@volter/supercode-orchestrator 0.5.68 → 0.5.70

package/board/client.mjs

@@ -0,0 +1,87 @@
+// `supercode workflow`'s client: it loads nothing of the board. A card verb is sent to the home's owner and its answer
+// written here; only a run-on-the-machine verb (and help) loads the board, to run as its own act.
+import { WorkspaceContexts } from '@volter/teams/context';
+import { supercodeHome } from '@volter/teams/home';
+import { askBoardOwner, BOARD_OPERATION_VERBS, boardHome, callerFacts } from '@volter/teams/board-owner';
+import { mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homeOf, parse } from './args.mjs';
+import { processSession } from './caller-session.mjs';
+
+/**
+ * `supercode workflow <verb>`: the CLI holds nothing. A card verb is sent to the home's board owner (`workflow serve`,
+ * @volter/teams/board-owner), which answers it in its own process with the home it holds; the answer is rendered here.
+ * The run-on-the-machine verbs (BOARD_OPERATION_VERBS: the owner itself, its init, repair and housekeeping, the
+ * dispatching switch and the verbs that hold the call open) and help are acts of their own, run here.
+ */
+export async function runWorkflow(argv) {
+  const args = parse(argv);
+  const [verb] = args._;
+  const help = !verb || verb === 'help' || args.help;
+  const root = help ? null : homeOf(args);
+  if (help || BOARD_OPERATION_VERBS.has(verb)) {
+    // The board has one writer. An operation that writes the boards (exclusive, below) takes the home's lock itself
+    // and so is that writer, refusing while an owner holds it; the dispatching switch is the owner's to write while one
+    // runs. The rest only read, or are the owner itself (serve), and run here as their own act.
+    const writes = !help && exclusive(verb, args);
+    let lock = null;
+    if (writes) {
+      try { lock = await takeHome(root); }
+      catch (error) {
+        if (verb === 'dispatching') return sendToOwner(root, argv, args);
+        process.stderr.write(`supercode workflow: ${verb} writes the boards of ${root}, which have a running owner (${error.message}); stop \`supercode workflow serve\` to run it\n`);
+        return 1;
+      }
+    }
+    const [{ runVerb }, { closeWorld }] = await Promise.all([import('./cli.mjs'), import('../orchestration.mjs')]);
+    try { return await runVerb(argv); } finally { lock?.release(); await closeWorld(); }
+  }
+  return sendToOwner(root, argv, args);
+}
+
+// The operations that write the boards: run only as the home's sole writer, holding its lock and a fencing epoch.
+const EXCLUSIVE = new Set(['init', 'migrate', 'gc', 'repair']);
+const BOARDS_WRITES = new Set(['create', 'new', 'rm', 'remove', 'delete', 'rename', 'set-default-workdir', 'import']);
+function exclusive(verb, args) {
+  if (EXCLUSIVE.has(verb)) return true;
+  if (verb === 'dispatch') return !args['dry-run'];
+  if (verb === 'dispatching') return ['on', 'off'].includes(args._[1]);
+  if (verb === 'boards') return BOARDS_WRITES.has(args._[1] ?? 'list');
+  return false;
+}
+
+/** Hold the home's lock and take a fencing epoch, as its owner does; rejects when an owner holds the lock. */
+async function takeHome(root) {
+  mkdirSync(root, { recursive: true });
+  const [{ holdLock }, { takeEpoch }, { listBoards, openBoard }] = await Promise.all([import('./lock-holder.mjs'), import('./fence.mjs'), import('./store.mjs')]);
+  const lock = await holdLock(join(boardHome(root), 'board.lock'), { onLost: (error) => { process.stderr.write(`supercode workflow: ${error.message}; stopping\n`); process.exit(1); } });
+  takeEpoch(root, () => listBoards(root).map((slug) => openBoard(root, slug)));
+  return lock;
+}
+
+async function sendToOwner(root, argv, args) {
+  const sid = processSession();
+  const harness = sid ? (sid === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code') : null;
+  // a file named `-` is the caller's standard input, read here and sent with the verb
+  const stdin = [args.file, args['body-file']].includes('-') ? readFileSync(0, 'utf8') : null;
+  // The caller's own selections travel with the verb, so the owner never answers it with its own: its board (the
+  // board it names, else the one its environment names) and its Teams context (named, else the one selected here).
+  const board = args.board ?? process.env.HERMES_KANBAN_BOARD ?? null;
+  const facts = { ...callerFacts(), SUPERCODE_CONTEXT: process.env.SUPERCODE_CONTEXT || new WorkspaceContexts(supercodeHome()).read().current || 'local' };
+  const answer = await askBoardOwner(root, { argv: withoutHome(argv), board, caller: null, session: sid ? { id: sid, harness } : null, facts, cwd: process.cwd(), stdin });
+  if (answer.stdout) process.stdout.write(answer.stdout);
+  if (answer.stderr) process.stderr.write(answer.stderr);
+  return answer.code ?? 1;
+}
+
+/** `argv` without the home and board it names: the owner answers for its own home, and the board travels apart. */
+export function withoutHome(argv) {
+  const out = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (/^--(root|board)=/.test(arg)) continue;
+    if (arg === '--root' || arg === '--board') { i++; continue; }
+    out.push(arg);
+  }
+  return out;
+}

