@volter/supercode-orchestrator 0.5.69 → 0.5.71

package/board/cli.mjs

@@ -2,21 +2,30 @@
 // format, and its dispatcher. Every verb of `hermes kanban` is here under its own name, with its own flags and its own
 // output lines, so a caller of Hermes's CLI calls this one unchanged; supercode's own verbs (`move`, `adopt`, `close`,
 // `serve`, `--at`) are added beside them. The Rust CLI hands every verb but `load` to `bin/orchestrator.mjs workflow`,
-// which lands here. The home is `--root`, else `SUPERCODE_ORCHESTRATOR_HOME`, else `HERMES_HOME`; the board is
+// which lands here. The home is `--root`, else `SUPERCODE_ORCHESTRATOR_HOME`; the board is
 // `--board <slug>`, else `HERMES_KANBAN_BOARD`, else the home's current board (`kanban/current`), else `default`.
+import { machineCall, closeDoors } from './doors.mjs';
+import { createHash } from 'node:crypto';
+import { DatabaseSync } from 'node:sqlite';
+import { homeOf, parse } from './args.mjs';
+import { BOARD_OPERATION_VERBS, boardHome, boardOwnerSocket, CALLER_FACTS } from '@volter/teams/board-owner';
+import { current, isCallersCall, ownCall, within } from './call.mjs';
 import { taskStatusOf } from './published.mjs';
-import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { createServer } from 'node:net';
+import { chmodSync, existsSync, mkdirSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, copyFileSync, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
+import { notRuntime, ownHome } from './owner-files.mjs';
 import { spawnSync } from 'node:child_process';
+import { holdLock } from './lock-holder.mjs';
+import { takeEpoch } from './fence.mjs';
+import { boardTool } from './tools.mjs';
 import { recordSlow, takeSteps } from '@volter/supercode-harness-sdk/slow-log';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir, tmpdir, userInfo } from 'node:os';
-import { read } from '../orchestration.mjs';
-import { actorOf, view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, setPrincipal, principalOf, isCaller, tx } from './store.mjs';
+import { actorOf, publishMarked, view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, setPrincipal, principalOf, isCaller, tx } from './store.mjs';
 import { isLocalWorkspace } from './workspace.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
-import { runtimeDoor } from './runtime-door.mjs';
 
 /** The messages on this machine the mailbox still has to deliver (`supercode message waiting`), by message id. */
 function mailWaiting() {
@@ -38,26 +47,35 @@ function mailExpiries() {
  * refused its credential, the publication it is retrying and the ones it abandoned. Null when no daemon answers or the
  * home is not registered: diagnostics then say nothing of publishing.
  */
-function boardPublishing(root) {
-  const read = runtimeDoor(null, 'harness.v1.boards.list', {}, { timeout: 15_000 });
-  if (read.code !== 0) return null;
+async function boardPublishing(root) {
+  let listed;
+  try { listed = await machineCall(null, 'harness.v1.boards.list', {}, { timeoutMs: 15_000 }); } catch { return null; }
   let here; try { here = realpathSync(root); } catch { here = resolve(root); }
-  try { const listed = JSON.parse(read.stdout); const board = listed.boards?.find((b) => b.root === here); return board ? { ...board, refused: listed.refused ?? null } : null; } catch { return null; }
+  const board = listed?.boards?.find((b) => b.root === here);
+  return board ? { ...board, refused: listed.refused ?? null } : null;
 }
-import { requestAdoption, alertManagers, boardAddress, boardLabel, boardSettings, boardCaller, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, stopDispatching, supercodeBin, tick, deliver, startDelivery } from './dispatch.mjs';
+import { dispatchingOf, knowLocalMachine, requestAdoption, alertManagers, boardAddress, boardLabel, boardSettings, boardCaller, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, stopDispatching, supercodeBin, tick, deliver, startDelivery } from './dispatch.mjs';
 import { watchBoard } from './wake.mjs';
 import { streamBoardPublications } from './event-stream.mjs';
-import { completionOwnerOf, isLatestReviewer, loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
+import { completionOwnerOf, followHome, isLatestReviewer, loadWorkflow, readHome, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
 import { evaluate } from './expr.mjs';
 import { agentDoor,agentScope,activeAgentAssignments,reassignAgent,agentUsage,localAgentRecord,agentRunForSession } from '../agents.mjs';
 
 // Text a verb stores, read from --file/--body-file PATH (`-` for stdin) when given: a shell never expands what it
 // never sees, as it does `$(...)` and `$VAR` in an argument.
-const textFrom = (file, inline) => file === undefined ? inline : readFileSync(file === '-' ? 0 : String(file), 'utf8');
+const textFrom = (file, inline) => {
+  if (file === undefined) return inline;
+  if (file === '-') { const sent = current().stdin; if (sent === null) throw new Error('- names standard input, and the caller sent none'); return sent; }
+  return readFileSync(callerPath(String(file)), 'utf8');
+};
+
+/** A path a caller names, read against its working directory; never the owner's own runtime files (owner-files.mjs). */
+const callerPath = (named) => notRuntime(resolve(current().cwd, named));
+const SAFE_SESSION = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
 const HELP = `supercode workflow <verb> [--root <home>] [--board <slug>] [--json]
 
 The board's verbs, with their flags:
-  init [--backing sqlite|files|ztrack] [--document <arcs.md>] [--commit] [--manager <address>] [--archive-max-lines N] [--archive-period month]
+  init [--backing sqlite|files|ztrack] [--document <arcs.md>] [--commit] [--manager <address>] [--dispatching on|off] [--archive-max-lines N] [--archive-period month]
   migrate --backing ztrack --document <arcs.md> --status-map <json>
   boards list|create|rm|switch|show|rename|set-default-workdir|export|import
   create <title> [--body | --body-file PATH|-] [--assignee] [--parent]... [--workspace scratch|worktree:<repository>|dir:<repository>] [--branch] [--project]
@@ -80,7 +98,7 @@ The board's verbs, with their flags:
   diagnostics [--task] [--severity]   stats   assignees   log <id> [--tail N]   tail <id>   watch [--assignee] [--kinds]
   notify-subscribe <id> --platform P --chat-id C [--thread-id]   notify-list [<id>]   notify-unsubscribe <id> --platform P --chat-id C
   capacity   (each cap's count against its max, and why each card waits; docs/adr/0009-board-capacity.md)
-  dispatch [--dry-run] [--max N] [--failure-limit N]   daemon [--interval S] [--max N] [--failure-limit N] [--pidfile F] [--verbose]   gc [--event-retention-days] [--log-retention-days]   repair
+  dispatching [on|off] [--reason R]   dispatch [--dry-run] [--max N] [--failure-limit N]   daemon [--interval S] [--max N] [--failure-limit N] [--pidfile F] [--verbose]   gc [--event-retention-days] [--log-retention-days]   repair
   pause [reason] · resume   (the board's emergency stop: new starts stop, running sessions go on)
 
 And:
@@ -119,38 +137,7 @@ And:
   workflow declares who may block, pause or finish a card; request-state mails its manager without changing state.
 `;
 
-const MULTI = new Set(['parent', 'skill', 'worker', 'child', 'ids', 'rm', 'tag', 'pr', 'pr-head', 'reviewed-sha', 'finding']);
-const FLAGS = new Set(['json', 'triage', 'no-notify', 'no-start', 'all', 'force', 'help', 'mine', 'archived', 'reclaim', 'dry-run',
-  'once', 'goal', 'no-goal', 'off', 'switch', 'delete', 'no-attachments', 'include-logs', 'verbose', 'commit']);
-// flags that take every following word up to the next flag (Hermes's nargs='+')
-const GREEDY = new Set(['ids', 'rm']);
-
-function parse(argv) {
-  const out = { _: [] };
-  for (let i = 0; i < argv.length; i += 1) {
-    const a = argv[i];
-    if (!a.startsWith('--') || a === '--') { out._.push(a); continue; }
-    const [key, inline] = a.slice(2).split(/=(.*)/s);
-    if (FLAGS.has(key)) { out[key] = true; continue; }
-    if (GREEDY.has(key)) {
-      const values = inline !== undefined ? [inline] : [];
-      while (i + 1 < argv.length && !argv[i + 1].startsWith('--')) values.push(argv[++i]);
-      (out[key] ??= []).push(...values);
-      continue;
-    }
-    const value = inline ?? argv[++i];
-    if (value === undefined) throw new Error(`--${key} needs a value`);
-    if (MULTI.has(key)) (out[key] ??= []).push(value);
-    else out[key] = value;
-  }
-  return out;
-}
 
