@staix/agent-hub 0.12.35 → 0.12.37

package/src/hub/daemon.ts

@@ -1,3 +1,4 @@
+import { readReleaseHostAdmission, type ReleaseHostAdmission } from "./release-admission.ts";
 import { ContainerRunner, type RunnerOptions, type RunReceipt } from "./check-runner.ts";
 import { fetchSpec, specAvailable, specRefs } from "./spec-read.ts";
 import { isDenied } from "../local/deny.ts";
@@ -14,17 +15,19 @@ import { needs, type NeedsInput } from "../ui/needs.ts";
 import { loadPetConfig } from "../pet/config.ts";
 import { projectionConfig, TextProjections, type ProjectionConfig } from "./text-projection.ts";
 import { policyPaths, matchesPolicy } from "./path-policy.ts";
+import { buildReviewBrief } from "./review-brief.ts";
 import { profileName, projectProfile, resolveProfile, mergeProfileOverrides, type ProfileName } from "./profiles.ts";
 import { catalogAssignments, loadRoleCatalog, selectedRoles, roleIdentity } from "./roles.ts";
 import { ActivityRing } from "./activity.ts";
 import { JcodePeer } from "../adapters/jcode.ts";
 import { jcodeMcpReady } from "../cli/jcode-mcp.ts";
-import { loadSdlc, sdlcGh } from "./sdlc.ts";
+import { loadSdlc, readSpecEdit, sdlcGh } from "./sdlc.ts";
+import { claudeStateFile, ownTerminalRow, pathEvidence, transcriptPersisted } from "./claude-state.ts";
 import { peerRosterConfig, rosterAllows, type PeerRoster } from "./roster.ts";
 import { KNOWN_PEERS, OPTIONAL_PEERS, PLANNER_PEERS, SUPPORTED_PEERS, isSupportedPeer, STARTABLE_PEERS, isStartablePeer } from "../adapters/registry.ts";
 import { RecoveryDeferredHubError } from "./deferred-hub.ts";
 import { databaseBusySite, isDatabaseBusy, RecoveryDatabaseBusy } from "./recovery-error.ts";
-import { ADAPTERS, QUOTA_HANDOFF_PLATFORMS, NATIVE_CONFIG_BLOCKS, nativeConfigurationDefaults, mergeNativeConfiguration, retainNativeRouting, DAEMON_PORTS, definitionOf } from "../adapters/registry.ts";
+import { ADAPTERS, DEFAULT_REVIEW_POOL, REVIEW_POOL_KINDS, QUOTA_HANDOFF_PLATFORMS, NATIVE_CONFIG_BLOCKS, nativeConfigurationDefaults, mergeNativeConfiguration, retainNativeRouting, DAEMON_PORTS, definitionOf } from "../adapters/registry.ts";
 import { definitionOf as instanceDefinitionOf, KNOWN_PEERS as BASE_KNOWN_PEERS, SUPPORTED_PEERS as BASE_SUPPORTED_PEERS, STARTABLE_PEERS as BASE_STARTABLE_PEERS } from "../adapters/registry.ts";
 import { effectiveInstanceRoles, instancePeerIds, validateInstances, type InstancesConfig } from "./instances.ts";
 import { INSTANCE_CONFIG_FILES, readInstanceConfig, readInstanceConfigLayers, readInstanceRoleConfig } from "./instance-config.ts";
@@ -46,7 +49,7 @@ import { resolveSettledRoles } from "./settled-roles.ts";
 import { CONFIG_SOURCE_FILES, configFingerprint, configSourceTexts, parseConfigSources, type ConfigSources } from "./config-reload.ts";
 import { eventLog, readEvents, tokenDeltas, type RoleIdentity } from "./events.ts";
 import { ExecutionBudget } from "./execution-budget.ts";
-import { claudeReportedTokens, readClaudeTranscriptUsage, waitForClaudeCompletion } from "./usage.ts";
+import { claudeReportedTokens, readClaudeTranscriptCompletion, readClaudeTranscriptUsage, waitForClaudeCompletion } from "./usage.ts";
 import type { ServerWebSocket } from "bun";
 import { AcpPeer, QwenIdentityError, type PermissionRequest } from "../adapters/acp.ts";
 import { CodexPeer } from "../adapters/codex-appserver.ts";
@@ -61,6 +64,9 @@ import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
 import { DEFAULT_NETWORK_ALLOW, startEgressProxy, type EgressProxy } from "../local/proxy.ts";
 import { runTool, toolResultFailed, TOOL_SCHEMAS, type ToolApproval, type ApprovalObserver, type ToolContext } from "../local/tools.ts";
 import { LocalPeer } from "../adapters/local-worker.ts";
+import { ReviewerPrintPeer } from "../adapters/reviewer-print.ts";
+import { reviewerPoolConfig } from "./reviewer-pool-config.ts";
+import { reviewDiff } from "../adapters/claude-print.ts";
 import { Capture, skipTools } from "../memory/capture.ts";
 import { DEFAULT_OMNIROUTE, OmniRoute, type OmniRouteConfig } from "../omniroute/client.ts";
 import { Sidecar } from "../switchyard/sidecar.ts";
@@ -69,12 +75,12 @@ import { Board, isClosedTaskState, taskProposalAt, taskHasStarted, CLASSES, type
 import { Budget, claudeWindows, codexWindows, DEFAULT_BUDGET, type BudgetConfig } from "./budget.ts";
 import { HUB } from "./envelope.ts";
 import { recallMemoryLines, trimToTokens } from "../memory/recall.ts";
-import { closeSync, constants as fsConstants, openSync, readSync, statSync } from "node:fs";
+import { closeSync, constants as fsConstants, openSync, lstatSync, readSync, statSync } from "node:fs";
 import { basename, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
 import { realPath, hubHome } from "./project.ts";
 import type { BusEvent } from "./bus.ts";
-import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, roleContract, TASK_TOOLS, BOUNDED_TASK_TOOLS, profileTaskTools } from "./hub-tools.ts";
+import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS, BOUNDED_TASK_TOOLS, profileTaskTools } from "./hub-tools.ts";
 import { Conductor, ConductorHolds, conductorPeer, conductorProgressSink, publicConductorTask, publicPeerBudget, type ConductEvent } from "./conductor.ts";
 import { SupervisionFeed } from "./supervision.ts";
 import { drainCliAudits } from "../cli/identity-audit.ts";
@@ -115,10 +121,10 @@ import { ContextWindows, DEFAULT_CONTEXT, acpContext, claudeContext, type Contex
 import { projectFileTool, scopedWriteBlocked } from "../cli/facts-hook.ts";
 import { detectTooling } from "./tooling.ts";
 import { looksSecret, DEFAULT_LEASE_MS, extractNodes, memoryHome, SUGGESTED, taskKey, type CandidateStore, type MemoryStore, type GoalView, type Suggested, type View as MemoryView } from "@staix/agent-mem";
-import { AGENT_MEM_VERSION, openProfileMemory, openProfileCandidates, type MemoryProfileBinding, type UnboundMemoryProfileReceipt } from "./memory-profile.ts";
+import { memoryProjectKey } from "@staix/agent-mem";
+import { AGENT_MEM_VERSION, MEMORY_SPLIT_INCOMPLETE, memoryProjectFor, openProfileMemory, openProfileCandidates, type MemoryProfileBinding, type UnboundMemoryProfileReceipt } from "./memory-profile.ts";
 import { syncMemory } from "@staix/agent-mem";
 import { MEMORY_READ_TOOLS, memoryRead, validateMemoryRead } from "./read-tools.ts";
-import { memoryProjectKey } from "@staix/agent-mem";
 import { nativeRecall } from "../memory/recall.ts";
 import { promotionScreen, withoutPii, mentionsPrivatePath } from "./memory-policy.ts";
 
@@ -181,7 +187,7 @@ export interface HubConfig {
   /** Per-sender rate limits and repeat suppression for what agents send (issue #38). */
   limits: LimitsConfig;
   /** Reviewer choice from recorded review outcomes, once a reviewer has `min_reviews` of an implementer (issue #35). */
-  review: { adaptive: boolean; min_reviews: number };
+  review: { adaptive: boolean; min_reviews: number; pool?: string[]; rerotate?: boolean };
   /** After an unplanned stop, start Kimi, Pi and the local worker again with their recorded sessions (issue #37). */
   recovery: { auto_resume_after_crash: boolean };
   /** Per peer, the hub-tool capabilities it has (issue #39); a peer not listed has all of them. */
@@ -435,6 +441,8 @@ function mlxPinProblem(routing: Routing, project: boolean): string | undefined {
 }
 
 export interface DaemonOptions {
+  /** Host-only admission transport; never selected by project config or tools. */
+  releaseHostAdmission?: (cwd: string) => Promise<ReleaseHostAdmission>;
   projectId?: string;
   instanceId?: string;
   cwd: string;
@@ -598,20 +606,26 @@ export async function startDaemon(opts: DaemonOptions) {
   let ready = false;
   try {
   const loadedConfig = opts.config ?? loadConfig(opts.cwd);
+  reviewerPoolConfig(loadedConfig.review, DEFAULT_REVIEW_POOL, REVIEW_POOL_KINDS);
   const lifecycleConfig = loadSdlc(opts.cwd, VERSION);
   // Preserve embedding-owned policy references, but never publish reloads into shared defaults.
   const ownedConfig = Object.fromEntries(Object.entries(loadedConfig).map(([key, value]) => [key, !opts.config || value === (DEFAULT_CONFIG as unknown as Record<string, unknown>)[key] ? structuredClone(value) : value])) as unknown as HubConfig;
   const declarations = validateInstances(loadedConfig.instances);
   const extraIds = Object.keys(declarations);
+  // #450 I3: channel extras (Claude) attach from the person's terminal; the hub never starts them and their hello is admitted.