package/board/dispatch.mjs

@@ -16,6 +16,9 @@
 // `workflow dispatch`) is harmless: every act of a round is a compare-and-set claim, a transaction that re-reads what it
 // acts on and does nothing when another round already acted (see `tick`). Every side effect follows a committed claim, so
 // a crash between the two steps is answered by the next round.
+import { machineCall } from './doors.mjs';
+import { processSession } from './caller-session.mjs';
+import { callerOf, current, isCallersCall, ownCall } from './call.mjs';
 import { noteStep } from '@volter/supercode-harness-sdk/slow-log';
 import { monitorsRuns, failedObservation, surfaceIncident, auditEndedRuns, originOf } from './incidents.mjs';
 import { readMachineFleet } from './machine-fleet.mjs';
@@ -57,13 +60,17 @@ export function normalMachine(name) {
 
 /** This machine's name as supercode's addresses spell it: its Teams enrollment, else its host name. */
 let localMachineName;
-export function localMachine() {
+/** Learn it once per process, from the machine's own daemon (in-process: doors.mjs); a host with no daemon is its OS name. */
+export async function knowLocalMachine() {
   if (localMachineName) return localMachineName;
-  try {
-    const reply=runtimeDoor(null,'harness.v1.machine.describe',{}, {timeout:15_000});
-    if(reply.code===0){const machine=JSON.parse(reply.stdout);return localMachineName=normalMachine(machine.name??machine.hostname);}
-  } catch { /* no local daemon: a plain host still has its OS machine name */ }
-  return localMachineName=normalMachine(hostname());
+  try { const machine = await machineCall(null, 'harness.v1.machine.describe', {}, { timeoutMs: 15_000 }); localMachineName = normalMachine(machine.name ?? machine.hostname); }
+  catch { localMachineName = normalMachine(hostname()); }
+  return localMachineName;
+}
+/** This machine's name, as the process learned it at its start (knowLocalMachine). */
+export function localMachine() {
+  if (!localMachineName) throw new Error('this machine\'s name is read at the start of a verb or the owner (knowLocalMachine), not on demand');
+  return localMachineName;
 }
 
 /** The supercode command the dispatcher drives. */
@@ -96,24 +103,10 @@ const lastJson = (text) => {
  * every session that can be messaged on every machine; `online` every enrolled machine connected to the team.
  */
 /**
- * The caller of a verb the machine daemon's board door runs here (another machine's session, `sc:<machine>:<harness>:
- * <id>`), or null when the verb was not called through the door. The door is this verb's parent: it named the caller
- * from the calling process itself and writes `{"caller": …}` on the verb's stdin, which this process reads to its end,
- * so nothing it starts inherits it. `SUPERCODE_BOARD_CALL` only says to read it. It is trusted as the machine's user is:
- * any process of that user can start a verb so, as it can name a session in CLAUDE_CODE_SESSION_ID.
+ * The session a verb answers for when another session called it (the board's owner answering the caller the CLI or the
+ * machine daemon's board door named, call.mjs), or null for the process's own call.
  */
-let readBoardCaller;
-export function boardCaller() {
-  if (readBoardCaller !== undefined) return readBoardCaller;
-  readBoardCaller = null;
-  if (process.env.SUPERCODE_BOARD_CALL !== '1') return null;
-  let said = null;
-  try { said = JSON.parse(readFileSync(0, 'utf8')); } catch { /* nothing said */ }
-  const m = /^sc:([^:\s]+):(claude-code|codex):([^:\s]+)$/.exec(said?.caller ?? '');
-  if (!m) throw new Error('this verb was started by the board door, which named no caller for it; nothing was done');
-  readBoardCaller = { address: m[0], machine: m[1], harness: m[2], session: m[3] };
-  return readBoardCaller;
-}
+export const boardCaller = () => callerOf();
 
 /**
  * The session a command runs in. Each harness names its own in a variable (Claude Code CLAUDE_CODE_SESSION_ID, Codex
@@ -121,27 +114,10 @@ export function boardCaller() {
  * pane can carry a Claude session's id too: the nearest harness among the command's ancestors says which is its own.
  */
 export function callerSession() {
-  // A verb another session called on this board (the machine daemon's board door): the daemon named its caller from the
-  // calling process itself, on the caller's own machine, and passes that address in place of the harness variables.
-  const called = boardCaller();
-  if (called) return called.session;
-  const claude = process.env.CLAUDE_CODE_SESSION_ID || null;
-  const codex = process.env.CODEX_THREAD_ID || null;
-  if (!claude || !codex) return claude ?? codex;
-  const table = spawnSync('ps', ['-A', '-o', 'pid=,ppid=,comm='], { encoding: 'utf8' });
-  const processes = new Map();
-  for (const row of String(table.stdout ?? '').split('\n')) {
-    const m = row.trim().match(/^(\d+)\s+(\d+)\s+(.*)$/);
-    if (m) processes.set(Number(m[1]), { parent: Number(m[2]), name: basename(m[3]) });
-  }
-  for (let pid = process.ppid, depth = 0; pid > 1 && depth < 64; depth++) {
-    const p = processes.get(pid);
-    if (!p) break;
-    if (p.name === 'codex') return codex;
-    if (/^claude(\.exe)?$/.test(p.name)) return claude;
-    pid = p.parent;
-  }
-  return claude;
+  // A caller's verb in the board's owner: its own side named it (the CLI from its process, the machine daemon from the
+  // calling process on its machine). Only the process's own call reads the harness variables.
+  if (isCallersCall()) return boardCaller()?.session ?? null;
+  return processSession();
 }
 
