since`: when the card entered its workflow status; `after_fired`: which of the status's `after` moves have run since
 // `tags`: the card's ordered tags (Hermes's `tenant` holds the first); `sponsor`, `sponsor_evidence`, `requested_by_unverified`: C4
+// An effect's attempts: how many were made, when the next may be, and, once its attempts are spent, when it failed and
+// why (engine.mjs runEffects). A failed effect is kept as the record of its terminal state and never tried again.
+const EFFECT_COLUMNS = { attempts: 'INTEGER NOT NULL DEFAULT 0', next_at: 'INTEGER NOT NULL DEFAULT 0', failed_at: 'INTEGER', last_error: 'TEXT' };
 const OURS_COLUMNS = { workspace_anchor: 'TEXT', workspace_root: 'TEXT', subtask_of: 'TEXT', stage: 'TEXT', since: 'INTEGER', after_fired: 'TEXT', blocked_by: 'TEXT', paused: 'TEXT', archived: 'INTEGER DEFAULT 0', every: 'TEXT', next_run_at: 'INTEGER', tags: 'TEXT', sponsor: 'TEXT', sponsor_evidence: 'TEXT', requested_by_unverified: 'TEXT' };
 
 // ------------------------------------------------------------------ backings
@@ -140,6 +143,8 @@ export function layOut(db, { fresh }) {
   db.exec(PUBLICATION_SCHEMA);
   const have = new Set(db.prepare('PRAGMA table_info(supercode_cards)').all().map((c) => c.name));
   for (const [column, type] of Object.entries(OURS_COLUMNS)) if (!have.has(column)) db.exec(`ALTER TABLE supercode_cards ADD COLUMN ${column} ${type}`);
+  const effectColumns = new Set(db.prepare('PRAGMA table_info(supercode_effects)').all().map((c) => c.name));
+  for (const [column, type] of Object.entries(EFFECT_COLUMNS)) if (!effectColumns.has(column)) db.exec(`ALTER TABLE supercode_effects ADD COLUMN ${column} ${type}`);
 }
 
 /**

package/board.mjs

@@ -13,7 +13,7 @@
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { summary } from './board/cli.mjs';
-import { commandEnv, notifyChats, supercodeBin } from './board/dispatch.mjs';
+import { commandEnv, notifyChats, startDelivery, supercodeBin } from './board/dispatch.mjs';
 import { watchBoard } from './board/wake.mjs';
 import { workflowEntry } from './board/workflow.mjs';
 import { evaluate, holds } from './board/expr.mjs';
@@ -79,6 +79,8 @@ export async function startBoard({ root, orchestration = null, log = () => {}, a
     try {
       const { reports, error } = await dispatchOnce(root);
       if (error) { log('warn', `board: tick failed: ${error}`); return; }
+      // what the round recorded is delivered by a pass of its own, which this loop never waits for
+      startDelivery(root, { log: (level, line) => log(level, `board: ${line}`) });
       // chat-platform subscriptions are delivered here, through the daemon's own channel adapters
       try { await notifyChats(root, adapters, log, wake); } catch (error) { log('warn', `board: chat notices failed: ${error.message}`); }
       for (const r of reports) {

package/loop.mjs

@@ -24,7 +24,7 @@ import { harnessHomes } from './mcp/verbs.mjs';
 import { checkMonitor, runJobScript } from './gates.mjs';
 import { startBoard } from './board.mjs';
 import { SenderIdentityRecord } from '@volter/teams/sender-identity';
-import { agentDoor,agentScope,teamsUnavailable,ensureProfileAgent,localProfileAgent,localAgentRecord,localAgentSessions,synchronizeLocalAgents,ensureForkAgent,agentRunForKey,agentIntent,agentPreamble,agentEnvironment,recordAgentRun,recordNativeAgentSession,pendingAgentRuns,synchronizeAgentRun,agentRunForSession } from './agents.mjs';
+import { agentDoor,agentScope,teamsUnavailable,ensureProfileAgent,localProfileAgent,localAgentRecord,localAgentSessions,synchronizeLocalAgents,ensureForkAgent,agentRunForKey,agentIntent,agentPreamble,agentEnvironment,recordAgentRun,recordNativeAgentSession,pendingAgentRuns,claimAgentRun,releaseAgentRun,synchronizeAgentRun,agentRunForSession } from './agents.mjs';
 import { materializeAgentHome } from './agent-home.mjs';
 import { localMachine } from './board/dispatch.mjs';
 import { execFile } from 'node:child_process';
@@ -201,8 +201,9 @@ export class Orchestrator {
       if(scope.offline)return;
       for(const pending of synchronizeLocalAgents({root:this.state.root,profiles:this.state.profiles,context,declarations:this.state.agents??{}}))this.log('warn',`agent ${pending.agent} declaration pending: ${pending.error}`);
       for(const row of pendingAgentRuns(this.state.root,scope.org)){
+        if(!claimAgentRun(this.state.root,scope.org,row))continue;
         try{synchronizeAgentRun(this.state.root,scope.org,row,{context,intended:row.profile_json?JSON.parse(row.profile_json):undefined});}
-        catch(error){this.log('warn',`agent session ${row.session_ref}: ${error.message}`);if(error.code==='rate_limited')break;}
+        catch(error){releaseAgentRun(this.state.root,scope.org,row);this.log('warn',`agent session ${row.session_ref}: ${error.message}`);if(error.code==='rate_limited')break;}
       }
     }catch(error){this.log('warn',`agent session synchronization: ${error.message}`);}
   }
@@ -521,8 +522,8 @@ export class Orchestrator {
     if(!INSTRUCTION_ARGUMENTS[worker.harness])(this.runtimeAgentPreambles??=new Map()).set(lid,agentPrompt);
     const session=`${worker.harness}:${runtime.handle.runtime_id}`;
     recordAgentRun(this.state.root,scope.org,agent.identity.id,{session,machine:null,run:run_key??lid,profile:agent.intended.resolved,main,starterSession:starter_session});
-    if(agent.synced!==false)try{synchronizeAgentRun(this.state.root,scope.org,{agent_id:agent.identity.id,session_ref:session,machine:null,main},{context,intended:agent.intended.resolved});}
-    catch(error){this.log('warn',`agent session ${session} retained for synchronization: ${error.message}`);}
+    if(agent.synced!==false&&claimAgentRun(this.state.root,scope.org,{session_ref:session,published:0}))try{synchronizeAgentRun(this.state.root,scope.org,{agent_id:agent.identity.id,session_ref:session,machine:null,main},{context,intended:agent.intended.resolved});}
+    catch(error){releaseAgentRun(this.state.root,scope.org,{session_ref:session});this.log('warn',`agent session ${session} retained for synchronization: ${error.message}`);}
     this.enqueue(events.worker({
       profile: profileName, keyString, runtime_id: runtime.handle.runtime_id,
       ev: { kind: 'started', runtime_id: runtime.handle.runtime_id, session_id: runtime.handle.runtime_id, connection: runtime.connection, harness: worker.harness, steer },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.38",
+  "version": "0.5.40",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {