@volter/supercode-orchestrator 0.5.47 → 0.5.49

package/README.md

@@ -525,10 +525,12 @@ failed/timeout fires without replaying them; a restart advances a stale claim
 once. `callOperator` addresses the live socket, with no cold-write fallback.
 `Orchestrator({executeJob})` is the corresponding in-process API for embedders.
 
-The daemon acquires its exclusive lease before loading state. A crash during the
-short acquisition critical section leaves `orchestrator.acquire`; subsequent
-starts fail closed until an operator inspects and removes that guard. Normal
-stops remove only their own lease. Native `jobs.resume` computes the first fire
+The daemon serves a home only while it holds the home's claim, Hermes's
+`gateway.lock` (an flock the kernel releases when its holder dies). A second
+daemon on the home waits for the claim and serves the home as soon as the first
+is gone, however it ended; nothing fails closed or waits for a person. The
+serving daemon records itself in `orchestrator.lock` for `supercode orchestrator
+status` and the operator verbs; a normal stop removes only its own record. Native `jobs.resume` computes the first fire
 for a job that was created paused with no next-run timestamp.
 
 ## Hosted daemon lifecycle

package/bin/runtime.mjs

@@ -53,7 +53,7 @@
 // Everything it prints is one JSON object per line on stdout.
 
 import { SenderIdentityRecord } from '@volter/teams/sender-identity';
-import { existsSync, mkdirSync, rmdirSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -75,7 +75,8 @@ import { httpJobExecutor } from '../hosted.mjs';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 
 /** How long a starting daemon waits for a stopping predecessor to release the home's lease. */
-const LEASE_HANDOFF_MS = 20_000;
+/** How often a daemon waiting for the home's claim asks for it again. */
+const CLAIM_RETRY_MS = 2_000;
 
 /// Adapter selector -> constructor. A `platforms:` block picks its adapter by
 /// `extra.adapter` when it has one and by the block's own name otherwise, so
@@ -388,16 +389,16 @@ function profileReport(name, profile) {
   };
 }
 
-// ---------------------------------------------------------------- the lease
+// ---------------------------------------------------------------- who serves the home
 
-/** The lease file, shared with `supercode orchestrator status|stop` (Rust `Lease`). */
+/** The record of the daemon serving the home, shared with `supercode orchestrator status|stop` (Rust `Lease`). */
 const readLock = readLease;
 
 function writeLock(root, lease) {
   writeFileSync(join(root, LOCK_FILE), `${JSON.stringify(lease, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
 }
 
-/** Only ever removes a lease this process holds. */
+/** Only ever removes the record this process wrote. */
 function clearLock(root) {
   const held = readLock(root);
   if (held && held.pid !== process.pid) return;
@@ -677,35 +678,26 @@ async function main() {
   let crashed = false;
   let gatewayLock = null;
   if (!args.once) {
-    // One daemon per home: its lease (and the acquisition guard serializing a lease's replacement) keeps a second daemon
-    // from firing the home's cron jobs, holding its channel adapters and driving its bindings twice, and tells a restart
-    // that its predecessor crashed (§4.7). None of it guards the board, whose one dispatcher is `workflow serve`. An
-    // acquisition guard left by a crash fails closed; inspect it before removing it manually.
-    // A service manager's restart starts this one while the last is still stopping (launchd's kickstart -k did, and
-    // this one exited 'already serving'): a live predecessor gets a moment to let go before it counts as serving.
-    for (let waited = 0; waited < LEASE_HANDOFF_MS; waited += 250) {
-      const previous = readLock(root);
-      if (!previous || previous.pid === process.pid || !leaseIsLive(previous)) break;
-      await new Promise((resolve) => setTimeout(resolve, 250));
-    }
-    const guard = join(root, 'orchestrator.acquire');
-    mkdirSync(guard);
-    try {
-      const previous = readLock(root);
-      if (previous && leaseIsLive(previous)) {
-        say('error', { root, message: `already serving ${root} (pid ${previous.pid})` });
-        throw new Error(`already serving ${root}`);
+    // One runtime serves a home: whoever holds its claim, Hermes's own gateway lock (`<home>/gateway.lock`, an flock the
+    // kernel releases the moment its holder dies, however it died). So its cron jobs fire once, its channel adapters
+    // are held once and its bindings are driven once, and a Hermes gateway on the home refuses while this daemon
+    // serves it. A second daemon does not exit and nothing waits for a person: it waits for the claim and serves the
+    // home as soon as the first is gone (a service manager's restart, a crash, kill -9).
+    for (let said = false; ;) {
+      try { gatewayLock = await holdGatewayLock(root); break; }
+      catch (error) {
+        if (!/ is served by /.test(error.message)) { say('error', { root, message: error.message }); process.exit(1); }
+        if (!said) { say('log', { level: 'info', message: `${error.message}; this daemon serves the home when that one ends` }); said = true; }
+        await new Promise((resolve) => setTimeout(resolve, CLAIM_RETRY_MS));
       }
-      crashed = Boolean(previous);
-      if (previous) unlinkSync(join(root, LOCK_FILE));
-      writeLock(root, { pid: process.pid, started_at: new Date().toISOString(), root, ...thisHost(), executor_url: args.executorUrl ?? null });
-    } finally {
-      rmdirSync(guard);
     }
-    // One runtime per home: Hermes's own gateway lock, held for as long as this daemon lives, so a Hermes
-    // gateway on this home refuses to start, and this daemon refuses a home a Hermes gateway serves.
+    // Who serves the home now (`orchestrator.lock`), for `supercode orchestrator status` and the operator verbs' live
+    // door. A record left behind is a predecessor that never stopped cleanly: this start replays for it (§4.7).
+    const previous = readLock(root);
+    crashed = Boolean(previous && previous.pid !== process.pid);
+    if (previous) unlinkSync(join(root, LOCK_FILE));
+    writeLock(root, { pid: process.pid, started_at: new Date().toISOString(), root, ...thisHost(), executor_url: args.executorUrl ?? null });
     try {
-      gatewayLock = await holdGatewayLock(root);
       // the home in both forms before it is loaded: a Hermes home is adopted as it stands
       for (const change of adoptHome(root)) say('log', { level: 'info', message: `home: ${change}` });
     } catch (error) {

package/board/cli.mjs

@@ -17,6 +17,15 @@ import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
 
+/**
+ * The messages on this machine whose delivery the mailbox gave up on (`supercode message expired`), by message id:
+ * filed by the board, never delivered within the mailbox's bound, kept unread. Empty when the mailbox does not answer.
+ */
+function mailExpiries() {
+  const r = spawnSync(supercodeBin(), ['message', 'expired', '--json'], { encoding: 'utf8', env: commandEnv(), timeout: 15_000 });
+  try { return new Map((JSON.parse(r.stdout) ?? []).map((expiry) => [expiry.id, expiry])); } catch { return new Map(); }
+}
+
 /**
  * What this machine's connector reports of publishing this board home (`harness.v1.boards.list`): whether the team
  * refused its credential, the publication it is retrying and the ones it abandoned. Null when no daemon answers or the
@@ -833,11 +842,12 @@ export async function runWorkflow(argv) {
       const { settings } = await laneState(root).catch(() => ({ settings: boardSettings({}) }));
       const fleet = observeFleet(root);
       const publishing = boardPublishing(root);
+      const expiredMail = mailExpiries();
       const order = ['warning', 'error', 'critical'];
       const found = withBoard((b) => {
         const cards = args.task ? [engine.getTask(b.db, args.task)].filter(Boolean) : engine.listCards(b.db, {});
         return [...(args.task ? [] : engine.diagnosePublishing(publishing).map((d) => ({ task: '(board)', title_of_task: null, ...d }))),
-          ...cards.flatMap((t) => engine.diagnose(b.db, t, { failureLimit: settings.failureLimit, fleet, launchWindowSeconds: settings.launchWindow, publishing }).map((d) => ({ task: t.id, title_of_task: t.title, ...d })))]
+          ...cards.flatMap((t) => engine.diagnose(b.db, t, { failureLimit: settings.failureLimit, fleet, launchWindowSeconds: settings.launchWindow, publishing, expiredMail }).map((d) => ({ task: t.id, title_of_task: t.title, ...d })))]
           .filter((d) => !args.severity || order.indexOf(d.severity) >= order.indexOf(args.severity));
       });
       if (args.json) { say(args, '', found); return 0; }
@@ -1514,7 +1524,7 @@ async function serve(root, args = {}) {
           for (const [t, why] of r.failed) log(`  ${t} did not start: ${why}`);
           for (const [t, why] of r.unsettled ?? []) log(`  ${t} could not be read: ${why}`);
           for (const [t, s, m] of r.started) log(`  ${t} started ${s} (${m})`);
-          for (const [t, to, why, what] of r.undelivered) log(what === 'close' ? `  close of ${to} for ${t} waits: ${why}` : `  notice for ${t} to ${to} not delivered: ${why}`);
+          for (const [t, to, why, what] of r.undelivered) log(what === 'close' ? `  close of ${to} for ${t} waits: ${why}` : `  notice for ${t} to ${to} not filed: ${why}`);
         }
       } catch (error) {
         log(`tick failed: ${error.message}`);

package/board/dispatch.mjs

@@ -1068,7 +1068,11 @@ function effectMessageKey(effect) {
   return `board-effect-${createHash('sha256').update(identity).digest('hex')}`;
 }
 
-/** The verb drains this durable notice immediately; the dispatcher retries after a failure. */
+/**
+ * A lifecycle notice to the session whose run changed, filed in its mailbox (the mailbox delivers it). The verb that
+ * recorded it files it at once after its commit; the delivery pass files any a verb left. It waits only for the
+ * session's address (a launch not yet bound).
+ */
 export async function sessionNotice(board, e) {
   const prior = view(board, (db) => json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(e.runId)?.metadata, {})?.supercode);
   if (prior?.close_confirmed_at) {
@@ -1079,24 +1083,14 @@ export async function sessionNotice(board, e) {
     });
     return true;
   }
-  e = { ...e, address: e.address ?? addressOf(prior) };
-  let error = null, receipt = null;
-  try {
-    if (!e.address) throw new Error('lifecycle notice awaits the owned launch session identity');
-    receipt = await send(board, boardAddress(board.label), board.label, e.address, e.text, effectMessageKey(e));
-    // A notice filed in the session's mailbox is done: the session reads its mail at its next
-    // turn, and a resumed session first. Only a notice no mailbox took is retried.
-    if (!receipt.delivered && !receipt.queued) error = receipt.reason ?? 'notice was not filed'; }
-  catch (failure) { error = String(failure.message).slice(-500); }
+  const address = e.address ?? addressOf(prior);
+  if (!address) throw new Error('lifecycle notice awaits the owned launch session identity');
+  const filed = fileMail(board, address, e.text, effectMessageKey(e));
   tx(board, (db) => {
     const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(e.runId)?.metadata, {})?.supercode;
-    if (session) setRunSession(db, e.runId, { ...session,
-      ...(error ? { lifecycle_notice_error: error }
-        : { lifecycle_notice_error: null, ...(session.lifecycle_notice_pending === e.durableId ? { lifecycle_notice_pending: null } : {}) }) });
-    if (!error || session?.lifecycle_notice_error !== error) event(db, e.id, error ? 'session_notice_failed' : receipt?.delivered ? 'session_notice_delivered' : 'session_notice_queued', { address: e.address, verb: e.verb, source_event: e.sourceEvent, notice: e.durableId, receipt, ...(error ? { error, retry: true } : {}) }, e.runId);
+    if (session?.lifecycle_notice_pending === e.durableId) setRunSession(db, e.runId, { lifecycle_notice_pending: null });
+    if (filed.new) event(db, e.id, 'session_notice_filed', { address, verb: e.verb, source_event: e.sourceEvent, notice: e.durableId, message_id: filed.message_id }, e.runId);
   });
-  // the attempt's reason goes with it, onto the effect's row (runEffects counts the attempt)
-  if (error) throw new Error(error);
   return true;
 }
 
@@ -1106,20 +1100,10 @@ export async function sessionEffect(board, e) {
     const row = view(board, db => e.runId ? db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(e.runId) : null);
     const session = json(row?.metadata, {})?.supercode;
     const address = addressOf(session);
-    let receipt;
-    try {
-      if (!address) throw new Error('actor session identity unavailable');
-      receipt = await send(board, boardAddress(board.label), board.label, address, e.text, effectMessageKey(e));
-    } catch (error) { receipt = { delivered: false, reason: error.message }; }
-    const kind = receipt.delivered ? 'actor_notice_delivered' : receipt.queued ? 'actor_notice_queued' : 'actor_notice_failed';
-    tx(board, db => {
-      const previous = db.prepare("SELECT kind,payload FROM task_events WHERE task_id=? AND kind IN ('actor_notice_delivered','actor_notice_queued','actor_notice_failed') ORDER BY id DESC LIMIT 1").get(e.id);
-      const payload = { notice: e.durableId, address, receipt };
-      if (previous?.kind !== kind || JSON.stringify(json(previous?.payload, {})?.receipt) !== JSON.stringify(receipt)) event(db, e.id, kind, payload, e.runId);
-    });
-    // a send its recipient's mailbox took (filed, or queued for a session between turns) is accepted: the mailbox
-    // delivers it from there, and the board does not send it again
-    if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'the actor notice was not filed');
+    if (!address) throw new Error('actor session identity unavailable');
+    // filed in the actor's mailbox, which delivers it
+    const filed = fileMail(board, address, e.text, effectMessageKey(e));
+    if (filed.new) tx(board, db => event(db, e.id, 'actor_notice_filed', { notice: e.durableId, address, message_id: filed.message_id }, e.runId));
     return true;
   }
   if (e.kind === 'close_session' || e.kind === 'run_ended') {
@@ -1550,17 +1534,8 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
       session = { ...kept, mode: 'adopt', launched_at: now(), seen_at: now() };
       // a kept session is told what this run is for (its card came back to it, with what happened since)
       tx(board, (db) => setRunSession(db, runId, { ...session, ...meta }));
-      if (input) {
-        try { deliverNow(board, addressOf(prev), input, `board-run-${task.id}-r${runId}`); }
-        catch (error) {
-          tx(board, (db) => {
-            const effect = { kind: 'session_notice', id: task.id, runId, address: addressOf(prev), text: input, verb: 'start', messageKey: `board-run-${task.id}-r${runId}` };
-            const saved = db.prepare('INSERT INTO supercode_effects(effect) VALUES(?)').run(JSON.stringify(effect));
-            setRunSession(db, runId, { lifecycle_notice_pending: Number(saved.lastInsertRowid), lifecycle_notice_error: error.message });
-            event(db, task.id, 'session_notice_failed', { verb: 'start', error: error.message, retry: true }, runId);
-          });
-        }
-      }
+      // filed in its mailbox, which delivers it
+      if (input) fileMail(board, addressOf(prev), input, `board-run-${task.id}-r${runId}`);
     } else if (prev.resumable !== false) {
       const authorization = view(board, db => currentRun(db,task.id)?.metadata?.supercode?.restart_authorized);
       const released = view(board,db=>{
@@ -1950,40 +1925,29 @@ function reconnectContinuedSessions(board, fleet, entry, report) {
 // ------------------------------------------------------------------ notify
 
 
-// a notice sent within a transaction's caller that cannot await (the launcher): the same door, synchronously
-function deliverNow(board, to, body, key) {
-  if (boardCopyOf(board)) throw copyRefusal(board, 'sends no notice to sessions');
-  const request = { op: 'send', from: boardAddress(board.label), from_name: `${board.label} board`, to, queue: false, id: key, subject: String(body).split('\n')[0].slice(0, 160),
-    body: `[Board notice from the ${board.label} board] ${body}\n\n(An automated notice from the board's dispatcher; replies to this address go nowhere.)` };
-  const r = sc(['message', 'remote-deliver'], { input: JSON.stringify(request), timeout: 120_000 });
-  const answer = lastJson(r.stdout);
-  if (answer?.code !== 0) throw new Error((answer?.text || r.stderr || `no delivery answer (exit ${r.code})`).trim().slice(-300));
-  if (!answer.receipt?.delivered) throw new Error(answer.receipt?.reason ?? 'native delivery confirmation pending');
-}
-
-async function send(board, from, label, to, body, key, { queue = false, ask = false, subject } = {}) {
-  if (boardCopyOf(board)) throw copyRefusal(board, 'sends no mail to sessions or managers');
+/**
+ * File one message from the board in its receiver's mailbox, and stop there (D138 step 6, D140): a local write through
+ * the mailbox's filing door (`supercode message file`), idempotent by the message id `key` fixes, with no network and
+ * nothing to try again. The mailbox delivers it: the machine daemon's watch loop hands it to its session by the
+ * session's own door, and carries mail for another machine there through Teams. `wake: false` leaves it for the
+ * session's next turn. A question the board waits on (`ask`) is answered by a reply to the board's address; a notice
+ * is not. Throws only when the local write failed.
+ */
+function fileMail(board, to, body, key, { ask = false, wake = true, subject } = {}) {
+  if (boardCopyOf(board)) throw copyRefusal(board, 'files no mail for sessions or managers');
   const request = {
-    op: 'send', from, from_name: `${label} board`, to, queue, id: key, subject: String(subject ?? String(body).split('\n')[0]).slice(0, 160),
-    // a question the board waits on is answered by a reply; a notice is not
-    body: ask ? `[A question from the ${label} board] ${body}` : `[Board notice from the ${label} board] ${body}\n\n(An automated notice from the board's dispatcher; replies to this address go nowhere.)`,
+    from: boardAddress(board.label), from_name: `${board.label} board`, to, id: key, wake, subject: String(subject ?? String(body).split('\n')[0]).slice(0, 160),
+    body: ask ? `[A question from the ${board.label} board] ${body}` : `[Board notice from the ${board.label} board] ${body}\n\n(An automated notice from the board's dispatcher; replies to this address go nowhere.)`,
   };
-  // a delivery to a busy session can take a minute on a loaded machine; what it answered is the verdict (a process
-  // killed after it answered `code: 0` delivered)
-  const r = await scAsync(['message', 'remote-deliver'], { input: JSON.stringify(request), timeout: 180_000 });
-  const answer = lastJson(r.stdout) ?? {};
-  if (answer.code !== 0) {
-    const error = new Error((answer.text || r.stderr || `no answer (exit ${r.code})`).trim().slice(-300));
-    // the delivery door's own answer that the recipient runs nowhere (mail_route / mail_send), never a local failure
-    if (typeof answer.code === 'number' && / is no longer running\. Nothing was sent\./.test(String(answer.text ?? ''))) error.notRunning = true;
-    throw error;
-  }
-  return answer.receipt ?? { delivered: false, reason: 'mail door returned no delivery receipt' };
+  const r = sc(['message', 'file'], { input: JSON.stringify(request), timeout: 30_000 });
+  const answer = lastJson(r.stdout);
+  if (answer?.code !== 0) throw new Error((answer?.text || r.stderr || `no answer from the mailbox's filing door (exit ${r.code})`).trim().slice(-300));
+  return { filed: true, message_id: answer.message_id, new: answer.new === true };
 }
 
 /**
  * Mail the workflow's managers (`params.managers`) about the dispatcher itself, not a card: its rounds failing, for one.
- * Answers how many took it; a manager that cannot be reached is skipped, never a reason to fail the caller.
+ * Answers how many it was filed for; a filing that fails is skipped, never a reason to fail the caller.
  */
 export async function alertManagers(root, slug, text, key) {
   let managers = [];
@@ -1991,54 +1955,26 @@ export async function alertManagers(root, slug, text, key) {
   const label = boardLabel(root, slug);
   let told = 0;
   for (const to of managers) {
-    try { const receipt = await send({ root }, boardAddress(label), label, to, text, key, { subject: text.split('\n')[0] }); if (receipt.delivered || receipt.queued) told += 1; } catch { /* the next alert tries again */ }
+    try { fileMail({ root, label }, to, text, key, { subject: text.split('\n')[0] }); told += 1; } catch { /* a filing that failed here is said by the next alert */ }
   }
   return told;
 }
 
 /**
- * The messages the workflow has the board send (`tell`, `ask`: board_message events) that it has not sent yet, sent now
- * and marked board_message_sent. A question goes under the id its card waits on; a resend of a sent one is a no-op
- * (the id is the send's idempotency key). One that fails is tried again next tick.
- */
-const MAIL_READY_SECONDS = 300;
-/** Each board message not yet sent nor abandoned gets its effect row (once: the insert reads that none exists). */
-export function queueBoardMail(db) {
-  db.prepare(`INSERT INTO supercode_effects (effect)
-    SELECT json_object('kind', 'board_message', 'id', original.task_id, 'event', original.id) FROM task_events original
-    WHERE original.kind = 'board_message'
-      AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind = 'board_message_sent' AND sent.task_id = original.task_id AND json_extract(sent.payload, '$.event') = original.id)
-      AND NOT EXISTS (SELECT 1 FROM task_events gone WHERE gone.kind = 'board_message_abandoned' AND gone.task_id = original.task_id AND json_extract(gone.payload, '$.event') = original.id)
-      AND NOT EXISTS (SELECT 1 FROM supercode_effects e WHERE json_extract(e.effect, '$.kind') = 'board_message' AND json_extract(e.effect, '$.event') = original.id)`).run();
-}
-
-/**
- * One board message's effect: its mail (with any batch it is in) sent under its fixed message id, so a second sender
- * is dropped by the mailbox. Answers true once it is sent, 'wait' while its batch window is open; throws the failure.
+ * The messages the workflow has the board send (`tell`, `ask`: board_message events) not filed yet, filed now (each
+ * with any batch it is in, `pendingRequestMail`) and marked board_message_sent. A question goes under the id its card
+ * waits on, so a second filing of it files nothing new. A mail inside its batch window waits for the next pass; one
+ * whose filing failed here is reported and filed by the next pass.
  */
-export async function sendBoardMessage(board, e) {
-  const state = () => view(board, (db) => db.prepare(`SELECT
-    EXISTS (SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?) AS sent,
-    EXISTS (SELECT 1 FROM task_events WHERE kind='board_message_abandoned' AND task_id=? AND json_extract(payload,'$.event')=?) AS gone`).get(e.id, e.event, e.id, e.event));
-  if (state().sent || state().gone || !e.event) return true;
-  const report = { undelivered: [] };
-  await sendBoardMessages(board, report, e.id);
-  if (state().sent) return true;
-  const failed = report.undelivered.find(([task]) => task === e.id);
-  if (failed) throw new Error(failed[2]);
-  // a mail waits for its batch window (at most a minute); one still not ready well after that is an attempt that failed
-  const recorded = view(board, (db) => db.prepare('SELECT created_at FROM task_events WHERE id = ?').get(e.event)?.created_at);
-  if (recorded && now() - Number(recorded) > MAIL_READY_SECONDS) throw new Error(`the mail was not ready to send ${now() - Number(recorded)} s after it was recorded`);
-  return 'wait';
-}
-
-export async function sendBoardMessages(board, report, taskId = null) {
-  const pending = view(board, db => db.prepare(`SELECT 1 FROM task_events original WHERE kind='board_message'
-    AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind='board_message_sent'
-      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id)
-    AND NOT EXISTS (SELECT 1 FROM task_events gone WHERE gone.kind='board_message_abandoned'
-      AND gone.task_id=original.task_id AND json_extract(gone.payload,'$.event')=original.id) LIMIT 1`).get());
-  if (!pending) return;
+export function fileBoardMail(board, report, taskId = null) {
+  // a message older than the workflow's notice_max_age_seconds is history, not news (a backlog replayed after an
+  // upgrade or a long stop): it is passed over, recorded once, never filed
+  const maxAge = Number(workflowFor(board.root)?.params?.notice_max_age_seconds) || null;
+  if (maxAge) tx(board, db => {
+    for (const row of db.prepare(`SELECT id, task_id FROM task_events original WHERE kind='board_message' AND created_at < ?
+      AND NOT EXISTS (SELECT 1 FROM task_events done WHERE done.kind IN ('board_message_sent', 'board_message_passed') AND done.task_id=original.task_id AND json_extract(done.payload,'$.event')=original.id)`).all(now() - maxAge))
+      event(db, row.task_id, 'board_message_passed', { event: row.id, reason: `older than notice_max_age_seconds (${maxAge})` });
+  });
   const planned = tx(board, db => pendingRequestMail(db, taskId));
   if (Number.isFinite(planned.nextAt)) report.next_mail_at = Math.min(report.next_mail_at ?? Infinity, planned.nextAt);
   for (const mail of planned.ready) {
@@ -2047,17 +1983,13 @@ export async function sendBoardMessages(board, report, taskId = null) {
     try {
       const task = view(board, db => getTask(db, first.task_id));
       const subject = mail.requester ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`;
-      const receipt = await send(board, boardAddress(board.label), board.label, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
-      if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'message was not filed');
+      const filed = fileMail(board, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
       tx(board, db => {
-        for (const member of mail.members) if (!db.prepare("SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?").get(member.task_id, member.id)) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, receipt, ...(mail.message_id ? { message_id: mail.message_id, request_id: member.message_id ?? mail.message_id } : {}) });
+        for (const member of mail.members) if (!db.prepare("SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?").get(member.task_id, member.id)) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, message_id: filed.message_id, ...(mail.message_id ? { request_id: member.message_id ?? mail.message_id } : {}) });
       });
+      (report.mailed ??= []).push([first.task_id, mail.to]);
     } catch (error) {
-      const reason = String(error.message).slice(-200);
-      for (const member of mail.members) report.undelivered.push([member.task_id, mail.to, reason]);
-      tx(board, db => {
-        for (const member of mail.members) event(db, member.task_id, 'board_message_failed', { event: member.id, to: mail.to, message_id: mail.message_id, reason });
-      });
+      for (const member of mail.members) report.undelivered.push([member.task_id, mail.to, String(error.message).slice(-200)]);
     }
   }
 }
@@ -2067,8 +1999,6 @@ export const boardAddress = (label) => `sc:${localMachine()}:board:${label.repla
 
 /** Consecutive failed sends after which a chat-platform subscription is dropped (Hermes's notifier drops a dead chat after 12). */
 const MAX_SEND_FAILURES = 12;
-/** Attempts a supercode notice gets before it is abandoned (its subscription stays). */
-const NOTICE_ATTEMPTS = 6;
 
 /**
  * What an audience is told of an event: the workflow's `notify[audience][kind]` template over the card, the event's
@@ -2123,31 +2053,17 @@ function sessionRecord(db) {
   return { held, latest };
 }
 
-/**
- * Whether the recipient's machine says, through its native discovery, that the session is not running (`persisted`:
- * its transcript is on disk and nothing runs it). Asked only after the delivery door answered that the session is no
- * longer running, once per machine and harness a round; null when the machine cannot answer.
- */
-function nativeEnded(address, discovered) {
-  const m = String(address).match(/^sc:([^:]+):([^:]+):(.+)$/);
-  if (!m) return null;
-  const [, machine, harness, session_id] = m, key = `${normalMachine(machine)}\u0000${harness}`;
-  if (!discovered.has(key)) { try { discovered.set(key, nativeSessions(machine, harness)); } catch { discovered.set(key, null); } }
-  const rows = discovered.get(key);
-  if (!rows) return null;
-  return nativeReading(rows, { session_id, harness }).alive === false ? { by: 'native_discovery', presence: 'persisted', machine } : null;
-}
-
 /**
  * The worker subscriptions of sessions that have ended, removed in one transaction, with one notice_unsubscribed event
  * per session naming its cards. A session has ended when no unended or current run works in it, the fleet does not list
- * it running, its latest run is not a release (a released session is a person's own, left running), and either the
- * board closed it (that run's confirmed close) or its machine's native discovery read it `persisted` this round
- * (`natively`). Everything is read inside the transaction, so a run that took the session meanwhile keeps it. A run
+ * it running, its latest run is not a release (a released session is a person's own, left running), and the board
+ * closed it (that run's confirmed close). Everything is read inside the transaction, so a run that took the session
+ * meanwhile keeps it. A worker session that ended any other way keeps its subscriptions, and is passed over while the
+ * fleet does not list it (`notify`); a run
  * that resumes the session subscribes it again at its launch and each round while it is the card's current run.
  * A creator's or manager's subscription is never ended here: its notices wait for the session to come back.
  */
-function endWorkerSubscriptions(board, fleet, report, natively = new Map()) {
+function endWorkerSubscriptions(board, fleet, report) {
   // each worker subscriber's liveness is read before the write
   const aliveNow = new Map();
   if (fleet.ok) for (const { chat_id: address } of board.db.prepare("SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) aliveNow.set(address, subscriberAlive(fleet, address));
@@ -2158,7 +2074,7 @@ function endWorkerSubscriptions(board, fleet, report, natively = new Map()) {
     for (const row of db.prepare("SELECT task_id, chat_id, thread_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) {
       const address = row.chat_id, record = latest.get(address);
       if (!record || record.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) === true)) continue;
-      const evidence = record.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at } : natively.get(address);
+      const evidence = record.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at } : null;
       if (!evidence || !remove.run(row.task_id, address, row.thread_id).changes) continue;
       if (!ended.has(address)) ended.set(address, { record, evidence, cards: [] });
       ended.get(address).cards.push(row.task_id);
@@ -2170,63 +2086,54 @@ function endWorkerSubscriptions(board, fleet, report, natively = new Map()) {
   });
 }
 
-async function notify(board, fleet, report, entry) {
-  const from = boardAddress(board.label);
+/**
+ * Each subscriber's notices, filed in its mailbox (D138 step 6, D140): the dispatcher's job ends at the filing, a local
+ * write under the notice's fixed key; the mailbox delivers it to the session, on this machine or through Teams on
+ * another. Each subscription's notices go in order, and its cursor moves past a notice once it is filed (or passed
+ * over); a filing that failed here leaves the cursor before it, and the next pass files it.
+ */
+function notify(board, fleet, report, entry) {
   endWorkerSubscriptions(board, fleet, report);
-  const { held, latest } = view(board, sessionRecord);
-  // A recipient whose delivery failed this round is not asked again this round for its other cards: those are left for
-  // the next round untried (a closed session subscribed to 21 subtasks was a delivery process for each, every round)
-  const refused = new Map(), discovered = new Map(), natively = new Map();
-  // each subscription's notices go in order; different subscribers are told side by side
-  await pool(subscriptions(board.db).filter((sub) => sub.platform === 'supercode'), SEND_CONCURRENCY, async (sub) => {
-    if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) return;
-    // a subscription whose last send failed waits out its retry time (as an effect does) before the next attempt
-    if (Number(sub.delivery_metadata?.next_at ?? 0) > now()) return;
+  for (const sub of subscriptions(board.db).filter((s) => s.platform === 'supercode')) {
+    if (stopping) break;
+    if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) continue;
     const role = ['worker', 'dependency', 'manager'].includes(sub.delivery_metadata?.role) ? sub.delivery_metadata.role : 'creator';
-    // a session the fleet does not list this tick is told next tick: one reading is not a loss (a loaded box drops
+    // a session the fleet does not list this pass is told next pass: one reading is not a loss (a loaded box drops
     // sessions from a read, and a dropped subscription never came back), and a session that is replaced on its card
     // has its subscription moved when the new one starts
-    if (role !== 'creator' && fleet.ok && !subscriberAlive(fleet, sub.chat_id)) return;
+    if (role !== 'creator' && fleet.ok && !subscriberAlive(fleet, sub.chat_id)) continue;
     const kinds = heardBy(entry, role);
-    if (!kinds.length) return;
+    if (!kinds.length) continue;
     const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id`)
       .all(sub.task_id, sub.last_event_id, ...kinds);
-    if (!events.length) return;
+    if (!events.length) continue;
     // the card as the workflow names it (its status the workflow's: triaging, reviewing, stopped; `stored_as` kanban.db's)
     const task = view(board, (db) => { const t = getTask(db, sub.task_id); return t ? { ...t, status: statusOf(db, t), stored_as: t.status } : t; });
     // a worker whose run has ended is not woken by a notice (a second session would start working the card beside
-    // the one the next run gets): the notice is filed in its mailbox, read when it next works
+    // the one the next run gets): the notice is filed for its next turn
     const working = role !== 'worker' || view(board, (db) => addressOf(currentRun(db, sub.task_id)?.metadata?.supercode) === sub.chat_id);
-    let cursor = Number(sub.last_event_id);
-    // A notice is sent first, under its fixed key (the mailbox drops a second send of it), and the cursor then only moves
-    // forward past it: two passes may both send one notice, and its recipient gets it once; a send that fails, or a pass
-    // that dies before its send, leaves the cursor behind the notice, so it is sent again.
+    // a Claude session always starts a turn when mail reaches it, so its mail is always delivered now
+    const wake = String(sub.chat_id).includes(':claude-code:') || (working && !(!entry.workflow.run && sub.delivery_mode === 'notify'));
     const where = "WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?";
     const identity = [sub.task_id, sub.chat_id, sub.thread_id ?? ''];
     const forward = (to) => tx(board, (db) => db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ? ${where} AND last_event_id < ?`).run(to, ...identity, to));
-    let failed = null, untried = false, trying = null;
+    // an event older than the workflow's notice_max_age_seconds is history, not news: it is passed over, never filed
+    const maxAge = Number(entry.params.notice_max_age_seconds) || null;
+    const stale = (ev) => maxAge && now() - Number(ev.created_at) > maxAge;
+    // A backlog (a restart, a pass that did not run) is told as it stands now: news is coalesced by its subject, not its
+    // kind alone (a later `assigned` says what an earlier one did, but each subtask added, dependency linked or unlinked
+    // is its own fact, keyed by the card it names); a comment or an answer is always its own message. Only events that
+    // would be told count: a stale one or the recipient's own act never supersedes one that would be.
+    const subjectOf = (ev) => { const p = json(ev.payload, {}) ?? {}; return ['commented', 'answered'].includes(ev.kind) ? `${ev.kind}:${ev.id}` : `${ev.kind}:${p.subtask ?? p.parent ?? p.child ?? ''}`; };
+    const latest = new Map(events.filter((ev) => !stale(ev) && !((json(ev.payload, {}) ?? {}).by === sub.chat_id)).map((ev) => [subjectOf(ev), ev.id]));
+    let cursor = Number(sub.last_event_id);
     try {
-      // an event older than the workflow's notice_max_age_seconds is history, not news: it is passed over, never mailed
-      const maxAge = Number(entry.params.notice_max_age_seconds) || null;
-      // A backlog (a restart, a recipient that could not be reached) is told as it stands now: of one kind of news about
-      // the card, only the latest (a later adoption_failed, blocked or moved says what the earlier one did); comments
-      // and answers, each its own message, in full. A notice the board already recorded as taken by this address is never sent again.
-      // only events that would be told count: a stale one or the recipient's own act never supersedes one that would be
-      const sendable = (ev) => { const p = json(ev.payload, {}) ?? {}; return !(maxAge && now() - Number(ev.created_at) > maxAge) && !(p.by && p.by === sub.chat_id); };
-      // News is coalesced by its subject, not its kind alone: a later `assigned` says what an earlier one did, but each
-      // subtask added, dependency linked or unlinked is its own fact, keyed by the card it names; a comment or an
-      // answer is always its own message.
-      const subjectOf = (ev) => { const p = json(ev.payload, {}) ?? {}; return ['commented', 'answered'].includes(ev.kind) ? `${ev.kind}:${ev.id}` : `${ev.kind}:${p.subtask ?? p.parent ?? p.child ?? ''}`; };
-      const latest = new Map(events.filter((ev) => sendable(ev)).map((ev) => [subjectOf(ev), ev.id]));
-      const sentBefore = board.db.prepare("SELECT 1 FROM task_events WHERE task_id = ? AND kind IN ('notice_delivered', 'notice_filed') AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') = ? LIMIT 1");
       for (const ev of events) {
         const p = json(ev.payload, {}) ?? {};
