@volter/supercode-orchestrator 0.5.39 → 0.5.41

package/bin/machine-fleet.mjs

@@ -12,15 +12,24 @@ async function read({ name, at }) {
   let channel;
   try {
     channel = await openMachine({ machine: at });
-    const panes = await new StreamRpc(await channel.open('node')).call('harness.v1.panes.list', {});
+    const node = new StreamRpc(await channel.open('node'));
+    const panes = await node.call('harness.v1.panes.list', {});
+    // What a board launch needs of this machine: its board process guard (describe), and its keyed launch door, asked
+    // for a key no launch has (an answer of null is the door; an unknown method is its absence)
+    const description = await node.call('harness.v1.machine.describe', {}).catch(() => null);
+    const keyed = await node.call('harness.v1.launches.get', { key: 'board-capability-reading' }).then(() => null, (error) => String(error?.message ?? error).slice(0, 200));
+    const capabilities = { guard: description?.boardProcessPolicy?.version === 1 ? description.boardProcessPolicy.harnesses ?? [] : [], launches: keyed === null, launchesRefused: keyed };
     const live = (Array.isArray(panes) ? panes : []).filter((pane) => !pane.dead && pane.pid);
-    let activities = [];
+    // the session under each live pane: the harness stream, an operator's; a caller the machine admits only to its panes
+    // (a box another custodian enrolled, granting view and control) reads its panes and no sessions
+    let activities = [], sessionsUnread = null;
     if (live.length) {
       const client = new SupercodeHarnessClient({ transport: harnessTransport(channel) });
       try { await client.start?.(); activities = (await client.request('harness.v1.sessions.activity_under', { pids: live.map((pane) => pane.pid) }))?.activities ?? []; }
-      finally { await client.close?.(); }
+      catch (error) { sessionsUnread = String(error?.message ?? error).slice(0, 200); }
+      finally { await client.close?.().catch(() => {}); }
     }
-    return { machine: name, panes, activities };
+    return { machine: name, panes, activities, capabilities, sessionsUnread };
   } finally { channel?.close(); }
 }
 const rows = await Promise.all(machines.map((machine) => within(read(machine), deadlineMs)

package/board/dispatch.mjs

@@ -312,6 +312,8 @@ function supervise(board, fleet, settings, report, entry, effects) {
   for (const { id } of rows) {
     const session = currentRun(board.db, id)?.metadata?.supercode;
     if (!session?.launch_key || !fleet.ok || sessionAlive(fleet, session) !== false) continue;
+    // how a keyed launch ended, where its machine keeps that record: read when it can be, never waited on
+    if (!fleet.capabilities?.get(normalMachine(session.machine))?.launches) continue;
     try { const receipt = launchReceipt(board, session); if (receipt?.live === false && receipt.exit) exits.set(id, receipt.exit); }
     catch (error) { report.failed.push([id, `exit receipt unavailable; retaining liveness observation: ${error.message}`]); }
   }
@@ -351,11 +353,16 @@ function supervise(board, fleet, settings, report, entry, effects) {
       const adopted = session?.mode === 'adopt' && Boolean(session.address);
       if (runRow && ((session?.launch_pending && !adopted) || session?.launch_deferred || (!session?.session_id && !session?.pid))) {
         const age = t - Number(session?.launched_at ?? runRow.started_at);
+        // a launch whose answer was lost may still have opened its pane: the window ends it only when this round's
+        // fleet reading shows neither its pane nor its session on its machine
+        const seen = session?.launch_key ? launchReading(fleet, session) : 'absent';
+        if (age >= settings.launchWindow && seen !== 'absent') { extendClaim(db, id, { ttl: settings.ttl, reason: seen === 'present' ? 'launch_binding' : 'launch_unread' }); return; }
         if (age >= settings.launchWindow) {
           const reason = session?.launch_deferred_error ?? session?.launch_error ?? 'no session or process was bound to the dispatched run';
           const error = `launch window ${settings.launchWindow}s expired after ${age}s: ${reason}`;
           if (!session?.launch_expired_at) {
-            setRunSession(db, runRow.id, { launch_expired_at: t, launch_error: error });
+            // a fresh launch the reading never showed has no session to resume: its next run starts fresh
+            setRunSession(db, runRow.id, { launch_expired_at: t, launch_error: error, ...(session?.launch_key && session.mode === 'fresh' ? { forgotten: true } : {}) });
             event(db, id, 'session_launch_expired', { error, age_seconds: age, window_seconds: settings.launchWindow, key: session?.launch_key ?? null, pane: session?.pane ?? null }, runRow.id);
           }
           observe('spawn_failed', { error, launch_window_seconds: settings.launchWindow }, null);
@@ -799,7 +806,7 @@ export async function startCard(board, id, { roles = ['manager'], lanes, setting
 
 /** Reconcile durable close intent and ended runs, including old unverified closed_at records.
  * Reads and process I/O stay outside the writer. An active successor owns its pane until it ends. */
-export function closeRequested(board, report, { taskId = null, caller = null, ttl = null } = {}) {
+export function closeRequested(board, report, { taskId = null, caller = null, ttl = null, fleet = null } = {}) {
   const rows = view(board, (db) => db.prepare(`SELECT id, task_id, ended_at, metadata FROM task_runs
     WHERE metadata IS NOT NULL ${taskId ? 'AND task_id = ?' : ''}`).all(...(taskId ? [taskId] : [])));
   // Repair pre-transfer history once: only identities with an older unended reference need a write.
@@ -821,29 +828,29 @@ export function closeRequested(board, report, { taskId = null, caller = null, tt
   for (const row of rows) {
     let session = json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
     if (!session || session.close_transferred_to || session.close_confirmed_at) continue;
-    if (session.launch_key && (session.launch_pending || !session.pane) && (row.ended_at || session.close_requested)) {
-      let receipt = null, receiptError = null;
-      try {
-        receipt = launchReceipt(board, session);
-        if (!receipt) receipt = cancelUnissuedLaunch(board, session);
-      } catch (error) { receiptError = error.message; }
-      const retired = unissuedLaunch(receipt, session) && retireUnissuedLaunch(board, row, session, receipt);
-      if (retired === true) {
-        (report.closed ??= []).push({ task_id: row.task_id, ...session, receipt });
-        continue;
-      }
-      // the key was never issued, and the session adopted onto the run is closed (or released) as its own below
-      if (retired === 'released') session = json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
-      // A receipt that names its pane and reads it not live is terminal enough to settle, with or without a status (a
-      // daemon that predates launch statuses answers none): the board's own pane reading below confirms the close
-      else if (receipt?.pane && receipt.status !== 'issued' && (receipt.status || typeof receipt.live === 'boolean' || receipt.exit)) { bindLaunch(board, row, session, receipt.pane, session.session_id); session = { ...session, pane: receipt.pane }; }
-      else {
-        const error = `close deferred: ${receiptError ?? `awaiting terminal launch receipt ${session.launch_key} (${receipt?.status ?? 'unknown'})`}`;
-        tx(board, (db) => {
-          setRunSession(db, row.id, { close_error: error, close_requested: session.close_requested ?? now() });
-          if (session.close_error !== error) event(db, row.task_id, 'session_close_failed', { error, retry: true }, row.id);
+    // A keyed launch is reconciled by its machine's own daemon (D137), never by a door the close waits on. A session
+    // adopted onto a run whose launch was still pending did not come from that launch: the key is let go and the
+    // session is the run's, released or closed as its own below. A launch that never bound a pane left nothing the
+    // board can name on its machine: its close is settled here. One with a pane is closed as any pane: panes.close,
+    // then the pane read absent.
+    if (session.launch_key && session.launch_pending && (row.ended_at || session.close_requested)) {
+      if (session.mode === 'adopt' && session.address) {
+        tx(board, (db) => setRunSession(db, row.id, { launch_pending: false, launch_key: null, launch_error: null }));
+        session = json(board.db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
+      } else if (!session.pane && !session.address && !session.pid) {
+        // settled only on a fleet reading that shows no session with its id on its machine; a lost open answer may
+        // have opened one, and that is closed as its own once it is bound
+        if (launchReading(fleet, session) !== 'absent') { report.undelivered.push([row.task_id, session.launch_key, 'close waits for a fleet reading that shows its launch absent', 'close']); continue; }
+        const settled = tx(board, (db) => {
+          const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
+          if (!current || current.launch_key !== session.launch_key || current.pane || current.close_confirmed_at) return false;
+          const at = now();
+          setRunSession(db, row.id, { launch_pending: false, close_requested: current.close_requested ?? at, closed_at: at, close_confirmed_at: at, close_error: null,
+            launch_error: current.launch_error ?? 'no pane was bound to its launch', forgotten: current.mode === 'fresh' ? true : Boolean(current.forgotten) });
+          event(db, row.task_id, 'session_closed', { key: session.launch_key, machine: session.machine, reason: 'no pane was bound to its launch, and the fleet reading shows neither a pane nor its session' }, row.id);
+          return true;
         });
-        report.undelivered.push([row.task_id, addressOf(session), error, 'close']);
+        if (settled) (report.closed ??= []).push({ task_id: row.task_id, ...session });
         continue;
       }
     }
@@ -1049,10 +1056,7 @@ export async function sessionNotice(board, e) {
   if (prior?.close_confirmed_at) {
     tx(board, (db) => {
       // A closed session has nothing to be told; its next run starts with its own prompt.
-      const unissued = unissuedLaunch(prior.launch_cancellation, prior);
-      event(db, e.id, 'session_notice_not_required', { address: e.address, verb: e.verb, notice: e.durableId,
-        reason: unissued ? 'machine confirmed launch was not issued; no session exists to notify' : 'session closed',
-        ...(unissued ? { receipt: prior.launch_cancellation } : {}) }, e.runId);
+      event(db, e.id, 'session_notice_not_required', { address: e.address, verb: e.verb, notice: e.durableId, reason: 'session closed' }, e.runId);
       if (prior.lifecycle_notice_pending === e.durableId) setRunSession(db, e.runId, { lifecycle_notice_pending: null });
     });
     return true;
@@ -1172,6 +1176,11 @@ function launcherCheck(db, task, lane, fleet) {
   const machine = normalMachine(task.machine);
   if (!fleet.ok) return `supercode could not read the fleet: ${fleet.error}`;
   if (fleet.unknown?.has(machine)) return `machine ${machine}'s door did not answer; the card starts when it does`;
+  // a machine is scheduled only when it can take a board launch: its board process guard runs this harness, and its
+  // daemon keeps keyed launches (it reconciles them itself). One without them is not scheduled, and says why.
+  const can = fleet.capabilities?.get(machine);
+  if (fleet.online.has(machine) && can && !can.launches) return `machine ${machine} cannot take a board launch: its keyed launch door (harness.v1.launches.get) answered ${can.launchesRefused ?? 'nothing'} (an older daemon has none; a box another custodian runs keeps it for its operators)`;
+  if (fleet.online.has(machine) && can && !can.guard.includes(HARNESSES[lane.harness] ? lane.harness : 'claude-code')) return `machine ${machine} has no native board process guard for ${lane.harness ?? 'claude-code'}; no unguarded session is launched`;
   if (!fleet.online.has(machine)) return `machine ${machine} is offline; the card starts when it is back`;
   // a card on this machine gets its workspace made here (scratch, dir or worktree, as Hermes makes it); another
   // machine's card names its directory there
@@ -1233,68 +1242,28 @@ const getTaskNow = (board, id) => view(board, (db) => getTask(db, id));
 
