@staix/agent-hub 0.12.32 → 0.12.33

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.12.33
+
+Upgrades with cancelled tasks and a managed terminal no longer stop at the lease renewal, and a notice the target sends right after it starts no longer blocks queue verification (#478). The upgrade runs with the target release's own coordinator, so an upgrade from 0.12.32 to this release already uses these fixes. A real upgrade with a managed TUI and cancelled rows (#478) and installed managed-Pi #418 AC8 (#142) remain unverified by this release preparation. Installation and the person's restart require separate receipts.
+
+- Preserve target capabilities on recovery lease renewals, defer hub notices until held queue verification finishes, and show recorded blocked errors (#478).
+- Discard deferred notices on reset, retry expired recovery leases after storage failures, and keep abort/archive available for corrupt snapshots (#478).
+
 ## 0.12.32
 
 Settings now reload without a restart where their apply class allows it, and settings changed by an agent never adopt guarded or machine-local values without a person's confirmed reload (#439). The upgrade runs with the target release's own coordinator, so this upgrade already uses the new reattach, continuity and screen changes (#463, #466). The first-party memory pin stays `@staix/agent-mem` 0.3.1; the curated shard migration merged in agent-mem is not released and must not be run before the hub opens memory through shards (#175). Native real-terminal console settings (#439 AC5), a real Orca upgrade with reattach (#463), installed managed-Pi #418 AC8 (#142) and #438 AC7 remain unverified by this release preparation. Installation and the person's restart require separate receipts.

package/README.md

@@ -5,7 +5,7 @@ Codex, Kimi Code, Pi and a hub-owned local worker (Qwen Code and Jcode optional)
 share a message bus and a task board per project and one memory on the machine,
 each attached through its own native interface.
 
-Status: 0.12.32, control protocol 16. Bun + TypeScript, one loopback daemon per
+Status: 0.12.33, control protocol 16. Bun + TypeScript, one loopback daemon per
 project. Site: [agent-hub.staix.net](https://agent-hub.staix.net).
 
 ## What it does today
@@ -77,15 +77,16 @@ cd <your project> && ahub init && ahub up
 
 After upgrading from 0.12.30 or earlier, run `ahub jcode --mode headless` once in each
 project that uses Jcode to refresh its owned MCP entry before conductor or dashboard
-starts of Jcode. The entry's format is unchanged in 0.12.32; a daemon start that still
+starts of Jcode. The entry's format is unchanged in 0.12.33; a daemon start that still
 reports the entry missing or stale is fixed by the same command.
 Cancellation needs a daemon advertising `task_cancel`; controlled downgrades
 refuse while cancelled rows exist. For local/Pi implementation, opt in to an
 available `checks.runner = "container"`; issue-backed owners also need authenticated
 spec access. PII work and designated reviewers retain their separate exemptions.
-See [release verification](docs/verification/2026-10-18-0.12.32.md) for the live legs
-still open, including #418 AC8, #438 AC7, the native console settings leg (#439 AC5)
-and a real upgrade with reattach (#463).
+See [release verification](docs/verification/2026-10-18-0.12.33.md) for the live legs
+still open, including #418 AC8, #438 AC7, the native console settings leg (#439 AC5),
+a real upgrade with reattach (#463) and a real upgrade with a managed terminal and
+cancelled tasks (#478).
 
 Before migrating a memory home with `amem`, upgrade every hub using that home to
 0.12.30 or later, check `ahub memory profile-check`, then quiesce and close all memory

package/docs/agent-notes/bus.md

@@ -21,6 +21,8 @@ Scope: delivery, digests and condensation, reply addressing, priority and limits
 - Observe memory rendering from final `out`, not `originals`, and suppress telemetry when either contains private envelopes. A pull emits rendered/delivered observations only after its journal transaction commits; observer exceptions must never change delivery settlement.
 - Classify automatic held-row completion only through `supersededDeliveryReason`: every original must be a hub presence or a provably moot hub task/review notice. Unknown/live/mixed rows stay held; keep `deliveryTaskContext` display-only. Tag only current-owner notices as owner audience; leave former-owner withdrawals untagged until the task closes. For cancelled tasks, settle earlier workflow notices but retain the stop notice whose `refs.taskCancelled` matches the cancellation revision. Preserve the requested-stop exclusion in `daemon.md`. Record the hub actor through `resolveDelivery`, restoring presence originals through `restorePreface` only for hub completion (person completion stays consumed); run on hold entry, restore, recovery release and board changes, never replay uncertain work. List every hold once in status, console notices and route explanations (#434).
 - `resolveDelivery` mutates queues in place; a refused or failed resolution puts back only that peer's queue and preface and keeps every pause. Never reload a snapshot on a live bus. Keep the selected delivery id and journal revision fixed in console row actions; retry/discard/completed never change a task role or cancel a native turn.
+- Recovery-deferred hub notices (`deferredHub`, #478) are accepted work kept outside the queues and the carried-queue integrity projection: never put them in `queues` or the integrity view while held. Every read of pending work includes them (`pendingEnvelopes`, `withdraw`, `revokeSupervision`, `queuedBacklogIds`, `get`, reset). Past `MAX_DEFERRED_HUB` refuse the publish; never drop a kept notice.
+- Release moves each deferred notice through `publishNow` and checkpoints it before delivery, events or nudges run. A failed checkpoint restores only publication state (the affected queue arrays in place, deferred, seen and withdrawn ids, pending outcomes) and keeps the hold. Never reload a snapshot or touch prefaces, pauses or the recovery mode from it.
 - Do not offer recipient retry to delivery-only local/ACP transports or pass ordinary messages through their hold; their hints direct the person to resolve. Keep current-adapter refusal authoritative and the ephemeral MCP exposure marker advisory; pull-only Kimi TUI retains retry.
 - Route peer retry only through `retryDelivery`: scope explicit-retry history by peer and immutable original ids across all grouped parents, commit monotone consumed-proof inheritance for every grouped non-context original with the checkpoint while keeping resolution audit rows unchanged; exclude hub `presence` originals from every retry proof, warning, inheritance and unknown-marking path, preserve unknown imported lineage fences without disabling fresh work, and admit busy-peer consent only to requeue its own `needs_review` row. Decorate rendered clones after condensation/pull/steer, never originals; reserve the shared journal body cap for the warning and an explicit Unicode-safe cut marker. Keep held hints bounded, body-free and advisory; metadata failure never changes a saved tool result or refusal class (#434).
 - `restore` takes queued work from the journal, never from the committed snapshot once the journal has state (an empty journal, revision 0, is seeded from the commit): from the commit only an empty queue key is carried over, for an offline peer whose key no delivery ever persisted (#234). Never resurrect a non-empty queue from it.

