@volter/supercode-orchestrator 0.5.46 → 0.5.47

package/bin/runtime.mjs

@@ -674,20 +674,13 @@ async function main() {
     return;
   }
   const root = resolve(args.root ?? defaultRoot());
-  // `SUPERCODE_BOARD_DISPATCHER=serve`: whoever started this daemon also runs `workflow serve` on the home, the board's
-  // one dispatcher, so this daemon runs no dispatch round (board.mjs). It is this process's alone: the sessions it
-  // launches do not inherit it. Any other value is refused before this daemon takes its lease or a lock.
-  const boardDispatcher = process.env.SUPERCODE_BOARD_DISPATCHER || null;
-  delete process.env.SUPERCODE_BOARD_DISPATCHER;
-  if (boardDispatcher !== null && boardDispatcher !== 'serve') {
-    say('error', { root, message: `SUPERCODE_BOARD_DISPATCHER is \`${boardDispatcher}\`: the one value it takes is \`serve\` (a \`workflow serve\` beside this daemon dispatches the board); unset, the board workflow's dispatch.serve decides` });
-    process.exit(2);
-  }
   let crashed = false;
   let gatewayLock = null;
   if (!args.once) {
-    // Serialize lease replacement before loading state. An acquisition guard
-    // left by a crash fails closed; inspect it before removing it manually.
+    // One daemon per home: its lease (and the acquisition guard serializing a lease's replacement) keeps a second daemon
+    // from firing the home's cron jobs, holding its channel adapters and driving its bindings twice, and tells a restart
+    // that its predecessor crashed (§4.7). None of it guards the board, whose one dispatcher is `workflow serve`. An
+    // acquisition guard left by a crash fails closed; inspect it before removing it manually.
     // A service manager's restart starts this one while the last is still stopping (launchd's kickstart -k did, and
     // this one exited 'already serving'): a live predecessor gets a moment to let go before it counts as serving.
     for (let waited = 0; waited < LEASE_HANDOFF_MS; waited += 250) {
@@ -756,7 +749,6 @@ async function main() {
   // build's, not whatever `supercode` a PATH lookup happens to find.
   const client = new SupercodeHarnessClient(process.env.SUPERCODE_BIN ? { command: process.env.SUPERCODE_BIN } : {});
   const orchestrator = new Orchestrator({
-    boardDispatcher,
     executeJob: args.executorUrl ? httpJobExecutor({ url: args.executorUrl, tokenFile: args.executorTokenFile, root }) : null,
     state,
     vault,

package/board/cli.mjs

@@ -1479,31 +1479,8 @@ async function serve(root, args = {}) {
   let wakeReason = null;
   try {
     while (!stopped) {
-      // An installer owns this operational window, not a card pause. Finish the
-      // current tick, acknowledge the request, then leave every run untouched.
-      // A replacement serve sees the same request before its first tick.
-      // A request whose installer is gone (its pane closed, or it was killed before clearing it) is void.
-      const installation = join(root, 'installation-window.json');
-      const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
-      const request = existsSync(installation) ? readJson(installation) : null;
-      const installerAlive = (pid) => { try { process.kill(Number(pid), 0); return true; } catch (error) { return error.code === 'EPERM'; } };
-      if (request?.token && request.pid && !installerAlive(request.pid)) {
-        log(`installation window ${request.token} of ${request.owner} is void: its installer ${request.pid} is gone`);
-        for (const path of [installation, join(root, 'installation-window.ack.json')]) if (readJson(path)?.token === request.token) try { unlinkSync(path); } catch { /* gone */ }
-      } else if (request?.token) {
-        const acknowledgment = join(root, 'installation-window.ack.json');
-        const previous = readJson(acknowledgment);
-        if (previous?.token !== request.token || previous?.pid !== process.pid) {
-          const temporary = `${acknowledgment}.${process.pid}`;
-          writeFileSync(temporary, JSON.stringify({ token: request.token, pid: process.pid, at: Date.now() }));
-          renameSync(temporary, acknowledgment);
-          log(`installation window held by ${request.owner}; dispatch waits`);
-        }
-        await new Promise(resolve => setTimeout(resolve, 250));
-        continue;
-      }
-      // A serve never ticks on code older than the installed orchestrator, also right after an
-      // installation window: its keeper starts the new one, whose board store this one does not keep.
+      // A serve never ticks on code older than the installed orchestrator: after its round it stops, and its keeper
+      // starts the new one. Nothing waits for an installation; a second round, old or new, is harmless.
       const replaced = (() => { const now = installed(); return running && now && now !== running ? now : null; })();
       if (replaced) { log(`orchestrator ${replaced} is installed (this serve runs ${running}); stopping, for its keeper to start the new one`); break; }
       pausedSaid = Boolean(paused(root)) && pausedSaid;

package/board/dispatch.mjs

@@ -12,9 +12,10 @@
 // - `headless`: the profile's worker for one query on this machine (`bin/hermes-worker.mjs`, Hermes's worker
 //   argv and task environment), watched by its pid as Hermes watches its own.
 //
-// Every side effect follows a committed transition: a card is claimed before its session is launched, and a
-// subscriber's cursor moves only after its notice was delivered, so two dispatchers over one board never both
-// launch and a crash between the two steps is answered by the next tick.
+// `workflow serve` is the board's one dispatcher, and a second round beside it (another serve, a one-shot
+// `workflow dispatch`) is harmless: every act of a round is a compare-and-set claim, a transaction that re-reads what it
+// acts on and does nothing when another round already acted (see `tick`). Every side effect follows a committed claim, so
+// a crash between the two steps is answered by the next round.
 import { monitorsRuns, failedObservation, surfaceIncident, auditEndedRuns, originOf } from './incidents.mjs';
 import { readMachineFleet } from './machine-fleet.mjs';
 let fleetRoot = null;
@@ -309,12 +310,16 @@ function supervise(board, fleet, settings, report, entry, effects) {
     if (!session?.launch_key || !fleet.ok || sessionAlive(fleet, session) !== false) continue;
     // how a keyed launch ended, where its machine keeps that record: read when it can be, never waited on
     if (!fleet.capabilities?.get(normalMachine(session.machine))?.launches) continue;
-    try { const receipt = launchReceipt(board, session); if (receipt?.live === false && receipt.exit) exits.set(id, receipt.exit); }
+    try { const receipt = launchReceipt(board, session); if (receipt?.live === false && receipt.exit) exits.set(id, { ...receipt.exit, launch_key: session.launch_key }); }
     catch (error) { report.failed.push([id, `exit receipt unavailable; retaining liveness observation: ${error.message}`]); }
   }
   for (const { id } of rows) readBefore(fleet, currentRun(board.db, id)?.metadata?.supercode);
   for (const { id } of rows) {
+    // A transaction that meets another round's write runs again from its start: what it asks for is staged per attempt
+    // and kept only once it committed, so a second round never carries out a move that was rolled back.
+    let staged = [];
     txRead(board, (db) => {
+      staged = [];
       const task = getTask(db, id);
       if (!task || (entry.workflow.run ? !task.current_run_id : task.status !== 'running')) return;
       const runRow = currentRun(db, id);
@@ -334,7 +339,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
             return;
           }
           const r = fire(db, board, entry, id, name, { roles: ['platform'], payload });
-          effects.push(...r.effects);
+          staged.push(...r.effects);
           if (bucket) report[bucket].push(id);
           if (r.to !== r.from && entry.workflow.statuses[r.to]?.stored_as === 'blocked') report.auto_blocked.push(id);
         } catch (error) {
@@ -419,7 +424,8 @@ function supervise(board, fleet, settings, report, entry, effects) {
         return;
       }
       if (session?.session_id) {
-        if(exits.has(id)) {
+        // an exit read for this run's own launch, never one an earlier launch of the card left
+        if(exits.has(id)&&exits.get(id).launch_key===session.launch_key) {
           const exit=exits.get(id);
           // an interactive session that ended cleanly was closed (by a person, or by itself): the workflow says what
           // follows, and it is not a crash to restart
@@ -428,7 +434,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
             if (monitorsRuns(entry)) { observe('session_closed', {...ended,exit},'crashed'); return; }
             try {
               const r = fire(db, board, entry, id, 'session_closed', { roles: ['platform'], payload: ended });
-              effects.push(...r.effects); (report.closed_by_hand ??= []).push(id);
+              staged.push(...r.effects); (report.closed_by_hand ??= []).push(id);
               return;
             } catch (error) { if (!error.noTransition) { report.failed.push([id, `session_closed: ${String(error.message).slice(-200)}`]); return; } }
           }
@@ -462,6 +468,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
       // the claim's own expiry answers it, as Hermes's does
       if (task.claim_expires && Number(task.claim_expires) < t) observe('orphaned', { stale_lock: task.claim_lock, claim_expires: task.claim_expires, error: `stale_lock=${task.claim_lock}` }, 'reclaimed');
     });
+    effects.push(...staged);
   }
 }
 
@@ -660,6 +667,17 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
     try {
       checked = checkWorkspace(board, task);
       moved = tx(board, (db) => {
+        // The claim: another round (a second serve, a one-shot dispatch) may have started this card, or others that count
+        // against the same caps, since this round read the board. Its starts are counted, and this card starts only if it
+        // still waits where it did and still fits.
+        const now = getTask(db, task.id);
+        if (!now || now.current_run_id || now.archived || statusOf(db, now) !== scope.card.status) throw Object.assign(new Error('started or moved by another round'), { claimedElsewhere: true });
+        for (const row of db.prepare('SELECT t.id, t.assignee, t.model_override, c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id WHERE t.current_run_id IS NOT NULL').all()) {
+          const lane = lanes[row.assignee] ?? {}, status = statusOf(db, row);
+          caps.take({ card: row.id, board: board.slug, machine: normalMachine(row.machine ?? localMachine()), assignee: row.assignee ?? null, status, stored: status, model: row.model_override ?? lane.model ?? null, harness: lane.harness ?? null });
+        }
+        const refused = caps.admit(waitingEntries[i], scope, waitingEntries);
+        if (refused) throw Object.assign(new Error(refused.why), { claimedElsewhere: true });
         assertWorkspaceOwner(db, task, checked);
         if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.mainRoot, task.id);
         if (!task.assignee && plan.profile) {
@@ -670,7 +688,8 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
       });
     } catch (error) {
       const reason = error.refusal ?? String(error.message).slice(-300);
-      tx(board, (db) => noteGuard(db, task.id, reason));
+      // another round's start is that round's to say; this one writes nothing for it
+      if (!error.claimedElsewhere) tx(board, (db) => noteGuard(db, task.id, reason));
       report.queued.push([task.id, reason]);
       continue;
     }
@@ -927,7 +946,8 @@ export function closeRequested(board, report, { taskId = null, caller = null, tt
         // Retain every attempt's latest fact, but avoid an unbounded thread of identical failures.
         if (current.close_error !== error) event(db, row.task_id, 'session_close_failed', { session_id: session.session_id, pane: session.pane, error, retry: !final }, row.id);
         if (final) event(db, row.task_id, 'run_incident', { observation: 'close_failed', run: row.id, reason: `the board could not close ${addressOf(session)} and will not try again: ${error}`, session: session.session_id, machine: session.machine, pane: session.pane ?? null, evidence: { error } }, row.id);
-      } else {
+      } else if (!current.close_confirmed_at) {
+        // a close another closer already confirmed (a claim that expired under it) is said once, by that closer
         const { close_error: _error, ...rest } = current;
         setRunSession(db, row.id, { ...rest, close_error: null, closed_at: at, close_confirmed_at: at });
         const address = addressOf(session);
@@ -964,7 +984,9 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
   const running = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
   for (const { id } of running) { const session = currentRun(board.db, id)?.metadata?.supercode; readBefore(fleet, session); if (session?.session_id) updatedAt(session); }
   for (const { id } of running) {
+    let staged = [];
     txRead(board, (db) => {
+      staged = [];
       const task = getTask(db, id);
       const status = statusOf(db, task);
       if (!(entry.workflow.statuses[status]?.on?.session_idle || entry.workflow.on?.session_idle || entry.workflow.run?.on?.session_idle)) return;
@@ -1024,7 +1046,7 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
         // the ask names what the session may do, as its run's prompt did
         const said = doors(entry.workflow, status, session.role ?? runSpec(entry, status)?.role ?? 'implementer', id, where, session.surface !== 'headless' ? 'pane' : 'headless');
         const r = fire(db, board, entry, id, 'session_idle', { roles: ['platform'], payload: { ...reading, turns: reading.turns_before, worked }, extra: { where, doors: said } });
-        effects.push(...r.effects);
+        staged.push(...r.effects);
         const after = currentRun(db, id);
         const stored = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runRow.id)?.metadata, {})?.supercode;
         const observation = retain('dispatched', { turns_after: Number(stored?.goal_turns ?? 0), nudge_queued: r.effects.some(e => e.kind === 'send_to_actor'), run_ended: after?.id !== runRow.id });
@@ -1036,6 +1058,7 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
         report.failed.push([id, `session_idle: ${String(error.message).slice(-200)}`]);
       }
     });
+    effects.push(...staged);
   }
 }
 
@@ -1263,7 +1286,8 @@ function bindLaunch(board, row, session, pane, sid) {
   return tx(board, (db) => {
     const current = db.prepare('SELECT ended_at, metadata FROM task_runs WHERE id=?').get(row.id);
     const saved = json(current?.metadata, {})?.supercode;
-    if (!saved || saved.launch_key !== session.launch_key || (saved.session_id && sid && saved.session_id !== sid)) return false;
+    // a launch another round already bound, or whose session was closed, is not bound again
+    if (!saved || saved.launch_key !== session.launch_key || !saved.launch_pending || saved.close_confirmed_at || (saved.session_id && sid && saved.session_id !== sid)) return false;
     const address = sid ? `sc:${session.machine}:${session.harness}:${sid}` : null;
     setRunSession(db, row.id, { ...saved, pane, session_id: sid ?? saved.session_id,
       ...(address ? { address, launch_pending: false, launch_error: null, seen_at: now() } : {}) });
@@ -1364,14 +1388,20 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
   // clock moves with the wait instead of running out (every resumed card failed so in the 22:17Z event-stream outage).
   for(const {id,run_id,launched_at} of deferred) {
     if (now() - launched_at >= settings.launchWindow) continue;
-    if (!fleet.ok) { tx(board,db=>setRunSession(db,run_id,{launched_at:now()})); report.queued.push([id,`launch waits for the fleet: ${fleet.error}`]); continue; }
+    // the run's launch is claimed before anything is done for it: another round's claim, or its launch, skips it here
+    const stillDeferred=db=>{const run=db.prepare('SELECT ended_at,metadata FROM task_runs WHERE id=?').get(run_id);return Boolean(run&&!run.ended_at&&getTask(db,id)?.current_run_id===run_id&&json(run.metadata,{})?.supercode?.launch_deferred);};
+    if (!fleet.ok) { tx(board,db=>{if(stillDeferred(db))setRunSession(db,run_id,{launched_at:now()});}); report.queued.push([id,`launch waits for the fleet: ${fleet.error}`]); continue; }
     try {
       const task=getTaskNow(board,id),status=view(board,db=>statusOf(db,task)),spec=runSpec(entry,status,task);
       const profile=spec&&view(board,db=>evaluate(entry.workflow.roles?.[spec.role]??'card.assignee',scopeOf(db,board,task,{params:entry.params})));
       const lane=lanes?.[profile];if(!lane){report.queued.push([id,'launch waits for its configured lane']);continue;}
       const why=launcherCheck(board.db,task,lane,fleet);if(why){report.queued.push([id,why]);continue;}
+      const claimed=tx(board,db=>{if(!stillDeferred(db))return false;setRunSession(db,run_id,{launch_deferred:false});return true;});
+      if(!claimed){report.queued.push([id,'its launch was taken by another round']);continue;}
       const session=launchRun(board,entry,id,lane,fleet,settings);
       if(session)report.started.push([id,session.address??session.session_id,session.mode]);
+      // nothing to launch now (its status runs nothing yet): the run waits deferred, as before the claim
+      else tx(board,db=>{const run=db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(run_id);const saved=json(run?.metadata,{})?.supercode??{};if(!saved.launch_key&&!saved.pid)setRunSession(db,run_id,{launch_deferred:true});});
     }catch(error){
       if(error.launchPending){report.queued.push([id,error.message]);continue;}
       const moved=tx(board,db=>monitorsRuns(entry)?(surfaceIncident(db,board,entry,id,'spawn_failed',{error:error.message,origin:originOf(error)}),{effects:[]}):fire(db,board,entry,id,'spawn_failed',{roles:['platform'],payload:{error:error.message}}));effects.push(...moved.effects);
@@ -1396,6 +1426,9 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
       if (!row.ended_at && now() - Number(s.launched_at) > settings.grace && launchReading(fleet, s) === 'absent') {
         const moved = tx(board, (db) => {
           if (getTask(db, row.task_id)?.current_run_id !== row.id) return null;
+          // another round may have bound this launch since the reading: only a launch still pending fails here
+          const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(row.id)?.metadata, {})?.supercode;
+          if (!current?.launch_pending || current.launch_key !== s.launch_key || current.address) return null;
           // a fresh launch that never showed in a reading has no session to resume: its next run starts fresh
           setRunSession(db, row.id, { launch_pending: false, ...(s.mode === 'fresh' ? { forgotten: true } : {}) });
           const payload = { error: `launch ${s.launch_key} ended before session binding` };
@@ -1567,11 +1600,14 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   Object.assign(session, meta);
   const kind = { adopt: 'session_adopted', resume: 'session_resumed', fresh: replaced ? 'session_replaced' : 'session_started' }[session.mode];
   const recorded = tx(board, (db) => {
-    const row = db.prepare('SELECT ended_at FROM task_runs WHERE id = ?').get(runId);
+    const row = db.prepare('SELECT ended_at, metadata FROM task_runs WHERE id = ?').get(runId);
     if (row?.ended_at || getTask(db, task.id)?.current_run_id !== runId) {
       requestSessionClose(db, task.id, { runId });
       return false;
     }
+    // this session recorded on the run already (by a binding that got here first) is said once
+    const saved = json(row?.metadata, {})?.supercode;
+    if (saved?.address === session.address && !saved.launch_pending) return true;
     setRunSession(db, runId, session);
     event(db, task.id, kind, { session_id: session.session_id, machine, pane: session.pane, address: session.address, mode: session.mode, ...(replaced ? { replaced } : {}) }, runId);
     // the working session hears updates to its card; the slot's previous session no longer does (a reviewer starting
@@ -2661,14 +2697,21 @@ export async function deliver({ root, slugs = null }) {
 
 /**
  * One tick over every board of the home at `root`. `lanes` from `lanesOf`, `settings` from `boardSettings`.
- * `only` limits starting to one card (a create that answers whether its card started). Each board is ticked under its
- * version-checked card claims; no dispatcher file lock. Two rounds may run at once (the dispatcher's and a one-shot
- * `workflow dispatch`). An adoption request and a session close are claimed in a transaction (`newClaim`) before
- * anything is done for them outside the board; card starts, supervision, review requests, mailed verbs and manual
- * continuations rely on their per-card transactions. Two rounds on one board at once can still both act on:
- * deferred-launch retries (two panes), launch binding (bindLaunch), and board-only writes
- * that do not re-check. A round runs no effect and delivers nothing: it records effects (`queueEffects`) and the
- * delivery pass (`deliver`) carries them out. Answers one report per board.
+ * `only` limits starting to one card (a create that answers whether its card started). No dispatcher file lock: two
+ * rounds may run at once, and every act is a claim taken in a transaction that re-reads its basis (a deferred `BEGIN`
+ * that runs again from its start when it meets another round's write):
+ * - a card start: the card still waits where the round read it, with no current run, and still fits the caps once the
+ *   runs other rounds started on this board are counted (startCards);
+ * - a deferred launch: the run is still deferred, current and unended (reconcileLaunches), so one round launches it;
+ * - a launch binding: the run's launch is still pending and its session not closed (bindLaunch); a launch's failure at
+ *   the end of its grace: still pending and unbound; a launched session is recorded once (launchPane);
+ * - supervision and idle observation: each card re-read in its transaction, the effects a move asks for kept only once
+ *   that move committed (a retried attempt's are dropped), an exit receipt applied only to the launch it was read for;
+ * - an adoption, a session close and its confirmation, a manual continuation: claimed (`newClaim`) or re-read.
+ * What two rounds may still both do is read-only or in-memory: a door read inside a retried transaction (an idle
+ * session's screen), a report line. A cap across boards counts other rounds' starts on this board only. A round runs no
+ * effect and delivers nothing: it records effects (`queueEffects`) and the delivery pass (`deliver`) carries them out.
+ * Answers one report per board.
  */
 export async function tick({ root, lanes, settings, only = null, slugs = null, dispatch = true, params = {}, deploymentReceipt = false }) {
   fleetRoot = root;

package/board/wake.mjs

@@ -53,7 +53,7 @@ export function watchBoard({ root, binary, env, log = () => {} }) {
       try { const receipt = JSON.parse(readFileSync(join(root, name), 'utf8')); wake('board-write', receipt.at); } catch { wake('board-write'); }
       return false;
     });
-    for (const name of ['workflow.yaml', 'config.yaml', 'installation-window.json', 'ESTOP']) file(join(root, name), name);
+    for (const name of ['workflow.yaml', 'config.yaml', 'ESTOP']) file(join(root, name), name);
     file(fileURLToPath(new URL('../package.json', import.meta.url)), 'installation');
     const boards = join(root, 'kanban', 'boards');
     directory(join(root, 'kanban'), 'board-registry', name => ['boards', 'ztrack.json', 'current'].includes(name));

package/loop.mjs

@@ -22,7 +22,6 @@ import { mountOrchestratorMcp } from './mcp/mount.mjs';
 import { performRemoveProfileDir } from './operator.mjs';
 import { harnessHomes } from './mcp/verbs.mjs';
 import { checkMonitor, runJobScript } from './gates.mjs';
-import { startBoard } from './board.mjs';
 import { SenderIdentityRecord } from '@volter/teams/sender-identity';
 import { agentScope,localProfileAgent,localAgentRecord,localAgentSessions,localForkAgent,handOffAgents,localReaderContext,agentRunForKey,agentPreamble,agentEnvironment,recordAgentRun,recordNativeAgentSession,agentRunForSession } from './agents.mjs';
 import { materializeAgentHome } from './agent-home.mjs';
@@ -54,10 +53,8 @@ export class Orchestrator {
    * @param {(profile, worker, env) => object|undefined} [o.launchFor]  launch override per worker (tests)
    * @param {(level, message) => void} [o.log]
    */
-  constructor({ state, vault = new Map(), client, adapters = {}, clock = null, launchFor = null, executeJob = null, boardDispatcher = null, log = () => {} }) {
+  constructor({ state, vault = new Map(), client, adapters = {}, clock = null, launchFor = null, executeJob = null, log = () => {} }) {
     this.state = state;
-    // who dispatches the home's board: 'serve' when a `workflow serve` beside this daemon does (board.mjs)
-    this.boardDispatcher = boardDispatcher;
     this.executeJob = executeJob;
     this.hostedTasks = new Set();
     this.identityRecord = new SenderIdentityRecord();
@@ -96,15 +93,8 @@ export class Orchestrator {
     // the queue already logs a failed event; a voided dispatch must not also
     // reject unhandled, which Node treats as fatal and which stopped the daemon
     if (this.autoTick) { this.timer = setInterval(() => { this.tick().catch(() => undefined); }, TICK_MS); this.timer.unref?.(); }
-    // the home's board, dispatched as a Hermes gateway dispatches it (docs/plans/hermes-compat.md row 14)
-    if (this.autoTick) this.board = await startBoard({
-      root: this.state.root, orchestration: this.state, log: this.log, adapters: this.adapters, dispatcher: this.boardDispatcher,
-      // a board notice as a turn in the subscribed chat's own session (Hermes's wake), sent as the subscriber
-      wake: (sub, text) => this.dispatchLogged(events.inbound({
-        profile: sub.notifier_profile || 'default', key: { platform: sub.platform, kind: sub.chat_type || 'dm', chat_id: sub.chat_id, ...(sub.thread_id ? { thread_id: sub.thread_id } : {}) },
-        sender: sub.user_id || 'kanban-notifier', sender_name: 'board', text, at: this.clock(),
-      })),
-    });
+    // The home's board is dispatched by `supercode workflow serve`, its one dispatcher; this daemon runs no round. A board
+    // subscription naming a chat platform is told by the agent mailbox (D140, supercode#975), never from here.
   }
 
   /**
@@ -228,7 +218,6 @@ export class Orchestrator {
 
   async stop() {
     if (this.timer) { clearInterval(this.timer); this.timer = null; }
-    this.board?.stop(); this.board = null;
     // Before any runtime closes: each binding records the runtime to resume (§4.7), while adapters can still deliver.
     await this.dispatch(events.stopping(this.clock())).catch((error) => this.log('error', `stopping: ${error.message}`));
     for (const timer of this.adapterRetries?.values() ?? []) clearTimeout(timer);

package/ontology.d.ts

@@ -141,6 +141,72 @@ export type BudgetPeriod =
   /** A calendar month. */
   | 'month';
 
+/**
+ * A cap on what the dispatcher starts, in the board's one capacity language (docs/adr/0009-board-capacity.md):
+ * what it counts, in which scope, among which cards and sessions, at most how many. Every cap applies; a card starts
+ * only when each cap that matches it has room.
+ */
+export interface Cap {
+  /** What the cap is called where a card waits on it and in the capacity view. */
+  name: string;
+  /** Where one count is kept: one for the whole home, or one per board, machine or profile. */
+  scope: CapScope;
+  /** What is counted. */
+  counts: CapCount;
+  /** Only what matches counts, and only a card that matches is held (every key that is given must match). */
+  where?: CapFilter;
+  /** What matches this is neither counted nor held, whatever `where` says (a standing service that holds no slot). */
+  unless?: CapFilter;
+  /** The most there may be in each count; a max that evaluates to nothing caps nothing. */
+  max: Expr;
+  /** Slots of each count held back for the cards this matches while any waits (Hermes's review reservation). */
+  reserve?: Reserve | null;
+}
+
+/** What a cap counts. */
+export type CapCount =
+  /** Cards with a live run. */
+  | 'runs'
+  /** Cards, each once whatever its runs and sessions (a cap's `where` names the statuses that hold a slot). */
+  | 'cards'
+  /** Live sessions the home's cards hold, in every slot (implementer and reviewer), idle or working. */
+  | 'sessions'
+  /** Those of the sessions that are in a turn now. */
+  | 'turns'
+  /** Cards started in this tick. */
+  | 'starts';
+
+/** Which cards and sessions a cap is about: each key given narrows it; a key's names are alternatives. */
+export interface CapFilter {
+  /** The card itself, by id. */
+  card?: Names;
+  /** The model a session runs (the card's model, else its profile's). */
+  model?: Names;
+  /** The harness a session runs (`claude-code`, `codex`, …). */
+  harness?: Names;
+  /** The card's assignee (its profile). */
+  assignee?: Names;
+  /** The card's status (for a card being started, the status its start moves it to). */
+  status?: Names;
+  /** The status the board stores for the card (`blocked` for a paused card or one blocked on a message). */
+  stored?: Names;
+  /** The machine the card names. */
+  machine?: Names;
+  /** The card's board. */
+  board?: Names;
+}
+
+/** Where a cap keeps one count. */
+export type CapScope =
+  /** One count across every board of the home and every machine its cards run on. */
+  | 'global'
+  /** One count per board. */
+  | 'board'
+  /** One count per machine a card names. */
+  | 'machine'
+  /** One count per profile (the lane a card's run is started in). */
+  | 'profile';
+
 /** One platform's configuration. */
 export interface ChannelConfig {
   /** The platform name (`telegram`, `slack`, `api_server`, …). */
@@ -215,8 +281,6 @@ export interface Delayed {
 
 /** The dispatcher: when it runs, what it may start, in what order, under which caps. */
 export interface Dispatch {
-  /** Whether the served home dispatches its boards (an expression; Hermes's `dispatch_in_gateway`). */
-  serve?: Expr | null;
   /** Seconds between ticks. */
   tick: Expr;
   /** The event the dispatcher sends a card it starts (to cards whose status has a transition for it). */
@@ -225,8 +289,8 @@ export interface Dispatch {
   eligible?: Expr | null;
   /** The order it starts them in: sort keys, `-` before one for descending. */
   order?: Expr[];
-  /** The caps. */
-  limits?: Limit[];
+  /** The caps, in the capacity language. */
+  capacity?: Cap[];
 }
 
 /** Why a binding ended (`docs/ORCHESTRATOR-IR.md` §2.5). */
@@ -402,6 +466,11 @@ export interface Job {
    * `isolated` (a new one) or `session:<id>` (that one). Absent: the source's own default.
    */
   session_target?: string | null;
+  /**
+   * The machine whose session runs each fire (supercode's: Hermes runs every fire on its own host). Absent, a
+   * fire runs where the orchestrator does.
+   */
+  machine?: string | null;
   /** Remaining-runs counter for `once` jobs. */
   repeat?: Repeat | null;
   /** Whether it fires at all. */
@@ -430,19 +499,8 @@ export interface JobOrigin {
   thread_id?: string | null;
 }
 