-        if (maxAge && now() - Number(ev.created_at) > maxAge) { cursor = ev.id; (report.stale_notices_passed ??= 0); report.stale_notices_passed += 1; continue; }
-
-        if (sentBefore.get(sub.task_id, ev.id, sub.chat_id)) { cursor = ev.id; continue; }
+        if (stale(ev)) { cursor = ev.id; report.stale_notices_passed = (report.stale_notices_passed ?? 0) + 1; continue; }
         // nobody is told of their own act
         if (p.by && p.by === sub.chat_id) { cursor = ev.id; continue; }
-        if (latest.has(subjectOf(ev)) && latest.get(subjectOf(ev)) !== ev.id) { cursor = ev.id; (report.superseded_notices_passed ??= 0); report.superseded_notices_passed += 1; continue; }
+        if (latest.get(subjectOf(ev)) !== ev.id) { cursor = ev.id; report.superseded_notices_passed = (report.superseded_notices_passed ?? 0) + 1; continue; }
         let text;
         if (ev.kind === 'commented') {
           if (p.author === sub.chat_id) { cursor = ev.id; continue; }
@@ -2235,69 +2142,23 @@ async function notify(board, fleet, report, entry) {
         } else text = noticeOf(entry, role, ev.kind, task, p);
         if (text) {
           const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
-          if (refused.has(sub.chat_id) || stopping) { untried = true; break; }
-          trying = ev.id;
-          let receipt;
-          try {
-            receipt = await send(board, from, board.label, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { queue: String(sub.chat_id).includes(':claude-code:') ? false : !working || (!entry.workflow.run && sub.delivery_mode === 'notify'), subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
-            // A notice the recipient's mailbox took is filed: the machine delivers it at the session's next turn, so the
-            // board does not send it again.
-            if (!receipt.delivered && !receipt.queued) throw new Error(receipt.reason ?? 'notice was not filed');
-          } catch (error) {
-            // two passes may send one notice at once, and the second send can fail while the first is taken: a notice
-            // another pass already recorded as taken is no failure
-            if (sentBefore.get(sub.task_id, ev.id, sub.chat_id)) { cursor = ev.id; forward(ev.id); continue; }
-            if (!refused.has(sub.chat_id)) refused.set(sub.chat_id, error);
-            throw error;
-          }
-          // recorded once, whichever pass's send the mailbox took
-          tx(board, (db) => { if (!db.prepare("SELECT 1 FROM task_events WHERE task_id = ? AND kind IN ('notice_delivered', 'notice_filed') AND json_extract(payload, '$.source_event') = ? AND json_extract(payload, '$.address') = ?").get(sub.task_id, ev.id, sub.chat_id)) event(db, sub.task_id, receipt.delivered ? 'notice_delivered' : 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, receipt }); });
+          // filed under its fixed key: a second pass filing the same notice files nothing new
+          const filed = fileMail(board, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { wake, subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
+          if (filed.new) tx(board, (db) => event(db, sub.task_id, 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, message_id: filed.message_id, wake }));
           report.notified.push([sub.task_id, ev.kind, sub.chat_id]);
-          forward(ev.id);
         }
         cursor = ev.id;
+        forward(cursor);
       }
     } catch (error) {
-      // One "no longer running" answer is not an ended session (a Claude session is resumed under the same id): for a
-      // worker no run holds, and that is not a released session, the machine's native discovery is asked, and a
-      // `persisted` reading ends its worker subscriptions after this round's deliveries.
-      const record = latest.get(sub.chat_id);
-      if (error.notRunning && role === 'worker' && record && !record.session.released && !held.has(sub.chat_id)) {
-        if (!natively.has(sub.chat_id)) natively.set(sub.chat_id, nativeEnded(sub.chat_id, discovered));
-        if (natively.get(sub.chat_id)) return;
-      }
-      failed = String(error.message).slice(-200);
-      tx(board, (db) => {
-        const kind = 'notice_failed';
-        const previous = db.prepare('SELECT payload FROM task_events WHERE task_id=? AND kind=? ORDER BY id DESC LIMIT 1').get(sub.task_id, kind);
-        const payload = { after_event: cursor, address: sub.chat_id, error: failed, retry: true };
-        const { by: _, ...said } = json(previous?.payload, {}) ?? {};
-        if (JSON.stringify(said) !== JSON.stringify(payload)) event(db, sub.task_id, kind, payload);
-      });
-      report.undelivered.push([sub.task_id, sub.chat_id, failed]);
+      report.undelivered.push([sub.task_id, sub.chat_id, String(error.message).slice(-200)]);
     }
-    // the cursor moves forward past what was passed over (a failed delivery is retried next pass)
     forward(cursor);
-    tx(board, (db) => {
-      // a round that left this subscription untried (a delivery to its recipient failed on another card) says nothing of it
-      if (untried) return;
-      // A notice is tried NOTICE_ATTEMPTS times, waiting as an effect does between attempts. After its last failed
-      // attempt it is abandoned (its terminal state, `notice_abandoned`, recorded once) and the cursor moves past it;
-      // the subscription stays, so the notices after it are still told (dropping it lost them when the round
-      // subscribed the session again from the card's newest event).
-      // failures are counted per notice: a failure of a later notice starts its own count
-      const failures = failed ? (Number(sub.delivery_metadata?.failing_event) === trying ? Number(sub.delivery_metadata?.failures ?? 0) : 0) + 1 : 0;
-      if (failed && failures >= NOTICE_ATTEMPTS && trying) {
-        event(db, sub.task_id, 'notice_abandoned', { source_event: trying, address: sub.chat_id, attempts: failures, error: failed });
-        db.prepare(`UPDATE kanban_notify_subs SET last_event_id = ?, delivery_metadata = ? ${where} AND last_event_id < ?`).run(trying, JSON.stringify({ ...sub.delivery_metadata, failures: 0, next_at: 0 }), ...identity, trying);
-        return;
-      }
-      if (failures !== Number(sub.delivery_metadata?.failures ?? 0) || (failed && Number(sub.delivery_metadata?.failing_event) !== trying)) db.prepare(`UPDATE kanban_notify_subs SET delivery_metadata = ? ${where}`).run(JSON.stringify({ ...sub.delivery_metadata, failures, failing_event: failed ? trying : null, next_at: failed ? now() + Math.min(1800, 30 * 2 ** (failures - 1)) : 0 }), ...identity);
-      if (task?.status === 'archived' && cursor >= events.at(-1).id) db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity);
-    });
-  });
-  const persisted = new Map([...natively].filter(([, reading]) => reading));
-  if (persisted.size) endWorkerSubscriptions(board, fleet, report, persisted);
+    // a subscription past its card's last event ends with the card: a worker's when the card is done or archived (its
+    // work is over, and its session may never run again), anyone's when it is archived
+    const over = task && (task.stored_as === 'archived' || (role === 'worker' && task.stored_as === 'done'));
+    if (over && cursor >= events.at(-1).id) tx(board, (db) => db.prepare(`DELETE FROM kanban_notify_subs ${where}`).run(...identity));
+  }
 }
 
 // Hermes's terminal kinds for a chat subscriber, in its order of silence: archived and unblocked move the cursor and say nothing
@@ -2496,37 +2357,11 @@ export function boardLabel(root, slug) {
   return slug && slug !== 'default' ? `${home}/${slug}` : home;
 }
 
-/** `sc` without blocking the tick: notices to many sessions go out side by side. */
-function scAsync(args, { input = null, timeout = 120_000 } = {}) {
-  return new Promise((done) => {
-    const child = spawnChild(supercodeBin(), args, { cwd: tmpdir(), env: commandEnv(), stdio: ['pipe', 'pipe', 'pipe'] });
-    let stdout = '';
-    let stderr = '';
-    const timer = setTimeout(() => { stderr += ` timed out after ${timeout}ms`; child.kill('SIGKILL'); }, timeout);
-    child.stdout.setEncoding('utf8').on('data', (c) => { stdout += c; });
-    child.stderr.setEncoding('utf8').on('data', (c) => { stderr += c; });
-    child.on('error', (error) => { clearTimeout(timer); done({ code: null, stdout, stderr: stderr + error.message }); });
-    child.on('close', (code) => { clearTimeout(timer); done({ code, stdout, stderr }); });
-    child.stdin.end(input ?? '');
-  });
-}
-
 // A dispatcher told to stop (its serve's SIGTERM, SIGINT or SIGHUP) starts nothing more in the round it is in: no further
-// board, card start, board message or notice. What it leaves untried is not a failure; the next dispatcher sends it.
+// board, card start, board message or notice. What it leaves unfiled is not a failure; the next dispatcher files it.
 let stopping = false;
 export function stopDispatching() { stopping = true; }
 
-// how many deliveries a tick has in flight at once (each is a `supercode message` process of a few seconds)
-const SEND_CONCURRENCY = 8;
-
-/** Run `fn` over `items`, at most `n` at a time. */
-async function pool(items, n, fn) {
-  let next = 0;
-  await Promise.all(Array.from({ length: Math.min(n, items.length) }, async () => {
-    while (next < items.length && !stopping) { const i = next; next += 1; await fn(items[i]); }
-  }));
-}
-
 /** A board file's fingerprint: a corrupt board is skipped until the file changes (Hermes retries it then). */
 const fingerprint = (path) => { try { const st = statSync(path); return `${st.size}:${st.mtimeMs}`; } catch { return 'missing'; } };
 const CORRUPT = /malformed|not a database|corrupt|disk image/i;
@@ -2681,10 +2516,10 @@ export async function deliver({ root, slugs = null }) {
       setActor(boardAddress(board.label));
       let mark = Date.now();
       const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
-      // board mail is sent as effect rows, one per message, each claimed as any effect is
-      tx(board, (db) => queueBoardMail(db)); phase('mail');
+      // board mail and notices are filed in their receivers' mailboxes (local writes); the mailbox delivers them
+      fileBoardMail(board, report); phase('mail');
       report.effects = await runEffects(board, [], { pending: true }); phase('effects');
-      await notify(board, fleet, report, entry); phase('notify');
+      notify(board, fleet, report, entry); phase('notify');
       synchronizeAgents(board, report); phase('agents');
       report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
       report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);

package/board/engine.mjs

@@ -477,8 +477,8 @@ const OWNED = new Set(['merge_reviewed', 'cleanup_workspace']);
 const effectWait = (attempts) => Math.min(1800, 30 * 2 ** Math.max(0, attempts - 1));
 // A delivery pass claims a row by compare-and-set on its next_at (set ahead only while the row is due) before trying it,
 // so two passes (serve's, the hosted loop's, a person's `workflow deliver`, a verb's own) never try one effect at once.
-// The claim outlasts any one attempt: each effect's I/O is bounded by its own timeouts (a send's 180 s, a merge's
-// MERGE_BUDGET plus one in-flight GitHub call), all well inside EFFECT_CLAIM.
+// The claim outlasts any one attempt: each effect's I/O is bounded by its own timeouts (a merge's MERGE_BUDGET plus one
+// in-flight GitHub call), all well inside EFFECT_CLAIM.
 const EFFECT_CLAIM = 900;
 