package/docs/agent-notes/daemon.md

@@ -20,7 +20,8 @@ Scope: the operator console, control WS and its protocol, state files, the dashb
 - Close 4000 is the one close that ends on its own, so it is not in `TERMINAL_CLOSES`: the session stands by and reconnects only once `status.json` reports the peer offline and not `claiming`. One exception (#205, `peerHeld` in `claude-channel.ts`): a session with channel pushes also reconnects when the holder is reported `toolsOnly` and not `claiming`, and takes the peer; the daemon refuses the reverse with 4000. Reconnecting blind would evict whoever holds the id now, and the two would trade it forever. `claim()` happens at hello and `attach()` only after the preface, so the peer reads as offline in between: the daemon writes the status file at the claim and the flag covers that window.
 - Adding a native peer requires testing the command emitted by the actual recovery driver, not only its inspection or launch helpers. Never let a generic non-Codex branch treat a new peer as Claude.
 - Cross-version recovery must use the authenticated source protocol for prepare/commit/abort and the target protocol after startup. Prove the transition against a real prior release before claiming compatibility.
-- Preserve `task_cancel` target-feature preflight before source holds, capture or commit. Reuse stored target features only after verifying the same retained root and digest; legacy receipts still capable of commit must obtain feature proof. Do not apply pre-commit compatibility checks to sources already past commit.
+- Preserve `task_cancel` target-feature preflight before source holds, capture or commit. Reuse stored target features only after verifying the same retained root and digest; legacy receipts still capable of commit must obtain feature proof. Do not apply pre-commit compatibility checks to sources already past commit. Every prepare, including the lease renewal before a terminal close and after a resume, sends the operation's stored `targetFeatures` (#478).
+- Defer hub notices only for an authenticated recovery `prepare` or `commit` whose target features include `recovery_deferred_hub`, or for a restored daemon. Otherwise `setRecoveryHold(true)` moves the deferred notices into queues before commit records expected integrity, and a bare `fenceRecovery` defers nothing. Abort and lease expiry release the bus hold before clearing the operation; if that release fails, keep the operation and let expiry retry on its 1 s timer (#478).
 - Resume a prepared `commitSent` source that is unavailable or database-busy inside the existing bounded shutdown poll; never re-send commit, re-prepare or close terminals again on that path. Require confirmed `stopped` before target startup, refuse a replacement instance, and retain the prepared receipt on timeout.
 - Keep restoration receipts explicitly tagged as pending, waiting with origin/binding, done with binding, or failed. Project waiting origins as `waiting:pending` and `waiting:failed`; preserve the chosen binding and origin across interruption instead of inferring completion from an object.
 - A zero-turn Claude session has no transcript, so it can never be resumed: every identity gate that compares session ids (restore, coordinator verify, daemon readiness) must tolerate a fresh session while the transcript is absent and stay strict the moment one exists. The commit snapshot records `sessionPersisted` for the restored daemon, and snapshots too old to have it are re-derived from disk. Never treat "session id changed" as proof of a lost conversation without checking the transcript first. A post-restore detachment repair (#463) is bound to its last accepted session even when its transcript is absent; never use the zero-turn exception to replace that recorded conversation.
@@ -33,9 +34,10 @@ Scope: the operator console, control WS and its protocol, state files, the dashb
 - Four checks read another release's source text for an exact line: `coordinatorCurrent` (`export async function disposeRecovery` in `src/cli/upgrade.ts`), `targetReadsWaivers` (`export function readRecoveryWaivers` in `src/hub/restart.ts`), `coordinatorRestarts` (`export function recordRestart` in `src/cli/upgrade.ts`) and `supportsAction` (`export async function reattachRecovery` in `src/cli/upgrade.ts`). Renaming, moving or un-exporting one makes this release read as an older one: keep those lines until a capability list replaces the checks. The reattach CLI dispatch must use the same `supportsAction` check as its printed command; never redirect a fallback command back to a coordinator without that action.
 - `reattachRecovery` (`src/cli/upgrade.ts`, #463) relaunches only the peer a blocked receipt's `blockedReattachment` names, once per its `reattachments` marker, after the lock, the runner claim and a re-read, and only against the same held target instance and version. The terminal proof is `inspectSavedTerminal` (`src/cli/terminal-recovery.ts`): only `orphaned` or `missing` (a typed stale handle and a complete, untruncated inventory) counts as gone; `unknown`, `changed` or a disconnected-only reading never authorizes a terminal. It counts as reattached only on a `done` restore receipt with the exact recorded session id, session file and project root, then leaves the operation blocked for `recovery resume`. It is person-only: `classifyPeerCommand` and `liveTestRefusal` refuse it from an agent shell.
 - The interactive screens (`src/cli/upgrade-interactive.ts`, #272) change an operation only by running an existing command (`recovery resume|abort|dispose|reattach`, `reset`) through `io.run`, and build their menu from `nextChoices`, whose text is `nextActions`: never call `abortRecovery`, `disposeRecovery` or a driver from a screen, and never offer a choice `next` does not have. The one addition is `cancellableWait` (a runner still at `prepare` with no effect): read the receipt again at the key press, stop only a runner `signedRunner` names (a claim without a matching process signature is never signalled), then run `recovery abort`, which decides again. Agents are ended (`endPlannedPeer`) only before an operation holds the lock, and only after the lock, the hub instance, the attached session and the terminal's handle and incarnation were read again: never on the plan as it was drawn. Ctrl+C leaves the screens and the terminal is not read after it; a prompt answers an interrupt with null, never text. What a hub says it waits for (`recovery.waiting`, the daemon's `blockers`) is shown, never decided on.
-- Recovery presentation (#466, `src/cli/upgrade-presentation*.ts`) only renders, and only when `humanRecovery` holds (a TTY and no `--json`); `--json` stays the raw document. Recognise `--json`, `--verbose` and `--color=` only through `recoveryPresentationFlag` (`src/cli/recovery-presentation-options.ts`), which `liveTestRefusal` and `classifyPeerCommand` share, so a presentation flag cannot hide reattach or a repaired dispose from authorization. A screen's Enter default (`preferred`) is read-only (refresh, follow the runner, read the receipt); apply, resume, reattach and destructive choices need their own key, and an item with a `disabledReason` never runs. The receipt's `waits` and `presentationCause` describe the current attempt only: written best-effort (a failed timing save warns, never fails the operation or replaces the wait's own error) and cleared at each resume. Without them show `timing unknown` or an unknown cause; never substitute `updatedAt` or guess a cause from error text. `endInspection` (the completion and stop-and-archive summary) only inspects, and a failed reading is `runtime unknown`.
+- Recovery presentation (#466, `src/cli/upgrade-presentation*.ts`) only renders, and only when `humanRecovery` holds (a TTY and no `--json`); `--json` stays the raw document. Recognise `--json`, `--verbose` and `--color=` only through `recoveryPresentationFlag` (`src/cli/recovery-presentation-options.ts`), which `liveTestRefusal` and `classifyPeerCommand` share, so a presentation flag cannot hide reattach or a repaired dispose from authorization. A screen's Enter default (`preferred`) is read-only (refresh, follow the runner, read the receipt); apply, resume, reattach and destructive choices need their own key, and an item with a `disabledReason` never runs. The receipt's `waits` and `presentationCause` describe the current attempt only: written best-effort (a failed timing save warns, never fails the operation or replaces the wait's own error) and cleared at each resume. Without them show `timing unknown` or an unknown cause; never substitute `updatedAt` or guess a cause from error text. With no typed cause, `renderBlocked` may show only the first recorded error line through `terminalText`, controls stripped, capped at 512 code points and labelled `typed cause unknown`, with the uniform action; never classify it or choose an option from its text (#478). `endInspection` (the completion and stop-and-archive summary) only inspects, and a failed reading is `runtime unknown`.
 - `upgrade()` (`src/cli/main.ts`, #272) never coordinates a target newer than its own `VERSION`: it hands over to that release's coordinator (`bun x --package @staix/agent-hub@<to> ahub upgrade --to <to>` with the same flags), and `AGENTHUB_UPGRADE_HANDOVER=1` keeps the process it started from handing over again. `--to` passes `exactVersion` before it reaches a package spec or the registry. `latestRelease` supplies it only for a terminal run or a dry run: `--yes`, and an apply through a pipe, still name the release.
 - Recovery judges the registry claim as it is now (`inspectRecovery` re-reads `registeredProjects()`), never the plan's frozen copy; a registry that cannot be read is not inspected, never stopped (#226).
+- `inspectRecovery` catches only `RecoveryDeferredHubError` from `readRestartSnapshot`: keep the stopped state and return the static `snapshotError` blocker without a `snapshot` binding. Never echo rejected content, repair the snapshot or offer resume from it (#478).
 - The managed Claude hook (`src/cli/facts-hook.ts`) may only add `permissionDecision: "allow"` on `PreToolUse`, and for `ask-when-needed` only what `projectFileTool` accepts: a hub that is down, slow or refuses decides nothing. The daemon puts `permission` in a `facts` reply only for the hook of this instance's recorded `ahub claude` launch (the same `launchId`, not `--unattended`), and a permission-only hook (`hookPurpose`) never drives busy state (#242).
 - `ahub claude` (`src/cli/launch.ts`, #270) publishes `claude-launch.json` for every launch against a running hub, atomically and without a lock: hooks, permission status, session observation and recovery read its `launchId`, so never make it wait for native-proof state. The native child's pid and signature go only into the private `claude-native-<binding hash>.json`, keyed by the exact launch record, written once under `claude-launch.lock` and removed at that child's own exit; never put them in `claude-launch.json`, where a late callback of an earlier launch could replace a newer record. Crash cleanup of a previous launch's settings file (`cleanupStaleClaudeSettings`) needs the launcher gone by `processLiveness` and that native proof, and for a `direct-child` proof the native pid absent from an available `processTable`: a direct child may exec in place, so its signature certifies nothing. A script or interpreter gets no proof and keeps its settings file.
 

package/docs/agent-notes/tasks.md

@@ -5,7 +5,7 @@ Scope: the task flow, assignment, the state machine and the hub's MCP tools. Rea
 - Tool callers are models: MCP `inputSchema` is not enforced on the way in. Normalize at the boundary (`cleanRefs`) before anything reaches the board, and never throw after a board write: a publish or notify that follows a `review()` or `done()` board write goes through the one `releaseNotice` guard, which turns a failed publish into a console notice, drops a failed notify and never retries (#231, #243). An assignment's delivery once its board write is saved (#276, #297): the move is fact, the failed publish is not retried in place (the journal's own recovery covers a storage error, and a retry may duplicate a publish that actually left), and a person looks for a queued or needs_review delivery with `ahub queue list --peer <owner>` (then `ahub queue show <id>`, or the accepted entry in `ahub task show <id>` if the journal is down) before re-sending with `ahub task assign <id> <owner>`. The distinction is made once, in `assignOwner`: a failure after the write prints the one console notice from `undeliveredNotice` right there, once, and throws `AssignmentUndeliveredError` carrying the saved task; callers (`review()`'s repeated rejection, `escalate` and its callers, the ready offer, both relays, the idle sweep, rescreen) decide control flow by the type and print nothing more, and `propose`, `assignTo` and `decline` additionally let the error reach the caller in its turn, which is a person or peer that can act. Two exceptions get no notice, by construction: a row superseded meanwhile, meaning a later history entry that moves or settles the task (another assignment, an unassign, the owner's accept, done, approval, close), while entries that do neither (the hub's quiet bookkeeping: answers, reviewer changes, idle sweeps, check results) leave the assignment undelivered and the notice stands, so the original error goes to the caller as before only on supersession; and a claim's own accepted write and "claimed by" line stay outside the delivery rule (a claim is its own hand-over; its overlap and routing announcements to earlier owners are deliveries and share the wrapper, so a failure there does read as one). A failure before the write stays a plain `Error` (#254), a failed write leaves the ready offer unconsumed (#231), and the notices before the write (waits, no-owner, the reserved-owner line) go through `releaseNotice` too, so those pre-write notices cannot fail their caller.
 - Post-await assignment publication is fenced by current role authority: supersession returns the current task without a saved-delivery notice; reviewer-only changes refresh current metadata and do not suppress a valid owner delivery. A replacement notice goes only to a role that actually received the request, not to an unread-only queue.
 - Console task row assignment/unassignment carries the exact role, task id and `flowRevision` (history length), checks it before effects and passes it to `Board.update`; a changed revision requires reload. Person owner removal clears owner/reservation and suppresses automatic offers until a later explicit person assignment/reservation; refuse owner removal under review or after approval, and preserve the required PII person reviewer.
-- Role withdrawal matches the task id, role kind and owner-request header. Owner acceptance evidence must be that peer's accepted entry after the latest ownership event, never another owner's state or an earlier assignment span. Withdraw unread requests without inventing delivery evidence. Preserve the original former-owner stop notice after a superseding escalation, while suppressing stale success/decision tails.
+- Role withdrawal matches the task id, role kind and owner-request header. Owner acceptance evidence must be that peer's accepted entry after the latest ownership event, never another owner's state or an earlier assignment span. Withdraw unread requests without inventing delivery evidence. Find them with `bus.pendingEnvelopes(peer)`, which includes recovery-deferred notices, never the snapshot's queues (#478). Preserve the original former-owner stop notice after a superseding escalation, while suppressing stale success/decision tails.
 - `assign()` never defaults to the task's current owner, or a decline can only come back to the decliner. A reservation (#207) is the same risk: the reserved owner goes first only through `blocked()`, and a decline or an escalation for reason `rejections` or `manual` records the owner it left in the history entry's `from`, which `excluded()` reads, so no later reroute hands the task back through its reservation.
 - The state machine allows `in_progress -> approved` only for classes without a reviewer; `review()` checks `in_review` itself.
 - Treat `cancelled` as closed through `isClosedTaskState`, but keep dependency release restricted to approval. Cancellation goes through `Tasks.cancel`, preserves the row and roles, clears its reservation/cohort, sends revision-bound stop notices and writes no outcome memory; never map it to approval or cancel a native turn or worktree. Planner cancellation stays limited to its own historically unaccepted proposed/backlog work; accepted work remains person-only.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.12.32 and control protocol 16. Live verification
+This guide describes ahub 0.12.33 and control protocol 16. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Agent-operated live verification
@@ -1837,6 +1837,9 @@ The runtime reset (the default):
   through the delivery journal, one `resolution_history` entry each. Work
   that was dispatching or accepted when the hub stopped is held as
   `needs_review` first, so it is discarded too;
+- discards hub notices a recovery hold kept back the same way, one entry per
+  recipient, without delivering them; the dry run lists them as
+  `q:<peer>:<id>`;
 - clears manual peer holds (`ahub pause`), budget pauses and conductor holds;
 - drops the agent session resume pointers `sessions.json`,
   `claude-session.json` and `claude-context.json`, so the next launch starts
@@ -1949,21 +1952,21 @@ section is what they run.
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.32), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.33), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.32 ahub upgrade --to 0.12.32 --dry-run
-bunx --package @staix/agent-hub@0.12.32 ahub upgrade --to 0.12.32 --yes
+bunx --package @staix/agent-hub@0.12.33 ahub upgrade --to 0.12.33 --dry-run
+bunx --package @staix/agent-hub@0.12.33 ahub upgrade --to 0.12.33 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.32 (protocol 16) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.33 (protocol 16) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -1995,14 +1998,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.32 --dry-run
+ahub upgrade --to 0.12.33 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.32 --yes
+ahub upgrade --to 0.12.33 --yes
 ahub recovery status [<operation-id>]
 ahub recovery resume [<operation-id>]
 ahub recovery abort [<operation-id>]
@@ -2029,6 +2032,15 @@ line of its own to `hub.log`), and until no task command or dashboard action is
 still running. A check the commit's stop kills writes to the board after the
 commit has recorded it, and the operation stays blocked.
 
