@volter/supercode-orchestrator 0.5.73 → 0.5.75

package/board/dispatch.mjs

@@ -28,9 +28,9 @@ import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, review
 import { runtimeDoor } from './runtime-door.mjs';
 import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, activeAgentAssignments,finishAgentAssignment,handOffAgents, agentRunForSession } from '../agents.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
-import { memorySnapshotSync } from '../hermes-cli.mjs';
+import { memorySnapshot } from '../hermes-cli.mjs';
 import { createRequire } from 'node:module';
-import { spawn as spawnChild, spawnSync } from 'node:child_process';
+import { spawn as spawnChild, execFile } from 'node:child_process';
 import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir, hostname, tmpdir, totalmem } from 'node:os';
 import { basename, dirname, join } from 'node:path';
@@ -81,14 +81,27 @@ export function commandEnv(as = null) {
   return { ...process.env, ...(as ? { SUPERCODE_CALLER: as } : {}) };
 }
 
+/**
+ * A `supercode` command the board runs as itself (a card's pane started or closed: `open … --pane`, `close`), started
+ * and awaited without holding this process's event loop: the owner answers verbs while it runs. `as`: the board this
+ * command acts for, so a card's pane is started and closed by its board, whichever session ran the board's verb.
+ * (Gap A31: these two are still helper processes; the daemon's launch and close doors replace them.)
+ */
 function sc(args, { input = null, timeout = 120_000, as = null } = {}) {
-  // `as`: the board this
-  // command acts for, so a card's pane is started and closed by its board, whichever session ran the board's verb
   const env = commandEnv(as);
   const started = performance.now();
-  const r = spawnSync(supercodeBin(), args, { cwd: tmpdir(), input: input ?? undefined, encoding: 'utf8', timeout, env, maxBuffer: 512 * 1024 * 1024 });
-  noteStep(`supercode ${args[0]}`, performance.now() - started);
-  return { code: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + (r.error ? r.error.message : '') };
+  return new Promise((resolve) => {
+    let stdout = '', stderr = '', done = false;
+    const child = spawnChild(supercodeBin(), args, { cwd: tmpdir(), env, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+    const finish = (code, extra = '') => { if (done) return; done = true; clearTimeout(timer); noteStep(`supercode ${args[0]}`, performance.now() - started); resolve({ code, stdout, stderr: stderr + extra }); };
+    const timer = setTimeout(() => { child.kill('SIGKILL'); finish(null, `supercode ${args[0]} did not answer within ${timeout} ms`); }, timeout);
+    child.stdout.setEncoding('utf8').on('data', (chunk) => { stdout += chunk; });
+    child.stderr.setEncoding('utf8').on('data', (chunk) => { stderr += chunk; });
+    child.on('error', (error) => finish(null, error.message));
+    child.on('close', (code) => finish(code));
+    child.stdin.on('error', () => {});
+    child.stdin.end(input ?? undefined);
+  });
 }
 
 const lastJson = (text) => {
@@ -122,7 +135,7 @@ export function callerSession() {
 
 /** The fleet as the home's machines answer for themselves (machine-fleet.mjs): this machine, and every machine an open
  * card of the home names or one of its notice subscribers is on. */
-export function observeFleet(root = fleetRoot) {
+export async function observeFleet(root = fleetRoot) {
   const machines = new Set();
   for (const slug of root ? listBoards(root) : []) {
     try {
@@ -134,7 +147,7 @@ export function observeFleet(root = fleetRoot) {
       } finally { b.close(); }
     } catch { /* its own tick reports it */ }
   }
-  const fleet = readMachineFleet(machines, localMachine());
+  const fleet = await readMachineFleet(machines, localMachine());
   presenceReading = { known: fleet.presenceKnown === true, online: new Set([localMachine(), ...fleet.online]), unknown: fleet.unknown ?? new Set() };
   notePresence(presenceReading);
   return fleet;
@@ -155,7 +168,6 @@ const HARNESSES = {
 const doorTransient = (r) => r.code === null || ['unavailable', 'machine_offline', 'rate_limited', 504, '504', 'ETIMEDOUT', 'ECONNRESET', 'EAI_AGAIN'].includes(json(String(r.stderr ?? '').trim().split('\n').pop(), null)?.code);
 const adoptedOnly = (s) => s?.mode === 'adopt' && !s.launch_key && s.surface !== 'headless';
 const addressOf = (s) => s?.address ?? (s?.session_id && s.machine ? `sc:${s.machine}:${s.harness ?? 'claude-code'}:${s.session_id}` : null);
-const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 
 // A session in a live pane of its machine is the fleet's reading; any other run is read on its own machine: a headless
 // worker by its pid, a pane by that machine's pane list, a session in no pane (an adopted native one) by that machine's
@@ -163,8 +175,16 @@ const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0,
 const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ? fleet.native.get(addressOf(session)).alive : unpublishedAlive(session);
 /** A subscriber's address as the session it names, for sessionAlive (its machine, harness and native id). */
 const sessionAt = (address) => { const m = /^sc:([^:]+):([^:]+):(.+)$/.exec(String(address)); return m && HARNESSES[m[2]] ? { address, machine: normalMachine(m[1]), harness: m[2], session_id: m[3] } : null; };
-const subscriberAlive = (fleet, address) => fleet.alive.has(address) || (sessionAt(address) ? sessionAlive(fleet, sessionAt(address)) === true : false);
+/** A subscriber's liveness, read first (readBefore): true, false, or null when it could not be read (unknown, never dead). */
+async function subscriberAlive(fleet, address) {
+  if (fleet.alive.has(address)) return true;
+  const session = sessionAt(address);
+  if (!session) return false;
+  await readBefore(fleet, session);
+  return sessionAlive(fleet, session) ?? null;
+}
 const paneLists = new Map();
+/** A session the fleet reading did not publish: alive by what was read of it before (readBefore), else unknown (null). */
 function unpublishedAlive(session) {
   if (!session) return null;
   if (session.surface === 'headless' && session.pid) return pidAlive(session.pid);
@@ -173,50 +193,59 @@ function unpublishedAlive(session) {
     if (!session.session_id) return null;
     try { return nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code', session.session_id), session).alive; } catch { return null; }
   }
-  let entry = paneLists.get(session.machine);
-  if (!entry || Date.now() - entry.at > READING_MS) {
-    if (readingsOnly) return null;
-    const r = doorOn(session.machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
-    const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
-    entry = { at: Date.now(), panes: Array.isArray(panes) ? panes : null };
-    paneLists.set(session.machine, entry);
-  }
+  const entry = paneLists.get(session.machine);
+  if (!entry || Date.now() - entry.at > READING_MS) return null;
   return entry.panes ? entry.panes.some((p) => p.pane === session.pane && !p.dead) : null;
 }
+/** A machine's pane list, read through its door (one reading serves READING_MS). */
+async function readPaneList(machine) {
+  const entry = paneLists.get(machine);
+  if (entry && Date.now() - entry.at <= READING_MS) return entry;
+  const r = await doorOn(machine, 'harness.v1.panes.list', {}, { timeout: 60_000 });
+  const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
+  const read = { at: Date.now(), panes: Array.isArray(panes) ? panes : null };
+  paneLists.set(machine, read);
+  return read;
+}
 
 /** Native activity comes from the machine's harness discovery, not catalogue age: each session the round reads is
  * discovered by its id (about 0.2 s), once per round (tick clears them). Listing the machine's every session to find
  * them (up to 2000, 1-6 s each) cost more than the sessions a board runs. */
 const discoveries = new Map();
 // A machine's pane list and harness discovery are read before a board write opens, never inside one: a door that
-// takes seconds would hold the board's write lock past a worker's own command's busy wait. A write that needs a
-// reading not taken yet reads it as unknown. One reading serves READING_MS.
+// takes seconds would hold the board's write lock past a worker's own command's busy wait. Reading is async (readNative,
+// readPaneList, readBefore: the doors in this process, never holding the event loop); every decision reads what was
+// read (nativeSessions, unpublishedAlive, sessionAlive), and a reading not taken yet is unknown. One reading serves
+// READING_MS.
 const READING_MS = 15_000;
-let readingsOnly = 0;
-const txRead = (board, fn) => { readingsOnly += 1; try { return tx(board, fn); } finally { readingsOnly -= 1; } };
-/** Take the readings a board write about `session` will need, before the write. */
-function readBefore(fleet, session) {
-  if (!session?.session_id || !session.machine || session.surface === 'headless') return;
-  try { nativeSessions(session.machine, session.harness ?? 'claude-code', session.session_id); } catch { /* unread: unknown inside the write */ }
-  sessionAlive(fleet, session);
-}
+const txRead = (board, fn) => tx(board, fn);
+/** Take the readings a decision or a board write about `session` will need, before it. */
+async function readBefore(fleet, session) {
+  if (!session?.machine || session.surface === 'headless') return;
+  if (session.session_id) try { await readNative(session.machine, session.harness ?? 'claude-code', session.session_id); } catch { /* unread: unknown */ }
+  if (session.pane && !fleet?.native?.has(addressOf(session))) await readPaneList(session.machine);
+}
+/** A session's native discovery as this round read it (readNative); throws (unavailable) when it was not read. */
 function nativeSessions(machine, harness, sessionId) {
+  const seen = discoveries.get(nativeKey(machine, harness, sessionId));
+  if (seen) return seen.sessions;
+  throw unavailable('native liveness is read before it is used (readBefore), and was not');
+}
+/** Read a session's native discovery through its machine's door, once a round. */
+async function readNative(machine, harness, sessionId) {
   const key = nativeKey(machine, harness, sessionId), seen = discoveries.get(key);
   if (seen) return seen.sessions;
-  if (readingsOnly) throw unavailable('native liveness is read before a board write, not inside it');
-  const sessions = discoverNative(machine, harness, sessionId);
+  const sessions = await discoverNative(machine, harness, sessionId);
   discoveries.set(key, { at: Date.now(), sessions });
   return sessions;
 }
 // A native discovery is bounded as the fleet reading is: one that does not answer in time is unknown, read next round.
 const NATIVE_DISCOVERY_MS = 15_000;
 const nativeKey = (machine, harness, sessionId) => `${normalMachine(machine)}\u0000${harness}\u0000${sessionId}`;
-function discoverNative(machine, harness, sessionId) {
+async function discoverNative(machine, harness, sessionId) {
   if (offlineMachine(machine)) throw unavailable(`native liveness unavailable: machine ${normalMachine(machine)} is offline`);
-  // This machine's discovery is its harness door, as every other harness read here is; another machine's is supercode's fleet arm
-  const result = normalMachine(machine) === localMachine()
-    ? doorOn(machine, 'harness.v1.sessions.discover', { harnesses: [harness], query: sessionId, limit: 2000 }, { timeout: NATIVE_DISCOVERY_MS })
-    : sc(['discover', '--on', machine, '--harness', harness, '--query', sessionId, '--limit', '2000'], { timeout: NATIVE_DISCOVERY_MS });
+  // the machine's own harness door, this one's or another's, as every other harness read here is
+  const result = await doorOn(machine, 'harness.v1.sessions.discover', { harnesses: [harness], query: sessionId, limit: 2000 }, { timeout: NATIVE_DISCOVERY_MS });
   const page = result.code === 0 ? lastJson(result.stdout) : null;
   if (!Array.isArray(page?.sessions)) throw unavailable(`native liveness unavailable on ${machine}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
   return page.sessions;
@@ -299,27 +328,28 @@ const offlineMachine = (machine) => {
   return m !== localMachine() && presenceReading?.known === true && !presenceReading.online.has(m);
 };
 /** A machine's public door (`harness.v1.*`), answered at once when the machine reads as offline. */
-const doorOn = (machine, method, params, options) => offlineMachine(machine)
+const doorOn = async (machine, method, params, options) => offlineMachine(machine)
   ? { code: 1, stdout: '', stderr: JSON.stringify({ code: 'machine_offline', message: `machine ${normalMachine(machine)} did not answer the fleet reading` }) }
-  : runtimeDoor(normalMachine(machine ?? localMachine()) === localMachine() ? null : machine, method, params, options);
+  : await runtimeDoor(normalMachine(machine ?? localMachine()) === localMachine() ? null : machine, method, params, options);
 const unavailable = message => Object.assign(new Error(message), { launchDeferred: true });
 
 // ------------------------------------------------------------------ supervise
 
-function supervise(board, fleet, settings, report, entry, effects) {
+async function supervise(board, fleet, settings, report, entry, effects) {
   const rows = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
   // Published native observations are the only liveness input. Missing data remains unknown. A launch the
   // observations show stopped is asked, through its machine's door, how it ended.
   const exits = new Map();
+  // every running session's liveness is read before anything is decided of it (unknown stays unknown)
+  for (const { id } of rows) await readBefore(fleet, currentRun(board.db, id)?.metadata?.supercode);
   for (const { id } of rows) {
     const session = currentRun(board.db, id)?.metadata?.supercode;
     if (!session?.launch_key || !fleet.ok || sessionAlive(fleet, session) !== false) continue;
     // how a keyed launch ended, where its machine keeps that record: read when it can be, never waited on
     if (!fleet.capabilities?.get(normalMachine(session.machine))?.launches) continue;
-    try { const receipt = launchReceipt(board, session); if (receipt?.live === false && receipt.exit) exits.set(id, { ...receipt.exit, launch_key: session.launch_key }); }
+    try { const receipt = await launchReceipt(board, session); if (receipt?.live === false && receipt.exit) exits.set(id, { ...receipt.exit, launch_key: session.launch_key }); }
     catch (error) { report.failed.push([id, `exit receipt unavailable; retaining liveness observation: ${error.message}`]); }
   }
-  for (const { id } of rows) readBefore(fleet, currentRun(board.db, id)?.metadata?.supercode);
   for (const { id } of rows) {
     // A transaction that meets another round's write runs again from its start: what it asks for is staged per attempt
     // and kept only once it committed, so a second round never carries out a move that was rolled back.
@@ -490,29 +520,29 @@ function limitsOf(db, board, entry, task, session) {
   return out;
 }
 
-function stopSession(board, session) {
+async function stopSession(board, session) {
   if (!session) return;
   if (boardCopyOf(board)) throw copyRefusal(board, 'closes no session');
   if (session.surface === 'headless' && pidAlive(session.pid)) {
     // SIGTERM to the worker's process group, then SIGKILL if it is still there after a grace, as Hermes stops its own
     const signal = (sig) => { try { process.kill(-session.pid, sig); } catch { try { process.kill(session.pid, sig); } catch { /* gone */ } } };
     signal('SIGTERM');
-    for (let waited = 0; waited < 10 && pidAlive(session.pid); waited += 1) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 500);
+    for (let waited = 0; waited < 10 && pidAlive(session.pid); waited += 1) await new Promise((resolve) => setTimeout(resolve, 500));
     if (pidAlive(session.pid)) signal('SIGKILL');
     return;
   }
   if (session.surface !== 'headless' && offlineMachine(session.machine)) throw new Error(`close deferred: machine ${normalMachine(session.machine)} is offline`);
   if (!session.pane && session.surface === 'native') {
-    const r = sc(['close', addressOf(session)], { timeout: 120_000, as: boardAddress(board.label) });
+    const r = await sc(['close', addressOf(session)], { timeout: 120_000, as: boardAddress(board.label) });
     if (r.code !== 0) throw new Error(`${doorTransient(r) ? 'close deferred: ' : ''}closing native session ${addressOf(session)}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
     // the close's receipt is a discovery taken after it, never the round's cached one from before
     discoveries.delete(nativeKey(session.machine, session.harness, session.session_id));
-    const reading = nativeReading(nativeSessions(session.machine, session.harness, session.session_id), session);
+    const reading = nativeReading(await readNative(session.machine, session.harness, session.session_id), session);
     if (reading.alive !== false) throw new Error(`native close has no confirmed stopped receipt for ${addressOf(session)}`);
     return;
   }
   if (session.pane) {
-    const r = runtimeDoor(normalMachine(session.machine??localMachine())===localMachine()?null:session.machine,'harness.v1.panes.close',{pane:session.pane},{env:commandEnv(),timeout:60_000,as:boardAddress(board.label)});
+    const r = await runtimeDoor(normalMachine(session.machine??localMachine())===localMachine()?null:session.machine,'harness.v1.panes.close',{pane:session.pane},{env:commandEnv(),timeout:60_000,as:boardAddress(board.label)});
     // a door that timed out or could not be reached says nothing about the pane: the close waits for the next round
     const transient = doorTransient(r);
     if (r.code !== 0 || json(r.stdout.trim(), null)?.closed !== session.pane) throw new Error(`${transient ? 'close deferred: ' : ''}closing pane ${session.pane}: ${(r.stderr || r.stdout || `exit ${r.code}`).trim().slice(-500)}`);
@@ -531,7 +561,7 @@ export function whereOf(board, task) {
 const hostOf = (pressure) => ({ memory_pressure: pressure, max_in_progress: derivedMaxInProgress() });
 
 /** What every board of the home at `root` holds now, counted for its caps (capacity.mjs). */
-function homeHoldings(root, slugs, lanes, fleet, entry) {
+async function homeHoldings(root, slugs, lanes, fleet, entry) {
   const live = (s) => fleet.sessions?.find((x) => x.address === addressOf(s)) ?? null;
   const out = [];
   for (const slug of slugs) {
@@ -539,6 +569,8 @@ function homeHoldings(root, slugs, lanes, fleet, entry) {
       const b = openBoard(root, slug);
       try {
         b.slug ??= slug; b.label ??= boardLabel(root, slug);
+        // each run's session read before it is counted live or not (unknown stays unknown)
+        for (const r of b.db.prepare('SELECT r.metadata FROM tasks t JOIN task_runs r ON r.id = t.current_run_id').all()) await readBefore(fleet, json(r.metadata, {})?.supercode);
         const storedOf = (id) => storedStatus(b.db, b, entry, id).stored;
         out.push(...holdings(b, { lanes, fleetOk: fleet.ok, alive: (s) => sessionAlive(fleet, s), liveRecord: live, modelOf: transcriptModel, storedOf, machineOf: normalMachine, home: localMachine() }));
       }
@@ -597,7 +629,7 @@ function transcriptModel(session) {
  * that matches a card must have room; capacity.mjs). Each is sent the start event (its validators are Hermes's respawn
  * guard) and what its new status runs is launched. `held` is what the home holds (homeHoldings), shared by its boards.
  */
-function startCards(board, fleet, lanes, settings, report, entry, effects, { only = null, held = [], dry = false } = {}) {
+async function startCards(board, fleet, lanes, settings, report, entry, effects, { only = null, held = [], dry = false } = {}) {
   const stop = paused(board.root);
   if (stop) { report.paused = stop; return; }
   const { workflow, params } = entry;
@@ -671,7 +703,7 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
     }
     let moved, checked;
     try {
-      checked = checkWorkspace(board, task);
+      checked = await checkWorkspace(board, task);
       moved = tx(board, (db) => {
         // The claim: another round (a second serve, a one-shot dispatch) may have started this card, or others that count
         // against the same caps, since this round read the board. Its starts are counted, and this card starts only if it
@@ -702,32 +734,75 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
     effects.push(...moved.effects);
     caps.take(waitingEntries[i]);
     try {
-      const session = launchRun(board, entry, task.id, plan.lane, fleet, settings);
+      const session = await launchRun(board, entry, task.id, plan.lane, fleet, settings);
       if (session) {
         if (session.surface !== 'pane' || normalMachine(task.machine ?? '') === localMachine()) tickState.local_started += 1;
         report.started.push([task.id, session.address ?? `pid ${session.pid}`, session.mode]);
       }
     } catch (error) {
-      if (error.launchPending) { report.queued.push([task.id, error.message]); continue; }
+      // a launch whose run ended meanwhile is no failure of the card's current run (its successor): said, nothing fired
+      if (error.launchPending || error.launchSuperseded) { report.queued.push([task.id, error.message]); continue; }
       const payload = { error: String(error.message).slice(-500), origin: originOf(error), ...(error.resumeFailed ? { resume_failed: true, ...error.resumeFailed } : {}) };
-      try { const r = tx(board, db => monitorsRuns(entry) ? (surfaceIncident(db,board,entry,task.id,'spawn_failed',payload), {effects:[]}) : fire(db, board, entry, task.id, 'spawn_failed', { roles: ['platform'], payload })); effects.push(...r.effects); } catch { /* no transition for it */ }
+      let r;
+      try { r = launchFailed(board, entry, task.id, error, payload); } catch { r = { effects: [] }; /* no transition for it */ }
+      if (!r) { report.queued.push([task.id, `run ${error.launchRun} was replaced before its launch failed: ${error.message}`]); continue; }
+      effects.push(...r.effects);
       report.failed.push([task.id, String(error.message).slice(-300)]);
     }
   }
 }
 
 /** Launch what the card's status runs: its role's lane, in the run's session slot, told the run's prompt and doors. */
-export function launchRun(board, entry, id, lane, fleet, settings) {
+/** Whether `runId` is still card `taskId`'s current, unended run: a launch's permission, read in the write it is used in. */
+function runCurrent(db, taskId, runId) {
+  return db.prepare('SELECT current_run_id FROM tasks WHERE id = ?').get(taskId)?.current_run_id === runId
+    && db.prepare('SELECT ended_at FROM task_runs WHERE id = ?').get(runId)?.ended_at == null;
+}
+const superseded = (taskId, runId) => Object.assign(new Error(`run ${runId} of ${taskId} ended or was replaced while its launch was prepared; nothing was started`), { launchSuperseded: true });
+/** A launch's preparation awaits (minting, workspace, doors) while the owner answers verbs: after each await, and right
+ *  before it is issued, the run must still be the card's current, unended one (a cancel or restart meanwhile ends it). */
+function assertRunCurrent(board, taskId, runId) {
+  if (!view(board, (db) => runCurrent(db, taskId, runId))) throw superseded(taskId, runId);
+}
+/** A write a launch makes for its run: made only while that run is still the card's current one, checked in the same
+ *  write, so a superseded launch's late result never lands on its successor's card. */
+function runTx(board, taskId, runId, fn) {
+  return tx(board, (db) => { if (!runCurrent(db, taskId, runId)) throw superseded(taskId, runId); return fn(db); });
+}
+/** A launch's failure, recorded against the run it attempted and only while that run is still the card's current one
+ *  (checked in the write that records it): a superseded launch's failure is no failure of its successor. Null when it
+ *  was superseded. */
+function launchFailed(board, entry, id, error, payload) {
+  return tx(board, (db) => {
+    if (!runCurrent(db, id, error.launchRun)) return null;
+    if (monitorsRuns(entry)) { surfaceIncident(db, board, entry, id, 'spawn_failed', payload, error.launchRun); return { effects: [] }; }
+    return fire(db, board, entry, id, 'spawn_failed', { roles: ['platform'], payload });
+  });
+}
+
+/** The card's current run's launch. Every error it ends with names that run (`launchRun`); one read when the run is no
+ *  longer the card's current one is its supersession, whatever failed, so no caller reports it against the successor. */
+export async function launchRun(board, entry, id, lane, fleet, settings) {
+  const runId = getTaskNow(board, id).current_run_id;
+  try { return await launchAttempt(board, entry, id, lane, fleet, settings, runId); }
+  catch (error) {
+    error.launchRun = runId;
+    if (!error.launchSuperseded && !view(board, (db) => runCurrent(db, id, runId))) error.launchSuperseded = true;
+    throw error;
+  }
+}
+
+async function launchAttempt(board, entry, id, lane, fleet, settings, runId) {
   let task = getTaskNow(board, id);
-  const checked = checkWorkspace(board, task);
-  if (checked) tx(board, (db) => {
+  if (task.current_run_id !== runId) throw superseded(id, runId);
+  const checked = await checkWorkspace(board, task);
+  if (checked) runTx(board, id, runId, (db) => {
     assertWorkspaceOwner(db, task, checked);
     db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.mainRoot, id);
   });
   const status = view(board, (db) => statusOf(db, task));
   const spec = runSpec(entry, status, task);
   if (!spec) return null;
-  const runId = task.current_run_id;
   const surface = lane.surface === 'pane' ? 'pane' : 'headless';
   const scope = view(board, (db) => scopeOf(db, board, task, { params: entry.params }));
   const where = whereOf(board, task);
@@ -748,8 +823,9 @@ export function launchRun(board, entry, id, lane, fleet, settings) {
     // Teams is never on a launch's path: the card's agent is its identity minted on this host under its retained intent,
     // and its sessions are joined to it off this path, after the launch. No Teams answer starts, stops or holds a card.
     const context=current().facts.SUPERCODE_CONTEXT,team=agentScope(context);
-    const agent=localCardAgent({root:board.root,org:team.org,server:team.server,profiles:entry.profiles,
+    const agent=await localCardAgent({root:board.root,org:team.org,server:team.server,profiles:entry.profiles,
       profile:lane.name,card:id,role:spec.role??slot,sponsor:task.sponsor??null});
+    assertRunCurrent(board,id,runId);
     // G3: a run of an agent over its budget does not start; the reason waits on the card until the window passes
     const budgets=[...(entry.profiles?.default?.budgets??[]),...(lane.name!=='default'?entry.profiles?.[lane.name]?.budgets??[]:[])];
     const refused=budgets.length?runBudgetRefusal(board.root,agent.identity.id,budgets,new Date().toISOString()):null;
@@ -762,12 +838,14 @@ export function launchRun(board, entry, id, lane, fleet, settings) {
     // The agent's own memory reaches every session of it: headless runs open its home; a pane, which may sit on
     // another machine, gets the home's snapshot in its first prompt. A shared profile's memory is never used.
     const agentHome=materializeAgentHome(board.root,team.org,agent.identity.id,lane);
+    assertRunCurrent(board,id,runId);
     if(surface==='headless')meta.agent_env.HERMES_HOME=agentHome;
-    else{const memory=memorySnapshotSync(agentHome);if(memory)prompt=`${prompt}\n\n${memory}`;}
+    else{const memory=await memorySnapshot(agentHome).catch(()=>'');assertRunCurrent(board,id,runId);if(memory)prompt=`${prompt}\n\n${memory}`;}
     const result = surface === 'pane'
-      ? launchPane(board, task, runId, lane, fleet, { input: prompt, slot, meta })
-      : launchHeadless(board, task, runId, lane, settings, { prompt, skills: spec.skills ?? [], meta });
+      ? await launchPane(board, task, runId, lane, fleet, { input: prompt, slot, meta })
+      : await launchHeadless(board, task, runId, lane, settings, { prompt, skills: spec.skills ?? [], meta });
     tx(board,db=>{
+      if(!runCurrent(db,id,runId))return; // replaced once launched: its session is the ended run's, closed as one
       setRunSession(db,runId,{launch_deferred:false,launch_deferred_error:null,restart_authorized:false});
       event(db,id,'restart_authorization_consumed',{},runId);
     });
@@ -777,12 +855,15 @@ export function launchRun(board, entry, id, lane, fleet, settings) {
     // An issued asynchronous launch may bind later. Its original permission
     // still belongs to this attempt, never a future lost-session restart. A
     // deferred launch was never issued: its run keeps the permission for its retry.
+    if(error.launchSuperseded||!view(board,db=>runCurrent(db,id,runId)))throw Object.assign(error,{launchSuperseded:true});
     if(!error.launchDeferred)tx(board,db=>{
+      if(!runCurrent(db,id,runId))return;
       setRunSession(db,runId,{restart_authorized:false});
       event(db,id,'restart_authorization_consumed',{},runId);
     });
     if(error.launchDeferred) {
       tx(board,db=>{
+        if(!runCurrent(db,id,runId))return;
         const previous=currentRun(db,id)?.metadata?.supercode;
         setRunSession(db,runId,{...meta,launch_deferred:true,launch_deferred_error:error.message});
         if(previous?.launch_deferred_error!==error.message)event(db,id,'launch_deferred',{reason:error.message},runId);
@@ -799,8 +880,8 @@ export async function startCard(board, id, { roles = ['manager'], lanes, setting
   // slot's session checks that session through it
   fleetRoot = board.root;
   const entry = await loadWorkflow(board.root);
-  const fleet = observeFleet();
-  const before = getTaskNow(board, id), checked = checkWorkspace(board, before);
+  const fleet = await observeFleet();
+  const before = getTaskNow(board, id), checked = await checkWorkspace(board, before);
   const moved = tx(board, (db) => {
     assertWorkspaceOwner(db, before, checked);
     if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.mainRoot, id);
@@ -817,9 +898,9 @@ export async function startCard(board, id, { roles = ['manager'], lanes, setting
   const lane = profile ? lanes[profile] : null;
   if (spec && !lane) throw new Error(`${id} is ${moved.to}, run by ${spec.role} (${profile ?? 'nobody'}), which is no lane of this home`);
   if (!lane) return null;
-  try { return launchRun(board,entry,id,lane,fleet,settings); }
+  try { return await launchRun(board,entry,id,lane,fleet,settings); }
   catch (error) {
-    if (monitorsRuns(entry) && !error.launchPending) tx(board,db=>surfaceIncident(db,board,entry,id,'spawn_failed',{error:error.message,origin:originOf(error)}));
+    if (monitorsRuns(entry) && !error.launchPending && !error.launchSuperseded) launchFailed(board, entry, id, error, { error: error.message, origin: originOf(error) });
     throw error;
   }
 }
@@ -834,11 +915,11 @@ export async function startCard(board, id, { roles = ['manager'], lanes, setting
 // The programs a harness pane runs in its foreground: Claude Code's, Codex's, and node (the daemon's Codex pane host,
 // a harness installed through npm). A pane running one of these runs a harness session, read or not.
 const HARNESS_COMMANDS = new Set(['claude', 'claude.exe', 'codex', 'codex.exe', 'node']);
-function turnAtClose(session, pane = null) {
+async function turnAtClose(session, pane = null) {
   const machine = session.machine ?? localMachine();
   let activity;
   if (pane?.pid) {
-    const r = doorOn(machine, 'harness.v1.sessions.activity_under', { pids: [pane.pid] }, { timeout: NATIVE_DISCOVERY_MS });
+    const r = await doorOn(machine, 'harness.v1.sessions.activity_under', { pids: [pane.pid] }, { timeout: NATIVE_DISCOVERY_MS });
     const page = r.code === 0 ? lastJson(r.stdout) : null;
     if (!Array.isArray(page?.activities)) return `the session in pane ${session.pane} could not be read just now (${(r.stderr || r.stdout).trim().slice(-160)})`;
     activity = page.activities.find((item) => item.pid === pane.pid)?.activity ?? null;
@@ -852,7 +933,7 @@ function turnAtClose(session, pane = null) {
     return `pane ${session.pane} names no process to read`;
   } else {
     if (!session.session_id) return 'its session is not known yet';
-    try { activity = nativeReading(discoverNative(machine, session.harness ?? 'claude-code', session.session_id), session).row?.activity ?? null; }
+    try { activity = nativeReading(await discoverNative(machine, session.harness ?? 'claude-code', session.session_id), session).row?.activity ?? null; }
     catch (error) { return `its session could not be read just now (${String(error.message).slice(0, 160)})`; }
     if (!activity) return `its session ${addressOf(session)} is not in its machine's discovery`;
   }
@@ -862,7 +943,7 @@ function turnAtClose(session, pane = null) {
   return `its session ${who} is in a turn (${activity.turn ?? 'unknown'}); it closes once the turn ends`;
 }
 
-export function closeRequested(board, report, { taskId = null, caller = null, ttl = null, fleet = null } = {}) {
+export async function closeRequested(board, report, { taskId = null, caller = null, ttl = null, fleet = null } = {}) {
   const rows = view(board, (db) => db.prepare(`SELECT id, task_id, ended_at, metadata FROM task_runs
     WHERE metadata IS NOT NULL ${taskId ? 'AND task_id = ?' : ''}`).all(...(taskId ? [taskId] : [])));
   // Repair pre-transfer history once: only identities with an older unended reference need a write.
@@ -948,17 +1029,17 @@ export function closeRequested(board, report, { taskId = null, caller = null, tt
     try {
       const machine = session.machine ?? localMachine();
       if (session.surface === 'native' && !session.pane) {
-        const reading = nativeReading(nativeSessions(machine, session.harness, session.session_id), session);
+        const reading = nativeReading(await readNative(machine, session.harness, session.session_id), session);
         if (reading.alive == null) throw new Error(`close deferred: native liveness unknown for ${addressOf(session)}`);
         if (reading.alive) {
           const protectedNow = active.some(r => addressOf(json(r.metadata, {})?.supercode) === addressOf(session));
           if (protectedNow) throw new Error('close deferred: native session is owned by an unended run');
-          if (row.ended_at) { const inTurn = turnAtClose(session); if (inTurn) throw new Error(`close deferred: ${inTurn}`); }
-          stopSession(board, session);
+          if (row.ended_at) { const inTurn = await turnAtClose(session); if (inTurn) throw new Error(`close deferred: ${inTurn}`); }
+          await stopSession(board, session);
         }
       } else {
       if (!panes.has(machine)) {
-        const r = doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000, as: boardAddress(board.label) });
+        const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000, as: boardAddress(board.label) });
         const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
         panes.set(machine, Array.isArray(list) ? { live: new Map(list.filter(p => !p.dead).map((p) => [p.pane, { pid: p.pid ?? null, command: p.activeCommand ?? null }])) } : { error: `cannot read panes on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}` });
       }
@@ -970,8 +1051,8 @@ export function closeRequested(board, report, { taskId = null, caller = null, tt
         if (protectedNow) throw new Error(`close deferred: pane ${session.pane} is owned by an unended run`);
         // An ended run's session is closed only between its turns, read last, after the claim and the pane list (a pane
         // already gone is settled above with no reading; t_f34710bc's coder was cut mid-proof at 15:01:13Z, 2026-10-04).
-        if (row.ended_at) { const inTurn = turnAtClose(session, observed.live.get(session.pane)); if (inTurn) throw new Error(`close deferred: ${inTurn}`); }
-        stopSession(board, session); observed.live.delete(session.pane);
+        if (row.ended_at) { const inTurn = await turnAtClose(session, observed.live.get(session.pane)); if (inTurn) throw new Error(`close deferred: ${inTurn}`); }
+        await stopSession(board, session); observed.live.delete(session.pane);
       }
       }
     } catch (e) {
@@ -1015,7 +1096,7 @@ export function closeRequested(board, report, { taskId = null, caller = null, tt
 