-/** A cap on what the dispatcher starts: cards counted per group, at most `max` in each. */
-export interface Limit {
-  /** What the cap is about, for its message. */
-  description?: string | null;
-  /** The group a card falls in (GitHub's `concurrency.group`): `'home'`, `card.board`, `card.assignee`, … */
-  group: Expr;
-  /** Which cards count against it. */
-  counts: Expr;
-  /** The cap; a cap that evaluates to nothing caps nothing. */
-  max: Expr;
-  /** Slots held back for the cards this matches while any waits (Hermes's review reservation). */
-  reserve?: Reserve | null;
-}
+/** Names written as one name or a list of them. */
+export type Names = string[];
 
 /** One delivery obligation. */
 export interface Obligation {
@@ -650,10 +708,10 @@ export interface Repeat {
   completed?: number;
 }
 
-/** Slots of a limit held for some cards. */
+/** Slots of a cap held for some cards. */
 export interface Reserve {
   /** The cards the slots are held for. */
-  for: Expr;
+  for: CapFilter;
   /** How many. */
   slots: Expr;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.46",
+  "version": "0.5.47",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {

package/board.mjs

@@ -1,125 +0,0 @@
-// The home's board, dispatched while the orchestrator serves the home (docs/architecture/orchestrator.md §2.9,
-// docs/plans/hermes-compat.md row 14). The board and its dispatcher are supercode's own (`board/`): Hermes Kanban's
-// format and lifecycle, each profile's lane decided by its `worker` in the IR. Where a Hermes gateway would run
-// its dispatcher, the daemon runs this one the same way: when the board's workflow says so (its `dispatch.serve`),
-// taking no file locks, waking on events with `dispatch.tick` as a safety sweep.
-// One dispatcher per board holds by construction, not by a lock: whoever starts the daemon beside a
-// `supercode workflow serve` on the same home (an Open Autonomy install's start) says so (`dispatcher: 'serve'`, from
-// SUPERCODE_BOARD_DISPATCHER), and the daemon then runs no round and no board event relay of its own. Chat-platform
-// subscriptions are delivered here whoever dispatches: the daemon hosts the channel adapters and a serve hosts none.
-// Each tick runs as
-// `workflow dispatch` in a child process: a tick waits on supercode (the fleet, launches, mail), and the daemon's
-// own loop never does.
-import { spawn } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { summary } from './board/cli.mjs';
-import { commandEnv, notifyChats, startDelivery, supercodeBin } from './board/dispatch.mjs';
-import { watchBoard } from './board/wake.mjs';
-import { runtimeDoor } from './board/runtime-door.mjs';
-import { workflowEntry } from './board/workflow.mjs';
-import { evaluate, holds } from './board/expr.mjs';
-
-const ENTRY = fileURLToPath(new URL('./bin/orchestrator.mjs', import.meta.url));
-
-function dispatchOnce(root) {
-  return new Promise((done) => {
-    const child = spawn(process.execPath, [ENTRY, 'workflow', 'dispatch', '--root', root, '--json'], { stdio: ['ignore', 'pipe', 'pipe'], env: process.env });
-    let out = '';
-    let err = '';
-    child.stdout.setEncoding('utf8').on('data', (c) => { out += c; });
-    child.stderr.setEncoding('utf8').on('data', (c) => { err = (err + c).slice(-2000); });
-    child.on('error', (error) => done({ error: error.message }));
-    child.on('close', () => {
-      // `workflow dispatch --json` prints its reports as one indented JSON document: the whole of stdout is the answer
-      // (its last line alone is a closing bracket, and every tick read as failed, its chat notices never sent).
-      try { done({ reports: JSON.parse(out) }); } catch { done({ error: (err || out).trim().slice(-500) || 'no answer' }); }
-    });
-  });
-}
-
-/**
- * The chat-platform notices alone, for a daemon that does not dispatch the board: each sweep sends what the board's
- * subscriptions have not yet been told through this daemon's channel adapters. Null when there is nothing it could send.
- */
-function startChatNotices({ root, entry, seconds, log, adapters, wake }) {
-  if (!Object.keys(entry.workflow.notify?.chat ?? {}).length) return null;
-  if (!Object.keys(adapters).length) { log('warn', 'board: the board workflow tells chats (notify.chat) and this daemon hosts no channel adapter to tell them'); return null; }
-  let running = false;
-  const sweep = async () => {
-    if (running) return;
-    running = true;
-    try { await notifyChats(root, adapters, log, wake); } catch (error) { log('warn', `board: chat notices failed: ${error.message}`); } finally { running = false; }
-  };
-  const timer = setInterval(() => { void sweep(); }, seconds * 1000);
-  timer.unref?.();
-  void sweep();
-  log('info', `board: chat notices every ${seconds}s through this daemon's channel adapters`);
-  return { tick() { void sweep(); }, stop() { clearInterval(timer); } };
-}
-
-/**
- * Start the board's dispatcher for the home at `root`; answers `{ tick, stop }`, or null when it neither dispatches
- * nor has chat notices to send. `dispatcher: 'serve'` says a `supercode workflow serve` dispatches this home's board:
- * the daemon then runs no round of its own, only the chat notices its adapters deliver.
- */
-export async function startBoard({ root, orchestration = null, log = () => {}, adapters = {}, wake = null, dispatcher = null }) {
-  // whether and how often the served home dispatches is the board workflow's (`dispatch.serve`, `dispatch.tick`)
-  let entry;
-  try { entry = workflowEntry(orchestration); } catch (error) { log('warn', `board: not dispatched: ${error.message}`); return null; }
-  const seconds = Math.max(Number(evaluate(entry.workflow.dispatch.tick, { params: entry.params })) || 60, 1);
-  if (dispatcher === 'serve') { log('info', 'board: not dispatched here (its dispatcher is the `workflow serve` beside this daemon)'); return startChatNotices({ root, entry, seconds, log, adapters, wake }); }
-  if (!holds(entry.workflow.dispatch.serve ?? null, { params: entry.params })) { log('info', 'board: not dispatched (the board workflow\'s dispatch.serve)'); return startChatNotices({ root, entry, seconds, log, adapters, wake }); }
-  let running = false;
-  let stopped = false;
-  const said = new Set();
-  const stuck = {};
-  const warned = {};
-  const tick = async () => {
-    if (running || stopped) return;
-    running = true;
-    try {
-      const { reports, error } = await dispatchOnce(root);
-      if (error) { log('warn', `board: tick failed: ${error}`); return; }
-      // what the round recorded is delivered by a pass of its own, which this loop never waits for
-      startDelivery(root, { log: (level, line) => log(level, `board: ${line}`) });
-      // chat-platform subscriptions are delivered here, through the daemon's own channel adapters
-      try { await notifyChats(root, adapters, log, wake); } catch (error) { log('warn', `board: chat notices failed: ${error.message}`); }
-      for (const r of reports) {
-        const line = summary(r);
-        stuck[r.board] = r.ready_waiting && !r.started?.length && !r.paused ? (stuck[r.board] || Date.now()) : 0;
-        if (stuck[r.board] && Date.now() - stuck[r.board] >= seconds * 6000 && Date.now() - (warned[r.board] ?? 0) >= 300_000) { log('warn', `board ${r.board} stuck: ${r.ready_waiting} ready card(s) and nothing started for ${Math.floor((Date.now() - stuck[r.board]) / 1000)}s`); warned[r.board] = Date.now(); }
-        if (r.paused && !said.has(`paused:${r.board}`)) { said.add(`paused:${r.board}`); log('info', `board ${r.board}: new starts paused by ${r.paused}`); }
-        if (!r.paused) said.delete(`paused:${r.board}`);
-        if (!line.endsWith('nothing to do')) log(r.error ? 'warn' : 'info', line);
-        for (const [task, why] of r.failed ?? []) log('warn', `board ${r.board}: ${task} did not start: ${why}`);
-        for (const [task, to, why, what] of r.undelivered ?? []) log('warn', what === 'close' ? `board ${r.board}: the close of ${to} for ${task} waits: ${why}` : `board ${r.board}: a notice for ${task} to ${to} was not delivered: ${why}`);
-        const unserved = r.chat_subscriptions && !Object.keys(adapters).length;
-        if (unserved && !said.has(`subs:${r.board}`)) { said.add(`subs:${r.board}`); log('warn', `board ${r.board}: ${r.chat_subscriptions} subscription(s) name a chat platform and this daemon hosts no channel adapter to tell them`); }
-        if (r.nonspawnable?.length && !said.has(`lane:${r.board}`)) { said.add(`lane:${r.board}`); log('warn', `board ${r.board}: ${r.nonspawnable.length} card(s) name an assignee that is no profile of this home, and wait`); }
-      }
-    } finally {
-      running = false;
-    }
-  };
-  const events = watchBoard({ root, binary: supercodeBin(), env: commandEnv(), log: message => log('warn', message) });
-  // The board's events are published by this machine's connector (D137, D138 step 4): the home is named to it once.
-  { const named = runtimeDoor(null, 'harness.v1.boards.register', { root }, { timeout: 30_000 });
-    log(named.code === 0 ? 'info' : 'warn', named.code === 0 ? 'board: its events are published by the machine\'s connector' : `board: events not published; the machine daemon did not take this home: ${(named.stderr || named.stdout).trim().split('\n').at(-1)}`); }
-  void (async () => {
-    let wakeReason = null;
-    while (!stopped) {
-      const began = Date.now();
-      if (wakeReason) log('info', `board: dispatch wake ${wakeReason.sources.join(', ')}; event age ${began - wakeReason.at}ms`);
-      await tick();
-      events.refresh();
-      wakeReason = await events.wait(Math.max(0, seconds * 1000 - (Date.now() - began)));
-      const remaining = 1000 - (Date.now() - began);
-      if (remaining > 0 && !stopped) await new Promise(done => setTimeout(done, remaining));
-    }
-  })().catch(error => log('warn', `board: dispatch loop failed: ${error.message}`));
-  log('info', `board: dispatching on events, safety sweep every ${seconds}s, each card as its profile's worker says`);
-  return {
-    tick() { events.wake('requested'); },
-    stop() { stopped = true; events.close(); },
-  };
-}