+From 0.12.33, while an operation holds a source of that release or later, and
+while a restored target waits for release, the notices the hub writes itself
+(other than `[FYI]` ones) are kept apart from the carried queues, durably in
+the delivery journal and the restart snapshot, so the queue comparison still
+matches exactly. Release queues them in order and saves each move before
+anything is delivered. A target that does not advertise `recovery_deferred_hub`
+gets them in its ordinary queues before commit instead. At most 2048 such
+notices wait; a further one is refused, and none already kept is dropped.
+
 0.9.0 turns on for every project with a config file, whether or not it has the
 block: `limits` (12 messages a minute per sender, 6 per recipient, 6
 `[IMPORTANT]` an hour, 120 s repeats) and `budget.wait_max_min` (30). Set them
@@ -2196,7 +2208,12 @@ and fresh-session choices carry a warning and name the consequence before the
 person confirms. Raw receipt keys and the original recorded error are available
 with `j` or `--verbose`. The four preservation failures name the actual failed
 queue, manual-pause, board or budget comparison; an older untyped cause remains
-unknown rather than being guessed from its text.
+unknown rather than being guessed from its text. When nothing more specific
+applies (no typed cause, reattachment or `database_busy`), Why shows the first
+line of the recorded error, with control characters removed and cut at 512
+characters, marked `typed cause unknown`. What to do then says to resolve that
+error, then resume or choose an offered action. Nothing is classified from that
+text, and JSON and piped output are unchanged.
 
 Completion and stop-and-archive use a human summary on a TTY. It separates the
 outcome, recorded plugin/global installation effects, remaining work and the
@@ -2256,7 +2273,10 @@ each receipt allows, given what is live, is tabulated in the recovery spec
 (`docs/specs/2026-09-20-upgrade-recovery-design.md`, "Receipts, evidence and
 next actions").
 
-- The source hold lapses after 10 minutes. A later `resume` prepares the same
+- The source hold lapses after 10 minutes. If releasing it fails because the
+  source's delivery storage fails, the hold stays and the expiry is retried
+  every second until storage recovers; restore the storage before `abort`.
+  A later `resume` prepares the same
   source again and checks its peers again, keeping the receipts, so no terminal
   is closed twice. It refuses, naming the next step, when the source daemon was
   replaced, when another operation holds it, or when a peer changed: a peer whose
@@ -2318,7 +2338,11 @@ next actions").
   that session. A target that dies again in the same `resume` stops it with the
   restart count; look at its `hub.log` before resuming again. Without the
   snapshot, or for an operation started by a coordinator older than 0.12.21,
-  the way out is stop-and-archive.
+  the way out is stop-and-archive. A snapshot whose kept hub notices fail
+  validation blocks that restart with `restart snapshot deferred hub notices
+  are invalid; restore is blocked`. The hub still reads as stopped, so
+  stop-and-archive (and abort, where it applies) stays offered; nothing
+  repairs the snapshot or offers to resume from it.
 - A Codex conversation comes back only when a rollout file naming its thread
   exists under `sessions/` of the store the restored terminal uses (the
   recorded `CODEX_HOME`, else `~/.codex`). Codex writes that file with the
@@ -2648,7 +2672,7 @@ ahub task cancel <id> --reason <text> [--superseded-by <ref>] [--revision N]
 
 The console also offers cancellation with the selected task's flow revision. Approved tasks cannot be cancelled. The planner's `hub_task_cancel` tool is limited to its own unaccepted backlog/proposed work; previously accepted work requires the person. Cancellation sends the former owner/reviewer a stop notice, releases overlap/reservation participation and keeps dependents blocked with a cancelled-dependency notice. It does not stop a native turn, delete a worktree or write an outcome memory note. Cancelled work is closed history, counted separately from approved work; it does not satisfy an approval dependency. A still-running private turn keeps its privacy fence after cancellation. Use the displayed revision to avoid acting on a task that changed while it was selected.
 
-The daemon advertises `task_cancel`; a current CLI refuses cancellation against older daemons. Recovery retains verified target features beside its immutable root/digest, reuses them on resume and checks only sources not yet past commit; a legacy receipt without that evidence needs a target probe only before commit. Upgrade/restart refuses a target without this feature while cancelled rows exist and names their ids. No cancelled row is rewritten as approved. An old binary launched by hand remains unsupported: it can count cancelled work as open or fail to move it. Use a compatible coordinator instead. Live task cancellation and sweep enablement are separate post-release operations.
+The daemon advertises `task_cancel`; a current CLI refuses cancellation against older daemons. Recovery retains verified target features beside its immutable root/digest, reuses them on resume and on each lease renewal before a terminal is closed, and checks only sources not yet past commit; a legacy receipt without that evidence needs a target probe only before commit. Upgrade/restart refuses a target without this feature while cancelled rows exist and names their ids. No cancelled row is rewritten as approved. An old binary launched by hand remains unsupported: it can count cancelled work as open or fail to move it. Use a compatible coordinator instead. Live task cancellation and sweep enablement are separate post-release operations.
 
 ## Task idle sweep
 

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.32
+bun add -g github:STAIxBWLB/agent-hub#v0.12.33
 ahub setup
 ```
 
@@ -30,9 +30,9 @@ and upgrade or crash recovery, see the [operations guide](operations.md). To
 move running projects to a newer release later, run `ahub upgrade` in a
 terminal: it reviews the plan with you, applies it and follows it.
 
-## Upgrading to 0.12.32
+## Upgrading to 0.12.33
 
-The upgrade runs with the target release's own coordinator. If the operation blocks because a restored Codex, Claude or Pi terminal disappeared, the person runs `ahub recovery reattach <operation-id> codex|claude|pi` to relaunch that peer with its recorded session (one relaunch per receipt), then `ahub recovery resume` to finish.
+The upgrade runs with the target release's own coordinator, so an upgrade from 0.12.32 with cancelled tasks and a managed terminal, or with a notice the target sends right after it starts, no longer blocks (#478). If the operation blocks because a restored Codex, Claude or Pi terminal disappeared, the person runs `ahub recovery reattach <operation-id> codex|claude|pi` to relaunch that peer with its recorded session (one relaunch per receipt), then `ahub recovery resume` to finish.
 
 From 0.12.30 or earlier, existing Jcode project MCP entries need one refresh before conductor or dashboard starts. Once per project, the person runs:
 

package/docs/security.md

@@ -119,7 +119,12 @@ The operator uses a plain terminal or `ahub console`. A Claude `!` command that
 inherits the agent markers follows the same rule. The console strips control
 sequences from agent and daemon text before it quotes forged headers, and its
 colors come only from a fixed palette applied afterwards, so message text cannot
-set styles or operate the terminal.
+set styles or operate the terminal. The recovery blocked screen shows a recorded
+error only when no typed cause exists: its first line, passed through the
+console's terminal sanitizer with control characters removed, capped at 512
+code points and marked as an untyped recorded error. A restart snapshot whose
+kept hub notices fail validation is reported with a fixed message, never with
+its content.
 
 This is an honest default against accidental impersonation and injected commands.
 It does not make the token inaccessible to an agent with unrestricted project

package/docs/specs/2026-09-20-upgrade-recovery-design.md

@@ -849,3 +849,23 @@ Recovery authorization and the presentation parser share the pure
 skipping the accepted one-shot presentation flags (`--json`, `--verbose`, `--color=<mode>`). Such flags never hide
 person-only reattachment from agent or live-test refusal checks; normalization
 confers no authority and unknown flags still fail the command parser.
+
+
+## Recovery-held hub publication amendment (#478)
+
+2026-10-18: Keep exact carried-queue integrity equality. Every checked prepare renewal carries the verified target features stored on the operation. Ordinary post-commit observational inspection stays free of pre-commit compatibility checks.
+
+Only an authenticated recovery operation with verified target support opts into hub deferral; a bare bus delivery fence retains its existing queue admission and does not confer daemon operation authority. The bus accepts hub-originated, deliverable notices during recovery into optional `BusSnapshot.deferredHub`, persisted by the existing private delivery journal and restart snapshot. These originals are outside delivery queues and their integrity projection. The accepted audience and envelope metadata, including private marking, are captured without new text-writing paths. FYI and hop-dropped publications keep their existing record-only behavior. Withdrawal and role/feed revocation also cover deferred originals. Backlog retention counts them as accepted work.
+
+A target advertises `recovery_deferred_hub` beside `task_cancel`. Before a commit to a target without that verified feature, the source materializes deferred originals into normal queues; expected integrity therefore verifies those rows normally. No old target is asked to preserve a field it cannot read.
+
+Deferred restore validation refuses malformed, non-hub, duplicate or already-accepted ids with a typed recovery error. The FIFO is capped at 2048 originals; overflow refuses admission without dropping accepted work or releasing the hold. Each release transfers an original through normal publication and checkpoints its removal from the deferred FIFO together with its queued/seen state before delivery is allowed. A crash resumes from the journal, preserving id dedupe. Failed checkpoints leave the original pending and recovery held. A retry of an already archived release still completes the bus release; a later ordinary startup also completes durable pending publication. Abort and lease expiry retain their recovery ownership until pending publication can be checkpointed.
+
+When no typed presentation cause exists, the human blocked screen shows only the existing sanitized first recorded error line, with controls removed and a 512-code-point cap. The action is uniform: resolve the recorded error, then resume or choose an offered action. Feature compatibility is a conditional option only, never classified from an error substring. JSON and piped rendering are unchanged.
+
+
+### Deferred-notice edge paths (#478 review amendment)
+
+An expired source lease retries a failed release checkpoint on a short timer; a vanished coordinator is not required to unstick the hold once storage recovers. Reset previews count deferred recipients as pending delivery ids, and stopped-runtime reset atomically records their discard audit and removes the originals without publication. Deferred records require their captured recipient array. Flush rollback restores only publication-owned state (affected queue arrays in place, deferred and seen ids, withdrawal bookkeeping and pending outcomes); it never reloads a live bus snapshot or changes its recovery mode, prefaces or independent pauses. Advisory nudges, like publication events, run after the checkpoint.
+
+A corrupt deferred field still refuses daemon restore. Coordinator inspection catches only the typed deferred-corruption error, keeps independently verified stopped evidence, reports an unknown snapshot binding with a static blocker, and leaves person abort/stop-and-archive exits available. It never claims that the corrupt snapshot can be resumed, repairs it or exposes rejected content.

package/docs/verification/2026-10-18-0.12.33.md

@@ -0,0 +1,42 @@
+# 0.12.33 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or native/live acceptance.
+
+## Candidate
+
+Version 0.12.33, control protocol 16 (`src/hub/control-client.ts`), from merged main `fe53b272db455fd5b95b4a504e806a0a0625a26c`. The candidate includes the one PR merged since `v0.12.32`: #479 (issue #478). The exact first-party memory pin remains `@staix/agent-mem` 0.3.1.
+
+- The upgrade runs with the target release's own coordinator (`bunx --package @staix/agent-hub@0.12.33 ahub upgrade`). An upgrade from 0.12.32 into 0.12.33 therefore already uses the fixed lease renewal and the deferred hub notices.
+- #479 adds the target feature `recovery_deferred_hub` beside `task_cancel`. A target without it gets deferred notices in its ordinary queues before commit, so mixed-version upgrades keep exact queue verification.
+- Still open: a real upgrade with a managed TUI and cancelled rows (#478), a real Orca upgrade exercising `ahub recovery reattach` (#463), the native real-terminal console settings leg (#439 AC5), installed managed-Pi #418 AC8 (#142) and #438 AC7.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported 10 stale documents, all made stale by #479; editing `daemon.md` made an 11th, `docs/agent-notes/README.md`. Each was compared against the #479 source diff (`cf3026fe..fe53b272`). The limits and messages cited were checked in the source: `MAX_DEFERRED_HUB` is 2048 (`src/hub/deferred-hub.ts`), the blocked-screen cap is 512 code points and the label is `typed cause unknown` (`src/cli/upgrade-presentation.ts`), and the snapshot blocker message comes from `src/cli/upgrade-runtime.ts`. Version references were moved to 0.12.33 in the same pass. No document review is deferred.
+
+| Document | Prior source stamp | Review result | Checked claims and correction |
+| --- | --- | --- | --- |
+| `README.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Status 0.12.33; Jcode entry unchanged; the verification link and the open #478 live leg. `task_cancel` text still holds. |
+| `docs/quickstart.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | `v0.12.33` install example and the upgrade section for the #478 fixes; reattach and resume text unchanged. |
+| `docs/security.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Blocked-screen recorded error passes the terminal sanitizer, controls stripped, capped; a corrupt snapshot is reported with a fixed message only. |
+| `docs/operations.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | 0.12.33 header and upgrade examples; deferred hub notices during recovery and the downgrade path; the lease-expiry retry; the corrupt-snapshot blocker; the blocked-screen fallback; runtime reset discards deferred notices; features sent on lease renewal. |
+| `docs/agent-notes/README.md` | `cf3026feab218207f0c21b300552eada0d5be227` | unchanged | Stale only because this pass edited `daemon.md`; the console exact-row navigation rule it explains is unchanged. |
+| `docs/agent-notes/adapters.md` | `cf3026feab218207f0c21b300552eada0d5be227` | unchanged | #479 touched only recovery and bus wiring in `daemon.ts`; no adapter, spawn or approval rule changed. |
+| `docs/agent-notes/budget.md` | `cf3026feab218207f0c21b300552eada0d5be227` | unchanged | Pause persistence and resume-notice order unchanged; "publish, then withdraw" holds, and withdraw now also covers deferred notices. |
+| `docs/agent-notes/bus.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Deferred notices stay outside queues and the integrity view, every pending-work read includes them, the cap refuses rather than drops; release checkpoints each move and a failed checkpoint restores only publication state. |
+| `docs/agent-notes/daemon.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Every prepare sends stored `targetFeatures`; when hub notices are deferred and the lease-expiry retry; `inspectRecovery` catches only `RecoveryDeferredHubError`; the `renderBlocked` fallback rule. |
+| `docs/agent-notes/tasks.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Role withdrawal finds unread requests through `bus.pendingEnvelopes`, which includes deferred notices. |
+| `docs/agent-notes/tests.md` | `cf3026feab218207f0c21b300552eada0d5be227` | unchanged | The new tests follow the existing rules; `scripts/check.sh`, seeds and CI are unchanged. |
+
+`AGENTS.md` area notes and `docs/verified.json` paths now include `src/hub/deferred-hub.ts` (bus and daemon) and `src/cli/reset.ts` (bus), the modules the new bus and daemon rules describe. A separate manifest commit restamps the reviewed documents against the reviewed source; it does not stamp itself. The release PR must use a merge commit, and committed freshness is rerun on main before tagging.
+
+## Recorded checks
+
+| PR | Final head | CI run |
+| --- | --- | --- |
+| [#479](https://github.com/STAIxBWLB/agent-hub/pull/479) | `e832901d10ab263e3887426534a6aebd3e8612ef` | [39085109057](https://github.com/STAIxBWLB/agent-hub/actions/runs/39085109057) |
+
+Both OS check jobs, all four seeded shards and the `seeded guards` aggregate succeeded. The PR passed two OCR delegation review rounds by a Claude subagent: 21 of 21 files were accounted for, and the round-1 findings were fixed and verified at the final head. These prior PR gates do not replace the release candidate's own exact-head CI.
+
+- Generated assets: `bun install --frozen-lockfile` and `bun run build` ran locally at `894350fa`. The only change to `plugins/agent-hub/server.js` and the plugin manifest is the version string 0.12.32 -> 0.12.33; the release PR's CI checks bundle freshness.
+- The release PR's own exact-head CI and the release workflow's tag checks are recorded on the PR and the tag, not here.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -74,7 +74,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -86,24 +86,27 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
         "src/hub/limits.ts",
         "src/hub/delivery-journal.ts",
+        "src/hub/deferred-hub.ts",
         "src/hub/inference.ts",
         "src/hub/daemon.ts",
-        "src/hub/supervision.ts"
+        "src/hub/supervision.ts",
+        "src/cli/reset.ts"
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
         "src/adapters/claude-channel.ts",
         "src/hub/restart.ts",
+        "src/hub/deferred-hub.ts",
         "src/hub/recovery-store.ts",
         "src/hub/snapshots.ts",
         "src/hub/manager.ts",
@@ -159,7 +162,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -177,7 +180,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -196,7 +199,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "38dfe1876c3b20d061b6232919e28965e1bb486e",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.32",
+  "version": "0.12.33",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.32",
+  "version": "0.12.33",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -16431,7 +16431,7 @@ import { join as join6 } from "path";
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.32",
+  version: "0.12.33",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/cli/reset.ts

@@ -4,6 +4,7 @@ import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync,
 import { join } from "node:path";
 import { Bus } from "../hub/bus.ts";
 import { DeliveryJournal } from "../hub/delivery-journal.ts";
+import { validateDeferredHub } from "../hub/deferred-hub.ts";
 import type { Project } from "../hub/registry.ts";
 import { HUB_DB_BUSY_TIMEOUT_MS } from "../hub/db-timeout.ts";
 
@@ -73,7 +74,14 @@ export function planReset(stateDir: string, projectId: string): ResetPlan {
     const bus: unknown = JSON.parse(meta?.bus_snapshot || "{}"), manual: unknown = JSON.parse(meta?.manual_paused || "[]");
     shaped(isList(manual, isText), "manual_paused");
     shaped(isObject(bus) && (bus.manualPaused === undefined || isList(bus.manualPaused, isText)) && (bus.queues === undefined || (isObject(bus.queues) && Object.values(bus.queues).every((queue) => isList(queue, isEnvelope)))), "bus_snapshot");
-    const { queues = {}, manualPaused = [] } = bus as { queues?: Record<string, { id: string }[]>; manualPaused?: string[] };
+    const { queues = {}, manualPaused = [], seen = [], deferredHub } = bus as {
+      queues?: Record<string, { id: string }[]>; manualPaused?: string[]; seen?: { id: string }[]; deferredHub?: unknown;
+    };
+    shaped(isList(seen, isEnvelope), "bus_snapshot.seen");
+    // Deferred notices are pending delivery too, but must not be published just to preview or reset them.
+    const deferred = validateDeferredHub(deferredHub, undefined, new Set([
+      ...seen.map(env => env.id), ...Object.values(queues).flat().map(env => env.id),
+    ]));
     plan.manualHolds = [...new Set([...manual as string[], ...manualPaused])].sort();
     // As Bus.queueList: a queued envelope that no open row stands for is listed as q:<peer>:<envelope id>.
     // ponytail: the rule is copied so the dry run never opens the journal for writing; the reset tests compare the
@@ -84,6 +92,9 @@ export function planReset(stateDir: string, projectId: string): ResetPlan {
       return (originals as { id: string }[]).map((env) => `${row.peer}:${env.id}`);
     }));
     for (const [peer, queue] of Object.entries(queues)) for (const env of queue) if (!recorded.has(`${peer}:${env.id}`)) plan.queued.push(`q:${peer}:${env.id}`);
+    for (const env of deferred) for (const peer of new Set(env.to)) {
+      if (!recorded.has(`${peer}:${env.id}`)) plan.queued.push(`q:${peer}:${env.id}`);
+    }
   } finally { db.close(); }
   return plan;
 }
@@ -114,6 +125,7 @@ export function resetRuntime(stateDir: string, project: Project): { settled: str
     const journal = new DeliveryJournal({ file, projectRoot: project.root, projectId: project.id, instanceId: randomUUID() });
     const bus = new Bus({ journal });
     try {
+      settled.push(...bus.discardDeferredHub("reset"));
       for (const { id } of bus.queueList().filter((row) => row.state === "queued" || row.state === "needs_review")) {
         // Read again each time: a queue entry's revision is the journal's, and every resolution moves it on.
         bus.resolveDelivery(id, bus.queueShow(id)!.revision, "discard", "reset");

package/src/cli/upgrade-presentation.ts

@@ -1,4 +1,4 @@
-import { paint, quoted, wrap, type Tone } from "./console-state.ts";
+import { paint, quoted, terminalText, wrap, type Tone } from "./console-state.ts";
 import { operationLines, stepLabel } from "./upgrade-labels.ts";
 import { recordedPeerGuidance, stopAndArchiveSummary, type RecordedPeerGuidance } from "./recovery-guidance.ts";
 import { restoreReceiptStatus } from "./upgrade-restore-state.ts";
@@ -162,6 +162,16 @@ export function renderBlocked(op: RecoveryOperation, choices: readonly NextChoic
   } else if (op.failure?.code === "database_busy") {
     happened = "The recovery database could not complete this step yet.";
     why = "The coordinator recorded database contention as retryable; its saved recovery state is retained.";
+  } else if (!cause && op.error) {
+    // A recorded error is evidence to show, not a typed classification. Reuse the console's
+    // terminal sanitizer before the normal renderer; discard later lines and bound by code point.
+    const first = terminalText(op.error.split(/[\r\n\p{Zl}\p{Zp}]/u, 1)[0] ?? "").replace(/\p{Cc}/gu, "").trim();
+    if (first) {
+      const points = Array.from(first);
+      const recorded = points.length > 512 ? `${points.slice(0, 509).join("")}...` : first;
+      why = `recorded error: ${recorded} (typed cause unknown).`;
+      action = "Resolve the recorded error, then resume or choose an offered action. If the target lacks a feature the source needs, choose a compatible target; keep the source records. Read [j] or use --verbose for details.";
+    }
   }
   const output = [...lines(`What happened: ${happened}`, "failure", options), ...lines(`Why: ${why}`, "muted", options), ...lines(`What to do: ${action}`, "attention", options)];
   for (const choice of choices) {

package/src/cli/upgrade-runtime.ts

@@ -19,6 +19,7 @@ import { abandonRestartSnapshot, readRestartSnapshot, waiveRecoveryPeers } from
 import { readRecoveryContinuity, retireRecoveryContinuity, writeRecoveryContinuity } from "../hub/recovery-continuity.ts";
 import { recoveryLock } from "../hub/recovery-store.ts";
 import { decodeRestoreReceipt, restoreTransition, type RestoreReceipt, type RestoreEvidence, type RestoreTransition } from "./upgrade-restore-state.ts";
+import { RecoveryDeferredHubError } from "../hub/deferred-hub.ts";
 import { RecoveryPreservationError, RecoveryPresentationError, type RecoveryNativeCause } from "./upgrade-presentation-data.ts";
 
 /** An unmanaged Claude's plugin retries with a backoff of at most 30 s; three of those bound the reconnect wait (#206). */
@@ -172,12 +173,21 @@ export async function inspectRecovery(project: Project, targetFeatures?: readonl
   const sourceProtocol = control?.protocol;
   const legacySupported = sourceProtocol !== undefined && RECOVERY_SOURCE_PROTOCOLS.includes(sourceProtocol as (typeof RECOVERY_SOURCE_PROTOCOLS)[number]);
   // A stopped runtime reports whose unreleased restart snapshot it holds: only that one can start it again (#215).
-  const snapshot = base.state === "stopped" ? readRestartSnapshot(project.stateDir, { projectRoot: project.root, projectId: project.id })?.operationId : undefined;
+  let snapshot: string | undefined, snapshotError: Inspection["snapshotError"];
+  if (base.state === "stopped") {
+    try { snapshot = readRestartSnapshot(project.stateDir, { projectRoot: project.root, projectId: project.id })?.operationId; }
+    catch (error) {
+      if (!(error instanceof RecoveryDeferredHubError)) throw error;
+      // Corruption blocks restore, but cannot erase independently confirmed shutdown or the person's archive exit.
+      // Keep diagnostics static: the rejected snapshot may contain forged envelope fields.
+      snapshotError = { code: "recovery_deferred_hub", message: "restart snapshot deferred hub notices are invalid; restore is blocked" };
+    }
+  }
   // A dead pid or a missing project directory is final whatever protocol its manifest names: probing it would read
   // "unavailable" forever and wedge abort, resume and stop-and-archive (#215).
   if (base.state === "stopped" || base.state === "missing" || (base.state !== "running" && !legacySupported)) return {
-    state: base.state, peers: [], blockers: base.state === "stopped" ? [] : [base.state === "incompatible" ? "manual-bootstrap-required: source lacks the recovery contract; use its matching CLI" : base.error ?? base.state],
-    ...(control?.instanceId ? { instanceId: control.instanceId } : {}), ...(control?.protocol ? { protocol: control.protocol } : {}), ...(snapshot ? { snapshot } : {}),
+    state: base.state, peers: [], blockers: base.state === "stopped" ? snapshotError ? [snapshotError.message] : [] : [base.state === "incompatible" ? "manual-bootstrap-required: source lacks the recovery contract; use its matching CLI" : base.error ?? base.state],
+    ...(control?.instanceId ? { instanceId: control.instanceId } : {}), ...(control?.protocol ? { protocol: control.protocol } : {}), ...(snapshot ? { snapshot } : {}), ...(snapshotError ? { snapshotError } : {}),
   };
   let status = base.status;
   if (!status && control && sourceProtocol === PROTOCOL) return {
@@ -666,8 +676,8 @@ export function makeRecoveryDriver(run: RunCommand = runCommand, liveTestPeer?:
           throw new Error(`source preparation expired or changed while waiting for the terminal; no terminal was closed`);
         }
         // Refresh the same prepared lease immediately before the terminal effect. Preserve
-        // the original peer roster, including any terminal already closed in this operation.
-        await control(planned.project, "prepare", op.id, planned.source.instanceId!);
+        // the original peer roster and verified target features, including after a resume.
+        await control(planned.project, "prepare", op.id, planned.source.instanceId!, op.targetFeatures);
         progress.terminals[key] = "pending"; save();
         const result = await closeTerminal(binding, 0, terminalOptions(run));
         if (result.manualRequired) throw new Error(`${binding.peer}: terminal close not verified; manual-required`);

package/src/cli/upgrade.ts

@@ -32,6 +32,8 @@ export interface Inspection {
   blockers: string[];
   /** #215: for a stopped runtime, the operation whose committed restart snapshot its state dir holds (unreleased). */
   snapshot?: string;
+  /** The runtime may be positively stopped while its restart snapshot remains unreadable; never claim ownership. */
+  snapshotError?: { code: "recovery_deferred_hub"; message: string };
 }
 export interface PlannedProject {
   project: Project;

package/src/hub/bus.ts

@@ -2,6 +2,7 @@ import { appendNote, DIGEST, HUB, keepNotes, MAX_HOP, mergePrefaces, newEnvelope
 import type { PeerAdapter, DeliveryReceipt } from "./peers.ts";
 import { DeliveryJournal, MAX_ENVELOPE_BODY, type JournalDelivery, type JournalDeliveryState } from "./delivery-journal.ts";
 import { DELIVERY_RETRY_WARNING } from "./delivery-hints.ts";
+import { MAX_DEFERRED_HUB, RecoveryDeferredHubError, validateDeferredHub } from "./deferred-hub.ts";
 import { PreEffectToolRefusal } from "./tool-refusal.ts";
 
 export type { DeliveryReceipt } from "./peers.ts";
@@ -64,6 +65,8 @@ export interface BusSnapshot {
   attempts: Record<string, number>;
   withdrawn: string[];
   manualPaused?: string[];
+  /** Hub notices accepted during recovery, durable but outside the carried delivery queues. */
+  deferredHub?: Envelope[];
   journal?: ReturnType<DeliveryJournal["snapshot"]>;
 }
 
@@ -142,6 +145,12 @@ export class Bus {
   /** Synchronous native failure observation, before queue callbacks can finish turn metrics. */
   onDeliveryFailed?: (peer: PeerId) => void;
   private recoveryHeld = false;
+  private deferHub = false;
+  private readonly deferredHub = new Map<string, Envelope>();
+  private flushingHub = false;
+  private replayingHub = false;
+  private deferredEvents: BusEvent[] = [];
+  private deferredNudges: (() => void)[] = [];
   private steering = 0;
   private condensing = 0;
   private closed = false;
@@ -273,10 +282,61 @@ export class Bus {
   }
 
   /** Stop new deliveries while a coordinator takes a stable snapshot. Existing adapter turns are left alone. */
-  setRecoveryHold(held: boolean): void {
-    this.recoveryHeld = held;
-    if (!held) this.onQueues?.(); // restored holds need classification even when no peer is attached
-    if (!held) for (const id of this.peers.keys()) void this.drain(id);
+  setRecoveryHold(held: boolean, deferHub = false): void {
+    if (this.replayingHub) throw new RecoveryDeferredHubError("recovery notice release is already in progress");
+    if (held) {
+      this.recoveryHeld = true;
+      this.deferHub = deferHub;
+      // An older target cannot carry this additive field: materialize before commit's expected integrity.
+      if (!deferHub) this.flushDeferredHub();
+      return;
+    }
+    // Persist each deferred -> queued transition while deliveries are still fenced. A failed checkpoint
+    // leaves the hold and the original pending head intact; a crash after it resumes from the journal.
+    this.flushDeferredHub();
+    this.recoveryHeld = false;
+    this.onQueues?.();
+    for (const id of this.peers.keys()) void this.drain(id);
+  }
+
+  private flushDeferredHub(): void {
+    if (this.flushingHub) return;
+    if (this.storageError) this.persist();
+    this.replayingHub = true;
+    try { while (this.deferredHub.size) {
+      const env = this.deferredHub.values().next().value!;
+      const beforeDeferred = [...this.deferredHub], beforeSeen = [...this.seen], beforeWithdrawn = [...this.withdrawn];
+      const affected = new Map(this.audience(env).map(peer => {
+        const queue = this.queues.get(peer);
+        return [peer, queue ? { queue, contents: [...queue] } : undefined] as const;
+      }));
+      const outcomes = this.pendingOutcomes.length;
+      this.flushingHub = true;
+      this.deferredEvents = []; this.deferredNudges = [];
+      try {
+        this.deferredHub.delete(env.id);
+        this.publishNow(env);
+      } catch (error) {
+        // Only publication state is transactional. A live peer's preface, pauses, attempts and
+        // recovery mode are independent state, not something a failed checkpoint may reload.
+        this.deferredHub.clear(); for (const [id, pending] of beforeDeferred) this.deferredHub.set(id, pending);
+        this.seen.clear(); for (const [id, seen] of beforeSeen) this.seen.set(id, seen);
+        this.withdrawn.clear(); for (const id of beforeWithdrawn) this.withdrawn.add(id);
+        for (const [peer, queue] of affected) {
+          if (queue) { queue.queue.splice(0, queue.queue.length, ...queue.contents); this.queues.set(peer, queue.queue); }
+          else this.queues.delete(peer);
+        }
+        this.pendingOutcomes.length = outcomes;
+        this.deferredEvents = []; this.deferredNudges = [];
+        throw new RecoveryDeferredHubError("deferred hub notice checkpoint failed; recovery remains held; restore delivery storage, then retry release or abort");
+      } finally { this.flushingHub = false; }
+      // Publication observers run only after the durable transition. Reentrant notices join the FIFO tail.
+      const events = this.deferredEvents; this.deferredEvents = [];
+      for (const event of events) this.emit(event);
+      const nudges = this.deferredNudges; this.deferredNudges = [];
+      for (const nudge of nudges) nudge();
+      this.onQueues?.();
+    } } finally { this.replayingHub = false; }
   }
 
   get isRecoveryHeld(): boolean {
@@ -296,7 +356,7 @@ export class Bus {
     let delay = 1;
     while (this.draining.size || this.steering || this.condensing) {
       if (Date.now() >= deadline) {
-        this.recoveryHeld = heldBefore;
+        if (!heldBefore) this.setRecoveryHold(false);
         throw new Error(`recovery fence timed out after ${timeoutMs} ms with ${this.draining.size + this.steering + this.condensing} deliveries still in flight; retry the operation`);
       }
       await Bun.sleep(delay);
@@ -314,6 +374,7 @@ export class Bus {
       attempts: Object.fromEntries(this.attempts),
       withdrawn: [...this.withdrawn],
       manualPaused: [...this.manualPaused],
+      ...(this.deferredHub.size ? { deferredHub: structuredClone([...this.deferredHub.values()]) } : {}),
     };
     if (includeJournal && this.journal) out.journal = this.journal.snapshot();
     return out;
@@ -341,6 +402,10 @@ export class Bus {
   }
 
   private loadSnapshot(snapshot: BusSnapshot): void {
+    const deferred = validateDeferredHub(snapshot.deferredHub, undefined, new Set([...snapshot.seen.map(e => e.id), ...Object.values(snapshot.queues).flat().map(e => e.id)]));
+    if (deferred.length) { this.recoveryHeld = true; this.deferHub = true; }
+    this.deferredHub.clear();
+    for (const env of deferred) this.deferredHub.set(env.id, structuredClone(env));
     this.queues.clear();
     for (const [id, queue] of Object.entries(snapshot.queues ?? {})) this.queues.set(id, queue.map((e) => ({ ...e, ...(e.to ? { to: [...e.to] } : {}) })));
     this.prefaces.clear();
@@ -532,7 +597,7 @@ export class Bus {
 
   queuedBacklogIds(id: PeerId): Set<number> {
     const ids = new Set<number>();
-    const retained = [...(this.queues.get(id) ?? []), ...(this.journal?.unresolved(id).filter(row => row.state !== "queued").flatMap(row => row.originals) ?? [])];
+    const retained = [...this.pendingEnvelopes(id), ...(this.journal?.unresolved(id).filter(row => row.state !== "queued").flatMap(row => row.originals) ?? [])];
     for (const env of retained) {
       const backlog = env.refs?.backlog;
       if (env.from !== HUB || env.kind !== "task" || !Array.isArray(backlog) || backlog.length > 64) continue;
@@ -602,8 +667,52 @@ export class Bus {
     this.prefaces.set(id, !now ? { ...env, body: uniqueMemoryLines(env.body) } : now.id === env.id ? { ...now, body: uniqueMemoryLines(now.body) } : { ...env, body: keepNotes(mergePrefaces(env.body, now.body), NOTES_KEPT) });
   }
 
-  /** Returns the peers the envelope was queued for. */
+  /** Stopped-runtime reset only: audit every deferred recipient without publishing or releasing work. */
+  discardDeferredHub(reason: string): string[] {
+    if (this.peers.size || this.flushingHub || this.replayingHub || !this.journal || this.storageError) throw new Error("deferred reset requires a stopped, readable delivery journal");
+    const pending = [...this.deferredHub];
+    const settled: string[] = [];
+    try {
+      this.journal.transaction(() => {
+        for (const [, env] of pending) for (const peer of new Set(env.to ?? [])) {
+          const id = `q:${peer}:${env.id}`;
+          this.journal!.createDelivery({ id, peer, state: "queued", createdAt: env.ts, originals: [env], out: [env] });
+          const row = this.journal!.get(id)!;
+          this.journal!.resolve(id, row.revision, "discard", reason, row.revision, "user");
+          settled.push(id);
+        }
+        this.deferredHub.clear();
+        this.persist();
+      });
+    } catch (error) {
+      this.deferredHub.clear(); for (const [id, env] of pending) this.deferredHub.set(id, env);
+      throw error;
+    }
+    return settled;
+  }
+
+  /** Accepted pending work, including notices withheld from the recovery integrity view. */
+  pendingEnvelopes(peer: PeerId): Envelope[] {
+    return [...(this.queues.get(peer) ?? []), ...[...this.deferredHub.values()].filter(e => e.to?.includes(peer))];
+  }
+
+  /** Returns the peers the envelope was accepted for, including durable deferred notices. */
   publish(env: Envelope): PeerId[] {
+    if (this.storageError) throw new Error("delivery journal unavailable");
+    if (this.seen.has(env.id) || this.deferredHub.has(env.id)) return [];
+    if (this.recoveryHeld && (this.deferHub || this.replayingHub) && env.from === HUB && env.priority !== "fyi" && env.hop <= MAX_HOP) {
+      if (this.deferredHub.size >= MAX_DEFERRED_HUB) throw new RecoveryDeferredHubError();
+      const targets = this.audience(env);
+      const copy = structuredClone({ ...env, to: targets });
+      this.deferredHub.set(copy.id, copy);
+      try { this.persist(); }
+      catch (error) { this.deferredHub.delete(copy.id); throw error; }
+      return targets;
+    }
+    return this.publishNow(env);
+  }
+
+  private publishNow(env: Envelope): PeerId[] {
     if (this.storageError) throw new Error("delivery journal unavailable");
     if (this.seen.has(env.id)) return [];
     this.seen.set(env.id, env);
@@ -638,7 +747,7 @@ export class Bus {
     } } finally { this.suppressDrain = false; }
     if (this.journal) {
       this.persist();
-      this.onQueues?.();
+      if (!this.flushingHub) this.onQueues?.();
       for (const id of targets) {
         const peer = this.peers.get(id);
         if (!this.held(id) && env.priority === "important" && peer?.steer && this.stateOf(id) === "busy") void this.steerQueued(id, env);
@@ -681,7 +790,7 @@ export class Bus {
 
   /** A recently published envelope, for resolving `reply_to`. */
   get(id: string): Envelope | undefined {
-    return this.seen.get(id);
+    return this.seen.get(id) ?? this.deferredHub.get(id);
   }
 
   /** The envelopes most recently handed to a peer, used to distinguish a received request from an unread queue. */
@@ -696,10 +805,10 @@ export class Bus {
    */
   withdraw(envelopeId: string): boolean {
     this.markWithdrawn(envelopeId);
-    let removed = false;
+    let removed = this.deferredHub.delete(envelopeId);
     for (const queue of this.queues.values()) {
       const i = queue.findIndex((e) => e.id === envelopeId);
-      if (i !== -1) removed = queue.splice(i, 1).length > 0;
+      if (i !== -1) { queue.splice(i, 1); removed = true; }
     }
     if (removed) this.onQueues?.();
     this.persist();
@@ -709,8 +818,15 @@ export class Bus {
   /** Revoke pending feed copies only; accepted/dispatching journal records and native turns are untouched. */
   revokeSupervision(peer: PeerId): number {
     const queue = this.queues.get(peer);
-    if (!queue && !this.preparing.has(peer)) return 0;
     let removed = 0;
+    for (const [id, env] of this.deferredHub) {
+      if (!env.refs?.supervision || !env.to?.includes(peer)) continue;
+      const remaining = env.to.filter(target => target !== peer);
+      if (remaining.length) this.deferredHub.set(id, { ...env, to: remaining });
+      else this.deferredHub.delete(id);
+      removed++;
+    }
+    if (!queue && !this.preparing.has(peer)) { if (removed) this.persist(); return removed; }
     const discarded = new Set<string>();
     for (let i = (queue?.length ?? 0) - 1; i >= 0; i--) {
       const env = queue![i]!;
@@ -796,9 +912,11 @@ export class Bus {
     }
     if (queuedEnv.priority === "important" && this.peers.get(id)?.pullOnly) {
       // Advisory only (issue #398): the envelope stays queued for `pull`; the hook must never affect it.
-      try { this.opts.onImportantQueued?.(id, { queued: queue.length, important: queue.filter((e) => e.priority === "important").length }); } catch { /* a nudge never stops an enqueue */ }
+      const counts = { queued: queue.length, important: queue.filter((e) => e.priority === "important").length };
+      const nudge = () => { try { this.opts.onImportantQueued?.(id, counts); } catch { /* a nudge never stops an enqueue */ } };
+      if (this.flushingHub) this.deferredNudges.push(nudge); else nudge();
     }
-    this.onQueues?.();
+    if (!this.flushingHub) this.onQueues?.();
     if (!this.suppressDrain) this.persist();
     if (!this.suppressDrain) void this.drain(id);
   }
@@ -1060,6 +1178,7 @@ export class Bus {
   }
 
   private emit(e: BusEvent): void {
+    if (this.flushingHub) { this.deferredEvents.push(e); return; }
     for (const tap of this.taps) tap(e);
   }
 }

package/src/hub/control-client.ts

@@ -8,7 +8,7 @@ export function stateDirFor(cwd: string): string {
 
 /** Control WS wire version. 2 = `deliver` carries `envs` (digests); 3 = `tools` role and task messages; 4 = budget messages and `hub_checkpoint`; 5 = `ask`; 6 = console-only `ui` session bootstrap; 8 = controlled recovery; 9 = Pi bridge metadata; 10 = durable delivery receipts; 11 = queue hold diagnostics; 12 = generation-bound channel settlement and execution budgets; 13 = turn-free facts (`facts` with tool, session and transcript binding, `silenced`) and per-recipient send results (issue #108). 14 = native context-window status and session-bound context checkpoint request ids (issue #185). 15 = conductor tools and permission deadlines/closed events (issues #190, #194). 16 = a Claude session without channel evidence: hello `channel: false` and `inbox` (issue #205). The plugin is installed apart from the daemon, so they can drift. */
 export const PROTOCOL = 16;
-export const DAEMON_FEATURES = ["task_cancel"] as const;
+export const DAEMON_FEATURES = ["task_cancel", "recovery_deferred_hub"] as const;
 /** Protocols a current coordinator may authenticate while upgrading a running source. */
 export const RECOVERY_SOURCE_PROTOCOLS = [9, 10, 11, 12, 13, 14, 15, PROTOCOL] as const;
 

package/src/hub/daemon.ts

@@ -22,6 +22,7 @@ import { jcodeMcpReady } from "../cli/jcode-mcp.ts";
 import { loadSdlc, sdlcGh } from "./sdlc.ts";
 import { peerRosterConfig, rosterAllows, type PeerRoster } from "./roster.ts";
 import { KNOWN_PEERS, OPTIONAL_PEERS, PLANNER_PEERS, SUPPORTED_PEERS, isSupportedPeer } from "./peer-catalog.ts";
+import { RecoveryDeferredHubError } from "./deferred-hub.ts";
 import { databaseBusySite, isDatabaseBusy, RecoveryDatabaseBusy } from "./recovery-error.ts";
 import { buildKimiLaunch } from "../cli/launch.ts";
 import { definitionOf } from "../adapters/registry.ts";
@@ -865,7 +866,7 @@ export async function startDaemon(opts: DaemonOptions) {
   let recoveryCommitted = false;
   let recoveryPeerSnapshot: RestartPeerSnapshot[] | undefined;
   let recoveryLeaseTimer: ReturnType<typeof setTimeout> | undefined;
-  const recoveryActive = () => !!recoveryOperationId && recoveryPhase !== "released";
+  const recoveryActive = () => !!recoveryOperationId && (recoveryPhase !== "released" || bus.isRecoveryHeld);
   if (restored) {
     bus.restore(restored.bus, restored.operationId);
     for (const hold of conductorHolds.list()) bus.pause(hold.peer);
@@ -874,22 +875,25 @@ export async function startDaemon(opts: DaemonOptions) {
     recoveryOperationId = restored.operationId;
     recoveryPhase = "restored";
     recoveryPeerSnapshot = restored.peers;
-    bus.setRecoveryHold(true);
+    bus.setRecoveryHold(true, true);
+  } else {
+    // A prior release may have committed its queue checkpoint before this daemon was stopped.
+    bus.setRecoveryHold(false);
   }
   const recoveryPeerAllowed = (id: PeerId) => !recoveryActive() || !recoveryPeerSnapshot || recoveryPeerSnapshot.some((peer) => peer.id === id);
-  const armRecoveryLease = () => {
+  const armRecoveryLease = (delayMs = 10 * 60_000): void => {
     clearTimeout(recoveryLeaseTimer);
     recoveryLeaseTimer = setTimeout(() => {
       if (!recoveryOperationId || recoveryCommitted || (recoveryPhase !== "preparing" && recoveryPhase !== "prepared")) return;
+      try { bus.setRecoveryHold(false); } catch (error) { log("recovery lease release deferred; delivery storage must be restored before abort"); armRecoveryLease(1000); return; }
       log(`recovery lease expired for ${recoveryOperationId}; hold aborted`);
       recoveryOperationId = undefined;
       recoveryPhase = undefined;
       recoveryPeerSnapshot = undefined;
-      bus.setRecoveryHold(false);
       budget.setRecoveryHold(false);
       removeRestartSnapshot(opts.stateDir);
       writeStatus();
-    }, 10 * 60_000);
+    }, delayMs);
     recoveryLeaseTimer.unref?.();
   };
   const memory = new MemoryClient(config.memory.worker_url ?? workerUrl(), 2000, log);
@@ -4465,7 +4469,7 @@ export async function startDaemon(opts: DaemonOptions) {
       armRecoveryLease();
       recoveryPeerSnapshot ??= Object.values(recoveryPeers());
       budget.setRecoveryHold(true);
-      bus.setRecoveryHold(true);
+      bus.setRecoveryHold(true, Array.isArray(msg.targetFeatures) && msg.targetFeatures.includes("recovery_deferred_hub"));
       await bus.fenceRecovery();
       { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
       const blocked = [...bus.peers].filter(([, peer]) => peer.state === "busy").map(([id]) => id);
@@ -4483,11 +4487,11 @@ export async function startDaemon(opts: DaemonOptions) {
     if (msg.op === "abort") {
       if (recoveryCommitted) return recoveryError("a committed recovery cannot be aborted");
       if (recoveryPhase === "released") return { t: "recovery", ok: true, recovery: recoveryView() };
+      bus.setRecoveryHold(false);
       recoveryOperationId = undefined;
       recoveryPhase = undefined;
       recoveryPeerSnapshot = undefined;
       clearTimeout(recoveryLeaseTimer);
-      bus.setRecoveryHold(false);
       budget.setRecoveryHold(false);
       writeStatus();
       return { t: "recovery", ok: true, aborted: true, recovery: recoveryView() };
@@ -4495,6 +4499,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (msg.op === "commit") {
       if ((recoveryPhase !== "prepared" && recoveryPhase !== "preparing") || !recoveryReady()) return recoveryError("recovery is not ready; inspect until peers are idle, approvals are complete and completion checks have finished");
       recoveryPhase = "prepared";
+      bus.setRecoveryHold(true, Array.isArray(msg.targetFeatures) && msg.targetFeatures.includes("recovery_deferred_hub"));
       recoveryPeerSnapshot ??= Object.values(recoveryPeers());
       const currentPeers = recoveryPeers();
       const peers = (recoveryPeerSnapshot ?? Object.values(currentPeers)).map((saved) => ({
@@ -4525,7 +4530,10 @@ export async function startDaemon(opts: DaemonOptions) {
       return { t: "recovery", ok: true, committed: true, recovery: { ...recoveryView(), phase: "prepared" } };
     }
     if (msg.op === "release") {
-      if (recoveryPhase === "released") return { t: "recovery", ok: true, released: true, recovery: recoveryView() };
+      if (recoveryPhase === "released") {
+        bus.setRecoveryHold(false); budget.setRecoveryHold(false);
+        return { t: "recovery", ok: true, released: true, recovery: recoveryView() };
+      }
       if (recoveryPhase !== "restored") return recoveryError("recovery is not restored");
       await bus.fenceRecovery();
       const current = recoveryPeers();
@@ -4797,7 +4805,8 @@ export async function startDaemon(opts: DaemonOptions) {
             try { log(`recovery ${sanitize(String(msg.op))} database contention: ${databaseBusySite(error).join("\n")}`); } catch { /* the reply still settles its rid */ }
             const busy = new RecoveryDatabaseBusy();
             reply({ ...recoveryError(busy.message), code: busy.code, retryable: busy.retryable });
-          } else reply(recoveryError((error as Error)?.message ?? "recovery operation failed"));
+          } else if (error instanceof RecoveryDeferredHubError) reply({ ...recoveryError(error.message), code: error.code });
+          else reply(recoveryError((error as Error)?.message ?? "recovery operation failed"));
         });
         return;
       case "send": {

package/src/hub/deferred-hub.ts

@@ -0,0 +1,60 @@
+import { HUB, MAX_HOP, type Envelope } from "./envelope.ts";
+
+/** ponytail: cap recovery at 2048 unpublished hub originals; replace with a paged durable outbox if measured recovery workloads exceed it. */
+export const MAX_DEFERRED_HUB = 2048;
+
+/** Refuses admission without dropping already accepted deferred work. */
+export class RecoveryDeferredHubError extends Error {
+  readonly code = "recovery_deferred_hub";
+  constructor(message = "recovery deferred hub notice limit reached; release or abort recovery before publishing more notices") {
+    super(message);
+    this.name = "RecoveryDeferredHubError";
+  }
+}
+
+/** Journal-less restore uses the same bounded core envelope shape as durable deferred work. */
+export function validateDeferredEnvelope(value: unknown, name: string): Envelope {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new RecoveryDeferredHubError(`${name} must be an envelope`);
+  const env = value as Record<string, unknown>;
+  const text = (value: unknown, max: number) => typeof value === "string" && value.length > 0 && value.length <= max;
+  if (!text(env.id, 256) || !text(env.trace, 256) || env.from !== HUB ||
+      typeof env.body !== "string" || env.body.length > 1_000_000 ||
+      !Number.isSafeInteger(env.hop) || (env.hop as number) < 0 || (env.hop as number) > MAX_HOP ||
+      !Number.isSafeInteger(env.ts) || (env.ts as number) < 0 ||
+      !["chat", "task", "review", "status", "budget", "presence"].includes(env.kind as string) ||
+      !["important", "status", "fyi"].includes(env.priority as string) ||
+      (!Array.isArray(env.to) || env.to.length > 256 || !env.to.every(peer => text(peer, 256))) ||
+      (env.private !== undefined && typeof env.private !== "boolean"))
+    throw new RecoveryDeferredHubError(`${name} is invalid`);
+  if (env.refs !== undefined) {
+    if (!env.refs || typeof env.refs !== "object" || Array.isArray(env.refs)) throw new RecoveryDeferredHubError(`${name}.refs is invalid`);
+    const refs = env.refs as Record<string, unknown>;
+    for (const key of ["repo", "branch", "commit", "task"])
+      if (refs[key] !== undefined && !text(refs[key], 4096)) throw new RecoveryDeferredHubError(`${name}.refs.${key} is invalid`);
+    if (refs.paths !== undefined && (!Array.isArray(refs.paths) || refs.paths.length > 256 || !refs.paths.every(path => text(path, 4096))))
+      throw new RecoveryDeferredHubError(`${name}.refs.paths is invalid`);
+  }
+  return value as Envelope;
+}
+
+/** Callers keep their existing envelope validation; this leaf checks deferred-only invariants. */
+export function validateDeferredHub(
+  value: unknown,
+  envelope: (value: unknown, name: string) => Envelope = validateDeferredEnvelope,
+  occupied: ReadonlySet<string> = new Set(),
+  name = "bus.deferredHub",
+): Envelope[] {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > MAX_DEFERRED_HUB)
+    throw new RecoveryDeferredHubError(`${name} must be an array of at most ${MAX_DEFERRED_HUB} hub envelopes`);
+  const ids = new Set<string>();
+  return value.map((item, index) => {
+    validateDeferredEnvelope(item, `${name}[${index}]`);
+    const env = envelope(item, `${name}[${index}]`);
+    if (env.from !== HUB) throw new RecoveryDeferredHubError(`${name}[${index}] is not hub-originated`);
+    if (ids.has(env.id) || occupied.has(env.id)) throw new RecoveryDeferredHubError(`${name}[${index}] repeats an accepted envelope id`);
+    ids.add(env.id);
+    return env;
+  });
+}

package/src/hub/delivery-journal.ts

@@ -6,6 +6,7 @@ import { HUB, USER, type Envelope, type Kind } from "./envelope.ts";
 import { heldDeliveryHints } from "./delivery-hints.ts";
 import { processLiveness } from "../pi/process-signature.ts";
 import { HUB_DB_BUSY_TIMEOUT_MS } from "./db-timeout.ts";
+import { validateDeferredHub } from "./deferred-hub.ts";
 
 export type JournalDeliveryState =
   | "queued"
@@ -167,6 +168,11 @@ function validateBus(value: unknown, name = "bus"): BusSnapshot {
     list(b.manualPaused, `${name}.manualPaused`, 4096).forEach((id) =>
       text(id, `${name}.manualPaused[]`, 256),
     );
+  const occupied = new Set<string>([
+    ...(b.seen as Envelope[]).map(env => env.id),
+    ...Object.values(queues).flatMap(items => (items as Envelope[]).map(env => env.id)),
+  ]);
+  validateDeferredHub(b.deferredHub, validateEnvelope, occupied, `${name}.deferredHub`);
   if (b.journal !== undefined) fail("nested journal snapshot is invalid");
   return b as unknown as BusSnapshot;
 }

package/src/hub/restart.ts

@@ -2,10 +2,11 @@ import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSy
 import { createHash } from "node:crypto";
 import { join } from "node:path";
 import type { BusSnapshot } from "./bus.ts";
-import type { PeerId, PeerState } from "./envelope.ts";
+import type { Envelope, PeerId, PeerState } from "./envelope.ts";
 import { MAX_HOP } from "./envelope.ts";
 import { validateJournalSnapshot } from "./delivery-journal.ts";
 import { atomicPrivateJSON } from "./recovery-store.ts";
+import { RecoveryDeferredHubError, validateDeferredHub } from "./deferred-hub.ts";
 
 export const RESTART_SCHEMA_VERSION = 1;
 
@@ -75,6 +76,16 @@ export function readRestartSnapshot(stateDir: string, expected: RestartReadExpec
   const bus = s.bus as Partial<BusSnapshot>;
   if (bus.schemaVersion !== 1 || !bus.queues || typeof bus.queues !== "object" || !bus.prefaces || typeof bus.prefaces !== "object" || !Array.isArray(bus.seen) || !bus.attempts || typeof bus.attempts !== "object" || !Array.isArray(bus.withdrawn)) return undefined;
   if (!Object.keys(bus.queues).every(peerId) || !Object.keys(bus.prefaces).every(peerId) || !Object.values(bus.queues).every((queue) => Array.isArray(queue) && queue.every((e) => isEnvelope(e))) || !Object.values(bus.prefaces).every((e) => isEnvelope(e)) || !bus.seen.every((e) => isEnvelope(e, true)) || !bus.withdrawn.every((id) => typeof id === "string" && id.length > 0) || !Object.values(bus.attempts).every((n) => Number.isSafeInteger(n) && n > 0)) return undefined;
+  try {
+    const occupied = new Set<string>([
+      ...bus.seen.map(env => env.id),
+      ...Object.values(bus.queues).flatMap(queue => queue.map(env => env.id)),
+    ]);
+    validateDeferredHub(bus.deferredHub, (value, name) => {
+      if (!isEnvelope(value)) throw new Error(`${name} is invalid`);
+      return value as Envelope;
+    }, occupied);
+  } catch (error) { if (error instanceof RecoveryDeferredHubError) throw error; return undefined; }
   if (!Array.isArray(s.manualPaused) || !s.manualPaused.every((id) => typeof id === "string") || !Array.isArray(s.peers) || !s.peers.every((peer) => peer && typeof peer === "object" && typeof peer.id === "string" && ["idle", "busy", "paused", "offline"].includes(peer.state as string) && Array.isArray(peer.queueIds) && peer.queueIds.every((id) => typeof id === "string"))) return undefined;
   if (s.integrity !== undefined && (!s.integrity || typeof s.integrity !== "object" || typeof s.integrity.boardDigest !== "string" || typeof s.integrity.budgetDigest !== "string" || !Array.isArray(s.integrity.manualPaused) || !s.integrity.manualPaused.every((id) => typeof id === "string") || !s.integrity.queues || typeof s.integrity.queues !== "object" || !Object.values(s.integrity.queues).every((ids) => Array.isArray(ids) && ids.every((id) => typeof id === "string")))) return undefined;
   if (bus.journal !== undefined) { try { validateJournalSnapshot(bus.journal); } catch { return undefined; } }

package/src/hub/tasks.ts

@@ -2415,7 +2415,7 @@ export class Tasks {
       const acceptance = previous.history.slice(assignment + 1).some(entry => entry.event === "accepted" && entry.by === peer);
       const boardEvidence = role === "owner" && acceptance;
       const mayHaveReceived = boardEvidence || this.d.bus.lastDeliveredTo(peer).some(matches) || this.d.bus.queueList(peer).some(row => ["dispatching", "accepted", "needs_review", "completed"].includes(row.state) && row.originals.some(matches));
-      for (const env of this.d.bus.snapshot(false).queues[peer] ?? []) if (matches(env)) this.d.bus.withdraw(env.id);
+      for (const env of this.d.bus.pendingEnvelopes(peer)) if (matches(env)) this.d.bus.withdraw(env.id);
       if (!mayHaveReceived) return;
       const body = role === "owner"
         ? `Task ${this.publicTitle(next)} is no longer assigned to you${next.owner ? `; its owner is now ${next.owner}` : "; it is unassigned"}. Do not accept or complete it; late calls under your former assignment are refused.`