-function homeOf(args) {
-  const root = args.root ?? process.env.SUPERCODE_ORCHESTRATOR_HOME ?? process.env.HERMES_HOME;
-  if (!root) throw new Error('which home? --root <home> (or SUPERCODE_ORCHESTRATOR_HOME)');
-  return resolve(root);
-}
 
 const SLUG = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 
@@ -164,7 +151,7 @@ const currentFile = (root) => join(root, 'kanban', 'current');
 
 /** The board a verb acts on, as Hermes resolves it. */
 function boardOf(root, args) {
-  for (const want of [args.board, process.env.HERMES_KANBAN_BOARD, existsSync(currentFile(root)) ? readFileSync(currentFile(root), 'utf8').trim() : null]) {
+  for (const want of [args.board, current().facts.HERMES_KANBAN_BOARD, existsSync(currentFile(root)) ? readFileSync(currentFile(root), 'utf8').trim() : null]) {
     if (!want) continue;
     const slug = normalSlug(want);
     if (slug === DEFAULT_BOARD || boardExists(root, slug) || existsSync(metaPath(root, slug))) return slug;
@@ -224,9 +211,10 @@ function counts(root, slug) {
 
 /** The home's lanes (profiles' workers) and board settings (the root config's `kanban:` block), as the IR reads them. */
 async function laneState(root) {
-  const orchestration = await read(root);
+  // the home as the owner holds it (workflow.mjs readHome), read again only after a file it is decoded from changed
+  const orchestration = await readHome(root);
   // the board's settings are its workflow's params (the instance's, under the home's own `kanban:` keys)
-  const entry = useWorkflow(root, workflowEntry(orchestration));
+  const entry = useWorkflow(root, Object.assign(workflowEntry(orchestration), { orchestration }));
   const settings = boardSettings(entry.params);
   const tick = Number(evaluate(entry.workflow.dispatch.tick, { params: entry.params }));
   if (tick > 0) settings.interval = tick;
@@ -237,43 +225,43 @@ async function laneState(root) {
 // The calling session's own address, as its actor is named: no fleet scan (a `message list` costs seconds).
 // the address the board recorded for the calling session when it launched it (a verb mailed from another machine
 // runs on the board's machine as its sender, whose address names the sender's machine)
-let recordedCaller = null;
 function callerAddress() {
   const id = callerSession();
   if (!id) return null;
-  return recordedCaller ?? boardCaller()?.address ?? `sc:${localMachine()}:${id === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code'}:${id}`;
+  return current().recorded ?? boardCaller()?.address ?? `sc:${localMachine()}:${id === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code'}:${id}`;
 }
 
-const callerName = () => process.env.HERMES_PROFILE || process.env.USER || 'user';
+const callerName = () => current().facts.HERMES_PROFILE || current().facts.USER || 'user';
 
 /**
  * C4: who the caller is as a principal, as a card's `created_by` records it: its agent (a relaunch keeps it), the
  * automation running it, its own plain session, or the person its Teams login names. Never the OS user; null when
  * nothing names one.
  */
-function callerPrincipal(root, sid, { teams = false } = {}) {
-  if (process.env.SUPERCODE_AGENT_ID) return `agent:${process.env.SUPERCODE_AGENT_ID}`;
-  if (process.env.SUPERCODE_AUTOMATION) return `automation:${process.env.SUPERCODE_AUTOMATION}`;
+async function callerPrincipal(root, sid, { teams = false } = {}) {
+  const facts = current().facts;
+  if (facts.SUPERCODE_AGENT_ID) return `agent:${facts.SUPERCODE_AGENT_ID}`;
+  if (facts.SUPERCODE_AUTOMATION) return `automation:${facts.SUPERCODE_AUTOMATION}`;
   if (sid) {
     const harness = boardCaller()?.harness ?? (sid === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code');
     const owner = agentRunForSession(root, [`${harness}:${sid}`]);
     if (owner) return `agent:${owner.agent_id}`;
     // a session an agent declared elsewhere owns (a manager's main session) is that agent's, as Teams records it
     let declared = null;
-    try { declared = agentDoor('session', [`${harness}:${sid}`], { context: process.env.SUPERCODE_CONTEXT }).data?.agent?.id ?? null; } catch { /* no Teams: the session */ }
+    try { declared = (await agentDoor('session', [`${harness}:${sid}`], { context: current().facts.SUPERCODE_CONTEXT })).data?.agent?.id ?? null; } catch { /* no Teams: the session */ }
     return declared ? `agent:${declared}` : `session:${callerAddress()}`;
   }
   if (!teams) return null;
-  const scope = agentScope(process.env.SUPERCODE_CONTEXT);
+  const scope = agentScope(current().facts.SUPERCODE_CONTEXT);
   return !scope.offline && scope.principal ? `person:${scope.principal}` : null;
 }
 
 /** C4: a requester named by an outside id; a proven link makes them the card's sponsor, anything less is recorded unverified. */
-function requestedSponsor(args) {
+async function requestedSponsor(args) {
   if (args.sponsor) return { sponsor: args.sponsor, sponsorEvidence: args.request ? { request: args.request, by: principalOf() } : null };
   if (!args['requested-by']) return {};
   let resolved = null;
-  try { resolved = agentDoor('resolveIdentity', [args['requested-by']], { context: process.env.SUPERCODE_CONTEXT }).data; } catch { /* no Teams: unverified */ }
+  try { resolved = (await agentDoor('resolveIdentity', [args['requested-by']], { context: current().facts.SUPERCODE_CONTEXT })).data; } catch { /* no Teams: unverified */ }
   if (resolved?.classification === 'proven' && resolved.principal?.kind === 'user') {
     const link = resolved.links?.find((l) => l.classification === 'proven');
     return { sponsor: resolved.principal.id, sponsorEvidence: { observation: args['requested-by'], link: link?.id ?? null, proof: link?.proof?.kind ?? null, request: args.request ?? null, by: principalOf() } };
@@ -283,7 +271,7 @@ function requestedSponsor(args) {
 
 const tagsOf = (card) => { const tags = Array.isArray(card.tags) ? card.tags : json(card.tags, null); return Array.isArray(tags) ? tags : card.tenant ? [card.tenant] : []; };
 
-const say = (args, human, value) => { process.stdout.write(args.json ? `${JSON.stringify(value, null, 2)}\n` : `${human}\n`); };
+const say = (args, human, value) => { current().out(args.json ? `${JSON.stringify(value, null, 2)}\n` : `${human}\n`); };
 
 // Hermes's own output lines, so a reader of `hermes kanban list` reads this one
 const ICONS = { todo: '◻', ready: '▶', running: '●', scheduled: '⏱', blocked: '⊘', done: '✓', archived: '—' };
@@ -357,27 +345,14 @@ function releaseBehind() {
   if (older < 0) return { key: `${running}>${latest}`, text: `orchestrator ${running} is behind the published ${latest}; action required: ${fix}` };
   return null;
 }
-function sayReleaseBehind() {
-  const behind = releaseBehind();
-  if (behind) process.stderr.write(`board: error: ${behind.text}\n`);
-}
 
-/**
- * The verbs a session on another machine may not call on a board (through its machine's board door): running the
- * board itself (its dispatcher, its init, its repair and housekeeping, adoption) and verbs that hold the call open (a
- * watch, a tail, an attach, the event stream). They are run on the board's machine. A verb the door started reads this
- * one list and refuses before it does anything.
- */
-export const NOT_FROM_ANOTHER_MACHINE = new Set(['serve', 'daemon', 'dispatch', 'init', 'adopt', 'boards', 'gc', 'repair', 'migrate', 'watch', 'tail', 'attach', 'events']);
-
-export async function runWorkflow(argv) {
+/** One verb in full, in the call it runs in (call.mjs): a caller's in the owner, or the process's own here. */
+export async function runVerb(argv) {
+  await knowLocalMachine();
   const args = parse(argv);
   const [verb, ...rest] = args._;
-  if (!verb || verb === 'help' || args.help) { process.stdout.write(HELP); return 0; }
+  if (!verb || verb === 'help' || args.help) { current().out(HELP); return 0; }
   const root = homeOf(args);
-  if (process.env.SUPERCODE_BOARD_CALL === '1' && NOT_FROM_ANOTHER_MACHINE.has(verb)) throw new Error(`${verb} is run on the board's own machine, not called from another`);
-  // the dispatcher's own verbs run every round; its serve says it once when it starts
-  if (!['dispatch', 'events'].includes(verb)) sayReleaseBehind();
   if (verb === 'events') return streamBoardPublications({root,after:args.after,once:args.once});
   // C4: one task store per Org. A named board without a store of its own is a saved view over it: its tag selects
   // the cards it shows, and a card filed through it carries that tag.
@@ -396,11 +371,13 @@ export async function runWorkflow(argv) {
   await loadWorkflow(root).catch((error) => { if (verb !== 'init' && verb !== 'boards') throw error; });
   const sid = listing && !args.mine ? null : callerSession();
   // what this command records is the calling session's act (its address, as its subscriptions name it)
-  recordedCaller = sid && boardExists(root, slug) ? withBoard((b) => b.db.prepare("SELECT json_extract(metadata, '$.supercode.address') AS address FROM task_runs WHERE json_extract(metadata, '$.supercode.session_id') = ? ORDER BY id DESC LIMIT 1").get(sid)?.address) ?? null : null;
+  current().recorded = sid && boardExists(root, slug) ? withBoard((b) => b.db.prepare("SELECT json_extract(metadata, '$.supercode.address') AS address FROM task_runs WHERE json_extract(metadata, '$.supercode.session_id') = ? ORDER BY id DESC LIMIT 1").get(sid)?.address) ?? null : null;
   if (sid) setActor(callerAddress());
-  setPrincipal(callerPrincipal(root, sid, { teams: !sid && !READS.has(verb) }));
+  setPrincipal(await callerPrincipal(root, sid, { teams: !sid && !READS.has(verb) }));
   if (sid && !READS.has(verb) && boardExists(root, slug)) {
-    withBoard((b) => { reconcileCallerLaunch(b, sid); const own = ownCard(b.db, sid); if (own) authorize(b.db, verb, rest, args, own); });
+    // binding the caller's launch is a write: only the owner, answering the caller's own verb, makes it (a local read
+    // never writes)
+    withBoard((b) => { if (isCallersCall()) reconcileCallerLaunch(b, sid); const own = ownCard(b.db, sid); if (own) authorize(b.db, verb, rest, args, own); });
   }
   // the board's workflow (the IR's): what each verb does, and who may send it, is its
   // every verb reads the board through its workflow (a list settles cards too), so every verb loads it
@@ -423,7 +400,11 @@ export async function runWorkflow(argv) {
       const source = openBoard(root, slug);
       try {
         const migrated = openZtrackBoard(preparing, { create: true, document: args.document, seed: { db: source.db, mapping }, init: layOut, root, slug });
-        migrated.close();
+        // the board's own state goes with it (its dispatching switch, its hooks cursor); its epoch is this process's
+        // (the migration holds the home's lock), which the target's first transaction stores
+        const state = (() => { try { return source.db.prepare("SELECT key, value FROM supercode_board_state WHERE key != 'owner_epoch'").all(); } catch { return []; } })();
+        try { migrated.tx((db) => { db.exec('CREATE TABLE IF NOT EXISTS supercode_board_state (key TEXT PRIMARY KEY, value TEXT)'); for (const row of state) db.prepare('INSERT INTO supercode_board_state (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(row.key, row.value); }); }
+        finally { migrated.close(); }
       } finally { source.close(); }
       renameSync(`${preparing}.board.db`, `${paths.ztrack}.board.db`);
       renameSync(preparing, paths.ztrack);
@@ -433,6 +414,8 @@ export async function runWorkflow(argv) {
       return 0;
     }
     case 'init': {
+      // a malformed switch is refused before anything is made
+      if (args.dispatching !== undefined && !['on', 'off'].includes(args.dispatching)) throw new Error('--dispatching takes on or off; nothing was made');
       // A board on the ztrack backing is made with what its ztrack.json declares besides its document: `--commit` (the
       // documents live in a git checkout, each write committed and pushed), its manager (`--manager`, else the first one
       // the home's workflow names), whose own writes it does not commit, and the archive's rotation. A board already there
@@ -464,6 +447,11 @@ export async function runWorkflow(argv) {
         const own = named(fileURLToPath(new URL('../bin/orchestrator.mjs', import.meta.url)));
         writeFileSync(record, `${JSON.stringify({ package: '@volter/supercode-orchestrator', version: own?.version ?? null, entry: own?.entry ?? null, supercode: process.env.SUPERCODE_BIN ? named(process.env.SUPERCODE_BIN) : null })}\n`);
       }
+      // its dispatching switch, set before any owner runs (an install's first start: `init --dispatching off`); while an
+      // owner runs, `workflow dispatching` is its verb
+      if (args.dispatching !== undefined) {
+        setDispatching(root, slug, args.dispatching === 'on', 'set at init');
+      }
       const backing = made.backing;
       made.close();
       const { profiles } = await laneState(root).catch(() => ({ profiles: [] }));
@@ -481,6 +469,8 @@ export async function runWorkflow(argv) {
       let workspace = args.workspace;
       if ((workspace === 'dir' || workspace === 'worktree') && meta.default_workdir) workspace = `${workspace}:${meta.default_workdir}`;
       // --goal / --no-goal are the create's words; without either, the workflow's initial decides
+      // a person filing for themselves sponsors it; an agent filing a person's request names them (proven) or records them unverified
+      const sponsorship = args.sponsor || args['requested-by'] ? await requestedSponsor(args) : principalOf()?.startsWith('person:') ? { sponsor: principalOf().slice('person:'.length) } : {};
       const created = withBoard((b) => engine.createCard(b, {
         title: rest.join(' '), body: textFrom(args['body-file'], args.body), assignee: args.assignee === 'none' ? null : args.assignee, machine: args.machine,
         workspace, branch: args.branch, parents: args.parent, priority: args.priority, tenant: args.tenant,
@@ -490,8 +480,7 @@ export async function runWorkflow(argv) {
         every: args.every ?? null, sessionId: callerSession(), subtaskOf: args['subtask-of'] ?? null, initialStatus: args['initial-status'] ?? null,
         project: args.project ?? meta.project_id ?? null, goal: args.goal ? { maxTurns: args['goal-max-turns'] ? Number(args['goal-max-turns']) : null } : args['no-goal'] ? false : null,
         tags: [...(viewTag ? [viewTag] : []), ...(args.tag ?? [])],
-        // a person filing for themselves sponsors it; an agent filing a person's request names them (proven) or records them unverified
-        ...(args.sponsor || args['requested-by'] ? requestedSponsor(args) : principalOf()?.startsWith('person:') ? { sponsor: principalOf().slice('person:'.length) } : {}),
+        ...sponsorship,
       }), true);
       await withBoardAsync(b=>engine.runEffects(b,created.effects??[]));
       let answer = { id: created.id, existing: created.existing };
@@ -566,8 +555,8 @@ export async function runWorkflow(argv) {
         return 0;
       }
       const others = boardsOf(root, { includeArchived: false }).length - 1;
-      if (others > 0) process.stdout.write(`Board: ${slug} (${others} other board${others === 1 ? '' : 's'} — \`supercode workflow boards list\`)\n\n`);
-      process.stdout.write(cards.length ? `${cards.map(line).join('\n')}\n` : '(no matching tasks)\n');
+      if (others > 0) current().out(`Board: ${slug} (${others} other board${others === 1 ? '' : 's'} — \`supercode workflow boards list\`)\n\n`);
+      current().out(cards.length ? `${cards.map(line).join('\n')}\n` : '(no matching tasks)\n');
       return 0;
     }
 
@@ -640,19 +629,19 @@ export async function runWorkflow(argv) {
         }
       }
       if (card.subscriptions.length) { out.push('', 'Notices:'); for (const s of card.subscriptions) out.push(`  → ${s.chat_id} (${s.platform === 'supercode' ? s.delivery_metadata?.role ?? 'creator' : s.platform})`); }
-      process.stdout.write(`${out.join('\n')}\n`);
+      current().out(`${out.join('\n')}\n`);
       return 0;
     }
 
     // G3: usage from each run's own harness records, summed on agents and on their sponsors
     case 'usage': {
-      const byAgent = agentUsage(root), context = process.env.SUPERCODE_CONTEXT;
-      const sponsorOf = (agent) => { try { return agentDoor('get', [agent], { context }).data.sponsor ?? null; } catch { for (const row of activeAgentAssignments(root).filter((a) => a.agent_id === agent)) { const local = localAgentRecord(root, row.org, agent); if (local) return local.identity.sponsor ?? null; } return null; } };
+      const byAgent = agentUsage(root), context = current().facts.SUPERCODE_CONTEXT;
+      const sponsorOf = async (agent) => { try { return (await agentDoor('get', [agent], { context })).data.sponsor ?? null; } catch { for (const row of activeAgentAssignments(root).filter((a) => a.agent_id === agent)) { const local = localAgentRecord(root, row.org, agent); if (local) return local.identity.sponsor ?? null; } return null; } };
       const sum = (records) => { const out = {}; for (const u of records) { const m = out[u.model] ??= { input_tokens: 0, output_tokens: 0, cache_read_tokens: 0, cache_write_tokens: 0, cost: 0 }; m.input_tokens += u.input_tokens ?? 0; m.output_tokens += u.output_tokens ?? 0; m.cache_read_tokens += u.cache_read_tokens ?? 0; m.cache_write_tokens += u.cache_write_tokens ?? 0; m.cost += u.cost?.amount ?? 0; if (u.cost?.amount != null) { m.cost_recorded = true; m.currency = u.cost.currency ?? m.currency ?? null; } else m.cost_unrecorded = true; } return out; };
       // a harness that keeps no price records tokens only: its cost reads as unrecorded, never as zero
       const line = (byModel) => Object.entries(byModel).map(([m, t]) => `${m} in ${t.input_tokens} out ${t.output_tokens} cache read ${t.cache_read_tokens} write ${t.cache_write_tokens} cost ${t.cost_recorded ? `${t.cost.toFixed(4)} ${t.currency ?? ''}${t.cost_unrecorded ? ' (some sessions unrecorded)' : ''}`.trim() : 'unrecorded'}`).join('; ');
       const agents = [...byAgent.keys()].filter((a) => !args.agent || a === args.agent);
-      const rows = agents.map((agent) => ({ agent, sponsor: args.sponsor || !args.agent ? sponsorOf(agent) : undefined, sessions: new Set(byAgent.get(agent).map((u) => u.session)).size, by_model: sum(byAgent.get(agent)) }))
+      const rows = (await Promise.all(agents.map(async (agent) => ({ agent, sponsor: args.sponsor || !args.agent ? await sponsorOf(agent) : undefined, sessions: new Set(byAgent.get(agent).map((u) => u.session)).size, by_model: sum(byAgent.get(agent)) }))))
         .filter((row) => !args.sponsor || row.sponsor === args.sponsor);
       const total = sum(rows.flatMap((row) => byAgent.get(row.agent)));
       const sponsors = [...new Set(rows.map((row) => row.sponsor).filter(Boolean))].map((sponsor) => ({ sponsor, agents: rows.filter((row) => row.sponsor === sponsor).length, by_model: sum(rows.filter((row) => row.sponsor === sponsor).flatMap((row) => byAgent.get(row.agent))) }));
@@ -661,13 +650,13 @@ export async function runWorkflow(argv) {
       return 0;
     }
 
-    case 'context': need(1, 'a card id'); process.stdout.write(`${withBoard((b) => view(b, (db) => engine.cardContext(db, id)))}\n`); return 0;
+    case 'context': need(1, 'a card id'); current().out(`${withBoard((b) => view(b, (db) => engine.cardContext(db, id)))}\n`); return 0;
 
     case 'runs': {
       need(1, 'a card id');
       const got = withBoard((b) => engine.runs(b.db, id, { stateType: args['state-type'] ?? null, stateName: args['state-name'] ?? null }));
       if (args.json) { say(args, '', got); return 0; }
-      process.stdout.write(got.length ? `${got.map((r) => `#${r.id}  ${(r.outcome || r.status).padEnd(14)} @${r.profile || '-'}  ${ts(r.started_at)}${r.ended_at ? ` → ${ts(r.ended_at)}` : ' (active)'}${r.metadata?.supercode?.address ? `  ${r.metadata.supercode.address}` : ''}${r.metadata?.supercode?.counted === false ? `  not counted: profile differs (${r.metadata.supercode.agent_profile_mismatch.differences.map((d) => d.field).join(', ')})` : ''}${r.summary ? `\n     → ${r.summary.split('\n')[0].slice(0, 160)}` : ''}`).join('\n')}\n` : `(no runs for ${id})\n`);
+      current().out(got.length ? `${got.map((r) => `#${r.id}  ${(r.outcome || r.status).padEnd(14)} @${r.profile || '-'}  ${ts(r.started_at)}${r.ended_at ? ` → ${ts(r.ended_at)}` : ' (active)'}${r.metadata?.supercode?.address ? `  ${r.metadata.supercode.address}` : ''}${r.metadata?.supercode?.counted === false ? `  not counted: profile differs (${r.metadata.supercode.agent_profile_mismatch.differences.map((d) => d.field).join(', ')})` : ''}${r.summary ? `\n     → ${r.summary.split('\n')[0].slice(0, 160)}` : ''}`).join('\n')}\n` : `(no runs for ${id})\n`);
       return 0;
     }
 
@@ -685,14 +674,14 @@ export async function runWorkflow(argv) {
     case 'assign': case 'reassign': if (args.agent) {
       // C7: a card role's assignment moves to another agent; the sessions it ran keep their identity
       need(1, 'a card id');
-      const context=process.env.SUPERCODE_CONTEXT,scope=agentDoor('scope',[],{context});
+      const context=current().facts.SUPERCODE_CONTEXT,scope=agentScope(context);
       const task=withBoard(b=>engine.getTask(b.db,id));
       if(!task)throw new Error(`no card ${id}`);
       withBoard(b=>{if(!rolesFor(b.db,id,sid,workflowFor(root).params).includes('manager'))throw new Error('Only the manager moves a card assignment between agents.');});
       const role=args.role??'implementer';
       const assignment=activeAgentAssignments(root).find(item=>item.org===scope.org&&item.kind==='card'&&item.target===id&&item.role===role);
       if(!assignment)throw new Error('declare the card role before reassigning its assignment');
-      const changed=reassignAgent(root,scope.org,assignment.id,args.agent,{context});
+      const changed=await reassignAgent(root,scope.org,assignment.id,args.agent,{context});
       withBoard(b=>tx(b,db=>event(db,id,'agent_assignment_reassigned',{assignment:assignment.id,role,from:assignment.agent_id,to:changed.agent_id})));
       say(args,`Reassigned ${id}/${role} to agent ${changed.agent_id}; sessions keep their identity`,{ok:true,assignment:changed});return 0;
     } need(2, 'a card id and a profile (or none)'); await withBoardAsync((b) => engine.set(b, id, 'assignee', rest[1] === 'none' ? null : rest[1])); say(args, `Assigned ${id} to ${rest[1] === 'none' ? '(nobody)' : rest[1]}`, { ok: true }); return 0;
@@ -753,7 +742,7 @@ export async function runWorkflow(argv) {
     }
     case 'attach': {
       need(2, 'a card id and a file');
-      const source = resolve(rest[1]);
+      const source = callerPath(rest[1]);
       if (!existsSync(source) || !statSync(source).isFile()) throw new Error(`no file ${rest[1]}`);
       const name = basename(args.name ?? source).replace(/[^A-Za-z0-9._ -]/g, '_') || 'attachment';
       const dir = join(slug === DEFAULT_BOARD ? join(root, 'kanban', 'attachments') : join(boardDir(root, slug), 'attachments'), id);
@@ -768,7 +757,7 @@ export async function runWorkflow(argv) {
       need(1, 'a card id');
       const got = withBoard((b) => engine.attachments(b.db, id));
       if (args.json) { say(args, '', got); return 0; }
-      process.stdout.write(got.length ? `${got.map((a) => `#${a.id}  ${a.filename}  ${a.size} bytes  ${ts(a.created_at)}  ${a.stored_path}`).join('\n')}\n` : `(no attachments on ${id})\n`);
+      current().out(got.length ? `${got.map((a) => `#${a.id}  ${a.filename}  ${a.size} bytes  ${ts(a.created_at)}  ${a.stored_path}`).join('\n')}\n` : `(no attachments on ${id})\n`);
       return 0;
     }
     case 'attach-rm': {
@@ -892,7 +881,7 @@ export async function runWorkflow(argv) {
     case 'diagnostics': case 'diag': {
       const { settings } = await laneState(root).catch(() => ({ settings: boardSettings({}) }));
       const fleet = observeFleet(root);
-      const publishing = boardPublishing(root);
+      const publishing = await boardPublishing(root);
       const expiredMail = mailExpiries();
       const waitingMail = mailWaiting();
       const order = ['warning', 'error', 'critical'];
@@ -903,14 +892,14 @@ export async function runWorkflow(argv) {
           .filter((d) => !args.severity || order.indexOf(d.severity) >= order.indexOf(args.severity));
       });
       if (args.json) { say(args, '', found); return 0; }
-      process.stdout.write(found.length ? `${found.map((d) => `${d.severity.padEnd(8)} ${d.task}  ${d.kind}: ${d.title}${d.actions[0] ? `\n         → ${d.actions[0]}` : ''}`).join('\n')}\n` : '(no active diagnostics)\n');
+      current().out(found.length ? `${found.map((d) => `${d.severity.padEnd(8)} ${d.task}  ${d.kind}: ${d.title}${d.actions[0] ? `\n         → ${d.actions[0]}` : ''}`).join('\n')}\n` : '(no active diagnostics)\n');
       return 0;
     }
     case 'stats': {
       const s = withBoard((b) => engine.stats(b.db));
       if (args.json) { say(args, '', s); return 0; }
       const fmt = (o) => Object.entries(o).sort().map(([k, v]) => `${k}=${v}`).join(', ') || '(none)';
-      process.stdout.write(`By status:   ${fmt(s.by_status)}\nBy assignee:\n${Object.entries(s.by_assignee).map(([a, c]) => `  ${a.padEnd(20)} ${fmt(c)}`).join('\n') || '  (none)'}\nBy machine:\n${Object.entries(s.by_machine).map(([m, c]) => `  ${m.padEnd(20)} ${fmt(c)}`).join('\n') || '  (none)'}\nOldest ready: ${s.oldest_ready_age_seconds === null ? '-' : `${Math.floor(s.oldest_ready_age_seconds / 60)}m`}\n`);
+      current().out(`By status:   ${fmt(s.by_status)}\nBy assignee:\n${Object.entries(s.by_assignee).map(([a, c]) => `  ${a.padEnd(20)} ${fmt(c)}`).join('\n') || '  (none)'}\nBy machine:\n${Object.entries(s.by_machine).map(([m, c]) => `  ${m.padEnd(20)} ${fmt(c)}`).join('\n') || '  (none)'}\nOldest ready: ${s.oldest_ready_age_seconds === null ? '-' : `${Math.floor(s.oldest_ready_age_seconds / 60)}m`}\n`);
       return 0;
     }
     case 'assignees': {
@@ -918,7 +907,7 @@ export async function runWorkflow(argv) {
       const c = withBoard((b) => engine.stats(b.db).by_assignee);
       const data = [...new Set([...profiles, ...Object.keys(c)])].sort().map((name) => ({ name, on_disk: profiles.includes(name), surface: lanes[name]?.surface ?? null, counts: c[name] ?? {} }));
       if (args.json) { say(args, '', data); return 0; }
-      process.stdout.write(`${'NAME'.padEnd(20)}  ${'ON DISK'.padEnd(8)}  ${'LANE'.padEnd(9)} COUNTS\n${data.map((e) => `${e.name.padEnd(20)}  ${(e.on_disk ? 'yes' : 'no').padEnd(8)}  ${(e.surface ?? '-').padEnd(9)} ${Object.entries(e.counts).sort().map(([k, v]) => `${k}=${v}`).join(', ') || '(idle)'}`).join('\n')}\n`);
+      current().out(`${'NAME'.padEnd(20)}  ${'ON DISK'.padEnd(8)}  ${'LANE'.padEnd(9)} COUNTS\n${data.map((e) => `${e.name.padEnd(20)}  ${(e.on_disk ? 'yes' : 'no').padEnd(8)}  ${(e.surface ?? '-').padEnd(9)} ${Object.entries(e.counts).sort().map(([k, v]) => `${k}=${v}`).join(', ') || '(idle)'}`).join('\n')}\n`);
       return 0;
     }
     case 'log': {
@@ -927,12 +916,12 @@ export async function runWorkflow(argv) {
       if (!existsSync(file)) {
         // a pane session keeps no log file: its transcript is the harness's own, named by the run
         const s = withBoard((b) => view(b, (db) => engine.lastSession(db, id)));
-        process.stdout.write(s ? `(${id} runs as session ${s.address}; its transcript is that session's: \`supercode sessions show ${s.session_id}\`)\n` : `(no log for ${id})\n`);
+        current().out(s ? `(${id} runs as session ${s.address}; its transcript is that session's: \`supercode sessions show ${s.session_id}\`)\n` : `(no log for ${id})\n`);
         return 0;
       }
       const text = readFileSync(file, 'utf8');
       const tail = args.tail ? Number(args.tail) : null;
-      process.stdout.write(tail ? text.slice(-tail) : text);
+      current().out(tail ? text.slice(-tail) : text);
       return 0;
     }
     case 'tail': case 'watch': {
@@ -951,7 +940,7 @@ export async function runWorkflow(argv) {
           if (kinds && !kinds.has(e.kind)) continue;
           if (args.assignee && e.assignee !== args.assignee) continue;
           if (args.tenant && e.tenant !== args.tenant) continue;
-          process.stdout.write(`[${ts(e.created_at)}] ${verb === 'watch' ? `${e.task_id} ` : ''}${e.kind}${e.payload ? ` ${e.payload}` : ''}\n`);
+          current().out(`[${ts(e.created_at)}] ${verb === 'watch' ? `${e.task_id} ` : ''}${e.kind}${e.payload ? ` ${e.payload}` : ''}\n`);
         }
         await new Promise((done) => setTimeout(done, interval));
       }
@@ -987,7 +976,7 @@ export async function runWorkflow(argv) {
     case 'notify-list': {
       const subs = withBoard((b) => engine.subscriptions(b.db, id ?? null));
       if (args.json) { say(args, '', subs); return 0; }
-      process.stdout.write(subs.length ? `${subs.map((s) => `${s.task_id}  ${s.platform}:${s.chat_id}${s.thread_id ? `#${s.thread_id}` : ''}  ${s.platform === 'supercode' ? s.delivery_metadata?.role ?? 'creator' : s.delivery_mode}  cursor=${s.last_event_id}`).join('\n')}\n` : '(no subscriptions)\n');
+      current().out(subs.length ? `${subs.map((s) => `${s.task_id}  ${s.platform}:${s.chat_id}${s.thread_id ? `#${s.thread_id}` : ''}  ${s.platform === 'supercode' ? s.delivery_metadata?.role ?? 'creator' : s.delivery_mode}  cursor=${s.last_event_id}`).join('\n')}\n` : '(no subscriptions)\n');
       return 0;
     }
 
@@ -1005,7 +994,7 @@ export async function runWorkflow(argv) {
       }
       const reports = await tick({ root, lanes, settings, params });
       if (args.json) say(args, '', reports);
-      else for (const r of reports) process.stdout.write(`${summary(r)}\n`);
+      else for (const r of reports) current().out(`${summary(r)}\n`);
       return reports.some((r) => r.error) ? 1 : 0;
     }
     case 'capacity': {
@@ -1024,7 +1013,7 @@ export async function runWorkflow(argv) {
       }
       lines.push(out.would.length ? `would start: ${out.would.join(' ')}` : 'would start: nothing');
       for (const w of out.waiting) lines.push(`${w.id}  ${w.why}`);
-      process.stdout.write(`${lines.join('\n')}\n`);
+      current().out(`${lines.join('\n')}\n`);
       return 0;
     }
     case 'deliver': {
@@ -1032,7 +1021,7 @@ export async function runWorkflow(argv) {
       // starts it after each round in a process of its own; never part of a round)
       const reports = await deliver({ root, slugs: args.board ? [slug] : null });
       if (args.json) say(args, '', reports);
-      else for (const r of reports) process.stdout.write(`${r.board}: ${r.error ? `error: ${r.error}` : `${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good, ${r.notified.length} notified`}\n`);
+      else for (const r of reports) current().out(`${r.board}: ${r.error ? `error: ${r.error}` : `${r.effects_waiting ?? 0} effect(s) waiting, ${r.effects_failed ?? 0} failed for good, ${r.notified.length} notified`}\n`);
       return reports.some((r) => r.error) ? 1 : 0;
     }
     case 'daemon': case 'serve': return serve(root, args);
@@ -1087,6 +1076,34 @@ export async function runWorkflow(argv) {
       await withBoardAsync((b) => engine.act(b, id, 'cancel', { payload: { reason: args.reason ?? rest.slice(1).join(' ') } }));
       say(args, `${id} cancelled`, { ok: true }); return 0;
     }
+    case 'run-session': {
+      // A headless worker records its harness session on its run (kanban-worker.mjs), through the owner like every board
+      // write. Only the run the owner launched for this worker: the launch's secret (in the worker's environment alone,
+      // its hash kept on the run), its card and its run are checked at the write, against the card's current, unended run.
+      need(2, 'a run id and a session id');
+      // the secret is the worker's own environment (SUPERCODE_RUN_LAUNCH, sent as a caller fact), never an argument
+      const runId = Number(id), harness = args.harness ?? null, launch = current().facts.SUPERCODE_RUN_LAUNCH ?? '', card = typeof args.task === 'string' ? args.task : '';
+      if (!Number.isSafeInteger(runId) || !SAFE_SESSION.test(rest[1]) || (harness !== null && !SAFE_SESSION.test(harness)) || !launch || !card) throw new Error('run-session takes a run id, a session id, --harness and --task, from a worker the owner launched');
+      const refused = withBoard((b) => tx(b, (db) => {
+        const row = db.prepare('SELECT r.task_id, r.ended_at, r.metadata, t.current_run_id FROM task_runs r JOIN tasks t ON t.id = r.task_id WHERE r.id = ?').get(runId);
+        const saved = json(row?.metadata, {})?.supercode ?? {};
+        if (!row || row.task_id !== card || row.ended_at != null || Number(row.current_run_id) !== runId || saved.surface !== 'headless' || !saved.launch_secret
+          || saved.launch_secret !== createHash('sha256').update(launch).digest('hex') || (saved.session_id && saved.session_id !== rest[1])) return `run ${runId} is not a launch this worker holds; nothing was recorded`;
+        engine.setRunSession(db, runId, { ...saved, session_id: rest[1], harness });
+        return null;
+      }));
+      if (refused) throw new Error(refused);
+      say(args, `run ${runId}: session ${rest[1]}`, { ok: true }); return 0;
+    }
+    case 'dispatching': {
+      // the board's dispatching switch (its owner's controller): `dispatching` says it, `dispatching on|off` sets it
+      if (id && !['on', 'off'].includes(id)) throw new Error('dispatching takes on or off');
+      // switching it is the manager's: a caller outside any session, or a session the workflow's params.managers names
+      if (id && sid && !withBoard((b) => rolesFor(b.db, '', sid, workflowFor(root).params)).includes('manager')) throw new Error(`switching dispatching is the manager's act; ${callerAddress()} is not a manager of this board (params.managers)`);
+      const state = id ? setDispatching(root, slug, id === 'on', args.reason ?? rest.slice(1).join(' ')) : dispatchingOf(root, slug);
+      say(args, `board ${slug}: dispatching ${state.on ? 'on' : 'off'}${state.at ? ` since ${state.at}` : ''}${state.by ? ` by ${state.by}` : ''}${state.reason ? ` (${state.reason})` : ''}`, { board: slug, ...state });
+      return 0;
+    }
     case 'pause': {
       if (id) {
         await withBoardAsync((b) => engine.act(b, id, 'pause', { payload: { reason: args.reason ?? rest.slice(1).join(' ') } }));
@@ -1157,10 +1174,10 @@ async function boardsVerb(root, rest, args) {
   const [action = 'list', target] = rest;
   switch (action) {
     case 'list': case 'ls': {
-      const current = boardOf(root, {});
-      const boards = boardsOf(root, { includeArchived: args.all }).map((b) => ({ ...b, is_current: b.slug === current, counts: counts(root, b.slug) }));
+      const selected = boardOf(root, {});
+      const boards = boardsOf(root, { includeArchived: args.all }).map((b) => ({ ...b, is_current: b.slug === selected, counts: counts(root, b.slug) }));
       if (args.json) { say(args, '', boards); return 0; }
-      process.stdout.write(`${''.padEnd(2)}  ${'SLUG'.padEnd(24)}  ${'NAME'.padEnd(28)}  COUNTS\n${boards.map((b) => `${(b.is_current ? '●' : ' ').padEnd(2)}  ${b.slug.padEnd(24)}  ${`${b.name}${b.archived ? ' [archived]' : ''}`.padEnd(28)}  ${Object.entries(b.counts).sort().map(([k, v]) => `${k}=${v}`).join(', ') || '(empty)'}`).join('\n')}\n\nCurrent board: ${current}\n`);
+      current().out(`${''.padEnd(2)}  ${'SLUG'.padEnd(24)}  ${'NAME'.padEnd(28)}  COUNTS\n${boards.map((b) => `${(b.is_current ? '●' : ' ').padEnd(2)}  ${b.slug.padEnd(24)}  ${`${b.name}${b.archived ? ' [archived]' : ''}`.padEnd(28)}  ${Object.entries(b.counts).sort().map(([k, v]) => `${k}=${v}`).join(', ') || '(empty)'}`).join('\n')}\n\nCurrent board: ${selected}\n`);
       return 0;
     }
     case 'create': case 'new': {
@@ -1215,7 +1232,7 @@ async function boardsVerb(root, rest, args) {
     case 'export': {
       const slug = normalSlug(target ?? boardOf(root, args));
       if (!boardExists(root, slug)) throw new Error(`board '${slug}' has no database`);
-      const out = resolve(args.output ?? `${slug}.tar.gz`);
+      const out = callerPath(args.output ?? `${slug}.tar.gz`);
       const made = exportBoard(root, slug, out, { attachments: !args['no-attachments'], logs: Boolean(args['include-logs']) });
       say(args, `Exported board '${slug}' → ${out}\n  Tasks:       ${made.counts.tasks}\n  Comments:    ${made.counts.task_comments}\n  Attachments: ${made.counts.attachment_files}`, made);
       return 0;
@@ -1242,6 +1259,8 @@ const TABLES = ['tasks', 'task_links', 'task_comments', 'task_events', 'task_run
  */
 function scrub(db) {
   db.exec('DELETE FROM kanban_notify_subs');
+  // a fencing token is the home's runtime custody, never a board's portable data (fence.mjs)
+  db.exec("CREATE TABLE IF NOT EXISTS supercode_board_state (key TEXT PRIMARY KEY, value TEXT); DELETE FROM supercode_board_state WHERE key = 'owner_epoch'");
   db.exec(`UPDATE tasks SET claim_lock = NULL, claim_expires = NULL, worker_pid = NULL, current_run_id = NULL, last_heartbeat_at = NULL,
            session_id = NULL, project_id = NULL, consecutive_failures = 0, last_failure_error = NULL`);
   db.exec("UPDATE tasks SET status = 'ready' WHERE status = 'running'");
@@ -1318,6 +1337,10 @@ function importBoard(root, archive, as) {
     const name = staged.name || manifest.board_name || slug;
     writeMeta(root, slug, { name, description: staged.description ?? '', icon: staged.icon ?? '', color: staged.color ?? '', archived: false });
     const warnings = [];
+    // the landed store keeps no other home's epoch: it is dropped before the board's first (fenced) transaction, which
+    // stores this process's (an import holds the home's lock)
+    const landed = new DatabaseSync(join(dest, 'kanban.db'));
+    try { landed.exec("CREATE TABLE IF NOT EXISTS supercode_board_state (key TEXT PRIMARY KEY, value TEXT); DELETE FROM supercode_board_state WHERE key = 'owner_epoch'"); } finally { landed.close(); }
     const b = openBoard(root, slug);
     let counts;
     try {
@@ -1456,6 +1479,96 @@ export function summary(r) {
  * re-read every tick, so a profile's change takes effect without a restart). Card claims
  * are version-checked by the backing; the dispatcher takes no file lock.
  */
+/** Record the board's dispatching switch: on or off, by whom and why, as one row of its state. */
+function setDispatching(root, slug, on, reason) {
+  const value = { on, by: actorOf() ?? principalOf() ?? null, at: new Date().toISOString(), reason: reason || null };
+  const board = openBoard(root, slug);
+  try {
+    tx(board, (db) => {
+      db.exec('CREATE TABLE IF NOT EXISTS supercode_board_state (key TEXT PRIMARY KEY, value TEXT)');
+      db.prepare("INSERT INTO supercode_board_state (key, value) VALUES ('dispatching', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(JSON.stringify(value));
+    });
+  } finally { board.close(); }
+  return value;
+}
+
+/**
+ * The owner's door: every card verb on this home's boards, from the CLI and the machine daemon's board door, answered
+ * here in a call of its own (call.mjs), with the home this process holds. One owner per home, by an OS lock held for
+ * its whole life by a holder process of its own (an exclusive SQLite lock on `<home>/board.lock`, released when the
+ * owner ends and the holder's standard input closes): a second serve refuses, and only the lock's owner removes and
+ * binds the socket.
+ */
+async function answerVerbs(root, log) {
+  const home = boardHome(root);
+  const lockPath = join(home, 'board.lock');
+  // The lock is held by a process of its own (lock-holder.mjs), so nothing this process reads can drop it; a verb
+  // naming the lock or socket as its input is refused (owner-files.mjs)
+  let lock;
+  try { lock = await holdLock(lockPath, { onLost: (error) => { log(`${error.message}: this home has no owner now; stopping`); process.exit(1); } }); }
+  catch (error) { throw new Error(`the boards of ${root} already have their owner (${lockPath} is held: ${error.message}); one serve per home`); }
+  ownHome(home);
+  // the lock held, this owner takes its fencing epoch and fences every board, before it answers anything (fence.mjs)
+  const epoch = takeEpoch(root, () => listBoards(root).map((slug) => openBoard(root, slug)));
+  log(`owner epoch ${epoch}`);
+  const path = boardOwnerSocket(root);
+  try { unlinkSync(path); } catch { /* none left */ }
+  // allowHalfOpen: a caller that ends its side after its request still gets the answer, written when it is ready
+  const server = createServer({ allowHalfOpen: true }, (socket) => {
+    let input = '';
+    socket.setEncoding('utf8');
+    socket.on('error', () => { /* the caller went away */ });
+    socket.on('data', (chunk) => {
+      if (input === null) return;
+      input += chunk;
+      const end = input.indexOf('\n');
+      if (end < 0) return;
+      const line = input.slice(0, end);
+      input = null;
+      // one answer per call, whatever the request did: a request that fails is a failed answer, never the owner's end
+      answerOne(root, line)
+        .catch((error) => ({ code: 1, stdout: '', stderr: `supercode workflow: ${error?.message ?? error}\n` }))
+        .then((answer) => { if (!socket.destroyed) socket.end(`${JSON.stringify(answer)}\n`); });
+    });
+  });
+  await new Promise((done, fail) => { server.once('error', fail); server.listen(path, () => { server.off('error', fail); done(); }); });
+  try { chmodSync(path, 0o600); } catch { /* the home is the user's own */ }
+  log(`answering the card verbs of ${root} at ${path}`);
+  return () => { server.close(); try { unlinkSync(path); } catch { /* gone */ } lock.release(); };
+}
+
+/** One request to the owner, answered whole: the verb run in the caller's call, its output kept for the answer. */
+async function answerOne(root, line) {
+  try {
+    const request = JSON.parse(line);
+    const tool = request?.tool && typeof request.tool.name === 'string' ? request.tool : null;
+    const argv = tool ? ['tool'] : Array.isArray(request?.argv) && request.argv.every((arg) => typeof arg === 'string') ? request.argv : null;
+    if (request?.v !== 1 || !argv?.length) return { code: 1, stdout: '', stderr: 'supercode workflow: a request names a verb\n' };
+    const verb = parse(argv)._[0];
+    if (BOARD_OPERATION_VERBS.has(verb)) return { code: 1, stdout: '', stderr: `supercode workflow: ${verb} is run on the board's machine as its own act, not sent to the owner\n` };
+    const session = request.session && typeof request.session.id === 'string' && ['claude-code', 'codex'].includes(request.session.harness) ? request.session : null;
+    const caller = typeof request.caller === 'string' ? request.caller : session ? `sc:${localMachine()}:${session.harness}:${session.id}` : null;
+    const facts = Object.fromEntries(Object.entries(request.facts ?? {}).filter(([key, value]) => CALLER_FACTS.includes(key) && typeof value === 'string'));
+    // a caller names its Teams context (the CLI and the daemon always do): one that names none is refused before anything
+    // is done, never answered with the owner's
+    if (!facts.SUPERCODE_CONTEXT) return { code: 1, stdout: '', stderr: 'supercode workflow: the request names no Teams context (facts.SUPERCODE_CONTEXT); nothing was done\n' };
+    const cwd = typeof request.cwd === 'string' && request.cwd ? request.cwd : root;
+    const stdin = typeof request.stdin === 'string' ? request.stdin : null;
+    let stdout = '';
+    let stderr = '';
+    let code;
+    await within({ caller, facts, cwd, stdin, out: (text) => { stdout += text; return true; }, err: (text) => { stderr += text; return true; } }, async () => {
+      // a worker's board tool (mcp/server.mjs), answered by the board's tools in this call (board/tools.mjs)
+      if (tool) { stdout = await boardTool(root, tool.name, tool.args && typeof tool.args === 'object' ? tool.args : {}, Object.fromEntries(Object.entries(tool.env ?? {}).filter(([key, value]) => /^HERMES_(KANBAN_TASK|KANBAN_RUN_ID|KANBAN_BOARD|PROFILE)$/.test(key) && typeof value === 'string'))); code = 0; return; }
+      try { code = await runVerb([...argv, '--root', root, ...(typeof request.board === 'string' && request.board ? ['--board', request.board] : [])]); }
+      catch (error) { stderr += `supercode workflow: ${error?.message ?? error}\n`; code = 1; }
+    });
+    return { code: code ?? 0, stdout, stderr };
+  } catch (error) {
+    return { code: 1, stdout: '', stderr: `supercode workflow: ${error?.message ?? error}\n` };
+  }
+}
+
 async function serve(root, args = {}) {
   // Hermes's daemon flags: --interval seconds, --max starts per tick, --failure-limit, --pidfile, --verbose
   const override = Number(args.interval) > 0 ? { interval: Number(args.interval) } : {};
@@ -1471,7 +1584,7 @@ async function serve(root, args = {}) {
   const kept = join(root, 'logs', 'workflow-serve.log');
   const log = (text) => {
     const line = `${new Date().toISOString()} ${text}\n`;
-    process.stdout.write(line);
+    current().out(line);
     try { mkdirSync(join(root, 'logs'), { recursive: true }); appendFileSync(kept, line); } catch { /* the pane still has it */ }
   };
   // the orchestrator this serve runs, as installed: a newer install ends the serve after its tick, so whatever keeps it
@@ -1501,7 +1614,7 @@ async function serve(root, args = {}) {
       // the same kind as rounds that stopped, so it goes where every board verb's error line reads it. Only a refusal
       // in hand counts: the team's 4xx answer, which the daemon records with the publication (from supercode-teams
       // 0.3.44). An attempt still being retried, or a daemon that records no answer, says nothing here.
-      const held = boardPublishing(root)?.failing;
+      const held = (await boardPublishing(root))?.failing;
       const refused = held && Number(held.status) >= 400 && Number(held.status) < 500 ? held : null;
       const heldLine = refused ? [`publishing to the team is held: the team refused ${refused.card}'s ${refused.kind} (sequence ${refused.sequence}) with ${refused.status}${refused.code ? ` ${refused.code}` : ''}: ${String(refused.error ?? '').split('\n')[0].slice(0, 200)} (tried ${refused.attempts} time(s)); nothing of this home after it is published until the team takes it`] : [];
       const temporary = `${heartbeat}.${process.pid}.tmp`;
@@ -1530,13 +1643,25 @@ async function serve(root, args = {}) {
     }
   };
   const running = installed();
-  log(`dispatching the boards of ${root} from ${localMachine()} (orchestrator ${running ?? 'unknown'})`);
+  await knowLocalMachine();
+  // The board's owner: it answers every card verb on this home's boards (answerVerbs) for as long as it runs, whether
+  // or not it dispatches.
+  // the held home is read again on its next use after a file it is decoded from changes (file events, no interval),
+  // watched before anything reads it; a watch that cannot be kept stops the owner, for its keeper to start it again
+  const unfollowHome = followHome(root, {
+    onChange: (name) => log(`home changed (${name}): read again on its next use`),
+    onLost: (error) => { log(`the home's files can no longer be watched (${error.message}); stopping, for the keeper to start the owner again`); stop(); },
+  });
+  let closeVerbs;
+  try { closeVerbs = await answerVerbs(root, log); } catch (error) { unfollowHome(); throw error; }
+  log(`owning the boards of ${root} on ${localMachine()} (orchestrator ${running ?? 'unknown'}); dispatching where a board's dispatching is on (\`supercode workflow dispatching\`)`);
   events = watchBoard({ root, binary: supercodeBin(), env: commandEnv(), log });
   // The board's events are published by this machine's connector, not by the dispatcher (D137, D138 step 4): the home is
   // named to the daemon once, and the connector follows its `workflow events` from then on, with or without this serve.
-  { const named = runtimeDoor(null, 'harness.v1.boards.register', { root }, { timeout: 30_000 });
-    const refused = named.code === 0 ? JSON.parse(named.stdout || '{}').refused ?? null : null;
-    log(named.code !== 0 ? `board events: not published; the machine daemon did not take this home: ${(named.stderr || named.stdout).trim().split('\n').at(-1)}`
+  { let named = null, refusal = null;
+    try { named = await machineCall(null, 'harness.v1.boards.register', { root }, { timeoutMs: 30_000 }); } catch (error) { refusal = error.message; }
+    const refused = named?.refused ?? null;
+    log(refusal ? `board events: not published; the machine daemon did not take this home: ${refusal}`
       : refused ? `board events: registered, but the team refused this machine's credential (${refused.status}); nothing is published until it is re-enrolled`
       : `board events: this home is published by the machine's connector`); }
   log('dispatch wakes on board writes, document edits and board mail; the interval sweep reads each machine\'s own door');
@@ -1559,14 +1684,23 @@ async function serve(root, args = {}) {
       if (wakeReason) log(`dispatch wake ${wakeReason.sources.join(', ')}; event age ${began - wakeReason.at}ms`);
       wakeReason = null;
       try {
-        const state = await laneState(root);
+        const state = await ownCall(() => laneState(root));
         const settings = { ...state.settings, ...override };
         interval = settings.interval;
-        const reports = await tick({ root, lanes: state.lanes, settings, params, deploymentReceipt: true });
-        round += 1;
-        // what the round recorded is delivered by a pass of its own, which this loop never waits for
-        if (!stopped) startDelivery(root, { log: (level, line) => { if (level === 'warn' || args.verbose) log(line); } });
-        if (!stopped) await watchRounds(reports);
+        // Publishing is the owner's, dispatching or not: what a writer outside this process marked changed is published
+        // on the wake its write caused, and the retained history kept bounded (store.mjs publishMarked).
+        const published = await ownCall(async () => publishMarked(root));
+        if (published && args.verbose) log(`published ${published} card(s) a writer outside the owner changed`);
+        // Dispatching is a controller over the boards whose own state says it is on; the owner answers verbs either way.
+        const dispatching = listBoards(root).filter((slug) => dispatchingOf(root, slug).on);
+        const reports = dispatching.length ? await ownCall(() => tick({ root, lanes: state.lanes, settings, params, slugs: dispatching, deploymentReceipt: true })) : [];
+        // with dispatching off on every board the owner only answers verbs: no round, no delivery, nothing told
+        if (dispatching.length) {
+          round += 1;
+          // what the round recorded is delivered by a pass of its own, which this loop never waits for
+          if (!stopped) startDelivery(root, { slugs: dispatching, log: (level, line) => { if (level === 'warn' || args.verbose) log(line); } });
+          if (!stopped) await watchRounds(reports);
+        }
         for (const r of reports) {
           nextMailAt = Math.min(nextMailAt, r.next_mail_at ?? Infinity);
           const said = summary(r);
@@ -1606,6 +1740,9 @@ async function serve(root, args = {}) {
       if (moved) { log(`orchestrator ${moved} is installed (this serve runs ${running}); stopping, for its keeper to start the new one`); break; }
     }
   } finally {
+    closeVerbs();
+    unfollowHome();
+    await closeDoors();
     events?.close();
     for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.off(signal, stop);
     if (args.pidfile) { try { unlinkSync(args.pidfile); } catch { /* gone */ } }