@staix/agent-hub 0.12.39 → 0.12.40

package/src/cli/upgrade.ts

@@ -51,6 +51,8 @@ export interface PlannedProject {
   blockers: string[];
   /** Unmanaged sessions (#206): their plugin reattaches to the new daemon; no terminal is closed or relaunched and no session id is compared. */
   reconnectOnly?: string[];
+  /** Attached native terminals with neither a current live launcher record nor an independently verified terminal binding. */
+  unrecordedTerminals?: string[];
   /** #215: Codex threads with no rollout and no turn the hub recorded; they restart as a new session, nothing to lose. */
   freshStart?: string[];
 }
@@ -99,6 +101,15 @@ export interface ReattachmentMarker {
   cause: "detached after restore";
   binding: TerminalBinding;
 }
+/** Trusted per-invocation attribution from the CLI identity preflight, never authority read from a receipt. */
+export interface RecoveryDelegation {
+  peer: string;
+  command: "upgrade" | "restart" | "recovery resume" | "recovery abort" | "recovery dispose" | "recovery-run";
+}
+type RecoveryDelegationAudit = RecoveryDelegation & { at: number; operationId: string };
+const MAX_RECOVERY_DELEGATIONS = 256;
+const RECOVERY_DELEGATION_COMMANDS: readonly string[] = ["upgrade", "restart", "recovery resume", "recovery abort", "recovery dispose", "recovery-run"];
+
 export interface RecoveryOperation {
   /**
    * #227: 2 marks a stop-and-archive recorded on an operation whose coordinator predates #215. Every older runner and
@@ -112,6 +123,8 @@ export interface RecoveryOperation {
   phase: "pending" | "running" | "blocked" | "completed" | "cancelled";
   step: string;
   sourceRoot: string;
+  /** Ids-only initiating and subsequent delegated invocations; retained across coordinator replacement. */
+  delegatedAudits?: RecoveryDelegationAudit[];
   targetRoot?: string;
   targetDigest?: string;
   /** Verified capability evidence bound to targetRoot/targetDigest; absence is legacy unknown, not an empty list. */
@@ -395,7 +408,7 @@ export function planFingerprint(plan: Omit<UpgradePlan, "fingerprint">): string
   return createHash("sha256").update(JSON.stringify(stable)).digest("hex");
 }
 
-export function createOperation(plan: UpgradePlan, sourceRoot: string, home = hubHome()): RecoveryOperation {
+export function createOperation(plan: UpgradePlan, sourceRoot: string, home = hubHome(), delegation?: RecoveryDelegation): RecoveryOperation {
   if (plan.blockers.length || plan.projects.some((p) => p.blockers.length)) throw new Error("upgrade plan has blockers; no runtimes were changed");
   if (!plan.projects.length) throw new Error("no running projects to recover");
   const { fingerprint, ...body } = plan;
@@ -405,6 +418,7 @@ export function createOperation(plan: UpgradePlan, sourceRoot: string, home = hu
     schema: 1, id, plan, sourceRoot, createdAt: Date.now(), updatedAt: Date.now(), phase: "pending", step: "stage",
     projects: plan.projects.map((p) => ({ id: p.project.id, phase: "pending", terminals: {} })),
   };
+  if (delegation) appendRecoveryDelegation(op, delegation, op.createdAt);
   writeOperation(id, op, home);
   acquireRecoveryLock(id, home);
   return op;
@@ -423,11 +437,49 @@ function abandoned(op: RecoveryOperation): boolean {
   return true;
 }
 
+function validRecoveryDelegation(value: unknown): value is RecoveryDelegation {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const row = value as Record<string, unknown>;
+  return typeof row.peer === "string" && /^[a-z][a-z0-9-]{0,31}$/.test(row.peer)
+    && typeof row.command === "string" && RECOVERY_DELEGATION_COMMANDS.includes(row.command);
+}
+
+function validateRecoveryDelegations(op: RecoveryOperation): void {
+  if (op.delegatedAudits === undefined) return;
+  if (!Array.isArray(op.delegatedAudits) || op.delegatedAudits.length > MAX_RECOVERY_DELEGATIONS || op.delegatedAudits.some(row =>
+    !validRecoveryDelegation(row) || Object.keys(row).some(key => !["at", "peer", "command", "operationId"].includes(key)) ||
+    !Number.isFinite(row.at) || row.at < 0 || row.operationId !== op.id)) throw new Error("invalid recovery delegation audit");
+}
+
+function appendRecoveryDelegation(op: RecoveryOperation, delegation: RecoveryDelegation, at: number): void {
+  validateRecoveryDelegations(op);
+  if (!validRecoveryDelegation(delegation) || Object.keys(delegation).some(key => !["peer", "command"].includes(key)) ||
+      !Number.isFinite(at) || at < 0) throw new Error("invalid recovery delegation audit");
+  if ((op.delegatedAudits?.length ?? 0) >= MAX_RECOVERY_DELEGATIONS) throw new Error("recovery delegation audit is full; nothing was executed");
+  (op.delegatedAudits ??= []).push({ at, peer: delegation.peer, command: delegation.command, operationId: op.id });
+}
+
+/** Record an external resume before handing off to even an older retained coordinator. */
+export function recordRecoveryDelegation(id: string, delegation: RecoveryDelegation, home = hubHome()): RecoveryOperation {
+  validateReceipt(id, readOperation<RecoveryOperation>(id, home));
+  const releaseRunner = claimRunner(id, home);
+  try {
+    const op = readOperation<RecoveryOperation>(id, home);
+    validateReceipt(id, op);
+    const at = Date.now();
+    appendRecoveryDelegation(op, delegation, at);
+    op.updatedAt = at;
+    writeOperation(id, op, home);
+    return op;
+  } finally { releaseRunner(); }
+}
+
 function validateReceipt(id: string, op: RecoveryOperation, historical = false): void {
   // Cleanup validates owned historical facts; this mode never authorizes restore, fresh or reattach.
   const options = historical ? { authority: "historical" as const } : {};
   const decode = (value: unknown) => decodeRestoreReceipt(value, options);
   if (!(op.schema === 1 || (op.schema === 2 && op.disposition)) || op.id !== id) throw new Error("unsupported operation receipt");
+  validateRecoveryDelegations(op);
   if (op.targetFeatures !== undefined && (!Array.isArray(op.targetFeatures) || !op.targetFeatures.every(feature => typeof feature === "string" && feature.length > 0) || !op.targetRoot || !op.targetDigest)) throw new Error("invalid target features");
   const { fingerprint, ...reviewed } = op.plan;
   if (fingerprint !== planFingerprint(reviewed) || op.projects.length !== op.plan.projects.length ||
@@ -524,6 +576,10 @@ export async function runRecovery(id: string, driver: RecoveryDriver, home = hub
       releaseRunner();
       return op;
     }
+    if (driver.liveTestPeer) {
+      appendRecoveryDelegation(op, { peer: driver.liveTestPeer, command: "recovery-run" }, driver.now());
+      writeOperation(id, op, home);
+    }
   } catch (error) { releaseRunner(); throw error; }
   let targetFeatures: readonly string[] = [];
   const save = () => { op.updatedAt = driver.now(); writeOperation(id, op, home); };
@@ -778,6 +834,7 @@ export async function runRecovery(id: string, driver: RecoveryDriver, home = hub
 