+  const channelExtras = extraIds.filter(id => instanceDefinitionOf(id, declarations)?.identity.mcp === "channel-plugin");
+  // Every Claude-family peer whose own state files the daemon reads: the builtin channel kinds, then their declared instances.
+  const channelPeers = [...ADAPTERS.filter(definition => definition.identity.mcp === "channel-plugin").map(definition => definition.kind), ...channelExtras];
   const executionRoots = new Map<string, string>();
   const executionOwners = new Map<string, { owner: PeerAdapter; cwd: string }>();
+  const reviewerUnavailable = new Map<string, string>();
   const roles = { ...loadedConfig.roles };
   const permissionModesFromInstances: Record<string, PermissionMode> = {};
   const startModesFromInstances: PeerStartConfig = {};
   const instancePermissionSources: NonNullable<HubConfig["permission_default_sources"]> = {};
   for (const [id, declaration] of Object.entries(declarations)) {
     roles[id] = effectiveInstanceRoles(id, declarations, loadedConfig.roles);
-    startModesFromInstances[id] = { start_mode: "headless" };
+    if (!channelExtras.includes(id)) startModesFromInstances[id] = { start_mode: "headless" };
     if (declaration.permission_mode !== undefined) {
       permissionModesFromInstances[id] = declaration.permission_mode;
       instancePermissionSources[id] = { mode: declaration.permission_mode, source: ".agenthub/config.local.json" };
@@ -627,10 +641,18 @@ export async function startDaemon(opts: DaemonOptions) {
   const definitionOf = (peer: string) => instanceDefinitionOf(peer, declarations);
   const KNOWN_PEERS: readonly string[] = [...BASE_KNOWN_PEERS, ...extraIds];
   const SUPPORTED_PEERS: readonly string[] = [...BASE_SUPPORTED_PEERS, ...extraIds];
-  const STARTABLE_PEERS: readonly string[] = [...BASE_STARTABLE_PEERS, ...extraIds];
+  const STARTABLE_PEERS: readonly string[] = [...BASE_STARTABLE_PEERS, ...extraIds.filter(id => !channelExtras.includes(id))];
   const isSupportedPeer = (peer: unknown): peer is string => typeof peer === "string" && definitionOf(peer) !== undefined;
-  const isStartablePeer = (peer: unknown): peer is string => typeof peer === "string" && definitionOf(peer)?.start.conductorStartable === true;
-  const RESERVED_IDS = new Set([...BASE_RESERVED_IDS, ...extraIds]);
+  const isStartablePeer = (peer: unknown): peer is string => typeof peer === "string" && !channelExtras.includes(peer) && definitionOf(peer)?.start.conductorStartable === true;
+  const RESERVED_IDS = new Set([...BASE_RESERVED_IDS, ...extraIds.filter(id => !channelExtras.includes(id))]);
+  // #223 R2: a declared instance whose effective roles are exactly reviewer gets review requests and its own task notices only.
+  const reviewOnlyPeer = (peer: string): boolean => Object.hasOwn(declarations, peer) && config.roles[peer]?.length === 1 && config.roles[peer]![0] === "reviewer";
+  /** #520: a task under review shows its review brief to whoever may read it (owner, reviewer, conductor). */
+  const briefField = (task: Task): { brief?: string } => { if (task.state !== "in_review") return {}; const text = tasks.briefText(task); return text ? { brief: text } : {}; };
+  /** #223 R2: a review-only instance reads the spec, refs and earlier verdicts of a task, never the builder's narrative. */
+  const reviewerView = (peer: string, view: Record<string, unknown>): Record<string, unknown> => !reviewOnlyPeer(peer) || !Array.isArray(view.history) ? view
+    : { ...view, history: (view.history as { event?: unknown; note?: unknown }[]).map(({ note, ...h }) => h.event === "approved" || h.event === "changes_requested" ? { ...h, note } : h) };
+  const reviewOnlyItem = (peer: string, env: Envelope): boolean => env.from === USER || env.from === HUB && (env.kind === "review" || (env.kind === "task" && env.to?.includes(peer) === true));
   const SETTINGS = projectSettings(declarations);
   const settingDef = (key: unknown) => instanceSettingDef(key, declarations);
   const accountOf = (peer: string) => definitionOf(peer)?.budget?.account ?? peer;
@@ -872,6 +894,7 @@ export async function startDaemon(opts: DaemonOptions) {
    * has not stopped since its cohort task closed. Workflow events and anything to the console are never held back.
    */
   const silence = (env: Envelope, to: PeerId): string | undefined => {
+    if (reviewOnlyPeer(to) && env.to?.includes(to) && !reviewOnlyItem(to, env)) return `${to} is a review-only instance: it receives review requests only (send a review through the task board)`;
     if (!turnFree() || env.from === USER || env.from === HUB || env.from === DIGEST || env.priority === "fyi" || env.kind !== "chat" || to === USER) return undefined;
     const cohort = tasks.silenced(env.from, to);
     if (!cohort) return undefined;
@@ -914,7 +937,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const staleOff = () => config.experiments?.stale_notices === "deliver";
   if (staleOff()) log("experiment: stale notices are delivered as before 0.12.4 (the issue #106 ablation)");
   const requestedPeerStops = new Set<string>();
-  const bus = new Bus({ rostered: membershipAllowed, deliveryHeld: peer => requestedPeerStops.has(peer) || rosterChanging === peer, journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs), admit, relevant: (peer, env) => env.refs?.boundedCheck || env.refs?.supervision || env.refs?.backlog ? relevantNotice(peer, env) : staleOff() || relevantNotice(peer, env), silence,
+  const bus = new Bus({ rostered: membershipAllowed, deliveryHeld: peer => requestedPeerStops.has(peer) || rosterChanging === peer, journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs), admit, relevant: (peer, env) => reviewOnlyPeer(peer) && !reviewOnlyItem(peer, env) ? `not for ${peer}: a review-only instance receives review requests only` : env.refs?.boundedCheck || env.refs?.supervision || env.refs?.backlog ? relevantNotice(peer, env) : staleOff() || relevantNotice(peer, env), silence,
     onImportantQueued: (peer, counts) => { const p = bus.peers.get(peer); if (p instanceof WsPeer) p.notifyQueued(counts); } });
   startupCleanup.push(() => bus.closeJournal());
   const manualPaused = new Set<PeerId>(bus.manualPausedPeers()); // recovery never lifts an operator's pause
@@ -961,7 +984,9 @@ export async function startDaemon(opts: DaemonOptions) {
   const recalled = new Set<PeerId>(); // once per peer per hub run, however often the peer's session restarts
   // #258: the hub's own store, machine-wide in ~/.agenthub/memory. Entries are filed under the project's memory key (its
   // normalized origin remote, the same on every machine; without one, its path). Fail-open: without it the hub works as before.
-  const memoryProject = memoryProjectKey(opts.cwd);
+  // Daemon start never depends on the memory home: an unresolvable home falls back to the raw key.
+  const memoryProjectRaw = memoryProjectKey(opts.cwd);
+  const memoryProject = (() => { try { return memoryProjectFor(opts.cwd); } catch { return memoryProjectRaw; } })();
   let memoryStore: MemoryStore | undefined;
   let memoryBinding: MemoryProfileBinding | undefined;
   let memoryProblem: string | undefined;
@@ -973,11 +998,11 @@ export async function startDaemon(opts: DaemonOptions) {
     memoryNotice(`hub native memory disabled: ${reason}`);
   };
   if (config.memory.native) {
-    try { const opened = openProfileMemory({ ttlMs: (config.memory.short_ttl_days ?? 14) * 24 * 3600_000, log, screen: promotionScreen(memoryProject, opts.cwd, () => activeRouting(), () => config.pii?.paths ?? [], (key) => {
+    try { const opened = openProfileMemory({ project: memoryProject, projectKey: memoryProjectRaw, ttlMs: (config.memory.short_ttl_days ?? 14) * 24 * 3600_000, log, screen: promotionScreen(memoryProject, opts.cwd, () => activeRouting(), () => config.pii?.paths ?? [], (key) => {
       const m = /#(\d+)@(\d+)$/.exec(key), t = m ? board.get(Number(m[1])) : undefined;
       return t && String(t.created) === m![2] ? [...(t.refs.paths ?? []), ...(t.plan?.paths ?? [])] : [];
     }) }, memoryUnavailable); memoryStore = opened.store; memoryBinding = opened.binding; startupCleanup.push(() => opened.store.close()); }
-    catch { if (!memoryProblem) memoryUnavailable("memory profile unavailable; inspect the selector and generation, then restart the hub"); }
+    catch (error) { if (!memoryProblem) memoryUnavailable(error instanceof Error && error.message === MEMORY_SPLIT_INCOMPLETE ? error.message : "memory profile unavailable; inspect the selector and generation, then restart the hub"); }
   }
   const memoryProfileStatus = (person = false) => {
     const value = memoryBinding?.status(memoryStore) ?? ({
@@ -1080,7 +1105,7 @@ export async function startDaemon(opts: DaemonOptions) {
 
   /** Session-start cross-platform recall. Awaited before the peer can receive anything, so it rides on the first delivery. Fail-open. */
   async function ensurePreface(peer: PeerId): Promise<void> {
-    if ((!config.memory.enabled && !memoryStore) || recalled.has(peer)) return;
+    if ((!config.memory.enabled && !memoryStore) || recalled.has(peer) || reviewOnlyPeer(peer)) return; // #223 R2: no shared memory in a fresh review
     // The hub's own long-term decisions, contracts and fails lead; claude-mem's recent work follows, each with half the budget.
     let own: string | undefined;
     try {
@@ -1276,9 +1301,55 @@ export async function startDaemon(opts: DaemonOptions) {
       specReason: !may(peer, "spec_read") ? `capabilities.${peer}` : specState.reason ?? "gh unauthenticated" }];
     }));
   };
+  const releaseQuotaSnapshot = () => {
+    const headroom = budget.headroom(), rows = [...bus.peers].filter(([, peer]) => peer.state !== "offline");
+    const reasons: string[] = [], notes: string[] = [];
+    for (const [id] of rows) {
+      const definition = definitionOf(id), account = definition?.budget?.account ?? id;
+      if (manualPaused.has(id)) reasons.push(`${id}: manual pause; ahub resume ${id}`);
+      if (budget.record(account)) reasons.push(`${id}: paused quota window; inspect ahub budget or ahub budget resume ${id}`);
+      if (definition && (!definition.budget || definition.budget.quotaExempt)) continue;
+      // Source availability belongs to the shared account, including its offline base and reviewer variants.
+      // The soft token window uses the same definition capability that resets it on resume.
+      const hasSource = accountMembers(account).some(member => {
+        const policy = definitionOf(member)?.budget;
+        return !!policy?.reader || !!policy?.resetSoftTokensOnResume && config.budget.kimi_tokens_5h > 0;
+      });
+      if (definition && !hasSource) {
+        notes.push(`${id}: no quota source`);
+        continue;
+      }
+      const reading = headroom[account];
+      if (!reading || !Number.isFinite(reading.headroom)) reasons.push(`${id}: quota window unknown or stale; inspect ahub budget or ahub budget set ${id} <0..1>`);
+      else if (reading.headroom <= 1 - config.budget.gate) reasons.push(`${id}: quota window below release headroom; wait for reset or inspect ahub budget set ${id} <0..1>`);
+    }
+    const idle = rows.every(([, peer]) => peer.state === "idle");
+    return { quota: reasons.length === 0, idle, reasons, notes, signature: JSON.stringify({ gate: config.budget.gate, softTokens: config.budget.kimi_tokens_5h, rows: rows.map(([id, peer]) => [id, peer.state]), headroom, paused: rows.map(([id]) => manualPaused.has(id)), records: Object.entries(budget.status()).map(([peer, row]) => [peer, row.paused?.since, row.paused?.resetsAt]) }) };
+  };
+  const releaseWindow = async () => {
+    const host = await (opts.releaseHostAdmission ?? readReleaseHostAdmission)(opts.cwd), quota = releaseQuotaSnapshot();
+    if (stopping || recoveryActive()) quota.reasons.push("recovery or shutdown is holding release planning");
+    return { at: Date.now(), host: host.admitted && !stopping && !recoveryActive(), quota: quota.quota, idle: quota.idle, reasons: [...(host.reason ? [host.reason] : []), ...quota.reasons, ...quota.notes], close: host.close, current: () => host.current?.() !== false && !stopping && !recoveryActive() && releaseQuotaSnapshot().signature === quota.signature };
+  };
   const tasks: Tasks = new Tasks({
+    releaseWindow,
     capabilities: peerCapabilities, repository: memoryRepo,
+    plannerBlocks: () => Object.fromEntries(bus.knownPeers().map(peer => {
+      const codes: ("approvals" | "quota")[] = [];
+      if ([...permissions.values()].some(request => request.peer === peer && request.expiresAt > Date.now())) codes.push("approvals");
+      if (budget.record(peer)) codes.push("quota");
+      return [peer, codes];
+    })),
     instances: () => declarations,
+    reviewOnly: reviewOnlyPeer,
+    // #223: a headless reviewer's verdict holds only while the same child it started with still runs for that task.
+    reviewAuthority: (by, task) => {
+      if (!definitionOf(by)?.reviewer) return undefined;
+      const peer = bus.peers.get(by) as ReviewerPrintPeer | undefined, token = peer?.reviewToken(task);
+      return () => token !== undefined && bus.peers.get(by) === peer && peer?.reviewToken(task) === token ? undefined : `no review of task #${task} is running for ${by}`;
+    },
+    // #223 R4: fresh only when the verdict comes from a reviewer session the hub started for this task's review.
+    reviewContext: (by, task) => !!definitionOf(by)?.reviewer && (bus.peers.get(by) as ReviewerPrintPeer | undefined)?.reviewing === task ? "fresh" : "continuing",
     // Proof belongs to the adapter generation actually started in the validated root. A role-only
     // reload cannot turn a canonical reviewer process into an isolated implementation owner.
     ownerIsolation: () => Object.fromEntries(extraIds.map(id => {
@@ -1294,6 +1365,10 @@ export async function startDaemon(opts: DaemonOptions) {
     catalog,
     sessionRoles: peer => bus.peers.has(peer) && bus.stateOf(peer) !== "offline" ? preparedSessionRoles.get(peer) ?? [] : [],
     projectedReview: task => reviewProjection(task),
+    reviewBrief: task => {
+      const root = executionRoot(task.owner ?? "");
+      return buildReviewBrief(root, task.refs.commit, { privatePath: path => isDenied(path, config.local.deny) || matchesPolicy(root, path, config.pii?.paths ?? [], true), nameable: tasks.nameable });
+    },
     sdlc: { config: () => lifecycleConfig, gh: (args, timeout, _cwd, bound) => sdlcGh(args, timeout, opts.cwd, bound) },
     board,
     bus,
@@ -1368,7 +1443,7 @@ export async function startDaemon(opts: DaemonOptions) {
     recordCohort: (c) => event({ type: "cohort", ...c }),
     // The trace holds peer names and numbers only (never task text): it is the inputs a later check of the prediction needs.
     recordSplit: (task, p, where) => event({ type: "split", task, where, verdict: p.verdict, ...(p.single ? { single: p.single, splitS: p.splitS, singleS: p.singleS } : {}), ...(p.verdict === "unknown" ? { reason: p.trace.at(-1)!.replace(/^ {2}unknown: /, "").slice(0, 200) } : {}), trace: p.trace.slice(1).map((l) => l.trim()).slice(0, 10) }),
-    failing: () => bus.failingPeers(),
+    failing: () => ({ ...bus.failingPeers(), ...Object.fromEntries(reviewerUnavailable) }),
     held: () => Object.fromEntries(bus.knownPeers().flatMap((peer) => { const hold = queueHold(peer); return hold ? [[peer, hold]] : []; })),
   });
   relevantNotice = (peer, env) => {
@@ -1547,8 +1622,8 @@ export async function startDaemon(opts: DaemonOptions) {
     } catch { /* no transcript yet: no readback */ }
   };
   /** Claude's transcript for this session: the one the status line reported, or the hook's own, inside Claude's projects. */
-  const claudeTranscript = (sessionId: string | undefined, fromHook: unknown): string | undefined => {
-    const reported = claudeSession();
+  const claudeTranscript = (sessionId: string | undefined, fromHook: unknown, peer = "claude"): string | undefined => {
+    const reported = claudeSession(peer);
     if (reported.transcriptPath && (!sessionId || reported.sessionId === sessionId)) return reported.transcriptPath;
     if (!sessionId || typeof fromHook !== "string" || !isAbsolute(fromHook) || basename(fromHook) !== `${sessionId}.jsonl`) return undefined;
     try {
@@ -1572,6 +1647,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const activeAt = new Map<PeerId, number>();
   interface NativeTurnStart { at: number; baseline?: string; generation: string; session: string; launch: string }
   const nativeTurnStart = new Map<PeerId, NativeTurnStart>();
+  const stopUnconfirmedNoticed = new WeakSet<NativeTurnStart>();
   const nativeStopWaits = new Map<PeerId, { start: NativeTurnStart; wait: ReturnType<typeof waitForClaudeCompletion> }>();
   /** Every Claude hook call's own start-up and the hub's time for it, summed per turn (issue #108): reported at Stop. */
   const hookStats = new Map<PeerId, { n: number; startupMs: number; hubMs: number; maxStartupMs: number }>();
@@ -1615,7 +1691,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const contextSession = (peer: PeerId): string | undefined => {
     const p = bus.peers.get(peer);
     if (p instanceof WsPeer && p.claiming) return undefined;
-    if (definitionOf(peer)?.turnEnd === "native-hook") { const c = claudeSession(); return c.sessionId ? `${c.sessionId}:${c.launchId ?? ""}` : undefined; }
+    if (definitionOf(peer)?.turnEnd === "native-hook") { const c = claudeSession(peer); return c.sessionId ? `${c.sessionId}:${c.launchId ?? ""}` : undefined; }
     if (p instanceof CodexPeer) return p.thread || undefined;
     if (p instanceof AcpPeer || p instanceof PiPeer) { const id = p.recoveryMetadata().sessionId; return typeof id === "string" ? id : undefined; }
     return undefined;
@@ -1829,7 +1905,7 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   // Claude's numbers arrive through the status line tee `ahub claude` installs (src/cli/statusline-tee.ts).
   let claudeUsageSeen = 0;
-  let claudeContextSeen = "";
+  const claudeContextSeen = new Map<string, string>();
   const contextTailSeen = new Map<PeerId, string>();
   const intervals = [
     setInterval(() => {
@@ -1861,16 +1937,16 @@ export async function startDaemon(opts: DaemonOptions) {
           for (const c of consoles) if (c.data.tail) c.send(JSON.stringify({ t: "context", peer, reading }));
         }
       }
-      try {
-        const file = join(opts.stateDir, "claude-context.json");
+      for (const claudePeer of channelPeers) try {
+        const file = join(opts.stateDir, claudeStateFile("claude-context", claudePeer));
         const payload = readFileSync(file, "utf8");
-        if (payload === claudeContextSeen) return;
+        if (payload === claudeContextSeen.get(claudePeer)) continue;
         const c = JSON.parse(payload);
-        const session = claudeSession();
-        if (c.instanceId !== instanceId || !session.sessionId || c.sessionId !== session.sessionId || c.launchId !== session.launchId || !["idle", "busy", "paused"].includes(bus.stateOf("claude"))) return;
-        claudeContextSeen = payload;
-        const bound = contextSession("claude");
-        if (bound) contexts.report("claude", claudeContext(c.context, bound, c.at), bound);
+        const session = claudeSession(claudePeer);
+        if (c.instanceId !== instanceId || !session.sessionId || c.sessionId !== session.sessionId || c.launchId !== session.launchId || !["idle", "busy", "paused"].includes(bus.stateOf(claudePeer))) continue;
+        claudeContextSeen.set(claudePeer, payload);
+        const bound = contextSession(claudePeer);
+        if (bound) contexts.report(claudePeer, claudeContext(c.context, bound, c.at), bound);
       } catch { /* absent or unreadable native telemetry is unknown */ }
     }, 1000),
     setInterval(() => budget.tick(), 30_000),
@@ -1925,7 +2001,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const SERVER_JS = join(import.meta.dir, "..", "..", "plugins", "agent-hub", "server.js");
   // What the hub's MCP server offers a native peer. Codex approves them in config, Kimi's requests for exactly these
   // names are answered by the hub; every call still passes daemon role/capability checks before its effects.
-  const HUB_TOOLS = ["hub_send", ...TASK_TOOLS.map((t) => t.name), ...CONDUCTOR_TOOLS.map((t) => t.name)];
+  const HUB_TOOLS = ["hub_send", ...TASK_TOOL_NAMES, ...CONDUCTOR_TOOLS.map((t) => t.name)];
   const HUB_TOOL_TITLES = new Set(HUB_TOOLS.map((name) => `mcp__agent-hub__${name}`));
   const toolEnv = (peer: PeerId, deliveryOnly = false) => ({ ...(deliveryOnly ? { AGENTHUB_DELIVERY_ONLY: "true" } : {}), AGENTHUB_MODE: "tools", AGENTHUB_PEER_ID: peer, AGENTHUB_STATE_DIR: opts.stateDir, AGENTHUB_PROJECT_DIR: opts.cwd });
 
@@ -1980,11 +2056,13 @@ export async function startDaemon(opts: DaemonOptions) {
     if (op === "hub_memory_correct") correctionInput(a);
     if (CONDUCTOR_TOOL_NAMES.has(op)) {
       if (piiTurn && ["hub_task_assign", "hub_task_escalate", "hub_peer_start"].includes(op)) throw new PreEffectToolRefusal("conductor mutations are unavailable during a PII turn");
-      return JSON.stringify(await conductor.execute(by, op, a));
+      const result = await conductor.execute(by, op, a);
+      const shown = op === "hub_task_show" && result && typeof result === "object" ? board.get(Number(a.id)) : undefined;
+      return JSON.stringify(shown ? { ...reviewerView(by, result as Record<string, unknown>), ...briefField(shown) } : result);
     }
     // Inside a PII turn the worker's words may carry the PII whatever they are attached to: a note would go to
     // claude-mem (a cloud observer) and a new task could be routed to a cloud peer without matching any pattern.
-    if (piiTurn && (MEMORY_READ_TOOLS.has(op) || op === "hub_memory_correct" || op === "hub_remember" || op === "hub_task_propose" || op === "hub_sdlc_record" || op === "hub_backlog_plan" || op === "hub_backlog_undo" || op === "hub_backlog_pull" || op === "hub_backlog_split" || op === "release_new")) throw new PreEffectToolRefusal(`${op} is not available while working on a PII task: its text must not leave this machine`);
+    if (piiTurn && (MEMORY_READ_TOOLS.has(op) || op === "hub_memory_correct" || op === "hub_remember" || op === "hub_task_propose" || op === "hub_sdlc_record" || op === "hub_plan_review" || op === "hub_sdlc_costs" || op.startsWith("hub_release_") || op === "hub_backlog_return_untouched" || op === "hub_backlog_plan" || op === "hub_backlog_undo" || op === "hub_backlog_pull" || op === "hub_backlog_split" || op === "release_new")) throw new PreEffectToolRefusal(`${op} is not available while working on a PII task: its text must not leave this machine`);
     // The same words attached to an ordinary task would reach its reviewer, its owner, overlapping owners (a plan, the
     // completed-change notice) and claude-mem. A turn that holds a PII task acts on ordinary tasks in a turn of its own.
     if (piiTurn && (op === "hub_task_done" || op === "hub_review" || (op === "hub_task_accept" && a.plan != null))) {
@@ -2098,8 +2176,28 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       case "hub_backlog_list":
         return JSON.stringify(tasks.backlogList(by));
+      case "hub_release_new":
+        return JSON.stringify(tasks.publicRelease(await tasks.newRelease(by, { name: a.name, goal: a.goal, order: a.order })));
+      case "hub_release_report":
+        return JSON.stringify(tasks.releaseReport(by, a.id));
+      case "hub_release_configure":
+        return JSON.stringify(tasks.publicRelease(await tasks.configureRelease(by, { id: a.id, revision: a.revision, hotfix: a.hotfix, state: a.state, cut: a.cut })));
+      case "hub_release_assign":
+        return JSON.stringify(tasks.publicView(await tasks.assignRelease(by, { id: a.id, revision: a.revision, release: a.release, reason: a.reason })));
+      case "hub_release_cut":
+        return JSON.stringify(tasks.publicRelease(await tasks.cutRelease(by, { id: a.id, revision: a.revision })));
       case "hub_release_list":
         return JSON.stringify(tasks.releaseList(by));
+      case "hub_planner_groom":
+        return JSON.stringify(await tasks.groomingDigest(by));
+      case "hub_sdlc_costs":
+        return JSON.stringify(await tasks.costReport(by, a.repo));
+      case "hub_plan_review": {
+        const { id, ...review } = a;
+        return JSON.stringify(tasks.publicView(await tasks.recordPlanReview(by, id, review)));
+      }
+      case "hub_backlog_return_untouched":
+        return JSON.stringify(tasks.publicView(await tasks.returnUntouchedToBacklog(by, { id: a.id, revision: a.revision, reason: a.reason })));
       case "hub_backlog_plan":
         return JSON.stringify(tasks.publicView(await tasks.planBacklog(by, { id: a.id, revision: a.revision, fields: a.fields, reason: a.reason })));
       case "hub_backlog_pull":
@@ -2120,7 +2218,8 @@ export async function startDaemon(opts: DaemonOptions) {
         return [line(t), overlap, tasks.claimRoleGuidance(t, by), t.owner === by ? tasks.planGuardText(t) : ""].filter(Boolean).join("\n");
       }
       case "hub_task_accept": {
-        const t = tasks.accept(by, a.id, a.plan);
+        // S1 spec acceptance and S9 plan review are checked against one task snapshot before acceptance.
+        const t = await tasks.acceptReviewed(by, a.id, a.plan);
         // A silent cohort (issue #107): the owners' plans come with every accept, as what the newcomer works from.
         const silent = tasks.silentFor(t.id);
         const overlap = a.plan == null && !silent ? "" : tasks.overlaps(t);
@@ -2151,9 +2250,10 @@ export async function startDaemon(opts: DaemonOptions) {
         return extra ? `${result}\n${extra}` : result;
       }
       case "hub_sdlc_record":
+        await tasks.specStageGate(by, a.id, a.receipt); // #481 S1: a live spec edit-time check before a build stage
         return line(tasks.recordLifecycle(by, a.id, a.receipt));
       case "hub_review":
-        return line(await tasks.review(by, a.id, a.verdict, a.note, a.unmet, a.head));
+        return line(await tasks.review(by, a.id, a.verdict, a.note, a.unmet, a.head, a.coverage));
       case "hub_remember":
         return tasks.remember(by, a);
       case "hub_checkpoint": {
@@ -2193,7 +2293,8 @@ export async function startDaemon(opts: DaemonOptions) {
     if (op === "task_show" && by !== USER) {
       const task = board.get(Number(a.id));
       if (task?.state === "backlog") throw new PreEffectToolRefusal("backlog is read through planner tools");
-      return JSON.stringify(task ? { ...publicConductorTask(task, (t) => tasks.publicView(t, true)), flowRevision: task.history.length } : `no task #${a.id}`);
+      if (!task) return JSON.stringify(`no task #${a.id}`);
+      return JSON.stringify({ ...reviewerView(by, publicConductorTask(task, (t) => tasks.publicView(t, true))), ...briefField(task), flowRevision: task.history.length });
     }
     if (op === "route_explain" && by !== USER) {
       if (a.id !== undefined && board.get(Number(a.id))?.state === "backlog") throw new PreEffectToolRefusal("backlog is read through planner tools");
@@ -2220,6 +2321,10 @@ export async function startDaemon(opts: DaemonOptions) {
       case "backlog_pull":
       case "backlog_return":
         return line(await tasks.moveBacklog(by, a.id, op === "backlog_pull"));
+      case "review_brief": {
+        const task = board.get(Number(a.id));
+        return task ? tasks.briefText(task) || `task #${task.id} names no commit, or is private: no brief` : `no task #${a.id}`;
+      }
       case "task_show": {
         const task = board.get(Number(a.id));
         return JSON.stringify(task ? { ...task, flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) } : `no task #${a.id}`, null, 2);
@@ -2349,19 +2454,20 @@ export async function startDaemon(opts: DaemonOptions) {
         // #64: a Claude session that never persisted a transcript cannot be resumed, so the
         // restore gate accepted a fresh session and nothing it stood for is lost. Snapshots
         // written before this flag existed are re-derived from disk.
-        const unpersistedClaude = definitionOf(saved.id)?.session.missingEvidence === "transcript" && (saved.sessionPersisted === false || (saved.sessionPersisted === undefined && !claudeTranscriptPersisted(saved.sessionId)));
+        const unpersistedClaude = definitionOf(saved.id)?.session.missingEvidence === "transcript" && (saved.sessionPersisted === false || (saved.sessionPersisted === undefined && !claudeTranscriptPersisted(saved.id, saved.sessionId)));
         if (!unpersistedClaude && !waived()) return false;
       }
       return true;
     });
   };
-  const claudeSession = (): { sessionId?: string; transcriptPath?: string; launchId?: string } => {
+  /** #450 I3: each Claude peer (claude and every claude-<name> instance) has its own session and launch files. */
+  const claudeSession = (peer = "claude"): { sessionId?: string; transcriptPath?: string; launchId?: string } => {
     try {
-      const value = JSON.parse(readFileSync(join(opts.stateDir, "claude-session.json"), "utf8"));
+      const value = JSON.parse(readFileSync(join(opts.stateDir, claudeStateFile("claude-session", peer)), "utf8"));
       if (value.instanceId !== instanceId) return {};
       let currentLauncher = false;
       try {
-        const launch = JSON.parse(readFileSync(join(opts.stateDir, "claude-launch.json"), "utf8"));
+        const launch = JSON.parse(readFileSync(join(opts.stateDir, claudeStateFile("claude-launch", peer)), "utf8"));
         if (launch.instanceId === instanceId && typeof launch.launchId === "string" && launch.launchId) {
           currentLauncher = true;
           if (value.launchId !== launch.launchId) return {};
@@ -2369,7 +2475,7 @@ export async function startDaemon(opts: DaemonOptions) {
       } catch { /* older/manual launches retain the existing instance fence */ }
       try {
         const records = JSON.parse(readFileSync(join(opts.stateDir, "terminal-recovery.json"), "utf8"));
-        const current = Array.isArray(records) ? records.find((row) => typeof row?.peer === "string" && definitionOf(row.peer)?.transport === "claude-channel" && row?.projectRoot === opts.cwd && row?.instanceId === instanceId) : undefined;
+        const current = ownTerminalRow(records, peer, opts.cwd, instanceId);
         if (!currentLauncher && current?.launchId && value.launchId !== current.launchId) return {};
       } catch { /* no managed terminal record: the instance fence is still enforced */ }
       return {
@@ -2427,33 +2533,30 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   /** Claude persists projects/<slug>/<sessionId>.jsonl only with the first turn. Prefer the
    * path Claude itself reported through the status line; fall back to the slug computation. */
-  const claudeTranscriptPersisted = (sessionId: string): boolean => {
-    const reported = claudeSession();
-    if (reported.sessionId === sessionId && reported.transcriptPath) return existsSync(reported.transcriptPath);
-    const config = process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
-    return existsSync(join(config, "projects", opts.cwd.replace(/[^a-zA-Z0-9]/g, "-"), `${sessionId}.jsonl`));
-  };
+  // ponytail: the version probe reads the builtin claude peer only; extend per peer if an instance's version matters (#450 I3).
+  const claudeTranscriptPersisted = (peer: string, sessionId: string): boolean => transcriptPersisted(claudeSession(peer), sessionId, Object.hasOwn(declarations, peer),
+    join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude"), "projects", opts.cwd.replace(/[^a-zA-Z0-9]/g, "-"), `${sessionId}.jsonl`), path => pathEvidence(path, lstatSync));
   // Optional native usage: only the instance-fenced explicit Claude session is read.
   // IDs persist in telemetry, so a restart/resume never counts the same native message twice.
   const claudeNativeUsageSeen = new Set(readEvents(join(opts.stateDir, "events.jsonl")).filter(e => e.type === "usage" && e.source === "claude_transcript").map(e => (e as { id: string }).id));
-  const collectClaudeUsage = () => {
-    const session = claudeSession();
-    if (!session.sessionId || !session.transcriptPath) return;
+  const collectClaudeUsage = () => { for (const peer of channelPeers) {
+    const session = claudeSession(peer);
+    if (!session.sessionId || !session.transcriptPath) continue;
     for (const record of readClaudeTranscriptUsage(session.sessionId, session.transcriptPath)) {
       if (claudeNativeUsageSeen.has(record.id)) continue;
       claudeNativeUsageSeen.add(record.id);
       const reported = claudeReportedTokens(record.usage);
-      if (reported !== undefined) addTokens("claude", reported);
-      event({ type: "usage", peer: "claude", source: "claude_transcript", id: record.id, ...record.usage, ...taskAttribution("claude"), ...(record.servedModel ? { servedModel: record.servedModel } : {}), ...(record.at ? { measuredAt: record.at } : {}) });
+      if (reported !== undefined) addTokens(peer, reported);
+      event({ type: "usage", peer, source: "claude_transcript", id: record.id, ...record.usage, ...taskAttribution(peer), ...(record.servedModel ? { servedModel: record.servedModel } : {}), ...(record.at ? { measuredAt: record.at } : {}) });
     }
-  };
+  } };
   const claudeUsageTimer = setInterval(collectClaudeUsage, 2000);
   claudeUsageTimer.unref(); intervals.push(claudeUsageTimer);
   const recoveryPeers = (): Record<string, RestartPeerSnapshot> => Object.fromEntries([...bus.peers].map(([id, peer]) => {
     const metadata = peer.recoveryMetadata?.() ?? {};
     const row: RestartPeerSnapshot = { id, state: peer.state, queueIds: bus.queueIds(id), ...(metadata.launch ? { launch: metadata.launch as Record<string, unknown> } : {}) };
     if (typeof metadata.threadId === "string") row.threadId = metadata.threadId;
-    const sessionId = definitionOf(id)?.transport === "claude-channel" ? claudeSession().sessionId : metadata.sessionId;
+    const sessionId = definitionOf(id)?.transport === "claude-channel" ? claudeSession(id).sessionId : metadata.sessionId;
     if (typeof sessionId === "string" && sessionId) row.sessionId = sessionId;
     return [id, row];
   }));
@@ -2496,7 +2599,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (peer instanceof AcpPeer && ["unknown", "unmanaged"].includes(peer.permissionModeState)) return peer.permissionModeState;
     if (starting.has(id) && (peer instanceof AcpPeer || peer instanceof CodexPeer)) return peer.getPermissionMode();
     if (definitionOf(id)?.transport === "claude-channel" && peer instanceof WsPeer && peer.state !== "offline") {
-      const launch = claudePermissionLaunch();
+      const launch = claudePermissionLaunch(id);
       if (!launch || claudePermissionGenerations.get(id) !== peer.sessionGeneration) return "unverified";
     }
     return permissionMode(id);
@@ -2508,6 +2611,12 @@ export async function startDaemon(opts: DaemonOptions) {
     return mode === "ask" ? {} : { permissionMode: mode };
   };
   const lastCodexThreads = new Map<string, string>();
+  // #450 I3: the console and dashboard list each declared instance right after its kind.
+  const byKind = (ids: string[]): string[] => {
+    const kindOf = (id: string) => Object.hasOwn(declarations, id) ? declarations[id]!.kind : undefined;
+    const out = ids.filter(id => kindOf(id) === undefined).flatMap(id => [id, ...ids.filter(extra => kindOf(extra) === id)]);
+    return [...out, ...ids.filter(id => !out.includes(id))];
+  };
   const statusPeerIds = (open: ReturnType<Board["statusTasks"]>) => {
     const reservations = board.statusReservations();
     const ids = new Set([...bus.knownPeers(), ...extraIds, ...reservations]);
@@ -2519,12 +2628,13 @@ export async function startDaemon(opts: DaemonOptions) {
     const taskNeeds = board.statusTasks();
     const taskStalls = tasks.stalled();
     const pendingTaskOffers = tasks.pendingOffers().filter(offer => offer.pullOnly === true);
-    const peerIds = statusPeerIds(taskNeeds);
+    const peerIds = byKind(statusPeerIds(taskNeeds));
     const view = {
     ...(crashReport.length ? { crash: crashReport } : {}),
     projectId,
     instanceId,
     version: VERSION,
+    pluginBundle: SERVER_JS,
     pendingRestart,
     memoryProfile: memoryProfileStatus(includeAttentionItems),
     lifecycleStages: [...lifecycleConfig.stages],
@@ -2534,6 +2644,8 @@ export async function startDaemon(opts: DaemonOptions) {
     roster: [...KNOWN_PEERS, ...OPTIONAL_PEERS].map(peer => ({ peer, on: onRoster(peer) })),
     protocol: PROTOCOL,
     features: DAEMON_FEATURES,
+    // #450 I3: the instance ids this daemon bound at startup; a launcher selects only one of these.
+    activeInstances: extraIds,
     stopping,
     pid: process.pid,
     cwd: opts.cwd,
@@ -3173,6 +3285,9 @@ export async function startDaemon(opts: DaemonOptions) {
     return { ok: true, mode, opened: opened.via, command };
   }
 
+  /** The CLI command that starts a peer: `ahub <kind> --as <id>` for a declared instance. */
+  const startCommand = (peer: string): string => { const kind = definitionOf(peer)?.kind; return kind && kind !== peer ? `ahub ${kind} --as ${peer}` : `ahub ${peer}`; };
+
   async function stopPeer(peer: unknown, rosterRemoval = false): Promise<Record<string, unknown>> {
     if (!rosterRemoval && rosterChanging !== undefined && rosterChanging === peer) return { ok: false, error: `${String(peer)} roster change is in progress` };
     if (stopping || recoveryActive()) return { ok: false, error: "recovery or shutdown is holding peer stops; finish the operation before retrying" };
@@ -3180,9 +3295,9 @@ export async function startDaemon(opts: DaemonOptions) {
     const owner = bus.peers.get(peer);
     const stopNotice = definitionOf(peer)?.cli.stopNotice?.(owner instanceof WsPeer ? "tui" : !owner ? startMode(peer) : "headless", owner);
     if (stopNotice) return { ok: false, error: stopNotice };
-    if (!(owner instanceof AcpPeer || owner instanceof PiPeer || owner instanceof LocalPeer)) return { ok: false, error: "unknown or non-owned peer; run ahub status and choose a hub-owned headless peer" };
+    if (!(owner instanceof AcpPeer || owner instanceof PiPeer || owner instanceof LocalPeer || owner instanceof ReviewerPrintPeer)) return { ok: false, error: "unknown or non-owned peer; run ahub status and choose a hub-owned headless peer" };
     if (owner instanceof PiPeer && owner.mode !== "headless") return { ok: false, error: "Pi belongs to a native TUI terminal; end it in its terminal" };
-    if (owner.state === "offline") return { ok: false, error: `peer is already offline; start it with ahub ${peer} before stopping it` };
+    if (owner.state === "offline") return { ok: false, error: `peer is already offline; start it with ${startCommand(peer)} before stopping it` };
     if (starting.has(peer) || requestedPeerStops.has(peer) || permissionChanges.has(peer)) return { ok: false, error: "peer lifecycle or permission change is in progress; wait for ahub status before retrying" };
     requestedPeerStops.add(peer); // fence delivery, starts and recovery before the first asynchronous stop step
     try {
@@ -3199,7 +3314,7 @@ export async function startDaemon(opts: DaemonOptions) {
         writeStatus();
         const state = bus.stateOf(peer);
         if (state !== "offline" || bus.peers.get(peer) !== owner) return { ok: false, error: "peer stop did not reach offline on its owner; inspect ahub status and its terminal before retrying" };
-        try { notify(rosterRemoval ? `${peer} stopped for roster removal; add it with ahub roster add ${peer} before starting it again` : `${peer} stopped by the console; start it again with ahub ${peer}`); } catch { /* owner stop and readback remain authoritative */ }
+        try { notify(rosterRemoval ? `${peer} stopped for roster removal; add it with ahub roster add ${peer} before starting it again` : `${peer} stopped by the console; start it again with ${startCommand(peer)}`); } catch { /* owner stop and readback remain authoritative */ }
         return { ok: true, state };
       });
     } catch {
@@ -3244,6 +3359,7 @@ export async function startDaemon(opts: DaemonOptions) {
 
   async function startPeerBody(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }, mute: (p: PeerAdapter) => void, executionCwd: string): Promise<Record<string, unknown>> {
     const adapter = definitionOf(peer);
+    if (adapter?.reviewer?.unavailable) return { ok: false, error: adapter.reviewer.unavailable };
     const preflight = adapter?.start.preflight?.({ instance: peer, form: args.mode });
     if (preflight) return { ok: false, error: preflight };
     if (adapter?.attach?.admission && !declarations[peer]) {
@@ -3559,7 +3675,7 @@ export async function startDaemon(opts: DaemonOptions) {
           const result = await piReceipts!.execute(sessionId ?? "", callId, name, humanBash ? { origin: "verified-user-bash", args: raw } : raw, async () => {
             if (!raw || typeof raw !== "object" || Array.isArray(raw)) return "error: invalid tool arguments";
             const nativeTurn = pi.observationTurn;
-            const output = TASK_TOOLS.some((t) => t.name === name) || CONDUCTOR_TOOL_NAMES.has(name) ? await taskOp(peer, name, raw as Record<string, unknown>, true) : await runTool(name, JSON.stringify(raw), { ...ctx, signal,
+            const output = TASK_TOOL_NAMES.has(name) || CONDUCTOR_TOOL_NAMES.has(name) ? await taskOp(peer, name, raw as Record<string, unknown>, true) : await runTool(name, JSON.stringify(raw), { ...ctx, signal,
               ...(humanBash ? { onProcessExit: (code: number | null) => { exitCode = code; } } : {}),
               permit: async (title, tool, toolSignal, path, _observe, originalPath) => {
                 const picked = humanBash ? (toolSignal?.aborted || context?.isCurrent() !== true ? "aborted" : true) : await piPermit(title, tool ?? name, toolSignal, path, context?.isCurrent, context?.onApproval, originalPath);
@@ -3738,6 +3854,41 @@ export async function startDaemon(opts: DaemonOptions) {
       await local.start();
       return { ok: true, model: route ? `${route} (fallback ${routing.local.fixed_model})` : (args.model ?? routing.local.fixed_model) };
     }
+    if (adapter?.reviewer) {
+      const backend = adapter.reviewer.backend;
+      if (!backend || !adapter.start.create) return { ok: false, error: "reviewer has no verified runtime" };
+      // #519: each backend proves isolation before admission, then starts one fresh child per review.
+      if (existing?.state === "busy") return { ok: false, error: `${peer} is reviewing; retry when it is idle` };
+      if (existing) { mute(existing); await existing.stop(); }
+      const reviewer = adapter.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["reviewer-print"]({
+        backend, cwd: executionCwd,
+        mcpConfig: JSON.stringify({ mcpServers: { "agent-hub": { command: process.execPath, args: ["run", SERVER_JS], env: toolEnv(peer, true) } } }),
+        systemPrompt: sessionRoleContract(peer),
+        watchdogMs: config.watchdog_ms,
+        privatePaths: [opts.stateDir, ...(config.pii?.paths ?? []), ...config.local.deny],
+        facts: env => env.private ? undefined : reviewDiff(executionCwd, env.refs?.commit, { privatePath: path => isDenied(path, config.local.deny) || matchesPolicy(executionCwd, path, config.pii?.paths ?? [], true), nameable: tasks.nameable }),
+        verdictSince: (task, since) => board.get(task)?.history.some(h => h.by === peer && h.at >= since && (h.event === "approved" || h.event === "changes_requested")) === true,
+        onUsage: usage => void addTokens(peer, (usage.input_tokens ?? 0) + (usage.output_tokens ?? 0)),
+        onUnavailable: (failure, current) => {
+          const attached = () => current() && bus.peers.get(peer) === reviewer;
+          if (!attached()) return;
+          if (failure.cause === "start_failed") reviewerUnavailable.set(peer, "reviewer isolation unavailable; restart after checking the verified CLI and isolation requirements");
+          return tasks.retryReviewer(failure.task, peer, failure, attached).then(() => undefined);
+        },
+        log,
+      }) }) as ReviewerPrintPeer;
+      try { await reviewer.start(); }
+      catch {
+        await reviewer.stop().catch(() => {});
+        const reason = "reviewer isolation unavailable; inspect the verified CLI version and isolation requirements";
+        reviewerUnavailable.set(peer, reason);
+        return { ok: false, error: reason };
+      }
+      reviewerUnavailable.delete(peer);
+      executionOwners.set(peer, { owner: reviewer, cwd: executionCwd });
+      bus.add(reviewer);
+      return { ok: true };
+    }
     return { ok: false, error: `unknown peer "${peer}"` };
   }
 
@@ -4601,16 +4752,23 @@ export async function startDaemon(opts: DaemonOptions) {
       return ids.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("task_cancel"))
         ? `target lacks task_cancel; cancelled tasks: ${ids.map(id => `#${id}`).join(", ")}` : undefined;
     };
+    const incompatibleRecoveryTarget = () => {
+      const cancelled = incompatibleCancellationTarget();
+      if (cancelled) return cancelled;
+      if (extraIds.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("peer_instances"))) return "target lacks peer_instances; declared instance identities cannot be restored by that daemon";
+      if (board.releases().some(release => release.train && ["active", "frozen"].includes(release.state)) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("release_trains"))) return "target lacks release_trains; active or frozen train safeguards cannot be preserved";
+      if ((extraIds.some(id => !!definitionOf(id)?.reviewer) || config.review.pool !== undefined) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("reviewer_pool"))) return "target lacks reviewer_pool; fresh review-only variants and pool policy cannot be preserved";
+      return undefined;
+    };
     const checkTarget = msg.op === "prepare" || msg.op === "commit" || msg.op === "inspect" && msg.targetFeatures !== undefined;
     if (checkTarget) {
-      const error = incompatibleCancellationTarget(); if (error) return recoveryError(error);
-      if (extraIds.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("peer_instances"))) return recoveryError("target lacks peer_instances; declared instance identities cannot be restored by that daemon");
+      const error = incompatibleRecoveryTarget(); if (error) return recoveryError(error);
     }
 
     if (msg.op === "inspect" || msg.op === "prepare" || msg.op === "commit") {
       for (const pi of bus.peers.values()) if (pi instanceof PiPeer && pi.state === "idle") {
         try { await pi.captureResume(); } catch (error) { return recoveryError((error as Error).message); }
-        if (checkTarget) { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
+        if (checkTarget) { const error = incompatibleRecoveryTarget(); if (error) return recoveryError(error); }
       }
     }
     if (msg.op === "inspect" && msg.operationId === undefined) return { t: "recovery", ok: true, recovery: recoveryView() };
@@ -4626,7 +4784,7 @@ export async function startDaemon(opts: DaemonOptions) {
         recoveryPeerSnapshot = undefined;
       }
       if (recoveryOperationId && recoveryOperationId !== op) return recoveryError("another recovery operation is active");
-      { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
+      { const error = incompatibleRecoveryTarget(); if (error) return recoveryError(error); }
       recoveryOperationId = op;
       if (!recoveryPhase) recoveryPhase = "preparing";
       armRecoveryLease();
@@ -4634,7 +4792,7 @@ export async function startDaemon(opts: DaemonOptions) {
       budget.setRecoveryHold(true);
       bus.setRecoveryHold(true, Array.isArray(msg.targetFeatures) && msg.targetFeatures.includes("recovery_deferred_hub"));
       await bus.fenceRecovery();
-      { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
+      { const error = incompatibleRecoveryTarget(); if (error) return recoveryError(error); }
       const blocked = [...bus.peers].filter(([, peer]) => peer.state === "busy").map(([id]) => id);
       if (!blocked.length && permissions.size === 0 && recoveryReady()) {
         recoveryPeerSnapshot ??= Object.values(recoveryPeers());
@@ -4661,6 +4819,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     if (msg.op === "commit") {
       if ((recoveryPhase !== "prepared" && recoveryPhase !== "preparing") || !recoveryReady()) return recoveryError("recovery is not ready; inspect until peers are idle, approvals are complete and completion checks have finished");
+      // Person ruling 2026-10-19: upgrade is excluded from release resource gates; original readiness still binds.
       recoveryPhase = "prepared";
       bus.setRecoveryHold(true, Array.isArray(msg.targetFeatures) && msg.targetFeatures.includes("recovery_deferred_hub"));
       recoveryPeerSnapshot ??= Object.values(recoveryPeers());
@@ -4669,7 +4828,7 @@ export async function startDaemon(opts: DaemonOptions) {
         ...saved,
         queueIds: bus.queueIds(saved.id),
         // Recorded at commit, not prepare: a first turn landing in between flips it (#64).
-        ...(definitionOf(saved.id)?.session.missingEvidence === "transcript" && saved.sessionId ? { sessionPersisted: claudeTranscriptPersisted(saved.sessionId) } : {}),
+        ...(definitionOf(saved.id)?.session.missingEvidence === "transcript" && saved.sessionId ? { sessionPersisted: claudeTranscriptPersisted(saved.id, saved.sessionId) } : {}),
       }));
       const snapshot: RestartSnapshot = {
         schemaVersion: 1,
@@ -4683,7 +4842,7 @@ export async function startDaemon(opts: DaemonOptions) {
         peers,
         integrity: integrity(),
       };
-      { const error = incompatibleCancellationTarget(); if (error) return recoveryError(error); }
+      { const error = incompatibleRecoveryTarget(); if (error) return recoveryError(error); }
       try { writeRestartSnapshot(opts.stateDir, snapshot); } catch { return recoveryError("could not persist restart state"); }
       recoveryCommitted = true;
       clearTimeout(recoveryLeaseTimer);
@@ -4717,9 +4876,9 @@ export async function startDaemon(opts: DaemonOptions) {
     return recoveryError("unknown recovery operation");
   }
 
-  function claudePermissionLaunch(): { launchId: string; unattended: boolean; hookPurpose?: string } | undefined {
+  function claudePermissionLaunch(peer = "claude"): { launchId: string; unattended: boolean; hookPurpose?: string } | undefined {
     try {
-      const row = JSON.parse(readFileSync(join(opts.stateDir, "claude-launch.json"), "utf8"));
+      const row = JSON.parse(readFileSync(join(opts.stateDir, claudeStateFile("claude-launch", peer)), "utf8"));
       if (row.instanceId !== instanceId || row.permissionHook !== true || typeof row.launchId !== "string" || !row.launchId) return undefined;
       return { launchId: row.launchId, unattended: row.unattended === true, ...(typeof row.hookPurpose === "string" ? { hookPurpose: row.hookPurpose } : {}) };
     } catch { return undefined; }
@@ -4748,7 +4907,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (!isPermissionMode(mode)) return { ok: false, error: "mode must be ask, ask-when-needed or never-ask" };
     if (mode === "never-ask" && confirmed !== true) return { ok: false, error: "never-ask needs --yes or console confirmation" };
     if (definitionOf(peer)?.transport === "claude-channel") {
-      const launch = claudePermissionLaunch();
+      const launch = claudePermissionLaunch(peer);
       if (!launch || !(owner instanceof WsPeer) || claudePermissionGenerations.get(peer) !== owner.sessionGeneration) return { ok: false, error: "Claude has no verified ahub claude permission hook; restart with ahub claude and run a tool first" };
       if (launch.unattended) return { ok: false, error: "Claude started --unattended already skips prompts; run ahub permission claude ask after it stops to clear the hub choice, then restart without --unattended" };
     } else if (owner instanceof CodexPeer) {
@@ -5021,18 +5180,18 @@ export async function startDaemon(opts: DaemonOptions) {
             let expectedLaunch: string | undefined;
             try {
               const rows = JSON.parse(readFileSync(join(opts.stateDir, "terminal-recovery.json"), "utf8"));
-              expectedLaunch = Array.isArray(rows) ? rows.find(row => typeof row?.peer === "string" && definitionOf(row.peer)?.transport === "claude-channel" && row?.projectRoot === opts.cwd && row?.instanceId === instanceId)?.launchId : undefined;
+              expectedLaunch = Array.isArray(rows) ? rows.find(row => row?.peer === peer && definitionOf(row.peer)?.transport === "claude-channel" && row?.projectRoot === opts.cwd && row?.instanceId === instanceId)?.launchId : undefined;
             } catch { /* an ordinary terminal has no Orca recovery identity */ }
             try {
-              const launch = JSON.parse(readFileSync(join(opts.stateDir, "claude-launch.json"), "utf8"));
+              const launch = JSON.parse(readFileSync(join(opts.stateDir, claudeStateFile("claude-launch", peer)), "utf8"));
               if (launch.instanceId === instanceId && typeof launch.launchId === "string") expectedLaunch = launch.launchId;
             } catch { /* older/manual launches do not have a launcher marker */ }
-            const current = claudeSession();
+            const current = claudeSession(peer);
             if ((phase === "stop" || phase === "post") && current.sessionId && current.sessionId !== sessionId) return void reply({ t: "facts", ok: false });
             if (!expectedLaunch || msg.nativeLaunchId === expectedLaunch) {
-              const transcript = claudeTranscript(sessionId, msg.transcriptPath);
+              const transcript = claudeTranscript(sessionId, msg.transcriptPath, peer);
               const launchId = typeof msg.nativeLaunchId === "string" ? msg.nativeLaunchId : undefined;
-              const file = join(opts.stateDir, "claude-session.json");
+              const file = join(opts.stateDir, claudeStateFile("claude-session", peer));
               writeFileSync(`${file}.hook.tmp`, JSON.stringify({ at: Date.now(), instanceId, sessionId, ...(launchId ? { launchId } : {}), ...(transcript ? { transcriptPath: transcript } : {}) }), { mode: 0o600 });
               chmodSync(`${file}.hook.tmp`, 0o600); renameSync(`${file}.hook.tmp`, file);
               nativeClaude = true;
@@ -5041,7 +5200,7 @@ export async function startDaemon(opts: DaemonOptions) {
           }
           if (definitionOf(peer)?.transport === "claude-channel" && msg.nativeInstanceId !== undefined && msg.nativeInstanceId !== instanceId) return void reply({ t: "facts", ok: false });
           const nativePeer = nativeClaude ? bus.peers.get(peer) : undefined;
-          const permissionLaunch = definitionOf(peer)?.transport === "claude-channel" ? claudePermissionLaunch() : undefined;
+          const permissionLaunch = definitionOf(peer)?.transport === "claude-channel" ? claudePermissionLaunch(peer) : undefined;
           const permission = nativeClaude && permissionLaunch && !permissionLaunch.unattended && msg.nativeLaunchId === permissionLaunch.launchId ? permissionMode(peer) : undefined;
           if (permission !== undefined && nativePeer instanceof WsPeer) claudePermissionGenerations.set(peer, nativePeer.sessionGeneration);
           const protectedWrite = scopedWriteBlocked(phase, permission, msg.tool, () => projectFileTool(msg.tool, msg.input, opts.cwd, config.protect_instruction_files, config.data?.readonly));
@@ -5053,10 +5212,10 @@ export async function startDaemon(opts: DaemonOptions) {
           if (phase === "session") { recordSessions(); return void reply({ t: "facts", ok: true }); }
           if ((phase === "start" || phase === "pre") && nativePeer instanceof WsPeer) {
             const previous = nativeTurnStart.get(peer);
-            const current = claudeSession();
+            const current = claudeSession(peer);
             if (phase === "start" || nativePeer.state !== "busy" || previous?.generation !== nativePeer.sessionGeneration || previous?.session !== sessionId || previous?.launch !== (current.launchId ?? "")) {
-              const session = claudeSession();
-              const baseline = session.sessionId && session.transcriptPath ? readClaudeTranscriptUsage(session.sessionId, session.transcriptPath).filter(record => record.completedTurn).at(-1)?.id : undefined;
+              const session = claudeSession(peer);
+              const baseline = session.sessionId && session.transcriptPath ? readClaudeTranscriptCompletion(session.sessionId, session.transcriptPath)?.id : undefined;
               nativeTurnStart.set(peer, { at: Date.now(), ...(baseline ? { baseline } : {}), generation: nativePeer.sessionGeneration, session: sessionId!, launch: session.launchId ?? "" });
             }
             nativePeer.nativeStarted(sessionId!);
@@ -5075,12 +5234,12 @@ export async function startDaemon(opts: DaemonOptions) {
               event({ type: "hook_stats", peer, n: st.n, startupMs: Math.round(st.startupMs), hubMs: Math.round(st.hubMs), maxStartupMs: Math.round(st.maxStartupMs) });
               hookStats.delete(peer);
               if (id && nativePeer instanceof WsPeer) nativePeer.nativeStopped(sessionId!);
-              if (factsOn()) { factSession(peer, sessionId); readbacks(peer, claudeTranscript(sessionId, msg.transcriptPath)); }
+              if (factsOn()) { factSession(peer, sessionId); readbacks(peer, claudeTranscript(sessionId, msg.transcriptPath, peer)); }
             };
             if (!nativeClaude) { finishStop(); reply({ t: "facts", ok: true }); return; } // legacy bookkeeping cannot certify native completion
-            const session = claudeSession();
-            let transcript = session.transcriptPath ?? claudeTranscript(sessionId, msg.transcriptPath);
-            const readCompletion = () => { transcript ??= claudeTranscript(sessionId, msg.transcriptPath); return session.sessionId && transcript ? readClaudeTranscriptUsage(session.sessionId, transcript).filter(record => record.completedTurn).at(-1) : undefined; };
+            const session = claudeSession(peer);
+            let transcript = session.transcriptPath ?? claudeTranscript(sessionId, msg.transcriptPath, peer);
+            const readCompletion = () => { transcript ??= claudeTranscript(sessionId, msg.transcriptPath, peer); return session.sessionId && transcript ? readClaudeTranscriptCompletion(session.sessionId, transcript) : undefined; };
             const completionId = (id: string) => createHash("sha256").update(`${sessionId}:${session.launchId ?? "legacy"}:${id}`).digest("hex");
             const started = nativeTurnStart.get(peer);
             const activeStart = !!started && started.session === sessionId && started.launch === (session.launchId ?? "") && nativePeer instanceof WsPeer && started.generation === nativePeer.sessionGeneration;
@@ -5091,7 +5250,7 @@ export async function startDaemon(opts: DaemonOptions) {
             }
             if (!started || !activeStart || !(nativePeer instanceof WsPeer)) { log("native Stop refused for claude: current native turn start unavailable"); return void reply({ t: "facts", ok: false }); }
             const scopeCurrent = () => {
-              const now = claudeSession();
+              const now = claudeSession(peer);
               return !stopping && bus.peers.get(peer) === nativePeer && nativePeer.sessionGeneration === started.generation && now.sessionId === started.session && (now.launchId ?? "") === started.launch;
             };
             const current = () => scopeCurrent() && nativeTurnStart.get(peer) === started;
@@ -5106,14 +5265,20 @@ export async function startDaemon(opts: DaemonOptions) {
               if (nativeStopWaits.get(peer) === ownWait) nativeStopWaits.delete(peer);
               if (!result.record) {
                 const reason = ({ unavailable: "completed transcript message unavailable", baseline: "completion still matches start baseline", "before-start": "completion timestamp precedes native start", superseded: "native start superseded during completion wait", verified: "completed transcript message unavailable" } as const)[result.reason];
-                log(`native Stop refused for claude: ${reason}`); return;
+                log(`native Stop refused for claude: ${reason}`);
+                // #517: a peer left busy receives no pushed messages; say so where the person looks, once per turn.
+                if (result.reason === "unavailable" && !stopUnconfirmedNoticed.has(started)) {
+                  stopUnconfirmedNoticed.add(started);
+                  notify(`${peer}: its turn end could not be confirmed from its transcript, so it stays busy and messages to it wait in its queue (hub_inbox reads them)`);
+                }
+                return;
               }
               const id = completionId(result.record.id);
               if (scopeCurrent() && nativeStopsSeen.has(id)) return;
               if (!current()) { log("native Stop refused for claude: native start superseded during completion wait"); return; }
               nativeStopsSeen.add(id); nativeTurnStart.delete(peer); // consume before idle admits another native turn
               if (transcript && !session.transcriptPath) {
-                const file = join(opts.stateDir, "claude-session.json");
+                const file = join(opts.stateDir, claudeStateFile("claude-session", peer));
                 writeFileSync(`${file}.hook.tmp`, JSON.stringify({ at: Date.now(), instanceId, sessionId, launchId: session.launchId, transcriptPath: transcript }), { mode: 0o600 });
                 chmodSync(`${file}.hook.tmp`, 0o600); renameSync(`${file}.hook.tmp`, file);
               }
@@ -5127,7 +5292,7 @@ export async function startDaemon(opts: DaemonOptions) {
           if (!factsOn()) return void reply({ t: "facts", ok: true, ...permissionReply });
           if (definitionOf(peer)?.transport === "claude-channel" && phase === "pre") observeProgress(peer, normalizeClaudeObservation(tool, input));
           factSession(peer, sessionId);
-          const transcript = claudeTranscript(sessionId, msg.transcriptPath);
+          const transcript = claudeTranscript(sessionId, msg.transcriptPath, peer);
           if (phase === "post") {
             factsFor(peer).postTool(peer, toolUseId, tool, input);
             readbacks(peer, transcript);
@@ -5202,6 +5367,23 @@ export async function startDaemon(opts: DaemonOptions) {
         if (msg.op === "export") {
           try { return void reply({ ok: true, export: tasks.workflowExport(msg.id) }); } catch { return void reply({ ok: false, error: "workflow export unavailable" }); }
         }
+        if (msg.op === "accept") {
+          // #481 S1: the person's spec acceptance, bound to the issue's body edit time; no body is read.
+          if (!Number.isSafeInteger(msg.id) || msg.id <= 0 || !Number.isSafeInteger(msg.issue) || msg.issue <= 0 || (msg.repo !== undefined && typeof msg.repo !== "string")) return void reply({ ok: false, error: "usage: ahub sdlc accept <task> --issue <n> [--repo owner/repository]" });
+          const task = board.get(msg.id);
+          const repo = msg.repo ?? task?.sdlc?.repo;
+          if (!task || typeof repo !== "string") return void reply({ ok: false, error: task ? "spec acceptance needs --repo owner/repository (the task's receipt names none)" : "invalid lifecycle task id" });
+          const linked = `${task.sdlc?.repo ?? ""}#${task.sdlc?.issue ?? ""}`;
+          void readSpecEdit(repo, msg.issue, (args, timeout, _cwd, bound) => sdlcGh(args, timeout, opts.cwd, bound)).then(edit => {
+            if (!edit) return reply({ ok: false, error: "issue edit time unavailable; nothing was recorded" });
+            // The readback is for the receipt read before it; a relink meanwhile makes it someone else's evidence.
+            const now = board.get(msg.id)?.sdlc;
+            if (`${now?.repo ?? ""}#${now?.issue ?? ""}` !== linked) return reply({ ok: false, error: "the task's spec link changed during the readback; nothing was recorded, run ahub sdlc accept again" });
+            try { const next = tasks.acceptSpec(USER, msg.id, { repo, issue: msg.issue, edit }); reply({ ok: true, acceptance: next.sdlc?.acceptance }); }
+            catch (error) { reply({ ok: false, error: (error as Error).message }); }
+          }, () => reply({ ok: false, error: "issue edit time unavailable; nothing was recorded" }));
+          return;
+        }
         if (msg.op !== "status" && msg.op !== "explain") return void reply({ ok: false, error: "unknown SDLC operation" });
         const selected = msg.id === undefined ? board.list().filter(task => task.state !== "backlog" && (task.sdlc || lifecycleConfig.mode !== "off" || lifecycleConfig.workflow === "gsd-lite")) : [board.get(Number(msg.id))].filter((task): task is Task => !!task);
         if (msg.id !== undefined && (!Number.isSafeInteger(msg.id) || msg.id <= 0 || !selected.length)) return void reply({ ok: false, error: "invalid lifecycle task id" });