 /** The fleet as the home's machines answer for themselves (machine-fleet.mjs): this machine, and every machine an open
@@ -771,7 +747,7 @@ export function launchRun(board, entry, id, lane, fleet, settings) {
   try {
     // Teams is never on a launch's path: the card's agent is its identity minted on this host under its retained intent,
     // and its sessions are joined to it off this path, after the launch. No Teams answer starts, stops or holds a card.
-    const context=process.env.SUPERCODE_CONTEXT,team=agentScope(context);
+    const context=current().facts.SUPERCODE_CONTEXT,team=agentScope(context);
     const agent=localCardAgent({root:board.root,org:team.org,server:team.server,profiles:entry.profiles,
       profile:lane.name,card:id,role:spec.role??slot,sponsor:task.sponsor??null});
     // G3: a run of an agent over its budget does not start; the reason waits on the card until the window passes
@@ -1368,7 +1344,7 @@ export function reconcileCallerLaunch(board, sid) {
     JOIN tasks t ON t.current_run_id=r.id WHERE r.ended_at IS NULL
     AND json_extract(r.metadata, '$.supercode.launch_pending') = 1`).all());
   const machine = localMachine();
-  const harness = sid === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code';
+  const harness = boardCaller()?.harness ?? (sid === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code');
   const candidates = rows.filter((row) => {
     const s = json(row.metadata, {})?.supercode;
     return s?.machine === machine && s.harness === harness && (!s.session_id || s.session_id === sid);
@@ -1702,20 +1678,22 @@ function launchHeadless(board, task, runId, lane, settings, { prompt = null, ski
   rotateLog(logFile, settings.logRotateBytes, settings.logBackups);
   const out = openSync(logFile, 'a');
   const exitFile = join(logDir, `${task.id}.r${runId}.exit`);
+  // the launch's secret, given to this worker alone: the run keeps its hash, and the worker's session record must name it
+  const launchSecret = randomUUID() + randomUUID();
   // the worker runs under a shell that records its exit code, so a later tick can tell a clean exit from a crash
   const child = spawnChild('/bin/sh', ['-c', '"$0" "$@"; echo $? > "$SUPERCODE_BOARD_EXIT_FILE"', process.execPath, WORKER, ...args], {
     cwd: workspace, detached: true, stdio: ['ignore', out, out],
     env: {
       SUPERCODE_BOARD_EXIT_FILE: exitFile,
       ...(task.goal_mode ? { HERMES_KANBAN_GOAL_MODE: '1', ...(task.goal_max_turns ? { HERMES_KANBAN_GOAL_MAX_TURNS: String(task.goal_max_turns) } : {}) } : {}),
-      ...process.env, ...meta.agent_env, HERMES_HOME: meta.agent_env?.HERMES_HOME??lane.dir, HERMES_PROFILE: lane.name, HERMES_KANBAN_TASK: task.id, HERMES_KANBAN_WORKSPACE: workspace,
-      HERMES_KANBAN_RUN_ID: String(runId), HERMES_KANBAN_DB: board.path, HERMES_KANBAN_BOARD: board.slug, HERMES_SESSION_SOURCE: 'kanban',
+      ...process.env, ...meta.agent_env, SUPERCODE_ORCHESTRATOR_HOME: board.root, HERMES_HOME: meta.agent_env?.HERMES_HOME??lane.dir, HERMES_PROFILE: lane.name, HERMES_KANBAN_TASK: task.id, HERMES_KANBAN_WORKSPACE: workspace,
+      HERMES_KANBAN_RUN_ID: String(runId), SUPERCODE_RUN_LAUNCH: launchSecret, HERMES_KANBAN_DB: board.path, HERMES_KANBAN_BOARD: board.slug, HERMES_SESSION_SOURCE: 'kanban',
       HERMES_KANBAN_CLAIM_LOCK: claimer(), ...(prompt ? { SUPERCODE_BOARD_PROMPT: prompt } : {}), ...(task.tenant ? { HERMES_TENANT: task.tenant } : {}),
       ...(task.branch_name ? { HERMES_KANBAN_BRANCH: task.branch_name } : {}),
     },
   });
   child.unref();
-  const session = { surface: 'headless', pid: child.pid, machine: localMachine(), mode: 'fresh', launched_at: now(), exit_file: exitFile, ...meta };
+  const session = { surface: 'headless', pid: child.pid, machine: localMachine(), mode: 'fresh', launched_at: now(), exit_file: exitFile, launch_secret: createHash('sha256').update(launchSecret).digest('hex'), ...meta };
   tx(board, (db) => {
     db.prepare('UPDATE tasks SET worker_pid = ? WHERE id = ?').run(child.pid, task.id);
     db.prepare('UPDATE task_runs SET worker_pid = ? WHERE id = ?').run(child.pid, runId);
@@ -1881,7 +1859,7 @@ function adoptSession(board, id, who, { request = null, open = request, progress
   const entry0 = workflowFor(board.root), card0 = view(board, (db) => getTask(db, id));
   const agentRole = view(board, (db) => adoptedRole(db, board, entry0, card0, beforeRun)) ?? 'implementer';
   const laneName = view(board, (db) => evaluate(entry0.workflow.roles?.[agentRole] ?? 'card.assignee', scopeOf(db, board, card0, { params: entry0.params }))) ?? assignee ?? card0?.assignee;
-  const lane = laneName ? lanes?.[laneName] : null, context = process.env.SUPERCODE_CONTEXT, team = agentScope(context);
+  const lane = laneName ? lanes?.[laneName] : null, context = current().facts.SUPERCODE_CONTEXT, team = agentScope(context);
   // The request is claimed before this adoption's first write outside the board (the agent store, below), in
   // a transaction that finds it still open and the card's run the one read: a request answered or claimed meanwhile, or
   // a run that changed, ends it here with nothing written anywhere, and no other round acts on a request claimed here.
@@ -2024,7 +2002,7 @@ function fileMail(board, to, body, key, { ask = false, wake = true, subject } =
  */
 export async function alertManagers(root, slug, text, key) {
   let managers = [];
-  try { const entry = await loadWorkflow(root, { fresh: true }); managers = Array.isArray(entry.params.managers) ? entry.params.managers.map(String) : []; } catch { /* a workflow that cannot load names nobody */ }
+  try { const entry = await loadWorkflow(root); managers = Array.isArray(entry.params.managers) ? entry.params.managers.map(String) : []; } catch { /* a workflow that cannot load names nobody */ }
   const label = boardLabel(root, slug);
   let told = 0;
   for (const to of managers) {
@@ -2243,7 +2221,7 @@ function notify(board, fleet, report, entry) {
 export async function notifyChats(root, adapters, log = () => {}, wake = null) {
   const sent = [];
   // what a chat is told is the workflow's (notify.chat)
-  const entry = await loadWorkflow(root, { fresh: true });
+  const entry = await loadWorkflow(root);
   const kinds = heardBy(entry, 'chat');
   if (!kinds.length) return sent;
   for (const slug of listBoards(root)) {
@@ -2422,7 +2400,7 @@ const CORRUPT = /malformed|not a database|corrupt|disk image/i;
 /** What a tick would start on each board of the home, planned through the workflow's `dispatch`, writing nothing. */
 export async function plan({ root, lanes, settings, slugs = null, params = {} }) {
   fleetRoot = root;
-  const loaded = await loadWorkflow(root, { fresh: true });
+  const loaded = await loadWorkflow(root);
   const entry = { ...loaded, params: { ...loaded.params, ...params } };
   const fleet = Object.values(lanes).some((l) => l.surface === 'pane') ? observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
   const out = [];
@@ -2536,31 +2514,24 @@ function capMax(cap, group, entry, lanes) {
   catch { return null; }
 }
 
-const ORCHESTRATOR_ENTRY = fileURLToPath(new URL('../bin/orchestrator.mjs', import.meta.url));
 const deliveries = new Map();
 /**
  * Start the home's delivery pass (`workflow deliver`) in a process of its own, unless one is already running: the
  * dispatcher's loop calls this after each round and never waits for it. `log(level, line)` hears what it failed at.
  * Answers whether one was started.
  */
-export function startDelivery(root, { log = () => {} } = {}) {
+export function startDelivery(root, { slugs = null, log = () => {} } = {}) {
+  // the controller's delivery pass, run here by the owner (no process of its own), never two at once for a home; the
+  // round never waits for it
   if (deliveries.has(root)) return false;
-  const child = spawnChild(process.execPath, [ORCHESTRATOR_ENTRY, 'workflow', 'deliver', '--root', root, '--json'], { stdio: ['ignore', 'pipe', 'pipe'], env: process.env });
-  deliveries.set(root, child);
-  let out = '', err = '';
-  child.stdout.setEncoding('utf8').on('data', (c) => { out += c; });
-  child.stderr.setEncoding('utf8').on('data', (c) => { err = (err + c).slice(-2000); });
-  const done = () => {
-    deliveries.delete(root);
-    let reports = null; try { reports = JSON.parse(out); } catch { log('warn', `delivery pass failed: ${(err || out).trim().slice(-300) || 'no answer'}`); return; }
+  const pass = ownCall(() => deliver({ root, slugs, controller: true })).then((reports) => {
     for (const r of reports) {
       if (r.error) log('warn', `delivery on board ${r.board} failed: ${r.error}`);
       for (const [task, to, why] of r.undelivered ?? []) log('warn', `board ${r.board}: a delivery for ${task} to ${to} waits: ${why}`);
       log('info', `delivery on board ${r.board}: ${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good; took ${Object.entries(r.ms ?? {}).map(([k, v]) => `${k} ${(v / 1000).toFixed(1)}s`).join(', ')}`);
     }
-  };
-  child.on('error', (error) => { log('warn', `delivery pass did not start: ${error.message}`); deliveries.delete(root); });
-  child.on('close', done);
+  }, (error) => log('warn', `delivery pass failed: ${error?.message ?? error}`)).finally(() => deliveries.delete(root));
+  deliveries.set(root, pass);
   return true;
 }
 
@@ -2570,12 +2541,31 @@ export function startDelivery(root, { log = () => {} } = {}) {
  * its own process (`workflow deliver`, started by serve after a round, one at a time), never inside a dispatch round,
  * so no recipient, door or Teams answer holds a round. Answers one report per board.
  */
-export async function deliver({ root, slugs = null }) {
+/**
+ * Whether the board dispatches: board state, kept in the board's own store (`supercode_board_state`, key `dispatching`)
+ * with who set it, when and why. A board that never recorded one dispatches, as every board did before the switch.
+ */
+export function dispatchingOf(root, slug) {
+  let board;
+  try {
+    board = openBoard(root, slug);
+    const row = board.db.prepare("SELECT value FROM supercode_board_state WHERE key = 'dispatching'").get();
+    const value = json(row?.value, null);
+    return value && typeof value.on === 'boolean' ? value : { on: true };
+  } catch { return { on: true }; } finally { board?.close(); }
+}
+
+export async function deliver({ root, slugs = null, controller = false }) {
   fleetRoot = root;
-  const entry = await loadWorkflow(root, { fresh: true });
+  const entry = await loadWorkflow(root);
+  // the owner's controller delivers only for boards whose dispatching is on, read as each board is reached (a pass
+  // already under way when a board is switched off leaves it); `workflow deliver`, an operator's act, delivers as asked
+  const boards = (slugs ?? listBoards(root)).filter((slug) => !controller || dispatchingOf(root, slug).on);
+  if (!boards.length) return [];
   const fleet = observeFleet();
   const out = [];
-  for (const slug of slugs ?? listBoards(root)) {
+  for (const slug of boards) {
+    if (controller && !dispatchingOf(root, slug).on) continue;
     const report = { board: slug, ms: {}, mailed: [], queued: [], failed: [], notified: [], undelivered: [], fleet: fleet.ok ? 'read' : fleet.error };
     let board;
     try {
@@ -2585,10 +2575,13 @@ export async function deliver({ root, slugs = null }) {
       let mark = Date.now();
       const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
       // board mail and notices are filed in their receivers' mailboxes (local writes); the mailbox delivers them
-      fileBoardMail(board, report); phase('mail');
-      report.effects = await runEffects(board, [], { pending: true }); phase('effects');
-      notify(board, fleet, report, entry); phase('notify');
-      synchronizeAgents(board, report); phase('agents');
+      // a controller's pass reads the board's switch before each phase and each effect: switched off meanwhile, what had
+      // not begun is left (an operator's `workflow deliver` delivers as asked)
+      const on = () => !controller || dispatchingOf(root, slug).on;
+      if (on()) { fileBoardMail(board, report); phase('mail'); }
+      if (on()) { report.effects = await runEffects(board, [], { pending: true, eligible: controller ? on : null }); phase('effects'); }
+      if (on()) { notify(board, fleet, report, entry); phase('notify'); }
+      if (on()) { synchronizeAgents(board, report); phase('agents'); }
       report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
       report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);
     } catch (error) { report.error = error.message; }
@@ -2621,15 +2614,16 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
   discoveries.clear();
   // a verb's flags (dispatch --max, --failure-limit) are params of this tick, read by the workflow as its own
   const deployment = deploymentReceipt ? workflowRevision(root) : null;
-  const loaded = await loadWorkflow(root, { fresh: true });
+  const loaded = await loadWorkflow(root);
   const entry = { ...loaded, params: { ...loaded.params, ...params } };
   const needFleet = Object.values(lanes).some((l) => l.surface === 'pane');
   const fleetAt = Date.now();
   const fleet = needFleet ? observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
   const fleetMs = Date.now() - fleetAt;
   const boards = slugs ?? listBoards(root);
-  // what every board of the home holds, for caps whose scope is the whole home (kanban.max_in_progress counts so)
-  const held = dispatch ? homeHoldings(root, boards, lanes, fleet, entry) : [];
+  // what every board of the home holds, for caps whose scope is the whole home (kanban.max_in_progress counts so): every
+  // board, including one whose dispatching is off, whose live workers still hold their places
+  const held = dispatch ? homeHoldings(root, listBoards(root), lanes, fleet, entry) : [];
   const out = [];
   for (const slug of boards) {
     if (stopping) break;

package/board/doors.mjs

@@ -0,0 +1,60 @@
+// The board owner's doors to its machine and the others (ADR 0010: sessions, panes and workspaces are the machine's,
+// asked through its own daemon). The owner is resident and async: it holds one admitted channel per machine for as
+// long as the channel lives and calls each door on it in-process, with the SDK clients the doors speak. No helper
+// process is started for a call. The local machine is this OS user's daemon on its socket; another machine is reached
+// through the Teams context's channel to it (@volter/teams/machine-door).
+import { openMachine } from '@volter/teams/machine-door';
+import { StreamRpc, harnessTransport } from '@volter/teams/client';
+import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
+import { noteStep } from '@volter/supercode-harness-sdk/slow-log';
+
+const held = new Map(); // machine name, '' for this one → Promise<{ channel, node, harness }>
+
+async function opened(machine) {
+  const key = machine ?? '';
+  const known = held.get(key);
+  if (known) {
+    const door = await known.catch(() => null);
+    if (door && !door.channel.closed) return door;
+    held.delete(key);
+  }
+  const opening = (async () => {
+    const channel = await openMachine({ machine: machine || null });
+    const door = { channel, node: null, harness: null };
+    channel.on('close', () => { if (held.get(key) === opening) held.delete(key); });
+    return door;
+  })();
+  held.set(key, opening);
+  try { return await opening; } catch (error) { held.delete(key); throw error; }
+}
+
+/**
+ * One `harness.v1.*` request to a machine's daemon: `machine` null for this machine. A session's records are the
+ * harness's own service, spoken by its SDK over the machine's harness stream; every other door is the daemon's node
+ * service. Throws the door's refusal (with its code).
+ */
+export async function machineCall(machine, method, params = {}, { timeoutMs = 60_000 } = {}) {
+  if (!method.startsWith('harness.v1.')) throw new Error('a machine door is a harness.v1 method');
+  const started = performance.now();
+  try {
+    const door = await opened(machine);
+    if (method.startsWith('harness.v1.sessions.')) {
+      door.harness ??= (async () => { const client = new SupercodeHarnessClient({ transport: harnessTransport(door.channel) }); await client.start?.(); return client; })();
+      return await (await door.harness).request(method, params, { timeoutMs });
+    }
+    door.node ??= door.channel.open('node').then((stream) => new StreamRpc(stream));
+    return await (await door.node).call(method, params, { timeoutMs });
+  } finally {
+    noteStep(`door ${method}${machine ? ' (another machine)' : ''}`, performance.now() - started);
+  }
+}
+
+/** Let go of every held channel (the owner stopping). */
+export async function closeDoors() {
+  for (const [key, opening] of [...held]) {
+    held.delete(key);
+    const door = await opening.catch(() => null);
+    try { await (await door?.harness)?.close?.(); } catch { /* closing anyway */ }
+    door?.channel.close();
+  }
+}

package/board/engine.mjs

@@ -7,6 +7,7 @@
 //
 // Each function takes an open board (`store.mjs`) and runs in one write transaction. Nothing here launches,
 // observes or sends: the dispatcher (`dispatch.mjs`) does, and records what it did through these.
+import { current } from './call.mjs';
 import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, rmSync } from 'node:fs';
 import { join, resolve } from 'node:path';
@@ -274,7 +275,7 @@ export function createCard(board, spec) {
     if(!arc) {
       const creator=/^sc:[^:]+:(claude-code|codex|gemini|grok|pi|hermes|opencode|supercode):(.+)$/.exec(actorOf()??'');
       const effect={kind:'declare_card_agent',id,role:'implementer',profile:spec.assignee??null,
-        context:process.env.SUPERCODE_CONTEXT??null,starter_session:creator?`${creator[1]}:${creator[2]}`:null};
+        context:current().facts.SUPERCODE_CONTEXT??null,starter_session:creator?`${creator[1]}:${creator[2]}`:null};
       const inserted=run(db,'INSERT INTO supercode_effects(effect) VALUES(?)',JSON.stringify(effect));
       declaration={...effect,durableId:Number(inserted.lastInsertRowid)};
     }
@@ -397,9 +398,9 @@ function cleanupWorkspace(board, id) {
  * `platform` for the dispatcher. Answers `{ from, to, moved }`; throws the workflow's refusal.
  */
 // who is sending, when a caller does not say: the CLI answers with the caller's role on the card (setCaller)
-let callerRoles = () => ['manager'];
-/** How the engine learns who a caller is on a card: `fn(db, cardId)` answers the caller's roles there. */
-export function setCaller(fn) { callerRoles = fn; }
+/** How the engine learns who a caller is on a card: `fn(db, cardId)` answers the caller's roles there (the call's own). */
+export function setCaller(fn) { current().roles = fn; }
+const callerRoles = (db, cardId) => current().roles(db, cardId);
 
 export async function act(board, id, name, { roles = null, payload = {}, extra = {} } = {}) {
   const entry = await loadWorkflow(board.root);
@@ -505,7 +506,7 @@ export function queueEffects(board, effects = []) {
 }
 
 /** The I/O a committed move asked for: the move's own `effects`, and with `pending` every recorded effect that is due. */
-export async function runEffects(board, effects = [], { pending: due = false } = {}) {
+export async function runEffects(board, effects = [], { pending: due = false, eligible = null } = {}) {
   const requested = new Set(effects.map((e) => e.durableId).filter(Boolean));
   const t = now();
   const rows = board.db.prepare('SELECT id, effect, attempts, next_at FROM supercode_effects WHERE failed_at IS NULL ORDER BY id').all()
@@ -517,6 +518,9 @@ export async function runEffects(board, effects = [], { pending: due = false } =
   // what this call did, for its caller's report: effect ids done, tried and kept, and skipped as another's claim
   const did = { done: [], kept: [], claimed_elsewhere: [] };
   for (const e of combined) {
+    // a controller's pass asks before each claim whether its board is still its to work (dispatching on): one switched
+    // off meanwhile has nothing more claimed by it
+    if (eligible && !eligible()) break;
     // the claim: taken only while the row is due and not failed; another pass holding it answers no change
     if (e.durableId && !tx(board, (db) => db.prepare('UPDATE supercode_effects SET next_at = ? WHERE id = ? AND failed_at IS NULL AND next_at <= ?').run(now() + EFFECT_CLAIM, e.durableId, now()).changes)) { did.claimed_elsewhere.push(e.durableId); continue; }
     let done, error = null;

package/board/event-stream.mjs

@@ -4,7 +4,6 @@ import { watch, existsSync, readFileSync, realpathSync, statSync } from 'node:fs
 import { dirname, basename, join, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { listBoards, openBoard, backingPaths } from './store.mjs';
-import { recordCardPublications } from './published.mjs';
 
 const identity = root => createHash('sha256').update(realpathSync(root)).digest('hex');
 const cursorOf = (home, boards) => Buffer.from(JSON.stringify({version:1,home,boards})).toString('base64url');
@@ -15,8 +14,8 @@ const RESETTLE_MS = 30_000;
 export async function* followBoardPublications({root,after,signal}) {
   const home=identity(root), positions={}, watchers=new Map();
   let dirty=true, wake=null, failure=null, inventory=null;
-  // Each store file as this follower's own pass left it, stamped right after that board's close. Its pass writes (the
-  // publication transaction) and closes the board, which rewrites the WAL and raises a watch event of its own; an event
+  // Each store file as this follower's own pass left it, stamped right after that board's close. Its pass only reads,
+  // but closing the board checkpoints the WAL and raises a watch event of its own; an event
   // for a store file that is still as its pass left it is that echo, not a change, and does not start another pass.
   // Without this the follower woke itself every quarter second and burned a core with nothing to publish
   // (t_0328d520). Stamped per board, a write to one board while later boards' passes run is never taken for an echo.
@@ -67,11 +66,12 @@ export async function* followBoardPublications({root,after,signal}) {
       for(const slug of slugs){
         const board=openBoard(root,slug);
         try {
-          // External native writers do not share our transaction wrapper. Their
-          // filesystem event reconciles once into the same retained source log.
+          // The follower only reads the board's retained log: what a writer changed, it published in its own transaction,
+          // and what a native writer marked, the board's owner publishes on its wake (published.mjs). Read in one view,
+          // in the backing's own transaction (not the store's, which would publish), so the boundary and the heads are
+          // one state.
           const boundary=board.tx(db=>{
-            recordCardPublications(db,null);
-            const log=db.prepare('SELECT id,pruned_through FROM supercode_publication_log').get();
+            const log=db.prepare('SELECT id,pruned_through FROM supercode_publication_log').get()??{id:null,pruned_through:0};
             const high=Number(db.prepare('SELECT MAX(sequence) AS n FROM supercode_publications').get()?.n??0);
             const heads=initial?db.prepare('SELECT sequence FROM supercode_publication_heads ORDER BY resource_id').all().map(row=>row.sequence):[];
             return {log:log.id,floor:Number(log.pruned_through),high,heads};

package/board/fence.mjs

@@ -0,0 +1,45 @@
+// The board owner's fencing token. The OS lock (lock-holder.mjs) says who owns a home; the epoch makes a stale owner's
+// write fail at the database whatever its stack is doing: an owner that lost its lock while blocked in synchronous work
+// cannot commit after its successor started. Each owner start takes a new epoch, above every epoch any board of the
+// home has stored and the home's own record (`<home>/board.epoch`, so a home whose boards are all new still counts up). Every
+// write transaction in the owner process stores its epoch in the board (`supercode_board_state`, key `owner_epoch`)
+// only when the stored one is not newer, in one conditional statement at the transaction's start; when it is newer this
+// owner is stale, and it exits there, its transaction uncommitted. Every board is made by the owner or by an operation
+// holding the home's lock, so its first (fenced) transaction stores its maker's epoch.
+import { renameSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { boardHome } from '@volter/teams/board-owner';
+
+let mine = null;
+const STATE = 'CREATE TABLE IF NOT EXISTS supercode_board_state (key TEXT PRIMARY KEY, value TEXT)';
+const epochFile = (root) => join(boardHome(root), 'board.epoch');
+const recorded = (root) => { try { return Number(readFileSync(epochFile(root), 'utf8').trim()) || 0; } catch { return 0; } };
+const storedIn = (db) => { db.exec(STATE); return Number(db.prepare("SELECT value FROM supercode_board_state WHERE key = 'owner_epoch'").get()?.value ?? 0) || 0; };
+
+/** This process's epoch: null outside the owner. */
+export const ownerEpoch = () => mine;
+
+/**
+ * Take a new epoch for the home at `root` (the caller holds its lock): one above the home's record and every epoch the
+ * boards opened by `boards()` store; recorded, then fenced into each board.
+ */
+export function takeEpoch(root, boards) {
+  let high = recorded(root);
+  for (const board of boards()) { try { high = Math.max(high, storedIn(board.db)); } finally { board.close(); } }
+  mine = high + 1;
+  const file = epochFile(root);
+  writeFileSync(`${file}.tmp`, `${mine}\n`); renameSync(`${file}.tmp`, file);
+  for (const board of boards()) { try { board.tx(() => {}); } finally { board.close(); } }
+  return mine;
+}
+
+/** At a write transaction's start: in the owner, store its epoch unless a newer one is stored, and exit when it is. */
+export function fenced(db) {
+  if (mine === null) return;
+  db.exec(STATE);
+  const r = db.prepare(`INSERT INTO supercode_board_state (key, value) VALUES ('owner_epoch', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value
+    WHERE CAST(supercode_board_state.value AS INTEGER) <= CAST(excluded.value AS INTEGER)`).run(String(mine));
+  if (r.changes > 0) return;
+  process.stderr.write(`${new Date().toISOString()} this owner (epoch ${mine}) was superseded by epoch ${storedIn(db)}: a newer owner holds the home; stopping before this write commits\n`);
+  process.exit(1);
+}