 /** Receipts and runner state only (#215): ids, phases and effects, never task or message text. */
 export function publicOperation(op: RecoveryOperation, runnerPid?: number | "unknown", live: Record<string, Inspection | undefined> = {}) {
+  validateRecoveryDelegations(op);
   const effect = (key: string, value: unknown) => {
     if (!key.startsWith("restored:")) return value === "pending" || value === "failed" ? value : "done";
     const receipt = decodeRestoreReceipt(value, { authority: "historical" });
@@ -798,6 +855,7 @@ export function publicOperation(op: RecoveryOperation, runnerPid?: number | "unk
       ...(p.restarts?.length ? { restarts: p.restarts.length } : {}) })),
     pluginInstalled: !!op.pluginInstalled, globalInstalled: !!op.globalInstalled,
     ...(!targetReadsWaivers(op) && op.projects.some((p) => failedPeers(op, p).length) ? { freshSession: `not offered: target ${op.plan.version} cannot read recovery waivers, so it could not release a new session` } : {}),
+    ...(op.delegatedAudits ? { delegatedAudits: op.delegatedAudits } : {}),
     ...(op.error ? { error: op.error } : {}), ...(op.failure ? { failure: op.failure } : {}), ...(op.blockedReattachment ? { blockedReattachment: op.blockedReattachment } : {}), ...(op.disposition ? { disposition: op.disposition } : {}), ...(op.audit ? { audit: op.audit } : {}), ...(op.freshOverride ? { freshOverride: op.freshOverride } : {}), ...(op.missingRecordedSession ? { missingRecordedSession: op.missingRecordedSession } : {}),
     ...(op.waits ? { waits: op.waits } : {}), ...(op.presentationCause ? { presentationCause: op.presentationCause } : {}), next };
 }
@@ -881,6 +939,10 @@ export async function abortRecovery(id: string, driver: RecoveryDriver, home = h
       if (recoveryLock(home) === id) releaseRecoveryLock(id, home);
       return;
     }
+    if (driver.liveTestPeer) {
+      appendRecoveryDelegation(op, { peer: driver.liveTestPeer, command: "recovery abort" }, driver.now());
+      writeOperation(id, op, home);
+    }
     if (abandoned(op)) writeOperation(id, op, home);
     const { fingerprint, ...body } = op.plan;
     if (fingerprint !== planFingerprint(body)) throw new Error("operation plan changed");
@@ -925,6 +987,10 @@ export async function disposeRecovery(id: string, choice: { fresh: string } | {
       if (recoveryLock(home) === id) releaseRecoveryLock(id, home);
       throw new Error(`operation is already ${op.phase}`);
     }
+    if (driver.liveTestPeer) {
+      appendRecoveryDelegation(op, { peer: driver.liveTestPeer, command: "recovery dispose" }, driver.now());
+      writeOperation(id, op, home);
+    }
     if (abandoned(op)) writeOperation(id, op, home);
     const at = driver.now();
     // Read once, as status and the runner do: every choice and refusal below is decided on it.

package/src/hub/board.ts

@@ -45,6 +45,8 @@ export interface HistoryEntry {
   owner?: PeerId | null;
   /** On a decline or an escalation: the owner it was declined for or taken from (#207); later reroutes leave it out. */
   from?: PeerId;
+  /** On a decline: the owner had no capacity right now (#531). Absent on older rows and on a plain refusal, which read as lasting. */
+  capacity?: true;
   /** On a hand-over: the new owner's split profile then (#109); absent when it was unknown. */
   profile?: string;
   /** Structured cause recorded at the operation source, never inferred from note text. */
@@ -302,7 +304,7 @@ export class Board {
 
