@staix/agent-hub 0.12.22 → 0.12.24

package/src/hub/tasks.ts

@@ -1,29 +1,57 @@
+import { readGitHubImport, type GitHubSource, type GitHubImportSelection } from "./github-import.ts";
+import { BACKLOG_SPLIT_SCREEN_TIMEOUT_MS, actualTaskDates, planningPatch, type PlanningFields, type Release, type ReleaseState } from "./planning.ts";
+import { readMergeQueue } from "./sdlc-queue.ts";
+import { readReleaseReadiness } from "./sdlc-release.ts";
+import { loadRoleCatalog, taskRole, taskRoleText, type RoleCatalog } from "./roles.ts";
+import { matchesPolicy } from "./path-policy.ts";
+import { mentionsPrivatePath } from "../memory/recall.ts";
+import { profileClass, profileData, profileTaskLabel, projectProfile, type ProfileName, type ProfileSelection, type ProjectProfile } from "./profiles.ts";
+import { phaseView, validatePhaseLinks, workflowHash } from "./workflow.ts";
 import { isAbsolute, relative } from "node:path";
 import type { Briefs } from "../memory/brief.ts";
 import type { MemoryClient } from "../memory/client.ts";
-import { CLASSES, OUTCOMES_KEPT_MS, PLAN_KEYS, TASK_MOVE_REASONS, type Board, type Task, type TaskClass, type TaskMoveReason, type TaskPlan, type TaskRefs } from "./board.ts";
+import { extractNodes, looksSecret, PROMOTED_KINDS, taskKey, type GoalView, type Kind, type MemoryStore, type Scope, type Tier } from "../memory/store.ts";
+import { CLASSES, OUTCOMES_KEPT_MS, ALL_PLAN_KEYS, TASK_MOVE_REASONS, taskHasStarted, planningUndoEntry, type HistoryEntry, type Board, type Task, type TaskClass, type TaskMoveReason, type TaskPlan, type TaskRefs } from "./board.ts";
 import type { Bus } from "./bus.ts";
-import { HUB, newEnvelope, NOTE_KINDS, noteLine, USER, type Envelope, type PeerId, type PeerState } from "./envelope.ts";
+import { HUB, newEnvelope, NOTE_KINDS, noteLine, sanitize, USER, type Envelope, type PeerId, type PeerState } from "./envelope.ts";
 import type { PiiVerdict, ScreenItem, ScreenRecord } from "./inference.ts";
 import { assign, detectSignals, LOCAL, peerEntry, PI, predictSplit, type Assignment, type Routing, type SplitObservation, type SplitPrediction } from "./routing.ts";
 import { ExecutionBudget, type ExecutionBudgetConfig, type ExecutionBudgetDecision, type ExecutionBudgetStatus, type ExecutionUnit } from "./execution-budget.ts";
 import { Cohorts, MAX_REQUESTS, type Cohort, type Completion } from "./cohorts.ts";
 import { realPath } from "./project.ts";
 import { PreEffectToolRefusal } from "./tool-refusal.ts";
+import { SUPPORTED_PEERS } from "./peer-catalog.ts";
 import { nextSweep, taskSweepConfig, type TaskSweepConfig, type SweepRecord } from "./task-sweep.ts";
+import { readSdlcPr, sdlcConfig, sdlcReceipt, sdlcStatus, stageDefinition, lifecycleStage, type SdlcConfig, sdlcGh, type SdlcGh, type SdlcStatus } from "./sdlc.ts";
+
+export type TaskAssignmentRole = "owner" | "reviewer";
 
 export interface TasksDeps {
+  /** Effective per-peer planner capacity, taken from the existing settings loader. */
+  wipLimit?: (peer: PeerId) => number;
+  recordPlanning?: (change: { by: string; task?: number; release?: number; fields: string[]; revision: number }) => void;
   board: Board;
   bus: Bus;
   routing: () => Routing;
   cwd: string;
   project: string;
+  profile?: ProfileName;
+  profileData?: ProjectProfile;
+  piiPaths?: string[];
+  catalog?: RoleCatalog;
+  /** Role ids whose contract was prepared for the current native session. */
+  sessionRoles?: (peer: PeerId) => string[];
+  /** Optional bounded snapshot presentation; never stored in task history or memory. */
+  projectedReview?: (task: Task) => string | undefined;
+  sdlc?: { config: () => SdlcConfig; gh?: SdlcGh };
   briefs?: Briefs;
   memory?: MemoryClient;
+  /** #258: the hub's own store, the project name it files entries under (the git chain) and the repo `#N` issues belong to. */
+  store?: { store: MemoryStore; project: string; repo: string; deny?: string[]; onNote?: (id: string) => void };
   /** a line for the human: console tail and hub.log */
   notify: (line: string) => void;
   /** The completion check configured for a class, if any (local config only; issue #7). */
-  check?: (cls: TaskClass) => string | undefined;
+  check?: (cls: TaskClass, task?: Task) => string | undefined;
   /** Runs one check; the hub runs them one at a time. */
   runCheck?: (command: string) => Promise<{ code: number | null; timedOut: boolean; interrupted?: boolean; tail: string }>;
   /** Hands a saved note to every other peer; it rides on their next delivery. */
@@ -90,7 +118,25 @@ const DEMOTE_AT = 1.5;
 const CONTRADICTION_WINDOW_MS = 7 * 86_400_000;
 const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
 /** Board events that leave a task where its completion check found it; any other event means it moved on meanwhile. */
-const QUIET_EVENTS = new Set(["answer", "reviewer changed", "idle sweep"]);
+const QUIET_EVENTS = new Set(["answer", "reviewer changed", "idle sweep", "memory reference started"]);
+
+/**
+ * Thrown when an assignment's board write is saved but a publish or notify after it failed (#297): the move is
+ * fact, the delivery is unconfirmed. Callers decide by this type, never by comparing owners or reading history.
+ * It stays a plain Error subclass, so the preEffect rule and the #231 ready-offer contract are unchanged.
+ * `task` and `cause` are non-enumerable: a PII task's title and detail must not reach a JSON.stringify of the error.
+ */
+export class AssignmentUndeliveredError extends Error {
+  /** The task as the board has it after the write. */
+  declare readonly task: Task;
+  declare readonly cause: unknown;
+  constructor(task: Task, cause: unknown) {
+    super(`task #${task.id}: the assignment to ${task.owner} is saved, but its delivery is not confirmed: ${cause instanceof Error ? cause.message : String(cause)}`);
+    this.name = "AssignmentUndeliveredError";
+    Object.defineProperty(this, "task", { value: task, enumerable: false });
+    Object.defineProperty(this, "cause", { value: cause, enumerable: false });
+  }
+}
 
 /** A project path as one spelling (#67): no leading `./`, no repeated or trailing `/`; the root is `.`. */
 export const normPath = (p: string) => p.replace(/^(\.\/)+/, "").replace(/\/{2,}/g, "/").replace(/\/+$/, "") || ".";
@@ -129,15 +175,15 @@ function cleanRefs(input: unknown): TaskRefs {
 }
 
 /** The same for a plan (issue #31): only its four lists, each of short strings. */
-function cleanPlan(input: unknown): TaskPlan {
+function cleanPlan(input: unknown, profile: ProfileSelection = "dev"): TaskPlan {
   const r = fields(input);
-  return Object.fromEntries(PLAN_KEYS.map((k) => [k, k === "paths" ? [...new Set(textList(r[k]).map(normPath))] : textList(r[k])] as const).filter(([, v]) => v.length));
+  return Object.fromEntries((profileData(profile).plan_keys as (keyof TaskPlan)[]).map((k) => [k, k === "paths" ? [...new Set(textList(r[k]).map(normPath))] : textList(r[k])] as const).filter(([, v]) => v.length));
 }
 
 /** A plan as one line for other owners; the whole plan is on the board. */
-const planText = (plan: TaskPlan = {}) => PLAN_KEYS.filter((k) => plan[k]?.length).map((k) => `${k.replace("_", " ")}: ${plan[k]!.join("; ")}`).join(" | ");
+const planText = (plan: TaskPlan = {}) => ALL_PLAN_KEYS.filter((k) => plan[k]?.length).map((k) => `${k.replace("_", " ")}: ${plan[k]!.join("; ")}`).join(" | ");
 /** What the PII screen reads of a task (#198): the text the patterns are checked against. */
-const screenText = (t: { title: string; detail: string; plan?: TaskPlan }) => [t.title, t.detail, planText(t.plan)].join("\n");
+const screenText = (t: { title: string; detail: string; plan?: TaskPlan; external?: Task["external"] }) => [t.title, t.detail, planText(t.plan), t.external?.repo, t.external?.url].filter(value => value !== undefined).join("\n");
 /** Re-screens of one task whose verdict was unknown, per hub run (#198). */
 const RESCREEN_MAX = 10;
 
@@ -146,12 +192,23 @@ const RESCREEN_MAX = 10;
  * PII handling, envelopes, briefs and memory notes are decided in one place.
  */
 export class Tasks {
+  private readonly incomingBacklog = new Set<number>();
+  private readonly plannerBacklog = new Map<PeerId, Set<number>>();
+  private readonly plannerBlockedQueue = new Map<PeerId, string>();
+  private readonly knownPlanners = new Set<PeerId>();
   /** Turn-free cohorts (issue #107): who works without messages, and who integrates. */
   readonly cohorts: Cohorts;
   private readonly sweepConfig: TaskSweepConfig;
   private sweeping = false;
 
   constructor(private readonly d: TasksDeps) {
+    const backlog = d.board.list("backlog");
+    for (const [peer, roles] of Object.entries(d.roles ?? {})) {
+      if (!roles.includes("planner")) continue;
+      this.knownPlanners.add(peer);
+      const queued = d.bus.queuedBacklogIds(peer);
+      this.addPlannerBacklog(peer, backlog.filter(task => !queued.has(task.id)).map(task => task.id));
+    }
     this.sweepConfig = taskSweepConfig(d.sweep);
     this.cohorts = new Cohorts({
       silence: (owners) => this.turnFree() && owners.every((p) => p !== USER && p !== HUB && (this.d.capable?.(p) ?? false)),
@@ -160,6 +217,11 @@ export class Tasks {
     // What the on-prem worker says about a PII task is private on the bus (console tail and log show a stub), so the
     // board keeps the text: `ahub task show <id>` is where the console user reads it, a refusal included.
     d.bus.tap((e) => {
+      if (e.t === "overflow" && e.env.from === HUB && e.env.kind === "task" && Array.isArray(e.env.refs?.backlog)) {
+        const ids = e.env.refs.backlog;
+        if (ids.length <= 64 && ids.every(id => Number.isSafeInteger(id) && id > 0)) this.addPlannerBacklog(e.peer, ids);
+        this.plannerBlockedQueue.set(e.peer, JSON.stringify(d.bus.queueIds(e.peer)));
+      }
       // A turn that ends takes its hand-overs with it: busy later is another turn (#115). The adapter's own state, since a
       // pause shows as `paused` while the turn goes on.
       if (e.t === "state" && d.bus.peers.get(e.peer)?.state !== "busy") for (const [k, p] of this.sent) if (p === e.peer) this.sent.delete(k);
@@ -172,7 +234,17 @@ export class Tasks {
     });
   }
 
-  isPii = (task: Pick<Task, "signals">) => task.signals.includes("pii") && this.d.routing().constraints.pii === "local_only";
+  isPii = (task: Pick<Task, "signals">) => task.signals.includes("pii_path") || (task.signals.includes("pii") && this.d.routing().constraints.pii === "local_only");
+
+  private signalsFor(task: Pick<Task, "title" | "detail" | "refs"> & { plan?: TaskPlan }, routing = this.d.routing()) {
+    const signals = detectSignals(task, routing, this.d.cwd);
+    const paths = [...(task.refs.paths ?? []), ...(task.plan?.paths ?? []), ...(task.plan?.sections ?? []).map(anchor => anchor.split("#")[0]!).filter(Boolean)];
+    if (paths.some(path => matchesPolicy(this.d.cwd, path, this.d.piiPaths ?? [], true))) {
+      if (!signals.includes("pii")) signals.push("pii");
+      signals.push("pii_path");
+    }
+    return signals;
+  }
 
   /** `signals.pii_screen = "local"` where the PII constraint applies (issue #198); on without a screener, every verdict is unknown. */
   private screenOn = (): boolean => {
@@ -185,8 +257,8 @@ export class Tasks {
     return (await this.d.piiScreen?.(text).catch(() => undefined)) ?? { label: "unknown", miss: "failed", ms: 0 };
   }
 
-  private recordScreen(task: number | undefined, item: ScreenItem, v: PiiVerdict | undefined): void {
-    const record: ScreenRecord = !v
+  private recordScreen(task: number | undefined, item: ScreenItem, v: PiiVerdict | undefined, inherited = false): void {
+    const record: ScreenRecord = inherited ? { item, label: "pii", source: "inherited" } : !v
       ? { item, label: "pii", source: "regex" }
       : { item, label: v.label === "clear" ? "clear" : "pii", source: v.label === "unknown" ? "unknown" : "screen", ...(v.category ? { category: v.category } : {}), ...(v.miss ? { miss: v.miss } : {}), ms: v.ms };
     try {
@@ -222,6 +294,7 @@ export class Tasks {
         if (!finding || this.waitsFor(task).length || this.isChecking(task.id) || this.silentFor(task.id)) continue;
         const responsible = finding.kind === "review-pending" ? task.reviewer! : task.owner!;
         if (responsible !== USER && !this.sweepAvailable(responsible)) continue;
+        if (finding.step === 3 && finding.kind !== "review-pending" && this.sweepConfig.auto_reassign && this.plannerPullRecord(task)?.pull && !assign(task, this.states(), this.d.routing(), { exclude: [...this.excluded(task), responsible], excludeOwners: this.plannerFull(task), waitsFor: this.waitsFor(task), ...this.weights(task.class) }).owner) continue;
         const title = this.publicTitle(task);
         const message = `Task ${title}: ${finding.kind}, idle escalation ${finding.step}/3.`;
         // Only identifiers, kind and step are kept in the ladder event. A crash after this write and before publish
@@ -237,12 +310,18 @@ export class Tasks {
           }
         } else {
           const reviewer = finding.kind === "review-pending";
-          const a = assign(task, this.states(), this.d.routing(), { exclude: [...this.excluded(task), responsible], waitsFor: this.waitsFor(task), ...(reviewer ? { candidates: [], notReviewer: task.owner ?? undefined } : {}), ...this.weights(task.class) });
+          const a = assign(task, this.states(), this.d.routing(), { exclude: [...this.excluded(task), responsible], excludeOwners: finding.kind !== "review-pending" && this.plannerPullRecord(task)?.pull ? this.plannerFull(task) : [], waitsFor: this.waitsFor(task), ...(reviewer ? { candidates: [], notReviewer: task.owner ?? undefined } : {}), ...this.weights(task.class) });
           const candidate = reviewer ? a.reviewer : a.owner;
           this.passedOver(task, a);
           this.d.notify(`${message} ${reviewer ? "Reviewer" : "Owner"} reassignment suggestion: ${candidate ?? "no eligible peer"}.`);
           if (!reviewer && candidate && this.sweepConfig.auto_reassign && this.sweepAvailable(candidate)) {
-            await this.assignOwner(this.d.board.get(task.id)!, HUB, { candidates: [candidate], exclude: [responsible], event: "reassigned", reason: "idle", note: `idle sweep: ${finding.kind}; from ${responsible}` });
+            try {
+              await this.assignOwner(this.d.board.get(task.id)!, HUB, { candidates: [candidate], exclude: [responsible], event: "reassigned", reason: "idle", note: `idle sweep: ${finding.kind}; from ${responsible}` });
+            } catch (e) {
+              // A saved move whose delivery failed: the console notice was printed where the error was thrown, and
+              // the sweep goes on (#297).
+              if (!(e instanceof AssignmentUndeliveredError)) throw e;
+            }
           }
         }
       }
@@ -289,18 +368,19 @@ export class Tasks {
 
   /** A task as a cloud peer may see it. */
   publicView(task: Task, fullHistory = false): Record<string, unknown> {
-    const { title, detail, history, ...rest } = task;
-    if (this.isPii(task)) return { ...rest, refs: {}, plan: {}, title: "[pii]", detail: "[pii]" };
+    const { title, detail, history, external, ...rest } = task;
+    if (this.isPii(task)) return { ...rest, actualDates: actualTaskDates(task), refs: {}, plan: {}, ...(task.sdlc ? { sdlc: { stage: stageDefinition(this.d.sdlc?.config() ?? sdlcConfig(undefined), task.sdlc.stage)?.base ?? "unknown" } } : {}), title: "[pii]", detail: "[pii]" };
     const screenHistoryText = (text: string, field: string, withheld = false): string => !withheld && this.nameable(text) ? text : `[history ${field} withheld: ${this.whyWithheld(text)}; ahub task show ${task.id}]`;
     const publicHistory = (fullHistory ? history : history.slice(-5)).map(h => ({
       at: h.at, by: h.by, event: h.event,
       ...(h.note === undefined ? {} : { note: screenHistoryText(h.note, "note", h.withheld) }),
       ...(h.profile === undefined ? {} : { profile: screenHistoryText(h.profile, "profile") }),
       ...(h.owner === undefined ? {} : { owner: h.owner }),
+      ...(h.planning ? { planning: { revision: h.planning.revision, fields: h.planning.fields, ...(h.planning.split ? { children: h.planning.split.children.map(child => child.id) } : {}) } } : {}),
       ...(h.reason && TASK_MOVE_REASONS.includes(h.reason) ? { reason: h.reason } : {}),
       ...(h.sweep ? { sweep: { kind: h.sweep.kind, activity: h.sweep.activity, step: h.sweep.step, at: h.sweep.at } } : {}),
     }));
-    return { ...rest, title, detail, history: publicHistory };
+    return { ...rest, ...(external && this.nameable(external.url) ? { external } : {}), actualDates: actualTaskDates(task), ...(((this.d.sdlc?.config().mode ?? "off") !== "off" || this.d.sdlc?.config().workflow === "gsd-lite") ? { lifecycle: sdlcStatus(this.d.sdlc?.config() ?? sdlcConfig(undefined), task.sdlc, undefined, this.workflowView(task)) } : {}), title, detail, history: publicHistory };
   }
 
   /** Console results expose direct approval and delivery holds, not just the chosen peer ids. */
@@ -371,7 +451,7 @@ export class Tasks {
   private health() {
     const failing = this.d.failing?.();
     const held = this.d.held?.();
-    return { ...(failing ? { failing } : {}), ...(held ? { held } : {}), ...(this.d.roles ? { roles: this.d.roles } : {}) };
+    return { pullOnly: [...this.d.bus.peers.values()].filter(peer => peer.id === "kimi" && peer.pullOnly).map(peer => peer.id), offRoster: SUPPORTED_PEERS.filter(peer => !this.d.bus.isRostered(peer)), ...(failing ? { failing } : {}), ...(held ? { held } : {}), ...(this.d.roles ? { roles: this.d.roles } : {}) };
   }
 
   /** What assignment weighs besides states and policy: quota, demotion and the review record. */
@@ -468,10 +548,371 @@ export class Tasks {
     }
   }
 
-  async propose(by: PeerId, input: { title?: string; detail?: string; class?: string; refs?: TaskRefs; plan?: TaskPlan; owner?: PeerId; after?: unknown; urgent?: unknown }): Promise<Task> {
+  private planningRecorded(change: { by: string; task?: number; release?: number; fields: string[]; revision: number }): void {
+    try { this.d.recordPlanning?.(change); } catch { /* telemetry never changes a durable result */ }
+  }
+
+  private planningAuthority(by: PeerId): void {
+    if (by !== USER && !this.d.roles?.[by]?.includes("planner")) throw new PreEffectToolRefusal("planning requires a person or configured planner role");
+  }
+
+  wipLimit(peer: PeerId): number {
+    const limit = this.d.wipLimit?.(peer) ?? 1;
+    if (!Number.isSafeInteger(limit) || limit < 0 || limit > 32) throw new PreEffectToolRefusal("invalid planner WIP capacity");
+    return limit;
+  }
+  private plannerPullRecord(task: Task): HistoryEntry["planning"] {
+    return task.history.findLast(entry => entry.event === "backlog pulled" || entry.event === "backlog returned")?.planning;
+  }
+  wip(peer: PeerId, except?: number): number {
+    return this.d.board.plannerWip(peer, except);
+  }
+  private prerequisiteOf(task: Task, prerequisite: number): boolean {
+    const pending = [...(task.deps ?? [])], seen = new Set<number>();
+    while (pending.length) { const id = pending.pop()!; if (id === prerequisite) return true; if (seen.has(id)) continue; seen.add(id); pending.push(...(this.d.board.get(id)?.deps ?? [])); }
+    return false;
+  }
+  private plannerFull(task: Task): PeerId[] {
+    return Object.keys(this.states()).filter(peer => { const queue = this.d.bus.queueSummary(peer); return this.wip(peer, task.id) >= this.wipLimit(peer) || !!queue.heldBy || queue.needsReview > 0; });
+  }
+  private plannerAssignment(task: Task, reservedOnly = false): Assignment {
+    const states = this.states();
+    const full = this.plannerFull(task);
+    // Preview the To Do transition without routing or offering the persisted backlog row.
+    return assign({ ...task, state: "proposed" }, states, this.d.routing(), { exclude: this.excluded(task), excludeOwners: full, ...(reservedOnly && task.reserved && !this.excluded(task).includes(task.reserved) ? { candidates: [task.reserved], namedOwner: task.reserved } : {}), waitsFor: this.waitsFor(task), ...this.weights(task.class) });
+  }
+
+  async pullPlanned(by: PeerId, input: { id: number; revision: number; reason: string }): Promise<Task> {
+    this.planningAuthority(by);
+    if (!Number.isSafeInteger(input.id) || input.id <= 0 || !Number.isSafeInteger(input.revision) || input.revision < 0 || typeof input.reason !== "string" || !input.reason.trim() || input.reason.length > 1000) throw new PreEffectToolRefusal("planner pull needs an id, revision and bounded reason");
+    const validate = () => {
+      const task = this.d.board.get(input.id);
+      if (!task || (task.planningRevision ?? 0) !== input.revision || task.state !== "backlog" || task.owner || taskHasStarted(task) || task.pinned) throw new PreEffectToolRefusal("planner pull changed, pinned or already started");
+      const release = task.release == null ? undefined : this.d.board.release(task.release);
+      if (task.release != null && (!release || ["frozen", "shipped", "dropped"].includes(release.state))) throw new PreEffectToolRefusal("planner pull requires unfrozen release scope");
+      if (this.waitsFor(task).length) throw new PreEffectToolRefusal("planner pull waits for dependency approval");
+      const priority = task.priority ?? (task.signals.includes("urgent") ? 0 : 2);
+      if (priority === 0) {
+        const goals = this.d.board.list().filter(goal => goal.state !== "approved" && (goal.priority ?? (goal.signals.includes("urgent") ? 0 : 2)) === 0 && goal.rank != null && goal.history.some(entry => entry.by === USER && entry.planning?.fields.includes("rank")));
+        const effectiveOrder = (candidate: Task) => goals.filter(goal => goal.id === candidate.id || this.prerequisiteOf(goal, candidate.id)).map(goal => ({ rank: goal.rank!, id: goal.id })).sort((a,b) => a.rank-b.rank || a.id-b.id)[0];
+        const order = effectiveOrder(task) ?? { rank: task.rank ?? Number.MAX_SAFE_INTEGER, id: task.id };
+        if (this.d.board.list("backlog").some(other => {
+          if (other.id === task.id || this.prerequisiteOf(other, task.id) || (other.priority ?? (other.signals.includes("urgent") ? 0 : 2)) !== 0) return false;
+          const competing = effectiveOrder(other);
+          return !!competing && (competing.rank < order.rank || competing.rank === order.rank && competing.id < order.id);
+        })) throw new PreEffectToolRefusal("a person's P0 backlog order is retained");
+      }
+      const assignment = this.plannerAssignment(task);
+      if (!assignment.owner) throw new PreEffectToolRefusal("no peer has eligible planner WIP capacity");
+      const reservation = task.history.findLast(entry => entry.event === "reserved" || entry.planning?.fields.includes("reserved") && !["backlog pulled", "backlog returned"].includes(entry.event)) ?? (task.history[0]?.event === "backlogged" ? task.history[0] : undefined);
+      if (task.reserved && reservation?.by === USER && assignment.owner !== task.reserved) throw new PreEffectToolRefusal("a person's reservation is retained");
+      return { task, owner: assignment.owner };
+    };
+    const initial = validate(), withheld = await this.withholds("note", input.reason, initial.task);
+    const current = validate();
+    const pulled = this.d.board.pullPlanned(current.task.id, by, current.owner, input.revision, input.reason.trim(), withheld);
+    this.planningRecorded({ by, task: pulled.id, fields: ["pull", "reserved"], revision: pulled.planningRevision! });
+    return pulled;
+  }
+
+  backlogList(by: PeerId): Record<string, unknown>[] {
+    this.planningAuthority(by);
+    return this.d.board.list("backlog").sort((a, b) => (a.rank ?? Number.MAX_SAFE_INTEGER) - (b.rank ?? Number.MAX_SAFE_INTEGER) || a.id - b.id).map(task => this.publicView(task));
+  }
+  private addPlannerBacklog(peer: PeerId, ids: readonly number[]): void {
+    if (!this.d.roles?.[peer]?.includes("planner")) return;
+    const pending = this.plannerBacklog.get(peer) ?? new Set<number>();
+    for (const id of ids) if (this.d.board.get(id)?.state === "backlog") pending.add(id);
+    if (pending.size) this.plannerBacklog.set(peer, pending);
+  }
+  /** One bounded ids-only batch per attached planner; failed or evicted copies stay pending. */
+  flushPlannerNotices(): number {
+    const configured = Object.entries(this.d.roles ?? {}).filter(([, roles]) => roles.includes("planner")).map(([peer]) => peer);
+    for (const peer of this.knownPlanners) if (!configured.includes(peer)) {
+      this.knownPlanners.delete(peer); this.plannerBacklog.delete(peer); this.plannerBlockedQueue.delete(peer);
+    }
+    for (const peer of configured) if (!this.knownPlanners.has(peer)) {
+      this.knownPlanners.add(peer);
+      const retained = this.d.bus.queuedBacklogIds(peer);
+      this.addPlannerBacklog(peer, this.d.board.list("backlog").filter(task => !retained.has(task.id)).map(task => task.id));
+    }
+    const planners = configured.filter(peer => this.d.bus.isRostered(peer) && this.d.bus.peers.has(peer) && this.d.bus.stateOf(peer) !== "offline");
+    if (!planners.length) return 0;
+    for (const id of this.incomingBacklog) if (this.d.board.get(id)?.state !== "backlog") this.incomingBacklog.delete(id);
+    const incoming = [...this.incomingBacklog].sort((a, b) => a - b).slice(0, 64);
+    if (incoming.length) {
+      for (const peer of configured) {
+        const queued = this.d.bus.queuedBacklogIds(peer);
+        this.addPlannerBacklog(peer, incoming.filter(id => !queued.has(id)));
+      }
+    }
+    for (const id of incoming) this.incomingBacklog.delete(id);
+    const notified = new Set<number>();
+    for (const peer of planners) {
+      const pending = this.plannerBacklog.get(peer);
+      if (!pending) continue;
+      const blockedQueue = this.plannerBlockedQueue.get(peer);
+      if (blockedQueue !== undefined && blockedQueue === JSON.stringify(this.d.bus.queueIds(peer))) continue;
+      this.plannerBlockedQueue.delete(peer);
+      for (const id of pending) if (this.d.board.get(id)?.state !== "backlog") pending.delete(id);
+      const ids = [...pending].sort((a, b) => a - b).slice(0, 64);
+      if (!ids.length) continue;
+      // Remove before publish: an immediate overflow callback may put this recipient's ids back.
+      for (const id of ids) pending.delete(id);
+      try {
+        const queued = this.d.bus.publish(newEnvelope(HUB, `Backlog items ${ids.map(id => `#${id}`).join(", ")}. Read hub_backlog_list and plan the next work with a reason for each change.`, { to: [peer], kind: "task", refs: { backlog: ids } }));
+        if (!queued.includes(peer)) this.addPlannerBacklog(peer, ids);
+        for (const id of ids) notified.add(id);
+      } catch (error) { this.addPlannerBacklog(peer, ids); throw error; }
+    }
+    return notified.size;
+  }
+  releaseList(by: PeerId): Record<string, unknown>[] {
+    this.planningAuthority(by);
+    const scopes = new Map<number, { id: number; state: Task["state"]; deps: number[] }[]>();
+    type Approval = { id: number; release: Task["release"]; doneAt: number | null };
+    const approved: Approval[] = [], owned = new Map<number, Approval[]>();
+    for (const task of this.d.board.list()) {
+      if (typeof task.release === "number") {
+        const scope = scopes.get(task.release) ?? [];
+        scope.push({ id: task.id, state: task.state, deps: task.deps ?? [] }); scopes.set(task.release, scope);
+      }
+      if (task.state !== "approved") continue;
+      const row = { id: task.id, release: task.release, doneAt: actualTaskDates(task).doneAt };
+      approved.push(row);
+      if (typeof task.release === "number") { const rows = owned.get(task.release) ?? []; rows.push(row); owned.set(task.release, rows); }
+    }
+    const compare = (a: Approval, b: Approval) => a.doneAt! - b.doneAt! || a.id - b.id;
+    const known = approved.filter(task => task.doneAt !== null).sort(compare), unknown = approved.filter(task => task.doneAt === null);
+    const after = (rows: Approval[], cut: number) => {
+      let low = 0, high = rows.length;
+      while (low < high) { const mid = Math.floor((low + high) / 2); if (rows[mid]!.doneAt! <= cut) low = mid + 1; else high = mid; }
+      return low;
+    };
+    // ponytail: audit previews show 32 ids plus exact counts; add a paginated audit endpoint for exhaustive lists.
+    const outsideIds = (rows: Approval[], start: number, release: number) => {
+      const result: number[] = [];
+      for (let i = start; i < rows.length && result.length < 32; i++) if (rows[i]!.release !== release) result.push(rows[i]!.id);
+      return result;
+    };
+    return this.d.board.releases().map(release => {
+      const own = owned.get(release.id) ?? [], ownKnown = own.filter(task => task.doneAt !== null).sort(compare);
+      const cutStart = release.cut === null ? known.length : after(known, release.cut);
+      const unknownPool = release.cut === null ? approved : unknown;
+      return { ...release,
+        name: this.nameable(release.name) ? release.name : "[withheld]",
+        goal: this.nameable(release.goal) ? release.goal : "[withheld]",
+        tasks: scopes.get(release.id) ?? [],
+        afterCutUnknown: outsideIds(unknownPool, 0, release.id),
+        afterCutUnknownCount: release.cut === null ? approved.length - own.length : unknown.length - (own.length - ownKnown.length),
+        afterCut: release.cut === null ? null : outsideIds(known, cutStart, release.id),
+        afterCutCount: release.cut === null ? null : known.length - cutStart - (ownKnown.length - after(ownKnown, release.cut)),
+      };
+    });
+  }
+
+  async planBacklog(by: PeerId, input: { id: number; revision: number; fields: unknown; reason: string }): Promise<Task> {
+    this.planningAuthority(by);
+    if (!Number.isSafeInteger(input.id) || input.id <= 0 || !Number.isSafeInteger(input.revision) || input.revision < 0) throw new PreEffectToolRefusal("invalid planning identity or revision");
+    if (typeof input.reason !== "string" || !input.reason.trim() || input.reason.length > 1000) throw new PreEffectToolRefusal("planning needs a bounded reason");
+    let patch: PlanningFields;
+    try { patch = planningPatch(input.fields); } catch (error) { throw new PreEffectToolRefusal((error as Error).message); }
+    const validate = () => {
+      const task = this.d.board.get(input.id);
+      if (!task || (task.planningRevision ?? 0) !== input.revision) throw new PreEffectToolRefusal("planning revision changed");
+      if (task.state === "approved") throw new PreEffectToolRefusal("approved work is final");
+      if (by !== USER && (task.state !== "backlog" || taskHasStarted(task) || task.pinned || Object.hasOwn(patch, "pinned"))) throw new PreEffectToolRefusal("planner changes only unpinned backlog work");
+      if (by !== USER && patch.rank !== undefined && task.history.some(entry => entry.by === USER && entry.planning?.fields.includes("rank"))) throw new PreEffectToolRefusal("a person's backlog order is retained");
+      if (Object.hasOwn(patch, "deps") || Object.hasOwn(patch, "reserved")) {
+        if (task.state !== "backlog" || taskHasStarted(task) || task.owner) throw new PreEffectToolRefusal("dependency and reservation changes require unstarted backlog work");
+        if (patch.reserved && !(SUPPORTED_PEERS as readonly string[]).includes(patch.reserved) && !this.d.bus.knownPeers().includes(patch.reserved) && !this.d.routing().classes[task.class]?.peers.includes(patch.reserved)) throw new PreEffectToolRefusal("reserved owner is not a supported or configured peer");
+        if (patch.reserved && !this.d.bus.isRostered(patch.reserved)) throw new PreEffectToolRefusal("reserved owner is off roster");
+        const rows = new Map(this.d.board.list().map(row => [row.id, row]));
+        const pending = [...(patch.deps ?? task.deps ?? [])], seen = new Set<number>();
+        while (pending.length) {
+          const id = pending.pop()!;
+          if (id === task.id) throw new PreEffectToolRefusal("planning dependencies would form a cycle");
+          if (seen.has(id)) continue;
+          seen.add(id);
+          const dependency = rows.get(id);
+          if (!dependency) throw new PreEffectToolRefusal(`no dependency task #${id}`);
+          pending.push(...(dependency.deps ?? []));
+        }
+      }
+      const target = patch.release === undefined ? task.release : patch.release;
+      if (target != null && !this.d.board.release(target)) throw new PreEffectToolRefusal("no such release");
+      for (const id of new Set([task.release, target])) {
+        if (id == null) continue;
+        const release = this.d.board.release(id)!;
+        if (["shipped", "dropped"].includes(release.state)) throw new PreEffectToolRefusal("settled release scope is final");
+        if (by !== USER && release.state === "frozen") throw new PreEffectToolRefusal("frozen release changes require a person");
+      }
+      return task;
+    };
+    const task = validate(), withheld = await this.withholds("note", input.reason, task);
+    validate(); // a person may have changed planning or frozen a release while the screen ran
+    const updated = this.d.board.plan(task.id, by, patch, input.revision, input.reason.trim(), withheld);
+    this.planningRecorded({ by, task: task.id, fields: Object.keys(patch), revision: updated.planningRevision! });
+    return updated; // persistence/readback failures must never claim no effect
+  }
+
+  async undoPlanning(by: PeerId, id: number, revision: number): Promise<Task> {
+    this.planningAuthority(by);
+    const task = this.d.board.get(id), entry = task ? planningUndoEntry(task) : undefined;
+    if (!task || !entry?.planning || entry.planning.revision !== revision || (task.planningRevision ?? 0) !== revision || by !== USER && entry.by !== by) throw new PreEffectToolRefusal("planning undo is stale or not owned");
+    if (entry.planning.split) {
+      const release = task.release == null ? undefined : this.d.board.release(task.release);
+      if (task.state !== "backlog" || task.owner || taskHasStarted(task) || release && ["shipped", "dropped"].includes(release.state) || by !== USER && (task.pinned || release?.state === "frozen")) throw new PreEffectToolRefusal("split undo is no longer eligible");
+      if (entry.planning.split.children.some(saved => this.d.board.get(saved.id)?.history.some(item => item.event === "memory reference started"))) throw new PreEffectToolRefusal("split children are referenced by persistent long-term memory");
+      const childIds = new Set(entry.planning.split.children.map(child => child.id)), budgets = this.d.executionBudget?.status();
+      if (Array.isArray(budgets) && budgets.some(budget => budget.kind === "task" && budget.taskId !== undefined && childIds.has(budget.taskId))) throw new PreEffectToolRefusal("split children are referenced by execution budgets");
+      if (this.d.store) {
+        try { this.d.store.store.refresh(); } catch { throw new PreEffectToolRefusal("split undo requires current memory link evidence"); }
+        const children = new Set(entry.planning.split.children.map(child => this.d.board.get(child.id)).filter((child): child is Task => !!child).map(child => this.memoryKey(child)));
+        if ([...children].some(key => this.d.store!.store.hasTask(key)) || this.d.store.store.goals().some(goal => goal.links.some(link => children.has(link.task)))) throw new PreEffectToolRefusal("split children are referenced by long-term tasks");
+      }
+      const restored = this.d.board.undoBacklogSplit(id, by, revision);
+      this.planningRecorded({ by, task: id, fields: ["split", "deps"], revision: restored.planningRevision! });
+      return restored;
+    }
+    if (entry.planning.pull) {
+      const release = task.release == null ? undefined : this.d.board.release(task.release);
+      if (task.state !== "proposed" || task.owner || taskHasStarted(task) || by !== USER && (task.pinned || release && ["frozen", "shipped", "dropped"].includes(release.state))) throw new PreEffectToolRefusal("planner pull undo is no longer eligible");
+      const returned = this.d.board.undoPlannedPull(id, by, revision);
+      this.offered.delete(id); this.incomingBacklog.add(id);
+      this.planningRecorded({ by, task: id, fields: ["pull", "reserved"], revision: returned.planningRevision! });
+      return returned;
+    }
+    return this.planBacklog(by, { id, revision, fields: entry.planning.previous, reason: `undo planning revision ${revision}` });
+  }
+
+  async importGitHub(by: PeerId, input: GitHubImportSelection, run?: SdlcGh): Promise<{ imported: number[]; existing: number[]; partial: boolean; complete: boolean; unconfirmed?: true }> {
+    if (by !== USER) throw new PreEffectToolRefusal("GitHub import is a person console command");
+    const deadline = performance.now() + 20_000;
+    const page = await readGitHubImport(input, run ?? ((args, timeout, _cwd, bound) => sdlcGh(args, timeout, this.d.cwd, bound)));
+    const imported: number[] = [], existing: number[] = [];
+    for (const issue of page.issues) {
+      if (performance.now() >= deadline) return { imported, existing, partial: true, complete: false };
+      let created = false;
+      try {
+        const prior = this.d.board.imported(issue.source.repo, issue.source.issue);
+        if (prior) { existing.push(prior.id); continue; }
+        const classes = profileData(this.d.profileData ?? this.d.profile ?? "dev").classes;
+        const cls = Object.keys(classes).find(name => classes[name] === "implement") ?? Object.keys(classes)[0];
+        const task = await this.propose(USER, { title: issue.title, detail: issue.detail, class: cls, backlog: true }, issue.source, () => { created = true; });
+        (created ? imported : existing).push(task.id);
+        if (performance.now() >= deadline) return { imported, existing, partial: true, complete: false };
+      } catch {
+        if (created) {
+          try {
+            const saved = this.d.board.imported(issue.source.repo, issue.source.issue);
+            if (saved) { if (!imported.includes(saved.id)) imported.push(saved.id); if (saved.state === "backlog") this.incomingBacklog.add(saved.id); return { imported, existing, partial: true, complete: false }; }
+          } catch { /* A failed readback leaves the committed identity unconfirmed. */ }
+        }
+        return { imported, existing, partial: true, complete: false, unconfirmed: true };
+      }
+    }
+    return { imported, existing, partial: page.partial, complete: !page.partial };
+  }
+
+  async splitBacklog(by: PeerId, input: { id: number; revision: number; parts: unknown; reason: string }): Promise<{ parent: Task; children: Task[] }> {
+    this.planningAuthority(by);
+    const { id, revision } = input;
+    if (!Number.isSafeInteger(id) || id <= 0 || !Number.isSafeInteger(revision) || revision < 0 || typeof input.reason !== "string" || !input.reason.trim() || input.reason.length > 1000) throw new PreEffectToolRefusal("split needs an id, revision and bounded reason");
+    const reason = input.reason.trim();
+    let parts: unknown;
+    try { parts = structuredClone(input.parts); } catch { throw new PreEffectToolRefusal("split parts must be cloneable data"); }
+    if (!Array.isArray(parts) || parts.length < 2 || parts.length > 8) throw new PreEffectToolRefusal("split needs two to eight parts");
+    const rows = parts as Record<string, unknown>[];
+    const validate = () => {
+      const parent = this.d.board.get(id);
+      if (!parent || parent.state !== "backlog" || parent.owner || taskHasStarted(parent) || (parent.planningRevision ?? 0) !== revision || by !== USER && parent.pinned) throw new PreEffectToolRefusal("split changed, pinned or already started");
+      const release = parent.release == null ? undefined : this.d.board.release(parent.release);
+      if (parent.release != null && (!release || ["shipped", "dropped"].includes(release.state) || by !== USER && release.state === "frozen")) throw new PreEffectToolRefusal("split release scope is frozen or final");
+      const profile = parent.profile ?? "dev";
+      const drafts = rows.map((part, index) => {
+        if (!part || typeof part !== "object" || Array.isArray(part) || Object.keys(part).some(key => !["title", "detail", "class", "refs", "plan", "after", "afterParts"].includes(key)) || typeof part.title !== "string" || !part.title.trim() || part.title.length > 300 || part.detail !== undefined && (typeof part.detail !== "string" || part.detail.length > 8000) || part.class !== undefined && typeof part.class !== "string") throw new PreEffectToolRefusal("invalid split part");
+        const given = part.class ?? parent.profileClass ?? parent.class;
+        const storedProfile = !parent.profile ? "dev" : profile === (this.d.profile ?? "dev") ? this.d.profileData ?? profile : profile;
+        let cls: TaskClass;
+        try { cls = part.class === undefined ? parent.class : profileClass(given as string, storedProfile); } catch (error) { throw new PreEffectToolRefusal((error as Error).message); }
+        const after = part.after ?? [], afterParts = part.afterParts ?? [];
+        if (!Array.isArray(after) || after.length > 64 || after.some(dep => !Number.isSafeInteger(dep) || dep <= 0) || new Set(after).size !== after.length || !Array.isArray(afterParts) || afterParts.length > 8 || afterParts.some(dep => !Number.isSafeInteger(dep) || dep < 0 || dep >= index) || new Set(afterParts).size !== afterParts.length) throw new PreEffectToolRefusal("split dependencies must name existing tasks or earlier parts");
+        const deps = [...new Set([...(parent.deps ?? []), ...after as number[]])], pending = [...deps], seen = new Set<number>();
+        const direct = afterParts.length ? deps.filter(dep => !parent.deps?.includes(dep)) : deps;
+        if (direct.length + afterParts.length > 64) throw new PreEffectToolRefusal("split child dependencies exceed the 64-edge cap");
+        while (pending.length) { const dependency = pending.pop()!; if (dependency === id) throw new PreEffectToolRefusal("split dependency reaches its parent"); if (seen.has(dependency)) continue; seen.add(dependency); const task = this.d.board.get(dependency); if (!task) throw new PreEffectToolRefusal("split dependency is missing"); pending.push(...(task.deps ?? [])); }
+        const refs = part.refs === undefined ? parent.refs : cleanRefs(part.refs), plan = cleanPlan(part.plan, storedProfile);
+        const draft = { title: part.title.replace(/\s+/g, " ").trim(), detail: part.detail as string | undefined ?? "", class: cls, refs, plan, deps, afterParts: afterParts as number[], ...(parent.role && cls === parent.class ? { role: parent.role } : {}), ...(parent.profile ? { profile: parent.profile, profileClass: given as string, ...(parent.profile === "dev" ? { customProfile: true as const } : {}) } : {}) };
+        const fields: PlanningFields = {};
+        for (const key of ["priority", "release", "plannedStart", "due"] as const) if (parent[key] !== undefined) fields[key] = parent[key];
+        return { ...draft, fields };
+      });
+      return { parent, drafts };
+    };
+    const initial = validate(), screening = this.screenOn();
+    const initialPrivacy = initial.drafts.map(part => this.signalsFor({ ...part, detail: [part.detail, planText(part.plan)].join("\n") }).filter(signal => signal === "pii" || signal === "pii_path"));
+    const initialPrivate = initialPrivacy.map(signals => this.isPii({ signals })), initialParentPrivate = this.isPii(initial.parent);
+    const initialParentPrivacy = initial.parent.signals.filter(signal => signal === "pii" || signal === "pii_path");
+    const initialReasonPrivate = initialParentPrivate || !this.nameable(reason);
+    let deadline: ReturnType<typeof setTimeout> | undefined;
+    const attempt = Promise.all([
+      Promise.all(initial.drafts.map((part, index) => screening && !initialParentPrivate && !initialPrivate[index] ? this.screenCall(screenText({ title: part.title, detail: part.detail, plan: part.plan })) : undefined)),
+      this.withholds("note", reason, initial.parent),
+    ]);
+    let screened: Awaited<typeof attempt>;
+    try { screened = await Promise.race([attempt, new Promise<never>((_, reject) => { deadline = setTimeout(() => reject(new PreEffectToolRefusal("split screening request deadline exceeded")), BACKLOG_SPLIT_SCREEN_TIMEOUT_MS); })]); }
+    finally { if (deadline !== undefined) clearTimeout(deadline); }
+    const [screenedVerdicts, withheld] = screened, current = validate();
+    const finalSignals = current.drafts.map(part => this.signalsFor({ ...part, detail: [part.detail, planText(part.plan)].join("\n") }));
+    const deterministicPrivate = finalSignals.map((signals, index) => initialPrivate[index] || this.isPii({ signals }));
+    const verdicts = screenedVerdicts.map((verdict, index) => deterministicPrivate[index] ? undefined : verdict);
+    const inherited = current.drafts.map((_part, index) => (initialParentPrivate || this.isPii(current.parent)) && !deterministicPrivate[index]);
+    const drafts = current.drafts.map((part, index) => ({ ...part, ...(screening ? { screeningNote: inherited[index] ? "pii: inherited" : this.screenNote(verdicts[index]) } : {}), signals: [...new Set([...initialPrivacy[index]!, ...initialParentPrivacy, ...finalSignals[index]!, ...current.parent.signals.filter(signal => ["pii", "pii_path", "urgent"].includes(signal)), ...(verdicts[index] && verdicts[index]!.label !== "clear" ? ["pii"] : [])])] }));
+    const result = this.d.board.splitBacklog(id, by, revision, drafts, reason, withheld || initialReasonPrivate || this.isPii(current.parent) || !this.nameable(reason));
+    for (const [index, child] of result.children.entries()) {
+      this.incomingBacklog.add(child.id);
+      if (screening) { this.recordScreen(child.id, "task", verdicts[index], inherited[index]); if (verdicts[index]?.label === "unknown") this.releaseNotice(`task #${child.id}: the PII screen gave no verdict (${verdicts[index]!.miss}); it is handled as a PII task`); }
+    }
+    this.planningRecorded({ by, task: id, fields: ["split", "deps"], revision: result.parent.planningRevision! });
+    return result;
+  }
+
+  async newRelease(by: PeerId, input: { name: string; goal: string; order: number }): Promise<Release> {
+    this.planningAuthority(by);
+    if (typeof input.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(input.name) || typeof input.goal !== "string" || !input.goal.trim() || input.goal.length > 1000 || !Number.isSafeInteger(input.order) || input.order < 0) throw new PreEffectToolRefusal("invalid release name, goal or order");
+    const text = input.name + "\n" + input.goal;
+    if (!this.nameable(text) || this.screenOn() && (await this.screenCall(text)).label !== "clear") throw new PreEffectToolRefusal("release text was not cleared for public planning");
+    if (this.d.board.releases().some(release => release.name === input.name)) throw new PreEffectToolRefusal("release name already exists");
+    const release = this.d.board.newRelease(input.name, input.goal.trim(), input.order);
+    this.planningRecorded({ by, release: release.id, fields: ["created"], revision: release.revision });
+    return release;
+  }
+
+  changeRelease(by: PeerId, input: { id: number; revision: number; state?: ReleaseState; plannedStart?: number | null; cut?: number | null; ship?: number | null }): Release {
+    this.planningAuthority(by);
+    const release = this.d.board.release(input.id);
+    if (!Number.isSafeInteger(input.id) || input.id <= 0 || !Number.isSafeInteger(input.revision) || !release || release.revision !== input.revision) throw new PreEffectToolRefusal("release revision changed");
+    if (["shipped", "dropped"].includes(release.state)) throw new PreEffectToolRefusal("settled release is final");
+    if (by !== USER && (release.state === "frozen" || input.state === "frozen" || input.state === "shipped" || input.state === "dropped")) throw new PreEffectToolRefusal("freeze, ship, drop and frozen changes require a person");
+    if (input.state === "shipped" && this.d.board.list().some(task => task.release === release.id && task.state !== "approved")) throw new PreEffectToolRefusal("every release task must be approved or moved out before ship");
+    const { id, revision, ...patch } = input;
+    if (!Object.keys(patch).length || Object.keys(patch).some(key => !["state", "plannedStart", "cut", "ship"].includes(key))) throw new PreEffectToolRefusal("unknown or empty release fields");
+    const updated = this.d.board.updateRelease(id, patch, revision);
+    this.planningRecorded({ by, release: id, fields: Object.keys(patch), revision: updated.revision });
+    return updated; // a failed readback may follow a durable release write
+  }
+
+  async propose(by: PeerId, input: { title?: string; detail?: string; class?: string; role?: unknown; refs?: TaskRefs; plan?: TaskPlan; owner?: PeerId; after?: unknown; urgent?: unknown; backlog?: unknown; goal?: unknown }, external?: GitHubSource, created?: () => void): Promise<Task> {
+    external = external ? { ...external } : undefined;
+    if (external && (by !== USER || input.backlog !== true)) throw new PreEffectToolRefusal("external intake requires person-owned backlog staging");
+    if (input.backlog !== undefined && typeof input.backlog !== "boolean") throw new PreEffectToolRefusal("backlog must be a boolean");
+    const backlog = input.backlog === true;
+    if (backlog && input.owner && !this.d.bus.isRostered(input.owner)) throw new PreEffectToolRefusal(`${input.owner} is off roster; add it before reserving work`);
     // Callers are models: a title is one line (it is part of console and hub.log lines), not a document.
     const title = String(input.title ?? "").replace(/\s+/g, " ").trim().slice(0, 300);
     if (!title) throw new PreEffectToolRefusal("title is required");
+    const goal = input.goal == null || input.goal === "" ? undefined : this.goalFor(by, input.goal);
     // Dependencies can only name tasks that exist, so the new task closes no cycle: nothing can depend on it yet.
     // Callers are models: a missing or null `after` is no dependency, and an id is an integer or a digit string.
     let afterIds: unknown[] = [];
@@ -485,40 +926,54 @@ export class Tasks {
       if (!deps.includes(id)) deps.push(id);
     }
     // An owner for work that waits is reserved (issue #207): routing offers it to that peer first once it is ready.
-    const reserved = this.waitsFor({ deps }).length ? input.owner : undefined;
+    const reserved = backlog || this.waitsFor({ deps }).length ? input.owner : undefined;
     const given = input.class === undefined || input.class === "" ? undefined : input.class;
-    if (given !== undefined && !CLASSES.includes(given as TaskClass)) throw new PreEffectToolRefusal(`class must be one of ${CLASSES.join(", ")}`);
+    const profile = this.d.profile ?? "dev";
+    let baseGiven: TaskClass | undefined;
+    try { if (given !== undefined) baseGiven = profileClass(given, this.d.profileData ?? profile); } catch (error) { throw new PreEffectToolRefusal((error as Error).message); }
     const text = { title, detail: String(input.detail ?? "").slice(0, 8000), refs: cleanRefs(input.refs) };
-    const plan = cleanPlan(input.plan);
+    const plan = cleanPlan(input.plan, this.d.profileData ?? profile);
     // The plan reaches other owners, so a PII pattern in it makes the task a PII task like one in the detail would.
-    const signals = detectSignals({ ...text, detail: [text.detail, planText(plan)].join("\n") }, this.d.routing(), this.d.cwd);
+    const screenDetail = [text.detail, external?.repo, external?.url].filter(value => value !== undefined && value !== "").join("\n");
+    const signals = this.signalsFor({ ...text, detail: [screenDetail, planText(plan)].join("\n"), plan });
     // Urgent work is handed over even when its paused owner's window resets soon (issue #36).
     if (input.urgent === true && !signals.includes("urgent")) signals.push("urgent");
     // The PII screen (issue #198) reads the same text before anything else does: until its verdict the task is on no
     // board, in no envelope and before no other model. A pattern match is PII without a call; no verdict is PII too.
     const screening = this.screenOn();
-    const screened = screening && !signals.includes("pii") ? await this.screenCall(screenText({ ...text, plan })) : undefined;
+    const screened = screening && !signals.includes("pii") ? await this.screenCall(screenText({ ...text, detail: screenDetail, plan })) : undefined;
     if (screened && screened.label !== "clear") signals.push("pii");
-    let cls = given as TaskClass | undefined;
+    let cls = baseGiven;
     let triaged = false;
     let fenced = false; // a PII task off campus: triage is not asked
     if (!cls && this.d.triage) {
       // Signals first: a PII task's text may only go to a model that is reached without leaving the campus network.
-      const pii = signals.includes("pii") && this.d.routing().constraints.pii === "local_only";
+      const pii = this.isPii({ signals });
       if (!pii || (await this.d.triage.onCampus().catch(() => false))) cls = await this.d.triage.classify(text.title, text.detail).catch(() => undefined);
       else fenced = true;
       triaged = !!cls;
     }
     // A claim is work the caller will do itself: without a class and a model to name one, it is implementation (#6).
-    const defaulted = !cls && input.owner === by;
+    const defaulted = !backlog && !cls && input.owner === by;
     if (defaulted) cls = "implement";
     if (!cls) throw new PreEffectToolRefusal(`class is required (one of ${CLASSES.join(", ")}); ${fenced ? "the task is handled as PII and the hub's model is not reached on campus, so it was not asked to name one" : "the hub could not name one for you"}`);
-    const draft = { ...text, class: cls };
-    let task = this.d.board.propose(by, { ...draft, plan, ...(deps.length ? { deps } : {}), ...(reserved ? { reserved } : {}), signals });
+    let selected;
+    try { selected = taskRole(input.role, cls, this.d.catalog ?? loadRoleCatalog(this.d.cwd)); }
+    catch (error) { throw new PreEffectToolRefusal((error as Error).message); }
+    const draft = { ...text, class: cls, ...(selected ? { role: selected.id } : {}), ...(profile !== "dev" || given !== undefined && given !== cls || this.d.profileData && this.d.profileData !== projectProfile("dev") ? { profile, profileClass: given ?? cls, ...(profile === "dev" ? { customProfile: true as const } : {}) } : {}) };
+    if (external) { const prior = this.d.board.imported(external.repo, external.issue); if (prior) return prior; }
+    let task = this.d.board.propose(by, { ...draft, plan, ...(external ? { external } : {}), ...(deps.length ? { deps } : {}), ...(reserved ? { reserved } : {}), signals, ...(backlog ? { backlog: true } : {}) });
+    created?.();
     if (screening) task = this.screenedTask(task, screened);
+    if (goal) this.linkNative(task, goal, by);
     if (triaged) task = this.d.board.update(task.id, "hub", "triaged", {}, `class ${cls} named by the hub's model`);
     if (defaulted) task = this.d.board.update(task.id, "hub", "class defaulted", {}, "class implement for a claim without one");
-    this.d.notify(`task ${this.publicTitle(task)} proposed by ${by} [${task.class}]${task.signals.length ? ` signals: ${task.signals.join(", ")}` : ""}`);
+    if (backlog) {
+      this.incomingBacklog.add(task.id);
+      this.releaseNotice(`task ${this.publicTitle(task)} backlogged by ${by} [${profileTaskLabel(task)}]`);
+      return task;
+    }
+    this.d.notify(`task ${this.publicTitle(task)} proposed by ${by} [${profileTaskLabel(task)}]${task.signals.length ? ` signals: ${task.signals.join(", ")}` : ""}`);
     // Re-read: a dependency approved while triage was awaited looked for its dependents before this row existed.
     const still = this.waitsFor(task);
     if (still.length) {
@@ -526,14 +981,37 @@ export class Tasks {
       return this.d.board.update(task.id, HUB, "blocked", {}, `waits for ${still.map((id) => `#${id}`).join(", ")}`);
     }
     // Naming yourself is a claim: the work is already yours, so no offer comes back to you (paper: Agensh CLAIM, #68).
-    return this.assignOwner(task, by, input.owner ? { candidates: [input.owner], claim: input.owner === by } : {});
+    return this.assignOwner(task, by, input.owner ? { candidates: [input.owner], namedOwner: input.owner, claim: input.owner === by } : {});
+  }
+
+  /** Person-owned staging only. Flow transitions remain with their existing owners and reviewers. */
+  async moveBacklog(by: PeerId, id: unknown, pull: boolean): Promise<Task> {
+    if (by !== USER) throw new PreEffectToolRefusal("backlog pull/return is a console command");
+    if (typeof pull !== "boolean") throw new PreEffectToolRefusal("pull must be a boolean");
+    const n = typeof id === "number" ? id : typeof id === "string" && /^\s*\d+\s*$/.test(id) ? Number(id) : NaN;
+    if (!Number.isSafeInteger(n) || n <= 0) throw new PreEffectToolRefusal("id must be a positive task number");
+    const task = this.d.board.get(n);
+    if (!task) throw new PreEffectToolRefusal(`no task #${n}`);
+    if (task.state !== (pull ? "backlog" : "proposed") || task.owner) throw new PreEffectToolRefusal(`task #${n}: ${pull ? "only backlog may be pulled" : "only ownerless proposed work may return to backlog"}`);
+    if (!pull && taskHasStarted(task)) throw new PreEffectToolRefusal(`task #${n}: started work cannot return to backlog`);
+    const pulled = task.history.findLast(entry => entry.event === "backlog pulled" || entry.event === "backlog returned");
+    const restoreReservation = !pull && pulled?.planning?.pull && !task.history.slice(task.history.lastIndexOf(pulled) + 1).some(entry => entry.event === "reserved" || entry.planning?.fields.includes("reserved"));
+    const next = this.d.board.update(n, by, pull ? "backlog pulled" : "backlog returned", { state: pull ? "proposed" : "backlog", owner: null, reviewer: null, ...(restoreReservation ? { reserved: pulled.planning!.previous.reserved ?? null } : {}) });
+    this.offered.delete(n);
+    if (!pull) { this.incomingBacklog.add(n); return next; }
+    const waits = this.waitsFor(next);
+    if (waits.length) return this.d.board.update(n, HUB, "blocked", {}, `waits for ${waits.map(v => `#${v}`).join(", ")}`);
+    // This persisted ready marker also lets a restart offer ownerless work once a peer attaches.
+    const ready = this.d.board.update(n, HUB, "ready", {}, "pulled from backlog");
+    return this.assignOwner(ready, by);
   }
 
   /** Where a screened task's `pii` signal came from, on its history and in events (issue #198); no verdict is a console line by id. */
+  private screenNote(v: PiiVerdict | undefined): string { return !v ? "pii: regex" : v.label === "clear" ? "clear" : v.label === "pii" ? `pii: screen, ${v.category}` : `pii: unknown, ${v.miss}`; }
   private screenedTask(task: Task, v: PiiVerdict | undefined): Task {
     this.recordScreen(task.id, "task", v);
     if (v?.label === "unknown") this.d.notify(`task #${task.id}: the PII screen gave no verdict (${v.miss}); it is handled as a PII task`);
-    const note = !v ? "pii: regex" : v.label === "clear" ? "clear" : v.label === "pii" ? `pii: screen, ${v.category}` : `pii: unknown, ${v.miss}`;
+    const note = this.screenNote(v);
     return this.d.board.update(task.id, HUB, "screened", {}, note);
   }
 
@@ -569,7 +1047,12 @@ export class Tasks {
     this.d.notify(`task ${this.publicTitle(lifted)}: the PII screen cleared it on a second look; it is routed as usual`);
     const still = this.waitsFor(lifted);
     if (still.length) return void this.d.board.update(lifted.id, HUB, "blocked", {}, `waits for ${still.map((id) => `#${id}`).join(", ")}`);
-    await this.assignOwner(lifted, HUB);
+    try {
+      await this.assignOwner(lifted, HUB);
+    } catch (e) {
+      // A saved move whose delivery failed: the console notice was printed where the error was thrown (#297).
+      if (!(e instanceof AssignmentUndeliveredError)) throw e;
+    }
   }
 
   /**
@@ -624,6 +1107,38 @@ export class Tasks {
   /** The tasks an overlap text for `task` names: their plans are in it (issue #108). */
   overlapTasks = (task: Task): number[] => this.overlapHits(task).map((h) => h.task.id);
 
+  /**
+   * Dashboard warning links (#264): the board's overlap pairs and the live cohorts, as task and peer ids only.
+   * Paths, symbols and plans stay out; PII tasks are excluded by the same rules overlapHits applies.
+   * ponytail: O(open²) board reads per call, fine at dashboard board sizes; cache by board revision if it ever shows.
+   */
+  overlapLinks(): { tasks: [number, number]; peers: string[] }[] {
+    const links: { tasks: [number, number]; peers: string[] }[] = [];
+    const seen = new Set<string>();
+    for (const task of this.d.board.list()) {
+      if (!OPEN.includes(task.state) || !task.owner || this.isPii(task)) continue;
+      for (const hit of this.overlapHits(task)) {
+        const pair = [task.id, hit.task.id].sort((a, b) => a - b) as [number, number];
+        const key = pair.join(":");
+        if (seen.has(key)) continue;
+        seen.add(key);
+        links.push({ tasks: pair, peers: [...new Set([task.owner, hit.task.owner!])].sort() });
+      }
+    }
+    return links;
+  }
+
+  /** The live cohorts as dashboard links (#264): member task ids and their owners, nothing else. */
+  cohortLinks(): { tasks: number[]; peers: string[] }[] {
+    const links: { tasks: number[]; peers: string[] }[] = [];
+    for (const cohort of this.cohorts.list()) {
+      const members = [...cohort.members.values()].filter(member => { const task = this.d.board.get(member.task); return task && !this.isPii(task); });
+      if (members.length < 2) continue;
+      links.push({ tasks: members.map((m) => m.task).sort((a, b) => a - b), peers: [...new Set(members.map((m) => m.owner))].sort() });
+    }
+    return links;
+  }
+
   /** While a gone owner's tasks move, its other tasks are about to move too: they are no one to settle with. */
   private releasing: PeerId | undefined;
 
@@ -652,6 +1167,16 @@ export class Tasks {
    * for a recorded notice to this peer whose task is gone, has another owner, or left the states it was about.
    */
   relevant = (peer: PeerId, env: Envelope): boolean => {
+    if (env.from === HUB && env.kind === "task" && env.refs?.backlog) {
+      const ids = env.refs.backlog;
+      if (!Array.isArray(ids) || !ids.length || ids.length > 64 || ids.some(id => !Number.isSafeInteger(id) || id <= 0)) return false;
+      const current = ids.filter(id => this.d.board.get(id)?.state === "backlog");
+      if (current.length !== ids.length || !this.d.roles?.[peer]?.includes("planner") || !this.d.bus.isRostered(peer)) {
+        this.addPlannerBacklog(peer, current);
+        return false;
+      }
+      return true;
+    }
     const c = this.conditional.get(env.id);
     if (!c || c.peer !== peer) return true;
     const t = this.d.board.get(c.task);
@@ -685,7 +1210,7 @@ export class Tasks {
    */
   private places(task: Task): { paths: string[]; symbols: string[] } {
     const paths = [...(task.refs.paths ?? []), ...(task.plan?.paths ?? [])].map((p) => this.projectPath(p));
-    return { paths: [...new Set(paths)], symbols: task.plan?.symbols ?? [] };
+    return { paths: [...new Set(paths)], symbols: [...(task.plan?.symbols ?? []), ...(task.plan?.sections ?? []).map(v => `section ${v}`), ...(task.plan?.sources ?? []).map(v => `source ${v}`)] };
   }
 
   private roots?: string[];
@@ -709,7 +1234,7 @@ export class Tasks {
     return this.d.board.list().flatMap((t) => {
       if (t.id === task.id || !t.owner || t.owner === task.owner || t.owner === this.releasing || !OPEN.includes(t.state) || this.isPii(t)) return [];
       const theirs = this.places(t);
-      const paths = mine.paths.filter((p) => theirs.paths.some((q) => samePlace(p, q)));
+      const paths = task.profile && t.profile && (task.plan?.sections?.length && t.plan?.sections?.length) ? [] : mine.paths.filter((p) => theirs.paths.some((q) => samePlace(p, q)));
       const symbols = mine.symbols.filter((x) => theirs.symbols.includes(x));
       return paths.length || symbols.length ? [{ task: t, paths, symbols }] : [];
     });
@@ -749,7 +1274,7 @@ export class Tasks {
         // Awaits run between tasks (briefs, memory): re-read, and stop for anything that changed meanwhile.
         const task = this.d.board.get(id);
         if (!task || task.owner !== peer || !OPEN.includes(task.state) || this.d.bus.stateOf(peer) !== "offline") continue;
-        if (!assign(task, this.states(), this.d.routing(), { exclude: [...this.excluded(task), peer], ...this.health() }).owner) continue;
+        if (!assign(task, this.states(), this.d.routing(), { exclude: [...this.excluded(task), peer], excludeOwners: this.plannerPullRecord(task)?.pull ? this.plannerFull(task) : [], ...this.health() }).owner) continue;
         try {
           const back = task.state === "in_progress" ? this.d.board.update(task.id, HUB, "released", { state: "proposed" }, why) : task;
           const next = await this.assignOwner(back, HUB, { exclude: [peer], event: "reassigned", reason: "offline", note: why });
@@ -757,7 +1282,12 @@ export class Tasks {
           // The gone owner hears it on its next delivery, if it comes back mid-work.
           if (next.owner && next.owner !== peer) this.d.tell?.(peer, noteLine(HUB, "decision", `task #${task.id} moved to ${next.owner} while you were offline; stop working on it`));
         } catch (e) {
-          this.d.notify(`task ${this.publicTitle(task)}: could not be released from ${peer}: ${(e as Error).message}`);
+          if (e instanceof AssignmentUndeliveredError) {
+            // The move is fact for the board, so it is fact here too: record it, and tell the gone owner to stop
+            // (the console notice was printed where the error was thrown) (#297).
+            moved.push({ id: task.id, title: this.publicTitle(task), to: e.task.owner });
+            if (e.task.owner && e.task.owner !== peer) this.d.tell?.(peer, noteLine(HUB, "decision", `task #${task.id} moved to ${e.task.owner} while you were offline; stop working on it`));
+          } else this.d.notify(`task ${this.publicTitle(task)}: could not be released from ${peer}: ${(e as Error).message}`);
         }
       }
     } finally {
@@ -766,26 +1296,27 @@ export class Tasks {
     return moved;
   }
 
-  /** Same code as assignment, without doing it. */
-  explain(target: number | { title: string; detail?: string; class: TaskClass; refs?: TaskRefs }): string[] {
-    const routing = this.d.routing();
+  /** Same code as assignment, without doing it. `routing`: a candidate policy to explain under (the settings preview, #269). */
+  explain(target: number | { title: string; detail?: string; class: TaskClass; refs?: TaskRefs }, routing: Routing = this.d.routing()): string[] {
+    const workflow = this.d.sdlc?.config().workflow === "gsd-lite" ? [`workflow: gsd-lite (${this.d.sdlc.config().mode}); checklist guidance, board dependencies authoritative`] : [];
     if (typeof target === "number") {
       const task = this.d.board.get(target);
       if (!task) throw new Error(`no task #${target}`);
-      const a = assign(task, this.states(), routing, { exclude: this.excluded(task), waitsFor: this.waitsFor(task), ...this.weights(task.class) });
+      const a = assign(task, this.states(), routing, { exclude: this.excluded(task), excludeOwners: this.plannerPullRecord(task)?.pull ? this.plannerFull(task) : [], waitsFor: this.waitsFor(task), ...this.weights(task.class) });
       // The split trace is for the pair the record is about: the task's owner when it has one (issue #109).
-      return [`task ${this.publicTitle(task)} (${task.state}, owner ${task.owner ?? "none"}${task.reserved ? `, reserved for ${task.reserved}` : ""})`, "if it were assigned now:", ...a.trace, ...(this.splitShadow(task, task.owner ?? a.owner)?.trace ?? [])];
+      return [...workflow, `task ${this.publicTitle(task)} (${task.state}, owner ${task.owner ?? "none"}${task.reserved ? `, reserved for ${task.reserved}` : ""})`, ...(task.profileClass ? [`profile class ${profileTaskLabel(task)}`] : []), ...(task.role ? [`task role ${task.role} (guidance only)`] : []), "if it were assigned now:", ...a.trace, ...(this.splitShadow(task, task.owner ?? a.owner)?.trace ?? [])];
     }
     const draft = { title: target.title, detail: target.detail ?? "", refs: target.refs ?? {} };
-    const signals = detectSignals(draft, routing, this.d.cwd);
-    const trace = assign({ class: target.class, signals }, this.states(), routing, this.weights(target.class)).trace;
+    const signals = this.signalsFor(draft, routing);
+    const base = profileClass(target.class, this.d.profileData ?? this.d.profile);
+    const trace = [...(this.d.profile && this.d.profile !== "dev" ? [`profile class ${target.class} (base ${base}, ${this.d.profile})`] : []), ...assign({ class: base, signals }, this.states(), routing, this.weights(base)).trace];
     // A draft is not sent to the PII screen (issue #198): a proposal is, and a pii or unknown verdict adds the pii signal.
-    return this.screenOn() && !signals.includes("pii") ? [...trace, "pii_screen is on: at proposal a pii or unknown verdict adds signal pii (local only)"] : trace;
+    return [...workflow, ...(this.screenOn() && !signals.includes("pii") ? [...trace, "pii_screen is on: at proposal a pii or unknown verdict adds signal pii (local only)"] : trace)];
   }
 
   /** Public read path: every generated line is screened, including profile/config-derived trace fields. */
-  publicExplain(target: number | { title: string; detail?: string; class: TaskClass; refs?: TaskRefs }): string[] {
-    return this.explain(target).map(line => this.nameable(line) ? line : "[routing explanation withheld: it matches a PII pattern]");
+  publicExplain(target: number | { title: string; detail?: string; class: TaskClass; refs?: TaskRefs }, routing?: Routing): string[] {
+    return this.explain(target, routing).map(line => this.nameable(line) ? line : "[routing explanation withheld: it matches a PII pattern]");
   }
 
   /**
@@ -801,7 +1332,8 @@ export class Tasks {
    */
   private passedOver(task: Task, a: Assignment): string {
     if (!a.unreserved || task.reserved === task.owner || this.excluded(task).includes(task.reserved!)) return "";
-    this.d.notify(`task ${this.publicTitle(task)}: its reserved owner ${task.reserved} is passed over (${a.unreserved}); routing proceeds`);
+    // Before the write, but after the caller's own (a decline's, say): a throwing console fails nothing (#297).
+    this.releaseNotice(`task ${this.publicTitle(task)}: its reserved owner ${task.reserved} is passed over (${a.unreserved}); routing proceeds`);
     return `; reserved owner ${task.reserved} passed over: ${a.unreserved}`;
   }
 
@@ -821,17 +1353,22 @@ export class Tasks {
   }
 
   /** `override`: a person's explicit assign, which past refusals do not block and which drops an agent's reservation (#207). */
-  private async assignOwner(task: Task, by: PeerId, opts: { candidates?: PeerId[]; event?: string; note?: string; reason?: TaskMoveReason; clearOnFail?: boolean; exclude?: PeerId[]; context?: string; contextWithheld?: boolean; claim?: boolean; override?: boolean } = {}): Promise<Task> {
+  private async assignOwner(task: Task, by: PeerId, opts: { candidates?: PeerId[]; namedOwner?: PeerId; event?: string; note?: string; reason?: TaskMoveReason; clearOnFail?: boolean; exclude?: PeerId[]; context?: string; contextWithheld?: boolean; claim?: boolean; override?: boolean; roster?: boolean; planner?: boolean } = {}): Promise<Task> {
+    if (task.state === "backlog") throw new PreEffectToolRefusal(`task #${task.id}: pull backlog work before assigning it`);
     const waits = this.waitsFor(task);
-    const a = assign(task, this.states(), this.d.routing(), { exclude: [...(opts.override ? [] : this.excluded(task)), ...(opts.exclude ?? []), ...(opts.event === "escalated" && task.owner ? [task.owner] : [])], ...(opts.candidates ? { candidates: opts.candidates } : {}), waitsFor: waits, ...this.weights(task.class) });
+    const plannedMove = opts.planner || this.plannerPullRecord(task)?.pull === true && (by === HUB || opts.roster) && (opts.reason !== "manual" || opts.roster);
+    const plannerFull = plannedMove ? this.plannerFull(task) : [];
+    const a = assign(task, this.states(), this.d.routing(), { exclude: [...(opts.override ? [] : this.excluded(task)), ...(opts.exclude ?? []), ...(opts.event === "escalated" && task.owner ? [task.owner] : [])], excludeOwners: plannerFull, ...(opts.candidates ? { candidates: opts.candidates } : {}), waitsFor: waits, ...this.weights(task.class), ...(opts.namedOwner ? { namedOwner: opts.namedOwner } : {}) });
 
     if (waits.length) {
-      this.d.notify(`task ${this.publicTitle(task)} waits for ${waits.map((id) => `#${id}`).join(", ")}; it is offered once they are approved`);
+      this.releaseNotice(`task ${this.publicTitle(task)} waits for ${waits.map((id) => `#${id}`).join(", ")}; it is offered once they are approved`);
       return task;
     }
     const passed = this.passedOver(task, a);
     if (!a.owner) {
-      this.d.notify(`task ${this.publicTitle(task)}: no peer can take it (${a.trace.filter((l) => l.includes("skipped")).length} skipped); assign with: ahub task assign ${task.id} <peer>`);
+      this.releaseNotice(opts.roster
+        ? `task ${this.publicTitle(task)}: ${task.owner} is off roster and no peer can take it; it stays with ${task.owner} in ${task.state}; assign with: ahub task assign ${task.id} <peer>`
+        : `task ${this.publicTitle(task)}: no peer can take it (${a.trace.filter((l) => l.includes("skipped")).length} skipped); assign with: ahub task assign ${task.id} <peer>`);
       // Only a decline takes the task away from its owner; a failed console assign or escalation leaves it where it was.
       if (opts.clearOnFail && task.owner) {
         this.cohorts.leave(task.id);
@@ -843,7 +1380,7 @@ export class Tasks {
     // A person's explicit assign replaces an agent's reservation (#207). Only a refusal keeps the owner it moves away from
     // out for good: a reviewer's rejections or an escalation by hand, never the hub's own move after a failed delivery.
     const lasting = opts.event === "escalated" && task.owner && (opts.reason === "rejections" || opts.reason === "manual");
-    const next = this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, `${opts.note ?? `to ${a.owner}`}${passed}`, { ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}) });
+    const next = this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(opts.roster && task.state === "in_progress" ? { state: "proposed" as const } : {}), ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, `${opts.note ?? `to ${a.owner}`}${passed}`, { ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}) });
     // What calibration reads (issue #109): routing chose the first owner (no single named candidate, no claim; not an
     // escalation, relay or reassignment of work already begun), and the work overlaps another owner's task not started
     // yet. For the record only. Work routed back to its proposer is left out, as its observations are (by === owner).
@@ -856,41 +1393,96 @@ export class Tasks {
     // A claim is its own hand-over: the claimant took the task in the turn it is in, so it is taking it, not busy elsewhere.
     // The cohort record formed just below reads it, and so does `route explain` while that turn lasts.
     if (opts.claim && a.owner === by && this.d.bus.peers.get(by)?.state === "busy") this.sent.set(handOver(next, by), by);
-    const hits = this.overlapHits(next);
-    this.formCohort(next, hits);
-    if (hits.length) {
-      this.announceOverlap(next, hits);
-      this.tellEarlierOwners(next, hits);
+    try {
+      const hits = this.overlapHits(next);
+      this.formCohort(next, hits);
+      if (hits.length) {
+        this.announceOverlap(next, hits);
+        this.tellEarlierOwners(next, hits);
+      }
+      this.announceRouting(next, a);
+      if (!opts.claim || a.owner !== by) await this.sendTask(next, a, opts.context, this.overlaps(next, true, hits), opts.contextWithheld);
+    } catch (e) {
+      // Everything between the write and the end of the delivery is in here: the move is fact, and a failure is a
+      // delivery failure (#297). The one console notice is printed here, once, for every caller; callers decide
+      // control flow by the error type.
+      let saved = next;
+      try {
+        saved = this.d.board.get(task.id) ?? next;
+      } catch { /* the write's row is still true */ }
+      // Superseded means a later entry that moves or settles the task: another assignment, an unassign, the
+      // owner's accept, done, approval, close. Entries that do neither (the hub's quiet bookkeeping, a check
+      // result landing during the brief) leave the assignment exactly as undelivered as before: the notice and
+      // the typed error stand (#297 Decisions).
+      const moves = (entries: Task["history"]) => entries.filter((h) => !QUIET_EVENTS.has(h.event) && !h.event.startsWith("check "));
+      if (moves(saved.history).length !== moves(next.history).length) throw e;
+      this.releaseNotice(this.undeliveredNotice(saved, e));
+      throw new AssignmentUndeliveredError(saved, e);
     }
-    this.announceRouting(next, a);
+    // A claim is its own hand-over, with no delivery: its accepted write and its line stay as they were (#297).
     if (opts.claim && a.owner === by) {
       const claimed = this.d.board.update(next.id, by, "accepted", { state: "in_progress" });
-      this.d.notify(`task ${this.publicTitle(claimed)} claimed by ${by}`);
+      this.releaseNotice(`task ${this.publicTitle(claimed)} claimed by ${by}`);
       return claimed;
     }
-    await this.sendTask(next, a, opts.context, this.overlaps(next, true, hits), opts.contextWithheld);
     return next;
   }
 
+  /** Person-only advice changes never change ownership, class or authority. */
+  setRole(by: PeerId, id: unknown, raw: unknown): Task {
+    if (by !== USER) throw new PreEffectToolRefusal("only the person may change an existing task catalog role");
+    if (raw === undefined) throw new PreEffectToolRefusal("name a catalog role id or explicit null to clear it");
+    const task = this.need(id, false, true);
+    if (task.state === "approved") throw new PreEffectToolRefusal("an approved task's role is historical; propose new work instead");
+    let selected;
+    try { selected = taskRole(raw === null ? undefined : raw, task.class, this.d.catalog ?? loadRoleCatalog(this.d.cwd)); }
+    catch (error) { throw new PreEffectToolRefusal((error as Error).message); }
+    if (task.role === selected?.id) return task;
+    const next = this.d.board.update(task.id, by, "catalog role changed", { role: selected?.id });
+    for (const peer of new Set([next.owner, next.state === "in_review" ? next.reviewer : null])) {
+      if (!peer || peer === USER) continue;
+      this.releaseNotice(`task ${this.publicTitle(next)}: catalog role update delivery unconfirmed`, () => this.d.bus.publish(newEnvelope(HUB,
+        `Task #${next.id}: catalog role changed by the person. ${next.role ? this.roleGuidance(next, peer, peer === next.reviewer) : "Catalog guidance cleared; follow the task's existing plan and requirements."}`,
+        { to: [peer], kind: "task", refs: { task: String(next.id) }, ...(this.isPii(next) ? { private: true } : {}) })));
+    }
+    return next;
+  }
+
+  /** A self-claim has no assignment envelope; its tool result carries the same bounded guidance. */
+  claimRoleGuidance(task: Task, peer: PeerId): string {
+    return task.owner === peer && task.state === "in_progress" ? this.roleGuidance(task, peer) : "";
+  }
+
+  private roleGuidance(task: Task, peer: PeerId, review = false): string {
+    if (!task.role) return "";
+    if (!review && this.d.sessionRoles?.(peer).includes(task.role)) return `Task role ${task.role} (already in your session guidance).`;
+    const role = (this.d.catalog ?? loadRoleCatalog(this.d.cwd)).roles.get(task.role);
+    if (role) try { return taskRoleText(role, review); } catch { /* a changed definition cannot break a saved assignment */ }
+    return `Task role ${task.role}: definition unavailable or exceeds the task guidance limit; grants no authority.`;
+  }
+
   /** `contextWithheld`: the PII screen did not clear a budget hand-off (#198); an escalation's reason is the hub's own words. */
   private async sendTask(task: Task, a: Assignment, context?: string, overlap = "", contextWithheld = false): Promise<void> {
     const pii = this.isPii(task);
     const brief = pii ? undefined : await this.d.briefs?.forTask(task.owner!, task).catch(() => undefined);
     const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${this.screen(task, h.note ?? "", "review note", a.owner, h.withheld)}`);
     const handoff = context && !pii ? this.screen(task, context, "handoff", a.owner, contextWithheld).slice(0, 3000) : "";
-    const facts = [`class ${task.class}`, a.owner === PI ? `backend pi/${a.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", a.reviewer ? `reviewer ${a.reviewer}` : task.class === "review" ? "no reviewer" : this.noReviewer(a)].filter(Boolean).join("; ");
+    const facts = [`class ${profileTaskLabel(task)}`, a.owner === PI ? `backend pi/${a.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", a.reviewer ? `reviewer ${a.reviewer}` : task.class === "review" ? "no reviewer" : this.noReviewer(a)].filter(Boolean).join("; ");
     const plan = planText(task.plan);
     const body = [
-      `Task #${task.id} [${task.class}] ${task.title}`,
+      `Task #${task.id} [${profileTaskLabel(task)}] ${task.title}`,
       task.detail,
       `Facts: ${facts}`,
+      this.roleGuidance(task, task.owner!),
       plan ? `Plan so far: ${plan}` : "",
       overlap,
       rejected.length ? `Earlier review notes:\n${rejected.join("\n")}` : "",
       brief ?? "",
       // What the previous owner left behind. Peer-written free text: never attached to a PII task.
       handoff ? `Handoff from the previous owner:\n${handoff}` : "",
-      `Take it with hub_task_accept {id: ${task.id}, plan: {paths, symbols, signatures, insertion_points}} (what you will change, before you start${pii ? "" : "; owners of overlapping tasks see it"}) or pass with hub_task_decline. When finished: hub_task_done {id: ${task.id}, summary: what changed, why, and the check you ran with its result, refs}.`,
+      task.state === "in_review"
+        ? `Ownership moved while this task is already under review. Read it with hub_task_show {id: ${task.id}} and wait for the review verdict; do not accept it or repeat completed work.`
+        : `Take it with hub_task_accept {id: ${task.id}, plan: {paths, symbols, signatures, insertion_points}} (what you will change, before you start${pii ? "" : "; owners of overlapping tasks see it"}) or pass with hub_task_decline. When finished: hub_task_done {id: ${task.id}, summary: what changed, why, and the check you ran with its result, refs}.`,
     ].filter(Boolean).join("\n\n");
     // A hand-over the owner takes in a turn of its own (#109, #115): idle before, busy after and not queued, this envelope
     // was in the delivery that started its turn. Busy before, it is queued, or steered into a turn about something else
@@ -936,6 +1528,16 @@ export class Tasks {
     }
   }
 
+  /**
+   * The one text for a saved assignment whose delivery is unconfirmed (#297), built through publicTitle (a PII task
+   * shows nothing more than it does today): what to check, and how to send it again. No automatic resend: a blind
+   * resend can duplicate a publish that did leave (the #276 decision).
+   */
+  undeliveredNotice(task: Task, cause: unknown): string {
+    const owner = task.owner ?? "its owner";
+    return `task ${this.publicTitle(task)}: the move to ${owner} is saved, but its assignment's delivery is not confirmed (${cause instanceof Error ? cause.message : String(cause)}); look for a queued or needs_review delivery with ahub queue list --peer ${owner} (then ahub queue show <id>), or the accepted entry in ahub task show ${task.id} if the journal is down; send it again with: ahub task assign ${task.id} ${owner}`;
+  }
+
   private readonly offered = new Set<number>(); // assignments in this hub run, including offers still in flight
   private readonly sent = new Map<string, PeerId>(); // hand-over (`handOver`) -> owner, for the owner's current turn: its task envelope started it, or it claimed the task in it
 
@@ -947,8 +1549,9 @@ export class Tasks {
    */
   async releaseReady(): Promise<void> {
     for (const t of this.d.board.list("proposed")) {
-      const last = t.history.at(-1)?.event;
-      if (!t.deps?.length || t.owner || this.offered.has(t.id) || (last !== "blocked" && last !== "ready" && last !== "reserved") || this.waitsFor(t).length) continue;
+      const last = t.history.findLast(entry => !QUIET_EVENTS.has(entry.event))?.event, planned = this.plannerPullRecord(t)?.pull === true;
+      if ((!t.deps?.length && !t.history.some(h => h.event === "backlog pulled")) || t.owner || this.offered.has(t.id) || (!planned && last !== "blocked" && last !== "ready" && last !== "reserved") || this.waitsFor(t).length) continue;
+      if (planned && !this.plannerAssignment(t, true).owner) continue;
       // ponytail: a reserved owner (#207) that attaches after another peer that can take the task is passed over here like
       // an offline one; hold reserved tasks for a grace period if restarts show that up.
       if (!assign(t, this.states(), this.d.routing(), { exclude: this.excluded(t), ...this.health() }).owner) continue; // nobody attached can take it yet
@@ -958,19 +1561,25 @@ export class Tasks {
 
   /** Callers hold a list read before an await: re-read, or a task the other caller offered meanwhile is offered twice. */
   private async offerReady(stale: Task, why: string): Promise<void> {
-    let offering = false;
+    let offering = false, undelivered: AssignmentUndeliveredError | undefined;
     try {
       const t = this.d.board.get(stale.id);
       if (!t || t.state !== "proposed" || t.owner || this.offered.has(t.id)) return;
+      const planned = this.plannerPullRecord(t)?.pull === true;
+      const selected = planned ? this.plannerAssignment(t, true).owner : undefined;
+      if (planned && !selected) return;
       this.offered.add(t.id);
       offering = true;
       const ready = t.history.at(-1)?.event === "ready" ? t : this.d.board.update(t.id, HUB, "ready", {}, why);
       this.releaseNotice(`task ${this.publicTitle(ready)} is ready: what it waited for is approved`);
-      await this.assignOwner(ready, HUB);
+      await this.assignOwner(ready, HUB, planned ? { candidates: [selected!], namedOwner: selected!, planner: true } : {});
     } catch (e) {
-      this.releaseNotice(`task ${this.publicTitle(stale)}: could not be assigned: ${e instanceof Error ? e.message : String(e)}`);
+      // A saved move whose delivery failed is not "could not be assigned" (#297); the console notice was printed
+      // where the error was thrown. The offer stays consumed by the error's own evidence, without the readback.
+      if (e instanceof AssignmentUndeliveredError) undelivered = e;
+      else this.releaseNotice(`task ${this.publicTitle(stale)}: could not be assigned: ${e instanceof Error ? e.message : String(e)}`);
     } finally {
-      if (offering) {
+      if (offering && !undelivered) {
         try {
           if (!this.d.board.get(stale.id)?.owner) this.offered.delete(stale.id);
         } catch (e) {
@@ -985,12 +1594,84 @@ export class Tasks {
     if (by !== USER && task[role] !== by) throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id}: only its ${role} (${task[role] ?? "none"}) or the console user can do that`);
   }
 
+  /** Artifact links and claimed local gates stay on the board; no outside text is accepted. */
+  recordLifecycle(by: PeerId, id: unknown, input: unknown): Task {
+    const task = this.need(id, false, true);
+    if (by !== USER && by !== task.owner && by !== task.reviewer) throw new PreEffectToolRefusal("only the task owner, reviewer or console user may record lifecycle evidence");
+    const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
+    const next = sdlcReceipt(input, task.sdlc, config);
+    const definition = stageDefinition(config, next.stage);
+    if (config.mode === "enforce" && config.definitions && input && typeof input === "object" && "stage" in input && next.stage !== task.sdlc?.stage && by !== USER) {
+      const actor = definition?.actor;
+      const acts = actor === "owner" ? by === task.owner : actor === "reviewer" ? by === task.reviewer : actor === "planner" ? this.d.roles?.[by]?.includes("planner") : actor === "owner/planner" && (by === task.owner || this.d.roles?.[by]?.includes("planner"));
+      if (!acts) throw new PreEffectToolRefusal(`lifecycle stage requires its ${actor ?? "unknown"} actor or the person`);
+    }
+    if (input && typeof input === "object" && "phase" in input) {
+      this.mine(task, by, "reviewer", true);
+      if (next.phase && !this.isPii(task) && !this.nameable(JSON.stringify(next.phase))) throw new PreEffectToolRefusal("phase metadata matches a PII pattern; use private work");
+      if (next.phase) validatePhaseLinks(task, next.phase, id => this.d.board.get(id), t => this.isPii(t));
+    }
+    if (next.reviewedHead !== task.sdlc?.reviewedHead) this.mine(task, by, "reviewer", true);
+    return this.d.board.update(task.id, by, "lifecycle", { sdlc: next });
+  }
+
+  async deliveryQueue(repo: string) {
+    const before = workflowHash(this.d.board.list().map(t => ({ id: t.id, state: t.state, after: t.deps, sdlc: t.sdlc, history: t.history.length })));
+    const links = this.d.board.list().map(t => ({ id: t.id, after: t.deps ?? [], private: this.isPii(t), receipt: t.sdlc, phase: this.isPii(t) ? undefined : this.workflowView(t) }));
+    const report = await readMergeQueue(repo, this.d.sdlc?.config() ?? sdlcConfig(undefined), links, this.d.sdlc?.gh);
+    // Policy can change across remote awaits without any board write. Never return its stale public projection.
+    const currentPrivacy = this.d.board.list().map(task => ({ id: task.id, private: this.isPii(task) }));
+    if (workflowHash(links.map(({ id, private: hidden }) => ({ id, private: hidden }))) !== workflowHash(currentPrivacy)) {
+      return { ...report, complete: false, rows: [], order: [], unordered: [], conflicts: [] };
+    }
+
+    const after = workflowHash(this.d.board.list().map(t => ({ id: t.id, state: t.state, after: t.deps, sdlc: t.sdlc, history: t.history.length })));
+    if (before !== after) { report.complete = false; report.order = []; if (report.rows.length) report.unordered = report.rows.map(row => row.pr); for (const row of report.rows) { row.ready = false; row.blockers.push("board changed during delivery readback"); } }
+    return report;
+  }
+  async releaseReadiness(repo: string, liveIssues: number[]) {
+    const report = await readReleaseReadiness(this.d.cwd, repo, liveIssues, { gh: this.d.sdlc?.gh });
+    if (report.documents) report.documents.documents = report.documents.documents.map(d => {
+      if (d.path && (!this.nameable(d.path) || matchesPolicy(this.d.cwd, d.path, this.d.piiPaths ?? [], true))) { const { path: _privatePath, ...metadata } = d; return metadata; }
+      return d;
+    });
+    return report;
+  }
+
+  private workflowView(task: Task) {
+    return phaseView(this.d.sdlc?.config() ?? sdlcConfig(undefined), task, id => this.d.board.get(id), t => this.isPii(t));
+  }
+  workflowExport(id: unknown): Record<string, unknown> {
+    const task = this.need(id), config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
+    const state = { id: task.id, state: task.state, stage: task.sdlc?.stage ?? config.stages[0] ?? "spec", ...(this.isPii(task) ? { private: true } : { phase: this.workflowView(task) ?? null }) };
+    return { schema: 1, workflow: config.workflow ?? "none", state, stateHash: workflowHash(state), sourceHash: workflowHash(config) };
+  }
+  async lifecycleStatus(id: unknown, refresh = true): Promise<SdlcStatus> {
+    const task = this.need(id), config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
+    const evidence = task.sdlc && !this.isPii(task) && refresh && config.mode !== "off" ? await readSdlcPr(task.sdlc, this.d.sdlc?.gh) : undefined;
+    return sdlcStatus(config, task.sdlc, evidence, this.workflowView(task));
+  }
+
+  private async lifecycleGate(task: Task, transition: "review" | "approval", reviewedHead?: string): Promise<void> {
+    const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
+    if (config.mode === "off") return;
+    const receipt = task.sdlc && { ...task.sdlc, ...(reviewedHead ? { reviewedHead } : {}) };
+    const evidence = receipt && !this.isPii(task) ? await readSdlcPr(receipt, this.d.sdlc?.gh) : undefined;
+    const current = this.need(task.id, false, true);
+    if (config.mode === "enforce" && (current.history.length !== task.history.length || current.owner !== task.owner || current.reviewer !== task.reviewer || current.state !== task.state)) throw new PreEffectToolRefusal(`task #${task.id}: changed during lifecycle readback; retry on current work`);
+    const status = sdlcStatus(config, receipt, evidence, this.workflowView(current));
+    const blockers = transition === "review" ? [...new Set([...status.blockers.filter(blocker => ["lifecycle stage definition unknown", "issue identity missing", "PR identity missing", "current PR evidence unknown", "PR is not open", "local gate on current head missing or failed"].includes(blocker)), ...(status.entry ?? []), ...(status.exit ?? [])])] : status.blockers;
+    if (config.mode === "enforce" && blockers.length) throw new PreEffectToolRefusal(`task #${task.id}: SDLC ${transition} blocked: ${blockers.join("; ")}`);
+    if (config.mode === "advise" && blockers.length) this.d.notify(`task ${this.publicTitle(task)}: SDLC ${transition} advice: ${this.isPii(task) ? "private lifecycle evidence unknown" : blockers.join("; ")}`);
+  }
+
   private need(id: unknown, open = false, preEffect = false): Task {
     // Callers are models (#70): an id is a whole number or a digit string, never an array that Number() would accept.
     const n = typeof id === "number" ? id : typeof id === "string" && /^\s*\d+\s*$/.test(id) ? Number(id) : NaN;
     if (!Number.isInteger(n)) throw new (preEffect ? PreEffectToolRefusal : Error)(`id must be a task number, not ${(typeof id === "number" ? String(id) : JSON.stringify(id ?? null)).slice(0, 60)}`);
     const task = this.d.board.get(n);
     if (!task) throw new (preEffect ? PreEffectToolRefusal : Error)(`no task #${n}`);
+    if (task.state === "backlog") throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${n} is backlog: pull it into To Do first`);
     // Handing a task to someone else only makes sense while there is work left on it.
     if (open && !OPEN.includes(task.state)) throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id} is ${task.state}: it can no longer change hands`);
     return task;
@@ -1006,10 +1687,10 @@ export class Tasks {
     this.ready(task, true);
     if (task.state !== "proposed" && task.state !== "changes_requested" && task.state !== "in_progress") throw new PreEffectToolRefusal(`task #${task.id} is ${task.state}: cannot move to in_progress`);
     // Models send null or {} for an optional field they leave empty: neither replaces a plan.
-    const given = plan == null ? undefined : cleanPlan(plan);
+    const given = plan == null ? undefined : cleanPlan(plan, (task.profile ?? "dev") === (this.d.profile ?? "dev") ? this.d.profileData ?? task.profile ?? "dev" : task.profile ?? "dev");
     const cleaned = given && Object.keys(given).length ? given : undefined;
     // A task's signals are fixed when it is proposed: text that matches a PII pattern cannot be let in afterwards.
-    if (cleaned && !this.isPii(task) && this.isPii({ signals: detectSignals({ title: "", detail: planText(cleaned), refs: {} }, this.d.routing(), this.d.cwd) })) {
+    if (cleaned && !this.isPii(task) && this.isPii({ signals: this.signalsFor({ title: "", detail: planText(cleaned), refs: {}, plan: cleaned }) })) {
       throw new PreEffectToolRefusal("this plan matches a PII pattern and is not kept: other owners would see it");
     }
     const before = new Set(this.overlapHits(task).map((h) => h.task.id));
@@ -1072,9 +1753,11 @@ export class Tasks {
     const task = this.need(id, true, true);
     this.mine(task, by, "owner", true);
     // The owner it is declined for goes on the entry, also when the console declines for it: `excluded()` keeps it out (#207).
-    const back = this.d.board.update(task.id, by, "declined", task.state === "in_progress" ? { state: "proposed" } : {}, reason, task.owner ? { from: task.owner } : {});
+    const planned = this.plannerPullRecord(task)?.pull === true;
+    const back = this.d.board.update(task.id, by, "declined", { ...(["in_progress", "changes_requested"].includes(task.state) ? { state: "proposed" as const } : {}), ...(planned ? { reserved: null } : {}) }, reason, task.owner ? { from: task.owner } : {});
+    if (planned) this.offered.delete(task.id);
     this.d.notify(`task ${this.publicTitle(back)} declined by ${by}${reason && !this.isPii(back) ? `: ${reason}` : ""}`);
-    return this.assignOwner(back, HUB, { event: "reassigned", reason: "declined", clearOnFail: true });
+    return this.assignOwner(back, HUB, { event: "reassigned", reason: "declined", clearOnFail: true, ...(planned ? { planner: true } : {}) });
   }
 
   /** Tasks whose check is queued or running, and the owner it was started for. */
@@ -1102,6 +1785,7 @@ export class Tasks {
     // The PII screen reads the summary of a done that passes these checks (issue #198); they run again after it.
     const withheld = await this.withholds("summary", summary, valid());
     let task = valid();
+    if (this.d.sdlc && this.d.sdlc.config().mode !== "off") { await this.lifecycleGate(task, "review"); task = valid(); }
     // A member of a silent cohort (issue #107): its done is an intent, and the last of them integrates first.
     const cohort = this.cohorts.of(task.id);
     const silentMember = !!cohort?.silent && this.turnFree() && !!task.owner && !this.isPii(task);
@@ -1131,7 +1815,7 @@ export class Tasks {
       else if (evidence) this.doneNotes.set(task.id, `Overlapping work finished while you worked (no turn-free integration step ran):\n${evidence}`);
     }
     if (task.state === "proposed" || task.state === "changes_requested") task = this.d.board.update(task.id, by, "accepted", { state: "in_progress" }, WITH_DONE); // done without a separate accept
-    const command = this.d.runCheck ? this.d.check?.(task.class) : undefined;
+    const command = this.d.runCheck ? this.d.check?.(task.class, task) : undefined;
     if (!command) return this.complete(task, by, summary, refs, "", withheld);
     // The tool call returns now; a check can outlast an agent's tool timeout. The result decides what comes next.
     this.checking.set(task.id, task.owner);
@@ -1175,7 +1859,7 @@ export class Tasks {
         const at = [...u.history].reverse().find((h) => h.event === "done");
         if (u.owner === t.owner || !at || at.at < handedAt(t)) return [];
         const theirs = this.places(u);
-        const paths = mine.paths.filter((p) => theirs.paths.some((q) => samePlace(p, q)));
+        const paths = t.profile && u.profile && (t.plan?.sections?.length && u.plan?.sections?.length) ? [] : mine.paths.filter((p) => theirs.paths.some((q) => samePlace(p, q)));
         const symbols = mine.symbols.filter((x) => theirs.symbols.includes(x));
         return paths.length || symbols.length ? [this.completedNotice(u, { task: t, paths, symbols }, at.note, at.withheld)] : [];
       });
@@ -1259,12 +1943,19 @@ export class Tasks {
   }
 
   private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = "", withheld = false): Promise<Task> {
-    const reviewer = task.reviewer;
-    const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", refs: cleanRefs(refs) }, checkOutput ? `${summary ?? ""}\n${checkOutput}`.trim() : summary, { withheld: withheld || undefined });
+    let reviewer = task.reviewer;
+    if (this.d.sdlc && this.d.sdlc.config().mode !== "off") {
+      await this.lifecycleGate(task, reviewer ? "review" : "approval");
+      task = this.need(task.id, false, true);
+      this.mine(task, by, "owner", true);
+      reviewer = task.reviewer;
+    }
+    const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: cleanRefs(refs) }, checkOutput ? `${summary ?? ""}\n${checkOutput}`.trim() : summary, { withheld: withheld || undefined });
     this.cohorts.closed(next.id); // its owner's next native turn end settles it in its cohort (issue #107)
     this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\n${summary ?? ""}`, withheld);
     this.tellCompleted(next, summary, withheld);
     if (!reviewer) {
+      this.settleMemory(next);
       if (next.owner) this.d.board.recordOutcome(next.owner, next.class, true); // approved without a review is a success too
       this.releaseNotice(`task ${this.publicTitle(next)} done by ${by}, no reviewer: approved`);
       await this.releaseDependents(next);
@@ -1339,11 +2030,15 @@ export class Tasks {
       `- List what is unmet in hub_review's unmet, one item each.`,
     ].join("\n");
     const summary = last?.note ? this.screen(task, last.note, "summary", reviewer, last.withheld) : "(no summary)";
-    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
+    const guidance = this.roleGuidance(task, reviewer, true);
+    let projection = "";
+    try { const text = this.d.projectedReview?.(task); if (text) projection = this.screen(task, sanitize(text), "document projection", reviewer); }
+    catch { projection = "(document projection unavailable)"; }
+    const body = `Review task #${task.id} [${profileTaskLabel(task)}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${guidance ? guidance + "\n" : ""}${projection ? projection + "\n" : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
     this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, task: String(task.id) }, ...(this.isPii(task) ? { private: true } : {}) }));
   }
 
-  async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown): Promise<Task> {
+  async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown, head?: unknown): Promise<Task> {
     const valid = (): Task => {
       const t = this.need(id, false, true);
       this.mine(t, by, "reviewer", true);
@@ -1355,11 +2050,17 @@ export class Tasks {
     if (items.length) note = `${note ?? ""}\nUnmet: ${items.join("; ")}`.trim();
     // The PII screen reads the note of a review that passes these checks (issue #198); they run again after it.
     const withheld = await this.withholds("review note", note, valid());
-    const task = valid();
+    let task = valid();
+    let reviewedHead: string | undefined;
+    if (head !== undefined) {
+      const checked = sdlcReceipt({ reviewedHead: head }, task.sdlc, this.d.sdlc?.config() ?? sdlcConfig(undefined));
+      reviewedHead = checked.reviewedHead;
+    }
+    if (verdict === "approved" && this.d.sdlc && this.d.sdlc.config().mode !== "off") { await this.lifecycleGate(task, "approval", reviewedHead); task = valid(); }
     const pii = this.isPii(task);
     const flag = { withheld: withheld || undefined };
     if (verdict === "approved") {
-      const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0 }, note, flag);
+      const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0, ...(reviewedHead && task.sdlc ? { sdlc: { ...task.sdlc, reviewedHead, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), "merge") } } : {}) }, note, flag);
       if (next.owner) {
         this.d.board.recordOutcome(next.owner, next.class, true);
         this.d.board.recordReview({ implementer: next.owner, reviewer: by, class: next.class, kind: "approved", task: next.id });
@@ -1369,6 +2070,7 @@ export class Tasks {
         }
       }
       this.note(next, by, "decision", `Task #${next.id} approved by ${by}: ${next.title}\n${note ?? ""}`, withheld);
+      this.settleMemory(next);
       this.releaseNotice(`task ${this.publicTitle(next)}: could not tell ${next.owner ?? "its owner"} it was approved`, () =>
         this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${this.screen(next, note, "review note", next.owner, withheld)}` : ""}`, pii));
       await this.releaseDependents(next);
@@ -1380,7 +2082,18 @@ export class Tasks {
     this.contradict(rejected);
     this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`, withheld);
     if (rejected.rejections >= ESCALATE_AFTER) {
-      const moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`, "rejections");
+      let moved: Task;
+      try {
+        moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`, "rejections");
+      } catch (e) {
+        // The verdict is saved. If the escalation's move was saved too, only its delivery is unconfirmed, and the
+        // error carries the saved task (#297); the console notice was printed where the error was thrown. The
+        // reviewer gets the saved task back, never a failed tool call (#276). Anything else (the task closed
+        // meanwhile (#254), a failed board write, a superseded move) still throws. assignOwner keeps throwing for
+        // the ready offer's retry (#231).
+        if (!(e instanceof AssignmentUndeliveredError)) throw e;
+        return e.task;
+      }
       if (moved.owner !== rejected.owner) return moved;
       // Nobody to escalate to: the owner still has to hear the verdict and the note.
       this.releaseNotice(`task ${this.publicTitle(moved)}: could not tell ${moved.owner ?? "its owner"} changes were requested again`, () =>
@@ -1404,24 +2117,64 @@ export class Tasks {
     if (from && by !== HUB) this.d.board.recordOutcome(from, task.class, false);
     // Only a reviewer that asked for changes on this work saw it fail: not an escalation of unreviewed work (a Pi failure).
     if (from && task.reviewer && task.reviewer !== USER && this.requestedChanges(task).has(task.reviewer)) this.d.board.recordReview({ implementer: from, reviewer: task.reviewer, class: task.class, kind: "escalated", task: task.id });
-    const next = await this.assignOwner(task, by, { candidates: list, event: "escalated", reason, note: `${why}; from ${from ?? "none"}`, context: why });
+    // The guarded tail of a landed move: the console notice, the decision note and the old owner's stop message,
+    // each behind its own releaseNotice. It runs on the success path and on a saved move whose delivery failed.
+    const tail = (moved: Task) => {
+      this.releaseNotice(`task ${this.publicTitle(moved)} escalated from ${from} to ${moved.owner} (${why})`);
+      this.note(moved, by, "decision", `Task #${moved.id} escalated from ${from} to ${moved.owner}: ${why}`);
+      if (from) this.releaseNotice(`task ${this.publicTitle(moved)}: could not tell ${from} it moved to ${moved.owner}`, () =>
+        this.tell({ ...moved, owner: from }, `Task #${moved.id} moved to ${moved.owner} (${why}). Stop working on it.`, this.isPii(moved)));
+    };
+    let next: Task;
+    try {
+      next = await this.assignOwner(task, by, { candidates: list, event: "escalated", reason, note: `${why}; from ${from ?? "none"}`, context: why });
+    } catch (e) {
+      // A saved move whose delivery failed arrives as AssignmentUndeliveredError carrying the saved task (#297);
+      // the tail still runs on it (its parts are guarded), and the caller still gets the throw. Anything before
+      // the write gets neither.
+      if (e instanceof AssignmentUndeliveredError) tail(e.task);
+      throw e;
+    }
     if (next.owner && next.owner !== from) {
       // The move is on the board (#243): review() reaches here after its changes_requested write.
-      this.releaseNotice(`task ${this.publicTitle(next)} escalated from ${from} to ${next.owner} (${why})`);
-      this.note(next, by, "decision", `Task #${next.id} escalated from ${from} to ${next.owner}: ${why}`);
-      if (from) this.releaseNotice(`task ${this.publicTitle(next)}: could not tell ${from} it moved to ${next.owner}`, () =>
-        this.tell({ ...next, owner: from }, `Task #${next.id} moved to ${next.owner} (${why}). Stop working on it.`, this.isPii(next)));
+      tail(next);
     } else this.releaseNotice(`task ${this.publicTitle(task)}: escalation found nobody in [${list.join(", ")}]; it stays with ${from ?? "nobody"}`);
     return this.d.board.get(next.id)!;
   }
 
   /** Caller authority is checked by the daemon; keep the real actor in task history. */
-  async assignTo(id: unknown, peer: PeerId, by: PeerId = USER, preEffect = false): Promise<Task> {
-    const task = this.need(id, true, preEffect);
+  async assignTo(id: unknown, peer: PeerId, by: PeerId = USER, preEffect = false, role: TaskAssignmentRole = "owner"): Promise<Task> {
+    if (role !== "owner" && role !== "reviewer") throw new (preEffect ? PreEffectToolRefusal : Error)("role must be owner or reviewer");
+    if (role === "reviewer" && by !== USER) {
+      const conductors = Object.entries(this.d.roles ?? {}).filter(([, roles]) => Array.isArray(roles) && roles.includes("conductor")).map(([actor]) => actor);
+      if (conductors.length !== 1 || conductors[0] !== by) throw new (preEffect ? PreEffectToolRefusal : Error)("only the console user or the configured conductor may name a reviewer");
+    }
+    const task = this.need(id, role === "owner", preEffect);
+    if (!this.d.bus.isRostered(peer)) throw new (preEffect ? PreEffectToolRefusal : Error)(`${peer} is off roster; add it to the roster before assigning work`);
+    if (role === "reviewer") {
+      if (!OPEN.includes(task.state) && task.state !== "in_review") throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id} is ${task.state}: its reviewer can no longer change`);
+      this.ready(task, preEffect);
+      const a = assign(task, this.states(), this.d.routing(), { candidates: [], namedReviewer: peer, ...(task.owner ? { notReviewer: task.owner } : {}), ...this.weights(task.class) });
+      if (a.reviewer !== peer) throw new (preEffect ? PreEffectToolRefusal : Error)(`cannot name ${peer} as reviewer: ${a.trace.filter(line => line.includes("reviewer") || line.includes("pii")).join("; ")}`);
+      const next = this.d.board.update(task.id, by, "reviewer changed", { reviewer: peer }, `named reviewer ${peer}`, { reason: "manual" });
+      if (next.state === "in_review" && task.reviewer && task.reviewer !== peer) {
+        const previous = task.reviewer;
+        this.releaseNotice(`task ${this.publicTitle(next)}: could not notify previous reviewer ${previous} that its review request is withdrawn`, () => {
+          for (const env of this.d.bus.snapshot(false).queues[previous] ?? []) {
+            if (env.from === HUB && env.kind === "review" && env.refs?.task === String(task.id)) this.d.bus.withdraw(env.id);
+          }
+          const body = `Review request for task #${task.id} ${this.publicTitle(next)} is withdrawn: its reviewer is now ${peer}. Do not review this task; a late verdict from the previous reviewer is refused.`;
+          if (previous === USER) this.d.notify(body);
+          else this.d.bus.publish(newEnvelope(HUB, body, { to: [previous], kind: "status", priority: "important", refs: { task: String(task.id) }, ...(this.isPii(next) ? { private: true } : {}) }));
+        });
+      }
+      if (next.state === "in_review" && peer !== USER) this.releaseNotice(`task ${this.publicTitle(next)}: could not send the review request to ${peer}`, () => this.sendReview(next, peer));
+      return next;
+    }
     // Work that waits is handed to nobody yet (issue #207): the peer becomes its reserved owner instead.
-    if (!this.waitsFor(task).length) return this.assignOwner(task, by, { candidates: [peer], event: "reassigned", reason: "manual", override: by === USER });
+    if (!this.waitsFor(task).length) return this.assignOwner(task, by, { candidates: [peer], namedOwner: peer, event: "reassigned", reason: "manual", override: by === USER });
     const next = this.d.board.update(task.id, by, "reserved", { reserved: peer }, `for ${peer}`, { reason: "manual" });
-    this.d.notify(`task ${this.publicTitle(next)} reserved for ${peer} by ${by}; it is offered to ${peer} first once what it waits for is approved`);
+    this.releaseNotice(`task ${this.publicTitle(next)} reserved for ${peer} by ${by}; it is offered to ${peer} first once what it waits for is approved`);
     return next;
   }
 
@@ -1430,28 +2183,70 @@ export class Tasks {
    * the usual constraints. Tasks it was reviewing get another reviewer. Moves are reported, never taken back automatically.
    */
   async reassignForPause(peer: PeerId, context: string | undefined, urgentOnly = false): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
-    const moved: { id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[] = [];
+    return this.reassignWork(peer, context, urgentOnly, false);
+  }
+
+  /** Read-only preview using the same assignment constraints as the roster relay. */
+  rosterPreview(peer: PeerId): { id: number; title: string; role: "owner" | "reviewer"; to: PeerId | null }[] {
     const routing = this.d.routing();
-    // The hand-off is screened once (#198), before anything moves, when an ordinary task will carry it.
+    return this.d.board.list().filter(task => task.state !== "approved" && (task.owner === peer || task.reviewer === peer)).map(task => {
+      const owner = task.owner === peer;
+      const weights = this.weights(task.class);
+      const pii = this.isPii(task);
+      const candidates = owner ? [pii ? LOCAL : PI, pii ? undefined : LOCAL, ...(routing.classes[task.class]?.peers ?? []).filter(p => p !== LOCAL && p !== PI)].filter((p): p is PeerId => !!p) : [];
+      const a = assign(task, this.states(), routing, { ...weights, offRoster: [...(weights.offRoster ?? []), peer], exclude: [peer], excludeOwners: owner && this.plannerPullRecord(task)?.pull ? this.plannerFull(task) : [], candidates, ...(owner ? { waitsFor: this.waitsFor(task) } : task.owner ? { notReviewer: task.owner } : {}) });
+      return { id: task.id, title: this.publicTitle(task), role: owner ? "owner" : "reviewer", to: (owner ? a.owner : a.reviewer) ?? null };
+    });
+  }
+
+  /** A roster removal offers work through the quota relay's constraints, preserving assignments nobody can take. */
+  async reassignForRoster(peer: PeerId): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
+    return this.reassignWork(peer, undefined, false, true);
+  }
+
+  private async reassignWork(peer: PeerId, context: string | undefined, urgentOnly: boolean, roster: boolean): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
+    const moved: { id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[] = [];
+    const routing = this.d.routing(), why = roster ? `roster removal of ${peer}` : `budget pause of ${peer}`;
+    // Budget context is screened exactly as before; a roster removal supplies no agent-written context.
     const moves = (t: Task) => (!urgentOnly || t.signals.includes("urgent")) && t.owner === peer && OPEN.includes(t.state);
     const contextWithheld = context && this.d.board.list().some((t) => moves(t) && !this.isPii(t)) ? await this.withholds("handoff", context) : false;
     for (const task of this.d.board.list()) {
-      // Waiting out a window that resets soon (issue #36): only urgent work moves.
       if (urgentOnly && !task.signals.includes("urgent")) continue;
-      if (task.owner === peer && OPEN.includes(task.state)) {
+      if (task.owner === peer && (OPEN.includes(task.state) || roster && task.state === "in_review")) {
         const pii = this.isPii(task);
         const candidates = [pii ? LOCAL : PI, pii ? undefined : LOCAL, ...(routing.classes[task.class]?.peers ?? []).filter((p) => p !== LOCAL && p !== PI)].filter((p): p is PeerId => !!p);
-        const back = task.state === "in_progress" ? this.d.board.update(task.id, HUB, "released", { state: "proposed" }, `budget pause of ${peer}`) : task;
-        const next = await this.assignOwner(back, HUB, { candidates, exclude: [peer], event: "reassigned", reason: "budget", note: `budget pause of ${peer}`, clearOnFail: true, ...(context ? { context, contextWithheld } : {}) });
+        if (this.plannerPullRecord(task)?.pull && !assign(task, this.states(), routing, { candidates, exclude: [...this.excluded(task), peer], excludeOwners: this.plannerFull(task), waitsFor: this.waitsFor(task), ...this.weights(task.class) }).owner) continue;
+        // Budget keeps its original release/unassign behaviour for ordinary work. Roster changes the state in
+        // assignOwner's same owner write only after routing has found somebody to take it.
+        const back = !roster && task.state === "in_progress" ? this.d.board.update(task.id, HUB, "released", { state: "proposed" }, why) : task;
+        let next: Task;
+        try {
+          next = await this.assignOwner(back, HUB, { candidates, exclude: [peer], event: "reassigned", reason: roster ? "manual" : "budget", note: why, ...(roster ? { roster: true } : { clearOnFail: true }), ...(context ? { context, contextWithheld } : {}) });
+        } catch (e) {
+          // The move is saved and its central #297 notice already spoke; relay the
+          // remaining tasks and run the roster tail on the saved row as on success.
+          if (!(e instanceof AssignmentUndeliveredError)) throw e;
+          next = e.task;
+        }
+        if (roster) {
+          if (!next.owner || next.owner === peer) continue;
+          this.releaseNotice(`task ${this.publicTitle(next)} moved from ${peer} to ${next.owner} (off roster)`);
+          if (next.state === "in_review" && next.reviewer && next.reviewer !== task.reviewer && next.reviewer !== USER) this.releaseNotice(`task ${this.publicTitle(next)}: could not send the review request to ${next.reviewer}`, () => this.sendReview(next, next.reviewer!, `(${peer} owned this and is off roster.)`));
+        }
         moved.push({ id: task.id, title: this.publicTitle(task), to: next.owner, role: "owner" });
       } else if (task.reviewer === peer && task.state !== "approved") {
-        // No owner candidates: only the reviewer is wanted, and it must be neither the paused peer nor the task's owner.
         const a = assign(task, this.states(), routing, { exclude: [peer], candidates: [], ...(task.owner ? { notReviewer: task.owner } : {}), ...this.weights(task.class) });
         const reviewer = a.reviewer && a.reviewer !== peer && a.reviewer !== task.owner ? a.reviewer : null;
-        const next = this.d.board.update(task.id, HUB, "reviewer changed", { reviewer }, `budget pause of ${peer}`);
+        if (roster && !reviewer) {
+          this.releaseNotice(`task ${this.publicTitle(task)}: its reviewer ${peer} is off roster and nobody else can review; the reviewer stays ${peer}; use ahub review ${task.id}`);
+          continue;
+        }
+        const next = this.d.board.update(task.id, HUB, "reviewer changed", { reviewer }, why);
         moved.push({ id: task.id, title: this.publicTitle(task), to: reviewer, role: "reviewer" });
-        if (next.state === "in_review" && reviewer && reviewer !== USER) this.sendReview(next, reviewer, `(${peer} was reviewing this and is paused for quota.)`);
-        else if (next.state === "in_review" && !reviewer) this.d.notify(`task ${this.publicTitle(next)}: its reviewer ${peer} is paused and nobody else can review; use ahub review ${next.id}`);
+        if (next.state === "in_review" && reviewer && reviewer !== USER) {
+          if (roster) this.releaseNotice(`task ${this.publicTitle(next)}: could not send the review request to ${reviewer}`, () => this.sendReview(next, reviewer, `(${peer} was reviewing this and is off roster.)`));
+          else this.sendReview(next, reviewer, `(${peer} was reviewing this and is paused for quota.)`);
+        } else if (next.state === "in_review" && !reviewer) this.d.notify(`task ${this.publicTitle(next)}: its reviewer ${peer} is paused and nobody else can review; use ahub review ${next.id}`);
       }
     }
     return moved;
@@ -1468,7 +2263,7 @@ export class Tasks {
     return { ...(policy?.route ? { route: policy.route } : {}), ...(policy?.fixed_model ? { fixedModel: policy.fixed_model } : {}), pii, task: String(about.id) };
   }
 
-  async remember(by: PeerId, input: { text?: string; title?: string; kind?: string; task?: unknown }): Promise<string> {
+  async remember(by: PeerId, input: { text?: string; title?: string; kind?: string; task?: unknown; horizon?: unknown; scope?: unknown }): Promise<string> {
     const text = String(input.text ?? "").trim();
     if (!text) throw new Error("text is required");
     const task = input.task !== undefined ? this.d.board.get(Number(input.task)) : undefined;
@@ -1476,24 +2271,132 @@ export class Tasks {
     // Shared with every other peer as well, so text that matches a PII pattern is refused like a note about a PII task.
     const title = String(input.title ?? "").trim();
     if (this.isPii({ signals: detectSignals({ title, detail: text, refs: {} }, this.d.routing(), this.d.cwd) })) throw new Error("this note matches a PII pattern and is not saved: claude-mem processes what it stores with a cloud model");
-    if (!this.d.memory) return "memory is disabled; nothing saved";
+    if (input.horizon !== undefined && input.horizon !== "short" && input.horizon !== "long") throw new Error('horizon is "short" or "long"');
+    if (input.scope !== undefined && input.scope !== "project" && input.scope !== "shared") throw new Error('scope is "project" or "shared"');
+    if (!this.d.memory && !this.d.store) return "memory is disabled; nothing saved";
+    // Long-term notes leave the machine (#258), and claude-mem's observer is a cloud model: a secret goes to neither.
+    if (looksSecret(`${title}\n${text}`)) throw new Error("this note looks like it holds a secret (a key, token or password) and is not saved");
+    if (this.aboutPrivatePath(title, text, task)) throw new Error("this note is about a path the project keeps private (pii.paths) and is not saved");
     if (await this.withholds("note", `${title}\n${text}`, task)) throw new Error("the PII screen did not clear this note, so it is not saved: claude-mem processes what it stores with a cloud model");
-    const kind = (NOTE_KINDS as readonly string[]).includes(String(input.kind)) ? String(input.kind) : "finding";
-    const res = await this.d.memory.save({ text, ...(title ? { title } : {}), project: this.d.project, metadata: { peer: by, kind, ...(task ? { task: task.id } : {}) } });
-    if (!res) return "memory worker unavailable; nothing saved";
+    const kind = (NOTE_KINDS as readonly string[]).includes(String(input.kind)) ? String(input.kind) as Kind : "finding";
+    const native = this.saveNative(by, kind, text, title, task, input.horizon === "long" || input.horizon === "short" ? input.horizon : undefined, input.scope === "shared" ? "shared" : "project");
+    if (task && this.d.memory) this.markMemoryReference(task, by);
+    const res = this.d.memory ? await this.d.memory.save({ text, ...(title ? { title } : {}), project: this.d.project, metadata: { peer: by, kind, ...(task ? { task: task.id } : {}) } }) : undefined;
+    if (!res && !native) return this.d.memory ? "memory worker unavailable; nothing saved" : "memory store unavailable; nothing saved";
     const line = noteLine(by, kind, title ? `${title}: ${text}` : text);
     this.d.notify(line);
     this.d.share?.(by, line);
-    return "saved to shared memory; the other agents get it with their next message";
+    return `saved to shared memory${native ? ` (hub memory ${native.id.slice(0, 8)}, ${native.tier}-term${this.d.memory && !res ? "; claude-mem unavailable" : ""})` : ""}; the other agents get it with their next message`;
+  }
+
+  /** The task's key in the hub's store: unique across `ahub reset --all`, which restarts the ids. */
+  private memoryKey(task: Task): string { return taskKey(this.d.store!.project, task); }
+
+  /**
+   * The long-term task a board task may join (#258). A peer names one of this project's; a person may name any (a link
+   * across projects is a person's). Refused before any board write.
+   */
+  private goalFor(by: PeerId, ref: unknown): GoalView {
+    if (!this.d.store) throw new PreEffectToolRefusal("goal: hub memory is off for this project");
+    const g = typeof ref === "string" && ref.trim() ? this.d.store.store.goalOf(ref.trim().replace(/^goal:/, "")) : undefined;
+    if (!g) throw new PreEffectToolRefusal(`goal: no long-term task ${JSON.stringify(ref).slice(0, 40)} (ahub goal list shows them)`);
+    if (by !== USER && g.project !== this.d.store.project) throw new PreEffectToolRefusal("goal: that long-term task belongs to another project; linking across projects is a person's");
+    if (g.state === "done" || g.state === "dropped") throw new PreEffectToolRefusal(`goal: that long-term task is ${g.state}`);
+    return g;
+  }
+  /** Fence deletion before external memory writes; one marker survives store absence. */
+  private markMemoryReference(task: Task, by: PeerId): void {
+    if (!this.d.board.get(task.id)?.history.some(entry => entry.event === "memory reference started")) this.d.board.update(task.id, by, "memory reference started", {});
+  }
+  /** Record a long-term link, never for PII; failures remain notices. */
+  private linkNative(task: Task, goal: GoalView, by: PeerId): string {
+    if (this.isPii(task)) { this.releaseNotice(`task #${task.id} is not linked to a long-term task: nothing about a PII task enters hub memory`); return "not linked (PII task)"; }
+    try { this.markMemoryReference(task, by); this.d.store!.store.goalLink(goal.id, this.memoryKey(task), by); return `part of long-term task ${goal.id.slice(0, 8)}`; }
+    catch (e) { this.releaseNotice(`task #${task.id}: the link to long-term task ${goal.id.slice(0, 8)} was not saved (${(e as Error).message})`); return "not linked"; }
+  }
+  /** A person links a board task of this project to a long-term task (`ahub goal link`). */
+  linkGoal(by: PeerId, id: unknown, ref: unknown): string {
+    const task = this.d.board.get(Number(id));
+    if (!task) throw new Error(`no task #${String(id).slice(0, 12)}`);
+    const goal = this.goalFor(by, ref);
+    return `task #${task.id}: ${this.linkNative(task, goal, by)}`;
+  }
+
+  /**
+   * One note in the hub's own store (#258). Short-term while its task is open; on an approved task, or with horizon
+   * long, decisions, contracts and fails are long-term. Fail-open: a store that cannot be written costs one notice.
+   * The caller has screened the text for PII; never a PII task's.
+   */
+  private saveNative(by: PeerId, kind: Kind, text: string, title: string, task: Task | undefined, horizon?: Tier, scope: Scope = "project"): { id: string; tier: Tier } | undefined {
+    const st = this.d.store;
+    if (!st || (task && this.isPii(task))) return undefined;
+    try { // never throws: callers run after a board write
+      // Approved, or settled in the store already: the snapshot the caller holds can predate an approval made while it awaited.
+      const approved = !!task && (task.state === "approved" || st.store.settled(this.memoryKey(task)));
+      const tier: Tier = horizon ?? (approved && PROMOTED_KINDS.includes(kind) ? "long" : "short");
+      const about = extractNodes(`${title}\n${text}`, { cwd: this.d.cwd, project: st.project, repo: st.repo, deny: st.deny, paths: [...(task?.refs.paths ?? []), ...(task?.plan?.paths ?? [])], symbols: task?.plan?.symbols, ...(task ? { task: { id: task.id, created: task.created } } : {}) });
+      // A short-term note on a task already approved (before hub memory existed, or late): the task is settled first, so
+      // the note gets its own deadline and is never taken for a source waiting for promotion.
+      if (task && approved && tier === "short" && !st.store.settled(this.memoryKey(task))) st.store.settle(this.memoryKey(task), by);
+      if (task) this.markMemoryReference(task, by);
+      const id = st.store.note({ op: "note", project: st.project, scope, tier, kind, peer: by, ...(title ? { title } : {}), text, ...(task ? { task: this.memoryKey(task) } : {}), about, source: by === USER ? "person" : "hub" }, horizon === "short");
+      st.onNote?.(id);
+      return { id, tier };
+    } catch (e) {
+      this.releaseNotice(`a ${kind} note was not saved to hub memory (${(e as Error).message})`);
+      return undefined;
+    }
+  }
+
+  /** An approved task's decision, contract and fail notes move to long-term; its short-term entries start to expire (#258). */
+  /**
+   * At hub start: an approved task whose settle entry a crash or a failed write cut off is settled now, so its
+   * decisions, contracts and fails still reach long-term memory and its findings get their deadline.
+   */
+  reconcileMemory(): number {
+    if (!this.d.store) return 0;
+    let n = 0;
+    for (const t of this.d.board.list("approved")) {
+      if (this.isPii(t)) continue;
+      try { const key = this.memoryKey(t); if (this.d.store.store.hasTask(key) && !this.d.store.store.settled(key)) { this.settleMemory(t); n++; } }
+      catch { /* fail-open: tried again at the next start */ }
+    }
+    return n;
+  }
+
+  private settleMemory(task: Task): void {
+    if (!this.d.store || this.isPii(task)) return;
+    // The store screens each note as it moves to the synced log (the promotion screen the daemon gives it).
+    try { this.d.store.store.settle(this.memoryKey(task), task.reviewer ?? task.owner ?? HUB); }
+    catch (e) { this.releaseNotice(`task #${task.id}: hub memory could not settle its notes (${(e as Error).message})`); }
+  }
+
+  /**
+   * Whether a note names, or its task touches, a path the current `pii.paths` makes private: checked before either memory
+   * backend sees it, whatever the task's signals said when it was proposed.
+   */
+  private aboutPrivatePath(title: string, text: string, task: Task | undefined): boolean {
+    const st = this.d.store;
+    // No denylist here: a path the graph leaves out is still checked against the privacy policy.
+    const about = extractNodes(`${title}\n${text}`, { cwd: this.d.cwd, project: st?.project ?? this.d.project, repo: st?.repo ?? this.d.project, deny: [],
+      paths: [...(task?.refs.paths ?? []), ...(task?.plan?.paths ?? [])], symbols: task?.plan?.symbols });
+    return mentionsPrivatePath(`${title}\n${text}`, about, this.d.piiPaths ?? [], this.d.cwd);
   }
 
   /** Auto notes: only transitions that carry content, never for PII. */
-  private note(task: Task, by: PeerId, kind: string, text: string, withheld = false): void {
-    if (this.isPii(task) || !this.d.memory) return;
+  private note(task: Task, by: PeerId, kind: Kind, text: string, withheld = false): void {
+    if (this.isPii(task) || (!this.d.memory && !this.d.store)) return;
     // claude-mem's observer is a cloud model: model-written text that matches a PII pattern, or that the PII screen did
-    // not clear (#198), is not sent (#69).
+    // not clear (#198), is not sent (#69). Long-term hub memory leaves the machine (#258): the same rule, and no secrets.
     if (withheld || !this.nameable(text)) return this.releaseNotice(`task #${task.id}: a ${kind} note was not saved to shared memory (${this.whyWithheld(text)})`);
-    void this.d.memory.save({ text, title: `agent-hub task #${task.id}: ${task.title}`.slice(0, 120), project: this.d.project, metadata: { peer: by, task: task.id, kind } });
+    if (looksSecret(text)) return this.releaseNotice(`task #${task.id}: a ${kind} note was not saved to shared memory (it looks like it holds a secret)`);
+    const title = `agent-hub task #${task.id}: ${task.title}`.slice(0, 120);
+    if (this.aboutPrivatePath(title, text, task)) return this.releaseNotice(`task #${task.id}: a ${kind} note was not saved to shared memory (it is about a private path)`);
+    this.saveNative(by, kind, text, title, task);
+    if (this.d.memory) {
+      try { this.markMemoryReference(task, by); } catch { return this.releaseNotice(`task #${task.id}: memory reference could not be recorded; note was not saved`); }
+      void this.d.memory.save({ text, title, project: this.d.project, metadata: { peer: by, task: task.id, kind } });
+    }
   }
 
   private tell(task: Task, body: string, pii: boolean): void {