 
 /** A transport error is not a negative launch receipt. The key remains owned by its run. */
+/**
+ * Where the round's fleet reading puts a launch's session: 'present' when its machine lists the launch's pane or a
+ * session with its id, 'absent' when its machine answered and lists neither, null when its machine was not read.
+ */
+function launchReading(fleet, session) {
+  const machine = normalMachine(session?.machine ?? localMachine());
+  if (!fleet?.ok || !fleet.online?.has(machine) || !fleet.panes?.has(machine)) return null;
+  const sessionSeen = session.session_id && fleet.sessions?.some((f) => f.machine === machine && f.session_id === session.session_id);
+  return (session.pane && fleet.panes.get(machine).has(session.pane)) || sessionSeen ? 'present' : 'absent';
+}
+
+/** How a keyed launch ended, as its machine recorded it; read only where the machine has the door (supervise). */
 function launchReceipt(board, session) {
   const r = doorOn(session.machine, 'harness.v1.launches.get',{key:session.launch_key},
     { timeout: 30_000, as: boardAddress(board.label) });
-  if (r.code !== 0) throw unavailable(`launch receipt unavailable on ${session.machine}: install the matching machine capability (harness.v1.launches.get): ${(r.stderr || r.stdout).trim().slice(-300)}`);
+  if (r.code !== 0) throw unavailable(`launch receipt unavailable on ${session.machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
   if (r.stdout.trim() === 'null') return null;
   const receipt = lastJson(r.stdout);
   if (!receipt || receipt.key !== session.launch_key) throw unavailable(`invalid launch receipt for ${session.launch_key} on ${session.machine}`);
   return receipt;
 }
 