 /** Quiet time is independent of dispatch cadence and the harness's busy label.
  * Keep bounded readings on the run so an ordinary quiet stretch can be reviewed later. */
-function observeIdle(board, fleet, settings, report, entry, effects) {
+async function observeIdle(board, fleet, settings, report, entry, effects) {
   if (!fleet.ok) return;
   // The published fleet says whether a session runs and its turn, not when it last wrote: that is the session's own
   // record, read from its machine's discovery (once a round, only when a card needs it).
@@ -1027,7 +1108,7 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
   };
   const managers = [].concat(entry.params.managers ?? []).filter(Boolean);
   const running = board.db.prepare(entry.workflow.run ? "SELECT id FROM tasks WHERE current_run_id IS NOT NULL" : "SELECT id FROM tasks WHERE status = 'running'").all();
-  for (const { id } of running) { const session = currentRun(board.db, id)?.metadata?.supercode; readBefore(fleet, session); if (session?.session_id) updatedAt(session); }
+  for (const { id } of running) { const session = currentRun(board.db, id)?.metadata?.supercode; await readBefore(fleet, session); if (session?.session_id) updatedAt(session); }
   for (const { id } of running) {
     let staged = [];
     txRead(board, (db) => {
@@ -1070,8 +1151,8 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
       const held = live?.turn === 'needs_input' ? 'waiting_on_user' : live?.turn === 'working' && lastAt > 0 && observedAt - lastAt >= settings.idleQuiet ? 'working_silent' : null;
       if (held) {
         if (session.idle_observation?.decision === held && session.idle_observation.last_message_at_ms === reading.last_message_at_ms) return;
-        let screen = null;
-        if (session.pane) { const r = doorOn(session.machine ?? localMachine(), 'panes.capture', { pane: session.pane, lines: 25 }, { timeout: 20_000 }); screen = r.code === 0 ? String(json(r.stdout.trim(), {})?.text ?? '').trim().split('\n').slice(-25).join('\n') : null; }
+        // (its screen is not read: the call here named `panes.capture`, no machine door, and never answered)
+        const screen = null;
         const observation = retain(held, { screen });
         const why = held === 'waiting_on_user' ? 'is waiting on its user (a question or a permission prompt)' : `has reported working without writing anything for ${Math.round((observedAt - lastAt) / 60)} min`;
         const text = `${id}: its session ${addressOf(session)} ${why}; nothing it is sent reaches it until that is answered.${screen ? `\nIts screen:\n${screen}` : ''}`;
@@ -1130,7 +1211,7 @@ export async function sessionNotice(board, e) {
   }
   const address = e.address ?? addressOf(prior);
   if (!address) throw new Error('lifecycle notice awaits the owned launch session identity');
-  const filed = fileMail(board, address, e.text, effectMessageKey(e));
+  const filed = await fileMail(board, address, e.text, effectMessageKey(e));
   tx(board, (db) => {
     const session = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(e.runId)?.metadata, {})?.supercode;
     if (session?.lifecycle_notice_pending === e.durableId) setRunSession(db, e.runId, { lifecycle_notice_pending: null });
@@ -1147,7 +1228,7 @@ export async function sessionEffect(board, e) {
     const address = addressOf(session);
     if (!address) throw new Error('actor session identity unavailable');
     // filed in the actor's mailbox, which delivers it
-    const filed = fileMail(board, address, e.text, effectMessageKey(e));
+    const filed = await fileMail(board, address, e.text, effectMessageKey(e));
     if (filed.new) tx(board, db => event(db, e.id, 'actor_notice_filed', { notice: e.durableId, address, message_id: filed.message_id }, e.runId));
     return true;
   }
@@ -1178,7 +1259,7 @@ export async function mergeReviewed(board, e) {
   for (const p of prs) {
     if (Date.now() - began > MERGE_BUDGET_MS) throw new Error(`the merge attempt spent its ${MERGE_BUDGET_MS / 1000} s; the rest is merged next attempt`);
     let answer;
-    try { answer = mergeReviewedPullRequest(p.pr.url, p.commit); } catch (error) {
+    try { answer = await mergeReviewedPullRequest(p.pr.url, p.commit); } catch (error) {
       const reason = String(error.message).slice(-300);
       tx(board, (db) => event(db, e.id, 'merge_pending', { pr: p.pr.url, reviewed: p.commit, reason }));
       throw new Error(`merging ${p.pr.url} at ${p.commit}: ${reason}`);
@@ -1246,11 +1327,18 @@ const PR_URL = /https?:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/\d+/i;
 /**
  * This machine's memory pressure: on Linux as Hermes reads it (MemAvailable); on macOS the kernel's own level
  * (kern.memorystatus_vm_pressure_level: 1 normal, 2 warning, 4 critical); `unknown` elsewhere, which restricts nothing.
+ * Read once per round (readMemoryPressure, awaited at the round's start) and held for that round's caps.
  */
-function memoryPressure() {
+let pressureReading = 'unknown';
+const memoryPressure = () => pressureReading;
+export async function readMemoryPressure() {
+  pressureReading = await pressureNow();
+  return pressureReading;
+}
+async function pressureNow() {
   if (process.platform === 'darwin') {
-    const r = spawnSync('sysctl', ['-n', 'kern.memorystatus_vm_pressure_level'], { encoding: 'utf8', timeout: 5_000 });
-    const level = Number(String(r.stdout ?? '').trim());
+    const stdout = await new Promise((resolve) => execFile('sysctl', ['-n', 'kern.memorystatus_vm_pressure_level'], { encoding: 'utf8', timeout: 5_000 }, (_, out) => resolve(out ?? '')));
+    const level = Number(String(stdout).trim());
     return level >= 4 ? 'critical' : level >= 2 ? 'elevated' : level === 1 ? 'ok' : 'unknown';
   }
   try {
@@ -1305,8 +1393,8 @@ function launchReading(fleet, session) {
 }
 
 /** How a keyed launch ended, as its machine recorded it; read only where the machine has the door (supervise). */
-function launchReceipt(board, session) {
-  const r = doorOn(session.machine, 'harness.v1.launches.get',{key:session.launch_key},
+async function launchReceipt(board, session) {
+  const r = await doorOn(session.machine, 'harness.v1.launches.get',{key:session.launch_key},
     { timeout: 30_000, as: boardAddress(board.label) });
   if (r.code !== 0) throw unavailable(`launch receipt unavailable on ${session.machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
   if (r.stdout.trim() === 'null') return null;
@@ -1336,7 +1424,7 @@ function bindLaunch(board, row, session, pane, sid) {
 }
 
 /** A fast worker can reach its first board door before open's reply. Bind only the daemon's keyed pane. */
-export function reconcileCallerLaunch(board, sid) {
+export async function reconcileCallerLaunch(board, sid) {
   fleetRoot = board.root;
   if (view(board, (db) => db.prepare(`SELECT 1 FROM task_runs r JOIN tasks t ON t.current_run_id=r.id
     WHERE json_extract(r.metadata, '$.supercode.session_id')=? AND COALESCE(json_extract(r.metadata, '$.supercode.launch_pending'),0)=0`).get(sid))) return;
@@ -1350,7 +1438,7 @@ export function reconcileCallerLaunch(board, sid) {
     return s?.machine === machine && s.harness === harness && (!s.session_id || s.session_id === sid);
   });
   if (!candidates.length) return;
-  const pane = process.env.SUPERCODE_TEAMS_PANE || observeFleet().sessions?.find((s) => s.address === `sc:${machine}:${harness}:${sid}`)?.pane;
+  const pane = process.env.SUPERCODE_TEAMS_PANE || (await observeFleet()).sessions?.find((s) => s.address === `sc:${machine}:${harness}:${sid}`)?.pane;
   if (!pane) return;
   // the caller's own pane (its environment, or this machine's reading) binds the run whose launch recorded that pane
   for (const row of candidates) {
@@ -1362,7 +1450,7 @@ export function reconcileCallerLaunch(board, sid) {
 /** The board's agent records: each run kept in the agent store, closed cards' assignments ended, declarations and ends
  * handed to this machine's daemon, and usage read from each machine's own doors. No Teams call: the daemon declares and
  * ends agents and binds their sessions (D137). It runs in the delivery pass (`deliver`), never in a dispatch round. */
-function synchronizeAgents(board, report) {
+async function synchronizeAgents(board, report) {
   // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
   // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
   const agentRuns=[...new Map(view(board,db=>db.prepare("SELECT id,task_id,metadata,ended_at FROM task_runs WHERE json_extract(metadata,'$.supercode.agent_id') IS NOT NULL ORDER BY id").all())
@@ -1395,9 +1483,9 @@ function synchronizeAgents(board, report) {
       if(!run?.ended_at||read>=5)continue;
       const [harness,...rest]=row.session_ref.split(':'),machine=row.machine&&normalMachine(row.machine)!==localMachine()?row.machine:null;
       // the usage door loads the session by its whole locator, which discovery names
-      const sessionId=rest.join(':'),found=runtimeDoor(machine,'harness.v1.sessions.discover',{query:sessionId,harnesses:[harness],limit:200},{timeout:30_000});
+      const sessionId=rest.join(':'),found=await runtimeDoor(machine,'harness.v1.sessions.discover',{query:sessionId,harnesses:[harness],limit:200},{timeout:30_000});
       const locator=found.code===0?json(found.stdout.trim(),{})?.sessions?.find(item=>item.locator?.harness===harness&&item.locator?.session_id===sessionId)?.locator:null;
-      const reply=locator?runtimeDoor(machine,'harness.v1.sessions.usage',{locator},{timeout:30_000}):{code:1};read++;
+      const reply=locator?await runtimeDoor(machine,'harness.v1.sessions.usage',{locator},{timeout:30_000}):{code:1};read++;
       if(reply.code===0)recordRunUsage(board.root,org,row.session_ref,json(reply.stdout.trim(),{})?.usage??[]);
       // a session unreadable a day after its run ended is recorded as having no usage record, so it stops retrying
       else if(now()-Number(run.ended_at)>86400)recordRunUsage(board.root,org,row.session_ref,[]);
@@ -1409,11 +1497,11 @@ function synchronizeAgents(board, report) {
     if(task&&(task.archived||['done','cancelled'].includes(task.status)))finishAgentAssignment(board.root,assignment.org,assignment.id,`card ${assignment.target} ${task.archived?'archived':task.status}`);
   }
   // What a creating or closing verb could not hand on (no daemon running then) is handed on here.
-  try{for(const pending of handOffAgents(board.root))report.queued.push([pending.agent,pending.error]);}
+  try{for(const pending of await handOffAgents(board.root))report.queued.push([pending.agent,pending.error]);}
   catch(error){report.queued.push(['agents',`agent hand-off waits: ${error.message}`]);}
 }
 
-function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
+async function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
   const deferred=view(board,db=>db.prepare("SELECT t.id,r.id run_id,COALESCE(json_extract(r.metadata,'$.supercode.launched_at'),r.started_at) launched_at FROM tasks t JOIN task_runs r ON r.id=t.current_run_id WHERE r.ended_at IS NULL AND json_extract(r.metadata,'$.supercode.launch_deferred')=1").all());
   // A deferred launch was never issued (a reading or door was not yet available): it is the start its manager, creator
   // or workflow asked for, carried out within the launch window; supervise surfaces it once when the window ends. The
@@ -1431,13 +1519,15 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
       const why=launcherCheck(board.db,task,lane,fleet);if(why){report.queued.push([id,why]);continue;}
       const claimed=tx(board,db=>{if(!stillDeferred(db))return false;setRunSession(db,run_id,{launch_deferred:false});return true;});
       if(!claimed){report.queued.push([id,'its launch was taken by another round']);continue;}
-      const session=launchRun(board,entry,id,lane,fleet,settings);
+      const session=await launchRun(board,entry,id,lane,fleet,settings);
       if(session)report.started.push([id,session.address??session.session_id,session.mode]);
       // nothing to launch now (its status runs nothing yet): the run waits deferred, as before the claim
       else tx(board,db=>{const run=db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(run_id);const saved=json(run?.metadata,{})?.supercode??{};if(!saved.launch_key&&!saved.pid)setRunSession(db,run_id,{launch_deferred:true});});
     }catch(error){
-      if(error.launchPending){report.queued.push([id,error.message]);continue;}
-      const moved=tx(board,db=>monitorsRuns(entry)?(surfaceIncident(db,board,entry,id,'spawn_failed',{error:error.message,origin:originOf(error)}),{effects:[]}):fire(db,board,entry,id,'spawn_failed',{roles:['platform'],payload:{error:error.message}}));effects.push(...moved.effects);
+      if(error.launchPending||error.launchSuperseded){report.queued.push([id,error.message]);continue;}
+      const moved=launchFailed(board,entry,id,error,monitorsRuns(entry)?{error:error.message,origin:originOf(error)}:{error:error.message});
+      if(!moved){report.queued.push([id,`run ${error.launchRun} was replaced before its launch failed: ${error.message}`]);continue;}
+      effects.push(...moved.effects);
       report.failed.push([id,error.message]);
     }
   }
@@ -1474,15 +1564,15 @@ function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes
   }
 }
 
-function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'worker', meta = {} } = {}) {
+async function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'worker', meta = {} } = {}) {
   const machine = normalMachine(task.machine);
   // Whether a board session opens a terminal window on its machine is the workflow's choice, stated on every launch;
   // no machine default decides it.
   const window = workflowFor(board.root).params.session_window;
   if (typeof window !== 'boolean') throw unavailable('the workflow declares no params.session_window (true or false): whether a board session opens a window on its machine is the workflow\'s choice');
   {
-    const made = resolveLocalWorkspace(board, task);
-    tx(board, (db) => {
+    const made = await resolveLocalWorkspace(board, task);
+    runTx(board, task.id, runId, (db) => {
       db.prepare('UPDATE tasks SET workspace_path=?, branch_name=COALESCE(branch_name,?) WHERE id=?').run(made, task.workspace_kind === 'worktree' ? `wt/${task.id}` : null, task.id);
     });
     task = { ...task, workspace_path: made };
@@ -1500,7 +1590,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   // a close its session's own command asked for is carried out first, so its pane is gone before the slot's next
   // session starts (never two processes on one session)
   // Every old pane in the slot must be settled, including a failed launch with no session id.
-  closeRequested(board, { undelivered: [] }, { taskId: task.id });
+  await closeRequested(board, { undelivered: [] }, { taskId: task.id });
   const pending = view(board, (db) => db.prepare('SELECT id, ended_at, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId))
     .map((r) => ({ ...r, session: json(r.metadata, {})?.supercode }))
     .find((r) => (r.session?.pane || r.session?.launch_key || r.session?.surface === 'native') && !r.session.close_transferred_to && (r.session.slot ?? 'worker') === slot && (r.ended_at || r.session.close_requested) && !r.session.close_confirmed_at);
@@ -1510,7 +1600,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     // the round's own fleet reading: a launch never reads the fleet again
     const fresh = fleet;
     if (!fresh.ok) throw unavailable(`cannot check for a manual continuation of ${prev.session_id}: ${fresh.error}`);
-    const r = doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
+    const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
     const listed = r.code === 0 ? json(r.stdout.trim(), null) : null;
     if (!Array.isArray(listed)) throw unavailable(`cannot read panes before continuing ${prev.session_id}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
     const pane = continuationPane(fresh, prev, new Set(listed.filter(p => !p.dead).map((p) => p.pane)));
@@ -1519,7 +1609,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   }
   if (prev?.close_requested && !prev.closed_at) {
     const report = { undelivered: [] };
-    closeRequested(board, report, { taskId: task.id });
+    await closeRequested(board, report, { taskId: task.id });
     prev = view(board, (db) => lastSession(db, task.id, slot));
     // a pane that could not be closed still holds the session: no second process is started on it
     if (prev?.close_requested && !prev.closed_at) throw unavailable(`the slot's session ${prev.session_id} asked to be closed and its pane ${prev.pane} could not be: ${report.undelivered.map((u) => u[2]).join('; ') || 'no reason given'}`);
@@ -1529,12 +1619,20 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   // launch (Claude Code's) is bound with it, one that names itself (Codex) is bound from a later round's fleet reading.
   // The pane id is chosen from the launch key and recorded before open runs, so a launch whose answer is lost (a
   // timeout, a closed stream) is still found by its pane in a later round's fleet reading, and by its session id.
-  const openOwned = (key, sid, mode, args) => {
+  const openOwned = async (key, sid, mode, args) => {
     const chosen = `p_${createHash('sha256').update(key).digest('hex').slice(0, 16)}`;
-    tx(board, (db) => setRunSession(db, runId, { ...meta, surface: 'pane', machine, harness, slot,
-      session_id: sid, mode, launch_key: key, pane: chosen, launch_pending: true, launched_at: now() }));
-    const result = sc([...args.slice(0, args.indexOf('--key')), '--pane', chosen, ...args.slice(args.indexOf('--key'))], { timeout: 180_000, as: boardAddress(board.label) });
+    tx(board, (db) => {
+      if (!runCurrent(db, task.id, runId)) throw Object.assign(new Error(`run ${runId} of ${task.id} ended or was replaced while its launch was prepared; nothing was started`), { launchSuperseded: true });
+      setRunSession(db, runId, { ...meta, surface: 'pane', machine, harness, slot,
+        session_id: sid, mode, launch_key: key, pane: chosen, launch_pending: true, launched_at: now() });
+    });
+    const result = await sc([...args.slice(0, args.indexOf('--key')), '--pane', chosen, ...args.slice(args.indexOf('--key'))], { timeout: 180_000, as: boardAddress(board.label) });
     const pane = lastJson(result.stdout)?.pane ?? chosen;
+    // the run ended while its pane opened: the pane it opened is closed, never left working for an ended run
+    if (!view(board, (db) => runCurrent(db, task.id, runId))) {
+      try { await stopSession(board, { surface: 'pane', machine, harness, pane, session_id: sid, launch_key: key }); } catch { /* the slot's next launch settles it */ }
+      throw Object.assign(new Error(`run ${runId} of ${task.id} ended while its pane opened; pane ${pane} was closed`), { launchSuperseded: true });
+    }
     if (pane !== chosen) tx(board, (db) => {
       const before = json(db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runId)?.metadata, {})?.supercode ?? {};
       setRunSession(db, runId, { ...before, pane });
@@ -1546,6 +1644,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
     const reason = result.code === 0 ? `launch ${key} opened pane ${pane}; its ${harness} session is bound from the fleet reading` :
       `launch ${key} (pane ${pane}) gave no answer; it is bound from the fleet reading if it opened: ${(result.stderr || result.stdout).trim().slice(-300)}`;
     tx(board, (db) => {
+      if (!runCurrent(db, task.id, runId)) return;
       setRunSession(db, runId, { launch_pending: true, launch_error: reason });
       event(db, task.id, 'session_launch_pending', { key, pane, reason }, runId);
     });
@@ -1557,34 +1656,38 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   // session it did not launch, left running at its run's end) is its owner's while it runs: it is never resumed beside
   // itself, and the launch waits for the owner to end it.
   if (prev?.surface === 'native' && !prev.pane && (!prev.close_confirmed_at || prev.released)) {
-    const reading = nativeReading(nativeSessions(prev.machine, prev.harness, prev.session_id), prev);
+    const reading = nativeReading(await readNative(prev.machine, prev.harness, prev.session_id), prev);
     if (reading.alive == null) throw unavailable(`cannot establish native continuation liveness for ${addressOf(prev)}`);
     fleet.native ??= new Map(); fleet.native.set(addressOf(prev), reading);
     if (reading.alive && prev.released) throw unavailable(`released session ${addressOf(prev)} still runs; the launch waits for its owner to end it`);
     if (reading.alive && (prev.closed_at || prev.close_requested || prev.forgotten)) throw unavailable(`native session ${addressOf(prev)} is still live; its close must finish before replacement`);
   }
   if (prev?.forgotten) {
-    if (!prev.close_confirmed_at && prev.pane && panePresent(prev.machine, prev.pane)) throw new Error(`forgotten session ${prev.session_id} still has live pane ${prev.pane}; close it before replacement`);
+    if (!prev.close_confirmed_at && prev.pane && await panePresent(prev.machine, prev.pane)) throw new Error(`forgotten session ${prev.session_id} still has live pane ${prev.pane}; close it before replacement`);
     replaced = { session_id: prev.session_id, why: 'the workflow let it go' };
   }
   else if (prev && (prev.harness ?? 'claude-code') !== harness) {
     // the card was reassigned to a lane of another harness: that harness starts it fresh (the card's text and thread
     // are its context), and the last session, if still open, is closed so two harnesses never work one card
-    if (prev.pane && !prev.closed_at && !adoptedOnly(prev)) stopSession(board, prev); // an adopted session is released, never closed
+    if (prev.pane && !prev.closed_at && !adoptedOnly(prev)) await stopSession(board, prev); // an adopted session is released, never closed
     replaced = { session_id: prev.session_id, why: `the card's lane runs ${harness}, not ${prev.harness ?? 'claude-code'}`, letGo: true };
   } else if (prev && prev.machine === machine) {
     // a session the board closed, or one whose close its own command asked for (the next tick's sweep closes that
     // run's pane), is not kept, whatever a fleet reading taken before the close still lists
-    const paneLive = prev.pane ? panePresent(prev.machine, prev.pane) : false;
+    const paneLive = prev.pane ? await panePresent(prev.machine, prev.pane) : false;
     if (paneLive && (prev.closed_at || prev.close_requested || prev.forgotten)) throw new Error(`session ${prev.session_id} still has live pane ${prev.pane}; cannot resume or replace it`);
     if (!prev.closed_at && !prev.close_requested && (prev.pane ? paneLive : sessionAlive(fleet, prev))) {
       // the session is kept; the heartbeat's count belongs to the run that ended, so the new run starts it again
       const { missing_since: _m, goal_turns: _t, goal_nudged_at: _n, idle_observation: _io, idle_below_threshold: _ib, idle_eligible: _ie, close_requested: _q, closed_at: _c, close_confirmed_at: _cc, close_error: _ce, close_attempts: _ca, close_attempted_at: _ct, monitor_held: _mh, ...kept } = prev;
       session = { ...kept, mode: 'adopt', launched_at: now(), seen_at: now() };
-      // a kept session is told what this run is for (its card came back to it, with what happened since)
-      tx(board, (db) => setRunSession(db, runId, { ...session, ...meta }));
+      // a kept session is told what this run is for (its card came back to it, with what happened since), only while
+      // this run is still the card's current one (its pane and native reads were awaited)
+      tx(board, (db) => {
+        if (!runCurrent(db, task.id, runId)) throw Object.assign(new Error(`run ${runId} of ${task.id} ended or was replaced while its session was read; nothing was told to it`), { launchSuperseded: true });
+        setRunSession(db, runId, { ...session, ...meta });
+      });
       // filed in its mailbox, which delivers it
-      if (input) fileMail(board, addressOf(prev), input, `board-run-${task.id}-r${runId}`);
+      if (input) { assertRunCurrent(board, task.id, runId); await fileMail(board, addressOf(prev), input, `board-run-${task.id}-r${runId}`); }
     } else if (prev.resumable !== false) {
       const authorization = view(board, db => currentRun(db,task.id)?.metadata?.supercode?.restart_authorized);
       const released = view(board,db=>{
@@ -1601,7 +1704,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
       // a session is resumed in its own harness, whatever the lane's is now
       const its = HARNESSES[prev.harness ?? 'claude-code'] ?? HARNESSES['claude-code'];
       const launchKey = `board-${task.id}-r${runId}-resume`;
-      session = openOwned(launchKey, prev.session_id, 'resume', ['open', '--new', its.program, ...base.slice(3),
+      session = await openOwned(launchKey, prev.session_id, 'resume', ['open', '--new', its.program, ...base.slice(3),
         '--key', launchKey, '--input', told, '--', ...its.resume(prev.session_id), ...tail]);
     } else replaced = { session_id: prev.session_id, why: 'its resume never came up' };
   } else if (prev) replaced = { session_id: prev.session_id, why: `the card moved from ${prev.machine} to ${machine}` };
@@ -1615,7 +1718,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   if (!session) {
     const sid = how.namesItself ? null : randomUUID();
     const launchKey = `board-${task.id}-r${runId}-${(sid ?? randomUUID()).slice(0,8)}`;
-    session = openOwned(launchKey, sid, 'fresh', [...base, '--key', launchKey,
+    session = await openOwned(launchKey, sid, 'fresh', [...base, '--key', launchKey,
       '--input', input ?? `Card ${task.id}: ${task.title}`, '--', ...(sid ? how.fresh(sid) : how.fresh()), ...tail]);
     if (replaced) session.replaces = replaced.session_id;
   }
@@ -1649,24 +1752,25 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
 }
 
 /** A machine reading, not a missing catalog entry, establishes whether a pane is alive. */
-function panePresent(machine, pane) {
-  const r = doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
+async function panePresent(machine, pane) {
+  const r = await doorOn(machine, 'harness.v1.panes.list',{}, { timeout: 60_000 });
   const panes = r.code === 0 ? json(r.stdout.trim(), null) : null;
   if (!Array.isArray(panes)) throw unavailable(`cannot establish pane ${pane} liveness on ${machine}: ${(r.stderr || r.stdout).trim().slice(-300)}`);
   return panes.some((p) => p.pane === pane && !p.dead);
 }
 
 /** Whether a pane just launched is still there after the harness had a moment to start. */
-function paneSurvives(machine, pane) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 6000);
-  return panePresent(machine, pane);
+async function paneSurvives(machine, pane) {
+  // a timer, never a blocking wait: the owner answers verbs while the harness starts
+  await new Promise((resolve) => setTimeout(resolve, 6000));
+  return await panePresent(machine, pane);
 }
 
 /** Hermes's own worker argv and task environment, run on this machine; watched by its pid. */
-function launchHeadless(board, task, runId, lane, settings, { prompt = null, skills: runSkills = [], meta = {} } = {}) {
-  const workspace = resolveLocalWorkspace(board, task);
+async function launchHeadless(board, task, runId, lane, settings, { prompt = null, skills: runSkills = [], meta = {} } = {}) {
+  const workspace = await resolveLocalWorkspace(board, task);
   if(meta.agent_profile_intent)meta.agent_profile_intent.worker={...meta.agent_profile_intent.worker,harness:lane.harness,model:task.model_override??lane.model??null,cwd:workspace};
-  tx(board, (db) => db.prepare('UPDATE tasks SET workspace_path=?,branch_name=COALESCE(branch_name,?) WHERE id=?').run(workspace, task.workspace_kind === 'worktree' ? `wt/${task.id}` : null, task.id));
+  runTx(board, task.id, runId, (db) => db.prepare('UPDATE tasks SET workspace_path=?,branch_name=COALESCE(branch_name,?) WHERE id=?').run(workspace, task.workspace_kind === 'worktree' ? `wt/${task.id}` : null, task.id));
   // the card's own skills and the ones its status's run names (a reviewer's, for one)
   const skills = [...new Set([...task.skills, ...runSkills])];
   const args = ['-p', lane.name, '--cli', '--accept-hooks', ...skills.flatMap((s) => ['--skills', s]),
@@ -1694,12 +1798,19 @@ function launchHeadless(board, task, runId, lane, settings, { prompt = null, ski
   });
   child.unref();
   const session = { surface: 'headless', pid: child.pid, machine: localMachine(), mode: 'fresh', launched_at: now(), exit_file: exitFile, launch_secret: createHash('sha256').update(launchSecret).digest('hex'), ...meta };
-  tx(board, (db) => {
-    db.prepare('UPDATE tasks SET worker_pid = ? WHERE id = ?').run(child.pid, task.id);
+  // recorded against this run only while it is still the card's current one; a run ended meanwhile gets no worker
+  const recorded = tx(board, (db) => {
+    if (!runCurrent(db, task.id, runId)) return false;
+    db.prepare('UPDATE tasks SET worker_pid = ? WHERE id = ? AND current_run_id = ?').run(child.pid, task.id, runId);
     db.prepare('UPDATE task_runs SET worker_pid = ? WHERE id = ?').run(child.pid, runId);
     setRunSession(db, runId, session);
     event(db, task.id, 'spawned', { pid: child.pid }, runId);
+    return true;
   });
+  if (!recorded) {
+    try { process.kill(-child.pid, 'SIGTERM'); } catch { try { process.kill(child.pid, 'SIGTERM'); } catch { /* already gone */ } }
+    throw Object.assign(new Error(`run ${runId} of ${task.id} ended while its worker started; the worker was stopped`), { launchSuperseded: true });
+  }
   return session;
 }
 
@@ -1714,9 +1825,9 @@ function rotateLog(file, max, backups) {
 }
 
 /** A headless card's directory on this machine, made as Hermes makes it (scratch, dir, or a git worktree). */
-function resolveLocalWorkspace(board, task) {
+async function resolveLocalWorkspace(board, task) {
   const root = board.root;
-  if (task.workspace_kind !== 'scratch') return resolveWorkspace(task, true).path;
+  if (task.workspace_kind !== 'scratch') return (await resolveWorkspace(task, true)).path;
   const dir = task.workspace_path || (board.slug === 'default' ? join(root, 'kanban', 'workspaces', task.id) : join(root, 'kanban', 'boards', board.slug, 'workspaces', task.id));
   mkdirSync(dir, { recursive: true });
   return dir;
@@ -1760,7 +1871,7 @@ const latestAnswer = (db, id) => db.prepare(`SELECT id, kind, payload FROM task_
  * of two rounds that read one request, one binds it and the other leaves it; the bind and the failure are each written
  * only while that claim is the card's latest.
  */
-export function completeAdoptions(board, fleet, settings, report, lanes = null) {
+export async function completeAdoptions(board, fleet, settings, report, lanes = null) {
   const pending = view(board, db => db.prepare(`SELECT e.id, e.task_id, e.kind, e.payload, e.created_at FROM task_events e
     WHERE ((e.kind = 'dispatch_held' AND json_extract(e.payload, '$.reason') = 'adoption requested') OR e.kind = 'adoption_claimed')
     AND e.id = (SELECT MAX(id) FROM task_events l WHERE l.task_id = e.task_id AND l.kind IN ${ADOPTION_ANSWERS})`).all());
@@ -1776,7 +1887,7 @@ export function completeAdoptions(board, fleet, settings, report, lanes = null)
     const asked = json(request.payload, {}) ?? {};
     const progress = {};
     try {
-      const got = adoptSession(board, row.task_id, asked.session, { request: request.id, open: row.id, progress, workspace: asked.workspace ?? null, assignee: asked.assignee ?? null, role: asked.role ?? null, ttl: settings.ttl, fleet: fleet?.ok ? fleet : null , lanes});
+      const got = await adoptSession(board, row.task_id, asked.session, { request: request.id, open: row.id, progress, workspace: asked.workspace ?? null, assignee: asked.assignee ?? null, role: asked.role ?? null, ttl: settings.ttl, fleet: fleet?.ok ? fleet : null , lanes});
       (report.adopted ??= []).push([row.task_id, got.address]);
     } catch (error) {
       const message = String(error.message).slice(-400);
@@ -1807,11 +1918,11 @@ function adoptionOpenTo(db, id, request, open) {
 }
 
 /** A session in no pane (a native process its machine's harness discovery holds as running), by its full address. */
-function nativeListing(who) {
+async function nativeListing(who) {
   const m = /^sc:([^:]+):([^:]+):(.+)$/.exec(String(who));
   if (!m || !HARNESSES[m[2]]) return null;
   const [, host, harness, session_id] = m;
-  try { return nativeReading(nativeSessions(host, harness, session_id), { session_id, harness }).alive === true ? { address: who, machine: normalMachine(host), harness, session_id, pane: null, name: null } : null; }
+  try { return nativeReading(await readNative(host, harness, session_id), { session_id, harness }).alive === true ? { address: who, machine: normalMachine(host), harness, session_id, pane: null, name: null } : null; }
   catch { return null; }
 }
 
@@ -1831,27 +1942,27 @@ function adoptedRole(db, board, entry, task, run) {
   return runSpec(entry, t?.target ? String(templateValue(t.target, scope)) : status, task)?.role ?? null;
 }
 
-function adoptSession(board, id, who, { request = null, open = request, progress = {}, workspace = null, ttl, assignee = null, role = null, fleet = null, lanes = null } = {}) {
-  fleet ??= observeFleet();
+async function adoptSession(board, id, who, { request = null, open = request, progress = {}, workspace = null, ttl, assignee = null, role = null, fleet = null, lanes = null } = {}) {
+  fleet ??= await observeFleet();
   if (!fleet.ok) throw new Error(`supercode could not read the fleet: ${fleet.error}`);
-  const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who) ?? nativeListing(who);
+  const found = fleet.sessions.find((s) => s.address === who || s.address.endsWith(`:${who}`) || s.name === who) ?? await nativeListing(who);
   if (!found) throw Object.assign(new Error(`the fleet lists no live session ${who}`), { notListed: true });
   const [, host, harness, sessionId] = found.address.split(':');
   if (!HARNESSES[harness]) throw new Error(`${found.address} is ${harness}; the board keeps and resumes ${Object.keys(HARNESSES).join(' and ')} sessions`);
-  const native = found.pane ? null : nativeReading(nativeSessions(host, harness, sessionId), { session_id: sessionId, harness });
-  if (found.pane ? !panePresent(host, found.pane) : native.alive !== true) throw new Error(`${found.address} has no verified live native process or pane`);
+  const native = found.pane ? null : nativeReading(await readNative(host, harness, sessionId), { session_id: sessionId, harness });
+  if (found.pane ? !await panePresent(host, found.pane) : native.alive !== true) throw new Error(`${found.address} has no verified live native process or pane`);
   const beforeRun = view(board, (db) => currentRun(db, id));
   const beforeSession = beforeRun?.metadata?.supercode;
   if (beforeRun && beforeSession?.session_id !== sessionId) throw new Error(`${id} has another active run/session; end it before adopting a different identity`);
-  if (beforeSession?.pane && beforeSession.pane !== found.pane && panePresent(beforeSession.machine, beforeSession.pane)) throw new Error(`${id} still has live pane ${beforeSession.pane}; close the extra pane before rebinding ${sessionId}`);
+  if (beforeSession?.pane && beforeSession.pane !== found.pane && await panePresent(beforeSession.machine, beforeSession.pane)) throw new Error(`${id} still has live pane ${beforeSession.pane}; close the extra pane before rebinding ${sessionId}`);
 
   // the session's own working directory, as discovery records it (where `--resume` finds it), else its pane's
   let dir = workspace ?? native?.row?.cwd;
   if (!dir) {
-    dir = nativeSessions(host, harness, sessionId).find((x) => x.locator?.session_id === sessionId)?.cwd ?? null;
+    dir = (await readNative(host, harness, sessionId)).find((x) => x.locator?.session_id === sessionId)?.cwd ?? null;
   }
   if (!dir && found.pane) {
-    const r = runtimeDoor(normalMachine(host)===localMachine()?null:host,'harness.v1.panes.list',{}, { timeout: 60_000 });
+    const r = await runtimeDoor(normalMachine(host)===localMachine()?null:host,'harness.v1.panes.list',{}, { timeout: 60_000 });
     dir = (json(r.stdout.trim(), []) ?? []).find((p) => p.pane === found.pane)?.cwd ?? null;
   }
   // Rule 2: a session working a card role is that role's agent, however it started; adopted, it joins the agent as a
@@ -1875,11 +1986,13 @@ function adoptSession(board, id, who, { request = null, open = request, progress
   });
   progress.claimed = request !== null;
   // The adopted session joins the role's agent as a launch does: its identity minted on this host, never asked of Teams.
-  const agent = lane ? localCardAgent({ root: board.root, org: team.org, server: team.server, profiles: entry0.profiles, profile: lane.name, card: id, role: agentRole, sponsor: card0?.sponsor ?? null }) : null;
+  const agent = lane ? await localCardAgent({ root: board.root, org: team.org, server: team.server, profiles: entry0.profiles, profile: lane.name, card: id, role: agentRole, sponsor: card0?.sponsor ?? null }) : null;
   // A session another agent already owns is refused before anything is recorded: the run would name one agent and the
   // agent store another, and every round after would trip on it.
   const owner = agent ? agentRunForSession(board.root, [`${harness}:${sessionId}`]) : null;
   if (owner && owner.agent_id !== agent.identity.id) throw new Error(`${found.address} already works for agent ${owner.agent_id} (run ${owner.run_id}); it cannot be adopted as ${agent.identity.id}`);
+  // the card's previous session is read before the bind decides whether it is still live
+  await readBefore(fleet, view(board, (db) => lastSession(db, id)));
   const adopted = tx(board, (db) => {
     const task = getTask(db, id);
     if (!task) throw new Error(`no card ${id}`);
@@ -1929,7 +2042,7 @@ function adoptSession(board, id, who, { request = null, open = request, progress
 }
 
 /** A manager/creator's manual native resume rebinds its existing run; this opens no process. */
-function reconnectContinuedSessions(board, fleet, entry, report) {
+async function reconnectContinuedSessions(board, fleet, entry, report) {
   if (!monitorsRuns(entry) || !fleet.ok) return;
   const rows = view(board, db => db.prepare(`SELECT r.* FROM task_runs r JOIN tasks t ON t.id=r.task_id
     WHERE t.current_run_id IS NULL AND t.status NOT IN ('done','archived') AND r.id=(SELECT MAX(id) FROM task_runs WHERE task_id=t.id)
@@ -1942,7 +2055,7 @@ function reconnectContinuedSessions(board, fleet, entry, report) {
     const live = fleet.sessions?.find(s => s.address === addressOf(saved) && s.state === 'running' && s.pane);
     if (!live) continue;
     if (!panes.has(saved.machine)) {
-      const answer = doorOn(saved.machine,'harness.v1.panes.list',{}, {timeout:60000});
+      const answer = await doorOn(saved.machine,'harness.v1.panes.list',{}, {timeout:60000});
       const list = answer.code === 0 ? json(answer.stdout,null) : null;
       panes.set(saved.machine,Array.isArray(list) ? new Set(list.filter(p=>!p.dead).map(p=>p.pane)) : null);
     }
@@ -1977,22 +2090,25 @@ function reconnectContinuedSessions(board, fleet, entry, report) {
 
 
 /**
- * File one message from the board in its receiver's mailbox, and stop there (D138 step 6, D140): a local write through
- * the mailbox's filing door (`supercode message file`), idempotent by the message id `key` fixes, with no network and
- * nothing to try again. The mailbox delivers it: the machine daemon's watch loop hands it to its session by the
- * session's own door, and carries mail for another machine there through Teams. `wake: false` leaves it for the
- * session's next turn. A question the board waits on (`ask`) is answered by a reply to the board's address; a notice
- * is not. Throws only when the local write failed.
+ * File one message from the board in its receiver's mailbox, and stop there (D138 step 6, D140): through this machine's
+ * daemon (`harness.v1.mail.file`, in this process over its held channel), which names the sender's identity itself and
+ * writes it through the mailbox's filing door, idempotent by the message id `key` fixes. Nothing here waits on the
+ * event loop. The mailbox delivers it: the machine daemon's watch loop hands it to its session by the session's own
+ * door, and carries mail for another machine there through Teams. `wake: false` leaves it for the session's next turn.
+ * A question the board waits on (`ask`) is answered by a reply to the board's address; a notice is not. Throws only
+ * when the filing failed.
  */
-function fileMail(board, to, body, key, { ask = false, wake = true, subject } = {}) {
+async function fileMail(board, to, body, key, { ask = false, wake = true, subject } = {}) {
   if (boardCopyOf(board)) throw copyRefusal(board, 'files no mail for sessions or managers');
   const request = {
     from: boardAddress(board.label), from_name: `${board.label} board`, to, id: key, wake, subject: String(subject ?? String(body).split('\n')[0]).slice(0, 160),
     body: ask ? `[A question from the ${board.label} board] ${body}` : `[Board notice from the ${board.label} board] ${body}\n\n(An automated notice from the board's dispatcher; replies to this address go nowhere.)`,
+    // the board's own Teams context (the call it files in): the sender is observed in that team, never the daemon's
+    context: current().facts.SUPERCODE_CONTEXT ?? null,
   };
-  const r = sc(['message', 'file'], { input: JSON.stringify(request), timeout: 30_000 });
-  const answer = lastJson(r.stdout);
-  if (answer?.code !== 0) throw new Error((answer?.text || r.stderr || `no answer from the mailbox's filing door (exit ${r.code})`).trim().slice(-300));
+  const r = await runtimeDoor(null, 'harness.v1.mail.file', request, { timeout: 30_000 });
+  const answer = r.code === 0 ? lastJson(r.stdout) : null;
+  if (answer?.code !== 0) throw new Error((answer?.text || (lastJson(r.stderr)?.message ?? r.stderr) || 'no answer from the mailbox\'s filing door').trim().slice(-300));
   return { filed: true, message_id: answer.message_id, new: answer.new === true };
 }
 
@@ -2006,7 +2122,7 @@ export async function alertManagers(root, slug, text, key) {
   const label = boardLabel(root, slug);
   let told = 0;
   for (const to of managers) {
-    try { fileMail({ root, label }, to, text, key, { subject: text.split('\n')[0] }); told += 1; } catch { /* a filing that failed here is said by the next alert */ }
+    try { await fileMail({ root, label }, to, text, key, { subject: text.split('\n')[0] }); told += 1; } catch { /* a filing that failed here is said by the next alert */ }
   }
   return told;
 }
@@ -2017,7 +2133,7 @@ export async function alertManagers(root, slug, text, key) {
  * waits on, so a second filing of it files nothing new. A mail inside its batch window waits for the next pass; one
  * whose filing failed here is reported and filed by the next pass.
  */
-export function fileBoardMail(board, report, taskId = null) {
+export async function fileBoardMail(board, report, taskId = null) {
   // a message older than the workflow's notice_max_age_seconds is history, not news (a backlog replayed after an
   // upgrade or a long stop): it is passed over, recorded once, never filed
   const maxAge = Number(workflowFor(board.root)?.params?.notice_max_age_seconds) || null;
@@ -2034,7 +2150,7 @@ export function fileBoardMail(board, report, taskId = null) {
     try {
       const task = view(board, db => getTask(db, first.task_id));
       const subject = mail.requester ? `State requests · ${mail.members.length} request(s) · ${task?.title || first.task_id}` : `${task?.title || first.task_id} · ${mail.message_id ? 'Question' : 'Update'}`;
-      const filed = fileMail(board, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
+      const filed = await fileMail(board, mail.to, mail.text, mail.message_id ?? `board-message-${first.id}`, { ask: Boolean(mail.message_id), subject });
       tx(board, db => {
         for (const member of mail.members) if (!db.prepare("SELECT 1 FROM task_events WHERE kind='board_message_sent' AND task_id=? AND json_extract(payload,'$.event')=?").get(member.task_id, member.id)) event(db, member.task_id, 'board_message_sent', { event: member.id, to: mail.to, message_id: filed.message_id, ...(mail.message_id ? { request_id: member.message_id ?? mail.message_id } : {}) });
       });
@@ -2114,17 +2230,18 @@ function sessionRecord(db) {
  * that resumes the session subscribes it again at its launch and each round while it is the card's current run.
  * A creator's or manager's subscription is never ended here: its notices wait for the session to come back.
  */
-function endWorkerSubscriptions(board, fleet, report) {
+async function endWorkerSubscriptions(board, fleet, report) {
   // each worker subscriber's liveness is read before the write
   const aliveNow = new Map();
-  if (fleet.ok) for (const { chat_id: address } of board.db.prepare("SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) aliveNow.set(address, subscriberAlive(fleet, address));
+  if (fleet.ok) for (const { chat_id: address } of board.db.prepare("SELECT DISTINCT chat_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) aliveNow.set(address, await subscriberAlive(fleet, address));
   tx(board, (db) => {
     const { held, latest } = sessionRecord(db);
     const remove = db.prepare("DELETE FROM kanban_notify_subs WHERE task_id = ? AND platform = 'supercode' AND chat_id = ? AND thread_id = ?");
     const ended = new Map();
     for (const row of db.prepare("SELECT task_id, chat_id, thread_id FROM kanban_notify_subs WHERE platform = 'supercode' AND json_extract(delivery_metadata, '$.role') = 'worker'").all()) {
       const address = row.chat_id, record = latest.get(address);
-      if (!record || record.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) === true)) continue;
+      // a session alive, or whose liveness could not be read (unknown, never taken as ended), keeps its subscription
+      if (!record || record.session.released || held.has(address) || (fleet.ok && aliveNow.get(address) !== false)) continue;
       const evidence = record.session.close_confirmed_at ? { by: 'board_close', run: record.run, closed_at: record.session.close_confirmed_at } : null;
       if (!evidence || !remove.run(row.task_id, address, row.thread_id).changes) continue;
       if (!ended.has(address)) ended.set(address, { record, evidence, cards: [] });
@@ -2143,8 +2260,8 @@ function endWorkerSubscriptions(board, fleet, report) {
  * another. Each subscription's notices go in order, and its cursor moves past a notice once it is filed (or passed
  * over); a filing that failed here leaves the cursor before it, and the next pass files it.
  */
-function notify(board, fleet, report, entry) {
-  endWorkerSubscriptions(board, fleet, report);
+async function notify(board, fleet, report, entry) {
+  await endWorkerSubscriptions(board, fleet, report);
   for (const sub of subscriptions(board.db).filter((s) => s.platform === 'supercode')) {
     if (stopping) break;
     if (sub.delivery_metadata?.dependent_card && sub.delivery_metadata.waiting_recipient) continue;
@@ -2152,7 +2269,12 @@ function notify(board, fleet, report, entry) {
     // a session the fleet does not list this pass is told next pass: one reading is not a loss (a loaded box drops
     // sessions from a read, and a dropped subscription never came back), and a session that is replaced on its card
     // has its subscription moved when the new one starts
-    if (role !== 'creator' && fleet.ok && !subscriberAlive(fleet, sub.chat_id)) continue;
+    if (role !== 'creator' && fleet.ok) {
+      const alive = await subscriberAlive(fleet, sub.chat_id);
+      if (alive === false) continue;
+      // unknown is not absent: its notices wait, and the wait is said, until its liveness can be read
+      if (alive === null) { report.undelivered.push([sub.task_id, sub.chat_id, 'its liveness could not be read; its notices wait until it can be']); continue; }
+    }
     const kinds = heardBy(entry, role);
     if (!kinds.length) continue;
     const events = board.db.prepare(`SELECT id, kind, payload, created_at, run_id FROM task_events WHERE task_id = ? AND id > ? AND kind IN (${kinds.map(() => '?').join(', ')}) ORDER BY id`)
@@ -2194,7 +2316,7 @@ function notify(board, fleet, report, entry) {
         if (text) {
           const body = ['worker', 'dependency'].includes(role) ? identifyNotice(ev, text) : text;
           // filed under its fixed key: a second pass filing the same notice files nothing new
-          const filed = fileMail(board, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { wake, subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
+          const filed = await fileMail(board, sub.chat_id, body, `board-${sub.task_id}-${ev.id}-${sub.chat_id.slice(-12)}`, { wake, subject: `${ev.kind.replaceAll('_', ' ')} · run ${ev.run_id ?? 'none'} · event ${ev.id} · ${task?.title || sub.task_id}` });
           if (filed.new) tx(board, (db) => event(db, sub.task_id, 'notice_filed', { source_event: ev.id, kind: ev.kind, address: sub.chat_id, message_id: filed.message_id, wake }));
           report.notified.push([sub.task_id, ev.kind, sub.chat_id]);
         }
@@ -2360,7 +2482,7 @@ function mailboxOf(address) {
  * read. Any other message is mail it does not take: it is refused to its sender, in its own mailbox, and filed as read
  * only once that refusal is filed.
  */
-function readMailbox(board, address, report) {
+async function readMailbox(board, address, report) {
   const box = mailboxOf(address);
   if (!box || !existsSync(join(box, 'new'))) return;
   for (const name of readdirSync(join(box, 'new')).filter((n) => n.endsWith('.json')).sort()) {
@@ -2370,7 +2492,7 @@ function readMailbox(board, address, report) {
     const notice = envelope.kind === 'notice' || envelope.reply_via?.mode === 'none';
     if (!envelope.in_reply_to && !notice) {
       try {
-        fileMail(board, envelope.from, `${address} takes answers to its questions and notices only; this message was not taken.`, `board-refused-${envelope.id}`);
+        await fileMail(board, envelope.from, `${address} takes answers to its questions and notices only; this message was not taken.`, `board-refused-${envelope.id}`);
       } catch (error) { report.undelivered.push(['mail', envelope.from, String(error.message).slice(-200)]); continue; }
       report.mailed.push([envelope.from, 'refused']);
     }
@@ -2402,10 +2524,10 @@ export async function plan({ root, lanes, settings, slugs = null, params = {} })
   fleetRoot = root;
   const loaded = await loadWorkflow(root);
   const entry = { ...loaded, params: { ...loaded.params, ...params } };
-  const fleet = Object.values(lanes).some((l) => l.surface === 'pane') ? observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
+  const fleet = Object.values(lanes).some((l) => l.surface === 'pane') ? await observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
   const out = [];
   // the home's caps count every board, whichever boards are planned
-  const held = homeHoldings(root, listBoards(root), lanes, fleet, entry);
+  const held = await homeHoldings(root, listBoards(root), lanes, fleet, entry);
   const caps = capacity(entry.workflow.dispatch?.capacity, held, evaluate);
   // what each cap counts now, before anything this plan would start
   Object.defineProperty(out, 'capacity', { value: caps.view().map((cap) => ({ ...cap, groups: cap.groups.map((g) => ({ ...g, max: capMax(cap, g, entry, lanes) })) })) });
@@ -2415,7 +2537,7 @@ export async function plan({ root, lanes, settings, slugs = null, params = {} })
     try {
       board.label = boardLabel(root, slug);
       await activatePullRequestReviews(board, entry, report, [], { dry: true, fleet });
-      startCards(board, fleet, lanes, settings, report, entry, [], { dry: true, held });
+      await startCards(board, fleet, lanes, settings, report, entry, [], { dry: true, held });
     } finally { board.close(); }
     out.push(report);
   }
@@ -2438,12 +2560,12 @@ function noCodeReviewDue(board, id) {
 /** The arc's session still in a turn: its review, and the close of that session the request brings (end_run), wait for
  *  the turn to end, so work in flight is never cut (t_f34710bc's coder had a proof take running when its review was
  *  requested at 15:01:13Z on 2026-10-04, and the close ended it). A session the reading cannot place waits on nothing. */
-function turnInFlight(board, id, fleet) {
+async function turnInFlight(board, id, fleet) {
   if (!fleet?.ok) return null;
   const session = currentRun(board.db, id)?.metadata?.supercode;
   if (!session?.session_id || session.surface === 'headless' || session.close_requested) return null;
   let turn = fleet.sessions?.find((x) => x.address === addressOf(session))?.turn ?? null;
-  if (turn == null && session.surface === 'native') try { turn = nativeReading(nativeSessions(session.machine, session.harness ?? 'claude-code', session.session_id), session).row?.activity?.turn ?? null; } catch { /* unread: waits on nothing */ }
+  if (turn == null && session.surface === 'native') try { turn = nativeReading(await readNative(session.machine, session.harness ?? 'claude-code', session.session_id), session).row?.activity?.turn ?? null; } catch { /* unread: waits on nothing */ }
   // a turn stopped on a permission or a question (needs_input) is a turn not finished, as one still working is
   return ['working', 'needs_input'].includes(turn) ? `its session ${addressOf(session)} is in a turn (${turn}); the review is requested once the turn ends` : null;
 }
@@ -2466,26 +2588,26 @@ async function activatePullRequestReviews(board, entry, report, effects, { only
     const ready = view(board, eligible);
     if (!ready) continue;
     if (ready !== true) { report.queued.push([id, `review waits: ${ready.length} open task(s) in the card's Tasks: ${ready[0].id} ${ready[0].title}`]); continue; }
-    const inTurn = turnInFlight(board, id, fleet);
+    const inTurn = await turnInFlight(board, id, fleet);
     if (inTurn) { report.queued.push([id, `review waits: ${inTurn}`]); continue; }
     let payload = null;
     try {
-      payload = openReviewPullRequests(board, id);
+      payload = await openReviewPullRequests(board, id);
       // The arc's open PRs ask for one review only while some head has no verdict: after changes are
       // requested the next run is the implementer's, until a new head is pushed.
       // An arc that closed its tasks having changed no code gets its one review of the act itself (ADR 0003).
-      if (!payload && noCodeReviewDue(board, id)) payload = noCodeChange(board, id);
+      if (!payload && noCodeReviewDue(board, id)) payload = await noCodeChange(board, id);
       if (!payload) { report.queued.push([id, 'review waits: no open PR on its branch, a wt/<card> branch or a registered checkout']); continue; }
       if (payload.waits) { report.queued.push([id, `review waits: ${payload.waits}`]); payload = null; continue; }
-      if (!payload.no_code && !reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
+      if (!payload.no_code && !await reviewDue(board, id, payload.pr.map((url, index) => ({ url, head: payload.pr_head[index] })))) {
         report.queued.push([id, `review waits: every open PR head (${payload.pr.join(', ')}) has a verdict or predates the last one; push a commit that answers it`]);
         continue;
       }
-      const evidence = payload.no_code ? { required: false, ready: true, reason: null, phase: 'source', no_code: payload.no_code } : inspectCompletionEvidence(board, id, entry, payload, 'request_review');
+      const evidence = payload.no_code ? { required: false, ready: true, reason: null, phase: 'source', no_code: payload.no_code } : await inspectCompletionEvidence(board, id, entry, payload, 'request_review');
       if (!evidence.ready) throw new Error(evidence.reason);
       // a dry run names the review a tick would request and writes nothing
       if (dry) { (report.would_review ??= []).push({ id, prs: payload.pr, heads: payload.pr_head, no_code: payload.no_code ?? null }); continue; }
-      refreshCardInputs(board, id, { commits: true });
+      await refreshCardInputs(board, id, { commits: true });
       const moved = tx(board, db => {
         const task = getTask(db, id);
         if (eligible(db) !== true) return null;
@@ -2537,9 +2659,10 @@ export function startDelivery(root, { slugs = null, log = () => {} } = {}) {
 
 /**
  * The delivery pass over every board of the home at `root`: what rounds recorded for after them (each due effect, with
- * its bounded attempts), board mail, subscription notices, and the board's agent records joined to Teams. It runs in
- * its own process (`workflow deliver`, started by serve after a round, one at a time), never inside a dispatch round,
- * so no recipient, door or Teams answer holds a round. Answers one report per board.
+ * its bounded attempts), board mail, subscription notices, and the board's agent records joined to Teams. The owner
+ * runs it in its own (the owner's) process after a round (startDelivery, one at a time, never awaited by the round), and an operator
+ * runs it as `workflow deliver`. Every door, filing and Teams answer it waits on is awaited, never a synchronous wait,
+ * so the owner answers verbs while it runs. Answers one report per board.
  */
 /**
  * Whether the board dispatches: board state, kept in the board's own store (`supercode_board_state`, key `dispatching`)
@@ -2562,7 +2685,7 @@ export async function deliver({ root, slugs = null, controller = false }) {
   // already under way when a board is switched off leaves it); `workflow deliver`, an operator's act, delivers as asked
   const boards = (slugs ?? listBoards(root)).filter((slug) => !controller || dispatchingOf(root, slug).on);
   if (!boards.length) return [];
-  const fleet = observeFleet();
+  const fleet = await observeFleet();
   const out = [];
   for (const slug of boards) {
     if (controller && !dispatchingOf(root, slug).on) continue;
@@ -2578,10 +2701,10 @@ export async function deliver({ root, slugs = null, controller = false }) {
       // a controller's pass reads the board's switch before each phase and each effect: switched off meanwhile, what had
       // not begun is left (an operator's `workflow deliver` delivers as asked)
       const on = () => !controller || dispatchingOf(root, slug).on;
-      if (on()) { fileBoardMail(board, report); phase('mail'); }
+      if (on()) { await fileBoardMail(board, report); phase('mail'); }
       if (on()) { report.effects = await runEffects(board, [], { pending: true, eligible: controller ? on : null }); phase('effects'); }
-      if (on()) { notify(board, fleet, report, entry); phase('notify'); }
-      if (on()) { synchronizeAgents(board, report); phase('agents'); }
+      if (on()) { await notify(board, fleet, report, entry); phase('notify'); }
+      if (on()) { await synchronizeAgents(board, report); phase('agents'); }
       report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
       report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);
     } catch (error) { report.error = error.message; }
@@ -2613,17 +2736,18 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
   fleetRoot = root;
   discoveries.clear();
   // a verb's flags (dispatch --max, --failure-limit) are params of this tick, read by the workflow as its own
-  const deployment = deploymentReceipt ? workflowRevision(root) : null;
+  const deployment = deploymentReceipt ? await workflowRevision(root) : null;
   const loaded = await loadWorkflow(root);
   const entry = { ...loaded, params: { ...loaded.params, ...params } };
   const needFleet = Object.values(lanes).some((l) => l.surface === 'pane');
   const fleetAt = Date.now();
-  const fleet = needFleet ? observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
+  const fleet = needFleet ? await observeFleet() : { ok: false, alive: new Set(), online: new Set(), sessions: [], error: 'no pane lanes' };
   const fleetMs = Date.now() - fleetAt;
+  await readMemoryPressure();
   const boards = slugs ?? listBoards(root);
   // what every board of the home holds, for caps whose scope is the whole home (kanban.max_in_progress counts so): every
   // board, including one whose dispatching is off, whose live workers still hold their places
-  const held = dispatch ? homeHoldings(root, listBoards(root), lanes, fleet, entry) : [];
+  const held = dispatch ? await homeHoldings(root, listBoards(root), lanes, fleet, entry) : [];
   const out = [];
   for (const slug of boards) {
     if (stopping) break;
@@ -2646,17 +2770,17 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
       let mark = Date.now();
       const phase = (name) => { const t = Date.now(); report.ms[name] = t - mark; mark = t; };
 
-      readMailbox(board, boardAddress(board.label), report); phase('mailbox');
+      await readMailbox(board, boardAddress(board.label), report); phase('mailbox');
       await refreshRelationAnswers(board); phase('answers');
       const effects = [];
-      completeAdoptions(board, fleet, settings, report, lanes); reconnectContinuedSessions(board, fleet, entry, report); reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); closeRequested(board, report, { ttl: settings.ttl, fleet }); phase('supervise');
+      await completeAdoptions(board, fleet, settings, report, lanes); await reconnectContinuedSessions(board, fleet, entry, report); await reconcileLaunches(board, fleet, report, entry, effects, settings, lanes); await supervise(board, fleet, settings, report, entry, effects); queueEffects(board, effects.splice(0)); await closeRequested(board, report, { ttl: settings.ttl, fleet }); phase('supervise');
       report.unsettled = [];
       report.promoted = recomputeReady(board, effects, report.unsettled);
       tx(board,db=>auditEndedRuns(db,board,entry));
       if (dispatch) await activatePullRequestReviews(board, entry, report, effects, { only, fleet });
-      if (dispatch && !stopping) startCards(board, fleet, lanes, settings, report, entry, effects, { only, held });
+      if (dispatch && !stopping) await startCards(board, fleet, lanes, settings, report, entry, effects, { only, held });
       phase('start');
-      if (dispatch && !only && !report.paused) observeIdle(board, fleet, settings, report, entry, effects);
+      if (dispatch && !only && !report.paused) await observeIdle(board, fleet, settings, report, entry, effects);
       // what the moves asked for is recorded with them; the delivery pass (`deliver`) carries it out, outside the round
       queueEffects(board, effects);
       phase('goals');
@@ -2676,7 +2800,7 @@ export async function tick({ root, lanes, settings, only = null, slugs = null, d
     out.push(report);
   }
   if (deployment && out.every(report => !report.error)) {
-    const receipt = retainWorkflowTick(root, deployment);
+    const receipt = await retainWorkflowTick(root, deployment);
     if (receipt && out[0]) out[0].deployment = receipt;
   }
   return out;