 /**
@@ -487,8 +487,9 @@ const EFFECT_CLAIM = 900;
  * to run after it, in the delivery pass, never inside a dispatch round.
  */
 export function queueEffects(board, effects = []) {
-  // a board message is its own effect row (dispatch.mjs queueBoardMail), so the move's mail hint is not recorded
-  const fresh = effects.filter((e) => !e.durableId && e.kind !== 'run' && !(e.kind === 'board_message' && !e.event));
+  // board mail is filed by the delivery pass from its board_message events (dispatch.mjs fileBoardMail), so the move's
+  // mail hint is not recorded
+  const fresh = effects.filter((e) => !e.durableId && e.kind !== 'run' && e.kind !== 'board_message');
   const now_ = fresh.filter((e) => ['invalidate_descendants', 'close_session', 'run_ended', 'stop_run'].includes(e.kind));
   const later = fresh.filter((e) => !now_.includes(e));
   for (const e of now_) {
@@ -518,8 +519,6 @@ export async function runEffects(board, effects = [], { pending: due = false } =
     let done, error = null;
     try { done = await runEffect(board, e); } catch (thrown) { done = false; error = String(thrown?.message ?? thrown).slice(0, 500); }
     if (!e.durableId) continue;
-    // a mail inside its batch window is not an attempt: it is looked at again in a few seconds
-    if (done === 'wait') { tx(board, (db) => db.prepare('UPDATE supercode_effects SET next_at = ? WHERE id = ?').run(now() + 5, e.durableId)); did.kept.push(e.durableId); continue; }
     if (done) { tx(board, (db) => db.prepare('DELETE FROM supercode_effects WHERE id = ?').run(e.durableId)); did.done.push(`${e.durableId}:${e.kind}`); continue; }
     did.kept.push(e.durableId);
     const made = (attempts.get(e.durableId) ?? 0) + 1;
@@ -538,7 +537,6 @@ export async function runEffects(board, effects = [], { pending: due = false } =
       } else if (made >= EFFECT_ATTEMPTS) {
         db.prepare('UPDATE supercode_effects SET attempts = ?, failed_at = ?, last_error = ? WHERE id = ?').run(made, now(), reason, e.durableId);
         if (card) event(db, card, 'effect_failed', { effect: e.durableId, kind: e.kind, attempts: made, error: reason, address: e.address ?? null }, e.runId ?? null);
-        if (card && e.kind === 'board_message' && e.event) event(db, card, 'board_message_abandoned', { event: e.event, attempts: made, reason });
       } else db.prepare('UPDATE supercode_effects SET attempts = ?, next_at = ?, last_error = ? WHERE id = ?').run(made, now() + effectWait(made), reason, e.durableId);
     });
   }
@@ -550,12 +548,8 @@ async function runEffect(board, e) {
   if (e.kind === 'session_notice') { const { sessionNotice } = await import('./dispatch.mjs'); return await sessionNotice(board, e) !== false; }
   if (e.kind === 'cleanup_workspace') { cleanupWorkspace(board, e.id); return true; }
   if (e.kind === 'declare_card_agent') { const { declareCardAgentEffect } = await import('./agent-declarations.mjs'); return declareCardAgentEffect(board, e) !== false; }
-  if (e.kind === 'board_message') {
-    const { sendBoardMessage, sendBoardMessages } = await import('./dispatch.mjs');
-    // a verb's own ask sends its card's mail at once; the mail's own effect row then finds it sent
-    if (!e.event) { await sendBoardMessages(board, { undelivered: [] }, e.id); return true; }
-    return await sendBoardMessage(board, e);
-  }
+  // a verb's own ask files its card's mail at once (a local write; the mailbox delivers it)
+  if (e.kind === 'board_message') { const { fileBoardMail } = await import('./dispatch.mjs'); fileBoardMail(board, { undelivered: [] }, e.id); return true; }
   if (e.kind === 'merge_reviewed') { const { mergeReviewed } = await import('./dispatch.mjs'); return await mergeReviewed(board, e) !== false; }
   if (e.kind === 'invalidate_descendants') { tx(board, (db) => invalidateDescendants(db, board, e.id)); return true; }
   if (e.kind === 'stop_run') { stopWorker(board, e.runId); return true; }
@@ -928,7 +922,7 @@ export function diagnosePublishing(publishing) {
  * same thing can go wrong, and supercode's own where only its sessions can): each `{ kind, severity, title, data,
  * actions }`, worst first.
  */
-export function diagnose(db, task, { failureLimit = DEFAULT_FAILURE_LIMIT, strandedSeconds = 30 * 60, blockedHours = 24, fleet = null, launchWindowSeconds = 300, publishing = null } = {}) {
+export function diagnose(db, task, { failureLimit = DEFAULT_FAILURE_LIMIT, strandedSeconds = 30 * 60, blockedHours = 24, fleet = null, launchWindowSeconds = 300, publishing = null, expiredMail = null } = {}) {
   const out = [];
   const t = now();
   const events = all(db, 'SELECT kind, payload, created_at FROM task_events WHERE task_id = ? ORDER BY id', task.id);
@@ -985,15 +979,19 @@ export function diagnose(db, task, { failureLimit = DEFAULT_FAILURE_LIMIT, stran
       ? { kind: 'effect_failed', severity: 'warning', title: `its ${kind} failed for good after ${row.attempts} attempts: ${row.last_error ?? 'no reason recorded'}`, data: { effect: row.id, kind, attempts: row.attempts }, actions: [] }
       : { kind: 'effect_stalled', severity: 'error', title: `its ${kind} has failed ${row.attempts} times and is still tried: ${row.last_error ?? 'no reason recorded'}`, data: { effect: row.id, kind, attempts: row.attempts }, actions: [] });
   }
-  // notices the board gave up on: each one, with the event it was about and who was not told
-  for (const row of all(db, "SELECT payload FROM task_events WHERE task_id = ? AND kind = 'notice_abandoned' ORDER BY id DESC LIMIT 20", task.id)) {
-    const p = json(row.payload, {}) ?? {};
-    out.push({ kind: 'notice_abandoned', severity: 'warning', title: `the notice of event ${p.source_event} to ${p.address} was abandoned after ${p.attempts} attempts: ${p.error ?? 'no reason recorded'}`, data: { event: p.source_event, address: p.address, attempts: p.attempts }, actions: [] });
-  }
   // publications of the card the machine's connector abandoned: the team refused each one past its attempts
   for (const a of (publishing?.abandoned ?? []).filter((a) => a.card === task.id).slice(0, 20)) {
     out.push({ kind: 'publication_abandoned', severity: 'warning', title: `its ${a.kind} (sequence ${a.sequence}) was not published to the team: refused ${a.attempts} times (${a.status} ${a.code ?? ''}): ${a.error}`, data: { publication: a.publication, sequence: a.sequence, status: a.status, code: a.code }, actions: [] });
   }
+  // mail the board filed for the card whose delivery the mailbox gave up on (its wake expired): it stays unread there
+  if (expiredMail?.size) {
+    for (const row of all(db, "SELECT kind, payload FROM task_events WHERE task_id = ? AND kind IN ('notice_filed', 'session_notice_filed', 'actor_notice_filed', 'board_message_sent') ORDER BY id DESC LIMIT 200", task.id)) {
+      const p = json(row.payload, {}) ?? {}, expiry = p.message_id && expiredMail.get(p.message_id);
+      if (!expiry) continue;
+      const what = row.kind === 'notice_filed' ? `its ${p.kind} notice` : row.kind === 'board_message_sent' ? 'its board mail' : `its ${row.kind.replace('_filed', '').replace('_', ' ')}`;
+      out.push({ kind: 'mail_expired', severity: 'warning', title: `${what} to ${expiry.to} was never delivered: ${expiry.reason} (${expiry.attempts} attempts); it stays unread in that mailbox`, data: { message_id: p.message_id, to: expiry.to, attempts: expiry.attempts, expired_at_ms: expiry.expired_at_ms }, actions: [] });
+    }
+  }
   const order = ['critical', 'error', 'warning'];
   return out.sort((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity));
 }

package/board/request-mail.mjs

@@ -2,10 +2,8 @@ import { event, json, now } from './store.mjs';
 
 export function pendingRequestMail(db, taskId = null) {
   const pending = db.prepare(`SELECT id, task_id, payload, created_at FROM task_events original
-    WHERE kind='board_message' AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind='board_message_sent'
-      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id)
-    AND NOT EXISTS (SELECT 1 FROM task_events gone WHERE gone.kind='board_message_abandoned'
-      AND gone.task_id=original.task_id AND json_extract(gone.payload,'$.event')=original.id) ORDER BY id`).all()
+    WHERE kind='board_message' AND NOT EXISTS (SELECT 1 FROM task_events sent WHERE sent.kind IN ('board_message_sent', 'board_message_passed')
+      AND sent.task_id=original.task_id AND json_extract(sent.payload,'$.event')=original.id) ORDER BY id`).all()
     .map(row => ({ ...row, mail: json(row.payload, {}) ?? {} }));
   if (!pending.length) return { ready: [], nextAt: Infinity };
   const batches = db.prepare("SELECT payload FROM task_events WHERE kind='board_message_batch' AND id>=? ORDER BY id").all(pending[0].id)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.47",
+  "version": "0.5.49",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {