@staix/agent-hub 0.12.19 → 0.12.21

package/src/hub/tasks.ts

@@ -4,10 +4,12 @@ import type { MemoryClient } from "../memory/client.ts";
 import { CLASSES, OUTCOMES_KEPT_MS, PLAN_KEYS, TASK_MOVE_REASONS, type Board, type Task, type TaskClass, type TaskMoveReason, type TaskPlan, type TaskRefs } from "./board.ts";
 import type { Bus } from "./bus.ts";
 import { HUB, newEnvelope, NOTE_KINDS, noteLine, USER, type Envelope, type PeerId, type PeerState } from "./envelope.ts";
-import { assign, detectSignals, LOCAL, PI, predictSplit, type Assignment, type Routing, type SplitObservation, type SplitPrediction } from "./routing.ts";
+import type { PiiVerdict, ScreenItem, ScreenRecord } from "./inference.ts";
+import { assign, detectSignals, LOCAL, peerEntry, PI, predictSplit, type Assignment, type Routing, type SplitObservation, type SplitPrediction } from "./routing.ts";
 import { ExecutionBudget, type ExecutionBudgetConfig, type ExecutionBudgetDecision, type ExecutionBudgetStatus, type ExecutionUnit } from "./execution-budget.ts";
 import { Cohorts, MAX_REQUESTS, type Cohort, type Completion } from "./cohorts.ts";
 import { realPath } from "./project.ts";
+import { PreEffectToolRefusal } from "./tool-refusal.ts";
 import { nextSweep, taskSweepConfig, type TaskSweepConfig, type SweepRecord } from "./task-sweep.ts";
 
 export interface TasksDeps {
@@ -44,6 +46,10 @@ export interface TasksDeps {
   roles?: Record<string, string[]>;
   /** Optional: name a class for a task proposed without one. `onCampus` says whether the model call stays on campus. */
   triage?: { classify: (title: string, detail: string) => Promise<TaskClass | undefined>; onCampus: () => Promise<boolean> };
+  /** The PII screen (issue #198): a closed verdict from a model on this machine or on campus, `unknown` on any failure. */
+  piiScreen?: (text: string) => Promise<PiiVerdict>;
+  /** Each screen verdict, for the record: item, label, source and category, never the text. */
+  recordScreen?: (record: ScreenRecord) => void;
   /** Turn-free coordination (issue #107): configured and no PII task open. Asked at each use. */
   turnFree?: () => boolean;
   /** Whether a peer's context path for facts is verified in its current session (issue #108). */
@@ -96,7 +102,7 @@ export const samePlace = (a: string, b: string) => {
 };
 
 /** Events that hand a task to an owner (or take it away); newer history records that owner on them (#67). */
-const OWNERSHIP_EVENTS = new Set(["assigned", "escalated", "reassigned", "unassigned"]);
+export const OWNERSHIP_EVENTS = new Set(["assigned", "escalated", "reassigned", "unassigned"]);
 /** The note on an accept recorded by the done call itself: its stages are unknown to the split prediction (issue #109). */
 const WITH_DONE = "with its done";
 /** How many times a task changed hands: a cohort member's generation (issue #107). */
@@ -130,6 +136,10 @@ function cleanPlan(input: unknown): TaskPlan {
 
 /** A plan as one line for other owners; the whole plan is on the board. */
 const planText = (plan: TaskPlan = {}) => PLAN_KEYS.filter((k) => plan[k]?.length).map((k) => `${k.replace("_", " ")}: ${plan[k]!.join("; ")}`).join(" | ");
+/** What the PII screen reads of a task (#198): the text the patterns are checked against. */
+const screenText = (t: { title: string; detail: string; plan?: TaskPlan }) => [t.title, t.detail, planText(t.plan)].join("\n");
+/** Re-screens of one task whose verdict was unknown, per hub run (#198). */
+const RESCREEN_MAX = 10;
 
 /**
  * The task flow. Adapters and tools never touch the board: every change comes through here, where assignment,
@@ -164,6 +174,42 @@ export class Tasks {
 
   isPii = (task: Pick<Task, "signals">) => task.signals.includes("pii") && this.d.routing().constraints.pii === "local_only";
 
+  /** `signals.pii_screen = "local"` where the PII constraint applies (issue #198); on without a screener, every verdict is unknown. */
+  private screenOn = (): boolean => {
+    const r = this.d.routing();
+    return r.signals.pii_screen === "local" && r.constraints.pii === "local_only";
+  };
+
+  /** One bounded screen call. A screener that fails is no verdict, handled as PII (fail closed). */
+  private async screenCall(text: string): Promise<PiiVerdict> {
+    return (await this.d.piiScreen?.(text).catch(() => undefined)) ?? { label: "unknown", miss: "failed", ms: 0 };
+  }
+
+  private recordScreen(task: number | undefined, item: ScreenItem, v: PiiVerdict | undefined): void {
+    const record: ScreenRecord = !v
+      ? { item, label: "pii", source: "regex" }
+      : { item, label: v.label === "clear" ? "clear" : "pii", source: v.label === "unknown" ? "unknown" : "screen", ...(v.category ? { category: v.category } : {}), ...(v.miss ? { miss: v.miss } : {}), ms: v.ms };
+    try {
+      this.d.recordScreen?.({ ...(task === undefined ? {} : { task }), ...record });
+    } catch { /* telemetry only */ }
+  }
+
+  /**
+   * Whether the model screen withholds free text about an ordinary task (issue #198): it is on and its verdict is not
+   * `clear`. Text that matches a pattern needs no call (the #69 checks withhold it; only the record says so), and a PII
+   * task's text is private. Tool callers are models: anything but a string is not screened, so `off` stays as it was.
+   */
+  private async withholds(item: ScreenItem, text: unknown, task?: Task): Promise<boolean> {
+    if (typeof text !== "string" || !text.trim() || !this.screenOn() || (task && this.isPii(task))) return false;
+    if (!this.nameable(text)) return (this.recordScreen(task?.id, item, undefined), false);
+    const v = await this.screenCall(text);
+    this.recordScreen(task?.id, item, v);
+    return v.label !== "clear";
+  }
+
+  /** Why free text is withheld: the pattern check first, as #69 words it. */
+  private whyWithheld = (text: string) => (this.nameable(text) ? "the PII screen did not clear it" : "it matches a PII pattern");
+
   /** Task-owned, default-off between-turn ladder. Persist before sending so restart cannot repeat a step. */
   async sweep(now = Date.now()): Promise<{ task: number; finding: SweepRecord }[]> {
     const recorded: { task: number; finding: SweepRecord }[] = [];
@@ -191,8 +237,9 @@ export class Tasks {
           }
         } else {
           const reviewer = finding.kind === "review-pending";
-          const a = assign(task, this.states(), this.d.routing(), { exclude: [...this.declined(task), responsible], waitsFor: this.waitsFor(task), ...(reviewer ? { candidates: [], notReviewer: task.owner ?? undefined } : {}), ...this.weights(task.class) });
+          const a = assign(task, this.states(), this.d.routing(), { exclude: [...this.excluded(task), responsible], waitsFor: this.waitsFor(task), ...(reviewer ? { candidates: [], notReviewer: task.owner ?? undefined } : {}), ...this.weights(task.class) });
           const candidate = reviewer ? a.reviewer : a.owner;
+          this.passedOver(task, a);
           this.d.notify(`${message} ${reviewer ? "Reviewer" : "Owner"} reassignment suggestion: ${candidate ?? "no eligible peer"}.`);
           if (!reviewer && candidate && this.sweepConfig.auto_reassign && this.sweepAvailable(candidate)) {
             await this.assignOwner(this.d.board.get(task.id)!, HUB, { candidates: [candidate], exclude: [responsible], event: "reassigned", reason: "idle", note: `idle sweep: ${finding.kind}; from ${responsible}` });
@@ -205,7 +252,7 @@ export class Tasks {
 
   private sweepAvailable(peer: PeerId): boolean {
     const bus = this.d.bus;
-    return bus.stateOf(peer) === "idle" && (this.d.idle?.(peer) ?? true) && !this.d.held?.()[peer] && !bus.queueSummary(peer).heldBy && !bus.queued(peer) && !bus.hasInFlight(peer);
+    return bus.stateOf(peer) === "idle" && (this.d.idle?.(peer) ?? true) && !peerEntry(this.d.held?.(), peer) && !bus.queueSummary(peer).heldBy && !bus.queued(peer) && !bus.hasInFlight(peer);
   }
 
   private sweepNotice(task: Task, peer: PeerId, body: string): void {
@@ -223,14 +270,19 @@ export class Tasks {
   /** Charge only budgets matching the task actually delivered to this peer, plus active run budgets. */
   admitExecution = (taskId: number | undefined, peer: PeerId, unit: ExecutionUnit, amount = 1): ExecutionBudgetDecision[] => this.d.executionBudget?.admitTask(taskId, peer, unit, amount) ?? [];
   /** A digest may include several tasks. Charge each matching task budget and each run budget once, atomically. */
-  admitExecutionEnvelopes = (envs: Envelope[], peer: PeerId, unit: ExecutionUnit, amount = 1): ExecutionBudgetDecision[] => {
-    const ids = [...new Set(envs.flatMap((e) => {
+  admitExecutionEnvelopes = (envs: Envelope[], peer: PeerId, unit: ExecutionUnit, amount = 1): ExecutionBudgetDecision[] =>
+    this.d.executionBudget?.admitTasks(this.budgetTaskIds(envs), peer, unit, amount) ?? [];
+
+  /** Whether an execution budget meters this peer's work on these envelopes; admits nothing. */
+  budgetApplies = (envs: Envelope[], peer: PeerId): boolean => this.d.executionBudget?.applies(this.budgetTaskIds(envs), peer) ?? false;
+
+  private budgetTaskIds(envs: Envelope[]): number[] {
+    return [...new Set(envs.flatMap((e) => {
       const value = e.refs?.task;
       const id = typeof value === "string" ? Number(value) : NaN;
       return Number.isSafeInteger(id) && id > 0 ? [id] : [];
     }))];
-    return this.d.executionBudget?.admitTasks(ids, peer, unit, amount) ?? [];
-  };
+  }
 
   /** What peers other than the owner, the console stream and the log may see of a task. */
   publicTitle = (task: Task) => (this.isPii(task) ? `#${task.id} [pii]` : `#${task.id} ${task.title}`);
@@ -239,10 +291,10 @@ export class Tasks {
   publicView(task: Task, fullHistory = false): Record<string, unknown> {
     const { title, detail, history, ...rest } = task;
     if (this.isPii(task)) return { ...rest, refs: {}, plan: {}, title: "[pii]", detail: "[pii]" };
-    const screenHistoryText = (text: string, field: string): string => this.nameable(text) ? text : `[history ${field} withheld: it matches a PII pattern; ahub task show ${task.id}]`;
+    const screenHistoryText = (text: string, field: string, withheld = false): string => !withheld && this.nameable(text) ? text : `[history ${field} withheld: ${this.whyWithheld(text)}; ahub task show ${task.id}]`;
     const publicHistory = (fullHistory ? history : history.slice(-5)).map(h => ({
       at: h.at, by: h.by, event: h.event,
-      ...(h.note === undefined ? {} : { note: screenHistoryText(h.note, "note") }),
+      ...(h.note === undefined ? {} : { note: screenHistoryText(h.note, "note", h.withheld) }),
       ...(h.profile === undefined ? {} : { profile: screenHistoryText(h.profile, "profile") }),
       ...(h.owner === undefined ? {} : { owner: h.owner }),
       ...(h.reason && TASK_MOVE_REASONS.includes(h.reason) ? { reason: h.reason } : {}),
@@ -257,7 +309,7 @@ export class Tasks {
     const noReview = task.class !== "review" && !task.reviewer && OPEN.includes(task.state) && !this.waitsFor(task).length
       ? this.noReviewer(assign(task, this.states(), this.d.routing(), { candidates: task.owner ? [task.owner] : [], notReviewer: task.owner ?? undefined, ...this.weights(task.class) }))
       : undefined;
-    const held = task.owner ? this.d.held?.()[task.owner] : undefined;
+    const held = task.owner ? peerEntry(this.d.held?.(), task.owner) : undefined;
     const holdText = held ? `${task.owner}'s queue is held (${held}); it receives the task once the hold is resolved` : undefined;
     return [base, noReview, holdText].filter(Boolean).join("; ");
   }
@@ -390,7 +442,7 @@ export class Tasks {
       // delivered) or in which it claimed it: the routed peer this very task, the other owner the overlapped one while it
       // is not started. Busy otherwise, it is at work on something else (#109, #115; a routing or cohort record is taken
       // before the task is sent, so a busy candidate is not available then).
-      available: Object.fromEntries(peers.map((p) => [p, !failing[p] && (states[p] === "idle" || taking(p))])),
+      available: Object.fromEntries(peers.map((p) => [p, !peerEntry(failing, p) && (states[p] === "idle" || taking(p))])),
     });
   }
 
@@ -419,7 +471,7 @@ export class Tasks {
   async propose(by: PeerId, input: { title?: string; detail?: string; class?: string; refs?: TaskRefs; plan?: TaskPlan; owner?: PeerId; after?: unknown; urgent?: unknown }): Promise<Task> {
     // Callers are models: a title is one line (it is part of console and hub.log lines), not a document.
     const title = String(input.title ?? "").replace(/\s+/g, " ").trim().slice(0, 300);
-    if (!title) throw new Error("title is required");
+    if (!title) throw new PreEffectToolRefusal("title is required");
     // Dependencies can only name tasks that exist, so the new task closes no cycle: nothing can depend on it yet.
     // Callers are models: a missing or null `after` is no dependency, and an id is an integer or a digit string.
     let afterIds: unknown[] = [];
@@ -428,49 +480,98 @@ export class Tasks {
     const deps: number[] = [];
     for (const v of afterIds) {
       const id = typeof v === "number" || (typeof v === "string" && /^\s*\d+\s*$/.test(v)) ? Number(v) : NaN;
-      if (!Number.isInteger(id)) throw new Error(`after: ${JSON.stringify(v)} is not a task id`);
-      if (!this.d.board.get(id)) throw new Error(`after: no task #${id}`);
+      if (!Number.isInteger(id)) throw new PreEffectToolRefusal(`after: ${JSON.stringify(v)} is not a task id`);
+      if (!this.d.board.get(id)) throw new PreEffectToolRefusal(`after: no task #${id}`);
       if (!deps.includes(id)) deps.push(id);
     }
-    const waits = this.waitsFor({ deps });
-    if (waits.length && input.owner) {
-      throw new Error(`this task would wait for ${waits.map((id) => `#${id}`).join(", ")}, not approved yet: ${input.owner === by ? "claim it once they are" : "propose it without an owner; routing offers it when they are approved"}`);
-    }
+    // An owner for work that waits is reserved (issue #207): routing offers it to that peer first once it is ready.
+    const reserved = this.waitsFor({ deps }).length ? input.owner : undefined;
     const given = input.class === undefined || input.class === "" ? undefined : input.class;
-    if (given !== undefined && !CLASSES.includes(given as TaskClass)) throw new Error(`class must be one of ${CLASSES.join(", ")}`);
+    if (given !== undefined && !CLASSES.includes(given as TaskClass)) throw new PreEffectToolRefusal(`class must be one of ${CLASSES.join(", ")}`);
     const text = { title, detail: String(input.detail ?? "").slice(0, 8000), refs: cleanRefs(input.refs) };
     const plan = cleanPlan(input.plan);
     // The plan reaches other owners, so a PII pattern in it makes the task a PII task like one in the detail would.
     const signals = detectSignals({ ...text, detail: [text.detail, planText(plan)].join("\n") }, this.d.routing(), this.d.cwd);
     // Urgent work is handed over even when its paused owner's window resets soon (issue #36).
     if (input.urgent === true && !signals.includes("urgent")) signals.push("urgent");
+    // The PII screen (issue #198) reads the same text before anything else does: until its verdict the task is on no
+    // board, in no envelope and before no other model. A pattern match is PII without a call; no verdict is PII too.
+    const screening = this.screenOn();
+    const screened = screening && !signals.includes("pii") ? await this.screenCall(screenText({ ...text, plan })) : undefined;
+    if (screened && screened.label !== "clear") signals.push("pii");
     let cls = given as TaskClass | undefined;
     let triaged = false;
+    let fenced = false; // a PII task off campus: triage is not asked
     if (!cls && this.d.triage) {
       // Signals first: a PII task's text may only go to a model that is reached without leaving the campus network.
       const pii = signals.includes("pii") && this.d.routing().constraints.pii === "local_only";
       if (!pii || (await this.d.triage.onCampus().catch(() => false))) cls = await this.d.triage.classify(text.title, text.detail).catch(() => undefined);
+      else fenced = true;
       triaged = !!cls;
     }
     // A claim is work the caller will do itself: without a class and a model to name one, it is implementation (#6).
     const defaulted = !cls && input.owner === by;
     if (defaulted) cls = "implement";
-    if (!cls) throw new Error(`class is required (one of ${CLASSES.join(", ")}); the hub could not name one for you`);
+    if (!cls) throw new PreEffectToolRefusal(`class is required (one of ${CLASSES.join(", ")}); ${fenced ? "the task is handled as PII and the hub's model is not reached on campus, so it was not asked to name one" : "the hub could not name one for you"}`);
     const draft = { ...text, class: cls };
-    let task = this.d.board.propose(by, { ...draft, plan, ...(deps.length ? { deps } : {}), signals });
+    let task = this.d.board.propose(by, { ...draft, plan, ...(deps.length ? { deps } : {}), ...(reserved ? { reserved } : {}), signals });
+    if (screening) task = this.screenedTask(task, screened);
     if (triaged) task = this.d.board.update(task.id, "hub", "triaged", {}, `class ${cls} named by the hub's model`);
     if (defaulted) task = this.d.board.update(task.id, "hub", "class defaulted", {}, "class implement for a claim without one");
     this.d.notify(`task ${this.publicTitle(task)} proposed by ${by} [${task.class}]${task.signals.length ? ` signals: ${task.signals.join(", ")}` : ""}`);
     // Re-read: a dependency approved while triage was awaited looked for its dependents before this row existed.
     const still = this.waitsFor(task);
     if (still.length) {
-      this.d.notify(`task ${this.publicTitle(task)} waits for ${still.map((id) => `#${id}`).join(", ")}; it is offered once they are approved`);
+      this.d.notify(`task ${this.publicTitle(task)} waits for ${still.map((id) => `#${id}`).join(", ")}; it is offered ${task.reserved ? `to ${task.reserved} first ` : ""}once they are approved`);
       return this.d.board.update(task.id, HUB, "blocked", {}, `waits for ${still.map((id) => `#${id}`).join(", ")}`);
     }
     // Naming yourself is a claim: the work is already yours, so no offer comes back to you (paper: Agensh CLAIM, #68).
     return this.assignOwner(task, by, input.owner ? { candidates: [input.owner], claim: input.owner === by } : {});
   }
 
+  /** Where a screened task's `pii` signal came from, on its history and in events (issue #198); no verdict is a console line by id. */
+  private screenedTask(task: Task, v: PiiVerdict | undefined): Task {
+    this.recordScreen(task.id, "task", v);
+    if (v?.label === "unknown") this.d.notify(`task #${task.id}: the PII screen gave no verdict (${v.miss}); it is handled as a PII task`);
+    const note = !v ? "pii: regex" : v.label === "clear" ? "clear" : v.label === "pii" ? `pii: screen, ${v.category}` : `pii: unknown, ${v.miss}`;
+    return this.d.board.update(task.id, HUB, "screened", {}, note);
+  }
+
+  /** How often each task was screened again in this hub run. ponytail: in memory, so a restart allows another round. */
+  private readonly rescreens = new Map<number, number>();
+
+  /**
+   * A task whose screen gave no verdict waits as a PII task (#198). While it is proposed and no peer ever owned it,
+   * nothing private was sent anywhere, so the daemon's release timer asks again here: one task per call (the timer runs
+   * one at a time), the least tried first, at most RESCREEN_MAX times each in a hub run; text too long for the screen
+   * never clears. `clear` lifts the pii signal and routes the task as usual (a named owner is not remembered, a reserved
+   * one is offered first as always), `pii` settles it, another unknown changes only the record. A task an owner took
+   * (`local`), even one declined back since, keeps its PII path: its notes, summary and decline reason are not screened.
+   */
+  async rescreen(): Promise<void> {
+    if (!this.screenOn()) return;
+    const waiting = (t: Task) => {
+      const last = [...t.history].reverse().find((h) => h.event === "screened")?.note ?? "";
+      return t.state === "proposed" && !t.owner && !t.history.some((h) => h.owner) && t.signals.includes("pii") && last.startsWith("pii: unknown") && last !== "pii: unknown, too long";
+    };
+    const tries = (t: Task) => this.rescreens.get(t.id) ?? 0;
+    const task = this.d.board.list("proposed").filter((t) => waiting(t) && tries(t) < RESCREEN_MAX).sort((a, b) => tries(a) - tries(b))[0];
+    if (!task) return;
+    this.rescreens.set(task.id, (this.rescreens.get(task.id) ?? 0) + 1);
+    const text = screenText(task);
+    const v = this.nameable(text) ? await this.screenCall(text) : undefined; // a pattern added since settles it
+    const now = this.d.board.get(task.id);
+    if (!now || !waiting(now)) return; // taken or moved meanwhile: its verdict stands
+    this.recordScreen(task.id, "task", v);
+    if (v?.label === "unknown") return;
+    if (v?.label !== "clear") return void this.d.board.update(task.id, HUB, "screened", {}, v ? `pii: screen, ${v.category}` : "pii: regex");
+    const lifted = this.d.board.update(task.id, HUB, "screened", { signals: now.signals.filter((s) => s !== "pii") }, "clear, screened again");
+    this.d.notify(`task ${this.publicTitle(lifted)}: the PII screen cleared it on a second look; it is routed as usual`);
+    const still = this.waitsFor(lifted);
+    if (still.length) return void this.d.board.update(lifted.id, HUB, "blocked", {}, `waits for ${still.map((id) => `#${id}`).join(", ")}`);
+    await this.assignOwner(lifted, HUB);
+  }
+
   /**
    * Open tasks of other owners whose paths overlap this one's. The later claimant settles it with the other owner, so
    * only the new owner reads "settle it"; anyone else learns that the owner was told. PII tasks are left out on both
@@ -564,12 +665,12 @@ export class Tasks {
    * Model-written free text about an ordinary task (a done summary, a review note with its unmet items, a handoff)
    * that matches a PII pattern stays on this machine (#69): every peer gets a stub, `local` too, which handles an
    * ordinary task's turn like any other (gateway off campus allowed, memory capture on). The board keeps the text for
-   * `ahub task show`. A PII task's messages are private already.
+   * `ahub task show`. A PII task's messages are private already. `withheld`: the PII screen did not clear it (#198).
    */
-  private screen(task: Task, text: string, what: string, to: PeerId | null | undefined): string {
-    if (!text || this.isPii(task) || to === USER || this.nameable(text)) return text;
-    this.d.notify(`task #${task.id}: the ${what} was withheld from ${to ?? "a peer"} (it matches a PII pattern)`);
-    return `[${what} withheld: it matches a PII pattern; ahub task show ${task.id}]`;
+  private screen(task: Task, text: string, what: string, to: PeerId | null | undefined, withheld = false): string {
+    if (!text || this.isPii(task) || to === USER || (!withheld && this.nameable(text))) return text;
+    this.d.notify(`task #${task.id}: the ${what} was withheld from ${to ?? "a peer"} (${this.whyWithheld(text)})`);
+    return `[${what} withheld: ${this.whyWithheld(text)}; ahub task show ${task.id}]`;
   }
 
   /** Where two tasks meet: shared paths, then shared symbols, leaving out any name that matches a PII pattern. */
@@ -648,7 +749,7 @@ export class Tasks {
         // Awaits run between tasks (briefs, memory): re-read, and stop for anything that changed meanwhile.
         const task = this.d.board.get(id);
         if (!task || task.owner !== peer || !OPEN.includes(task.state) || this.d.bus.stateOf(peer) !== "offline") continue;
-        if (!assign(task, this.states(), this.d.routing(), { exclude: [...this.declined(task), peer], ...this.health() }).owner) continue;
+        if (!assign(task, this.states(), this.d.routing(), { exclude: [...this.excluded(task), peer], ...this.health() }).owner) continue;
         try {
           const back = task.state === "in_progress" ? this.d.board.update(task.id, HUB, "released", { state: "proposed" }, why) : task;
           const next = await this.assignOwner(back, HUB, { exclude: [peer], event: "reassigned", reason: "offline", note: why });
@@ -671,12 +772,15 @@ export class Tasks {
     if (typeof target === "number") {
       const task = this.d.board.get(target);
       if (!task) throw new Error(`no task #${target}`);
-      const a = assign(task, this.states(), routing, { exclude: this.declined(task), waitsFor: this.waitsFor(task), ...this.weights(task.class) });
+      const a = assign(task, this.states(), routing, { exclude: this.excluded(task), waitsFor: this.waitsFor(task), ...this.weights(task.class) });
       // The split trace is for the pair the record is about: the task's owner when it has one (issue #109).
-      return [`task ${this.publicTitle(task)} (${task.state}, owner ${task.owner ?? "none"})`, "if it were assigned now:", ...a.trace, ...(this.splitShadow(task, task.owner ?? a.owner)?.trace ?? [])];
+      return [`task ${this.publicTitle(task)} (${task.state}, owner ${task.owner ?? "none"}${task.reserved ? `, reserved for ${task.reserved}` : ""})`, "if it were assigned now:", ...a.trace, ...(this.splitShadow(task, task.owner ?? a.owner)?.trace ?? [])];
     }
     const draft = { title: target.title, detail: target.detail ?? "", refs: target.refs ?? {} };
-    return assign({ class: target.class, signals: detectSignals(draft, routing, this.d.cwd) }, this.states(), routing, this.weights(target.class)).trace;
+    const signals = detectSignals(draft, routing, this.d.cwd);
+    const trace = assign({ class: target.class, signals }, this.states(), routing, this.weights(target.class)).trace;
+    // A draft is not sent to the PII screen (issue #198): a proposal is, and a pii or unknown verdict adds the pii signal.
+    return this.screenOn() && !signals.includes("pii") ? [...trace, "pii_screen is on: at proposal a pii or unknown verdict adds signal pii (local only)"] : trace;
   }
 
   /** Public read path: every generated line is screened, including profile/config-derived trace fields. */
@@ -684,7 +788,22 @@ export class Tasks {
     return this.explain(target).map(line => this.nameable(line) ? line : "[routing explanation withheld: it matches a PII pattern]");
   }
 
-  private declined = (task: Task) => task.history.filter((h) => h.event === "declined").map((h) => h.by);
+  /**
+   * Peers routing leaves out for good (#207): the owners a task was declined for (the console declines for one; older rows
+   * name only the decliner) and the owners it was escalated away from, so a reservation never hands it back to them.
+   */
+  private excluded = (task: Task) => task.history.flatMap((h) => (h.event === "declined" ? [h.from ?? h.by] : h.event === "escalated" && h.from ? [h.from] : []));
+
+  /**
+   * Says on the console and hub.log that routing passed over the reserved owner (#207); returns the history note's suffix.
+   * Only news is said: not when the reserved owner is the one the task moves away from, nor once it refused the task for
+   * good (its decline or escalation said that).
+   */
+  private passedOver(task: Task, a: Assignment): string {
+    if (!a.unreserved || task.reserved === task.owner || this.excluded(task).includes(task.reserved!)) return "";
+    this.d.notify(`task ${this.publicTitle(task)}: its reserved owner ${task.reserved} is passed over (${a.unreserved}); routing proceeds`);
+    return `; reserved owner ${task.reserved} passed over: ${a.unreserved}`;
+  }
 
   /** Why the task will approve directly at done: no reviewer could be picked, and who was skipped (issue #92). */
   private noReviewer(a: Assignment): string {
@@ -697,18 +816,20 @@ export class Tasks {
 
   private announceRouting(task: Task, a: Assignment): void {
     if (task.class !== "review" && !a.reviewer) this.d.notify(`task ${this.publicTitle(task)}: ${this.noReviewer(a)}`);
-    const hold = a.owner ? this.d.held?.()[a.owner] : undefined;
+    const hold = a.owner ? peerEntry(this.d.held?.(), a.owner) : undefined;
     if (hold) this.d.notify(`task ${this.publicTitle(task)}: ${a.owner}'s queue is held (${hold}); the task arrives once the hold is resolved`);
   }
 
-  private async assignOwner(task: Task, by: PeerId, opts: { candidates?: PeerId[]; event?: string; note?: string; reason?: TaskMoveReason; clearOnFail?: boolean; exclude?: PeerId[]; context?: string; claim?: boolean } = {}): Promise<Task> {
+  /** `override`: a person's explicit assign, which past refusals do not block and which drops an agent's reservation (#207). */
+  private async assignOwner(task: Task, by: PeerId, opts: { candidates?: PeerId[]; event?: string; note?: string; reason?: TaskMoveReason; clearOnFail?: boolean; exclude?: PeerId[]; context?: string; contextWithheld?: boolean; claim?: boolean; override?: boolean } = {}): Promise<Task> {
     const waits = this.waitsFor(task);
-    const a = assign(task, this.states(), this.d.routing(), { exclude: [...this.declined(task), ...(opts.exclude ?? []), ...(opts.event === "escalated" && task.owner ? [task.owner] : [])], ...(opts.candidates ? { candidates: opts.candidates } : {}), waitsFor: waits, ...this.weights(task.class) });
+    const a = assign(task, this.states(), this.d.routing(), { exclude: [...(opts.override ? [] : this.excluded(task)), ...(opts.exclude ?? []), ...(opts.event === "escalated" && task.owner ? [task.owner] : [])], ...(opts.candidates ? { candidates: opts.candidates } : {}), waitsFor: waits, ...this.weights(task.class) });
 
     if (waits.length) {
       this.d.notify(`task ${this.publicTitle(task)} waits for ${waits.map((id) => `#${id}`).join(", ")}; it is offered once they are approved`);
       return task;
     }
+    const passed = this.passedOver(task, a);
     if (!a.owner) {
       this.d.notify(`task ${this.publicTitle(task)}: no peer can take it (${a.trace.filter((l) => l.includes("skipped")).length} skipped); assign with: ahub task assign ${task.id} <peer>`);
       // Only a decline takes the task away from its owner; a failed console assign or escalation leaves it where it was.
@@ -719,7 +840,10 @@ export class Tasks {
       return task;
     }
     const profile = this.d.splitProfile?.(a.owner);
-    const next = this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(opts.event === "escalated" ? { rejections: 0 } : {}) }, opts.note ?? `to ${a.owner}`, { ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}) });
+    // A person's explicit assign replaces an agent's reservation (#207). Only a refusal keeps the owner it moves away from
+    // out for good: a reviewer's rejections or an escalation by hand, never the hub's own move after a failed delivery.
+    const lasting = opts.event === "escalated" && task.owner && (opts.reason === "rejections" || opts.reason === "manual");
+    const next = this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, `${opts.note ?? `to ${a.owner}`}${passed}`, { ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}) });
     // What calibration reads (issue #109): routing chose the first owner (no single named candidate, no claim; not an
     // escalation, relay or reassignment of work already begun), and the work overlaps another owner's task not started
     // yet. For the record only. Work routed back to its proposer is left out, as its observations are (by === owner).
@@ -744,14 +868,16 @@ export class Tasks {
       this.d.notify(`task ${this.publicTitle(claimed)} claimed by ${by}`);
       return claimed;
     }
-    await this.sendTask(next, a, opts.context, this.overlaps(next, true, hits));
+    await this.sendTask(next, a, opts.context, this.overlaps(next, true, hits), opts.contextWithheld);
     return next;
   }
 
-  private async sendTask(task: Task, a: Assignment, context?: string, overlap = ""): Promise<void> {
+  /** `contextWithheld`: the PII screen did not clear a budget hand-off (#198); an escalation's reason is the hub's own words. */
+  private async sendTask(task: Task, a: Assignment, context?: string, overlap = "", contextWithheld = false): Promise<void> {
     const pii = this.isPii(task);
     const brief = pii ? undefined : await this.d.briefs?.forTask(task.owner!, task).catch(() => undefined);
-    const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${this.screen(task, h.note ?? "", "review note", a.owner)}`);
+    const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${this.screen(task, h.note ?? "", "review note", a.owner, h.withheld)}`);
+    const handoff = context && !pii ? this.screen(task, context, "handoff", a.owner, contextWithheld).slice(0, 3000) : "";
     const facts = [`class ${task.class}`, a.owner === PI ? `backend pi/${a.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", a.reviewer ? `reviewer ${a.reviewer}` : task.class === "review" ? "no reviewer" : this.noReviewer(a)].filter(Boolean).join("; ");
     const plan = planText(task.plan);
     const body = [
@@ -763,7 +889,7 @@ export class Tasks {
       rejected.length ? `Earlier review notes:\n${rejected.join("\n")}` : "",
       brief ?? "",
       // What the previous owner left behind. Peer-written free text: never attached to a PII task.
-      context && !pii ? `Handoff from the previous owner:\n${this.screen(task, context, "handoff", a.owner).slice(0, 3000)}` : "",
+      handoff ? `Handoff from the previous owner:\n${handoff}` : "",
       `Take it with hub_task_accept {id: ${task.id}, plan: {paths, symbols, signatures, insertion_points}} (what you will change, before you start${pii ? "" : "; owners of overlapping tasks see it"}) or pass with hub_task_decline. When finished: hub_task_done {id: ${task.id}, summary: what changed, why, and the check you ran with its result, refs}.`,
     ].filter(Boolean).join("\n\n");
     // A hand-over the owner takes in a turn of its own (#109, #115): idle before, busy after and not queued, this envelope
@@ -777,58 +903,85 @@ export class Tasks {
   }
 
   /** Nobody, the console user included, works on a task before what it waits for is approved. */
-  private ready(task: Task): void {
+  private ready(task: Task, preEffect = false): void {
     const waits = this.waitsFor(task);
-    if (waits.length) throw new Error(`task #${task.id} waits for ${waits.map((id) => `#${id}`).join(", ")}, not approved yet`);
+    if (waits.length) throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id} waits for ${waits.map((id) => `#${id}`).join(", ")}, not approved yet`);
   }
 
   /** An approved task may be the last thing others waited for: those go through assignment now (issue #34). */
   private async releaseDependents(approved: Task): Promise<void> {
-    for (const t of this.d.board.list("proposed")) {
-      if (!t.deps?.includes(approved.id) || t.owner || this.waitsFor(t).length) continue;
-      await this.offerReady(t, `#${approved.id} approved`);
+    try {
+      for (const t of this.d.board.list("proposed")) {
+        if (!t.deps?.includes(approved.id) || t.owner || this.waitsFor(t).length) continue;
+        await this.offerReady(t, `#${approved.id} approved`);
+      }
+    } catch (e) {
+      this.releaseNotice(`task #${approved.id}: could not release dependents: ${e instanceof Error ? e.message : String(e)}`);
     }
   }
 
-  private readonly offered = new Set<number>(); // ready tasks offered in this hub run
+  /** Notifications may read the same unavailable board; they must not undo a saved approval's return. */
+  private releaseNotice(line: string): void {
+    try { this.d.notify(line); } catch { /* best effort; the release timer retries ownerless work */ }
+  }
+
+  private readonly offered = new Set<number>(); // assignments in this hub run, including offers still in flight
   private readonly sent = new Map<string, PeerId>(); // hand-over (`handOver`) -> owner, for the owner's current turn: its task envelope started it, or it claimed the task in it
 
   /**
    * A stop between an approval and the assignment of its dependents (both are saved on their own) leaves them ownerless
    * with nothing left to wait for, and no later approval to offer them. The daemon calls this on its release timer:
-   * each such task is offered once per hub run, once an attached peer can take it (peers attach one by one).
+   * each such task is offered once an attached peer can take it (peers attach one by one). Only an assignment uses
+   * up its offer for this hub run; a failed or ownerless offer stays eligible, after approval and on the timer alike.
    */
   async releaseReady(): Promise<void> {
     for (const t of this.d.board.list("proposed")) {
       const last = t.history.at(-1)?.event;
-      if (!t.deps?.length || t.owner || this.offered.has(t.id) || (last !== "blocked" && last !== "ready") || this.waitsFor(t).length) continue;
-      if (!assign(t, this.states(), this.d.routing(), { exclude: this.declined(t), ...this.health() }).owner) continue; // nobody attached can take it yet
+      if (!t.deps?.length || t.owner || this.offered.has(t.id) || (last !== "blocked" && last !== "ready" && last !== "reserved") || this.waitsFor(t).length) continue;
+      // ponytail: a reserved owner (#207) that attaches after another peer that can take the task is passed over here like
+      // an offline one; hold reserved tasks for a grace period if restarts show that up.
+      if (!assign(t, this.states(), this.d.routing(), { exclude: this.excluded(t), ...this.health() }).owner) continue; // nobody attached can take it yet
       await this.offerReady(t, "nothing left to wait for");
     }
   }
 
   /** Callers hold a list read before an await: re-read, or a task the other caller offered meanwhile is offered twice. */
   private async offerReady(stale: Task, why: string): Promise<void> {
-    const t = this.d.board.get(stale.id);
-    if (!t || t.state !== "proposed" || t.owner || this.offered.has(t.id)) return;
-    this.offered.add(t.id);
-    const ready = t.history.at(-1)?.event === "ready" ? t : this.d.board.update(t.id, HUB, "ready", {}, why);
-    this.d.notify(`task ${this.publicTitle(ready)} is ready: what it waited for is approved`);
-    await this.assignOwner(ready, HUB).catch((e: Error) => this.d.notify(`task ${this.publicTitle(ready)}: could not be assigned: ${e.message}`));
+    let offering = false;
+    try {
+      const t = this.d.board.get(stale.id);
+      if (!t || t.state !== "proposed" || t.owner || this.offered.has(t.id)) return;
+      this.offered.add(t.id);
+      offering = true;
+      const ready = t.history.at(-1)?.event === "ready" ? t : this.d.board.update(t.id, HUB, "ready", {}, why);
+      this.releaseNotice(`task ${this.publicTitle(ready)} is ready: what it waited for is approved`);
+      await this.assignOwner(ready, HUB);
+    } catch (e) {
+      this.releaseNotice(`task ${this.publicTitle(stale)}: could not be assigned: ${e instanceof Error ? e.message : String(e)}`);
+    } finally {
+      if (offering) {
+        try {
+          if (!this.d.board.get(stale.id)?.owner) this.offered.delete(stale.id);
+        } catch (e) {
+          this.offered.delete(stale.id);
+          this.releaseNotice(`task ${this.publicTitle(stale)}: could not verify assignment: ${e instanceof Error ? e.message : String(e)}`);
+        }
+      }
+    }
   }
 
-  private mine(task: Task, by: PeerId, role: "owner" | "reviewer"): void {
-    if (by !== USER && task[role] !== by) throw new Error(`task #${task.id}: only its ${role} (${task[role] ?? "none"}) or the console user can do that`);
+  private mine(task: Task, by: PeerId, role: "owner" | "reviewer", preEffect = false): void {
+    if (by !== USER && task[role] !== by) throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id}: only its ${role} (${task[role] ?? "none"}) or the console user can do that`);
   }
 
-  private need(id: unknown, open = false): Task {
+  private need(id: unknown, open = false, preEffect = false): Task {
     // Callers are models (#70): an id is a whole number or a digit string, never an array that Number() would accept.
     const n = typeof id === "number" ? id : typeof id === "string" && /^\s*\d+\s*$/.test(id) ? Number(id) : NaN;
-    if (!Number.isInteger(n)) throw new Error(`id must be a task number, not ${(typeof id === "number" ? String(id) : JSON.stringify(id ?? null)).slice(0, 60)}`);
+    if (!Number.isInteger(n)) throw new (preEffect ? PreEffectToolRefusal : Error)(`id must be a task number, not ${(typeof id === "number" ? String(id) : JSON.stringify(id ?? null)).slice(0, 60)}`);
     const task = this.d.board.get(n);
-    if (!task) throw new Error(`no task #${n}`);
+    if (!task) throw new (preEffect ? PreEffectToolRefusal : Error)(`no task #${n}`);
     // Handing a task to someone else only makes sense while there is work left on it.
-    if (open && !OPEN.includes(task.state)) throw new Error(`task #${task.id} is ${task.state}: it can no longer change hands`);
+    if (open && !OPEN.includes(task.state)) throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id} is ${task.state}: it can no longer change hands`);
     return task;
   }
 
@@ -837,15 +990,16 @@ export class Tasks {
    * announced like one found at assignment (issue #31).
    */
   accept(by: PeerId, id: unknown, plan?: unknown): Task {
-    const task = this.need(id);
-    this.mine(task, by, "owner");
-    this.ready(task);
+    const task = this.need(id, false, true);
+    this.mine(task, by, "owner", true);
+    this.ready(task, true);
+    if (task.state !== "proposed" && task.state !== "changes_requested" && task.state !== "in_progress") throw new PreEffectToolRefusal(`task #${task.id} is ${task.state}: cannot move to in_progress`);
     // Models send null or {} for an optional field they leave empty: neither replaces a plan.
     const given = plan == null ? undefined : cleanPlan(plan);
     const cleaned = given && Object.keys(given).length ? given : undefined;
     // A task's signals are fixed when it is proposed: text that matches a PII pattern cannot be let in afterwards.
     if (cleaned && !this.isPii(task) && this.isPii({ signals: detectSignals({ title: "", detail: planText(cleaned), refs: {} }, this.d.routing(), this.d.cwd) })) {
-      throw new Error("this plan matches a PII pattern and is not kept: other owners would see it");
+      throw new PreEffectToolRefusal("this plan matches a PII pattern and is not kept: other owners would see it");
     }
     const before = new Set(this.overlapHits(task).map((h) => h.task.id));
     const next = this.d.board.update(task.id, by, "accepted", { state: "in_progress", ...(cleaned ? { plan: cleaned } : {}) });
@@ -904,9 +1058,10 @@ export class Tasks {
   };
 
   async decline(by: PeerId, id: unknown, reason?: string): Promise<Task> {
-    const task = this.need(id, true);
-    this.mine(task, by, "owner");
-    const back = this.d.board.update(task.id, by, "declined", task.state === "in_progress" ? { state: "proposed" } : {}, reason);
+    const task = this.need(id, true, true);
+    this.mine(task, by, "owner", true);
+    // The owner it is declined for goes on the entry, also when the console declines for it: `excluded()` keeps it out (#207).
+    const back = this.d.board.update(task.id, by, "declined", task.state === "in_progress" ? { state: "proposed" } : {}, reason, task.owner ? { from: task.owner } : {});
     this.d.notify(`task ${this.publicTitle(back)} declined by ${by}${reason && !this.isPii(back) ? `: ${reason}` : ""}`);
     return this.assignOwner(back, HUB, { event: "reassigned", reason: "declined", clearOnFail: true });
   }
@@ -922,14 +1077,20 @@ export class Tasks {
   isChecking = (id: number) => this.checking.has(id);
 
   async done(by: PeerId, id: unknown, summary?: string, refs?: TaskRefs): Promise<Task> {
-    let task = this.need(id);
-    this.mine(task, by, "owner");
-    if (task.state === "in_review" || task.state === "approved") throw new Error(`task #${task.id} is already ${task.state}`);
-    this.ready(task);
-    if (this.checking.has(task.id)) {
-      // The result goes only to the owner the check was started for: anyone who took the task since hears nothing.
-      throw new Error(this.checking.get(task.id) === task.owner ? `task #${task.id}: its check is still running; its result comes as a task message` : `task #${task.id}: a check from before it changed hands is still running; call hub_task_done again in a few minutes`);
-    }
+    const valid = (): Task => {
+      const t = this.need(id, false, true);
+      this.mine(t, by, "owner", true);
+      if (t.state === "in_review" || t.state === "approved") throw new PreEffectToolRefusal(`task #${t.id} is already ${t.state}`);
+      this.ready(t, true);
+      if (this.checking.has(t.id)) {
+        // The result goes only to the owner the check was started for: anyone who took the task since hears nothing.
+        throw new PreEffectToolRefusal(this.checking.get(t.id) === t.owner ? `task #${t.id}: its check is still running; its result comes as a task message` : `task #${t.id}: a check from before it changed hands is still running; call hub_task_done again in a few minutes`);
+      }
+      return t;
+    };
+    // The PII screen reads the summary of a done that passes these checks (issue #198); they run again after it.
+    const withheld = await this.withholds("summary", summary, valid());
+    let task = valid();
     // A member of a silent cohort (issue #107): its done is an intent, and the last of them integrates first.
     const cohort = this.cohorts.of(task.id);
     const silentMember = !!cohort?.silent && this.turnFree() && !!task.owner && !this.isPii(task);
@@ -960,15 +1121,15 @@ export class Tasks {
     }
     if (task.state === "proposed" || task.state === "changes_requested") task = this.d.board.update(task.id, by, "accepted", { state: "in_progress" }, WITH_DONE); // done without a separate accept
     const command = this.d.runCheck ? this.d.check?.(task.class) : undefined;
-    if (!command) return this.complete(task, by, summary, refs);
+    if (!command) return this.complete(task, by, summary, refs, "", withheld);
     // The tool call returns now; a check can outlast an agent's tool timeout. The result decides what comes next.
     this.checking.set(task.id, task.owner);
-    const pending = this.d.board.update(task.id, by, "done (checking)", { refs: cleanRefs(refs) }, summary);
+    const pending = this.d.board.update(task.id, by, "done (checking)", { refs: cleanRefs(refs) }, summary, { withheld: withheld || undefined });
     this.d.notify(`task ${this.publicTitle(pending)} done by ${by}; its check is queued or running: ${command}`);
     const seen = { events: pending.history.length, owner: pending.owner };
     this.pendingChecks++;
     this.checkQueue = this.checkQueue
-      .then(() => this.finishChecked(pending.id, by, summary, command, seen))
+      .then(() => this.finishChecked(pending.id, by, summary, command, seen, withheld))
       .catch((e: Error) => this.d.notify(`task #${pending.id}: its check result could not be recorded: ${e.message}`))
       .finally(() => this.pendingChecks--);
     return pending;
@@ -1005,7 +1166,7 @@ export class Tasks {
         const theirs = this.places(u);
         const paths = mine.paths.filter((p) => theirs.paths.some((q) => samePlace(p, q)));
         const symbols = mine.symbols.filter((x) => theirs.symbols.includes(x));
-        return paths.length || symbols.length ? [this.completedNotice(u, { task: t, paths, symbols }, at.note)] : [];
+        return paths.length || symbols.length ? [this.completedNotice(u, { task: t, paths, symbols }, at.note, at.withheld)] : [];
       });
       if (!open.length && !done.length) continue;
       const owners = [...new Set(open.map((h) => h.task.owner!))];
@@ -1033,7 +1194,8 @@ export class Tasks {
     const lines = others.map((t) => {
       const files = this.places(t).paths.filter(this.nameable);
       const signatures = (t.plan?.signatures ?? []).filter(this.nameable);
-      const first = (doneAt(t)?.note ?? "").split("\n").find((l) => l.trim())?.trim().slice(0, 300);
+      const done = doneAt(t);
+      const first = done?.withheld ? undefined : (done?.note ?? "").split("\n").find((l) => l.trim())?.trim().slice(0, 300);
       return [
         `- ${this.publicTitle(t)} (owner ${t.owner}, ${t.state})`,
         files.length ? `  changed files: ${files.join(", ")}` : "",
@@ -1049,7 +1211,7 @@ export class Tasks {
     return [head, "The done counts once the files did not change between two calls and the others have stopped.", ...lines, facts?.text ?? ""].filter(Boolean).join("\n");
   }
 
-  private async finishChecked(id: number, by: PeerId, summary: string | undefined, command: string, seen: { events: number; owner: PeerId | null }): Promise<void> {
+  private async finishChecked(id: number, by: PeerId, summary: string | undefined, command: string, seen: { events: number; owner: PeerId | null }, withheld: boolean): Promise<void> {
     const result = await this.d.runCheck!(command).catch((e: Error) => ({ code: null, timedOut: false, interrupted: false, tail: e.message }));
     this.checking.delete(id);
     const task = this.d.board.get(id);
@@ -1074,7 +1236,7 @@ export class Tasks {
       }
       this.d.board.update(id, HUB, "check passed", {}, `${outcome}\n${result.tail}`.trim());
       // The output goes to the reviewer with the done note, not into shared memory: nobody screened it.
-      await this.complete(this.d.board.get(id)!, by, `${summary ?? ""}\nCheck: ${outcome}`.trim(), undefined, result.tail);
+      await this.complete(this.d.board.get(id)!, by, `${summary ?? ""}\nCheck: ${outcome}`.trim(), undefined, result.tail, withheld);
       return;
     }
     this.d.board.update(id, HUB, "check failed", {}, `${outcome}\n${result.tail}`.trim());
@@ -1085,12 +1247,12 @@ export class Tasks {
     this.tell(task, `Task #${id}: its check failed.\n$ ${outcome}${result.tail ? `\n${result.tail}` : ""}\nFix it and call hub_task_done again.`, pii);
   }
 
-  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = ""): Promise<Task> {
+  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = "", withheld = false): Promise<Task> {
     const reviewer = task.reviewer;
-    const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", refs: cleanRefs(refs) }, checkOutput ? `${summary ?? ""}\n${checkOutput}`.trim() : summary);
+    const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", refs: cleanRefs(refs) }, checkOutput ? `${summary ?? ""}\n${checkOutput}`.trim() : summary, { withheld: withheld || undefined });
     this.cohorts.closed(next.id); // its owner's next native turn end settles it in its cohort (issue #107)
-    this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\n${summary ?? ""}`);
-    this.tellCompleted(next, summary);
+    this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\n${summary ?? ""}`, withheld);
+    this.tellCompleted(next, summary, withheld);
     if (!reviewer) {
       if (next.owner) this.d.board.recordOutcome(next.owner, next.class, true); // approved without a review is a success too
       this.d.notify(`task ${this.publicTitle(next)} done by ${by}, no reviewer: approved`);
@@ -1106,7 +1268,7 @@ export class Tasks {
    * work is done (after its check, when one runs), and nobody else does (issue #31). A message of its own, not a
    * ride-along line: an owner in the middle of those files needs it before its next task arrives.
    */
-  private tellCompleted(task: Task, summary?: string): void {
+  private tellCompleted(task: Task, summary?: string, withheld = false): void {
     const hits = this.overlapHits(task).filter((h) => h.task.owner !== USER && h.task.owner !== HUB);
     const cohort = this.cohorts.of(task.id);
     const silent = this.silentFor(task.id);
@@ -1117,19 +1279,20 @@ export class Tasks {
         cohort.held.add(task.id);
         continue;
       }
-      this.whileOpen(hit.task.owner!, hit.task.id, this.completedNotice(task, hit, summary));
+      this.whileOpen(hit.task.owner!, hit.task.id, this.completedNotice(task, hit, summary, withheld));
     }
   }
 
   /**
    * The completed-change notice: files, signatures and the summary are the owner's own words (paths given at done
-   * included), and any item that matches a PII pattern is left out of what other owners get.
+   * included), and any item that matches a PII pattern is left out of what other owners get, the summary also when the
+   * PII screen did not clear it (`withheld`, #198).
    */
-  private completedNotice(task: Task, hit: { task: Task; paths: string[]; symbols: string[] }, summary?: string): string {
+  private completedNotice(task: Task, hit: { task: Task; paths: string[]; symbols: string[] }, summary?: string, withheld = false): string {
     const paths = this.places(task).paths.filter(this.nameable);
     const signatures = (task.plan?.signatures ?? []).filter(this.nameable);
     const first = (summary ?? "").split("\n").find((l) => l.trim())?.trim().slice(0, 300);
-    const line = first && this.nameable(first) ? first : undefined;
+    const line = first && !withheld && this.nameable(first) ? first : undefined;
     return [
       `Task #${task.id} (owner ${task.owner}) is done and touches your open #${hit.task.id} on ${this.where(hit)}. Check your work against it before you go on.`,
       paths.length ? `Changed files: ${paths.join(", ")}` : "",
@@ -1144,7 +1307,7 @@ export class Tasks {
       const t = this.d.board.get(id);
       if (!t || this.isPii(t)) return [];
       const done = [...t.history].reverse().find((h) => h.event === "done");
-      return [this.completedNotice(t, { task, paths: this.places(task).paths.filter((p) => this.places(t).paths.some((q) => samePlace(p, q))), symbols: [] }, done?.note)];
+      return [this.completedNotice(t, { task, paths: this.places(task).paths.filter((p) => this.places(t).paths.some((q) => samePlace(p, q))), symbols: [] }, done?.note, done?.withheld)];
     });
     return lines.length ? lines.join("\n") : undefined;
   }
@@ -1163,21 +1326,28 @@ export class Tasks {
       `- ${check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : "No check ran for this class: run the affected tests yourself."}`,
       `- List what is unmet in hub_review's unmet, one item each.`,
     ].join("\n");
-    const summary = last?.note ? this.screen(task, last.note, "summary", reviewer) : "(no summary)";
+    const summary = last?.note ? this.screen(task, last.note, "summary", reviewer, last.withheld) : "(no summary)";
     const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
     this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, task: String(task.id) }, ...(this.isPii(task) ? { private: true } : {}) }));
   }
 
   async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown): Promise<Task> {
-    const task = this.need(id);
-    this.mine(task, by, "reviewer");
-    if (verdict !== "approved" && verdict !== "changes_requested") throw new Error('verdict must be "approved" or "changes_requested"');
-    if (task.state !== "in_review") throw new Error(`task #${task.id} is ${task.state}: cannot move to ${verdict} before its owner calls hub_task_done`);
-    const pii = this.isPii(task);
+    const valid = (): Task => {
+      const t = this.need(id, false, true);
+      this.mine(t, by, "reviewer", true);
+      if (verdict !== "approved" && verdict !== "changes_requested") throw new PreEffectToolRefusal('verdict must be "approved" or "changes_requested"');
+      if (t.state !== "in_review") throw new PreEffectToolRefusal(`task #${t.id} is ${t.state}: cannot move to ${verdict} before its owner calls hub_task_done`);
+      return t;
+    };
     const items = textList(unmet);
     if (items.length) note = `${note ?? ""}\nUnmet: ${items.join("; ")}`.trim();
+    // The PII screen reads the note of a review that passes these checks (issue #198); they run again after it.
+    const withheld = await this.withholds("review note", note, valid());
+    const task = valid();
+    const pii = this.isPii(task);
+    const flag = { withheld: withheld || undefined };
     if (verdict === "approved") {
-      const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0 }, note);
+      const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0 }, note, flag);
       if (next.owner) {
         this.d.board.recordOutcome(next.owner, next.class, true);
         this.d.board.recordReview({ implementer: next.owner, reviewer: by, class: next.class, kind: "approved", task: next.id });
@@ -1186,31 +1356,31 @@ export class Tasks {
           this.d.board.recordReview({ implementer: next.owner, reviewer: r, class: next.class, kind: "caught", task: next.id });
         }
       }
-      this.note(next, by, "decision", `Task #${next.id} approved by ${by}: ${next.title}\n${note ?? ""}`);
-      this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${this.screen(next, note, "review note", next.owner)}` : ""}`, pii);
+      this.note(next, by, "decision", `Task #${next.id} approved by ${by}: ${next.title}\n${note ?? ""}`, withheld);
+      this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${this.screen(next, note, "review note", next.owner, withheld)}` : ""}`, pii);
       await this.releaseDependents(next);
       return next;
     }
-    const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: task.rejections + 1 }, note);
+    const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: task.rejections + 1 }, note, flag);
     this.cohorts.withdraw(rejected.id); // open again: its done intent no longer counts (issue #107)
     if (rejected.owner) this.d.board.recordOutcome(rejected.owner, rejected.class, false);
     this.contradict(rejected);
-    this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`);
+    this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`, withheld);
     if (rejected.rejections >= ESCALATE_AFTER) {
       const moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`, "rejections");
       if (moved.owner !== rejected.owner) return moved;
       // Nobody to escalate to: the owner still has to hear the verdict and the note.
-      this.tell(moved, `Task #${moved.id}: ${by} requests changes again.${note ? ` ${this.screen(moved, note, "review note", moved.owner)}` : ""} Nobody else can take it; fix it and call hub_task_done again.`, pii);
+      this.tell(moved, `Task #${moved.id}: ${by} requests changes again.${note ? ` ${this.screen(moved, note, "review note", moved.owner, withheld)}` : ""} Nobody else can take it; fix it and call hub_task_done again.`, pii);
       return moved;
     }
     const reopened = this.d.board.update(rejected.id, HUB, "reopened", { state: "in_progress" });
-    this.tell(reopened, `Task #${reopened.id}: ${by} requests changes.${note ? ` ${this.screen(reopened, note, "review note", reopened.owner)}` : ""} Fix it and call hub_task_done again.`, pii);
+    this.tell(reopened, `Task #${reopened.id}: ${by} requests changes.${note ? ` ${this.screen(reopened, note, "review note", reopened.owner, withheld)}` : ""} Fix it and call hub_task_done again.`, pii);
     return reopened;
   }
 
   /** Task-level escalation: the next attached peer in the class's escalate_to takes over, with the history. */
-  async escalate(by: PeerId, id: unknown, why = "by hand", reason: TaskMoveReason | undefined = by === HUB ? undefined : "manual"): Promise<Task> {
-    let task = this.need(id, true);
+  async escalate(by: PeerId, id: unknown, why = "by hand", reason: TaskMoveReason | undefined = by === HUB ? undefined : "manual", preEffect = false): Promise<Task> {
+    let task = this.need(id, true, preEffect);
     const list = this.d.routing().classes[task.class]?.escalate_to ?? [];
     if (task.state === "changes_requested") task = this.d.board.update(task.id, HUB, "reopened", { state: "in_progress" });
     const from = task.owner;
@@ -1229,8 +1399,13 @@ export class Tasks {
   }
 
   /** Caller authority is checked by the daemon; keep the real actor in task history. */
-  async assignTo(id: unknown, peer: PeerId, by: PeerId = USER): Promise<Task> {
-    return this.assignOwner(this.need(id, true), by, { candidates: [peer], event: "reassigned", reason: "manual" });
+  async assignTo(id: unknown, peer: PeerId, by: PeerId = USER, preEffect = false): Promise<Task> {
+    const task = this.need(id, true, preEffect);
+    // Work that waits is handed to nobody yet (issue #207): the peer becomes its reserved owner instead.
+    if (!this.waitsFor(task).length) return this.assignOwner(task, by, { candidates: [peer], event: "reassigned", reason: "manual", override: by === USER });
+    const next = this.d.board.update(task.id, by, "reserved", { reserved: peer }, `for ${peer}`, { reason: "manual" });
+    this.d.notify(`task ${this.publicTitle(next)} reserved for ${peer} by ${by}; it is offered to ${peer} first once what it waits for is approved`);
+    return next;
   }
 
   /**
@@ -1240,6 +1415,9 @@ export class Tasks {
   async reassignForPause(peer: PeerId, context: string | undefined, urgentOnly = false): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
     const moved: { id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[] = [];
     const routing = this.d.routing();
+    // The hand-off is screened once (#198), before anything moves, when an ordinary task will carry it.
+    const moves = (t: Task) => (!urgentOnly || t.signals.includes("urgent")) && t.owner === peer && OPEN.includes(t.state);
+    const contextWithheld = context && this.d.board.list().some((t) => moves(t) && !this.isPii(t)) ? await this.withholds("handoff", context) : false;
     for (const task of this.d.board.list()) {
       // Waiting out a window that resets soon (issue #36): only urgent work moves.
       if (urgentOnly && !task.signals.includes("urgent")) continue;
@@ -1247,7 +1425,7 @@ export class Tasks {
         const pii = this.isPii(task);
         const candidates = [pii ? LOCAL : PI, pii ? undefined : LOCAL, ...(routing.classes[task.class]?.peers ?? []).filter((p) => p !== LOCAL && p !== PI)].filter((p): p is PeerId => !!p);
         const back = task.state === "in_progress" ? this.d.board.update(task.id, HUB, "released", { state: "proposed" }, `budget pause of ${peer}`) : task;
-        const next = await this.assignOwner(back, HUB, { candidates, exclude: [peer], event: "reassigned", reason: "budget", note: `budget pause of ${peer}`, clearOnFail: true, ...(context ? { context } : {}) });
+        const next = await this.assignOwner(back, HUB, { candidates, exclude: [peer], event: "reassigned", reason: "budget", note: `budget pause of ${peer}`, clearOnFail: true, ...(context ? { context, contextWithheld } : {}) });
         moved.push({ id: task.id, title: this.publicTitle(task), to: next.owner, role: "owner" });
       } else if (task.reviewer === peer && task.state !== "approved") {
         // No owner candidates: only the reviewer is wanted, and it must be neither the paused peer nor the task's owner.
@@ -1282,6 +1460,7 @@ export class Tasks {
     const title = String(input.title ?? "").trim();
     if (this.isPii({ signals: detectSignals({ title, detail: text, refs: {} }, this.d.routing(), this.d.cwd) })) throw new Error("this note matches a PII pattern and is not saved: claude-mem processes what it stores with a cloud model");
     if (!this.d.memory) return "memory is disabled; nothing saved";
+    if (await this.withholds("note", `${title}\n${text}`, task)) throw new Error("the PII screen did not clear this note, so it is not saved: claude-mem processes what it stores with a cloud model");
     const kind = (NOTE_KINDS as readonly string[]).includes(String(input.kind)) ? String(input.kind) : "finding";
     const res = await this.d.memory.save({ text, ...(title ? { title } : {}), project: this.d.project, metadata: { peer: by, kind, ...(task ? { task: task.id } : {}) } });
     if (!res) return "memory worker unavailable; nothing saved";
@@ -1292,10 +1471,11 @@ export class Tasks {
   }
 
   /** Auto notes: only transitions that carry content, never for PII. */
-  private note(task: Task, by: PeerId, kind: string, text: string): void {
+  private note(task: Task, by: PeerId, kind: string, text: string, withheld = false): void {
     if (this.isPii(task) || !this.d.memory) return;
-    // claude-mem's observer is a cloud model: model-written text that matches a PII pattern is not sent (#69).
-    if (!this.nameable(text)) return this.d.notify(`task #${task.id}: a ${kind} note was not saved to shared memory (it matches a PII pattern)`);
+    // claude-mem's observer is a cloud model: model-written text that matches a PII pattern, or that the PII screen did
+    // not clear (#198), is not sent (#69).
+    if (withheld || !this.nameable(text)) return this.d.notify(`task #${task.id}: a ${kind} note was not saved to shared memory (${this.whyWithheld(text)})`);
     void this.d.memory.save({ text, title: `agent-hub task #${task.id}: ${task.title}`.slice(0, 120), project: this.d.project, metadata: { peer: by, task: task.id, kind } });
   }