-function cancelUnissuedLaunch(board, session) {
-  const result = doorOn(session.machine, 'harness.v1.launches.cancel', {key:session.launch_key},
-    { timeout: 30_000, as: boardAddress(board.label) });
-  if (result.code !== 0) throw unavailable(`launch cancellation unavailable on ${session.machine}; retain ${session.launch_key}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
-  const receipt = lastJson(result.stdout);
-  if (!receipt || receipt.key !== session.launch_key) throw unavailable(`invalid cancellation receipt for ${session.launch_key}`);
-  return receipt;
-}
-
-function unissuedLaunch(receipt, session) {
-  return receipt?.key === session?.launch_key && receipt?.status === 'cancelled' && receipt?.cancelled === true &&
-    receipt?.outcome === 'not_issued' && receipt?.live === false && receipt?.pane === null;
-}
-
-/**
- * Retire a launch key its machine confirmed it never issued. Returns true when the run's launch is settled and closed,
- * 'released' when the key is retired but the run keeps a session adopted onto it, false when the run is not this key's.
- */
-function retireUnissuedLaunch(board, row, session, receipt, { entry = null, effects = [] } = {}) {
-  if (!unissuedLaunch(receipt, session)) return false;
-  const result = tx(board, db => {
-    const current = db.prepare('SELECT ended_at, metadata FROM task_runs WHERE id=?').get(row.id);
-    const saved = json(current?.metadata, {})?.supercode;
-    if (!saved || saved.launch_key !== session.launch_key) return { retired: false, effects: [] };
-    // A session adopted onto a run whose launch was still pending did not come from that launch (the machine never
-    // issued the key): the key is retired and the adopted session stays the run's, supervised and closed as its own.
-    if (saved.mode === 'adopt' && saved.address && saved.launch_pending) {
-      setRunSession(db, row.id, { launch_pending: false, launch_cancellation: receipt, launch_error: null, launch_key: null });
-      event(db, row.task_id, 'session_launch_cancelled', { key: session.launch_key, machine: session.machine, receipt, kept: saved.address }, row.id);
-      return { retired: 'released', effects: [] };
-    }
-    if (saved.pane || saved.address || saved.pid) return { retired: false, effects: [] };
-    if (!current.ended_at && (!entry || getTask(db, row.task_id)?.current_run_id !== row.id)) return { retired: false, effects: [] };
-    if (saved.close_confirmed_at) return { retired: true, effects: [] };
-    const collected = [];
-    const at = now();
-    setRunSession(db, row.id, { launch_pending: false, launch_cancellation: receipt, launch_error: 'machine confirmed launch was not issued',
-      close_requested: saved.close_requested ?? at, closed_at: at, close_confirmed_at: at, close_error: null,
-      forgotten: saved.mode === 'fresh' ? true : Boolean(saved.forgotten) });
-    event(db, row.task_id, 'session_launch_cancelled', { key: session.launch_key, machine: session.machine, receipt }, row.id);
-    if (!current.ended_at) {
-      const payload = { error: `launch ${session.launch_key} was not issued; its machine retired the key` };
-      const moved = monitorsRuns(entry) ? (surfaceIncident(db,board,entry,row.task_id,'spawn_failed',payload), {effects:[]}) : fire(db,board,entry,row.task_id,'spawn_failed',{roles:['platform'],payload});
-      collected.push(...moved.effects);
-    }
-    event(db, row.task_id, 'session_closed', { key: session.launch_key, machine: session.machine, reason: 'launch not issued', receipt }, row.id);
-    return { retired: true, effects: collected };
-  });
-  effects.push(...result.effects);
-  return result.retired;
-}
-
 function bindLaunch(board, row, session, pane, sid) {
   return tx(board, (db) => {
     const current = db.prepare('SELECT ended_at, metadata FROM task_runs WHERE id=?').get(row.id);
@@ -1331,12 +1300,10 @@ export function reconcileCallerLaunch(board, sid) {
   if (!candidates.length) return;
   const pane = process.env.SUPERCODE_TEAMS_PANE || observeFleet().sessions?.find((s) => s.address === `sc:${machine}:${harness}:${sid}`)?.pane;
   if (!pane) return;
+  // the caller's own pane (its environment, or this machine's reading) binds the run whose launch recorded that pane
   for (const row of candidates) {
     const s = json(row.metadata, {})?.supercode;
-    const receipt = launchReceipt(board, s);
-    if (receipt?.live && receipt.pane === pane) {
-      if (bindLaunch(board, row, s, pane, sid)) return;
-    }
+    if ((s.pane === pane || s.session_id === sid) && bindLaunch(board, row, s, pane, sid)) return;
   }
 }
 
@@ -1433,35 +1400,29 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
   const rows = view(board, (db) => db.prepare(`SELECT id, task_id, started_at, ended_at, metadata FROM task_runs
     WHERE json_extract(metadata, '$.supercode.launch_pending') = 1
     AND json_extract(metadata, '$.supercode.close_confirmed_at') IS NULL`).all());
+  // A keyed launch whose session is not bound yet is bound from this round's fleet reading: its pane, and the session
+  // the reading finds in it. Its machine's daemon reconciles the key itself (D137); no door is asked here. A launch with
+  // no pane waits for its launch window (supervise surfaces it then); a pane read absent on its online machine after
+  // the grace ended before its session was bound.
   for (const row of rows) {
     const s = json(row.metadata, {})?.supercode;
     try {
-      let receipt = launchReceipt(board, s);
-      if (!receipt && (row.ended_at || now() - Number(s.launched_at ?? row.started_at) >= settings.launchWindow)) receipt = cancelUnissuedLaunch(board, s);
-      if (unissuedLaunch(receipt, s)) {
-        if (!retireUnissuedLaunch(board, row, s, receipt, { entry, effects })) report.failed.push([row.task_id, 'negative launch receipt conflicts with a bound session; retaining ownership']);
-        continue;
-      }
-      if (receipt?.status === 'issued' || (receipt?.live === false && !receipt.status && !receipt.exit)) {
-        report.queued.push([row.task_id, `launch ${s.launch_key} is issued or uncertain; retaining ownership`]);
-        continue;
-      }
-      if (!receipt?.pane) { report.queued.push([row.task_id, s.launch_error ?? `awaiting launch receipt ${s.launch_key}`]); continue; }
-      const sid = s.session_id ?? fleet.sessions?.find((f) => f.pane === receipt.pane && String(f.address).startsWith(`sc:${s.machine}:${s.harness}:`))?.address.split(':')[3];
-      bindLaunch(board, row, s, receipt.pane, receipt.live ? sid : null);
-      if (receipt.live === false && !row.ended_at && now() - s.launched_at > settings.grace) {
-        // A recorded pane absent on its machine is evidence; a closed response stream was not.
-        if (!panePresent(s.machine, receipt.pane)) {
-          const moved = tx(board, (db) => {
-            if (getTask(db, row.task_id)?.current_run_id !== row.id) return null;
-            setRunSession(db, row.id, { launch_pending: false });
-            const payload = { error: `launch ${s.launch_key} ended before session binding` };
-            if (monitorsRuns(entry)) { surfaceIncident(db, board, entry, row.task_id, 'spawn_failed', payload); return { effects: [] }; }
-            return fire(db, board, entry, row.task_id, 'spawn_failed', { roles: ['platform'], payload });
-          });
-          if (moved) effects.push(...moved.effects);
-        }
-      } else if (!sid) report.queued.push([row.task_id, `pane ${receipt.pane} is live; awaiting ${s.harness} session identity`]);
+      // found by its pane (chosen before open) or by its session id (named before open, for Claude Code)
+      const found = fleet.sessions?.find((f) => f.machine === normalMachine(s.machine) && String(f.address).startsWith(`sc:${s.machine}:${s.harness}:`)
+        && ((s.pane && f.pane === s.pane) || (s.session_id && f.session_id === s.session_id)));
+      const sid = s.session_id ?? found?.address.split(':')[3];
+      if (found && sid) { bindLaunch(board, row, s, found.pane ?? s.pane, sid); continue; }
+      if (!row.ended_at && now() - Number(s.launched_at) > settings.grace && launchReading(fleet, s) === 'absent') {
+        const moved = tx(board, (db) => {
+          if (getTask(db, row.task_id)?.current_run_id !== row.id) return null;
+          // a fresh launch that never showed in a reading has no session to resume: its next run starts fresh
+          setRunSession(db, row.id, { launch_pending: false, ...(s.mode === 'fresh' ? { forgotten: true } : {}) });
+          const payload = { error: `launch ${s.launch_key} ended before session binding` };
+          if (monitorsRuns(entry)) { surfaceIncident(db, board, entry, row.task_id, 'spawn_failed', payload); return { effects: [] }; }
+          return fire(db, board, entry, row.task_id, 'spawn_failed', { roles: ['platform'], payload });
+        });
+        if (moved) effects.push(...moved.effects);
+      } else report.queued.push([row.task_id, `launch ${s.launch_key}${s.pane ? ` (pane ${s.pane})` : ''} awaits its ${s.harness} session in the fleet reading`]);
     } catch (error) { report.failed.push([row.task_id, `launch reconciliation retained: ${error.message}`]); }
   }
 }
@@ -1499,7 +1460,8 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   if (pending) throw unavailable(`slot ${slot} still owns pane ${pending.session.pane} from run ${pending.id}; closure must be confirmed before another session starts: ${pending.session.close_error ?? 'close pending'}`);
   let prev = view(board, (db) => lastSession(db, task.id, slot));
   if (prev?.session_id && !prev.forgotten && (prev.harness ?? 'claude-code') === harness && prev.machine === machine) {
-    const fresh = observeFleet();
+    // the round's own fleet reading: a launch never reads the fleet again
+    const fresh = fleet;
     if (!fresh.ok) throw unavailable(`cannot check for a manual continuation of ${prev.session_id}: ${fresh.error}`);
     const r = doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
     const listed = r.code === 0 ? json(r.stdout.trim(), null) : null;
@@ -1515,30 +1477,27 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     // a pane that could not be closed still holds the session: no second process is started on it
     if (prev?.close_requested && !prev.closed_at) throw unavailable(`the slot's session ${prev.session_id} asked to be closed and its pane ${prev.pane} could not be: ${report.undelivered.map((u) => u[2]).join('; ') || 'no reason given'}`);
   }
+  // The machine was checked before the card was claimed (launcherCheck: its board process guard and keyed launch door,
+  // from the round's fleet reading); the launch asks no door of it. Open's reply names the pane; a session named at
+  // launch (Claude Code's) is bound with it, one that names itself (Codex) is bound from a later round's fleet reading.
+  // The pane id is chosen from the launch key and recorded before open runs, so a launch whose answer is lost (a
+  // timeout, a closed stream) is still found by its pane in a later round's fleet reading, and by its session id.
   const openOwned = (key, sid, mode, args) => {
-    const description = doorOn(machine,'harness.v1.machine.describe',{});
-    const policy = description.code === 0 ? json(description.stdout,null)?.boardProcessPolicy : null;
-    if (policy?.version !== 1 || !policy.harnesses?.includes(harness)) throw unavailable(`machine ${machine} has no native board process guard for ${harness}; no unguarded session was launched`);
-    launchReceipt(board, { machine, launch_key: key }); // Prove the exact receipt door before starting a process.
+    const chosen = `p_${createHash('sha256').update(key).digest('hex').slice(0, 16)}`;
     tx(board, (db) => setRunSession(db, runId, { ...meta, surface: 'pane', machine, harness, slot,
-      session_id: sid, mode, launch_key: key, launch_pending: true, launched_at: now() }));
-    const result = sc(args, { timeout: 180_000, as: boardAddress(board.label) });
-    let facts = null, receiptError = null;
-    try { facts = launchReceipt(board, { machine, launch_key: key }); } catch (error) { receiptError = error.message; }
-    const pane = facts?.pane ?? lastJson(result.stdout)?.pane ?? null;
-    // The daemon's keyed receipt is authoritative even when the stream carrying open's reply closed.