   /** The only way a task changes. Validates the move, records who did what, returns the new row. */
   /** A `plan` in the patch replaces the old one whole: a new plan is the owner's current intent, not an addition. */
-  update(id: number, by: PeerId, event: string, patch: Partial<Pick<Task, "state" | "owner" | "reviewer" | "reserved" | "refs" | "plan" | "rejections" | "signals" | "sdlc" | "role" | "cancelled">>, note?: string, extra: Pick<HistoryEntry, "profile" | "sweep" | "reason" | "from" | "withheld" | "reviewCost" | "reviewContext" | keyof ReviewerHistory> = {}, expectedFlowRevision?: number): Task {
+  update(id: number, by: PeerId, event: string, patch: Partial<Pick<Task, "state" | "owner" | "reviewer" | "reserved" | "refs" | "plan" | "rejections" | "signals" | "sdlc" | "role" | "cancelled">>, note?: string, extra: Pick<HistoryEntry, "profile" | "sweep" | "reason" | "from" | "capacity" | "withheld" | "reviewCost" | "reviewContext" | keyof ReviewerHistory> = {}, expectedFlowRevision?: number): Task {
     const task = this.get(id);
     if (!task) throw new Error(`no task #${id}`);
     if (expectedFlowRevision !== undefined && (!Number.isSafeInteger(expectedFlowRevision) || expectedFlowRevision < 0 || task.history.length !== expectedFlowRevision)) throw new Error("task flow revision changed");
@@ -318,7 +320,7 @@ export class Board {
     }
     if (patch.state === "backlog" && taskHasStarted(task) && !untouchedReturn) throw new Error(`task #${id}: started work cannot return to backlog`);
     const reviewMetadata = reviewerHistory(extra);
-    const history = [...task.history, { at: Date.now(), by, event, ...reviewMetadata, ...(note ? { note } : {}), ...(patch.cancelled?.supersededBy ? { supersededBy: patch.cancelled.supersededBy } : {}), ...("owner" in patch ? { owner: next.owner } : {}), ...(extra.profile ? { profile: extra.profile } : {}), ...(extra.sweep ? { sweep: extra.sweep } : {}), ...(extra.reason && TASK_MOVE_REASONS.includes(extra.reason) ? { reason: extra.reason } : {}), ...(extra.from ? { from: extra.from } : {}), ...(extra.withheld && note ? { withheld: true as const } : {}), ...(extra.reviewContext === "fresh" || extra.reviewContext === "continuing" ? { reviewContext: extra.reviewContext } : {}), ...(extra.reviewCost ? { reviewCost: extra.reviewCost } : {}) }];
+    const history = [...task.history, { at: Date.now(), by, event, ...reviewMetadata, ...(note ? { note } : {}), ...(patch.cancelled?.supersededBy ? { supersededBy: patch.cancelled.supersededBy } : {}), ...("owner" in patch ? { owner: next.owner } : {}), ...(extra.profile ? { profile: extra.profile } : {}), ...(extra.sweep ? { sweep: extra.sweep } : {}), ...(extra.reason && TASK_MOVE_REASONS.includes(extra.reason) ? { reason: extra.reason } : {}), ...(extra.from ? { from: extra.from } : {}), ...(extra.capacity === true ? { capacity: true as const } : {}), ...(extra.withheld && note ? { withheld: true as const } : {}), ...(extra.reviewContext === "fresh" || extra.reviewContext === "continuing" ? { reviewContext: extra.reviewContext } : {}), ...(extra.reviewCost ? { reviewCost: extra.reviewCost } : {}) }];
     this.taskWrite(() => this.db
       .query("UPDATE tasks SET state = ?, owner = ?, reviewer = ?, reserved = ?, refs = ?, plan = ?, rejections = ?, signals = ?, history = ?, sdlc = ?, task_role = ?, cancelled = ?, updated = ? WHERE id = ?")
       .run(next.state, next.owner, next.reviewer, next.reserved ?? null, JSON.stringify(next.refs), JSON.stringify(next.plan ?? {}), next.rejections, JSON.stringify(next.signals), JSON.stringify(history), next.sdlc ? JSON.stringify(next.sdlc) : null, next.role ?? null, next.cancelled ? JSON.stringify(next.cancelled) : null, Date.now(), id));

package/src/hub/bus.ts

@@ -230,12 +230,12 @@ export class Bus {
         this.note(peer.id, noteLine(HUB, "decision", `your message was not delivered: ${refused}`));
         return refused;
       }
-      this.publish(env);
-      if (offRoster.length) this.note(peer.id, noteLine(HUB, "decision", `your message is retained off roster for ${offRoster.join(", ")}; delivered to the other recipients`));
+      const published = this.publishResult(env);
+      if (offRoster.length && published.dropped !== "hop") this.note(peer.id, noteLine(HUB, "decision", `your message is retained off roster for ${offRoster.join(", ")}; delivered to the other recipients`));
       // The sender's result (issue #107): a turn answer has no caller, so it hears it on its next delivery. It counts as
       // not sent only when nobody got it.
       if (hushed.length) this.note(peer.id, noteLine(HUB, "decision", `your message was not delivered to ${hushed.map((h) => h.peer).join(", ")}: ${hushed[0]!.reason}`));
-      return heldBack ? hushed[0]!.reason : undefined;
+      return heldBack ? hushed[0]!.reason : published.dropped === "hop" ? published : undefined;
     };
     peer.onFailed = (envs, failure) => {
       // The adapter got the condensed list; what has to come back is what that list replaced.
@@ -894,6 +894,11 @@ export class Bus {
     return (this.queues.get(id) ?? []).filter((e) => e.priority === "important").length;
   }
 
+  /** The oldest `important` envelope still waiting in a queue, for the busy-peer notice (#572 AC1); a read, never a delivery. */
+  oldestQueuedImportantAt(id: PeerId): number | undefined {
+    return (this.queues.get(id) ?? []).reduce<number | undefined>((oldest, e) => e.priority !== "important" ? oldest : oldest === undefined ? e.ts : Math.min(oldest, e.ts), undefined);
+  }
+
   private enqueue(id: PeerId, env: Envelope, front = false): void {
     if (this.withdrawn.has(env.id)) return;
     const queue = this.queues.get(id) ?? [];

package/src/hub/checks.ts

@@ -15,16 +15,19 @@ const TAIL_CHARS = 4000;
 const KEEP_CHARS = 64 * 1024;
 /** How long output may still arrive after the command exited; a descendant that left the group can hold the pipes. */
 const DRAIN_MS = 500;
+/** How long a killed check may wait for its exit and close events before it settles without them (#558). */
+const KILL_GRACE_MS = 1000;
 
 /** Runs one check command in the project root, in its own process group so a timeout stops what it started. */
-export function runCheck(command: string, cwd: string, timeoutMs: number, running?: Set<() => void>): Promise<CheckResult> {
+export function runCheck(command: string, cwd: string, timeoutMs: number, running?: Set<() => void>, spawnChild: typeof spawn = spawn): Promise<CheckResult> {
   return new Promise((resolve) => {
     let out = "";
     let timedOut = false;
     let interrupted = false;
     let settled = false;
     let exited = false;
-    const child = spawn("sh", ["-c", command], { cwd, env: childEnv(process.env), stdio: ["ignore", "pipe", "pipe"], detached: true });
+    const child = spawnChild("sh", ["-c", command], { cwd, env: childEnv(process.env), stdio: ["ignore", "pipe", "pipe"], detached: true });
+    let grace: ReturnType<typeof setTimeout> | undefined;
     const killGroup = () => {
       try {
         if (child.pid) process.kill(-child.pid, "SIGKILL");
@@ -32,10 +35,15 @@ export function runCheck(command: string, cwd: string, timeoutMs: number, runnin
         // already gone
       }
     };
+    /** A kill that is a verdict (timeout, hub stop) settles even if the child's events never come. */
+    const killAndSettle = () => {
+      killGroup();
+      grace ??= setTimeout(() => done(null), KILL_GRACE_MS);
+    };
     const stop = () => {
-      if (exited) return; // finished before the hub stopped: its own result stands
+      if (exited || settled) return; // finished before the hub stopped, or already settled: its result stands and the group may be reused
       interrupted = true;
-      killGroup();
+      killAndSettle();
     };
     running?.add(stop);
     const keep = (chunk: string) => {
@@ -48,12 +56,13 @@ export function runCheck(command: string, cwd: string, timeoutMs: number, runnin
     }
     const timer = setTimeout(() => {
       timedOut = true;
-      killGroup();
+      killAndSettle();
     }, timeoutMs);
     const done = (code: number | null) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
+      clearTimeout(grace);
       running?.delete(stop);
       child.stdout?.destroy();
       child.stderr?.destroy();
@@ -65,6 +74,7 @@ export function runCheck(command: string, cwd: string, timeoutMs: number, runnin
       done(null);
     });
     child.on("exit", (code) => {
+      if (settled) return; // the kill grace settled it: the process group id is no longer ours to signal
       exited = true;
       clearTimeout(timer); // it finished in time; only its output may still be on the way
       killGroup(); // a background job it left behind (sh has no job control, so it is still in the group)

package/src/hub/conductor.ts

@@ -240,7 +240,8 @@ export class Conductor {
       if (definitionOf(start.peer, instances)?.kind !== start.peer && !this.hooks.known(start.peer)) throw new PreEffectToolRefusal(`unknown peer: ${start.peer}`);
       const result = await this.hooks.start(start.peer);
       const opened = result && typeof result === "object" && typeof (result as { opened?: unknown }).opened === "string" ? { opened: (result as { opened: string }).opened } : {};
-      emit({ peer: start.peer }); return { ...start, ...opened };
+      const already = result && typeof result === "object" && (result as { already?: unknown }).already === true ? { already: true } : {};
+      emit({ peer: start.peer }); return { ...start, ...opened, ...already };
     }
     const peer = peerId(args.peer, true);
     if (!this.hooks.known(peer)) throw new PreEffectToolRefusal(`unknown peer: ${peer}`);

package/src/hub/config-apply.ts

@@ -11,6 +11,8 @@ import { taskSweepConfig } from "./task-sweep.ts";
 import { projectionConfig } from "./text-projection.ts";
 import { validateInstances, type InstancesConfig } from "./instances.ts";
 import { peerRosterConfig } from "./roster.ts";
+import { CHARACTER_IDS } from "../pet/characters.ts";
+import { petPalette } from "../pet/config.ts";
 
 export type ApplyClass = "live" | "next use" | "restart";
 export interface ApplyRule { applies: ApplyClass; reason?: string }
@@ -63,6 +65,7 @@ export function authorizeConfigLeaf(input: ConfigAuthorizationInput): ConfigAuth
   if (["inference.enabled", "inference.triage", "review.adaptive"].includes(key) && before === true && after === false) tightening = true;
   if (key === "review.min_reviews" && numeric(before) && numeric(after) && after >= before) tightening = true;
   if (tightening && !input.settledHolderChange) return result(true, false, "semantic tightening");
+  if (input.source === "config" && (key === "pet" || key.startsWith("pet."))) return result(true, false, "console-local presentation");
   if (guard?.risk === "safe" && !machine) return result(true, false, "safe registered setting");
   if (input.acceptedFallback && !machine) {
     const person = input.authority === "terminal" || input.authority === "settings" && !!guard;
@@ -106,12 +109,26 @@ const block = (schema: Record<string, Check>): Check => {
 };
 const peerMap = (check: Check) => map(check, SUPPORTED_PEERS);
 const timerSeconds = number(1, 2_147_483_647 / 1000), timerMinutes = number(1, 2_147_483_647 / 60_000);
+const petFields: Record<string, Check> = {
+  character: words(CHARACTER_IDS),
+  size: words(["line", "mini", "full"]),
+  glyphs: words(["auto", "ascii", "blocks"]),
+  blink: bool,
+  bell: bool,
+  palette: (v, k) => { if (!petPalette(v)) fail(k, "unknown choice"); },
+  window: bool,
+};
+export const validatePetConfig: Check = (v, k) => {
+  if (v === false) return;
+  block(petFields)(v, k);
+};
+shapes.set(validatePetConfig, { fields: petFields });
 const nativeValidators = { bool, text, strings, argv, number, words, block };
 const schema: Record<string, Check> = {
   ...Object.assign({}, ...ADAPTERS.map(adapter => adapter.configuration?.schema?.(nativeValidators) ?? {})),
   watchdog_ms: number(1, 2_147_483_647), kimi_cmd: argv, qwen_cmd: argv, jcode_cmd: argv, codex_bin: text, jcode_home: text, jcode_provider_profile: text,
   permission_modes: v => { permissionDefaults(v); }, protect_instruction_files: bool,
-  instances: v => { validateInstances(v); },
+  instances: v => { validateInstances(v); }, pet: validatePetConfig,
   batch_max: number(1, 100_000, true), batch_ms: number(0, 2_147_483_647), queue_cap: number(1, 1_000_000, true),
   memory: block({ enabled: bool, worker_url: text, inject_tokens: number(0, 1_000_000, true), brief_items: number(0, 10_000, true), native: bool,
     short_ttl_days: number(1, 3650, true), sync_interval_min: number(0, 1440, true), suggest_edges: bool }),
@@ -142,6 +159,7 @@ const schema: Record<string, Check> = {
   review: block({ adaptive: bool, min_reviews: number(1, Number.MAX_SAFE_INTEGER, true), pool: v => { reviewerPoolConfig({ pool: v }, DEFAULT_REVIEW_POOL, REVIEW_POOL_KINDS); }, rerotate: bool }), recovery: block({ auto_resume_after_crash: bool }),
   capabilities: map(strings), coordination: words(["advisory", "turn-free"]), experiments: block({ stale_notices: words(["drop", "deliver"]) }),
 };
+export const SCHEMA_KEYS: readonly string[] = Object.freeze(Object.keys(schema));
 export function validateRawConfig(raw: unknown, declarations?: InstancesConfig): asserts raw is Record<string, unknown> {
   const value = object(raw, "config");
   const instances = validateInstances(value.instances ?? declarations);
@@ -169,7 +187,7 @@ const restart: Record<string, string> = {
   profile: "Session tool schemas and profile contracts are bound at startup", profile_overrides: "Session tool schemas and profile contracts are bound at startup",
   text_projection: "Converter and cache ownership are bound at startup", terminal: "Terminal provider is supplied by the daemon lifecycle", bench: "Benchmark execution environment is selected before work starts",
 };
-const live = new Set(["permission", "roster", "roles", "planner", "conductor", "protect_instruction_files", "task_sweep", "capabilities", "research", "snapshots", "tasks.wip_limits", "tasks.escalate_after", "approvals.notify"]);
+const live = new Set(["permission", "roster", "roles", "planner", "conductor", "protect_instruction_files", "task_sweep", "capabilities", "research", "snapshots", "tasks.wip_limits", "tasks.escalate_after", "approvals.notify", "pet"]);
 const nextMemory = new Set(["memory.inject_tokens", "memory.brief_items", "memory.suggest_edges"]);
 /** Closed top-level schema; leaf overrides retain the existing session/runtime boundaries. */
 export function configApply(key: string): ApplyRule {

package/src/hub/config-reload.ts

@@ -35,7 +35,7 @@ export function configSourceTexts(cwd: string): ConfigSourceTexts {
 
 export const configFingerprint = (texts: ConfigSourceTexts): string => createHash("sha256").update(JSON.stringify(texts)).digest("hex");
 
-/** Validate only the hub-owned routing schema; Switchyard target/route fields remain extensible. */
+/** Validate active routing; bounded legacy tables are ignored as retired settings. */
 function validateRoutingRaw(value: unknown): void {
   const bad = (key: string): never => { throw new Error(`.agenthub/routing.toml: ${key} is invalid or unknown`); };
   const table = (v: unknown, key: string): Record<string, unknown> => {
@@ -62,12 +62,6 @@ function validateRoutingRaw(value: unknown): void {
     else if (Array.isArray(v)) { if (v.length > 1024) bad(key); for (const item of v) openValue(item, key, depth + 1); }
     else for (const item of Object.values(table(v, key))) openValue(item, key, depth + 1);
   };
-  const switchyard = (v: unknown, key: string, required: "id" | "type") => {
-    for (const [name, item] of Object.entries(table(v, key))) {
-      if (!name || name.length > 128 || ["__proto__", "constructor", "prototype"].includes(name)) bad(key);
-      const entry = table(item, `${key}.${name}`); text(entry[required], `${key}.${name}.${required}`); openValue(entry, `${key}.${name}`);
-    }
-  };
   const nativeValidators = { bool, text, strings, argv: strings,
     number: (min = 1, max = Number.MAX_SAFE_INTEGER, _integer = true) => (v: unknown, k: string) => numeric(v, k, min, max),
     words: (values: readonly string[]) => (v: unknown, k: string) => choice(v, k, values),
@@ -75,7 +69,7 @@ function validateRoutingRaw(value: unknown): void {
   };
   closed(value, "routing", {
     ...Object.assign({}, ...ADAPTERS.map(adapter => adapter.configuration?.routingSchema?.(nativeValidators) ?? {})),
-    targets: (v, k) => switchyard(v, k, "id"), routes: (v, k) => switchyard(v, k, "type"),
+    targets: openValue, routes: openValue,
     // parseRouting delegates these tables to the existing parseHubRoutes validator.
     hub_routes: (v, k) => { table(v, k); },
     stay_switch: (v, k) => choice(v, k, ["off", "shadow", "enforce"]), max_switch_prefill_tokens: numeric,

package/src/hub/control-client.ts

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { projectContext } from "./project.ts";
 
 export function stateDirFor(cwd: string): string {
@@ -8,7 +8,7 @@ export function stateDirFor(cwd: string): string {
 
 /** Control WS wire version. 2 = `deliver` carries `envs` (digests); 3 = `tools` role and task messages; 4 = budget messages and `hub_checkpoint`; 5 = `ask`; 6 = console-only `ui` session bootstrap; 8 = controlled recovery; 9 = Pi bridge metadata; 10 = durable delivery receipts; 11 = queue hold diagnostics; 12 = generation-bound channel settlement and execution budgets; 13 = turn-free facts (`facts` with tool, session and transcript binding, `silenced`) and per-recipient send results (issue #108). 14 = native context-window status and session-bound context checkpoint request ids (issue #185). 15 = conductor tools and permission deadlines/closed events (issues #190, #194). 16 = a Claude session without channel evidence: hello `channel: false` and `inbox` (issue #205). The plugin is installed apart from the daemon, so they can drift. */
 export const PROTOCOL = 16;
-export const DAEMON_FEATURES = ["native_hook_launch", "task_cancel", "recovery_deferred_hub", "peer_instances", "release_trains", "reviewer_pool", "native_tui_launch"] as const;
+export const DAEMON_FEATURES = ["native_hook_launch", "task_cancel", "recovery_deferred_hub", "peer_instances", "release_trains", "reviewer_pool", "native_tui_launch", "terminal_owner", "cli_audit_delegated"] as const;
 /** Protocols a current coordinator may authenticate while upgrading a running source. */
 export const RECOVERY_SOURCE_PROTOCOLS = [9, 10, 11, 12, 13, 14, 15, PROTOCOL] as const;
 
@@ -18,6 +18,10 @@ export interface Hello {
   peer?: string;
   /** `peer` only: false when the session cannot show channel pushes; its queue then waits for `inbox` (issue #205). */
   channel?: boolean;
+  /** Managed Claude launch identity; absent for plain or pre-daemon sessions. */
+  launchId?: string;
+  /** Reclaim after replacement, never an intentional initial takeover. */
+  standby?: boolean;
   projectId?: string;
   instanceId?: string;
   projectRoot?: string;
@@ -56,9 +60,15 @@ export function readControl(stateDir: string): ControlDescriptor | undefined {
   }
 }
 
+const instancePins = new Map<string, { instanceId: string }>();
+
 /** One authenticated control connection. `request` correlates replies by `rid`; everything else goes to `onPush`. */
 export class ControlClient {
   features: readonly string[] = [];
+  private welcomeInstanceId?: string;
+  /** Identity from the authenticated welcome, never the unauthenticated descriptor alone. */
+  get instanceId(): string | undefined { return this.welcomeInstanceId; }
+  get isOpen(): boolean { return this.ws.readyState === WebSocket.OPEN; }
   private nextRid = 1;
   private readonly pending = new Map<number, (msg: any) => void>();
   onPush: (msg: any) => void = () => {};
@@ -67,11 +77,23 @@ export class ControlClient {
 
   private constructor(private readonly ws: WebSocket) {}
 
+  /** Scope all helper-module connections in one CLI invocation to its authenticated audit consumer. */
+  static pinInstance(stateDir: string, instanceId: string): () => void {
+    const key = resolve(stateDir), pin = { instanceId };
+    if (!instanceId || instancePins.has(key)) throw new Error("control instance is already pinned or unavailable");
+    instancePins.set(key, pin);
+    return () => { if (instancePins.get(key) === pin) instancePins.delete(key); };
+  }
+
   /** `protocol` is used only by the upgrade coordinator for an authenticated, explicitly supported source contract. */
   static connect(stateDir: string, hello: Hello, timeoutMs = 3000, protocol = PROTOCOL): Promise<ControlClient> {
     if (!RECOVERY_SOURCE_PROTOCOLS.includes(protocol as (typeof RECOVERY_SOURCE_PROTOCOLS)[number])) return Promise.reject(new Error(`unsupported recovery source protocol ${protocol}`));
     const control = readControl(stateDir);
     if (!control) return Promise.reject(new Error(`no hub running for ${stateDir} (run: ahub up)`));
+    const pin = instancePins.get(resolve(stateDir));
+    if (pin && (control.instanceId !== pin.instanceId || hello.instanceId !== undefined && hello.instanceId !== pin.instanceId)) {
+      return Promise.reject(new Error("delegated audit consumer changed; refusing a connection to its replacement"));
+    }
     if (control.protocol !== undefined && control.protocol !== protocol) {
       return Promise.reject(Object.assign(new Error(`wire version mismatch: hub speaks ${control.protocol}, CLI speaks ${protocol}; stop it with its matching CLI, then upgrade and restart`), { code: 4426 }));
     }
@@ -80,7 +102,7 @@ export class ControlClient {
         (hello.projectRoot && hello.projectRoot !== control.cwd)) {
       return Promise.reject(Object.assign(new Error("hub project or instance does not match the selected project"), { code: 4404 }));
     }
-    const expected = { projectId: hello.projectId ?? control.projectId, instanceId: hello.instanceId ?? control.instanceId,
+    const expected = { projectId: hello.projectId ?? control.projectId, instanceId: pin?.instanceId ?? hello.instanceId ?? control.instanceId,
       projectRoot: hello.projectRoot ?? control.cwd };
     return new Promise((resolve, reject) => {
       const ws = new WebSocket(control.url);
@@ -113,6 +135,7 @@ export class ControlClient {
           return refuse(Object.assign(new Error("connected hub has a different project or instance"), { code: 4404 }));
         }
         client.features = Object.freeze(Array.isArray(reply.features) ? reply.features.filter((feature: unknown): feature is string => typeof feature === "string") : []);
+        client.welcomeInstanceId = typeof reply.instanceId === "string" && reply.instanceId ? reply.instanceId : undefined;
         clearTimeout(timer);
         resolve(client);
       });