@staix/agent-hub 0.12.30 → 0.12.32

package/src/hub/daemon.ts

@@ -1,3 +1,8 @@
+import { ContainerRunner, type RunnerOptions, type RunReceipt } from "./check-runner.ts";
+import { fetchSpec, specAvailable, specRefs } from "./spec-read.ts";
+import { isDenied } from "../local/deny.ts";
+import { supersededDeliveryReason, deliveryTaskContext } from "./delivery-superseded.ts";
+import { renderHeldHint } from "./delivery-hints.ts";
 import { correctionInput, MemoryTelemetry } from "./memory-candidates.ts";
 import { MemoryObservations } from "./memory-observations.ts";
 import { createStalenessProbe } from "./memory-staleness.ts";
@@ -14,22 +19,26 @@ import { catalogAssignments, loadRoleCatalog, selectedRoles, roleIdentity } from
 import { ActivityRing } from "./activity.ts";
 import { JcodePeer } from "../adapters/jcode.ts";
 import { jcodeMcpReady } from "../cli/jcode-mcp.ts";
-import { loadSdlc } from "./sdlc.ts";
+import { loadSdlc, sdlcGh } from "./sdlc.ts";
 import { peerRosterConfig, rosterAllows, type PeerRoster } from "./roster.ts";
-import { KNOWN_PEERS, OPTIONAL_PEERS, SUPPORTED_PEERS, isSupportedPeer } from "./peer-catalog.ts";
+import { KNOWN_PEERS, OPTIONAL_PEERS, PLANNER_PEERS, SUPPORTED_PEERS, isSupportedPeer } from "./peer-catalog.ts";
 import { databaseBusySite, isDatabaseBusy, RecoveryDatabaseBusy } from "./recovery-error.ts";
-import { buildKimiLaunch, buildQwenLaunch } from "../cli/launch.ts";
+import { buildKimiLaunch } from "../cli/launch.ts";
+import { definitionOf } from "../adapters/registry.ts";
 import { ProgressObserver, normalizeCodexObservation, normalizeClaudeObservation } from "./progress.ts";
 import type { ToolObservation } from "../models/route/signals.ts";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { appendFileSync, chmodSync, existsSync, fstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, existsSync, fstatSync, mkdirSync, readFileSync, renameSync, rmSync, watchFile, unwatchFile, writeFileSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
 import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { childEnv } from "./child-process.ts";
 import { runCheck } from "./checks.ts";
 import { DEFAULT_TASK_SWEEP, taskSweepConfig, type TaskSweepConfig } from "./task-sweep.ts";
-import { stripUntrusted } from "./config-trust.ts";
+import { ALL_MACHINE_LOCAL, configRepositoryPresent, configTracked, stripUntrusted } from "./config-trust.ts";
+import { authorizeConfigLeaf, configApply, configChanges, validateEffectiveConfig } from "./config-apply.ts";
+import { resolveSettledRoles } from "./settled-roles.ts";
+import { CONFIG_SOURCE_FILES, configFingerprint, configSourceTexts, parseConfigSources, type ConfigSources } from "./config-reload.ts";
 import { eventLog, readEvents, tokenDeltas, type RoleIdentity } from "./events.ts";
 import { ExecutionBudget } from "./execution-budget.ts";
 import { claudeReportedTokens, readClaudeTranscriptUsage, waitForClaudeCompletion } from "./usage.ts";
@@ -42,7 +51,7 @@ import { ensureMlx, type MlxOptions } from "../models/mlx.ts";
 import { PiToolReceipts, packPiShellResult } from "../pi/tool-receipts.ts";
 import { PreEffectToolRefusal } from "./tool-refusal.ts";
 import { processSignature } from "../pi/process-signature.ts";
-import { recordPiReplacement, validatePiSession } from "../pi/session.ts";
+import { PiSessionBookmarkMismatch, PiSessionUnresumable, recordPiReplacement, validatePiSession } from "../pi/session.ts";
 import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
 import { DEFAULT_NETWORK_ALLOW, startEgressProxy, type EgressProxy } from "../local/proxy.ts";
 import { runTool, toolResultFailed, TOOL_SCHEMAS, type ToolApproval, type ApprovalObserver, type ToolContext } from "../local/tools.ts";
@@ -51,16 +60,16 @@ import { Capture, skipTools } from "../memory/capture.ts";
 import { DEFAULT_OMNIROUTE, OmniRoute, type OmniRouteConfig } from "../omniroute/client.ts";
 import { Sidecar } from "../switchyard/sidecar.ts";
 import { Briefs } from "../memory/brief.ts";
-import { Board, taskProposalAt, taskHasStarted, CLASSES, type Task, type TaskClass } from "./board.ts";
+import { Board, isClosedTaskState, taskProposalAt, taskHasStarted, CLASSES, type Task, type TaskClass } from "./board.ts";
 import { Budget, claudeWindows, codexWindows, DEFAULT_BUDGET, type BudgetConfig } from "./budget.ts";
 import { HUB } from "./envelope.ts";
 import { recallMemoryLines, trimToTokens } from "../memory/recall.ts";
 import { closeSync, constants as fsConstants, openSync, readSync, statSync } from "node:fs";
 import { basename, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
-import { realPath } from "./project.ts";
+import { realPath, hubHome } from "./project.ts";
 import type { BusEvent } from "./bus.ts";
-import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, roleContract, TASK_TOOLS, profileTaskTools } from "./hub-tools.ts";
+import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, roleContract, TASK_TOOLS, BOUNDED_TASK_TOOLS, profileTaskTools } from "./hub-tools.ts";
 import { Conductor, ConductorHolds, conductorPeer, conductorProgressSink, publicConductorTask, publicPeerBudget, type ConductEvent } from "./conductor.ts";
 import { SupervisionFeed } from "./supervision.ts";
 import { drainCliAudits } from "../cli/identity-audit.ts";
@@ -68,13 +77,13 @@ import { launcherPreview } from "../cli/preview.ts";
 import { AssignmentUndeliveredError, Tasks } from "./tasks.ts";
 import { DEFAULT_INFERENCE, DIGEST, Inference, screenPii, type InferenceConfig } from "./inference.ts";
 import { ask, ASK_NOTE_TITLE, RUN_START } from "./ask.ts";
-import { currentRouting, detectSignals, OVERLAY_FILE, parseRouting, routingText, type Routing } from "./routing.ts";
-import { checkSettingValue, ignoredLine, pendingUndo, readOverlay, restoredValue, routingCandidate, storedLocally, settingDef, settingRefusal, settingRows, settingText, undoSetting, valueAt, writeConfigSetting, writeRoutingSetting, type SettingAuthority, type SettingDef, type SettingRow, type SettingValue } from "./settings.ts";
+import { currentRouting, detectSignals, OVERLAY_FILE, overlayToml, parseRouting, routingText, type Routing } from "./routing.ts";
+import { SETTINGS, checkSettingValue, ignoredLine, pendingUndo, pendingUndoIdentity, readOverlay, restoredValue, routingCandidate, storedLocally, settingDef, settingRefusal, settingRows, settingText, undoSetting, valueAt, writeConfigSetting, writeRoutingSetting, type SettingAuthority, type SettingDef, type SettingRow, type SettingValue, type UndoIdentity } from "./settings.ts";
 import { Bus } from "./bus.ts";
 import { attribute, deliveryTask, type TaskAttribution } from "./attribution.ts";
 import { DeliveryJournal } from "./delivery-journal.ts";
 import { startDashboard, type DashboardSession } from "./ui.ts";
-import { PROTOCOL, stateDirFor } from "./control-client.ts";
+import { DAEMON_FEATURES, PROTOCOL, stateDirFor } from "./control-client.ts";
 import { newEnvelope, parseMarker, replyParent, sanitize, USER, type Envelope, type PeerId, type Priority } from "./envelope.ts";
 import { BasePeer, DEFAULT_WATCHDOG_MS, type PeerAdapter } from "./peers.ts";
 import { MemoryClient, workerUrl } from "../memory/client.ts";
@@ -90,6 +99,8 @@ import type { JournalDelivery } from "./delivery-journal.ts";
 import { DEFAULT_LIMITS, Limiter, PROJECT_LIMITS, type LimitsConfig } from "./limits.ts";
 import { changedPaths, hasTree, repoOf, snapshot, Turns, type TurnRecord } from "./snapshots.ts";
 import { archiveRestartSnapshot, readRecoveryWaivers, readRestartSnapshot, removeRestartSnapshot, restartPath, writeRestartSnapshot, type RecoveryPhase, type RestartPeerSnapshot, type RestartSnapshot } from "./restart.ts";
+import { consumeRecoveryContinuity, readRecoveryContinuity, retireRecoveryContinuity } from "./recovery-continuity.ts";
+import { shellQuote } from "../cli/terminal-recovery.ts";
 
 import { isStartablePeer, peerStartConfig, PEER_START_RETRY_MS, STARTABLE_PEERS, startModeOf, terminalTemplate, type PeerStartConfig, type StartMode } from "./start-mode.ts";
 import { hasKimiHubMcp } from "../cli/kimi-mcp.ts";
@@ -104,7 +115,7 @@ import { syncMemory } from "@staix/agent-mem";
 import { MEMORY_READ_TOOLS, memoryRead, validateMemoryRead } from "./read-tools.ts";
 import { memoryProjectKey } from "@staix/agent-mem";
 import { nativeRecall } from "../memory/recall.ts";
-import { promotionScreen, withoutPii } from "./memory-policy.ts";
+import { promotionScreen, withoutPii, mentionsPrivatePath } from "./memory-policy.ts";
 
 export interface HubConfig {
   watchdog_ms: number;
@@ -125,6 +136,8 @@ export interface HubConfig {
   memory: { enabled: boolean; worker_url?: string; inject_tokens: number; brief_items: number; native?: boolean; short_ttl_days?: number; sync_interval_min?: number; suggest_edges?: boolean };
   roster: PeerRoster;
   roles: Record<string, string[]>;
+  /** #455: the one peer that holds the planner role; unset, the `roles` planners stand, or the hub assigns one. */
+  planner?: string;
   profile?: ProfileName;
   profile_overrides?: Record<string, unknown>;
   pii?: { paths: string[] };
@@ -147,7 +160,7 @@ export interface HubConfig {
   /** Between-turn task escalation, disabled unless explicitly enabled (#186). */
   task_sweep: TaskSweepConfig;
   /** A command per task class run when the owner marks the task done, and its timeout (issue #7). */
-  checks: { timeout_s: number; [cls: string]: string | number };
+  checks: { timeout_s: number; runner?: "container"; [cls: string]: string | number | undefined };
   /** A git tree at each turn boundary for `ahub turns` and `ahub undo`, the last `keep` per peer (issue #33). */
   snapshots: { enabled: boolean; keep: number };
   /** #247: opt-in research records of each approved task in ~/.agenthub/research (ids, counts and tokens only). */
@@ -228,17 +241,24 @@ const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
 /** The shared project config, then the machine's own file, which overrides it block by block (issue #17). */
 const CONFIG_FILES = ["config.json", "config.local.json"] as const;
+export interface ConfigLayer { name: typeof CONFIG_FILES[number]; raw: Record<string, any> }
 const CONFIG_BLOCKS = ["memory", "roster", "roles", "catalog_roles", "pii", "data", "conductor", "budget", "context", "inference", "omniroute", "local", "pi", "approvals", "tasks", "task_sweep", "checks", "snapshots", "research", "bench", "limits", "review", "recovery", "capabilities", "mlx", "permission_modes", "peers", "terminal"];
 
 /** Connection-time policy refresh reads role/feed fields only, never launches or machine-local configuration. */
-export function loadConductorPolicy(cwd: string): { roles: Record<string, string[]>; conductor: HubConfig["conductor"] } {
+export function loadConductorPolicy(cwd: string, layers?: readonly ConfigLayer[]): { roles: Record<string, string[]>; conductor: HubConfig["conductor"]; planner?: string } {
   const roles: Record<string, string[]> = { ...DEFAULT_ROLES };
   const conductor = { ...DEFAULT_CONFIG.conductor };
+  let planner: string | undefined;
   for (const name of CONFIG_FILES) {
     let file: Record<string, unknown>;
-    try { file = JSON.parse(readFileSync(join(cwd, ".agenthub", name), "utf8")); }
+    if (layers && !layers.some(layer => layer.name === name)) continue;
+    try { file = layers ? structuredClone(layers.find(layer => layer.name === name)!.raw) : JSON.parse(readFileSync(join(cwd, ".agenthub", name), "utf8")); }
     catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") continue; throw error; }
     if (file.roles !== undefined) { conductorPeer(file.roles); Object.assign(roles, file.roles); }
+    if (file.planner !== undefined) {
+      if (!(PLANNER_PEERS as readonly unknown[]).includes(file.planner)) throw new Error(`planner must be one of ${PLANNER_PEERS.join(", ")}`);
+      planner = file.planner as string;
+    }
     if (file.conductor !== undefined) {
       if (!file.conductor || typeof file.conductor !== "object" || Array.isArray(file.conductor)) throw new Error("conductor must be an object");
       const block = file.conductor as Record<string, unknown>;
@@ -253,7 +273,7 @@ export function loadConductorPolicy(cwd: string): { roles: Record<string, string
     }
   }
   conductorPeer(roles);
-  return { roles, conductor };
+  return { roles, conductor, ...(planner ? { planner } : {}) };
 }
 
 /** `memory.short_ttl_days`: a whole number of days from 1 to 3650; anything else would make every short-term deadline invalid. */
@@ -267,13 +287,14 @@ function syncMinutes(v: unknown): number {
   return v;
 }
 
-export function loadConfig(cwd: string): HubConfig {
+export function loadConfig(cwd: string, layers?: readonly ConfigLayer[]): HubConfig {
   const ignored: string[] = [];
   const appliedPermissionSources: NonNullable<HubConfig["permission_default_sources"]> = {};
   const files = CONFIG_FILES.flatMap((name) => {
     let file: Record<string, any>; // parsed JSON, checked field by field below
+    if (layers && !layers.some(layer => layer.name === name)) return [];
     try {
-      file = JSON.parse(readFileSync(join(cwd, ".agenthub", name), "utf8"));
+      file = layers ? structuredClone(layers.find(layer => layer.name === name)!.raw) : JSON.parse(readFileSync(join(cwd, ".agenthub", name), "utf8"));
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
       throw error;
@@ -328,7 +349,7 @@ export function loadConfig(cwd: string): HubConfig {
     throw new Error("legacy MLX configuration requires explicit mlx.provider=legacy; migrate to provider=ollama to avoid Python serving");
   }
   const mlx = { ...(file.mlx?.provider === "legacy" ? { enabled: true, provider: "legacy" as const, maxInputTokens: 16_000, maxTokens: 2048 } : DEFAULT_CONFIG.mlx), ...file.mlx };
-  const conductorPolicy = loadConductorPolicy(cwd);
+  const conductorPolicy = loadConductorPolicy(cwd, layers);
   if (!mlx.enabled && file.pi?.backend === "mlx") throw new Error("Pi backend mlx conflicts with mlx.enabled=false");
   if (typeof mlx.runtimeDir === "string" && mlx.runtimeDir) mlx.runtimeDir = resolve(cwd, mlx.runtimeDir);
   if (typeof mlx.modelPath === "string" && mlx.modelPath) mlx.modelPath = resolve(cwd, mlx.modelPath);
@@ -345,6 +366,7 @@ export function loadConfig(cwd: string): HubConfig {
       ...(file.memory?.sync_interval_min !== undefined ? { sync_interval_min: syncMinutes(file.memory.sync_interval_min) } : {}) }, // the native store is on with any project config (#258)
     roster: peerRosterConfig(file.roster),
     roles: conductorPolicy.roles,
+    planner: conductorPolicy.planner,
     conductor: conductorPolicy.conductor,
     budget: { ...DEFAULT_CONFIG.budget, wait_max_min: 30, ...file.budget }, // on with any project config (issue #36)
     context: { ...DEFAULT_CONTEXT, ...file.context },
@@ -358,7 +380,7 @@ export function loadConfig(cwd: string): HubConfig {
     },
     tasks: { ...DEFAULT_CONFIG.tasks, ...file.tasks, ...(file.tasks?.wip_limits !== undefined ? { wip_limits: planningWipLimits(file.tasks.wip_limits) } : {}) },
     task_sweep: taskSweepConfig(file.task_sweep),
-    checks: { ...DEFAULT_CONFIG.checks, ...file.checks },
+    checks: { ...DEFAULT_CONFIG.checks, ...file.checks, runner: file.checks?.runner === "container" ? "container" : undefined },
     snapshots: { ...DEFAULT_CONFIG.snapshots, enabled: true, ...file.snapshots },
     research: { enabled: file.research?.enabled === true }, // opt-in: anything but true is off
     bench: { enabled: file.bench?.enabled === true }, // opt-in: a run resets this project's work tree
@@ -423,6 +445,12 @@ export interface DaemonOptions {
   researchGraceMs?: number;
   /** Tests observe timer-driven sync without opening a remote; production uses the package sync. */
   memorySync?: typeof syncMemory;
+  /** Host-only test/embedding transports. Never read from config or tool input. */
+  boundedTools?: {
+    specAvailable?: typeof specAvailable;
+    fetchSpec?: typeof fetchSpec;
+    runner?: (options: RunnerOptions) => Pick<ContainerRunner, "available" | "start" | "result" | "consumeOutput" | "cancel" | "sweep" | "stopAll" | "markStale"> & Partial<Pick<ContainerRunner, "unknownReceipts" | "maintenanceUnavailable">>;
+  };
 }
 
 interface Client {
@@ -544,7 +572,9 @@ export async function startDaemon(opts: DaemonOptions) {
   try {
   const loadedConfig = opts.config ?? loadConfig(opts.cwd);
   const lifecycleConfig = loadSdlc(opts.cwd);
-  const config = { ...loadedConfig, roster: peerRosterConfig(loadedConfig.roster), permission_modes: permissionDefaults(loadedConfig.permission_modes), roles: { ...loadedConfig.roles }, conductor: { ...DEFAULT_CONFIG.conductor, ...loadedConfig.conductor } };
+  // Preserve embedding-owned policy references, but never publish reloads into shared defaults.
+  const ownedConfig = Object.fromEntries(Object.entries(loadedConfig).map(([key, value]) => [key, !opts.config || value === (DEFAULT_CONFIG as unknown as Record<string, unknown>)[key] ? structuredClone(value) : value])) as unknown as HubConfig;
+  const config = { ...ownedConfig, roster: peerRosterConfig(loadedConfig.roster), permission_modes: permissionDefaults(loadedConfig.permission_modes), roles: { ...loadedConfig.roles }, conductor: { ...DEFAULT_CONFIG.conductor, ...loadedConfig.conductor } };
   let rosterChanging: string | undefined;
   let kimiSessionMode: StartMode | undefined;
   let kimiAdmissionId: string | undefined;
@@ -560,6 +590,39 @@ export async function startDaemon(opts: DaemonOptions) {
   const logFile = join(opts.stateDir, "hub.log");
   // The state dir can vanish under a running hub (issue #56): a log line must never take a handler down with it.
   const log = (line: string) => { try { appendFileSync(logFile, `${new Date().toISOString()} ${line}\n`); } catch { /* the state dir is gone; the watchdog is stopping the hub */ } };
+  let runningRouting = currentRouting(opts.cwd, log);
+  let acceptedSources = parseConfigSources(configSourceTexts(opts.cwd), runningRouting);
+  const startupSources = structuredClone(acceptedSources.trustLayers);
+  const embeddedConfig = structuredClone(config);
+  let desiredConfig = structuredClone(config);
+  const startupRouting = structuredClone(runningRouting);
+  let desiredRouting = structuredClone(runningRouting);
+  let configRevision = 0;
+  let reloadConfirmation: { token: string; fingerprint: string; revision: number; keys: string[] } | undefined;
+  let pendingRestart: { key: string; reason: string }[] = [];
+  let lastReloadFailure: string | undefined;
+  let reloadDebounce: ReturnType<typeof setTimeout> | undefined;
+  let configWatchPending = false;
+  const configWatchers: { path: string; listener: (current: import("node:fs").Stats, previous: import("node:fs").Stats) => void }[] = [];
+  const stopConfigWatch = () => { configWatchPending = false; clearTimeout(reloadDebounce); for (const item of configWatchers.splice(0)) unwatchFile(item.path, item.listener); };
+  const activeRouting = () => runningRouting;
+  // #455: the planner in force. `policyRoles` is what the config files say; settlePlanner derives config.roles from it in
+  // place (Tasks holds the same object): an explicit `planner` key is exclusive, and with none and no rostered planner
+  // the first rostered PLANNER_PEERS entry plans. Never written to disk: a person pins it with the `planner` setting.
+  let policyRoles = structuredClone(config.roles);
+  let plannerSource: "setting" | "roles" | "automatic" | "none" = "none";
+  let plannerLogged = "";
+  const settlePlanner = () => {
+    const { roles, source } = resolveSettledRoles(policyRoles, config.planner, onRoster);
+    for (const key of Object.keys(config.roles)) delete config.roles[key];
+    Object.assign(config.roles, roles);
+    plannerSource = source;
+    const line = `${plannerPeers().join(", ") || "nobody"} (${source})`;
+    if (line !== plannerLogged) { log(`planner: ${line}${source === "automatic" ? "; pin it with ahub settings set planner <peer>" : ""}`); plannerLogged = line; }
+  };
+  const plannerPeers = () => Object.keys(config.roles).filter(peer => config.roles[peer]!.includes("planner"));
+  if (config.planner !== undefined && !(PLANNER_PEERS as readonly string[]).includes(config.planner)) log(`planner: ${JSON.stringify(config.planner)} is not one of ${PLANNER_PEERS.join(", ")}; ignored`);
+  settlePlanner();
   const catalog = loadRoleCatalog(opts.cwd);
   for (const error of catalog.errors) log(`catalog role ${error.id}: ${error.reason}`);
   const resolvedProfile = resolveProfile(config.profile, config.profile_overrides);
@@ -579,16 +642,16 @@ export async function startDaemon(opts: DaemonOptions) {
     try { configured = configuredRoles(peer); } catch { note = "catalog selection is incompatible or unavailable"; }
     const prepared = preparedSessionRoles.get(peer);
     const active = bus.peers.get(peer)?.state !== "offline" && bus.peers.has(peer);
+    let desired = configured;
+    try { desired = selectedRoles(peer, config.roles, { ...resolvedProfile.catalog_roles, ...catalogAssignments(config.catalog_roles) }, catalog).map(role => role.id); }
+    catch { note = "catalog selection is incompatible or unavailable"; }
     const value = active ? prepared ?? null : configured;
-    return { value, values: compatibleRoles(peer), ...(active && JSON.stringify(prepared ?? null) !== JSON.stringify(configured) ? { pending: configured } : {}), ...(note ? { note } : active && !prepared ? { note: "Current session guidance is unconfirmed; configuration is not receipt of model consumption." } : {}) };
-  }
-  function validateRoleSetting(scratch: string, peer: string) {
-    const candidate = loadConfig(scratch);
-    selectedRoles(peer, config.roles, { ...resolvedProfile.catalog_roles, ...catalogAssignments(candidate.catalog_roles) }, catalog);
-    return candidate;
+    return { value, values: compatibleRoles(peer), ...(JSON.stringify(value) !== JSON.stringify(desired) ? { pending: desired } : {}), ...(note ? { note } : active && !prepared ? { note: "Current session guidance is unconfirmed; configuration is not receipt of model consumption." } : {}) };
   }
+  const prepareRoleSelection = (peer: string) => { roleAssignments[peer] = catalogAssignments(config.catalog_roles)[peer] ?? resolvedProfile.catalog_roles[peer] ?? []; };
   function sessionRoleContract(peer: string): string {
     try {
+      prepareRoleSelection(peer);
       const selected = selectedRoles(peer, config.roles, roleAssignments, catalog);
       preparedSessionRoles.set(peer, selected.map(role => role.id));
       preparedSessionRoleIdentities.set(peer, selected.map(roleIdentity));
@@ -694,8 +757,11 @@ export async function startDaemon(opts: DaemonOptions) {
 
   // A session record left by a run that never shut down means it crashed (issue #37). A controlled restart has its own.
   const crashed = !recoveryOperation && !restartFilePresent ? readSessions(opts.stateDir) : undefined;
+  let piContinuity = readRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd });
+  // A disposed operation's exact session takes precedence over a stale crash record for this whole startup.
+  const archivedPiContinuity = piContinuity.state !== "absent";
   if (config.mlx.enabled === false) {
-    const launches = [...(restored?.peers ?? []).filter(peer => peer.id === "pi").map(peer => peer.launch), ...(crashed?.peers ?? []).filter(peer => peer.peer === "pi").map(peer => peer.meta.launch)];
+    const launches = [...(restored?.peers ?? []).filter(peer => peer.id === "pi").map(peer => peer.launch), ...(crashed?.peers ?? []).filter(peer => peer.peer === "pi" && !archivedPiContinuity).map(peer => peer.meta.launch)];
     for (const launch of launches) {
       const problem = mlxLaunchProblem(config, (launch ?? {}) as { backend?: unknown; model?: unknown });
       if (problem) throw new Error(`recorded Pi recovery: ${problem}`);
@@ -704,7 +770,7 @@ export async function startDaemon(opts: DaemonOptions) {
   // A controlled restart's source may have been cut short before it removed its record: this run is not a crash, and
   // a record left now would make the next ordinary start look like one.
   if (recoveryOperation || restartFilePresent) try { removeSessions(opts.stateDir); } catch { /* nothing to remove */ }
-  const autoResume = config.recovery.auto_resume_after_crash === true; // a string "false" is not a yes
+  const autoResume = () => config.recovery.auto_resume_after_crash === true; // a string "false" is not a yes
   const piAutoStart = () => onRoster("pi") && config.pi.auto_start;
   const startedAt = Date.now();
   /** What crash recovery did or asks the user to do, for `ahub status`. */
@@ -718,12 +784,12 @@ export async function startDaemon(opts: DaemonOptions) {
   if (crashed) for (const d of journal.list()) if (d.state === "needs_review" && d.reason === "daemon stopped during delivery" && d.updatedAt >= startedAt) lost.set(d.peer, [...(lost.get(d.peer) ?? []), d]);
   // Capabilities (issue #39): enforced here and in taskOp, never by role text alone. Unlisted peers keep everything.
   // A listed peer whose value is not a list gets nothing: whoever listed it meant to narrow it.
-  const may = (peer: PeerId, cap: "propose" | "assign" | "remember" | "memory_correct" | "memory_read" | "important"): boolean => {
+  const may = (peer: PeerId, cap: "propose" | "assign" | "remember" | "memory_correct" | "memory_read" | "important" | "spec_read" | "check_run"): boolean => {
     if (peer === USER || peer === HUB || !Object.hasOwn(config.capabilities, peer)) return true;
     const list = config.capabilities[peer];
     return Array.isArray(list) && list.includes(cap);
   };
-  const CAPABILITIES = ["propose", "assign", "remember", "memory_correct", "memory_read", "important"];
+  const CAPABILITIES = ["propose", "assign", "remember", "memory_correct", "memory_read", "important", "spec_read", "check_run"];
   for (const [peer, list] of Object.entries(config.capabilities)) {
     if (!PEER_ID.test(peer)) log(`capabilities.${peer} is not a peer id; ignored (capabilities is an object of lists, one per peer)`);
     else if (!Array.isArray(list)) log(`capabilities.${peer} is not a list: ${peer} gets no capabilities`);
@@ -738,7 +804,8 @@ export async function startDaemon(opts: DaemonOptions) {
   // silence without facts would leave overlapping owners blind. Facts and silence ask the same question, so both switch
   // together. Cached until the board changes: it is asked per recipient of every message.
   let turnFreeNow: boolean | undefined;
-  const turnFree = (): boolean => (turnFreeNow ??= coordination === "turn-free" && !board.list().some((t) => t.state !== "approved" && tasks.isPii(t)));
+  const turns = new Map<PeerId, { capture?: boolean; id: string; start: number; tokens: number; tree?: string; snapshotMs?: number; private?: boolean; deliveryTask?: number; attribution: TaskAttribution; preparedRoles: RoleIdentity[] | null }>();
+  const turnFree = (): boolean => (config.coordination === "turn-free" || tasks.cohorts.list().some(cohort => cohort.silent)) && ![...turns.values()].some(turn => turn.private) && (turnFreeNow ??= !board.list().some((t) => !isClosedTaskState(t.state) && tasks.isPii(t)));
   /**
    * Why `to` does not get an agent's message (issue #107): sender and recipient are in one silent cohort, and the sender
    * has not stopped since its cohort task closed. Workflow events and anything to the console are never held back.
@@ -783,10 +850,10 @@ export async function startDaemon(opts: DaemonOptions) {
   const hubStartedAt = Date.now();
   // The bus exists before `Tasks`, which knows whether a queued notice still matters (issue #106).
   let relevantNotice: (peer: PeerId, env: Envelope) => boolean = () => true;
-  const staleOff = config.experiments?.stale_notices === "deliver";
-  if (staleOff) log("experiment: stale notices are delivered as before 0.12.4 (the issue #106 ablation)");
+  const staleOff = () => config.experiments?.stale_notices === "deliver";
+  if (staleOff()) log("experiment: stale notices are delivered as before 0.12.4 (the issue #106 ablation)");
   const requestedPeerStops = new Set<string>();
-  const bus = new Bus({ rostered: membershipAllowed, deliveryHeld: peer => requestedPeerStops.has(peer) || rosterChanging === peer, journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs), admit, relevant: (peer, env) => env.refs?.supervision || env.refs?.backlog ? relevantNotice(peer, env) : staleOff || relevantNotice(peer, env), silence,
+  const bus = new Bus({ rostered: membershipAllowed, deliveryHeld: peer => requestedPeerStops.has(peer) || rosterChanging === peer, journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs), admit, relevant: (peer, env) => env.refs?.boundedCheck || env.refs?.supervision || env.refs?.backlog ? relevantNotice(peer, env) : staleOff() || relevantNotice(peer, env), silence,
     onImportantQueued: (peer, counts) => { const p = bus.peers.get(peer); if (p instanceof WsPeer) p.notifyQueued(counts); } });
   startupCleanup.push(() => bus.closeJournal());
   const manualPaused = new Set<PeerId>(bus.manualPausedPeers()); // recovery never lifts an operator's pause
@@ -842,7 +909,7 @@ export async function startDaemon(opts: DaemonOptions) {
     memoryNotice(`hub native memory disabled: ${reason}`);
   };
   if (config.memory.native) {
-    try { const opened = openProfileMemory({ ttlMs: (config.memory.short_ttl_days ?? 14) * 24 * 3600_000, log, screen: promotionScreen(memoryProject, opts.cwd, () => currentRouting(opts.cwd, log), () => config.pii?.paths ?? [], (key) => {
+    try { const opened = openProfileMemory({ ttlMs: (config.memory.short_ttl_days ?? 14) * 24 * 3600_000, log, screen: promotionScreen(memoryProject, opts.cwd, () => activeRouting(), () => config.pii?.paths ?? [], (key) => {
       const m = /#(\d+)@(\d+)$/.exec(key), t = m ? board.get(Number(m[1])) : undefined;
       return t && String(t.created) === m![2] ? [...(t.refs.paths ?? []), ...(t.plan?.paths ?? [])] : [];
     }) }, memoryUnavailable); memoryStore = opened.store; memoryBinding = opened.binding; startupCleanup.push(() => opened.store.close()); }
@@ -867,7 +934,7 @@ export async function startDaemon(opts: DaemonOptions) {
    * Notes as they leave for a model (a recall preface, a brief, `ask` evidence) are screened again under the current
    * policy: a shared note was accepted under another project's patterns, and patterns change. A match is withheld.
    */
-  const screenMemory = <T extends { title: string | null; text: string }>(vs: T[]): T[] => withoutPii(vs, currentRouting(opts.cwd, log), opts.cwd, config.pii?.paths ?? []);
+  const screenMemory = <T extends { title: string | null; text: string }>(vs: T[]): T[] => withoutPii(vs, activeRouting(), opts.cwd, config.pii?.paths ?? []);
   let candidates: CandidateStore | undefined;
   if (memoryStore) {
     try { candidates = openProfileCandidates(memoryBinding!); const opened = candidates; startupCleanup.push(() => opened.close()); }
@@ -978,7 +1045,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const onCampus = async (): Promise<boolean> => (await omni.onCampus()) && !(sidecar?.upstream && omni.isAccessHost(sidecar.upstream));
   let sidecar: Sidecar | undefined; // L2, started by the first hub-owned model call, stopped with the hub
   let sidecarRouting = "";
-  inference = new Inference(config.inference, { omni, sidecar: () => sidecar, route: "sy/fast", fixedModel: () => currentRouting(opts.cwd, log).local.fixed_model, log });
+  inference = new Inference(config.inference, { omni, sidecar: () => sidecar, route: "sy/fast", fixedModel: () => activeRouting().local.fixed_model, log });
 
   let dashboard: ReturnType<typeof startDashboard> | undefined;
   const uiEvents: { seq: number; event: BusEvent }[] = [];
@@ -1000,7 +1067,7 @@ export async function startDaemon(opts: DaemonOptions) {
     conductor: () => conductorPeer(config.roles) ?? undefined,
     scope: () => config.conductor?.feed ?? "own",
     tasks: () => board.list(), publicTitle: (task) => tasks.publicTitle(task), isPrivate: (task) => tasks.isPii(task),
-    approvalAgeMs: (config.conductor?.approval_wait_s ?? 30) * 1000,
+    approvalAgeMs: () => (config.conductor?.approval_wait_s ?? 30) * 1000,
     readRound: (peer) => conductorHolds.readRound(peer), writeRound: (peer, signature) => conductorHolds.writeRound(peer, signature),
     emit: (notice) => {
       if (stopping || recoveryActive()) return false;
@@ -1011,10 +1078,11 @@ export async function startDaemon(opts: DaemonOptions) {
   const refreshConductorPolicy = () => {
     if (opts.config) return; // explicit embedding/test configuration remains its authority
     const before = conductorPeer(config.roles);
-    const policy = loadConductorPolicy(opts.cwd);
-    for (const key of Object.keys(config.roles)) delete config.roles[key];
-    Object.assign(config.roles, policy.roles);
+    const policy = { roles: policyRoles, planner: config.planner, conductor: config.conductor };
+    policyRoles = structuredClone(policy.roles);
+    config.planner = policy.planner;
     config.conductor = policy.conductor;
+    settlePlanner();
     const after = conductorPeer(config.roles);
     if (before && (before !== after || config.conductor.feed === "off")) { bus.revokeSupervision(before); supervision.resetPending(before); budgetFeedSeen.clear(); }
     if (config.conductor.feed === "off" && after) bus.revokeSupervision(after);
@@ -1023,8 +1091,8 @@ export async function startDaemon(opts: DaemonOptions) {
   startupCleanup.push(() => executionBudget.close());
   // Completion checks (issue #7): only from a config file git does not track, one at a time, killed on stop.
   const allowedChecks = new Set([...CLASSES, ...Object.keys(resolvedProfile.classes)]);
-  const checkCommands = Object.fromEntries(Object.entries(config.checks).filter(([k, v]) => allowedChecks.has(k) && typeof v === "string" && v.trim())) as Record<string, string>;
-  const strayChecks = Object.keys(config.checks).filter((k) => k !== "timeout_s" && !(k in checkCommands));
+  const checkCommands = Object.fromEntries(Object.entries(config.checks).filter(([k, v]) => k !== "runner" && allowedChecks.has(k) && typeof v === "string" && v.trim())) as Record<string, string>;
+  const strayChecks = Object.keys(config.checks).filter((k) => k !== "timeout_s" && k !== "runner" && !(k in checkCommands));
   if (strayChecks.length) log(`checks ignored for ${strayChecks.join(", ")}: not a task class with a command (classes: ${CLASSES.join(", ")})`);
   // Commands and the other machine-local fields came only from a file git vouched for (loadConfig, issue #17).
   for (const line of config.ignored ?? []) log(`${line}; only a config file nobody committed may set it`);
@@ -1034,7 +1102,96 @@ export async function startDaemon(opts: DaemonOptions) {
   const runningChecks = new Set<() => void>();
   let checksClosed = false; // set on stop: a check still queued then must not start and outlive the hub
   const interrupted = { code: null, timedOut: false, interrupted: true, tail: "" };
+  // Bounded capabilities (#418): inactive sandboxed peers need no host account probe.
+  // A config-file daemon probes configured Pi/runner at startup; embeddings opt in or probe lazily on use.
+  let specState: Awaited<ReturnType<typeof specAvailable>> = { available: false, reason: "gh unavailable: not probed" };
+  let specProbe: Promise<void> | undefined, specProbeSettled = false;
+  const ensureSpec = (refresh = false): Promise<void> => {
+    if (specProbe && (!refresh || !specProbeSettled)) return specProbe;
+    specProbeSettled = false;
+    specProbe = Promise.resolve().then(() => (opts.boundedTools?.specAvailable ?? specAvailable)({ projectDir: opts.cwd }))
+      .then(value => { specState = value; }, () => { specState = { available: false, reason: "gh unavailable" }; })
+      .finally(() => { specProbeSettled = true; });
+    return specProbe;
+  };
+  const checkPending = new Set<string>();
+  const checkConnections = new WeakMap<object, string>();
+  const checkBindings = new Map<string, Pick<RunReceipt, "task" | "owner" | "generation" | "updated" | "revision">>();
+  const connectionGeneration = (id: string): string | undefined => {
+    const peer = bus.peers.get(id);
+    if (!peer || peer.state === "offline") return undefined;
+    let token = checkConnections.get(peer);
+    if (!token) { token = randomUUID(); checkConnections.set(peer, token); }
+    const native = peer instanceof WsPeer || peer instanceof CodexPeer || peer instanceof PiPeer ? peer.sessionGeneration : peer.recoveryMetadata?.().sessionId;
+    if (peer instanceof PiPeer && native === undefined) return undefined;
+    return `${instanceId}:${token}:${String(native ?? "")}`;
+  };
+  const currentCheck = (receipt: { task: number; owner: string; updated: number | string; generation: number | string; revision?: number }) => {
+    const task = board.get(receipt.task);
+    return !!task && task.owner === receipt.owner && task.state === "in_progress" && task.updated === receipt.updated && task.history.length === receipt.revision
+      && connectionGeneration(receipt.owner) === receipt.generation && may(receipt.owner, "check_run") && membershipAllowed(receipt.owner) && !tasks.isPii(task)
+      && !turns.get(receipt.owner)?.private && !contextPii(receipt.owner);
+  };
+  const boundedSafe = (text: string) => !looksSecret(text) && screenMemory([{ title: null, text }]).length === 1
+    && !mentionsPrivatePath(text, [], [...(config.pii?.paths ?? []), ...config.local.deny], opts.cwd);
+  const publicCheck = (receipt: RunReceipt) => {
+    const safeTail = boundedSafe(receipt.tail), safeError = !receipt.error || boundedSafe(receipt.error);
+    return { run: receipt.run, task: receipt.task, status: receipt.status, sha: receipt.sha, tree: receipt.tree, lockfile: receipt.lockfile,
+      excluded: receipt.excluded, runner: receipt.runner, image: receipt.image, platform: receipt.platform,
+      check: receipt.check, ...(receipt.files ? { files: receipt.files } : {}), exit: receipt.exit, timed_out: receipt.timed_out,
+      cancelled: receipt.cancelled, interrupted: receipt.interrupted, duration_ms: receipt.duration_ms,
+      tail: safeTail ? receipt.tail : "", output_bytes: receipt.output_bytes, truncated: receipt.truncated,
+      output_withheld: receipt.output_withheld || !safeTail || !safeError, ...(safeError && receipt.error ? { error: receipt.error } : {}) };
+  };
+  const checkOptions: RunnerOptions = {
+    projectDir: opts.cwd, stateDir: opts.stateDir, storageDir: join(hubHome(), "checks"),
+    projectKey: createHash("sha256").update(realPath(opts.cwd)).digest("hex").slice(0, 24),
+    enabled: () => config.checks.runner === "container",
+    isDenied: path => isDenied(path, config.local.deny) || matchesPolicy(opts.cwd, path, config.pii?.paths ?? [], true),
+    isCurrent: currentCheck,
+    onResult: async receipt => {
+      if (!currentCheck(receipt)) { await checkRunner.markStale(receipt.run); return; }
+      // Only a screened, current-owner result is delivered; no tail enters capture or diagnostic logs.
+      const view = publicCheck(receipt);
+      checkBindings.set(receipt.run, { task: receipt.task, owner: receipt.owner, generation: receipt.generation, updated: receipt.updated, revision: receipt.revision });
+      while (checkBindings.size > 200) checkBindings.delete(checkBindings.keys().next().value!);
+      if (stopping || !currentCheck(receipt)) { await checkRunner.markStale(receipt.run); return; }
+      bus.publish(newEnvelope(HUB, sanitize(JSON.stringify(view)), { to: [receipt.owner], kind: "task", refs: { task: String(receipt.task), boundedCheck: receipt.run } }));
+      log(`check ${receipt.run}: exit ${receipt.exit ?? "unknown"}, bytes ${receipt.output_bytes}`);
+    },
+  };
+  const checkRunner = opts.boundedTools?.runner?.(checkOptions) ?? new ContainerRunner(checkOptions);
+  const runnerRefreshAbort = new AbortController();
+  startupCleanup.push(() => { runnerRefreshAbort.abort(); void checkRunner.stopAll(); });
+  let runnerState = await checkRunner.available(runnerRefreshAbort.signal);
+  const orphanChecks = (await checkRunner.sweep()).map(line => boundedSafe(line) ? sanitize(line) : "orphan check: details withheld by privacy policy");
+  if (opts.boundedTools?.specAvailable || !opts.config && (config.pi.enabled || config.checks.runner === "container")) await ensureSpec();
+  let runnerStateAt = runnerState.checkedAt ?? Date.now(), refreshingRunner: Promise<void> | undefined;
+  const refreshRunner = (): Promise<void> => {
+    if (stopping || runnerRefreshAbort.signal.aborted) return Promise.resolve();
+    if (Date.now() - runnerStateAt < 60_000) return Promise.resolve();
+    if (refreshingRunner) return refreshingRunner;
+    refreshingRunner = checkRunner.available(runnerRefreshAbort.signal).then(value => {
+      if (stopping || runnerRefreshAbort.signal.aborted) return;
+      runnerState = value; runnerStateAt = value.checkedAt ?? Date.now();
+    }, () => {
+      if (stopping || runnerRefreshAbort.signal.aborted) return;
+      runnerState = { available: false, reason: "container unavailable" }; runnerStateAt = Date.now();
+    }).finally(() => { refreshingRunner = undefined; });
+    return refreshingRunner;
+  };
+  const peerCapabilities = () => {
+    // Keep the last confirmed capability during a bounded, single-flight refresh; replace it only on a result.
+    if (Date.now() - runnerStateAt >= 60_000) void refreshRunner();
+    return Object.fromEntries([...new Set([...SUPPORTED_PEERS, ...bus.peers.keys()])].map(peer => {
+    if (peer !== "pi" && peer !== "local") return [peer, { tests: true, spec: true }];
+    return [peer, { tests: runnerState.available && may(peer, "check_run"), spec: specState.available && may(peer, "spec_read"),
+      testsReason: !may(peer, "check_run") ? `capabilities.${peer}` : `runner unavailable: ${runnerState.reason ?? "unknown"}`,
+      specReason: !may(peer, "spec_read") ? `capabilities.${peer}` : specState.reason ?? "gh unauthenticated" }];
+    }));
+  };
   const tasks: Tasks = new Tasks({
+    capabilities: peerCapabilities, repository: memoryRepo,
     recordPlanning: change => event({ type: "planning", ...change }),
     wipLimit: peer => Object.hasOwn(config.tasks.wip_limits ?? {}, peer) ? config.tasks.wip_limits![peer]! : 1,
     profile: profileName(config.profile),
@@ -1043,17 +1200,17 @@ export async function startDaemon(opts: DaemonOptions) {
     catalog,
     sessionRoles: peer => bus.peers.has(peer) && bus.stateOf(peer) !== "offline" ? preparedSessionRoles.get(peer) ?? [] : [],
     projectedReview: task => reviewProjection(task),
-    sdlc: { config: () => lifecycleConfig },
+    sdlc: { config: () => lifecycleConfig, gh: (args, timeout, _cwd, bound) => sdlcGh(args, timeout, opts.cwd, bound) },
     board,
     bus,
     executionBudget,
-    routing: () => currentRouting(opts.cwd, log), // routing.toml is edited while the hub runs: re-read on change, last good parse kept
+    routing: () => activeRouting(), // only the complete validated reload can publish routing changes
     cwd: opts.cwd,
     project: chain.at(-1)!,
     ...(config.memory.enabled ? { memory } : {}),
     candidates, candidateScreen: screenMemory, privateTurn: peer => !!turns.get(peer)?.private || contextPii(peer),
     memoryCheck: checkMemory,
-    ...(config.memory.enabled || memoryStore ? { briefs: new Briefs(config.memory.enabled ? memory : undefined, chain.at(-1)!, config.memory.brief_items,
+    ...(config.memory.enabled || memoryStore ? { briefs: new Briefs(config.memory.enabled ? memory : undefined, chain.at(-1)!, () => config.memory.brief_items,
       memoryStore ? (t) => { checkMemory(); return screenMemory(memoryStore!.related(memoryProject, taskNodes(t), Number.MAX_SAFE_INTEGER)).slice(0, config.memory.brief_items).map((v) => ({ id: `mem:${v.id}`, line: memoryLine(v), kind: v.kind, about: v.about })); } : undefined,
       (peer, task, counts) => event({ type: "memory_brief", peer, task, ...counts }),
       items => { const stale = staleness(); return items.map(item => `${item.line}${stale(item.about ?? []) ? " (stale?)" : ""}`); }) } : {}),
@@ -1088,14 +1245,19 @@ export async function startDaemon(opts: DaemonOptions) {
     },
     triage: { classify: (title, detail) => inference?.triage(title, detail) ?? Promise.resolve(undefined), onCampus: () => onCampus() },
     // The PII screen (issue #198): the model on this machine when MLX/Ollama is enabled, else the gateway on campus only.
-    piiScreen: (text) => screenPii(text, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => currentRouting(opts.cwd, log).local.fixed_model }),
+    piiScreen: (text) => screenPii(text, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model }),
     recordScreen: (record) => event({ type: "pii_screen", ...record }),
     quota: (): ReturnType<Budget["headroom"]> => budget.headroom(), // budget is built below; this runs at assignment time
     review: config.review,
     sweep: taskSweepConfig(config.task_sweep),
     sweepHeld: () => stopping || recoveryActive(),
+    cancellationHeld: () => stopping || recoveryActive(),
+    offerRead: (peer, envelopeId) => journal.offerRead(peer, envelopeId),
+    offerPullOnly: (id) => { const peer = bus.peers.get(id); return peer instanceof WsPeer && peer.pullOnly; },
+    stallNotice: stall => { supervision.taskStalled(stall); },
     roles: config.roles,
     turnFree,
+    coordination: () => config.coordination === "turn-free",
     capable: (peer) => capable.has(peer),
     idle: (peer) => idle(peer),
     treeHash: (paths, windows) => facts.tree(paths, windows),
@@ -1116,6 +1278,21 @@ export async function startDaemon(opts: DaemonOptions) {
     held: () => Object.fromEntries(bus.knownPeers().flatMap((peer) => { const hold = queueHold(peer); return hold ? [[peer, hold]] : []; })),
   });
   relevantNotice = (peer, env) => {
+    if (env.from === HUB && env.refs?.boundedCheck) {
+      const run = env.refs.boundedCheck, binding = checkBindings.get(run);
+      let outputSafe = false;
+      try {
+        const value = JSON.parse(env.body) as { tail?: unknown; error?: unknown };
+        outputSafe = typeof value.tail === "string" && boundedSafe(value.tail)
+          && (value.error === undefined || typeof value.error === "string" && boundedSafe(value.error));
+      } catch { /* An unknown projection never reaches a model. */ }
+      if (!binding || binding.owner !== peer || !currentCheck(binding) || !outputSafe) {
+        checkBindings.delete(run);
+        void checkRunner.markStale(run).catch(() => {});
+        return false;
+      }
+      return true;
+    }
     if (env.from !== HUB || !env.refs?.supervision) return tasks.relevant(peer, env);
     if (conductorPeer(config.roles) !== peer || config.conductor.feed === "off") return false;
     const key = env.refs.supervisionKey ?? "";
@@ -1139,7 +1316,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const facts: Facts = new Facts({ root: opts.cwd, repo: factsRepo, tmp: join(opts.stateDir, "facts"), instance: instanceId.slice(0, 8), scope: (peer) => repositoryFacts ? (scopes.has(peer) ? scopes.get(peer) : scopes.set(peer, tasks.factScope(peer)).get(peer)) : undefined, peers: () => [...bus.peers.keys()], nameable: tasks.nameable, deny: config.local.deny, privatePath: path => matchesPolicy(opts.cwd, path, config.pii?.paths ?? []), projection: file => projections.project(file) });
   const progress = new ProgressObserver({
     tasks: () => board.list(),
-    isPrivate: () => board.list().some(task => task.state !== "approved" && tasks.isPii(task)),
+    isPrivate: () => [...turns.values()].some(turn => turn.private) || board.list().some(task => !isClosedTaskState(task.state) && tasks.isPii(task)),
     inference: { escalate: (conversation, turn) => inference?.escalate(conversation, turn) ?? Promise.resolve(undefined) },
     emit: conductorProgressSink(event, supervision),
     notify,
@@ -1322,7 +1499,7 @@ export async function startDaemon(opts: DaemonOptions) {
     return undefined;
   };
   const activityRings = { kimi: new ActivityRing(), qwen: new ActivityRing() };
-  const contextPii = (peer: PeerId) => board.list().some(t => t.state !== "approved" && (t.owner === peer || t.reviewer === peer) && tasks.isPii(t));
+  const contextPii = (peer: PeerId) => !!turns.get(peer)?.private || board.list().some(t => !isClosedTaskState(t.state) && (t.owner === peer || t.reviewer === peer) && tasks.isPii(t));
   const requestCheckpoint = (peer: PeerId, reason: "quota" | "context"): Promise<string | undefined> => {
     // One outstanding request per peer. A quota transition may proceed without a summary rather than steal a context waiter.
     if (checkpointWaits.has(peer) || recoveryActive() || stopping) return Promise.resolve(undefined);
@@ -1416,7 +1593,6 @@ export async function startDaemon(opts: DaemonOptions) {
   // Turns and their tokens for telemetry (issue #40). Turn ids carry the hub run, so they stay unique across restarts.
   const runId = Date.now().toString(36);
   let turnSeq = 0;
-  const turns = new Map<PeerId, { id: string; start: number; tokens: number; tree?: string; snapshotMs?: number; private?: boolean; deliveryTask?: number; attribution: TaskAttribution; preparedRoles: RoleIdentity[] | null }>();
   const pendingDeliveryTask = new Map<PeerId, number>();
   const taskAttribution = (peer: PeerId, delivery = turns.get(peer)?.deliveryTask): TaskAttribution => {
     const result = attribute(delivery, board.list("in_progress").filter(t => t.owner === peer).map(t => t.id));
@@ -1444,11 +1620,11 @@ export async function startDaemon(opts: DaemonOptions) {
     event({ type: "supervision_turn", peer, turn: receipt.id, ...(receipt.tokens === undefined ? {} : { tokens: receipt.tokens }), ms: Math.max(0, Date.now() - receipt.at) });
   };
   // Per-turn snapshots (issue #33): a git tree at both turn boundaries, recorded in hub.db for `ahub turns` and `ahub undo`.
-  const repo = config.snapshots.enabled ? factsRepo : undefined;
-  const turnLog = repo ? new Turns(join(opts.stateDir, "hub.db")) : undefined;
-  if (turnLog) startupCleanup.push(() => turnLog.close());
+  const repo = factsRepo;
+  let turnLog = config.snapshots.enabled && repo ? new Turns(join(opts.stateDir, "hub.db")) : undefined;
+  startupCleanup.push(() => turnLog?.close());
   /** Whether a peer has a PII task open in any state: assigned and not yet accepted counts. */
-  const holdsPii = (peer: PeerId) => board.list().some((t) => t.owner === peer && t.state !== "approved" && t.state !== "in_review" && tasks.isPii(t));
+  const holdsPii = (peer: PeerId) => !!turns.get(peer)?.private || board.list().some((t) => t.owner === peer && !isClosedTaskState(t.state) && t.state !== "in_review" && tasks.isPii(t));
   const memoryObservations = memoryTelemetry ? new MemoryObservations(memoryTelemetry, (peer, envs) => {
     if (turns.get(peer)?.private || contextPii(peer) || envs.some(env => env.private)) return;
     for (const env of envs) {
@@ -1460,7 +1636,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (row && tasks.isPii(row)) return;
     return { ...(row ? { task: taskKey(memoryProject, row) } : {}), turn: turns.get(peer)?.id ?? null, session: contextSession(peer) ?? null };
   }) : undefined;
-  bus.onMemoryDelivery = (peer, id, out, field) => memoryObservations?.delivery(peer, id, out, field);
+  bus.onMemoryDelivery = (peer, id, out, field) => { if (!out.some(env => env.refs?.boundedCheck)) memoryObservations?.delivery(peer, id, out, field); };
   const citeMemory = (peer: PeerId, text: string, id: string, envs: readonly Envelope[] = []) => {
     if (!tasks.nameable(text) || looksSecret(text) || !screenMemory([{ title: null, text }]).length) return;
     memoryObservations?.cite(peer, text, id, envs);
@@ -1470,7 +1646,8 @@ export async function startDaemon(opts: DaemonOptions) {
    * runs inside the state change): three git calls at a turn's start and four at its end, each with the 10 s timeout
    * in snapshots.ts.
    */
-  const snap = (what: string): { tree?: string; ms: number } => {
+  const snap = (what: string, capture = config.snapshots.enabled): { tree?: string; ms: number } => {
+    if (!capture) return { ms: 0 };
     const t0 = performance.now();
     let tree: string | undefined;
     try {
@@ -1482,11 +1659,11 @@ export async function startDaemon(opts: DaemonOptions) {
     return { tree, ms: Math.round(performance.now() - t0) };
   };
   function privateSnapshotWindow(): boolean {
-    return [...turns.values()].some(turn => turn.private) || board.list().some(task => task.state !== "approved" && tasks.isPii(task));
+    return [...turns.values()].some(turn => turn.private) || board.list().some(task => !isClosedTaskState(task.state) && tasks.isPii(task));
   }
   function reviewProjection(task: Task): string | undefined {
     if (!projections.enabled || tasks.isPii(task)) return undefined;
-    if (!repo || !turnLog) return "(projected review unavailable: snapshots are disabled or unavailable)";
+    if (!config.snapshots.enabled || !repo || !turnLog) return "(projected review unavailable: snapshots are disabled or unavailable)";
     if (privateSnapshotWindow()) return "(projected review unavailable: private snapshot window)";
     const created = taskProposalAt(task);
     const from = created === undefined ? undefined : turnLog.taskStart(task.id, created);
@@ -1525,6 +1702,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const contextTailSeen = new Map<PeerId, string>();
   const intervals = [
     setInterval(() => {
+      void refreshRunner().catch(() => {});
       try { tasks.flushPlannerNotices(); } catch { /* the board remains authoritative if notice delivery fails */ }
       for (const pending of checkpointWaits.values()) if (!pending.valid()) pending.done(undefined);
       for (const [id, request] of permissions) if (request.expiresAt > Date.now()) supervision.approvalWaiting({ id, peer: request.peer, tool: request.tool ?? "unknown", createdAt: request.createdAt });
@@ -1587,10 +1765,21 @@ export async function startDaemon(opts: DaemonOptions) {
       }
     }, 5_000),
   ];
-  const taskSweep = taskSweepConfig(config.task_sweep);
-  if (taskSweep.enabled) intervals.push(setInterval(() => {
-    void tasks.sweep(opts.taskSweepNow?.() ?? Date.now()).catch(() => notify("task idle sweep failed; inspect hub task history before manual action"));
-  }, taskSweep.interval_s * 1000));
+  let sweepTimer: ReturnType<typeof setInterval> | undefined;
+  const rescheduleSweep = () => {
+    if (sweepTimer) clearInterval(sweepTimer);
+    sweepTimer = undefined;
+    const sweep = taskSweepConfig(config.task_sweep);
+    tasks.configureSweep(sweep);
+    if (sweep.enabled) {
+      sweepTimer = setInterval(() => {
+        void tasks.sweep(opts.taskSweepNow?.() ?? Date.now()).catch(() => notify("task idle sweep failed; inspect hub task history before manual action"));
+      }, sweep.interval_s * 1000);
+      sweepTimer.unref?.();
+    }
+  };
+  rescheduleSweep();
+  startupCleanup.push(() => clearInterval(sweepTimer));
   for (const i of intervals) i.unref?.();
   startupCleanup.push(() => { for (const i of intervals) clearInterval(i); });
 
@@ -1607,7 +1796,7 @@ export async function startDaemon(opts: DaemonOptions) {
   // names are answered by the hub; every call still passes daemon role/capability checks before its effects.
   const HUB_TOOLS = ["hub_send", ...TASK_TOOLS.map((t) => t.name), ...CONDUCTOR_TOOLS.map((t) => t.name)];
   const HUB_TOOL_TITLES = new Set(HUB_TOOLS.map((name) => `mcp__agent-hub__${name}`));
-  const toolEnv = (peer: PeerId) => ({ AGENTHUB_MODE: "tools", AGENTHUB_PEER_ID: peer, AGENTHUB_STATE_DIR: opts.stateDir, AGENTHUB_PROJECT_DIR: opts.cwd });
+  const toolEnv = (peer: PeerId, deliveryOnly = false) => ({ ...(deliveryOnly ? { AGENTHUB_DELIVERY_ONLY: "true" } : {}), AGENTHUB_MODE: "tools", AGENTHUB_PEER_ID: peer, AGENTHUB_STATE_DIR: opts.stateDir, AGENTHUB_PROJECT_DIR: opts.cwd });
 
   /** One entry point for the task tools, whoever calls them: MCP clients, the local worker, the console. */
   // A task op can write the board across awaits (triage, briefs, the dependents an approval releases): a recovery
@@ -1627,11 +1816,21 @@ export async function startDaemon(opts: DaemonOptions) {
         const id = Number.isSafeInteger(proposed) && proposed! > 0 ? proposed : admittedId;
         auditConduct({ kind: "conduct", actor: by, action: op.slice(4), ...(id === undefined ? {} : { task: id }) });
       }
-      return text;
+      const hint = args[3] ? ownHeldHint(by) : "";
+      return hint ? `${text}\n\n${hint}` : text;
+    } catch (error) {
+      // Keep proven pre-effect refusal identity/code for native receipts; only add body-free metadata.
+      const hint = args[3] ? ownHeldHint(by) : "";
+      if (hint && error instanceof Error) error.message += `\n\n${hint}`;
+      throw error;
     } finally {
       taskOpsInFlight--;
     }
   };
+  function ownHeldHint(peer: PeerId): string {
+    try { return renderHeldHint(bus.heldDeliveryHints(peer), Date.now(), !(bus.peers.get(peer) instanceof LocalPeer || bus.peers.get(peer) instanceof AcpPeer)); }
+    catch { return ""; } // unavailable telemetry is not a zero count or a reason to fail the tool itself
+  }
   /** A model-written peer argument: a peer id, or nothing for absent, null or "". Anything else is refused. */
   const peerArg = (v: unknown, name: string): PeerId | undefined => {
     if (v == null || v === "") return undefined;
@@ -1640,6 +1839,12 @@ export async function startDaemon(opts: DaemonOptions) {
     return id;
   };
   async function taskOpBody(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
+    if (BOUNDED_TASK_TOOLS.has(op)) {
+      const keys = op === "hub_task_spec" ? ["id"] : op === "hub_check_start" ? ["id", "check", "files"] : ["run"];
+      if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => !keys.includes(key))
+        || (keys.includes("id") ? !Number.isSafeInteger(a.id) || a.id < 1 : typeof a.run !== "string" || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(a.run))) throw new PreEffectToolRefusal("invalid bounded task request");
+      if (by !== USER && (piiTurn || turns.get(by)?.private || contextPii(by))) throw new PreEffectToolRefusal("bounded task tools unavailable during a PII turn");
+    }
     if (MEMORY_READ_TOOLS.has(op)) validateMemoryRead(op, a);
     if (op === "hub_memory_correct") correctionInput(a);
     if (CONDUCTOR_TOOL_NAMES.has(op)) {
@@ -1660,7 +1865,7 @@ export async function startDaemon(opts: DaemonOptions) {
     // console reads a PII task's text deliberately, with `ahub task show <id>`.
     const onPrem = inProcess && by === "local" && piiTurn;
     const line = (t: { id: number; state: string; owner: PeerId | null; reviewer: PeerId | null }) => { const task = board.get(t.id); return task && by === USER ? tasks.resultLine(task) : `task #${t.id}: ${t.state}, owner ${t.owner ?? "none"}, reviewer ${t.reviewer ?? "none"}`; };
-    const need = (cap: "propose" | "assign" | "remember" | "memory_read" | "memory_correct", what: string) => {
+    const need = (cap: "propose" | "assign" | "remember" | "memory_read" | "memory_correct" | "spec_read" | "check_run", what: string) => {
       if (may(by, cap)) return;
       log(`capabilities: ${by} may not ${what} (${op})`);
       throw new PreEffectToolRefusal(`${by} may not ${what} (no "${cap}" in capabilities.${by} in .agenthub/config.json)`);
@@ -1678,7 +1883,88 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     if (op === "hub_memory_correct") { need("memory_correct", "propose memory corrections"); return tasks.correct(by, a); }
     if (op === "hub_remember") need("remember", "save notes to shared memory");
+    if (op === "hub_task_spec") {
+      need("spec_read", "read assigned specifications");
+      const authorized = () => {
+        const task = board.get(a.id);
+        if (!task || task.state === "backlog" || task.owner !== by && task.reviewer !== by || tasks.isPii(task) || turns.get(by)?.private || contextPii(by)) throw new PreEffectToolRefusal("spec unavailable");
+        return task;
+      };
+      const task = authorized(), generation = connectionGeneration(by), updated = task.updated, revision = task.history.length;
+      const deadline = Date.now() + 25_000; // retain a response margin inside the control client's 30-second cap
+      const issues = specRefs(task, memoryRepo);
+      if (!issues.length) throw new PreEffectToolRefusal("no assigned spec references");
+      await ensureSpec();
+      authorized();
+      if (!specState.available) throw new PreEffectToolRefusal(specState.reason ?? "gh unauthenticated");
+      const specs = [];
+      for (const issue of issues) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) throw new PreEffectToolRefusal("timeout");
+        specs.push(await (opts.boundedTools?.fetchSpec ?? fetchSpec)(memoryRepo, issue, { screen: boundedSafe, projectDir: opts.cwd, timeoutMs: Math.min(15_000, remaining) }));
+        const current = authorized();
+        if (current.updated !== updated || current.history.length !== revision || connectionGeneration(by) !== generation || !may(by, "spec_read")) throw new PreEffectToolRefusal("spec unavailable");
+      }
+      const result = JSON.stringify({ specs });
+      if (Buffer.byteLength(result) > 80 * 1024) throw new PreEffectToolRefusal("too large");
+      if (!specs.every(spec => boundedSafe(`${spec.title}\n${spec.body}`))) throw new PreEffectToolRefusal("spec withheld by privacy policy");
+      return result;
+    }
+    if (op === "hub_check_start") {
+      need("check_run", "run isolated checks");
+      if (stopping || recoveryActive()) throw new PreEffectToolRefusal("runner unavailable: recovery or shutdown");
+      const authorized = () => {
+        const task = board.get(a.id);
+        if (!task || task.owner !== by || task.state !== "in_progress" || tasks.isPii(task) || turns.get(by)?.private || contextPii(by)) throw new PreEffectToolRefusal("check unavailable");
+        return task;
+      };
+      const task = authorized(), updated = task.updated, revision = task.history.length, generation = connectionGeneration(by);
+      if (!generation) throw new PreEffectToolRefusal("check requires an attached owner");
+      if (a.check !== "test" && a.check !== "typecheck"
+        || a.check === "test" && (!Array.isArray(a.files) || a.files.length < 1 || a.files.length > 32 || a.files.some((file: unknown) => typeof file !== "string" || !/^test\/[A-Za-z0-9._/-]+\.test\.ts$/.test(file) || file.split("/").some(part => !part || part === "." || part === "..")))
+        || a.check === "typecheck" && a.files !== undefined) throw new PreEffectToolRefusal("invalid check request");
+      await refreshRunner();
+      const current = authorized();
+      if (current.updated !== updated || current.history.length !== revision || connectionGeneration(by) !== generation || !may(by, "check_run") || stopping || recoveryActive()) throw new PreEffectToolRefusal("check unavailable");
+      if (!runnerState.available) throw new PreEffectToolRefusal(`runner unavailable: ${runnerState.reason ?? "unknown"}`);
+      const ref = current.refs.commit ?? current.refs.branch;
+      if (!ref) throw new PreEffectToolRefusal("check requires task branch or commit");
+      const handle = checkRunner.start({ task: current.id, owner: by, generation, updated, revision: current.history.length, ref, check: a.check, ...(a.files === undefined ? {} : { files: a.files }) });
+      checkPending.add(handle.run);
+      void handle.done.finally(() => checkPending.delete(handle.run)).catch(() => {});
+      return JSON.stringify({ run: handle.run });
+    }
+    if (op === "hub_check_result" || op === "hub_check_cancel") {
+      need("check_run", "read or cancel isolated checks");
+      let receipt = await checkRunner.result(a.run);
+      const task = receipt ? board.get(receipt.task) : undefined;
+      if (!receipt || by !== USER && (receipt.owner !== by || !task || tasks.isPii(task))) throw new PreEffectToolRefusal("check unavailable");
+      if (receipt.status === "stale" && by !== USER) throw new PreEffectToolRefusal("check unavailable: stale binding");
+      if (!currentCheck(receipt)) {
+        await checkRunner.markStale(receipt.run); receipt = { ...receipt, status: "stale" };
+        // markStale persists and can abort a run: a refusal after it is never proof of absent effects.
+        if (by !== USER) throw new Error("check unavailable: stale binding");
+      }
+      if (op === "hub_check_cancel") {
+        await checkRunner.cancel(receipt.run);
+        const actual = await checkRunner.result(receipt.run);
+        if (!actual) throw new Error("check receipt unavailable after cancellation");
+        return JSON.stringify({ run: actual.run, status: actual.status, cancelled: actual.cancelled });
+      }
+      if (by !== USER && !currentCheck(receipt)) throw new PreEffectToolRefusal("check unavailable: stale binding");
+      if (by === receipt.owner) await checkRunner.consumeOutput(receipt.run);
+      if (by !== USER && (!currentCheck(receipt) || turns.get(by)?.private || contextPii(by))) throw new Error("check unavailable: stale binding");
+      // Policy can change during output cleanup, so form the final projection again.
+      return JSON.stringify(publicCheck(receipt));
+    }
     switch (op) {
+      case "hub_delivery_retry": {
+        if (by === USER || by === HUB || !a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => key !== "delivery_id") || typeof a.delivery_id !== "string" || a.delivery_id.length < 1 || a.delivery_id.length > 256) throw new PreEffectToolRefusal("hub_delivery_retry accepts only your delivery_id; completed and discard require the person");
+        if (bus.peers.get(by) instanceof LocalPeer || bus.peers.get(by) instanceof AcpPeer) throw new PreEffectToolRefusal("delivery-only peers require the person to resolve held deliveries");
+        if (stopping || recoveryActive()) throw new PreEffectToolRefusal("recovery or shutdown is holding delivery mutations");
+        bus.retryDelivery(by, a.delivery_id);
+        return `retry queued for delivery ${a.delivery_id}; check for earlier effects before acting`;
+      }
       case "hub_backlog_list":
         return JSON.stringify(tasks.backlogList(by));
       case "hub_release_list":
@@ -1710,6 +1996,14 @@ export async function startDaemon(opts: DaemonOptions) {
         if (silent && factsOn()) facts.sawPlans(by, tasks.overlapTasks(t)); // the plans in this answer need no fact later
         return [line(t), overlap, tasks.planGuardText(t)].filter(Boolean).join("\n");
       }
+      case "hub_task_cancel": {
+        if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => !["id", "reason", "superseded_by", "revision"].includes(key))
+          || !Number.isSafeInteger(a.id) || a.id < 1 || typeof a.reason !== "string" || !a.reason.trim() || a.reason.length > 2000
+          || a.superseded_by !== undefined && (typeof a.superseded_by !== "string" || !a.superseded_by.trim() || a.superseded_by.length > 2000)
+          || a.revision !== undefined && (!Number.isSafeInteger(a.revision) || a.revision < 0)) throw new PreEffectToolRefusal("invalid cancellation request");
+        if (by !== USER && (piiTurn || turns.get(by)?.private || contextPii(by))) throw new PreEffectToolRefusal("cancellation unavailable during a PII turn");
+        return JSON.stringify(tasks.publicView(await tasks.cancel(a.id, by, { reason: a.reason, supersededBy: a.superseded_by, expectedFlowRevision: a.revision })));
+      }
       case "hub_task_decline":
         return line(await tasks.decline(by, a.id, a.reason));
       case "hub_task_done": {
@@ -1814,8 +2108,13 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       case "task_escalate":
         return line(await tasks.escalate(USER, a.id, undefined, undefined, true));
-      case "route_explain":
-        return tasks.explain(a.id !== undefined ? Number(a.id) : { title: String(a.title ?? ""), class: a.class as TaskClass }).join("\n");
+      case "route_explain": {
+        const trace = tasks.explain(a.id !== undefined ? Number(a.id) : { title: String(a.title ?? ""), class: a.class as TaskClass });
+        return [...trace, ...bus.knownPeers().flatMap(peer => {
+          if (trace.some(line => line.startsWith(`  hold: ${peer}'s queue is held:`))) return [];
+          const hold = queueHold(peer); return hold ? [`${peer} queue: ${hold}`] : [];
+        })].join("\n");
+      }
       case "turn_revert": {
         // `ahub undo --context` (issue #33): the conversation half of an undo; the CLI restores the files itself.
         const turn = turnLog?.get(String(a.turn));
@@ -1840,7 +2139,7 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   function recoveryTaskPreface(peer: PeerId): void {
     if (recoveryPhase !== "restored") return;
-    const open = board.list().filter((task) => (task.owner === peer || task.reviewer === peer) && !["approved"].includes(task.state));
+    const open = board.list().filter((task) => (task.owner === peer || task.reviewer === peer) && !isClosedTaskState(task.state));
     if (!open.length) return;
     const lines = open.map((task) => {
       const view = tasks.publicView(task) as { title?: unknown; detail?: unknown; state?: unknown; owner?: unknown; reviewer?: unknown };
@@ -1854,6 +2153,20 @@ export async function startDaemon(opts: DaemonOptions) {
   const permissionChanges = new Map<string, Promise<void>>();
   const permissionModes = new Map<string, PermissionMode>(Object.entries(config.permission_modes).map(([peer, mode]) => [peer, mode === "never-ask" ? "ask" : mode]));
   for (const peer of pendingPermissionDefaults.keys()) permissionModes.set(peer, "ask");
+  const changedPermissionDefaults = new Set<string>();
+  const applyPendingPermissionDefault = (peer: string): void => {
+    if (changedPermissionDefaults.has(peer) && (!bus.peers.has(peer) || bus.peers.get(peer)!.state === "offline")) {
+      changedPermissionDefaults.delete(peer);
+      const mode = config.permission_modes[peer] ?? "ask";
+      const source = config.permission_default_sources?.[peer]?.source ?? "configuration default";
+      permissionModes.set(peer, mode === "never-ask" ? "ask" : mode);
+      permissionModeSources.set(peer, source);
+      pendingPermissionDefaults.delete(peer);
+      if (mode === "never-ask") pendingPermissionDefaults.set(peer, source);
+      if (config.permission_default_sources?.[peer]) defaultSources[peer] = config.permission_default_sources[peer]!;
+      else delete defaultSources[peer];
+    }
+  };
   const permissionMode = (peer: string): PermissionMode => permissionModes.get(peer) ?? "ask";
   const permissionModeSources = new Map(Object.entries(defaultSources).map(([peer, value]) => [peer, value.source]));
   const unattendedPeers = new Set<string>();
@@ -1875,6 +2188,7 @@ export async function startDaemon(opts: DaemonOptions) {
   let releasing = false; // gone-owner release (#6) and the ready sweep (#34): one run at a time, and a recovery commit waits for it
   const recoveryReady = () => {
     if (!recoveryActive() || releasing || taskOpsInFlight !== 0 || tasks.checksPending() !== 0 || (piReceipts?.inFlight ?? 0) !== 0 || permissions.size !== 0 || starting.size !== 0 || requestedPeerStops.size !== 0 || rosterChanging !== undefined || !budget.recoverySettled || [...bus.peers.values()].some((peer) => peer.state === "busy" || (peer instanceof PiPeer && !peer.recoveryReady))) return false;
+    if (checkPending.size !== 0) return false;
     if (!recoveryPeerSnapshot) return true;
     const current = recoveryPeers();
     return recoveryPeerSnapshot.every((saved) => {
@@ -2029,7 +2343,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     return now;
   };
-  const queueHoldStatus = (peer: PeerId, heldBy?: string) => heldBy ? { heldBy, holdNote: queueHold(peer) } : {};
+  const queueHoldStatus = (peer: PeerId, heldBy?: string) => heldBy ? { heldBy, holdNote: queueHold(peer), heldRows: heldRows(peer) } : {};
   const logPermissionStart = (peer: string) => {
     const requested = defaultSources[peer];
     const selected = permissionMode(peer), pending = pendingPermissionDefaults.has(peer);
@@ -2062,15 +2376,19 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const status = (includeAttentionItems = false, includeAttentionInput = false) => {
     const taskNeeds = board.statusTasks();
+    const taskStalls = tasks.stalled();
+    const pendingTaskOffers = tasks.pendingOffers().filter(offer => offer.pullOnly === true);
     const peerIds = statusPeerIds(taskNeeds);
     const view = {
     ...(crashReport.length ? { crash: crashReport } : {}),
     projectId,
     instanceId,
     version: VERSION,
+    pendingRestart,
     memoryProfile: memoryProfileStatus(includeAttentionItems),
     lifecycleStages: [...lifecycleConfig.stages],
     protocol: PROTOCOL,
+    features: DAEMON_FEATURES,
     stopping,
     pid: process.pid,
     cwd: opts.cwd,
@@ -2082,11 +2400,15 @@ export async function startDaemon(opts: DaemonOptions) {
     ),
     taskWip: Object.fromEntries(peerIds.map(id => [id, { wip: tasks.wip(id), wipLimit: tasks.wipLimit(id) }])),
     boardReadCapabilities: { releaseFilter: true, columnMetadata: true },
-    roleInfo: Object.fromEntries(peerIds.map(id => [id, { flowRoles: config.roles[id] ?? [], catalogRoles: roleState(id) }])),
+    roleInfo: Object.fromEntries(peerIds.map(id => [id, { flowRoles: config.roles[id] ?? [], catalogRoles: roleState(id), ...(config.roles[id]?.includes("planner") ? { planner: plannerSource } : {}) }])),
+    planner: { peers: plannerPeers(), source: plannerSource },
     ...(pendingPermissionDefaults.size ? { permissionDefaults: [...pendingPermissionDefaults].map(([peer, source]) => ({ peer, mode: "never-ask", source })) } : {}),
     ...(sidecar ? { switchyard: sidecar.status } : {}),
     ...(modelRelay ? { models: modelRelay.status() } : {}),
+    isolatedChecks: { pending: checkPending.size, orphans: orphanChecks, unknownReceipts: checkRunner.unknownReceipts ?? [], maintenanceUnavailable: checkRunner.maintenanceUnavailable === true },
+    taskCapabilities: peerCapabilities(),
     tasks: board.counts(),
+    taskStalls, pendingTaskOffers,
     ...(bus.storageError ? { deliveryError: bus.storageError } : {}),
     ...(recoveryOperationId ? { recovery: { operationId: recoveryOperationId, phase: recoveryPhase, ready: recoveryReady() } } : {}),
     };
@@ -2103,6 +2425,7 @@ export async function startDaemon(opts: DaemonOptions) {
       storageBlocked: !!bus.storageError,
       recovery: recoveryOperationId ? { id: recoveryOperationId, running: true } : undefined,
       tasks: taskNeeds,
+      facts: [...taskStalls.map(stall => ({ kind: "stall" as const, id: stall.task })), ...pendingTaskOffers.map(offer => ({ kind: "offer" as const, id: offer.task, peer: offer.peer }))],
       budget: Object.fromEntries(Object.entries(budget.status()).map(([peer, row]) => [peer, row.paused ? { paused: { since: row.paused.since, resetsAt: row.paused.resetsAt } } : {}])),
     };
     const attention = needs(attentionInput, Date.now());
@@ -2122,37 +2445,58 @@ export async function startDaemon(opts: DaemonOptions) {
   const taskChanged = board.onChange;
   board.onChange = (task, entry) => {
     try { taskChanged?.(task, entry); }
-    finally { writeStatus(); } // committed task transitions refresh token-free attention even without bus activity
+    finally {
+      try { settleSupersededDeliveries(); }
+      finally { writeStatus(); } // committed task transitions refresh token-free attention even without bus activity
+    }
   };
 
   // A queue change is not a bus event: without this, status.json reports the queue as it was before the last
   // message and keeps a phantom `queued N` after the queue drains (measured on a live 0.6.3 hub).
-  function movedDeliveryTasks(row: JournalDelivery): string[] {
-    return [...new Set(row.originals.flatMap((env) => {
-      const task = env.refs?.task ? board.get(Number(env.refs.task)) : undefined;
-      if (!task || (task.owner === row.peer && task.state !== "approved")) return [];
-      return [`task ${tasks.publicTitle(task)} ${task.state === "approved" ? "has been approved" : `has moved to ${task.owner ?? "nobody"}`}`];
-    }))];
+  function heldRows(peer: PeerId) {
+    return bus.queueList(peer).filter(row => row.state === "needs_review").map(row => ({
+      id: row.id, senders: [...new Set(row.originals.map(env => sanitize(env.from)))],
+      kinds: [...new Set(row.originals.map(env => env.kind))], createdAt: row.createdAt,
+      context: deliveryTaskContext(row.originals, board, peer),
+    }));
   }
   function queueHold(peer: PeerId): string | undefined {
-    const id = bus.queueSummary(peer).heldBy;
-    const row = id ? bus.queueShow(id) : undefined;
-    if (!row) return undefined;
-    const moved = movedDeliveryTasks(row);
-    return `held by needs_review ${id}${moved.length ? ` (${moved.join("; ")})` : ""}; ahub queue resolve ${id} --action completed|retry|discard --reason <text>`;
+    const rows = heldRows(peer);
+    if (!rows.length) return undefined;
+    return rows.map(row => `held by needs_review ${row.id} (from ${row.senders.join(",")}; kind ${row.kinds.join(",")}; age ${Math.max(0, Math.floor((Date.now() - row.createdAt) / 1000))}s${row.context ? `; ${row.context}` : ""}); ahub queue resolve ${row.id} --action completed|retry|discard --reason <text>`).join("; ");
+  }
+  let settlingSuperseded = false;
+  function settleSupersededDeliveries() {
+    if (settlingSuperseded || stopping || recoveryActive() || bus.isRecoveryHeld) return;
+    settlingSuperseded = true;
+    try {
+      for (const row of bus.queueList()) {
+        if (row.state !== "needs_review" || row.reason?.startsWith("requested stop:")) continue;
+        const reason = supersededDeliveryReason(row.originals, board, row.peer);
+        if (!reason) continue;
+        try { bus.resolveDelivery(row.id, row.revision, "completed", reason, "hub"); }
+        catch { /* Busy peers, storage failures and changed revisions remain held for the next queue/board change. */ }
+      }
+    } finally { settlingSuperseded = false; }
   }
   const noticedHolds = new Set<string>();
+  let reportingQueues = false;
   bus.onQueues = () => {
-    if (stopping) return;
-    for (const row of bus.queueList()) {
-      if (row.state !== "needs_review" || noticedHolds.has(row.id)) continue;
-      noticedHolds.add(row.id);
-      supervision.needsReview(row.peer, row.id);
-      const moved = movedDeliveryTasks(row);
-      notify(`${row.peer} queue held by needs_review ${row.id}${moved.length ? ` (${[...new Set(moved)].join("; ")})` : ""}; inspect: ahub queue show ${row.id}; resolve: ahub queue resolve ${row.id} --action completed|retry|discard --reason <text>`);
-    }
-    writeStatus();
+    if (stopping || settlingSuperseded || reportingQueues) return;
+    reportingQueues = true;
+    try {
+      settleSupersededDeliveries();
+      for (const peer of bus.knownPeers()) {
+        const rows = heldRows(peer);
+        if (!rows.some(row => !noticedHolds.has(row.id))) continue;
+        for (const row of rows) { noticedHolds.add(row.id); supervision.needsReview(peer, row.id); }
+        notify(`${peer} queue ${queueHold(peer)}`);
+      }
+      writeStatus();
+    } finally { reportingQueues = false; }
   };
+  // Opening the journal/restoring the snapshot preceded callbacks; classify those holds too.
+  settleSupersededDeliveries();
 
   // When each peer went offline; a peer never seen attached counts from hub start (issue #6).
   const offlineSince = new Map<PeerId, number>();
@@ -2266,17 +2610,57 @@ export async function startDaemon(opts: DaemonOptions) {
 
   // Session identities of the attached peers, kept current for crash recovery (issue #37); a clean stop removes them.
   let sessionsWritten = "";
+  // One bounded failure generation: unchanged events neither contend for the writer lock nor repeat its notice.
+  let piSettlementFailure: { key: string; error: string; retryAfter: number } | undefined;
+  function settlePiContinuity(): void {
+    if (stopping || recoveryActive() || piContinuity.state !== "ready") return;
+    const peer = bus.peers.get("pi");
+    if (!(peer instanceof PiPeer) || peer.state === "offline" || !peer.sessionGeneration || !peer.recoveryReady) return;
+    const saved = piContinuity.bookmark, actual = peer.recoveryMetadata();
+    if (typeof actual.sessionId !== "string" || !actual.sessionId) return;
+    const key = JSON.stringify([piContinuity.digest, peer.sessionGeneration, actual]);
+    if (piSettlementFailure?.key === key && Date.now() < piSettlementFailure.retryAfter) return;
+    const matches = actual.sessionId === saved.pi.sessionId && (saved.pi.sessionFile === undefined || actual.sessionFile === saved.pi.sessionFile);
+    try {
+      const expected = { projectId, projectRoot: opts.cwd, operationId: saved.operationId, digest: piContinuity.digest };
+      const settled = matches ? consumeRecoveryContinuity(opts.stateDir, expected) : retireRecoveryContinuity(opts.stateDir, expected, "authenticated_session_changed").retired;
+      piSettlementFailure = undefined;
+      if (settled) {
+        piContinuity = { state: "absent" };
+        if (!matches) log("Pi archived continuity retired after recording a different authenticated session");
+      }
+      else {
+        // Re-read after the failed exact CAS; never settle a newer bookmark in this call.
+        piContinuity = readRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd });
+        if (piContinuity.state !== "absent") log("Pi continuity bookmark changed before attachment settlement; retained for inspection");
+      }
+    } catch (error) {
+      const signature = error instanceof Error ? `${error.name}:${error.message}` : String(error);
+      const report = piSettlementFailure?.key !== key || piSettlementFailure.error !== signature;
+      piSettlementFailure = { key, error: signature, retryAfter: Date.now() + 30_000 };
+      piContinuity = readRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd });
+      if (report) log("Pi continuity attachment settlement unavailable; bookmark retained");
+    }
+  }
   const recordSessions = () => {
     if (stopping) return;
+    const pi = bus.peers.get("pi");
+    if (piContinuity.state === "ready" && (!(pi instanceof PiPeer) || pi.state === "offline" || !pi.sessionGeneration || !pi.recoveryReady)) {
+      piContinuity = readRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd });
+    }
     const peers = [...bus.peers.values()].filter((p) => p.state !== "offline").map((p) => {
       let meta: Record<string, unknown> = {};
       try { meta = (p as { recoveryMetadata?: () => Record<string, unknown> }).recoveryMetadata?.() ?? {}; } catch { /* not ready yet: the id alone */ }
       return { peer: p.id, meta };
     });
     const text = JSON.stringify(peers);
-    if (text === sessionsWritten) return;
-    sessionsWritten = text;
-    try { writeSessions(opts.stateDir, { instanceId, at: Date.now(), peers }); } catch (error) { log(`session record not written: ${(error as Error).message}`); }
+    try {
+      if (text !== sessionsWritten) {
+        writeSessions(opts.stateDir, { instanceId, at: Date.now(), peers });
+        sessionsWritten = text;
+      }
+      settlePiContinuity(); // the identical snapshot may already be durable; never retire after a failed write
+    } catch (error) { log(`session record not written: ${(error as Error).message}`); }
   };
   const recoverAfterCrash = async (prev: SessionsFile) => {
     const report = (line: string) => (crashReport.push(line), notify(`crash recovery: ${line}`));
@@ -2284,6 +2668,7 @@ export async function startDaemon(opts: DaemonOptions) {
     report(`the previous hub run stopped without shutting down${lostCount ? `; ${lostCount} deliveries it had in flight are in needs_review (ahub queue list)` : ""}`);
     const start = (peer: string, args: Parameters<typeof startPeer>[1]) => startPeer(peer, args).catch((e: Error) => ({ ok: false, error: e.message }));
     for (const step of crashPlan(prev.peers)) {
+      if (step.peer === "pi" && archivedPiContinuity) { report("pi: archived continuity evidence holds crash-session resume and fresh fallback; pi.auto_start uses only the recorded archived session"); continue; }
       // `pi.auto_start` already asks for Pi (#66): its recorded headless session comes back, auto-resume or not, and a
       // fresh one starts when that fails or there is nothing headless to resume. Pi runs on-prem: no cloud quota.
       if (step.peer === "pi" && piAutoStart()) {
@@ -2299,7 +2684,7 @@ export async function startDaemon(opts: DaemonOptions) {
         report(fresh.ok ? `pi.auto_start started a fresh session${back}` : `pi.auto_start could not start Pi either (${String(fresh.error)})`);
         continue;
       }
-      if (!step.resume || !autoResume) {
+      if (!step.resume || !autoResume()) {
         report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}`);
         continue;
       }
@@ -2324,7 +2709,7 @@ export async function startDaemon(opts: DaemonOptions) {
       // #248: the add-ons it works with, once per attach (names and versions only).
       // A result is written unless a later attachment began meanwhile: a peer that detached before its probe settled
       // still did its work under that attachment.
-      if (e.state === "offline") attachedNow.delete(e.peer);
+      if (e.state === "offline") { attachedNow.delete(e.peer); applyPendingPermissionDefault(e.peer); }
       else if (!attachedNow.has(e.peer)) {
         attachedNow.add(e.peer);
         const peer = e.peer, attachment = ++attachments;
@@ -2345,20 +2730,21 @@ export async function startDaemon(opts: DaemonOptions) {
         const pii = holdsPii(e.peer);
         for (const id of turnTasks.keys()) if (!turnLog?.get(id)) turnTasks.delete(id);
         turnTasks.set(id, board.list().filter((t) => t.owner === e.peer && ["proposed", "in_progress", "changes_requested", "in_review"].includes(t.state)).map((t) => t.id));
-        const start = turnLog && !pii ? snap(`the start of ${id}`) : undefined; // before the peer is handed anything: the tap runs inside setState
-        try { turnLog?.begin(id, e.peer, start?.tree); } catch (error) { log(`turn record ${id}: ${(error as Error).message}`); }
+        const capture = config.snapshots.enabled && !!turnLog;
+        const start = capture && !pii ? snap(`the start of ${id}`) : undefined; // before the peer is handed anything: the tap runs inside setState
+        try { if (capture) turnLog?.begin(id, e.peer, start?.tree); } catch (error) { log(`turn record ${id}: ${(error as Error).message}`); }
         const preparedRoles = preparedSessionRoleIdentities.get(e.peer)?.map(role => ({ ...role })) ?? null;
-        turns.set(e.peer, { id, start: Date.now(), tokens: 0, deliveryTask: delivery, attribution, preparedRoles, ...(start ? { tree: start.tree, snapshotMs: start.ms } : {}), ...(pii ? { private: true } : {}) });
+        turns.set(e.peer, { id, capture, start: Date.now(), tokens: 0, deliveryTask: delivery, attribution, preparedRoles, ...(start ? { tree: start.tree, snapshotMs: start.ms } : {}), ...(pii ? { private: true } : {}) });
         event({ type: "turn_start", peer: e.peer, turn: id });
       } else if (!busy && open) {
         turns.delete(e.peer);
         let afterTurn: (() => void) | undefined;
         let files: number | undefined;
         let snapshotMs = open.snapshotMs;
-        if (turnLog && (open.private || holdsPii(e.peer))) {
+        if (open.capture && turnLog && (open.private || holdsPii(e.peer))) {
           try { turnLog.end(open.id, undefined, [], Math.max(1, Number(config.snapshots.keep) || 20)); } catch (error) { log(`turn record ${open.id}: ${(error as Error).message}`); }
-        } else if (turnLog) {
-          const end = snap(`the end of ${open.id}`);
+        } else if (open.capture && turnLog) {
+          const end = snap(`the end of ${open.id}`, true);
           const changed = open.tree && end.tree ? changedPaths(repo!, open.tree, end.tree) : [];
           if (open.tree && end.tree) files = changed.length; // unknown, not zero, when a snapshot failed
           snapshotMs = (snapshotMs ?? 0) + end.ms;
@@ -2523,7 +2909,7 @@ export async function startDaemon(opts: DaemonOptions) {
   /** pi.auto_start at hub start (#269): in Pi's start mode, and said out loud when it could not be done. */
   const autoStartPi = () => void hubStart("pi", "pi.auto_start").then(
     (result) => { if (result.ok !== true) notify(`pi.auto_start did not start Pi: ${String(result.error)}`); },
-    (error) => log(`Pi auto-start failed: ${(error as Error).message}`));
+    (error) => log(`Pi auto-start failed: ${(error as Error).message}${piContinuity.state === "ready" ? `. ${continuityCleanup()}` : ""}`));
   async function stopPiForReplacement(pi: PiPeer): Promise<void> {
     replacingPi.add(pi);
     try { await pi.stop(); } finally { replacingPi.delete(pi); }
@@ -2544,6 +2930,7 @@ export async function startDaemon(opts: DaemonOptions) {
     const running = startPeerOnce(peer, args).then(async result => {
       if (!result.ok && peer === "codex") unattendedPeers.delete(peer);
       if (!result.ok || result.already) return result;
+      if (peer === "pi") recordSessions();
       return permissionChange(peer, async () => {
         if (peer === "codex") { if (args.unattended) unattendedPeers.add(peer); else unattendedPeers.delete(peer); }
         logPermissionStart(peer); writeStatus(); return result;
@@ -2572,6 +2959,8 @@ export async function startDaemon(opts: DaemonOptions) {
     const mode = startMode(peer), owner = bus.peers.get(peer), can = mode === "tui" ? opener.available() : undefined;
     return { peer, mode, attached: !!owner && owner.state !== "offline", command: peer === "kimi" ? "ahub kimi" : `ahub ${startWords(peer, mode).join(" ")}`, ...(can ? (can.ok ? { via: can.via } : { why: can.why }) : {}) };
   });
+  // Printed for a person's explicit reconciliation only; never executed by auto-start.
+  const continuityCleanup = () => `After inspection, archive the active bookmark with ${["mv", "-n", "--", join(opts.stateDir, "recovery-continuity.json"), join(opts.stateDir, `recovery-continuity.retired.manual.${randomUUID()}.json`)].map(shellQuote).join(" ")} before choosing another session`;
   async function hubStart(peer: unknown, by: string): Promise<Record<string, unknown>> {
     if (stopping) return { ok: false, error: "hub is stopping" };
     if (rosterChanging !== undefined && rosterChanging === peer) return { ok: false, error: `${String(peer)} roster change is in progress` };
@@ -2579,7 +2968,32 @@ export async function startDaemon(opts: DaemonOptions) {
     if (!membershipAllowed(peer)) return { ok: false, error: `${peer} is off roster; a person can add it with ahub roster add ${peer}` };
     if (!startable(peer)) return { ok: false, error: "unknown peer; the hub starts claude, codex, kimi, pi (when enabled) and local" };
     if (recoveryActive()) return { ok: false, error: "recovery is holding mutations" };
+    const continuity = peer === "pi" && by === "pi.auto_start"
+      ? piContinuity.state === "ready" ? (piContinuity = readRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd })) : piContinuity
+      : undefined;
+    if (continuity?.state === "invalid") return { ok: false, error: `archived Pi continuity evidence is invalid or unreadable; no fresh session was started. ${continuityCleanup()}` };
+    const resume = continuity?.state === "ready" ? continuity.bookmark.pi : undefined;
     const mode = startMode(peer);
+    if (resume?.sessionFile && continuity?.state === "ready") {
+      try { validatePiSession(opts.stateDir, opts.cwd, resume.sessionFile, resume.sessionId); }
+      catch (error) {
+        const retry = `ahub pi --mode ${mode} --session-file ${shellQuote(resume.sessionFile)}`;
+        if (error instanceof PiSessionUnresumable || error instanceof PiSessionBookmarkMismatch) {
+          try {
+            const retired = retireRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd, operationId: continuity.bookmark.operationId, digest: continuity.digest }, "resume_unavailable");
+            if (retired.retired) {
+              piContinuity = { state: "absent" };
+              const diagnosis = error instanceof PiSessionBookmarkMismatch ? "Pi continuity bookmark does not match the preserved session" : "recorded Pi session is unresumable";
+              return { ok: false, error: `${diagnosis}; continuity evidence was archived; no fresh session was started. Inspect the preserved session, then select a valid managed file with ahub pi --mode ${mode} --session-file <managed-file>` };
+            }
+          } catch { return { ok: false, error: `Pi continuity retirement could not be confirmed; bookmark retained; no fresh session was started. After inspecting storage, retry ${retry}. ${continuityCleanup()}` }; }
+          piContinuity = readRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd });
+          return { ok: false, error: `Pi continuity changed before retirement; inspect recovery-continuity.json; no fresh session was started. Retry the intended session with ${retry}. ${continuityCleanup()}` };
+        }
+        return { ok: false, error: `Pi continuity session storage could not be verified; bookmark retained; no fresh session was started. After inspecting storage, retry ${retry}. ${continuityCleanup()}` };
+      }
+    }
+    if (mode === "tui" && (peer === "pi" || peer === "local")) { await ensureSpec(true); await refreshRunner(); }
     const owner = bus.peers.get(peer);
     if (mode === "headless") {
       // A Pi a person runs in a terminal is theirs: a start made for them never takes it over as a headless one.
@@ -2587,23 +3001,26 @@ export async function startDaemon(opts: DaemonOptions) {
       // like one whose terminal was closed, so a headless start in that window replaces it; record when a launch was
       // issued to tell the two apart.
       if (owner instanceof PiPeer && owner.state !== "offline" && owner.mode === "tui") return { ok: false, error: "Pi runs in a terminal; end it there before starting a headless one", command: "ahub pi --headless" };
-      return startPeer(peer, peer === "pi" || peer === "kimi" ? { mode: "headless" } : {});
+      return startPeer(peer, peer === "pi" || peer === "kimi" ? { mode: "headless", ...(resume ?? {}) } : {});
     }
     if (owner && owner.state !== "offline") return { ok: true, already: true, mode };
-    const command = `ahub ${startWords(peer, mode).join(" ")}`;
+    const words = [...startWords(peer, mode)];
+    if (resume) words.push(...(resume.sessionFile ? ["--session-file", resume.sessionFile] : ["--session-id", resume.sessionId]), ...(resume.backend ? ["--backend", resume.backend] : []), ...(resume.model ? ["--model", resume.model] : []));
+    const command = `ahub ${resume ? words.map(shellQuote).join(" ") : words.join(" ")}`;
     const since = Date.now() - (opening.get(peer) ?? 0);
     if (since < PEER_START_RETRY_MS) return { ok: false, error: `a terminal for ${peer} was opened ${Math.round(since / 1000)}s ago; wait for its TUI, or run ${command} yourself`, command };
     // Reserved before the provider is awaited, so starts that arrive together open one terminal, not one each.
     opening.set(peer, Date.now());
+    if (resume && (stopping || recoveryActive() || !membershipAllowed(peer) || rosterChanging === peer || requestedPeerStops.has(peer))) { opening.delete(peer); return { ok: false, error: "Pi lifecycle changed before its continuity terminal opened; bookmark retained" }; }
     // Every word is the hub's own: its runtime, its entry point, this project and a peer from the closed list.
-    const opened = await opener.open(`${peer} (agent-hub)`, [process.execPath, CLI_ENTRY, "--project", opts.cwd, ...startWords(peer, mode)]).catch((error: Error) => ({ ok: false as const, why: "the terminal provider failed", detail: error.message }));
+    const opened = await opener.open(`${peer} (agent-hub)`, [process.execPath, CLI_ENTRY, "--project", opts.cwd, ...words]).catch((error: Error) => ({ ok: false as const, why: "the terminal provider failed", detail: error.message }));
     if (!opened.ok) {
       opening.delete(peer); // nothing was opened: the next request may try again at once
       if (opened.detail) log(`terminal provider for ${peer}: ${opened.detail}`);
       const headless = peer === "claude" ? "" : `, or set its start mode to headless (ahub settings set peers.${peer}.start_mode headless)`;
       return { ok: false, error: `${peer} starts in its TUI and the hub could not open a terminal for it (${opened.why}). Run ${command} in a terminal${headless}`, command };
     }
-    try { notify(`${peer}: ${by} opened a terminal running ${command} (${opened.via}); it attaches when its TUI is ready`); } catch { /* the terminal is open either way */ }
+    try { notify(resume ? `pi: pi.auto_start opened a terminal for its recorded archived session (${opened.via}); attachment is not yet verified` : `${peer}: ${by} opened a terminal running ${command} (${opened.via}); it attaches when its TUI is ready`); } catch { /* the terminal is open either way */ }
     return { ok: true, mode, opened: opened.via, command };
   }
 
@@ -2662,6 +3079,8 @@ export async function startDaemon(opts: DaemonOptions) {
   async function startPeerOnce(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }): Promise<Record<string, unknown>> {
     let unmute: (() => void) | undefined;
     try {
+      applyPendingPermissionDefault(peer);
+      if (peer === "pi" || peer === "local") { await ensureSpec(true); await refreshRunner(); }
       return await startPeerBody(peer, args, (p) => { unmute = muteState(p); });
     } finally {
       unmute?.();
@@ -2669,8 +3088,12 @@ export async function startDaemon(opts: DaemonOptions) {
   }
 
   async function startPeerBody(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }, mute: (p: PeerAdapter) => void): Promise<Record<string, unknown>> {
+    const adapter = definitionOf(peer);
     if (peer === "jcode" && args.mode !== undefined && args.mode !== "headless") return { ok: false, error: "Jcode native TUI driving is unverified; use headless" };
-    if (peer === "qwen" && args.mode !== undefined && args.mode !== "headless") return { ok: false, error: "Qwen TUI is not offered before its native verification; use ahub qwen --mode headless" };
+    if (adapter?.transport === "acp" && adapter.start.create) {
+      const refusal = adapter.start.preflight?.({ instance: peer, form: args.mode });
+      if (refusal) return { ok: false, error: refusal };
+    }
     if (peer === "kimi") {
       if (args.mode !== undefined && !["headless", "tui"].includes(args.mode)) return { ok: false, error: "invalid Kimi mode" };
       const owner = bus.peers.get(peer);
@@ -2757,32 +3180,36 @@ export async function startDaemon(opts: DaemonOptions) {
       catch { await jcode.stop().catch(() => {}); throw new Error("Jcode startup not verified; check native version, provider profile, MCP store and owned daemon (details withheld)"); }
       return { ok: true, policy: "unmanaged" };
     }
-    if (peer === "qwen") {
-      if (args.mode === "tui") return { ok: false, error: "Qwen TUI is not offered before its native verification; use ahub qwen --mode headless" };
-      const launch = buildQwenLaunch(config.qwen_cmd, args.model);
-      const qwen = new AcpPeer("qwen", {
-        onActivity: item => activityRings.qwen.append(item),
-        isPrivateTurn: () => !!turns.get("qwen")?.private || contextPii("qwen"),
-        cmd: [launch.cmd, ...launch.args], qwen025: true, permissionMode: permissionMode("qwen"),
+    if (adapter?.transport === "acp" && adapter.start.create) {
+      // ponytail: A1 migrates one ACP factory; A2 generalizes its native config and activity ports before adding another.
+      const launch = adapter.start.launch({ instance: peer, form: "headless", projectRoot: opts.cwd, stateDir: opts.stateDir, entrypoint: CLI_ENTRY,
+        userArgs: [], unattended: false, env: {}, nativeCommand: config.qwen_cmd, model: args.model });
+      const mcpServers = [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: Object.entries(toolEnv(peer, true)).map(([name, value]) => ({ name, value })) }];
+      const permission = permissionMode(peer);
+      const owner = adapter.start.create({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: undefined, permission, mcpServers, daemon: { acp: {
+        onActivity: item => activityRings[peer as keyof typeof activityRings].append(item),
+        isPrivateTurn: () => !!turns.get(peer)?.private || contextPii(peer),
+        cmd: [launch.cmd, ...launch.args], permissionMode: permission,
         ...(args.model ? { launchModel: args.model } : {}), ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}),
         cwd: opts.cwd, watchdogMs: config.watchdog_ms, onPermission,
         autoApprove: title => !stopping && HUB_TOOL_TITLES.has(title),
         log: () => log("Qwen runtime diagnostic: details withheld"),
         onUsageDiagnostic: (observation, sessionId) => {
           if (observation.source !== "usage_update" || observation.shape !== "context-used") return;
-          const current = contextSession("qwen"); if (!current) return;
-          contexts.report("qwen", observation.contextUsed !== undefined && observation.contextCapacity !== undefined
+          const current = contextSession(peer); if (!current) return;
+          contexts.report(peer, observation.contextUsed !== undefined && observation.contextCapacity !== undefined
             ? acpContext({ used: observation.contextUsed, size: observation.contextCapacity }, sessionId, Date.now())
             : { source: "acp_usage_update", sessionId, measuredAt: Date.now(), tokens: null, window: null, used: null }, current);
         },
-        onTurnFailure: () => { supervisionTurns.delete("qwen"); },
-        mcpServers: [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: Object.entries(toolEnv("qwen")).map(([name, value]) => ({ name, value })) }],
-        preamble: sessionRoleContract("qwen"),
-      });
-      recoveryTaskPreface("qwen"); await ensurePreface("qwen");
-      try { await qwen.start(); await reconcileNativeStart(peer, qwen); }
+        onTurnFailure: () => { supervisionTurns.delete(peer); },
+        mcpServers,
+        preamble: sessionRoleContract(peer),
+      } } });
+      if (!(owner instanceof AcpPeer)) throw new Error("ACP factory did not return its native transport");
+      recoveryTaskPreface(peer); await ensurePreface(peer);
+      try { await owner.start(); await reconcileNativeStart(peer, owner); }
       catch (error) {
-        await qwen.stop().catch(() => log("Qwen stop after failed startup was not confirmed"));
+        await owner.stop().catch(() => log("Qwen stop after failed startup was not confirmed"));
         if (error instanceof QwenIdentityError) throw error;
         throw new Error("Qwen could not reach its provider or complete its startup handshake; verify the provider connection and Qwen Code 0.25.0 (details withheld)");
       }
@@ -2828,7 +3255,7 @@ export async function startDaemon(opts: DaemonOptions) {
             current);
         },
         onTurnFailure: () => { supervisionTurns.delete("kimi"); },
-        mcpServers: [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: Object.entries(toolEnv("kimi")).map(([name, value]) => ({ name, value })) }],
+        mcpServers: [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: Object.entries(toolEnv("kimi", true)).map(([name, value]) => ({ name, value })) }],
         preamble: sessionRoleContract("kimi"),
       });
       recoveryTaskPreface("kimi");
@@ -2916,11 +3343,11 @@ export async function startDaemon(opts: DaemonOptions) {
       if (!["headless", "tui"].includes(mode) || !["auto", "dgx", "mlx"].includes(backend)) return { ok: false, error: "invalid Pi mode/backend" };
       const problem = mlxLaunchProblem(config, { backend, model: args.model });
       if (problem) return { ok: false, error: problem };
-      modelRelay ??= await startModelRelay({ omni, admitRequest: admitPiRequest, dgxMaxInputTokens: currentRouting(opts.cwd, log).pi.dgx_max_context_tokens, allowedDGXmodels: { "dgx/coding": config.pi.dgx_coding, "dgx/fast": config.pi.dgx_fast }, mlx: config.mlx.enabled === false ? undefined : config.mlx, mlxAlias: "mlx/fast", fallbackDGXAlias: "dgx/fast", enableHubAuto: true,
+      modelRelay ??= await startModelRelay({ omni, admitRequest: admitPiRequest, dgxMaxInputTokens: activeRouting().pi.dgx_max_context_tokens, allowedDGXmodels: { "dgx/coding": config.pi.dgx_coding, "dgx/fast": config.pi.dgx_fast }, mlx: config.mlx.enabled === false ? undefined : config.mlx, mlxAlias: "mlx/fast", fallbackDGXAlias: "dgx/fast", enableHubAuto: true,
         routeSessionKey: () => { const session = bus.peers.get("pi")?.recoveryMetadata?.().sessionId; return typeof session === "string" ? session : undefined; },
-        staySwitch: () => currentRouting(opts.cwd, log),
+        staySwitch: () => activeRouting(),
         onRoute: record => event({ type: "route", peer: "pi", ...record }),
-        efficientWaitMs: currentRouting(opts.cwd, log).pi.efficient_wait_ms,
+        efficientWaitMs: activeRouting().pi.efficient_wait_ms,
         underBudget: () => { const current = bus.peers.get("pi"); return current instanceof PiPeer && tasks.budgetApplies(current.budgetEnvelopes, "pi"); },
         onCooldown: record => {
           log(`model ${record.alias}: ${record.event === "start" ? `cooling down for ${Math.round(record.ms! / 1000)} s after ${record.failures} transport or startup failures` : "cooldown ended"}`);
@@ -2960,7 +3387,7 @@ export async function startDaemon(opts: DaemonOptions) {
           return typeof refused === "string" ? `not sent: ${refused}` : "sent";
         },
       };
-      const routing = currentRouting(opts.cwd, log);
+      const routing = activeRouting();
       const pi = new PiPeer("pi", {
         cwd: opts.cwd, stateDir: opts.stateDir, cmd: config.pi.cmd, mode, backend,
         model: args.model,
@@ -3008,7 +3435,7 @@ export async function startDaemon(opts: DaemonOptions) {
           if (backend !== "auto") return backend === "mlx" ? "mlx/fast" : "dgx/coding";
           const taskId = envs.find(env => env.refs?.task)?.refs?.task;
           const task = taskId ? board.get(Number(taskId)) : undefined;
-          const policyBackend = task ? currentRouting(opts.cwd, log).classes[task.class]?.pi_backend : undefined;
+          const policyBackend = task ? activeRouting().classes[task.class]?.pi_backend : undefined;
           if (policyBackend === "mlx") {
             if (config.mlx.enabled !== false) return "mlx/fast";
             const problem = disabledMlxPolicyProblem(config, opts.cwd);
@@ -3076,7 +3503,7 @@ export async function startDaemon(opts: DaemonOptions) {
       return { ok: true, ...(mode === "tui" ? { launch: pi.tuiLaunch } : {}) };
     }
     if (peer === "local") {
-      const routing = currentRouting(opts.cwd, log);
+      const routing = activeRouting();
       // `--model` pins a model on OmniRoute and skips L2; `--route` picks another Switchyard route.
       const route = args.model ? undefined : (args.route ?? routing.local.route);
       if (route && !(route.startsWith("hub/") ? routing.hub_routes?.[route] : routing.routes[route])) return { ok: false, ...(existing && existing.state !== "offline" ? { already: true } : {}), error: `routing.toml has no route "${route}"` };
@@ -3123,8 +3550,8 @@ export async function startDaemon(opts: DaemonOptions) {
         admitBudget: async (envs, unit) => tasks.admitExecutionEnvelopes(envs, "local", unit),
         ...(route ? { route } : {}),
         ...(sidecar && route && !route.startsWith("hub/") ? { sidecar } : {}),
-        hubRoutes: () => currentRouting(opts.cwd, log).hub_routes ?? {},
-        staySwitch: () => currentRouting(opts.cwd, log),
+        hubRoutes: () => activeRouting().hub_routes ?? {},
+        staySwitch: () => activeRouting(),
         onRoute: record => event({ type: "route", peer: "local", ...record }),
         onAdvisor: record => event({ type: "advisor", peer: "local", ...record }),
         onRouteOutcome: record => event({ type: "route_outcome", peer: "local", ...record }),
@@ -3167,7 +3594,7 @@ export async function startDaemon(opts: DaemonOptions) {
   }
 
   async function validateLocalChoice(route: string | undefined, fixedModel: string): Promise<void> {
-    const routing = currentRouting(opts.cwd, log);
+    const routing = activeRouting();
     if (route && !(route.startsWith("hub/") ? routing.hub_routes?.[route] : routing.routes[route])) throw new Error(`routing.toml has no route "${route}"`);
     const models = await omni.models();
     const required = new Set([fixedModel]);
@@ -3351,7 +3778,7 @@ export async function startDaemon(opts: DaemonOptions) {
       instanceId,
       attention: attentionStatus.attentionInput,
       pet,
-      status: { peers: peerView, taskWip: attentionStatus.taskWip, roleInfo: attentionStatus.roleInfo },
+      status: { peers: peerView, pendingRestart, taskWip: attentionStatus.taskWip, roleInfo: attentionStatus.roleInfo },
       boardCapabilities: { backlog: true },
       planningCapabilities: { enabled: true, wipPull: true, split: true },
       releases: tasks.releaseList(USER),
@@ -3364,7 +3791,7 @@ export async function startDaemon(opts: DaemonOptions) {
       tasks: boardTasks.map((task) => {
         const view = tasks.publicView(task);
         // Refs and history can themselves quote private text. The dashboard needs neither.
-        return { id: task.id, title: view.title, detail: view.detail, class: task.class, ...(task.profile ? { profile: task.profile, profileClass: task.profileClass } : {}), ...(task.role ? { role: task.role } : {}), state: task.state, owner: task.owner, reviewer: task.reviewer, deps: view.deps ?? [], ...(task.reserved ? { reserved: task.reserved } : {}), planningRevision: task.planningRevision ?? 0, rank: task.rank ?? null, priority: task.priority ?? null, release: task.release ?? null, plannedStart: task.plannedStart ?? null, due: task.due ?? null, pinned: task.pinned === true, actualDates: view.actualDates, ...(view.external ? { external: view.external } : {}), started: taskHasStarted(task), urgent: task.signals.includes("urgent"), updated: task.updated, reworkRound: task.history.filter(entry => entry.event === "changes_requested").length, checking: tasks.isChecking(task.id), ...(view.lifecycle ? { lifecycle: view.lifecycle } : {}) };
+        return { id: task.id, title: view.title, detail: view.detail, class: task.class, ...(task.profile ? { profile: task.profile, profileClass: task.profileClass } : {}), ...(task.role ? { role: task.role } : {}), state: task.state, owner: task.owner, reviewer: task.reviewer, deps: view.deps ?? [], ...(task.reserved ? { reserved: task.reserved } : {}), planningRevision: task.planningRevision ?? 0, rank: task.rank ?? null, priority: task.priority ?? null, release: task.release ?? null, plannedStart: task.plannedStart ?? null, due: task.due ?? null, pinned: task.pinned === true, actualDates: view.actualDates, ...(view.cancelled ? { cancelled: view.cancelled } : {}), ...(view.external ? { external: view.external } : {}), started: taskHasStarted(task), urgent: task.signals.includes("urgent"), updated: task.updated, reworkRound: task.history.filter(entry => entry.event === "changes_requested").length, checking: tasks.isChecking(task.id), ...(view.lifecycle ? { lifecycle: view.lifecycle } : {}) };
       }),
       links: links.filter(link => link.tasks.every(id => { const task = board.get(id); return task && !tasks.isPii(task); })),
       budget: Object.fromEntries(peers.map((id) => [id, { ...(quota[id] ?? { windows: [] }), context: contexts.view(id, contextSession(id), bus.peers.has(id) && ["idle", "busy", "paused"].includes(bus.stateOf(id))) }])),
@@ -3386,6 +3813,237 @@ export async function startDaemon(opts: DaemonOptions) {
     };
   }
 
+  /** Set a validated leaf in place: objects captured by policy consumers retain their identity. */
+  function putConfig(target: object, key: string, value: unknown): void {
+    const parts = key.split(".");
+    if (parts.some(part => ["__proto__", "constructor", "prototype"].includes(part))) throw new Error("unsafe configuration path");
+    let node = target as Record<string, unknown>;
+    for (const part of parts.slice(0, -1)) {
+      if (!Object.hasOwn(node, part) || !node[part] || typeof node[part] !== "object" || Array.isArray(node[part])) node[part] = {};
+      node = node[part] as Record<string, unknown>;
+    }
+    if (value === undefined) delete node[parts.at(-1)!];
+    else node[parts.at(-1)!] = structuredClone(value);
+  }
+  function changedRawPaths(before: unknown, after: unknown, prefix = ""): string[] {
+    const object = (value: unknown): value is Record<string, unknown> => !!value && typeof value === "object" && !Array.isArray(value);
+    if (object(before) || object(after)) {
+      const old = object(before) ? before : {}, next = object(after) ? after : {};
+      return [...new Set([...Object.keys(old), ...Object.keys(next)])].flatMap(key => changedRawPaths(old[key], next[key], prefix ? `${prefix}.${key}` : key));
+    }
+    return JSON.stringify(before) === JSON.stringify(after) ? [] : [prefix];
+  }
+  function declaredPaths(value: unknown, prefix = ""): string[] {
+    // Switchyard dictionaries have opaque keys (including dots); publish each dictionary as one value.
+    if (["routing.targets", "routing.routes", "routing.hub_routes"].includes(prefix)) return [prefix];
+    if (value && typeof value === "object" && !Array.isArray(value)) return Object.entries(value).flatMap(([key, child]) => declaredPaths(child, prefix ? `${prefix}.${key}` : key));
+    return prefix ? [prefix] : [];
+  }
+  const isMachineKey = (key: string) => ALL_MACHINE_LOCAL.some(path => key === path || key.startsWith(`${path}.`));
+  function roleHolders(candidate: HubConfig): { planners: string[]; conductors: string[] } {
+    // A valid transfer may briefly have two conductors while its leaves are planned. Validate the final map later.
+    const policy = Object.fromEntries(Object.entries(candidate.roles).map(([peer, roles]) => [peer, roles.filter(role => role !== "conductor")]));
+    const settled = resolveSettledRoles(policy, candidate.planner, peer => rosterAllows(candidate.roster, peer, candidate.pi.enabled));
+    return { planners: settled.planners, conductors: Object.keys(candidate.roles).filter(peer => candidate.roles[peer]!.includes("conductor")).sort() };
+  }
+  function prepareConfiguration(sources: ConfigSources, authority: SettingAuthority, scope?: string, confirmed: readonly string[] = []) {
+    const fileConfig = loadConfig(opts.cwd, sources.layers);
+    validateEffectiveConfig(fileConfig);
+    const candidate = structuredClone(desiredConfig), routing = structuredClone(desiredRouting);
+    const accepted: string[] = [], rejected: { key: string; reason: string }[] = [], guarded: string[] = [];
+    const previews: { key: string; before: string; after: string; effect?: string }[] = [];
+    const paths = new Set<string>();
+    for (const layer of [...sources.trustLayers, ...acceptedSources.trustLayers]) {
+      const prefix = layer.name.endsWith(".toml") ? "routing" : "";
+      for (const path of declaredPaths(layer.raw, prefix)) paths.add(path);
+    }
+    if (!opts.config) for (const change of configChanges(desiredConfig, fileConfig)) paths.add(change.key);
+    for (const key of paths) {
+      if (scope && key !== scope) continue;
+      const route = key.startsWith("routing."), path = (route ? key.slice(8) : key).split(".");
+      const layers = sources.trustLayers.filter(layer => layer.name.endsWith(route ? ".toml" : ".json"));
+      const priorLayers = acceptedSources.trustLayers.filter(layer => layer.name.endsWith(route ? ".toml" : ".json"));
+      const current = [...layers].reverse().find(layer => valueAt(layer.raw, path) !== undefined);
+      const prior = [...priorLayers].reverse().find(layer => valueAt(layer.raw, path) !== undefined);
+      const changedLayers = [...new Set([...layers.map(layer => layer.name), ...priorLayers.map(layer => layer.name)])].filter(name => JSON.stringify(valueAt(layers.find(layer => layer.name === name)?.raw, path)) !== JSON.stringify(valueAt(priorLayers.find(layer => layer.name === name)?.raw, path)));
+      const rawChanged = changedLayers.length > 0;
+      if (opts.config && !rawChanged) continue; // embedding overrides are not file defaults
+      const before = valueAt(route ? desiredRouting : desiredConfig, path);
+      const after = valueAt(route ? sources.routing : opts.config && !current ? embeddedConfig : fileConfig, path);
+      const rawAfter = current ? valueAt(current.raw, path) : undefined;
+      if (!rawChanged && JSON.stringify(before) === JSON.stringify(after)) continue;
+      const machine = !route && isMachineKey(key);
+      const origin = current ?? prior;
+      let tracked = origin ? configTracked(opts.cwd, origin.name) : false;
+      if (!machine && tracked === undefined && !configRepositoryPresent(opts.cwd)) tracked = false;
+      const guard = SETTINGS.find(def => def.store === (route ? "routing" : "config") && def.path.join(".") === path.join("."));
+      const acceptedFallback = !machine && tracked !== undefined && !!current && JSON.stringify(after) === JSON.stringify(valueAt(route ? startupRouting : embeddedConfig, path)) && JSON.stringify(after) === JSON.stringify(rawAfter) && JSON.stringify(rawAfter) === JSON.stringify(valueAt(startupSources.find(layer => layer.name === current.name)?.raw, path));
+      if (key.startsWith("roster.") && scope !== key && JSON.stringify(before) !== JSON.stringify(after)) {
+        rejected.push({ key, reason: "use the confirmed ahub roster add/remove setting; a full reload cannot bypass peer lifecycle" });
+        continue;
+      }
+      let settledHolderChange = false, effect: string | undefined;
+      if (key === "planner" || key === "roles" || key.startsWith("roles.")) {
+        const prospective = structuredClone(candidate);
+        putConfig(prospective, path.join("."), after);
+        const oldHolders = roleHolders(candidate), newHolders = roleHolders(prospective);
+        settledHolderChange = JSON.stringify(oldHolders) !== JSON.stringify(newHolders);
+        if (settledHolderChange) effect = `planner ${JSON.stringify(oldHolders.planners)} -> ${JSON.stringify(newHolders.planners)}; conductor ${JSON.stringify(oldHolders.conductors)} -> ${JSON.stringify(newHolders.conductors)}`;
+      }
+      const input = { key, before, acceptedFallback, settledHolderChange, after: machine && rawChanged ? rawAfter : after, source: route ? "routing" as const : "config" as const, tracked, authority, guard, confirmed: !!scope || confirmed.includes(key) };
+      const decision = authorizeConfigLeaf(input);
+      if (!decision.allowed) {
+        const next = `${decision.reason}; review and run ahub settings reload, or revert this key${machine && tracked !== false ? "; move machine-local declarations to an untracked local file first" : ""}`;
+        rejected.push({ key, reason: next });
+        if (!scope && authority === "terminal" && authorizeConfigLeaf({ ...input, confirmed: true }).allowed) {
+          const shown = { key, before: before === undefined ? "(unset)" : JSON.stringify(before)!, after: after === undefined ? "(unset)" : JSON.stringify(after)!, ...(effect ? { effect } : {}) };
+          if (key.length > 160 || Buffer.byteLength(shown.before) > 16_384 || Buffer.byteLength(shown.after) > 16_384 || effect && Buffer.byteLength(effect) > 2048) rejected.at(-1)!.reason += "; complete preview exceeds the 16 KiB value/2 KiB effect bound; reduce this edit before confirmation";
+          else { guarded.push(key); previews.push(shown); }
+        }
+        continue;
+      }
+      putConfig(route ? routing : candidate, path.join("."), after);
+      if (route) {
+        routing.sources ??= {};
+        const origin = sources.routing.sources?.[path.join(".")];
+        if (origin) routing.sources[path.join(".")] = origin; else delete routing.sources[path.join(".")];
+      }
+      if (!route && path[0] === "permission_modes" && path[1]) {
+        candidate.permission_default_sources ??= {};
+        const source = fileConfig.permission_default_sources?.[path[1]];
+        if (source) candidate.permission_default_sources[path[1]] = source;
+        else delete candidate.permission_default_sources[path[1]];
+      }
+      accepted.push(key);
+    }
+    // Describe the guarded transaction against all safe changes already admitted by this plan.
+    const rolePreviews = previews.filter(item => item.key === "planner" || item.key === "roles" || item.key.startsWith("roles."));
+    if (rolePreviews.length) {
+      const prospective = structuredClone(candidate);
+      for (const item of rolePreviews) putConfig(prospective, item.key, item.after === "(unset)" ? undefined : JSON.parse(item.after));
+      const before = roleHolders(candidate), after = roleHolders(prospective);
+      const effect = `planner ${JSON.stringify(before.planners)} -> ${JSON.stringify(after.planners)}; conductor ${JSON.stringify(before.conductors)} -> ${JSON.stringify(after.conductors)}`;
+      for (const item of rolePreviews) item.effect = effect;
+    }
+    guarded.sort(); previews.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+    if (previews.some(item => item.effect && Buffer.byteLength(item.effect) > 2048) || guarded.length > 200 || Buffer.byteLength(JSON.stringify({ token: "x".repeat(36), keys: guarded, changes: previews })) > 131_072) {
+      for (const item of rejected) if (guarded.includes(item.key)) item.reason += "; combined confirmation preview exceeds its 128 KiB bound; split this edit";
+      guarded.length = 0; previews.length = 0;
+    }
+    const changes = configChanges({ ...config, roles: policyRoles }, candidate);
+    const running = structuredClone({ ...config, roles: policyRoles });
+    for (const change of changes) if (change.applies !== "restart") putConfig(running, change.key, change.after);
+    validateEffectiveConfig(running);
+    conductorPeer(running.roles);
+    for (const peer of Object.keys(running.catalog_roles ?? {})) selectedRoles(peer, running.roles, { ...resolvedProfile.catalog_roles, ...catalogAssignments(running.catalog_roles) }, catalog);
+    const problem = running.mlx.enabled === false ? mlxPinProblem(routing, sources.texts["routing.toml"] !== null) : undefined;
+    if (problem) throw new Error(problem);
+    return { sources, fileConfig, candidate, running, routing, changes, accepted, rejected, guarded, previews };
+  }
+  /** Acknowledging one field never hides another pending edit in the same file. */
+  function acknowledgeConfiguration(sources: ConfigSources, paths: readonly string[]): void {
+    const layers = acceptedSources.trustLayers.map(layer => ({ ...layer, raw: structuredClone(layer.raw) }));
+    for (const name of CONFIG_SOURCE_FILES) {
+      let layer = layers.find(layer => layer.name === name);
+      const relevant = paths.filter(key => key.startsWith("routing.") === name.endsWith(".toml"));
+      if (!relevant.length) continue;
+      if (!layer) { layer = { name, raw: {} }; layers.push(layer); }
+      const next = sources.trustLayers.find(layer => layer.name === name)?.raw;
+      for (const key of relevant) {
+        const path = key.startsWith("routing.") ? key.slice(8) : key;
+        const raw = valueAt(next, path.split("."));
+        const winning = [...sources.trustLayers].reverse().find(source => source.name.endsWith(name.endsWith(".toml") ? ".toml" : ".json") && valueAt(source.raw, path.split(".")) !== undefined);
+        if (raw !== undefined && winning?.name !== name) continue; // a shadowed edit was never authorized by its no-op effective value
+        putConfig(layer.raw, path, raw);
+      }
+    }
+    acceptedSources = { ...sources, trustLayers: layers, layers: layers.filter((layer): layer is typeof layer & { name: "config.json" | "config.local.json" } => layer.name.endsWith(".json")), routing: desiredRouting };
+  }
+  function configWriteCheck(scratch: string, authority: SettingAuthority, scope?: string): HubConfig {
+    const texts = configSourceTexts(opts.cwd), next = configSourceTexts(scratch);
+    texts["config.json"] = next["config.json"];
+    texts["config.local.json"] = next["config.local.json"];
+    const prepared = prepareConfiguration(parseConfigSources(texts), authority, scope);
+    const refusal = prepared.rejected.find(item => item.key === scope);
+    if (refusal) throw new Error(`${refusal.key}: ${refusal.reason}`);
+    return prepared.fileConfig;
+  }
+  function routingWriteCheck(authority: SettingAuthority, overlay: import("./routing.ts").RoutingOverlay | undefined, scope?: string): void {
+    const texts = configSourceTexts(opts.cwd);
+    texts["routing.local.toml"] = overlay === undefined ? null : overlayToml(overlay);
+    const prepared = prepareConfiguration(parseConfigSources(texts), authority, scope);
+    const refusal = prepared.rejected.find(item => item.key === scope);
+    if (refusal) throw new Error(`${refusal.key}: ${refusal.reason}`);
+  }
+  function runConfigWatch(): void {
+    if (stopping) return;
+    if (rosterChanging) { configWatchPending = true; return; }
+    void reloadConfig("ordinary");
+  }
+  /** The only publication path; named writes are scoped, full guarded reloads need person confirmation. */
+  async function reloadConfig(authority: SettingAuthority, scope?: string, confirm?: unknown): Promise<Record<string, unknown>> {
+    if (stopping || recoveryActive()) return { ok: false, error: "recovery or shutdown is holding configuration reload" };
+    let fingerprint = "unavailable", published = false;
+    try {
+      const texts = configSourceTexts(opts.cwd);
+      fingerprint = configFingerprint(texts);
+      if (confirm !== undefined && (typeof confirm !== "string" || authority !== "terminal" || scope || !reloadConfirmation || reloadConfirmation.token !== confirm || reloadConfirmation.fingerprint !== fingerprint || reloadConfirmation.revision !== configRevision)) return { ok: false, error: "configuration confirmation is stale or changed; run ahub settings reload again" };
+      const sources = parseConfigSources(texts);
+      const prepared = prepareConfiguration(sources, authority, scope, confirm === undefined ? [] : reloadConfirmation!.keys);
+      if (confirm !== undefined && prepared.rejected.some(item => reloadConfirmation!.keys.includes(item.key))) return { ok: false, error: "configuration trust changed; run ahub settings reload again" };
+      if (scope && prepared.rejected.some(item => item.key === scope)) return { ok: false, error: prepared.rejected.find(item => item.key === scope)!.reason };
+      const { changes, candidate } = prepared;
+      const routingChanges = changedRawPaths({ ...runningRouting, sources: undefined }, { ...prepared.routing, sources: undefined }, "routing");
+      if (prepared.running.snapshots.enabled && repo && !turnLog) turnLog = new Turns(join(opts.stateDir, "hub.db"));
+      const priorDesired = JSON.stringify([desiredConfig, desiredRouting, acceptedSources.trustLayers]);
+      const rolesChanged = changes.some(change => change.key === "roles" || change.key.startsWith("roles.") || change.key === "planner");
+      const beforeConductor = conductorPeer(config.roles);
+      published = true;
+      for (const change of changes) {
+        if (change.applies === "restart" || change.key === "roles" || change.key.startsWith("roles.")) continue;
+        putConfig(config, change.key, change.after);
+      }
+      if (rolesChanged) { policyRoles = structuredClone(prepared.running.roles); settlePlanner(); }
+      for (const change of changes.filter(change => change.key === "permission_modes" || change.key.startsWith("permission_modes."))) {
+        for (const peer of change.key === "permission_modes" ? SUPPORTED_PEERS : [change.key.split(".")[1]!]) changedPermissionDefaults.add(peer);
+      }
+      config.permission_default_sources = candidate.permission_default_sources;
+      for (const peer of changedPermissionDefaults) applyPendingPermissionDefault(peer);
+      if (changes.some(change => change.key === "task_sweep" || change.key.startsWith("task_sweep."))) rescheduleSweep();
+      if (changes.some(change => ["batch_max", "batch_ms", "queue_cap"].includes(change.key))) bus.configureScheduling({ batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap });
+      if (changes.some(change => change.key === "watchdog_ms")) for (const peer of bus.peers.values()) if (peer instanceof BasePeer) peer.configureWatchdog(config.watchdog_ms);
+      Object.assign(limits, config.limits);
+      turnFreeNow = undefined;
+      runningRouting = { ...prepared.routing, pi: runningRouting.pi };
+      desiredConfig = structuredClone(candidate);
+      desiredRouting = structuredClone(prepared.routing);
+      acknowledgeConfiguration(sources, prepared.accepted);
+      if (priorDesired !== JSON.stringify([desiredConfig, desiredRouting, acceptedSources.trustLayers])) configRevision++;
+      pendingRestart = configChanges({ ...config, roles: policyRoles }, candidate).filter(change => change.applies === "restart").map(change => ({ key: change.key, reason: change.reason! }));
+      pendingRestart.push(...routingChanges.filter(key => configApply(key).applies === "restart").map(key => ({ key, reason: configApply(key).reason! })));
+      storedConfigCache = undefined;
+      if (beforeConductor && (beforeConductor !== conductorPeer(config.roles) || config.conductor.feed === "off")) {
+        bus.revokeSupervision(beforeConductor); supervision.resetPending(beforeConductor); budgetFeedSeen.clear();
+      }
+      if (confirm !== undefined) reloadConfirmation = undefined;
+      if (prepared.guarded.length) reloadConfirmation = { token: randomUUID(), fingerprint, revision: configRevision, keys: prepared.guarded };
+      const refusal = prepared.rejected.map(item => `${item.key}: ${item.reason}`).join("; ");
+      const failure = refusal ? `${fingerprint}:${refusal}` : undefined;
+      if (failure && lastReloadFailure !== failure) { try { notify(`configuration keys retained: ${sanitize(refusal).slice(0, 1200)}`); } catch { log("configuration keys retained; notice unavailable"); } }
+      lastReloadFailure = failure;
+      writeStatus();
+      const applied = [...changes.filter(change => change.applies !== "restart").map(change => change.key), ...routingChanges.filter(key => configApply(key).applies !== "restart")];
+      return { ok: true, applied, pendingRestart, rejected: prepared.rejected,
+        ...(prepared.guarded.length ? { confirmation: { token: reloadConfirmation!.token, keys: reloadConfirmation!.keys, changes: prepared.previews } } : {}),
+        text: [applied.length ? `configuration reloaded: ${applied.join(", ")}` : pendingRestart.length ? `pending restart: ${pendingRestart.map(item => item.key).join(", ")}` : "configuration unchanged", ...(prepared.rejected.length ? [`retained keys: ${prepared.rejected.map(item => item.key).join(", ")}; review ahub settings reload or revert the file`] : [])].join("\n") };
+    } catch (error) {
+      const message = sanitize(error instanceof Error ? error.message : "configuration reload could not be confirmed").slice(0, 600);
+      const failure = `${fingerprint}:${message}`;
+      if (lastReloadFailure !== failure) { lastReloadFailure = failure; try { notify(`configuration reload ${published ? "unconfirmed" : "refused"}: ${message}; run ahub settings reload after reviewing or reverting the file`); } catch { log("configuration reload notice unavailable"); } }
+      return { ok: false, error: message, ...(published ? { applied: true } : {}), pendingRestart };
+    }
+  }
+
   // #269: settings. One registry (src/hub/settings.ts) serves the dashboard and `ahub settings`; nothing outside it is written.
   let storedConfigCache: { stamp: string; config: HubConfig | undefined } | undefined;
   /** What the config files hold now, as the loader reads them. Re-read only when a file changed: the dashboard polls. */
@@ -3398,16 +4056,6 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     return storedConfigCache.config;
   };
-  /** Stored start modes and the scoped instruction policy follow a settings write or undo. */
-  const applyStartModes = () => { const stored = storedConfig(); if (stored) { config.peers = stored.peers; config.protect_instruction_files = stored.protect_instruction_files; } };
-  /** Apply only the named peer; unrelated hand edits retain their prior publication scope. */
-  const applyRoleSelection = (peer: string) => {
-    const stored = storedConfig(); if (!stored) return;
-    config.catalog_roles = { ...config.catalog_roles };
-    const ids = catalogAssignments(stored.catalog_roles)[peer];
-    if (ids === undefined) delete config.catalog_roles[peer]; else config.catalog_roles[peer] = ids;
-    roleAssignments[peer] = ids ?? resolvedProfile.catalog_roles[peer] ?? [];
-  };
   const settingScalar = (value: unknown): SettingValue => typeof value === "string" || typeof value === "boolean" || typeof value === "number" ? value : Array.isArray(value) ? value.map(String) : null;
   const routingValue = (routing: ReturnType<typeof currentRouting>, def: SettingDef): SettingValue =>
     settingScalar(def.path[0] === "stay_switch" ? routing.stay_switch : (routing.classes[def.path[1] as TaskClass] as Record<string, unknown> | undefined)?.[def.path[2]!]);
@@ -3417,14 +4065,14 @@ export async function startDaemon(opts: DaemonOptions) {
     try { return { settings: { ...settingsView(), ...(session?.settings ? { sessionUntil: session.settingsUntil } : {}) } }; }
     catch { return {}; }
   }
-  function settingsView(): { rows: SettingRow[]; undo?: string } {
+  function settingsView(): { rows: SettingRow[]; undo?: string; pendingRestart: { key: string; reason: string }[] } {
     const stored = storedConfig();
     // What the loader would say about the files as they are: an overlay that does not parse, or one that no longer
     // merges (it names a route routing.toml dropped), leaves the last good policy in force, and the rows say why.
     let routingProblem: string | undefined;
     try { parseRouting(routingText(opts.cwd), readOverlay(opts.cwd)); } catch (error) { routingProblem = (error as Error).message; }
     const rows = settingRows({
-      cwd: opts.cwd, routing: currentRouting(opts.cwd, log), ...(routingProblem ? { routingProblem } : {}), ...(stored?.ignored ? { ignored: stored.ignored } : {}),
+      cwd: opts.cwd, routing: activeRouting(), ...(routingProblem ? { routingProblem } : {}), ...(stored?.ignored ? { ignored: stored.ignored } : {}),
       running: (path) => path[0] === "roster" ? onRoster(path[1]!) : path[0] === "tasks" && path[1] === "wip_limits" ? tasks.wipLimit(path[2]!) : valueAt(config, path),
       next: stored ? (path) => path[0] === "roster" ? rosterAllows(stored.roster, path[1]!, stored.pi.enabled) : path[0] === "tasks" && path[1] === "wip_limits" ? (Object.hasOwn(stored.tasks.wip_limits ?? {}, path[2]!) ? stored.tasks.wip_limits![path[2]!] : 1) : valueAt(stored, path) : undefined,
       roles: roleState,
@@ -3435,16 +4083,17 @@ export async function startDaemon(opts: DaemonOptions) {
       },
     });
     const undo = pendingUndo(opts.stateDir);
-    return { rows, ...(undo ? { undo } : {}) };
+    const planner = `In force: ${plannerPeers().join(", ") || "nobody"} (${plannerSource}). Setting it makes that peer the only planner; agents cannot change it.`;
+    return { pendingRestart, rows: rows.map(row => row.key === "planner" ? { ...row, hint: planner } : row), ...(undo ? { undo } : {}) };
   }
   /** The same announcement whatever surface made the change: events.jsonl, hub.log and every open console. */
-  const recordSetting = (key: string, from: SettingValue, to: SettingValue, source: "dashboard" | "terminal", undo = false) => {
-    event({ type: "settings", key, from, to, source, ...(undo ? { undo: true } : {}) });
+  const recordSetting = (key: string, from: SettingValue, to: SettingValue, source: "dashboard" | "terminal", undo = false, reason?: string) => {
+    event({ type: "settings", key, from, to, source, ...(undo ? { undo: true } : {}), ...(reason ? { reason } : {}) });
     try { notify(`setting ${key}: ${settingText(from)} -> ${settingText(to)} (${undo ? "undo, " : ""}${source})`); } catch { /* the write stands */ }
   };
   const settingSource = (authority: SettingAuthority) => authority === "terminal" ? "terminal" as const : "dashboard" as const;
   function rosterView() {
-    const open = board.list().filter(task => task.state !== "approved");
+    const open = board.list().filter(task => !isClosedTaskState(task.state));
     return [...KNOWN_PEERS, ...OPTIONAL_PEERS.filter(peer => config.roster?.[peer] !== undefined)].map(peer => ({ peer, on: onRoster(peer), startMode: startMode(peer), state: bus.stateOf(peer), queued: bus.queued(peer), tasks: open.filter(task => task.owner === peer || task.reviewer === peer).length }));
   }
   function rosterCandidate(def: SettingDef, value: SettingValue, undo = false): PeerRoster {
@@ -3475,7 +4124,7 @@ export async function startDaemon(opts: DaemonOptions) {
       ? `Stop ${peer}'s existing work in its retained terminal; removal detaches the hub connection and does not stop that terminal's work.`
       : undefined;
   }
-  async function changeRosterSetting(def: SettingDef, value: SettingValue, source: "dashboard" | "terminal", confirm: unknown, now: boolean, undo = false): Promise<Record<string, unknown>> {
+  async function changeRosterSetting(def: SettingDef, value: SettingValue, source: "dashboard" | "terminal", confirm: unknown, now: boolean, undo = false, authority: SettingAuthority = "ordinary", reason?: string, undoIdentity?: UndoIdentity): Promise<Record<string, unknown>> {
     if (rosterChanging) return { ok: false, error: `roster change for ${rosterChanging} is in progress` };
     const peer = def.path[1]!;
     let saved = false;
@@ -3490,12 +4139,13 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       if (stopping || recoveryActive()) return { ok: false, error: "recovery or shutdown is holding roster changes" };
       rosterChanging = peer;
-      if (undo) undoSetting(opts.cwd, opts.stateDir, (scratch) => loadConfig(scratch), routingCheck);
-      else writeConfigSetting(opts.cwd, opts.stateDir, def, value, (scratch) => loadConfig(scratch));
+      if (undo) undoSetting(opts.cwd, opts.stateDir, scratch => configWriteCheck(scratch, authority, `roster.${peer}`), (_routing, overlay) => routingWriteCheck(authority, overlay), undoIdentity);
+      else writeConfigSetting(opts.cwd, opts.stateDir, def, value, scratch => configWriteCheck(scratch, authority, `roster.${peer}`));
       // Apply exactly the authorized key. Other file edits stay pending until the next hub start.
       config.roster = next;
+      settlePlanner(); // #455: an automatic planner follows the roster
       saved = true;
-      recordSetting(def.key, before, after, source, undo);
+      recordSetting(def.key, before, after, source, undo, reason);
       bus.rosterChanged(peer); // fence the queue before stopping or detaching the adapter
       if (!after) {
         for (const pending of permissions.values()) if (pending.peer === peer) pending.done(undefined);
@@ -3517,30 +4167,40 @@ export async function startDaemon(opts: DaemonOptions) {
         const owner = bus.peers.get(peer);
         if (owner instanceof PiPeer && owner.mode === "tui") await owner.resumeFromRoster();
       }
+      const reloaded = await reloadConfig(authority, `roster.${peer}`);
+      if (reloaded.ok !== true) return { ...reloaded, saved: true };
       writeStatus();
-      const stayed = !after ? board.list().filter(task => task.state !== "approved" && (task.owner === peer || task.reviewer === peer)) : [];
+      const stayed = !after ? board.list().filter(task => !isClosedTaskState(task.state) && (task.owner === peer || task.reviewer === peer)) : [];
       return { ok: true, text: [`${peer}: ${after ? "on" : "off"} roster (in force now)`, ...(!after && terminalNotice ? [terminalNotice] : []), ...(after && peer === "codex" ? [`Codex 0.146.0 needs a manual return: resume the previous native session with ${codexResumeCommand()}.`] : []), ...(!after ? handoff.map(move => sanitize(`task ${move.title}: ${move.role} assignment moved to ${move.to}`)) : []), ...stayed.map(task => sanitize(`task ${tasks.publicTitle(task)} stays with ${peer} as ${[task.owner === peer ? "owner" : "", task.reviewer === peer ? "reviewer" : ""].filter(Boolean).join(" and ")} (${task.state})`)), ...(!after && !handoff.length && !stayed.length ? ["No open tasks to hand over."] : [])].join("\n"), ...(!after ? { handoff } : {}) };
     } catch (error) {
       if (saved) writeStatus();
       return { ok: false, error: sanitize((error as Error).message), ...(saved ? { saved: true } : {}) };
-    } finally { if (rosterChanging === peer) { rosterChanging = undefined; bus.rosterChanged(peer); } }
+    } finally { if (rosterChanging === peer) { rosterChanging = undefined; bus.rosterChanged(peer); if (configWatchPending && !stopping) { configWatchPending = false; clearTimeout(reloadDebounce); reloadDebounce = setTimeout(runConfigWatch, 100); reloadDebounce.unref?.(); } } }
   }
   /** A checked definition and value, or the refusal. Every settings write and preview starts here. */
   function settingInput(key: unknown, raw: unknown): { def: SettingDef; value: SettingValue } | { error: string } {
     const def = settingDef(key);
     if (typeof def === "string") return { error: def };
-    const routing = currentRouting(opts.cwd, log);
+    const routing = activeRouting();
     try { return { def, value: checkSettingValue(def, raw, def.type === "roles" ? compatibleRoles(def.path[1]!) : [...Object.keys(routing.routes), ...Object.keys(routing.hub_routes ?? {})]) }; }
     catch (error) { return { error: (error as Error).message }; }
   }
-  async function settingsSet(key: unknown, raw: unknown, authority: SettingAuthority, confirm?: unknown, now?: unknown): Promise<Record<string, unknown>> {
+  const settingReason = (reason: unknown): string | undefined => {
+    if (reason === undefined) return undefined;
+    if (typeof reason !== "string" || !reason.trim() || Buffer.byteLength(reason) > 400) throw new Error("setting reason must contain 1..400 UTF-8 bytes");
+    return sanitize(reason.trim());
+  };
+  async function settingsSet(key: unknown, raw: unknown, authority: SettingAuthority, confirm?: unknown, now?: unknown, rawReason?: unknown): Promise<Record<string, unknown>> {
+    if (stopping || recoveryActive()) return { ok: false, error: "recovery or shutdown is holding settings" };
+    let reason: string | undefined;
+    try { reason = settingReason(rawReason); } catch (error) { return { ok: false, error: (error as Error).message }; }
     const input = settingInput(key, raw);
     if ("error" in input) return { ok: false, error: input.error };
     const { def, value } = input;
     const refusal = settingRefusal(def, value, authority);
     if (refusal) return { ok: false, error: refusal };
     const source = settingSource(authority);
-    if (def.group === "Roster") return changeRosterSetting(def, value, source, confirm, now === true);
+    if (def.group === "Roster") return changeRosterSetting(def, value, source, confirm, now === true, false, authority, reason);
     if (rosterChanging) return { ok: false, error: `roster change for ${rosterChanging} is in progress` };
     const peer = def.group === "Permissions" ? def.path.at(-1)! : undefined;
     // The console asks for y before never-ask; here the person types the peer it is for.
@@ -3551,53 +4211,63 @@ export async function startDaemon(opts: DaemonOptions) {
       const from = permissionMode(peer!);
       const result = await permissionChange(peer!, () => changePermission(peer!, value, value === "never-ask"));
       if (result.ok !== true) return result;
-      recordSetting(def.key, from, permissionMode(peer!), source);
+      recordSetting(def.key, from, permissionMode(peer!), source, false, reason);
       return { ok: true, text: `${def.key}: ${result.permissionMode}`, ...(typeof result.note === "string" ? { note: result.note } : {}) };
     }
+    let saved = false;
     try {
       if (def.store === "routing") {
-        const from = routingValue(currentRouting(opts.cwd, log), def);
-        const next = writeRoutingSetting(opts.cwd, opts.stateDir, def, value, routingCheck);
+        const from = routingValue(activeRouting(), def);
+        const next = writeRoutingSetting(opts.cwd, opts.stateDir, def, value, (_routing, overlay) => routingWriteCheck(authority, overlay, def.key));
         if (!next) return { ok: true, text: `${def.key}: ${OVERLAY_FILE} already ${value === null ? "leaves it unset" : `holds ${settingText(value)}`}; nothing was written` };
-        recordSetting(def.key, from, routingValue(next, def), source);
-        return { ok: true, text: `${def.key}: ${settingText(routingValue(next, def))} (in force now)` };
+        saved = true;
+        const result = await reloadConfig(authority, def.key);
+        if (result.ok !== true) return { ...result, saved: true };
+        recordSetting(def.key, from, routingValue(activeRouting(), def), source, false, reason);
+        return { ok: true, text: `${def.key}: ${settingText(routingValue(activeRouting(), def))} (in force now)` };
       }
-      // Removing the machine-local value uncovers the shared file's: never-ask there needs the same confirmation.
       if (peer && value === null && storedLocally(opts.cwd, def) && restoredValue(opts.cwd, opts.stateDir, def, true) === "never-ask" && confirm !== peer) return { ok: false, error: `removing the machine-local value leaves never-ask from config.json for ${peer}: it needs the peer id as the confirmation; nothing was changed` };
       const from = settingScalar(valueAt(storedConfig(), def.path));
-      if (!writeConfigSetting(opts.cwd, opts.stateDir, def, value, (scratch) => def.type === "roles" ? validateRoleSetting(scratch, def.path[1]!) : loadConfig(scratch))) return { ok: true, text: `${def.key}: config.local.json already ${value === null ? "leaves it unset" : `holds ${settingText(value)}`}; nothing was written` };
-      storedConfigCache = undefined;
+      if (!writeConfigSetting(opts.cwd, opts.stateDir, def, value, scratch => configWriteCheck(scratch, authority, def.path.join(".")))) return { ok: true, text: `${def.key}: config.local.json already ${value === null ? "leaves it unset" : `holds ${settingText(value)}`}; nothing was written` };
+      saved = true;
+      const result = await reloadConfig(authority, def.path.join("."));
+      if (result.ok !== true) return { ...result, saved: true };
       const to = settingScalar(valueAt(storedConfig(), def.path));
-      if (def.type === "roles") applyRoleSelection(def.path[1]!); else applyStartModes();
-      recordSetting(def.key, from, to, source);
-      if (def.type === "roles") event({ type: "role", peer: def.path[1]!, actor: "user", stage: "assigned", roles: selectedRoles(def.path[1]!, config.roles, roleAssignments, catalog).map(roleIdentity) });
-      // Config trust (#17) can drop a machine-local field at load: the write happened, and the person is told it will not count.
-      const dropped = ignoredLine(storedConfig()?.ignored, def);
-      return { ok: true, text: dropped ? `${def.key}: written, but the hub does not read it (${dropped})` : `${def.key}: ${settingText(to)} (${def.applies === "live" ? "in force now" : def.applies === "peer start" ? "applies at the peer's next start" : "applies at the next hub start"})` };
+      recordSetting(def.key, from, to, source, false, reason);
+      if (def.type === "roles") { prepareRoleSelection(def.path[1]!); event({ type: "role", peer: def.path[1]!, actor: "user", stage: "assigned", roles: selectedRoles(def.path[1]!, config.roles, roleAssignments, catalog).map(roleIdentity) }); }
+      const timing = def.applies === "live" ? "in force now" : def.applies === "restart" ? "pending restart"
+        : ["permission_modes", "catalog_roles", "peers"].includes(def.path[0]!) ? "applies at the peer's next start" : def.key === "coordination" ? "applies to new tasks" : "applies at next use";
+      return { ok: true, text: `${def.key}: ${settingText(to)} (${timing})` };
     } catch (error) {
-      return { ok: false, error: (error as Error).message };
+      return { ok: false, error: sanitize((error as Error).message), ...(saved ? { saved: true } : {}) };
     }
   }
-  /** A pin the hub could not start with: refused before a write or an undo puts it on disk. */
-  // As at hub start: with no project routing.toml only a pin the overlay sets counts, never the shipped template's own.
-  const routingCheck = (routing: Routing) => { const problem = config.mlx.enabled === false ? mlxPinProblem(routing, existsSync(join(opts.cwd, ".agenthub", "routing.toml"))) : undefined; if (problem) throw new Error(problem); };
-  async function settingsUndo(authority: SettingAuthority, confirm?: unknown, now?: unknown): Promise<Record<string, unknown>> {
+
+  async function settingsUndo(authority: SettingAuthority, confirm?: unknown, now?: unknown, rawReason?: unknown, expectedKey?: unknown, expectedDigest?: unknown): Promise<Record<string, unknown>> {
+    if (stopping || recoveryActive()) return { ok: false, error: "recovery or shutdown is holding settings" };
+    let reason: string | undefined;
+    try { reason = settingReason(rawReason); } catch (error) { return { ok: false, error: (error as Error).message }; }
     // The previous version can hold a wider value than the one in force, so undo is never an ordinary session's.
     if (authority === "ordinary") return { ok: false, error: "undo can put back a value that widens what agents do without asking: open a settings session with ahub ui --settings, or use ahub settings undo in a terminal" };
-    const def = settingDef(pendingUndo(opts.stateDir));
-    if (typeof def === "string") return { ok: false, error: "nothing to undo" };
-    if (def.group === "Roster") return changeRosterSetting(def, null, settingSource(authority), confirm, now === true, true);
+    const identity = pendingUndoIdentity(opts.stateDir);
+    if (expectedKey !== undefined || expectedDigest !== undefined) {
+      if (typeof expectedKey !== "string" || !expectedKey || typeof expectedDigest !== "string" || !/^[a-f0-9]{64}$/.test(expectedDigest)) return { ok: false, error: "invalid undo preview identity; preview again; nothing was undone" };
+      if (!identity || identity.key !== expectedKey || identity.undoDigest !== expectedDigest) return { ok: false, error: "undo record changed since preview; preview again; nothing was undone" };
+    }
+    const def = settingDef(identity?.key);
+    if (typeof def === "string" || !identity) return { ok: false, error: "nothing to undo" };
+    if (def.group === "Roster") return changeRosterSetting(def, null, settingSource(authority), confirm, now === true, true, authority, reason, identity);
     if (rosterChanging) return { ok: false, error: `roster change for ${rosterChanging} is in progress` };
-    const read = (): SettingValue => def.store === "routing" ? routingValue(currentRouting(opts.cwd, log), def) : settingScalar(valueAt(storedConfig(), def.path));
+    const read = (): SettingValue => def.store === "routing" ? routingValue(activeRouting(), def) : settingScalar(valueAt(storedConfig(), def.path));
     // never-ask is set with its confirmation, never put back by an undo that carries none.
     if (def.group === "Permissions" && restoredValue(opts.cwd, opts.stateDir, def) === "never-ask") return { ok: false, error: `undo would put never-ask back for ${def.path.at(-1)} without its confirmation: set ${def.key} again (never-ask, or inherit where the shared file holds it) with the confirmation instead; nothing was undone` };
     try {
       const from = read();
-      undoSetting(opts.cwd, opts.stateDir, (scratch) => def.type === "roles" ? validateRoleSetting(scratch, def.path[1]!) : loadConfig(scratch), routingCheck);
-      storedConfigCache = undefined;
-      if (def.type === "roles") applyRoleSelection(def.path[1]!); else applyStartModes();
-      recordSetting(def.key, from, read(), settingSource(authority), true);
-      if (def.type === "roles") event({ type: "role", peer: def.path[1]!, actor: "user", stage: "assigned", roles: selectedRoles(def.path[1]!, config.roles, roleAssignments, catalog).map(roleIdentity) });
+      undoSetting(opts.cwd, opts.stateDir, scratch => configWriteCheck(scratch, authority, def.path.join(".")), (_routing, overlay) => routingWriteCheck(authority, overlay, def.key), identity);
+      const result = await reloadConfig(authority, def.store === "routing" ? def.key : def.path.join("."));
+      if (result.ok !== true) return { ...result, saved: true };
+      recordSetting(def.key, from, read(), settingSource(authority), true, reason);
+      if (def.type === "roles") { prepareRoleSelection(def.path[1]!); event({ type: "role", peer: def.path[1]!, actor: "user", stage: "assigned", roles: selectedRoles(def.path[1]!, config.roles, roleAssignments, catalog).map(roleIdentity) }); }
       return { ok: true, text: `${def.key}: put back to ${settingText(read())}` };
     } catch (error) {
       return { ok: false, error: (error as Error).message };
@@ -3611,21 +4281,21 @@ export async function startDaemon(opts: DaemonOptions) {
     if (def.group === "Roster") {
       try {
         const peer = def.path[1]!, next = rosterCandidate(def, value), on = rosterAllows(next, peer, config.pi.enabled);
-        return { ok: true, lines: [`${peer}: ${onRoster(peer) ? "on" : "off"} -> ${on ? "on" : "off"} roster`, ...(on ? ["Admission, starts and new work become available; any existing pause or held delivery remains."] : [`${bus.queued(peer)} queued messages are retained until the peer returns.`, "Owned runtimes stop; native terminal sessions detach. Open tasks are offered to another eligible peer.", ...(retainedTerminalNotice(peer) ? [retainedTerminalNotice(peer)!] : []), ...tasks.rosterPreview(peer).map(move => sanitize(`task ${move.title}: ${move.to ? `${move.role} offered to ${move.to} if removed now` : `${move.role} stays with ${peer}; no eligible replacement`}`)), ...(rosterRemovalRefusal(peer, false) ? [rosterRemovalRefusal(peer, false)!] : [])])], ...(on ? {} : { confirm: peer }) };
+        return { ok: true, lines: [`${peer}: ${onRoster(peer) ? "on" : "off"} -> ${on ? "on" : "off"} roster`, ...(on ? ["Admission, starts and new work become available; any existing pause or held delivery remains."] : [`${bus.queued(peer)} queued messages are retained until the peer returns.`, "Owned runtimes stop; native terminal sessions detach. Open tasks are offered to another eligible peer.", `For a busy peer, use ahub roster remove ${peer} --now explicitly; this stops its owned runtime or detaches its native session during the active turn.`, ...(retainedTerminalNotice(peer) ? [retainedTerminalNotice(peer)!] : []), ...tasks.rosterPreview(peer).map(move => sanitize(`task ${move.title}: ${move.to ? `${move.role} offered to ${move.to} if removed now` : `${move.role} stays with ${peer}; no eligible replacement`}`)), ...(rosterRemovalRefusal(peer, false) ? [rosterRemovalRefusal(peer, false)!] : [])])], ...(on ? {} : { confirm: peer }) };
       } catch (error) { return { ok: false, error: sanitize((error as Error).message) }; }
     }
     if (def.key === "scoped_grants.protect_instructions") return { ok: true, lines: ["Applies now to scoped writes and edits of AGENTS.md, CLAUDE.md and QWEN.md, including symlinks and folded spellings.", "true asks a person; false keeps these documents grantable (the default). Explicit approval and never-ask keep their meaning."] };
     if (def.group === "Permissions") {
       const peer = def.path.at(-1)!;
-      return { ok: true, lines: [permissionBoundary(peer), ...(isPermissionMode(value) ? [`${value}: ${permissionGrant(peer, value)}`] : ["inherit: the shared file's default, or ask"])] };
+      return { ok: true, lines: [permissionBoundary(peer), ...(isPermissionMode(value) ? [`${value}: ${permissionGrant(peer, value)}`] : ["inherit: the shared file's default, or ask"])], ...(value === "never-ask" || value === null && restoredValue(opts.cwd, opts.stateDir, def, true) === "never-ask" ? { confirm: peer } : {}) };
     }
-    if (def.store !== "routing") return { ok: true, lines: [`${def.key}: ${settingText(value)}; ${def.applies === "peer start" ? "applies at the peer's next start" : "read at the next hub start"}`] };
+    if (def.store !== "routing") return { ok: true, lines: [`${def.key}: ${settingText(value)}; ${def.applies === "next use" ? "applies at next use" : def.applies === "live" ? "in force as soon as it is saved" : "pending restart"}`] };
     try {
       const after = parseRouting(routingText(opts.cwd), routingCandidate(readOverlay(opts.cwd), def, value));
-      const open = board.list().filter((task) => task.state !== "approved");
+      const open = board.list().filter((task) => !isClosedTaskState(task.state));
       // A PII task's routing is fixed by its constraint and its text is private: it is counted, not shown.
       const shown = open.filter((task) => !tasks.isPii(task)).slice(0, 20);
-      return { ok: true, lines: [`${def.key}: ${settingText(routingValue(currentRouting(opts.cwd, log), def))} -> ${settingText(routingValue(after, def))}`, ...(open.length ? [] : ["no open task: nothing is routed differently now"])],
+      return { ok: true, lines: [`${def.key}: ${settingText(routingValue(activeRouting(), def))} -> ${settingText(routingValue(after, def))}`, ...(open.length ? [] : ["no open task: nothing is routed differently now"])],
         tasks: shown.map((task) => ({ id: task.id, before: tasks.publicExplain(task.id), after: tasks.publicExplain(task.id, after) })),
         ...(open.length > shown.length ? { hidden: open.length - shown.length } : {}) };
     } catch (error) {
@@ -3633,6 +4303,14 @@ export async function startDaemon(opts: DaemonOptions) {
     }
   }
 
+  function settingsUndoPreview(): Record<string, unknown> {
+    const identity = pendingUndoIdentity(opts.stateDir), def = settingDef(identity?.key);
+    if (typeof def === "string" || !identity) return { ok: false, error: "nothing to undo" };
+    const value = restoredValue(opts.cwd, opts.stateDir, def), preview = settingsPreview(def.key, value ?? null);
+    if (pendingUndoIdentity(opts.stateDir)?.undoDigest !== identity.undoDigest) return { ok: false, error: "undo record changed during preview; preview again" };
+    return { ...preview, ...identity, lines: [`Undo ${def.key}: put back ${settingText(value)}`, ...(Array.isArray(preview.lines) ? preview.lines : []), "The saved previous machine-local file is revalidated before writing."] };
+  }
+
   async function uiAction(a: Record<string, unknown>, session?: DashboardSession): Promise<unknown> {
     const bad = { ok: false, error: "invalid or unavailable dashboard action" };
     // #269: a session opened by `ahub ui --settings` may raise authority while its window lasts; any other may not.
@@ -3711,11 +4389,13 @@ export async function startDaemon(opts: DaemonOptions) {
         return { ok: false, error: `${a.peer} did not start; inspect ahub status and hub.log` };
       }
       case "setting":
-        return settingsSet(a.key, a.value, authority, a.confirm, a.now);
+        return settingsSet(a.key, a.value, authority, a.confirm, a.now, a.reason);
       case "setting_undo":
-        return settingsUndo(authority, a.confirm, a.now);
+        return settingsUndo(authority, a.confirm, a.now, a.reason, a.key, a.undoDigest);
       case "setting_preview":
-        return settingsPreview(a.key, a.value);
+        return a.undo === true ? settingsUndoPreview() : settingsPreview(a.key, a.value);
+      case "setting_reload":
+        return reloadConfig(authority);
       default:
         return bad;
     }
@@ -3735,6 +4415,7 @@ export async function startDaemon(opts: DaemonOptions) {
       // #272: the rest of what recoveryReady() waits for, so the upgrade screen can name the wait. Display only.
       ...(taskOpsInFlight !== 0 ? ["a task command in flight"] : []),
       ...(tasks.checksPending() !== 0 ? ["completion checks queued or running"] : []),
+      ...(checkPending.size !== 0 ? ["isolated checks queued or running"] : []),
       ...((piReceipts?.inFlight ?? 0) !== 0 ? ["Pi tool calls in flight"] : []),
       ...(releasing ? ["ready tasks being released"] : []),
       ...([...bus.peers].filter(([, peer]) => peer instanceof PiPeer && peer.state !== "busy" && !peer.recoveryReady).map(([id, peer]) => !membershipAllowed(id) && peer instanceof PiPeer && peer.mode === "tui" ? `${id} is not settled; end the retained Pi TUI, then prepare again` : `${id} is not settled`)),
@@ -3750,10 +4431,19 @@ export async function startDaemon(opts: DaemonOptions) {
   async function recoveryOp(msg: any): Promise<Record<string, unknown>> {
     if (typeof msg.op !== "string" || !["inspect", "prepare", "commit", "abort", "release"].includes(msg.op)) return recoveryError("unknown recovery operation");
     if (typeof msg.expectedInstanceId !== "string" || msg.expectedInstanceId !== instanceId) return recoveryError("expected daemon instance does not match");
+    const incompatibleCancellationTarget = () => {
+      const ids = board.list().filter(task => task.state === "cancelled").map(task => task.id);
+      return ids.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("task_cancel"))
+        ? `target lacks task_cancel; cancelled tasks: ${ids.map(id => `#${id}`).join(", ")}` : undefined;
+    };
+    const checkTarget = msg.op === "prepare" || msg.op === "commit" || msg.op === "inspect" && msg.targetFeatures !== undefined;
+    if (checkTarget) { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
+
     if (msg.op === "inspect" || msg.op === "prepare" || msg.op === "commit") {
       const pi = bus.peers.get("pi");
       if (pi instanceof PiPeer && pi.state === "idle") {
         try { await pi.captureResume(); } catch (error) { return recoveryError((error as Error).message); }
+        if (checkTarget) { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
       }
     }
     if (msg.op === "inspect" && msg.operationId === undefined) return { t: "recovery", ok: true, recovery: recoveryView() };
@@ -3769,6 +4459,7 @@ export async function startDaemon(opts: DaemonOptions) {
         recoveryPeerSnapshot = undefined;
       }
       if (recoveryOperationId && recoveryOperationId !== op) return recoveryError("another recovery operation is active");
+      { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
       recoveryOperationId = op;
       if (!recoveryPhase) recoveryPhase = "preparing";
       armRecoveryLease();
@@ -3776,6 +4467,7 @@ export async function startDaemon(opts: DaemonOptions) {
       budget.setRecoveryHold(true);
       bus.setRecoveryHold(true);
       await bus.fenceRecovery();
+      { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
       const blocked = [...bus.peers].filter(([, peer]) => peer.state === "busy").map(([id]) => id);
       if (!blocked.length && permissions.size === 0 && recoveryReady()) {
         recoveryPeerSnapshot ??= Object.values(recoveryPeers());
@@ -3823,6 +4515,7 @@ export async function startDaemon(opts: DaemonOptions) {
         peers,
         integrity: integrity(),
       };
+      { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
       try { writeRestartSnapshot(opts.stateDir, snapshot); } catch { return recoveryError("could not persist restart state"); }
       recoveryCommitted = true;
       clearTimeout(recoveryLeaseTimer);
@@ -4009,7 +4702,7 @@ export async function startDaemon(opts: DaemonOptions) {
           if (important) ws.notifyQueued({ queued: bus.queued(c.peer!), important });
         });
       }
-      return void reply({ t: "welcome", projectId, instanceId, cwd: opts.cwd, protocol: PROTOCOL });
+      return void reply({ t: "welcome", projectId, instanceId, cwd: opts.cwd, protocol: PROTOCOL, features: DAEMON_FEATURES });
     }
     if (stopping && msg.t !== "status" && msg.t !== "kill") return void reply({ ok: false, error: "hub is stopping" });
     if (c.role !== "console" && c.peer && !membershipAllowed(c.peer)) return void reply({ ok: false, error: `${c.peer} is off roster` });
@@ -4048,11 +4741,19 @@ export async function startDaemon(opts: DaemonOptions) {
           return void reply({ ok: true, delivery: queueView(bus.queueShow(msg.id)) });
         } catch { return void reply({ ok: false, error: "resolution refused: refresh the delivery revision and inspect active or already resolved work" }); }
       }
+      case "delivery_holds": {
+        if (!c.peer || (c.role !== "peer" && c.role !== "tools")) return void reply({ ok: false, error: "held metadata requires a peer identity" });
+        try {
+          const held = bus.heldDeliveryHints(c.peer);
+          return void reply(held ? { ok: true, held } : { ok: false, error: "held metadata unavailable" });
+        } catch { return void reply({ ok: false, error: "held metadata unavailable" }); }
+      }
       case "delivery_receipt": {
         const peer = c.peer ? bus.peers.get(c.peer) : undefined;
-        if (c.role !== "peer" || !(peer instanceof WsPeer) || typeof msg.deliveryId !== "string" || !peer.ownsDelivery(sock, msg.generation, msg.deliveryId) || !["accepted", "needs_review"].includes(msg.state)) return void reply({ ok: false, error: "invalid delivery receipt" });
+        if (c.role !== "peer" || !(peer instanceof WsPeer) || typeof msg.deliveryId !== "string" || !peer.ownsDelivery(sock, msg.generation, msg.deliveryId) || !["accepted", "needs_review", "failed_safe"].includes(msg.state)) return void reply({ ok: false, error: "invalid delivery receipt" });
+        if (msg.state === "failed_safe" && (!peer.pullOnly || bus.queueShow(msg.deliveryId)?.state !== "dispatching")) return void reply({ ok: false, error: "safe failure requires an unseen push to a pull-only session" });
         const reason = typeof msg.reason === "string" ? sanitize(msg.reason).replace(/\s+/g, " ").trim().slice(0, 300) : "";
-        bus.deliveryReceipt(peer.id, { id: msg.deliveryId, state: msg.state, ...(msg.state === "needs_review" ? { reason: reason || "Claude bridge could not confirm notification delivery" } : {}) });
+        bus.deliveryReceipt(peer.id, { id: msg.deliveryId, state: msg.state, ...(msg.state !== "accepted" ? { reason: reason || "Claude bridge could not confirm notification delivery" } : {}) });
         return void reply({ ok: true });
       }
       case "inbox": {
@@ -4285,7 +4986,7 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       case "watch": {
         if (c.role !== "console") return void reply({ ok: false, error: "watch is a person-only console command" });
-        if (msg.peer !== "kimi" && msg.peer !== "qwen") return void reply({ ok: false, error: "watch supports headless kimi and qwen only" });
+        if (typeof msg.peer !== "string" || !definitionOf(msg.peer)?.capabilities?.watch) return void reply({ ok: false, error: "watch supports headless kimi and qwen only" });
         const peer = msg.peer as "kimi" | "qwen";
         // Judged by the live owner: a headless Kimi started by --mode headless is watchable under a TUI start mode.
         const kimiOwner = bus.peers.get("kimi");
@@ -4358,16 +5059,19 @@ export async function startDaemon(opts: DaemonOptions) {
       case "settings_get":
         if (c.role !== "console") return void reply({ ok: false, error: "settings are a person's: run ahub settings in a terminal" });
         return void reply({ ok: true, ...settingsView(), roster: rosterView() });
+      case "settings_reload":
+        if (c.role !== "console") return void reply({ ok: false, error: "settings are a person command" });
+        return void reloadConfig("terminal", undefined, msg.confirm).then(reply, () => reply({ ok: false, error: "configuration reload could not be confirmed; inspect hub.log" }));
       case "settings_preview":
         if (c.role !== "console") return void reply({ ok: false, error: "settings are a person's: run ahub settings in a terminal" });
-        return void reply(settingsPreview(msg.key, msg.value));
+        return void reply(msg.undo === true ? settingsUndoPreview() : settingsPreview(msg.key, msg.value));
       case "settings_set":
         if (c.role !== "console") return void reply({ ok: false, error: "settings are a person's: run ahub settings in a terminal" });
-        void settingsSet(msg.key, msg.value, "terminal", msg.confirm, msg.now).then(reply, () => reply({ ok: false, error: "the setting could not be changed; inspect hub.log" }));
+        void settingsSet(msg.key, msg.value, "terminal", msg.confirm, msg.now, msg.reason).then(reply, () => reply({ ok: false, error: "the setting could not be changed; inspect hub.log" }));
         return;
       case "settings_undo":
         if (c.role !== "console") return void reply({ ok: false, error: "settings are a person's: run ahub settings in a terminal" });
-        return void settingsUndo("terminal", msg.confirm, msg.now).then(reply, () => reply({ ok: false, error: "the setting could not be undone; inspect hub.log" }));
+        return void settingsUndo("terminal", msg.confirm, msg.now, msg.reason, msg.key, msg.undoDigest).then(reply, () => reply({ ok: false, error: "the setting could not be undone; inspect hub.log" }));
       case "kimi_launch_end": {
         if (c.role !== "console") return void reply({ ok: false, error: "Kimi launch cleanup is console only" });
         if (typeof msg.admissionId === "string" && msg.admissionId === kimiAdmissionId) clearKimiAdmission();
@@ -4424,7 +5128,7 @@ export async function startDaemon(opts: DaemonOptions) {
           board,
           isPii: (t) => tasks.isPii(t),
           onCampus,
-          isPiiText: (q) => currentRouting(opts.cwd, log).constraints.pii === "local_only" && detectSignals({ title: q, detail: "", refs: {} }, currentRouting(opts.cwd, log), opts.cwd).includes("pii"),
+          isPiiText: (q) => activeRouting().constraints.pii === "local_only" && detectSignals({ title: q, detail: "", refs: {} }, activeRouting(), opts.cwd).includes("pii"),
           ...(config.memory.enabled ? { memory } : {}),
           // #258: entries that match the question, then the graph neighbourhood of what they are about.
           ...(memoryStore ? { native: (keys: string[]) => {
@@ -4501,6 +5205,7 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   async function stopOnce(): Promise<void> {
     stopping = true;
+    runnerRefreshAbort.abort();
     // A stop someone asked for is not a crash, even if it then runs past the shutdown deadline: forget the sessions now.
     try { removeSessions(opts.stateDir, instanceId); } catch { /* the state dir is gone */ }
     checksClosed = true;
@@ -4508,12 +5213,16 @@ export async function startDaemon(opts: DaemonOptions) {
     log("hub stopping");
     writeStatus();
     dashboard?.stop();
+    stopConfigWatch();
+    clearInterval(sweepTimer);
     for (const i of intervals) clearInterval(i);
     for (const pending of checkpointWaits.values()) pending.done(undefined);
     for (const p of permissions.values()) p.done(undefined);
     try {
       // A peer can still be inside memory recall or its native handshake when kill arrives.
       // Drain those starts before taking the final owned-process snapshot.
+      // Fence/abort the runner now, but slow container teardown must not consume the peer-stop deadline.
+      const runnerStopped = Promise.allSettled([checkRunner.stopAll(), refreshingRunner ?? Promise.resolve()]);
       await Promise.allSettled([...starting.values()]);
       // A fingerprint still being detected belongs in the research records written below; its peer must still be
       // attached when it settles, so this comes before the peers stop (each detection is bounded by its probe deadline).
@@ -4522,6 +5231,7 @@ export async function startDaemon(opts: DaemonOptions) {
       // A peer whose stop rejects must not strand the daemon (issue #56): its failure is
       // logged and shutdown finishes anyway, or the process ignores SIGTERM forever.
       for (const exit of exits) if (exit.status === "rejected") log(`peer stop failed during shutdown: ${(exit.reason as Error)?.message ?? exit.reason}`);
+      await runnerStopped;
       await modelRelay?.close();
       await egress?.close();
       await piReceipts?.close();
@@ -4566,9 +5276,21 @@ export async function startDaemon(opts: DaemonOptions) {
   writeFileSync(tokenFile, token, { mode: 0o600 });
   chmodSync(tokenFile, 0o600);
   budget.restore(); // pauses recorded by an earlier hub run stay in force; unfinished handoffs wait for peers to attach
-  writeStatus(); // #226: no hub.pid any more; status.json carries the pid with its signature
+  bus.onQueues(); // initial restored holds are reported only after the listener is bound; writes status.json too
   log(`${RUN_START}${process.pid} control=127.0.0.1:${server.port} cwd=${opts.cwd}`);
   ready = true;
+  for (const name of CONFIG_SOURCE_FILES) {
+    const path = join(opts.cwd, ".agenthub", name);
+    const listener = (current: import("node:fs").Stats, previous: import("node:fs").Stats) => {
+      if (stopping || current.mtimeMs === previous.mtimeMs && current.size === previous.size && current.ino === previous.ino && current.nlink === previous.nlink) return;
+      clearTimeout(reloadDebounce);
+      reloadDebounce = setTimeout(runConfigWatch, 100);
+      reloadDebounce.unref?.();
+    };
+    watchFile(path, { persistent: false, interval: 100 }, listener);
+    configWatchers.push({ path, listener });
+  }
+  startupCleanup.push(stopConfigWatch);
   // #258: approvals whose settle entry a crash cut off are settled now (decisions, contracts and fails reach long-term).
   try { const settled = tasks.reconcileMemory(); if (settled) log(`hub memory: settled ${settled} approved task${settled === 1 ? "" : "s"} a stop had left unsettled`); }
   catch (e) { log(`hub memory reconciliation failed: ${(e as Error).message}`); }
@@ -4594,7 +5316,7 @@ export async function startDaemon(opts: DaemonOptions) {
     });
   }
   // After a crash that recorded Pi, crash recovery starts it (#66): its recorded session first, a fresh one if that fails.
-  const piRecovered = !!crashed?.peers.some((p) => p.peer === "pi");
+  const piRecovered = !archivedPiContinuity && !!crashed?.peers.some((p) => p.peer === "pi");
   if (piAutoStart() && !recoveryActive() && !piRecovered) autoStartPi();
   return { bus, token, port: server.port as number, stop, stopped: new Promise<void>((r) => (onStop = r)) };
   } finally {