-    if (pane) tx(board, (db) => {
+      session_id: sid, mode, launch_key: key, pane: chosen, launch_pending: true, launched_at: now() }));
+    const result = sc([...args.slice(0, args.indexOf('--key')), '--pane', chosen, ...args.slice(args.indexOf('--key'))], { timeout: 180_000, as: boardAddress(board.label) });
+    const pane = lastJson(result.stdout)?.pane ?? chosen;
+    if (pane !== chosen) tx(board, (db) => {
       const before = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runId)?.metadata, {})?.supercode ?? {};
       setRunSession(db, runId, { ...before, pane });
     });
-    const currentFleet = observeFleet();
-    const discovered = sid ?? currentFleet.sessions?.find((f) => f.pane === pane && String(f.address).startsWith(`sc:${machine}:${harness}:`))?.address.split(':')[3];
-    if (pane && discovered && facts?.live === true) {
-      return { surface: 'pane', session_id: discovered, machine, harness, pane, mode, launch_key: key,
+    if (pane && sid && result.code === 0) {
+      return { surface: 'pane', session_id: sid, machine, harness, pane, mode, launch_key: key,
         launch_pending: false, launch_error: null, launched_at: now() };
     }
-    const reason = facts?.live === false && pane ? `launch pane ${pane} ended` :
-      `launch ${key} is awaiting its machine receipt or session identity: ${receiptError ?? (result.stderr || result.stdout).trim().slice(-300)}`;
+    const reason = result.code === 0 ? `launch ${key} opened pane ${pane}; its ${harness} session is bound from the fleet reading` :
+      `launch ${key} (pane ${pane}) gave no answer; it is bound from the fleet reading if it opened: ${(result.stderr || result.stdout).trim().slice(-300)}`;
     tx(board, (db) => {
       setRunSession(db, runId, { launch_pending: true, launch_error: reason });
       event(db, task.id, 'session_launch_pending', { key, pane, reason }, runId);
@@ -2237,7 +2196,11 @@ async function notify(board, fleet, report, entry) {
       // and answers, each its own message, in full. A notice the board already recorded as taken by this address is never sent again.
       // only events that would be told count: a stale one or the recipient's own act never supersedes one that would be
       const sendable = (ev) => { const p = json(ev.payload, {}) ?? {}; return !(maxAge && now() - Number(ev.created_at) > maxAge) && !(p.by && p.by === sub.chat_id); };
-      const latest = new Map(events.filter((ev) => !['commented', 'answered'].includes(ev.kind) && sendable(ev)).map((ev) => [ev.kind, ev.id]));
+      // News is coalesced by its subject, not its kind alone: a later `assigned` says what an earlier one did, but each
+      // subtask added, dependency linked or unlinked is its own fact, keyed by the card it names; a comment or an
+      // answer is always its own message.
+      const subjectOf = (ev) => { const p = json(ev.payload, {}) ?? {}; return ['commented', 'answered'].includes(ev.kind) ? `${ev.kind}:${ev.id}` : `${ev.kind}:${p.subtask ?? p.parent ?? p.child ?? ''}`; };
+      const latest = new Map(events.filter((ev) => sendable(ev)).map((ev) => [subjectOf(ev), ev.id]));
       const sentBefore = board.db.prepare("SELECT 1 FROM task_events WHERE task_id = ? AND kind IN ('notice_delivered', 'notice_filed') AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') = ? LIMIT 1");
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
@@ -2246,7 +2209,7 @@ async function notify(board, fleet, report, entry) {
         if (sentBefore.get(sub.task_id, ev.id, sub.chat_id)) { cursor = ev.id; continue; }
         // nobody is told of their own act
         if (p.by && p.by === sub.chat_id) { cursor = ev.id; continue; }
-        if (latest.has(ev.kind) && latest.get(ev.kind) !== ev.id) { cursor = ev.id; (report.superseded_notices_passed ??= 0); report.superseded_notices_passed += 1; continue; }
+        if (latest.has(subjectOf(ev)) && latest.get(subjectOf(ev)) !== ev.id) { cursor = ev.id; (report.superseded_notices_passed ??= 0); report.superseded_notices_passed += 1; continue; }
         let text;
         if (ev.kind === 'commented') {
           if (p.author === sub.chat_id) { cursor = ev.id; continue; }
@@ -2305,13 +2268,14 @@ async function notify(board, fleet, report, entry) {
       // attempt it is abandoned (its terminal state, `notice_abandoned`, recorded once) and the cursor moves past it;
       // the subscription stays, so the notices after it are still told (dropping it lost them when the round
       // subscribed the session again from the card's newest event).
-      const failures = failed ? Number(sub.delivery_metadata?.failures ?? 0) + 1 : 0;
+      // failures are counted per notice: a failure of a later notice starts its own count
+      const failures = failed ? (Number(sub.delivery_metadata?.failing_event) === trying ? Number(sub.delivery_metadata?.failures ?? 0) : 0) + 1 : 0;
       if (failed && failures >= NOTICE_ATTEMPTS && trying) {
         event(db, sub.task_id, 'notice_abandoned', { source_event: trying, address: sub.chat_id, attempts: failures, error: failed });
         db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ?, delivery_metadata = ? ${where} AND last_event_id < ?`).run(trying, JSON.stringify({ ...sub.delivery_metadata, failures: 0, next_at: 0 }), ...identity, trying);
         return;
       }
-      if (failures !== Number(sub.delivery_metadata?.failures ?? 0)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures, next_at: failed ? now() + Math.min(1800, 30 * 2 ** (failures - 1)) : 0 }), ...identity);
+      if (failures !== Number(sub.delivery_metadata?.failures ?? 0) || (failed && Number(sub.delivery_metadata?.failing_event) !== trying)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures, failing_event: failed ? trying : null, next_at: failed ? now() + Math.min(1800, 30 * 2 ** (failures - 1)) : 0 }), ...identity);
       if (task?.status === 'archived' && cursor >= events.at(-1).id) db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity);
     });
   });
@@ -2721,7 +2685,7 @@ export async function deliver({ root, slugs = null }) {
  * `workflow dispatch`). An adoption request and a session close are claimed in a transaction (`newClaim`) before
  * anything is done for them outside the board; card starts, supervision, review requests, mailed verbs and manual
  * continuations rely on their per-card transactions. Two rounds on one board at once can still both act on:
- * deferred-launch retries (two panes), launch-receipt work (cancelUnissuedLaunch, bindLaunch), and board-only writes
+ * deferred-launch retries (two panes), launch binding (bindLaunch), and board-only writes
  * that do not re-check. A round runs no effect and delivers nothing: it records effects (`queueEffects`) and the
  * delivery pass (`deliver`) carries them out. Answers one report per board.
  */
@@ -2765,7 +2729,7 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       readMailbox(board, boardAddress(board.label), report); phase('mailbox');
       await refreshRelationAnswers(board); phase('answers');
       const effects = [];
-      completeAdoptions(board, fleet, settings, report, lanes); reconnectContinuedSessions(board, fleet, entry, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); closeRequested(board, report, { ttl: settings.ttl }); phase('supervise');
+      completeAdoptions(board, fleet, settings, report, lanes); reconnectContinuedSessions(board, fleet, entry, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); closeRequested(board, report, { ttl: settings.ttl, fleet }); phase('supervise');
       report.unsettled = [];
       report.promoted = recomputeReady(board, effects, report.unsettled);
       tx(board,db=>auditEndedRuns(db,board,entry));

package/board/engine.mjs

@@ -974,6 +974,11 @@ export function diagnose(db, task, { failureLimit = DEFAULT_FAILURE_LIMIT, stran
       ? { kind: 'effect_failed', severity: 'warning', title: `its ${kind} failed for good after ${row.attempts} attempts: ${row.last_error ?? 'no reason recorded'}`, data: { effect: row.id, kind, attempts: row.attempts }, actions: [] }
       : { kind: 'effect_stalled', severity: 'error', title: `its ${kind} has failed ${row.attempts} times and is still tried: ${row.last_error ?? 'no reason recorded'}`, data: { effect: row.id, kind, attempts: row.attempts }, actions: [] });
   }
+  // notices the board gave up on: each one, with the event it was about and who was not told
+  for (const row of all(db, "SELECT payload FROM task_events WHERE task_id = ? AND kind = 'notice_abandoned' ORDER BY id DESC LIMIT 20", task.id)) {
+    const p = json(row.payload, {}) ?? {};
+    out.push({ kind: 'notice_abandoned', severity: 'warning', title: `the notice of event ${p.source_event} to ${p.address} was abandoned after ${p.attempts} attempts: ${p.error ?? 'no reason recorded'}`, data: { event: p.source_event, address: p.address, attempts: p.attempts }, actions: [] });
+  }
   const order = ['critical', 'error', 'warning'];
   return out.sort((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity));
 }

package/board/machine-fleet.mjs

@@ -1,7 +1,8 @@
 // The fleet as each machine the board works on answers for itself: its panes (`harness.v1.panes.list`) and the harness
 // session beneath each live pane's process (`harness.v1.sessions.activity_under`). This is the reading the machine's
-// connector publishes to Teams, taken at its source. Teams' session feed is for viewers; dispatch never waits on it
-// (D137, D138).
+// connector publishes to Teams, taken at its source. Each machine's reading also says what a board launch needs of it
+// (`capabilities`: its board process guard's harnesses, and whether it has the keyed launch door). Teams' session feed
+// is for viewers; dispatch never waits on it (D137, D138).
 //
 // Every machine is read at once, each within DEADLINE_MS (bin/machine-fleet.mjs), so one hung machine or relay costs a
 // reading that long, not the sum of them. A machine that answered is `online`. A remote machine that did not is
@@ -20,10 +21,11 @@ export function readMachineFleet(machines, local) {
     encoding: 'utf8', timeout: DEADLINE_MS + 5_000, maxBuffer: 64 * 1024 * 1024 });
   let rows = null;
   try { rows = JSON.parse(String(reply.stdout).trim().split('\n').pop()); } catch { /* no reading */ }
-  const online = new Set(), unknown = new Set(), alive = new Set(), native = new Map(), sessions = [];
+  // `panes`: each answering machine's live pane ids, whether or not a session was read in them
+  const online = new Set(), unknown = new Set(), alive = new Set(), native = new Map(), sessions = [], capabilities = new Map(), panes = new Map();
   if (!Array.isArray(rows)) {
     const error = String(reply.stderr || reply.error?.message || 'no answer').trim().slice(-300);
-    return { ok: false, presenceKnown: false, online, unknown: new Set(names), alive, native, sessions, error: `the fleet reading did not answer: ${error}` };
+    return { ok: false, presenceKnown: false, online, unknown: new Set(names), alive, native, sessions, capabilities, panes, error: `the fleet reading did not answer: ${error}` };
   }
   let localError = null;
   for (const row of rows) {
@@ -33,7 +35,9 @@ export function readMachineFleet(machines, local) {
       continue;
     }
     online.add(row.machine);
+    capabilities.set(row.machine, row.capabilities ?? { guard: [], launches: false });
     const live = (row.panes ?? []).filter((pane) => !pane.dead && pane.pid);
+    panes.set(row.machine, new Set((row.panes ?? []).filter((pane) => !pane.dead).map((pane) => pane.pane)));
     for (const { pid, activity } of row.activities ?? []) {
       const pane = live.find((item) => item.pid === pid);
       if (!pane || !activity?.session_id || !activity.harness) continue;
@@ -45,5 +49,5 @@ export function readMachineFleet(machines, local) {
     }
   }
   const ok = online.has(local);
-  return { ok, presenceKnown: ok, online, unknown, alive, native, sessions, error: ok ? null : `machine ${local}'s door did not answer: ${localError ?? 'no row'}` };
+  return { ok, presenceKnown: ok, online, unknown, alive, native, sessions, capabilities, panes, error: ok ? null : `machine ${local}'s door did not answer: ${localError ?? 'no row'}` };
 }

package/board/workflow.mjs

@@ -374,9 +374,6 @@ function queueTransitionNotice(db, board, entry, task, from, name, payload, befo
   const afterState = beforeRun && json(one(db, 'SELECT metadata FROM task_runs WHERE id=?', beforeRun.id)?.metadata, {})?.supercode?.state;
   if (!beforeRun || (state(task, from) === state(after, to) && beforeState === afterState) || effects.some((e) => e.kind === 'session_notice' && e.runId === beforeRun.id)) return;
   const session = json(beforeRun.metadata, {})?.supercode;
-  const cancellation = session?.launch_cancellation;
-  if (cancellation?.key === session?.launch_key && cancellation?.status === 'cancelled' && cancellation?.cancelled === true &&
-      cancellation?.outcome === 'not_issued' && cancellation?.live === false && cancellation?.pane === null) return;
   const address = session?.address ?? (session?.session_id && session.machine ? `sc:${session.machine}:${session.harness ?? 'claude-code'}:${session.session_id}` : null);
   if (!address && !session?.launch_key && !session?.pane) return;
   // The session that made this change learns it from its own command's answer; a notice about

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.39",
+  "version": "0.5.41",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {