@staix/agent-hub 0.12.44 → 0.13.0

package/src/hub/tasks.ts

@@ -1,3 +1,7 @@
+import { buildTaskCodeSymbols, publicTaskCodeSymbols, taskCodeSymbolsDisjoint, HOST_CODE_SYMBOLS } from "./task-code-symbols.ts";
+import { normalizePlanSymbol, symbolsOverlap } from "./symbol-normalizer.ts";
+import { publicTestIntegrity, readTestIntegrity, testIntegrityBlockers, type TestIntegrity } from "./test-integrity.ts";
+import { completePlanInventory, planConformance, planConformanceBlockers, planFingerprint, type PlanConformance } from "./plan-conformance.ts";
 import { RELEASE_TRAIN_HISTORY_LIMIT, releaseTrainData, releaseTrainReadiness, releaseMetrics } from "./sdlc-release.ts";
 import { cleanCostPlan, costMetrics, type CostPlan, type ReviewCost } from "./cost-governance.ts";
 import { specRefs } from "./spec-read.ts";
@@ -8,6 +12,7 @@ import { NoWriteTurns } from "./no-writes.ts";
 import { readGitHubImport, type GitHubSource, type GitHubImportSelection } from "./github-import.ts";
 import { BACKLOG_SPLIT_SCREEN_TIMEOUT_MS, actualTaskDates, planningPatch, type PlanningFields, type Release, type ReleaseState } from "./planning.ts";
 import { readMergeQueue } from "./sdlc-queue.ts";
+import { DEFAULT_MAX_NITS, parseReviewFindings, findingsForHead, findingHead as resolveFindingHead, findingTally, type ReviewFinding, type ReviewFindingSet } from "./review-findings.ts";
 import { readReleaseReadiness } from "./sdlc-release.ts";
 import { loadRoleCatalog, taskRole, taskRoleText, type RoleCatalog } from "./roles.ts";
 import { matchesPolicy } from "./path-policy.ts";
@@ -35,7 +40,7 @@ import { coverageGap, renderReviewBrief, type ReviewBrief } from "./review-brief
 import { definitionOf as builtinDefinitionOf } from "../adapters/registry.ts";
 import { ADAPTERS, DEFAULT_REVIEW_POOL, definitionOf, familyOf, type ProjectAdapterCatalog } from "../adapters/registry.ts";
 import { plannerGrooming, nextSweep, taskSweepConfig, type TaskSweepConfig, type SweepRecord } from "./task-sweep.ts";
-import { readPrCostHistory, readReviewReadiness, reviewReadinessFromEvidence, type PrEvidence, type ReviewReadiness, readPlanIssueMetadata, canonicalStage, checklistOf, readSdlcPr, readSpecEdit, sdlcConfig, sdlcReceipt, sdlcStatus, specState, SPEC_STATE_TEXT, stageDefinition, lifecycleStage, type SdlcConfig, type PlanIssueMetadata, sdlcGh, type SdlcGh, type SdlcStatus, type SpecEdit, type SpecState } from "./sdlc.ts";
+import { linkedReceipt, openPrFor, readPrCostHistory, readReviewReadiness, reviewReadinessFromEvidence, type PrEvidence, type ReviewReadiness, readPlanIssueMetadata, canonicalStage, checklistOf, readSdlcPr, readSpecEdit, sdlcConfig, sdlcReceipt, sdlcStatus, specState, SPEC_STATE_TEXT, stageDefinition, lifecycleStage, type SdlcConfig, type PlanIssueMetadata, sdlcGh, type SdlcGh, type SdlcStatus, type SpecEdit, type SpecState } from "./sdlc.ts";
 
 export type TaskAssignmentRole = "owner" | "reviewer";
 
@@ -70,6 +75,7 @@ export interface TasksDeps {
   /** Explicit acceptance/self-claim only; implicit done has no pre-work baseline. */
   ownerAccepted?: (task: Task) => void;
   /** #520: the review brief for a task's commit (git only, bounded); undefined when the task names no commit. */
+  prepareReviewBrief?: (task: Task) => Promise<void>;
   reviewBrief?: (task: Task) => ReviewBrief | { unavailable: string } | undefined;
   sdlc?: { config: () => SdlcConfig; gh?: SdlcGh };
   briefs?: Briefs;
@@ -174,6 +180,8 @@ const CONTRADICTION_WINDOW_MS = 7 * 86_400_000;
 const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
 /** Board events that leave a task where its completion check found it; any other event means it moved on meanwhile. */
 const QUIET_EVENTS = new Set(["answer", "reviewer changed", "idle sweep", "memory reference started"]);
+QUIET_EVENTS.add("ready held"); // #655: the hub's note that a ready task waits for its reserved owner's WIP slot.
+QUIET_EVENTS.add("plan observed"); // Host observation does not move the task or replace completion intent.
 
 /**
  * Thrown when an assignment's board write is saved but a publish or notify after it failed (#297): the move is
@@ -250,9 +258,17 @@ function acceptRefs(input: unknown): TaskRefs | undefined {
 /** The same for a plan (issue #31): only its four lists, each of short strings. */
 function cleanPlan(input: unknown, profile: ProfileSelection = "dev"): TaskPlan {
   const r = fields(input);
+  const evidence: Pick<TaskPlan, "proof" | "risks"> = {};
+  for (const key of ["proof", "risks"] as const) {
+    const value = r[key];
+    if (value === undefined) continue;
+    if (!Array.isArray(value) || value.length > 32 || value.some(item => typeof item !== "string" || item.length > 512)) throw new PreEffectToolRefusal(`plan.${key}: expected at most 32 strings of at most 512 characters`);
+    const items = value.map(item => item.replace(/\s+/g, " ").trim()).filter(Boolean);
+    if (items.length) evidence[key] = items;
+  }
   let scope: CostPlan;
   try { scope = cleanCostPlan(r); } catch { throw new PreEffectToolRefusal("invalid review or CI cost scope"); }
-  return { ...Object.fromEntries((profileData(profile).plan_keys as (keyof TaskPlan)[]).map((k) => [k, k === "paths" ? [...new Set(textList(r[k]).map(normPath))] : textList(r[k])] as const).filter(([, v]) => v.length)), ...scope };
+  return { ...Object.fromEntries((profileData(profile).plan_keys as (keyof TaskPlan)[]).map((k) => [k, k === "paths" ? [...new Set(textList(r[k]).map(normPath))] : textList(r[k])] as const).filter(([, v]) => v.length)), ...evidence, ...scope };
 }
 
 /** A plan as one line for other owners; the whole plan is on the board. */
@@ -266,6 +282,9 @@ const RESCREEN_MAX = 10;
  * The task flow. Adapters and tools never touch the board: every change comes through here, where assignment,
  * PII handling, envelopes, briefs and memory notes are decided in one place.
  */
+/** #694: a PR staged at done with the commit or branch it was read for. */
+interface IdentityLink { repo: string; pr: number; basis: { commit?: string; branch?: string } }
+
 export class Tasks {
   private readonly repositories: TaskRepositories;
   private readonly incomingBacklog = new Set<number>();
@@ -280,6 +299,7 @@ export class Tasks {
   private sweeping = false;
 
   constructor(private readonly d: TasksDeps) {
+    d.board.trackPlanRevisions = () => (d.sdlc?.config().mode ?? "off") !== "off";
     this.repositories = new TaskRepositories(d.cwd, d.repository);
     for (const task of d.board.list()) this.warmRepository(task);
     if (d.coordination) {
@@ -389,7 +409,7 @@ export class Tasks {
           } else {
             const admission = this.plannerPullRecord(task)?.pull ? this.plannerAssignment(task, true) : assign(task, this.states(), this.d.routing(), { exclude: this.excluded(task), ...this.weights(task.class, task) });
             this.releaseNotice(`${text} Owner reassignment suggestion: ${admission.owner ?? "no eligible peer"}.`);
-            if (admission.owner && config.auto_reassign && this.sweepAvailable(admission.owner)) {
+            if (admission.owner && config.auto_reassign && this.sweepAvailable(admission.owner) && !this.reservedHold(task)) {
               try { await this.assignOwner(this.d.board.get(task.id)!, HUB, { candidates: [admission.owner], event: "reassigned", reason: "idle", note: "ready-unassigned idle sweep" }); }
               catch (e) { if (!(e instanceof AssignmentUndeliveredError)) throw e; }
             }
@@ -526,14 +546,62 @@ export class Tasks {
   /** What peers other than the owner, the console stream and the log may see of a task. */
   publicTitle = (task: Task) => (this.isPii(task) ? `#${task.id} [pii]` : `#${task.id} ${task.title}`);
 
+  private reviewFindingSets(task: Task): ReviewFindingSet[] { return task.history.flatMap(entry => entry.reviewFindings ? [entry.reviewFindings] : []); }
+
+  private findingHead(task: Task, reviewedHead?: string): string | undefined {
+    return resolveFindingHead(task.sdlc, reviewedHead ? { head: reviewedHead } : undefined, task.refs.commit);
+  }
+
+  private findingTextAllowed(task: Task, items: readonly ReviewFinding[]): boolean {
+    return this.candidateTextAllowed(JSON.stringify(items), task)
+      && items.every(item => !item.path || !matchesPolicy(this.d.cwd, item.path, this.d.piiPaths ?? [], true));
+  }
+
+  /** Host-authored proposals contain only cleared IDs, integer task references and fixed instruction targets. */
+  private proposeRecurringFindings(task: Task, by: PeerId, items: readonly ReviewFinding[], withheld: boolean): void {
+    if (withheld || this.isPii(task) || this.d.privateTurn?.(by) || !items.length || !this.findingTextAllowed(task, items)) return;
+    const rows = this.d.board.list();
+    const keys = new Set(rows.filter(row => row.class === "plan" && row.history[0]?.by === HUB)
+      .flatMap(row => row.detail?.split("\n").filter(line => line.startsWith("Review finding key: ")) ?? []));
+    const created: number[] = [];
+    // No await separates the durable dedupe read from creation; concurrent verdicts see the first proposal.
+    for (const item of items.filter(item => item.disposition !== "false_positive")) {
+      const same = (finding: ReviewFinding) => finding.id === item.id && finding.pass === item.pass;
+      const holders = rows.filter(row => {
+        if (this.isPii(row)) return false;
+        const last = row.history.findLast(entry => entry.reviewFindings?.items.some(value => value.id === item.id));
+        const finding = last?.reviewFindings?.items.find(value => value.id === item.id);
+        return !last?.withheld && finding && same(finding) && finding.disposition !== "false_positive" && this.findingTextAllowed(row, [finding]);
+      });
+      if (new Set(holders.map(row => row.id)).size < 2) continue;
+      const key = `Review finding key: ${item.pass}:${item.id}`;
+      if (keys.has(key)) continue;
+      const title = `Review policy amendment for recurring finding ${item.pass}:${item.id}`;
+      const detail = `${key}\nFinding ${item.pass}:${item.id} recurred on tasks ${holders.slice(0, 8).map(row => `#${row.id}`).join(", ")}. Inspect their review histories and propose an AGENTS.md or relevant docs/agent-notes/ amendment. This backlog card is a proposal, not authorization to edit instruction files.`;
+      const draft = { title, detail, refs: { paths: ["AGENTS.md", "docs/agent-notes/"] } };
+      const signals = this.signalsFor(draft);
+      if (this.isPii({ signals }) || !this.candidateTextAllowed(`${title}\n${detail}`)) continue;
+      const proposal = this.d.board.propose(HUB, { ...draft, class: "plan", backlog: true, signals });
+      this.incomingBacklog.add(proposal.id); keys.add(key); created.push(proposal.id);
+    }
+    for (const id of created) this.releaseNotice(`task #${id}: recurring review finding amendment proposed in the backlog`);
+  }
+
   /** A task as a cloud peer may see it. */
+
   publicView(task: Task, fullHistory = false): Record<string, unknown> {
-    const { title, detail, history, external, cancelled, ...rest } = task;
+    const { title, detail, history, external, cancelled, codeSymbols, ...taskRest } = task;
+    const rest = { ...taskRest, ...(history.some(h => h.by === USER && h.planDeparture) ? { planDepartureAccepted: true } : {}) };
     if (this.isPii(task)) return { ...rest, actualDates: actualTaskDates(task), refs: {}, plan: {}, ...(task.sdlc ? { sdlc: { stage: stageDefinition(this.d.sdlc?.config() ?? sdlcConfig(undefined), task.sdlc.stage)?.base ?? "unknown" } } : {}), title: "[pii]", detail: "[pii]" };
+    if (rest.sdlc?.redFirst && !this.publicMetadataText(JSON.stringify(rest.sdlc.redFirst))) {
+      const { redFirst: _withheld, ...receipt } = rest.sdlc; rest.sdlc = receipt;
+    }
     const screenHistoryText = (text: string, field: string, withheld = false): string => !withheld && this.nameable(text) ? text : `[history ${field} withheld: ${this.whyWithheld(text)}; ahub task show ${task.id}]`;
     const publicHistory = (fullHistory ? history : history.slice(-5)).map(h => ({
       at: h.at, by: h.by, event: h.event,
       ...(h.note === undefined ? {} : { note: screenHistoryText(h.note, "note", h.withheld) }),
+      ...(h.reviewFindings ? { reviewFindings: !h.withheld && this.findingTextAllowed(task, h.reviewFindings.items) ? h.reviewFindings
+        : { ...(h.reviewFindings.head ? { head: h.reviewFindings.head } : {}), tally: findingTally(h.reviewFindings.items), withheld: true } } : {}),
       ...(h.supersededBy === undefined ? {} : { supersededBy: screenHistoryText(h.supersededBy, "supersession", h.withheld) }),
       ...(h.profile === undefined ? {} : { profile: screenHistoryText(h.profile, "profile") }),
       ...(h.owner === undefined ? {} : { owner: h.owner }),
@@ -545,7 +613,10 @@ export class Tasks {
       ...(h.reason && TASK_MOVE_REASONS.includes(h.reason) ? { reason: h.reason } : {}),
       ...(h.sweep ? { sweep: { kind: h.sweep.kind, activity: h.sweep.activity, step: h.sweep.step, at: h.sweep.at } } : {}),
     }));
-    return { ...rest, ...(cancelled ? { cancelled: { ...cancelled, reason: screenHistoryText(cancelled.reason, "cancellation", cancelled.withheld), ...(cancelled.supersededBy ? { supersededBy: screenHistoryText(cancelled.supersededBy, "supersession", cancelled.withheld) } : {}) } } : {}), ...(external && this.nameable(external.url) ? { external } : {}), actualDates: actualTaskDates(task), ...(((this.d.sdlc?.config().mode ?? "off") !== "off" || this.d.sdlc?.config().workflow === "gsd-lite") ? { lifecycle: sdlcStatus(this.d.sdlc?.config() ?? sdlcConfig(undefined), task.sdlc, undefined, this.workflowView(task)) } : {}), title, detail, history: publicHistory };
+    const sets = this.reviewFindingSets(task), current = findingsForHead(sets, this.findingHead(task));
+    const symbolRepository = codeSymbols && this.codeSymbolsRepository(task);
+    const publicSymbols = codeSymbols && symbolRepository ? publicTaskCodeSymbols(codeSymbols, this.reviewHead(task), symbolRepository.key, this.publicMetadataText) : undefined;
+    return { ...rest, ...(publicSymbols ? { codeSymbols: publicSymbols } : {}), ...(current.length ? { findings: findingTally(current) } : {}), ...(cancelled ? { cancelled: { ...cancelled, reason: screenHistoryText(cancelled.reason, "cancellation", cancelled.withheld), ...(cancelled.supersededBy ? { supersededBy: screenHistoryText(cancelled.supersededBy, "supersession", cancelled.withheld) } : {}) } } : {}), ...(external && this.nameable(external.url) ? { external } : {}), actualDates: actualTaskDates(task), ...(((this.d.sdlc?.config().mode ?? "off") !== "off" || this.d.sdlc?.config().workflow === "gsd-lite") ? { lifecycle: sdlcStatus(this.d.sdlc?.config() ?? sdlcConfig(undefined), task.sdlc, undefined, this.workflowView(task), undefined, sets, task.refs.commit) } : {}), title, detail, history: publicHistory };
   }
 
   /** Console results expose direct approval and delivery holds, not just the chosen peer ids. */
@@ -761,7 +832,7 @@ export class Tasks {
       // were stored as written, so both sides are compared in one spelling.
       if (mine.repositoryKey !== theirs.repositoryKey) continue;
       const file = (p: string) => normPath(p) !== "." && theirs.paths.some((q) => normPath(q) === normPath(p));
-      const same = mine.paths.some(file) || mine.symbols.some((x) => theirs.symbols.includes(x));
+      const same = mine.paths.some(file) || mine.symbols.some((x) => theirs.symbols.some((y) => symbolsOverlap(x, y)));
       if (!same || this.d.board.reviews({ task: t.id }).some((r) => r.kind === "contradicted")) continue;
       this.d.board.recordReview({ implementer: t.owner, reviewer: approval.by, class: t.class, kind: "contradicted", task: t.id });
     }
@@ -1421,6 +1492,7 @@ export class Tasks {
     this.withdrawRoleRequest(confirmed, returned, "reviewer");
     this.incomingBacklog.add(confirmed.id);
     this.planningRecorded({ by, task: confirmed.id, fields: ["return"], revision: confirmed.planningRevision ?? 0 });
+    await this.releaseHeld(confirmed.owner); // its owner's slot is free (#655)
     return returned;
   }
 
@@ -1548,6 +1620,18 @@ export class Tasks {
   /** The tasks an overlap text for `task` names: their plans are in it (issue #108). */
   overlapTasks = (task: Task): number[] => this.overlapHits(task).map((h) => h.task.id);
 
+  /** Console detail advice only: no pair persistence, and no private task on either side. */
+  symbolOverlaps(task: Task): { task: number; files: string[]; sameFileDifferentSymbols: boolean }[] {
+    // A routing-locality opt-out does not make symbol metadata for a marked task public.
+    const markedPrivate = (value: Task) => value.signals.includes("pii") || value.signals.includes("pii_path");
+    if (markedPrivate(task)) return [];
+    return this.overlapHits(task).filter(hit => !markedPrivate(hit.task)).map(hit => ({
+      task: hit.task.id,
+      files: hit.paths.filter(this.publicMetadataText),
+      sameFileDifferentSymbols: this.sameFileDifferentSymbols(task, hit),
+    }));
+  }
+
   /**
    * Dashboard warning links (#264): the board's overlap pairs and the live cohorts, as task and peer ids only.
    * Paths, symbols and plans stay out; PII tasks are excluded by the same rules overlapHits applies.
@@ -1590,12 +1674,23 @@ export class Tasks {
    * ponytail: kept in memory, so after a restart such a notice is delivered whatever its task's state; persist the
    * condition if stale notices after restarts show up.
    */
-  private readonly conditional = new Map<string, { peer: PeerId; task: number; states: Task["state"][] }>();
+  private readonly conditional = new Map<string, { peer: PeerId; task: number; tasks?: number[]; states: Task["state"][] }>();
 
   /**
    * Publish a notice about `task`, which only matters to `to` while that task is in one of `states` for it (issue
    * #106): open work by default; the conflict notices of #91 count a task in review too.
    */
+  /**
+   * #713: the completed-change notice of task `done` for one recipient, about all of its tasks in `about`. It stays relevant while any of them is still open for the
+   * recipient, and carries `completedFor` so the bus replaces an earlier queued notice for the same `done` task and recipient.
+   */
+  whileOpenFor(to: PeerId, done: number, about: number[], body: string): void {
+    const env = newEnvelope(HUB, body, { to: [to], kind: "task", refs: { task: String(about[0]), taskRecipient: "owner", completedFor: done } });
+    this.conditional.set(env.id, { peer: to, task: about[0]!, tasks: about, states: OPEN });
+    if (this.conditional.size > 1024) this.conditional.delete(this.conditional.keys().next().value as string);
+    this.d.bus.publish(env);
+  }
+
   whileOpen(to: PeerId, task: number, body: string, states: Task["state"][] = OPEN): void {
     const env = newEnvelope(HUB, body, { to: [to], kind: "task", refs: { task: String(task), taskRecipient: "owner" } });
     this.conditional.set(env.id, { peer: to, task, states });
@@ -1624,8 +1719,8 @@ export class Tasks {
     }
     const c = this.conditional.get(env.id);
     if (!c || c.peer !== peer) return true;
-    const t = this.d.board.get(c.task);
-    return !!t && t.owner === peer && c.states.includes(t.state);
+    // A notice about several of the recipient's tasks matters while any one of them is still open for it (#713).
+    return (c.tasks ?? [c.task]).some((id) => { const t = this.d.board.get(id); return !!t && t.owner === peer && c.states.includes(t.state); });
   };
 
   /** Whether a model-written name may be shown to other peers and in the log: one matching a PII pattern may be PII. */
@@ -1661,7 +1756,12 @@ export class Tasks {
   private places(task: Task): { repositoryKey: string; paths: string[]; symbols: string[] } {
     const scope = this.repositories.scope(task.refs);
     const paths = [...(task.refs.paths ?? []), ...(task.plan?.paths ?? [])].map((p) => scope === this.repositories.project ? this.projectPath(p) : normPath(this.repositories.relativePath(scope, p)));
-    return { repositoryKey: scope.key, paths: [...new Set(paths)], symbols: [...(task.plan?.symbols ?? []), ...(task.plan?.sections ?? []).map(v => `section ${v}`), ...(task.plan?.sources ?? []).map(v => `source ${v}`)] };
+    const symbols = [
+      ...(task.plan?.symbols ?? []).map(normalizePlanSymbol),
+      ...(task.plan?.sections ?? []).map(v => `section ${v}`),
+      ...(task.plan?.sources ?? []).map(v => `source ${v}`),
+    ];
+    return { repositoryKey: scope.key, paths: [...new Set(paths)], symbols: [...new Set(symbols)] };
   }
 
   private roots?: string[];
@@ -1687,7 +1787,7 @@ export class Tasks {
       const theirs = this.places(t);
       if (mine.repositoryKey !== theirs.repositoryKey) return [];
       const paths = task.profile && t.profile && (task.plan?.sections?.length && t.plan?.sections?.length) ? [] : mine.paths.filter((p) => theirs.paths.some((q) => samePlace(p, q)));
-      const symbols = mine.symbols.filter((x) => theirs.symbols.includes(x));
+      const symbols = mine.symbols.filter((x) => theirs.symbols.some((y) => symbolsOverlap(x, y)));
       return paths.length || symbols.length ? [{ task: t, paths, symbols }] : [];
     });
   }
@@ -2037,13 +2137,49 @@ export class Tasks {
     if (waits.length) throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id} waits for ${waits.map((id) => `#${id}`).join(", ")}, not approved yet`);
   }
 
+  /** Ready offers between their cap check and the owner write (#655): task id -> reserved owner whose slot it takes. */
+  private readonly readyInFlight = new Map<number, PeerId>();
+
+  /** Offer order for ready work (#655): priority (urgent is P0, none is P2), then rank, then id. */
+  private readonly readyOrder = (a: Task, b: Task): number =>
+    (a.priority ?? (a.signals.includes("urgent") ? 0 : 2)) - (b.priority ?? (b.signals.includes("urgent") ? 0 : 2))
+    || (a.rank ?? Number.MAX_SAFE_INTEGER) - (b.rank ?? Number.MAX_SAFE_INTEGER) || a.id - b.id;
+
+  /** Ready work the hub parked on its reserved owner's WIP cap (#655): its latest move-or-hold entry is `ready held`. */
+  private isHeld(task: Task): boolean {
+    // A planner's priority or rank edit (`planned`) is no move: it must not make held work look released.
+    return task.history.findLast(entry => entry.event === "ready held" || !QUIET_EVENTS.has(entry.event) && entry.event !== "planned")?.event === "ready held";
+  }
+
+  /**
+   * Why readiness must not hand `task` to its reserved owner yet (#655): that owner is at its planner WIP cap, the count
+   * `acceptanceCapacity` refuses at. Peer id and counts only, so it is safe for a PII task. A reserved owner the task
+   * excludes is not honoured by routing, and planner-pulled work was admitted by its pull: neither is held.
+   */
+  private reservedHold(task: Task): string | undefined {
+    const owner = task.reserved;
+    if (!owner || task.owner || this.plannerPullRecord(task)?.pull === true || this.excluded(task).includes(owner)) return undefined;
+    // Offers in flight take a slot before their owner is written; once it is written wip() counts it, so never twice.
+    const flying = [...this.readyInFlight].filter(([id, peer]) => peer === owner && id !== task.id && !this.d.board.get(id)?.owner).length;
+    const limit = this.wipLimit(owner), used = this.wip(owner, task.id) + (this.pendingClaims.get(owner) ?? 0) + flying;
+    return used >= limit ? `reserved owner ${owner} is at its planner WIP cap (${used}/${limit}); stays ready in To Do with its reservation until a slot frees` : undefined;
+  }
+
+  /** The task is ready but its reserved owner has no room: say so once on the task history, never assign. */
+  private holdReady(task: Task, why: string, reason: string): void {
+    if (this.isHeld(task)) return;
+    const ready = task.history.at(-1)?.event === "ready" ? task : this.d.board.update(task.id, HUB, "ready", {}, why);
+    this.d.board.update(ready.id, HUB, "ready held", {}, reason);
+    this.releaseNotice(`task ${this.publicTitle(ready)} is ready but held: ${reason}`);
+  }
+
   /** An approved task may be the last thing others waited for: those go through assignment now (issue #34). */
   private async releaseDependents(approved: Task): Promise<void> {
     try {
-      for (const t of this.d.board.list("proposed")) {
-        if (!t.deps?.includes(approved.id) || t.owner || this.waitsFor(t).length) continue;
-        await this.offerReady(t, `#${approved.id} approved`);
-      }
+      // Its dependents and, as its owner's slot just freed (#655), that owner's held ready tasks: one list in priority order.
+      const ready = this.d.board.list("proposed").filter(t => !t.owner && !this.waitsFor(t).length
+        && (t.deps?.includes(approved.id) || !!approved.owner && t.reserved === approved.owner && this.isHeld(t))).sort(this.readyOrder);
+      for (const t of ready) await this.offerReady(t, t.deps?.includes(approved.id) ? `#${approved.id} approved` : "owner slot freed");
     } catch (e) {
       this.releaseNotice(`task #${approved.id}: could not release dependents: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -2165,14 +2301,25 @@ export class Tasks {
     this.offered.delete(task.id);
     this.releaseNotice(`task #${task.id}: cancellation stall cleanup unavailable`, () => this.d.board.clearStall(task.id));
     for (const peer of new Set([task.owner, task.reviewer])) if (peer && peer !== USER) this.releaseNotice(`task #${task.id}: cancellation notice unavailable`, () => this.d.bus.publish(newEnvelope(HUB, sanitize(`Task #${task.id} cancelled. Stop working on it. No native turn or working tree was changed.`), { to: [peer], kind: "task", priority: "important", refs: { task: String(task.id), taskCancelled: cancelled.flowRevision }, ...(this.isPii(next) ? { private: true } : {}) })));
+    await this.releaseHeld(task.owner); // its owner's slot is free (#655)
     this.releaseNotice(`task #${task.id}: cancellation dependent advice unavailable`, () => {
       for (const dependent of this.d.board.list()) if (!isClosedTaskState(dependent.state) && !dependent.owner && dependent.deps?.includes(task.id)) this.releaseNotice(`task #${dependent.id}: cancellation stall advice unavailable`, () => this.reportStall(dependent, { kind: "cancelled-dependency", dependency: task.id, code: "cancelled" }));
     });
     return next;
   }
 
+  /** A slot freed for `peer` (cancel, untouched return): its held ready tasks are offered in priority order, and the cap stops the offers (#655). */
+  private async releaseHeld(peer: PeerId | null | undefined): Promise<void> {
+    if (!peer) return;
+    try {
+      for (const t of this.d.board.list("proposed").filter(t => !t.owner && t.reserved === peer && this.isHeld(t) && !this.waitsFor(t).length).sort(this.readyOrder)) await this.offerReady(t, "owner slot freed");
+    } catch (e) {
+      this.releaseNotice(`task ${peer}: could not offer held ready work: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+
   async releaseReady(): Promise<void> {
-    for (const t of this.d.board.list("proposed")) {
+    for (const t of [...this.d.board.list("proposed")].sort(this.readyOrder)) {
       if (t.owner) { this.d.board.clearStall(t.id); continue; }
       const cancelledDependency = t.deps?.find(id => this.d.board.get(id)?.state === "cancelled");
       if (cancelledDependency) { this.reportStall(t, { kind: "cancelled-dependency", dependency: cancelledDependency, code: "cancelled" }); continue; }
@@ -2184,7 +2331,7 @@ export class Tasks {
         continue;
       }
       this.d.board.clearStall(t.id);
-      if ((!t.deps?.length && !t.history.some(h => h.event === "backlog pulled")) || (!planned && last !== "blocked" && last !== "ready" && last !== "reserved")) continue;
+      if ((!t.deps?.length && !t.history.some(h => h.event === "backlog pulled")) || (!planned && last !== "blocked" && last !== "ready" && last !== "reserved" && !this.isHeld(t))) continue;
       // ponytail: a reserved owner (#207) that attaches after another peer that can take the task is passed over here like
       // an offline one; hold reserved tasks for a grace period if restarts show that up.
       await this.offerReady(t, "nothing left to wait for");
@@ -2193,13 +2340,18 @@ export class Tasks {
 
   /** Callers hold a list read before an await: re-read, or a task the other caller offered meanwhile is offered twice. */
   private async offerReady(stale: Task, why: string): Promise<void> {
-    let offering = false, undelivered: AssignmentUndeliveredError | undefined;
+    let offering = false, undelivered: AssignmentUndeliveredError | undefined, slot: PeerId | undefined;
     try {
       const t = this.d.board.get(stale.id);
       if (!t || t.state !== "proposed" || t.owner || this.personUnassigned(t) || this.offered.has(t.id)) return;
       const planned = this.plannerPullRecord(t)?.pull === true;
       const selected = planned ? this.plannerAssignment(t, true).owner : undefined;
       if (planned && !selected) return;
+      const held = planned ? undefined : this.reservedHold(t); // #655: the cap holds before the ready move is offered
+      if (held) { this.holdReady(t, why, held); return; }
+      // The check and the slot are one synchronous step: assignOwner can yield before it writes the owner, and a second offer
+      // for the same reserved owner must see this one as taking the last slot.
+      if (!planned && t.reserved) { slot = t.reserved; this.readyInFlight.set(t.id, slot); }
       this.offered.add(t.id);
       offering = true;
       const ready = t.history.at(-1)?.event === "ready" ? t : this.d.board.update(t.id, HUB, "ready", {}, why);
@@ -2211,6 +2363,7 @@ export class Tasks {
       if (e instanceof AssignmentUndeliveredError) undelivered = e;
       else this.releaseNotice(`task ${this.publicTitle(stale)}: could not be assigned: ${e instanceof Error ? e.message : String(e)}`);
     } finally {
+      if (slot) this.readyInFlight.delete(stale.id);
       if (offering && !undelivered) {
         try {
           if (!this.d.board.get(stale.id)?.owner) this.offered.delete(stale.id);
@@ -2226,6 +2379,48 @@ export class Tasks {
     if (by !== USER && task[role] !== by) throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id}: only its ${role} (${task[role] ?? "none"}) or the console user can do that`);
   }
 
+  /** #694: write the one issue the task itself names (the plan-review source) into its lifecycle receipt, once; never relinks. */
+  private linkIssue(task: Task): Task {
+    if (this.isPii(task) || task.sdlc?.issue) return task;
+    let identity: { repo: string; issue: number } | undefined;
+    try { identity = this.planIssueIdentity(task); } catch { return task; }
+    const next = identity && linkedReceipt(task.sdlc, identity, this.d.sdlc?.config() ?? sdlcConfig(undefined));
+    return next ? this.d.board.update(task.id, HUB, "lifecycle linked", { sdlc: next }, `issue #${identity!.issue}`) : task;
+  }
+
+  /**
+   * #694: the PR the hub can verify for a done, without writing it: the one open PR whose head is the done's full commit
+   * (or, with no commit, its branch). The read's basis travels with it, so a task whose commit or branch changed while the
+   * read was awaited never receives a PR found for another head. The done persists it only after its gates admit it, so a
+   * refused done stays effect-free (#254).
+   */
+  private async identityLink(task: Task, refs?: TaskRefs): Promise<IdentityLink | undefined> {
+    if (this.isPii(task) || task.sdlc?.pr) return undefined;
+    const repository = task.sdlc?.repo ?? task.refs.repo ?? this.d.repository;
+    const commit = refs?.commit ?? task.refs.commit, branch = refs?.branch ?? task.refs.branch;
+    if (!repository || !commit && !branch) return undefined;
+    const pr = await openPrFor(repository, commit ? { commit } : { branch }, this.d.sdlc?.gh ?? sdlcGh);
+    return pr ? { repo: repository, pr, basis: { commit, branch } } : undefined;
+  }
+
+  /**
+   * The task as the done's gates see it: the issue the current task names (re-resolved now, so a changed title or refs
+   * counts) and the staged PR only while the done's effective commit and branch are still the ones it was read for.
+   */
+  private withLink(task: Task, link: IdentityLink | undefined, refs?: TaskRefs): Task {
+    if ((this.d.sdlc?.config().mode ?? "off") === "off" || this.isPii(task)) return task;
+    const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
+    let issue: { repo: string; issue: number } | undefined;
+    if (!task.sdlc?.issue) { try { issue = this.planIssueIdentity(task); } catch { issue = undefined; } }
+    const commit = refs?.commit ?? task.refs.commit, branch = refs?.branch ?? task.refs.branch;
+    const repository = task.sdlc?.repo ?? task.refs.repo ?? this.d.repository;
+    const pr = link && !task.sdlc?.pr && repository?.toLowerCase() === link.repo.toLowerCase() && link.basis.commit === commit && (commit !== undefined || link.basis.branch === branch) ? link : undefined;
+    let next = task.sdlc;
+    if (issue) next = linkedReceipt(next, issue, config) ?? next;
+    if (pr) next = linkedReceipt(next, { repo: pr.repo, pr: pr.pr }, config) ?? next;
+    return next === task.sdlc ? task : { ...task, sdlc: next };
+  }
+
   private planIssueIdentity(task: Task): { repo: string; issue: number } | undefined {
     const source = task.external ?? task.sdlc;
     if (source?.repo && source.issue) return { repo: source.repo, issue: source.issue };
@@ -2278,6 +2473,16 @@ export class Tasks {
     const digest = plannerGrooming(visible, { repository: this.d.repository ?? `path:${realPath(this.d.cwd)}`,
       limits: Object.fromEntries(peers.map(peer => [peer, this.wipLimit(peer)])), wip: Object.fromEntries(peers.map(peer => [peer, this.wip(peer)])),
       states, issues, reviewedIssues, acceptedIssues, blockers });
+    // #694: backfill lifecycle issue links after every authority check, with their own bound (not the metadata-read
+    // budget): each call links up to 32 open tasks that still lack one, so later tasks are reached on later calls.
+    if ((this.d.sdlc?.config().mode ?? "off") !== "off") {
+      let linked = 0;
+      for (const task of this.d.board.list()) {
+        if (linked >= 32) break;
+        if (isClosedTaskState(task.state) || task.sdlc?.issue || this.isPii(task)) continue;
+        if (this.linkIssue(task) !== task) linked++;
+      }
+    }
     return { ...digest, truncated: digest.truncated || incomplete, ...(current.some(task => this.isPii(task)) ? { privateTasks: "withheld" } : {}) };
   }
 
@@ -2374,8 +2579,9 @@ export class Tasks {
     const current = this.need(task.id, false, true, true);
     if (current.history.length !== flow || (current.planningRevision ?? 0) !== revision) throw new PreEffectToolRefusal("plan review changed during readback");
     const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
-    const updated = this.d.board.update(current.id, by, "plan reviewed", { ...(Object.keys(scope).length ? { plan: { ...current.plan, ...scope } } : {}), sdlc: { ...current.sdlc, stage: current.sdlc?.stage ?? lifecycleStage(config, "plan"),
+    let updated = this.d.board.update(current.id, by, "plan reviewed", { ...(Object.keys(scope).length ? { plan: { ...current.plan, ...scope } } : {}), sdlc: { ...current.sdlc, stage: current.sdlc?.stage ?? lifecycleStage(config, "plan"),
       planReview: { planner: by, planningRevision: revision, recordedAt: Date.now(), ...(Object.keys(scope).length ? { scope } : {}), ...(issue ? { issue } : {}) } } }, raw.reason.trim(), { ...(withheld ? { withheld: true } : {}) }, flow);
+    if (config.mode !== "off") updated = this.linkIssue(updated); // #694
     if (updated.state === "proposed" && !updated.owner) {
       this.offered.delete(updated.id);
       try { await this.offerReady(updated, "planner review recorded"); }
@@ -2390,7 +2596,11 @@ export class Tasks {
     if (by !== USER && by !== task.owner && by !== task.reviewer) throw new PreEffectToolRefusal("only the task owner, reviewer or console user may record lifecycle evidence");
     const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
     const next = sdlcReceipt(input, task.sdlc, config, VERSION);
+    // The spec identity is person-owned in enforce. No observation cache or restart can reopen a relink bypass.
+    const specRelink = (task.sdlc?.repo !== undefined && next.repo !== task.sdlc.repo) || (task.sdlc?.issue !== undefined && next.issue !== task.sdlc.issue);
+    if (config.mode === "enforce" && by !== USER && specRelink) throw new PreEffectToolRefusal("only the person may relink an established repository or issue in enforce");
     const definition = stageDefinition(config, next.stage);
+    if (next.redFirst && input && typeof input === "object" && "redFirst" in input && !this.isPii(task) && !this.publicMetadataText(JSON.stringify(next.redFirst))) throw new PreEffectToolRefusal("red-first metadata matches a PII pattern; use private work");
     // #481 S1: entering a build stage in enforce needs the person's spec acceptance; the person may move any stage.
     if (config.mode === "enforce" && by !== USER && next.stage !== task.sdlc?.stage && definition && canonicalStage(definition.base) === "build" && specState(next, undefined) === "missing") throw new PreEffectToolRefusal(this.specText(task, "missing", "blocked"));
     if (config.mode === "enforce" && config.definitions && input && typeof input === "object" && "stage" in input && next.stage !== task.sdlc?.stage && by !== USER) {
@@ -2409,13 +2619,16 @@ export class Tasks {
     const suppliedHead = !!input && typeof input === "object" && (input as { reviewedHead?: unknown }).reviewedHead !== undefined;
     const artifactChanged = next.repo !== task.sdlc?.repo || next.pr !== task.sdlc?.pr;
     if (next.reviewedHead !== undefined && (next.reviewedHead !== task.sdlc?.reviewedHead || (suppliedHead && artifactChanged))) this.mine(task, by, "reviewer", true);
-    return this.d.board.update(task.id, by, "lifecycle", { sdlc: next });
+    const departure = task.history.findLast(h => h.by === USER && h.planDeparture)?.planDeparture;
+    const invalidatesDeparture = !!departure && (artifactChanged || next.localHead !== task.sdlc?.localHead && next.localHead !== undefined && next.localHead !== departure.head || next.reviewedHead !== task.sdlc?.reviewedHead && next.reviewedHead !== undefined && next.reviewedHead !== departure.head);
+    return this.d.board.update(task.id, by, "lifecycle", { sdlc: next }, undefined, { ...this.planObservation({ ...task, sdlc: next }), ...(invalidatesDeparture ? { planDepartureInvalidated: true } : {}) });
   }
 
   async deliveryQueue(repo: string) {
+    const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
     const before = workflowHash(this.d.board.list().map(t => ({ id: t.id, state: t.state, after: t.deps, sdlc: t.sdlc, history: t.history.length })));
-    const links = this.d.board.list().map(t => ({ id: t.id, after: t.deps ?? [], private: this.isPii(t), receipt: t.sdlc, phase: this.isPii(t) ? undefined : this.workflowView(t) }));
-    const report = await readMergeQueue(repo, this.d.sdlc?.config() ?? sdlcConfig(undefined), links, this.d.sdlc?.gh);
+    const links = this.d.board.list().map(t => ({ id: t.id, after: t.deps ?? [], private: this.isPii(t), receipt: t.sdlc, phase: this.isPii(t) ? undefined : this.workflowView(t), findings: this.isPii(t) ? undefined : this.reviewFindingSets(t), plan: config.mode === "off" || this.isPii(t) ? undefined : { paths: this.planPaths(t), revision: t.history.findLast(h => h.planRevision)?.planRevision?.revision ?? 0, fingerprint: planFingerprint(t.plan ?? {}), accepted: this.validPlanDepartures(t) } }));
+    const report = await readMergeQueue(repo, config, links, this.d.sdlc?.gh, this.publicMetadataText);
     // Policy can change across remote awaits without any board write. Never return its stale public projection.
     const currentPrivacy = this.d.board.list().map(task => ({ id: task.id, private: this.isPii(task) }));
     if (workflowHash(links.map(({ id, private: hidden }) => ({ id, private: hidden }))) !== workflowHash(currentPrivacy)) {
@@ -2424,6 +2637,20 @@ export class Tasks {
 
     const after = workflowHash(this.d.board.list().map(t => ({ id: t.id, state: t.state, after: t.deps, sdlc: t.sdlc, history: t.history.length })));
     if (before !== after) { report.complete = false; report.order = []; if (report.rows.length) report.unordered = report.rows.map(row => row.pr); for (const row of report.rows) { row.ready = false; row.blockers.push("board changed during delivery readback"); } }
+    else if (config.mode !== "off") for (const row of report.rows) if (row.head && !row.private) for (const id of row.tasks) {
+      const task = this.d.board.get(id);
+      if (task?.sdlc?.repo?.toLowerCase() === report.repo.toLowerCase() && task.sdlc.pr === row.pr) {
+        if (this.validPlanDepartures(task).length && row.planConformance?.some(item => item.task === id && item.state !== "unknown" && !item.accepted)) this.invalidatedPlanDepartures.add(id);
+        this.capturePlanHead(task, row.head);
+      }
+    }
+    for (const row of report.rows) if (row.testIntegrity) {
+      row.testIntegrity = row.testIntegrity.map(item => ({ ...publicTestIntegrity(item, this.publicMetadataText), ...(item.task === undefined ? {} : { task: item.task }) }));
+      if (config.mode === "enforce") {
+        row.blockers = [...new Set([...row.blockers, ...row.testIntegrity.flatMap(testIntegrityBlockers)])];
+        row.ready = row.ready && row.blockers.length === 0;
+      }
+    }
     return report;
   }
   async releaseReadiness(repo: string, liveIssues: number[]) {
@@ -2457,12 +2684,114 @@ export class Tasks {
     const state = { id: task.id, state: task.state, stage, ...(this.isPii(task) ? { private: true } : { criteria: this.workflowView(task) ?? null }) };
     return { schema: 2, state, stateHash: workflowHash(state), sourceHash: workflowHash(config) };
   }
+  private readonly planReads = new Map<number, { identity: string; evidence: PrEvidence }>();
+  // ponytail: consent expires on restart because a refused readback cannot first mutate the task's history.
+  // A durable host observation journal can retain safe consent across lifetimes without reviving pending invalidations.
+  private readonly departureGeneration = crypto.randomUUID();
+  private readonly invalidatedPlanDepartures = new Set<number>();
+  private readonly observedPlans = new Map<number, NonNullable<HistoryEntry["planObservation"]>>();
+  private planIdentity(task: Task): string {
+    return JSON.stringify([task.refs, task.sdlc, task.plan, task.owner, task.reviewer, task.state, this.isPii(task), this.d.sdlc?.config()]);
+  }
+  private planReadIdentity(task: Task): string { return JSON.stringify([task.sdlc?.repo, task.sdlc?.pr, task.refs.repo, planFingerprint(task.plan ?? {})]); }
+  private planPaths(task: Task): string[] | undefined {
+    if (!task.sdlc?.repo) return;
+    // Resolve the artifact slug first: it may warm the canonical project's previously unnamed identity.
+    const artifact = this.repositories.scope({ repo: task.sdlc.repo, paths: task.refs.paths });
+    const scope = this.repositories.scope(task.refs);
+    if (scope.key !== artifact.key) return;
+    return task.plan?.paths?.map(path => scope === this.repositories.project ? this.projectPath(path) : this.repositories.relativePath(scope, path));
+  }
+  private planScopeIdentity(task: Task): string {
+    const paths = this.planPaths(task); // Warm verified aliases before capturing the scope identity.
+    const scope = this.repositories.scope(task.refs);
+    return planFingerprint({ key: scope.key, root: scope.root ?? null, aliases: [...scope.aliases].sort(),
+      repo: task.refs.repo ?? null, absoluteRefs: (task.refs.paths ?? []).filter(isAbsolute).sort(), paths: paths ?? null });
+  }
+  private validPlanDepartures(task: Task): NonNullable<HistoryEntry["planDeparture"]>[] {
+    const invalidated = task.history.findLastIndex(h => h.planDepartureInvalidated && !h.planDeparture);
+    if (this.invalidatedPlanDepartures.has(task.id)) return [];
+    const latest = task.history.findLastIndex(h => h.by === USER && h.event === "plan departure accepted" && h.planDeparture);
+    return latest > invalidated && task.history[latest]!.planDeparture!.generation === this.departureGeneration
+      && task.history[latest]!.planDeparture!.scope === this.planScopeIdentity(task) ? [task.history[latest]!.planDeparture!] : [];
+  }
+  private planReport(task: Task, evidence?: PrEvidence) {
+    const rawReport = planConformance(this.isPii(task) ? undefined : this.planPaths(task), this.isPii(task) ? undefined : evidence);
+    const safe = [...rawReport.outside, ...rawReport.untouched].every(path => this.publicMetadataText(path));
+    const report: PlanConformance = safe ? rawReport : { state: "unknown", head: rawReport.head, outside: [], untouched: [] };
+    const fingerprint = planFingerprint(task.plan ?? {});
+    const observation = task.history.find(h => h.planObservation?.repo === task.sdlc?.repo && h.planObservation?.pr === task.sdlc?.pr)?.planObservation ?? this.observedPlans.get(task.id);
+    const revision = task.history.findLast(h => h.planRevision)?.planRevision?.revision;
+    const acceptance = evidence && this.validPlanDepartures(task).findLast(item => item.repo === task.sdlc?.repo && item.pr === task.sdlc?.pr && item.head === evidence.head
+      && item.revision === (revision ?? 0) && item.fingerprint === fingerprint && JSON.stringify([...item.paths].sort()) === JSON.stringify([...evidence.paths].sort()));
+    return { ...report, accepted: !!acceptance, earlierPushes: "unknown" as const,
+      ...(observation && observation.repo === task.sdlc?.repo && observation.pr === task.sdlc?.pr ? { revisionsAfterFirstObservedPush: Math.max(0, (revision ?? 0) - observation.revision) } : {}) };
+  }
+  private capturePlanRead(task: Task, evidence: PrEvidence | undefined): void {
+    if ((this.d.sdlc?.config().mode ?? "off") === "off" || !evidence || this.isPii(task) || !task.sdlc?.repo || !task.sdlc.pr) return;
+    if (this.planReads.size >= 256 && !this.planReads.has(task.id)) this.planReads.delete(this.planReads.keys().next().value!);
+    this.planReads.set(task.id, { identity: this.planReadIdentity(task), evidence });
+    const accepted = task.history.findLast(h => h.by === USER && h.planDeparture)?.planDeparture;
+    if (accepted && evidence.pathsComplete === true && JSON.stringify([...accepted.paths].sort()) !== JSON.stringify([...evidence.paths].sort())) this.invalidatedPlanDepartures.add(task.id);
+    this.capturePlanHead(task, evidence.head);
+  }
+  private capturePlanHead(task: Task, head: string): void {
+    if ((this.d.sdlc?.config().mode ?? "off") === "off" || this.isPii(task) || !task.sdlc?.repo || !task.sdlc.pr) return;
+    if (this.planReads.get(task.id)?.evidence.head !== head) this.planReads.delete(task.id);
+    const accepted = task.history.findLast(h => h.by === USER && h.planDeparture)?.planDeparture;
+    if (accepted && (accepted.head !== head || accepted.repo !== task.sdlc.repo || accepted.pr !== task.sdlc.pr)) this.invalidatedPlanDepartures.add(task.id);
+    if (!task.history.some(h => h.planObservation?.repo === task.sdlc?.repo && h.planObservation?.pr === task.sdlc?.pr)
+      && (!this.observedPlans.has(task.id) || this.observedPlans.get(task.id)?.repo !== task.sdlc.repo || this.observedPlans.get(task.id)?.pr !== task.sdlc.pr)) {
+      // ponytail: this is first observed push, not a true push event. Earlier pushes stay unknown; upgrade to a webhook/Actions push receipt.
+      if (this.observedPlans.size >= 256) this.observedPlans.delete(this.observedPlans.keys().next().value!);
+      this.observedPlans.set(task.id, { repo: task.sdlc.repo, pr: task.sdlc.pr, head,
+        revision: task.history.findLast(h => h.planRevision)?.planRevision?.revision ?? 0, fingerprint: planFingerprint(task.plan ?? {}) });
+    }
+  }
+  private planObservation(task: Task): Pick<HistoryEntry, "planObservation" | "planDepartureInvalidated"> {
+    if ((this.d.sdlc?.config().mode ?? "off") === "off") return {};
+    const observation = this.observedPlans.get(task.id);
+    const lastAcceptance = task.history.findLastIndex(h => h.by === USER && h.planDeparture);
+    return {
+      ...(observation && observation.repo === task.sdlc?.repo && observation.pr === task.sdlc?.pr
+        && !task.history.some(h => h.planObservation?.repo === observation.repo && h.planObservation.pr === observation.pr) ? { planObservation: observation } : {}),
+      ...(this.invalidatedPlanDepartures.has(task.id) && !task.history.slice(lastAcceptance + 1).some(h => h.planDepartureInvalidated) ? { planDepartureInvalidated: true as const } : {}),
+    };
+  }
+  async acceptPlanDeparture(by: PeerId, id: unknown, head: unknown, reason: unknown): Promise<Task> {
+    if (by !== USER) throw new PreEffectToolRefusal("only the person may accept a plan departure");
+    if (typeof head !== "string" || !/^[a-f0-9]{40}$/.test(head) || typeof reason !== "string" || !reason.trim() || reason.length > 2048) throw new PreEffectToolRefusal("departure acceptance requires a full head and a bounded reason");
+    const initial = this.need(id, false, true), identity = this.planIdentity(initial), scope = this.planScopeIdentity(initial), history = initial.history.length;
+    const valid = () => { const now = this.need(id, false, true); if (isClosedTaskState(now.state) || identity !== this.planIdentity(now) || scope !== this.planScopeIdentity(now) || history !== now.history.length) throw new PreEffectToolRefusal("task changed during departure readback"); return now; };
+    if (this.isPii(initial)) throw new PreEffectToolRefusal("private PR file evidence is unavailable; amend the private plan instead");
+    const read: SdlcGh = (args, timeout, cwd, cap) => { valid(); return (this.d.sdlc?.gh ?? sdlcGh)(args, timeout, cwd, cap); };
+    const evidence = initial.sdlc && await readSdlcPr(initial.sdlc, read); valid();
+    if (!evidence || completePlanInventory(evidence) === undefined) throw new PreEffectToolRefusal("complete PR file inventory unknown");
+    if (evidence.head !== head) throw new PreEffectToolRefusal("departure acceptance head is not the current PR head");
+    if (this.planReport(initial, evidence).state !== "departure") throw new PreEffectToolRefusal("current plan conformance is not a known departure; amend unknown scope or coverage first");
+    const note = sanitize(reason.replace(/\s+/g, " ").trim());
+    const withheld = await this.withholds("note", note, initial); const current = valid();
+    this.capturePlanRead(current, evidence);
+    const next = this.d.board.update(current.id, USER, "plan departure accepted", {}, note, { withheld: withheld || undefined, ...this.planObservation(current),
+      planDeparture: { generation: this.departureGeneration, scope, repo: current.sdlc!.repo!, pr: current.sdlc!.pr!, head, revision: current.history.findLast(h => h.planRevision)?.planRevision?.revision ?? 0, fingerprint: planFingerprint(current.plan ?? {}), paths: [...evidence.paths] } });
+    this.invalidatedPlanDepartures.delete(current.id);
+    return next;
+  }
   async lifecycleStatus(id: unknown, refresh = true): Promise<SdlcStatus> {
-    const task = this.need(id), config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
-    const evidence = task.sdlc && !this.isPii(task) && refresh && config.mode !== "off" ? await readSdlcPr(task.sdlc, this.d.sdlc?.gh) : undefined;
+    const task = this.need(id), config = this.d.sdlc?.config() ?? sdlcConfig(undefined), identity = this.planIdentity(task);
+    const valid = () => { const now = this.need(id, false, true); if (this.planIdentity(now) !== identity || now.history.length !== task.history.length) throw new PreEffectToolRefusal("task changed during lifecycle readback"); return now; };
+    const deadline = performance.now() + 20_000;
+    const read: SdlcGh = (args, timeout, cwd, cap) => { valid(); const remaining = deadline - performance.now(); return remaining > 0 ? (this.d.sdlc?.gh ?? sdlcGh)(args, Math.min(timeout ?? 10_000, remaining), cwd, cap) : Promise.resolve({ code: 1, stdout: "" }); };
+    const evidence = task.sdlc && !this.isPii(task) && refresh && config.mode !== "off" ? await readSdlcPr(task.sdlc, read, true) : undefined;
+    valid();
     const accepted = task.sdlc?.acceptance;
-    const edit = accepted && !this.isPii(task) && refresh && config.mode !== "off" ? await readSpecEdit(accepted.repo, accepted.issue, this.d.sdlc?.gh) : undefined;
-    return sdlcStatus(config, task.sdlc, evidence, this.workflowView(task), edit);
+    const edit = accepted && !this.isPii(task) && refresh && config.mode !== "off" ? await readSpecEdit(accepted.repo, accepted.issue, read) : undefined;
+    const integrity = config.mode !== "off" ? publicTestIntegrity(task.sdlc && evidence && !this.isPii(task) ? await readTestIntegrity(task.sdlc, evidence, read) : this.unknownTestIntegrity(this.isPii(task)), this.publicMetadataText) : undefined;
+    const current = valid();
+    if (this.planIdentity(current) !== this.planIdentity(task) || current.history.length !== task.history.length) throw new PreEffectToolRefusal("task changed during lifecycle readback");
+    this.capturePlanRead(current, evidence);
+    return sdlcStatus(config, current.sdlc, evidence, this.workflowView(current), edit, this.isPii(current) ? [] : this.reviewFindingSets(current), current.refs.commit,
+      config.mode !== "off" ? this.planReport(this.d.board.get(current.id)!, evidence) : undefined, integrity);
   }
 
   /** #481 S1: only build work starts from an accepted spec. */
@@ -2528,24 +2857,34 @@ export class Tasks {
     this.d.notify(this.specText(task, state, "advice"));
   }
 
-  private async lifecycleGate(task: Task, transition: "review" | "approval", reviewedHead?: string): Promise<PrEvidence | undefined> {
+  private unknownTestIntegrity(privateTask = false): TestIntegrity {
+    return { applicability: "unknown", redFirst: "unknown", fileState: "unknown", modifiedTests: [], blockers: [privateTask ? "test integrity: private evidence unavailable" : "test integrity: current evidence unknown"] };
+  }
+
+  private async lifecycleGate(task: Task, transition: "review" | "approval", reviewedHead?: string, findings?: readonly ReviewFindingSet[]): Promise<PrEvidence | undefined> {
     const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
     if (config.mode === "off") return;
     const receipt = task.sdlc && { ...task.sdlc, ...(reviewedHead ? { reviewedHead } : {}) };
+    const deadline = performance.now() + 20_000;
     const read: SdlcGh = (args, timeout, cwd, cap) => {
       const current = this.need(task.id, false, true);
       if (current.history.length !== task.history.length || current.owner !== task.owner || current.reviewer !== task.reviewer || this.isPii(current) !== this.isPii(task)) return Promise.resolve({ code: 1, stdout: "" });
-      return (this.d.sdlc?.gh ?? sdlcGh)(args, timeout, cwd, cap);
+      const remaining = deadline - performance.now();
+      return remaining > 0 ? (this.d.sdlc?.gh ?? sdlcGh)(args, Math.min(timeout ?? 10_000, remaining), cwd, cap) : Promise.resolve({ code: 1, stdout: "" });
     };
-    const evidence = receipt && !this.isPii(task) ? await readSdlcPr(receipt, read) : undefined;
+    const evidence = receipt && !this.isPii(task) ? await readSdlcPr(receipt, read, true) : undefined;
+    const integrity = publicTestIntegrity(receipt && evidence && !this.isPii(task) ? await readTestIntegrity(receipt, evidence, read) : this.unknownTestIntegrity(this.isPii(task)), this.publicMetadataText);
     const current = this.need(task.id, false, true);
     if (config.mode === "enforce" && (current.history.length !== task.history.length || current.owner !== task.owner || current.reviewer !== task.reviewer || current.state !== task.state)) throw new PreEffectToolRefusal(`task #${task.id}: changed during lifecycle readback; retry on current work`);
     // Advise may continue on the current task, but evidence from its previous link cannot admit that task's review.
     if (current.history.length !== task.history.length || current.owner !== task.owner || current.reviewer !== task.reviewer || current.state !== task.state || this.isPii(current) !== this.isPii(task)) return;
-    const status = sdlcStatus(config, receipt, evidence, this.workflowView(current));
-    const blockers = transition === "review" ? [...new Set([...status.blockers.filter(blocker => ["lifecycle stage definition unknown", "issue identity missing", "PR identity missing", "current PR evidence unknown", "PR is not open", "local gate on current head missing or failed"].includes(blocker)), ...(status.entry ?? []), ...(status.exit ?? [])])] : status.blockers;
+    this.capturePlanRead(current, evidence);
+    const planReport = this.planReport(current, evidence);
+    const status = sdlcStatus(config, receipt, evidence, this.workflowView(current), undefined, this.isPii(current) ? [] : findings ?? this.reviewFindingSets(current), current.refs.commit, planReport, integrity);
+    const blockers = transition === "review" ? [...new Set([...status.blockers.filter(blocker => ["lifecycle stage definition unknown", "issue identity missing", "PR identity missing", "current PR evidence unknown", "PR is not open", "local gate on current head missing or failed"].includes(blocker) || blocker.startsWith("test integrity:")), ...(status.entry ?? []), ...(status.exit ?? [])])] : status.blockers;
     if (config.mode === "enforce" && blockers.length) throw new PreEffectToolRefusal(`task #${task.id}: SDLC ${transition} blocked: ${blockers.join("; ")}`);
-    if (config.mode === "advise" && blockers.length) this.d.notify(`task ${this.publicTitle(task)}: SDLC ${transition} advice: ${this.isPii(task) ? "private lifecycle evidence unknown" : blockers.join("; ")}`);
+    const advice = [...new Set([...blockers, ...planConformanceBlockers(planReport), ...testIntegrityBlockers(integrity)])];
+    if (config.mode === "advise" && advice.length) this.d.notify(`task ${this.publicTitle(task)}: SDLC ${transition} advice: ${this.isPii(task) ? "private lifecycle evidence unknown" : advice.join("; ")}`);
     return evidence;
   }
 
@@ -2746,19 +3085,25 @@ export class Tasks {
   /** Whether a completion check is still running for this task. */
   isChecking = (id: number) => this.checking.has(id);
 
+  private completionCurrent(id: unknown, by: PeerId, preEffect: boolean): Task {
+    const task = this.need(id, false, preEffect);
+    this.mine(task, by, "owner", preEffect);
+    if (preEffect) {
+      if (task.state === "in_review" || isClosedTaskState(task.state)) throw new PreEffectToolRefusal(`task #${task.id} is already ${task.state}`);
+    } else {
+      if (task.state === "in_review" || isClosedTaskState(task.state)) throw new Error(`task #${task.id} is already ${task.state}`);
+    }
+    this.ready(task, preEffect);
+    if (task.state === "proposed" || task.state === "changes_requested") this.acceptanceCapacity(task);
+    if (this.checking.has(task.id)) {
+      // The result goes only to the owner the check was started for: anyone who took the task since hears nothing.
+      throw new (preEffect ? PreEffectToolRefusal : Error)(this.checking.get(task.id) === task.owner ? `task #${task.id}: its check is still running; its result comes as a task message` : `task #${task.id}: a check from before it changed hands is still running; call hub_task_done again in a few minutes`);
+    }
+    return task;
+  }
+
   async done(by: PeerId, id: unknown, summary?: string, refs?: TaskRefs): Promise<Task> {
-    const valid = (): Task => {
-      const t = this.need(id, false, true);
-      this.mine(t, by, "owner", true);
-      if (t.state === "in_review" || isClosedTaskState(t.state)) throw new PreEffectToolRefusal(`task #${t.id} is already ${t.state}`);
-      this.ready(t, true);
-      if (t.state === "proposed" || t.state === "changes_requested") this.acceptanceCapacity(t);
-      if (this.checking.has(t.id)) {
-        // The result goes only to the owner the check was started for: anyone who took the task since hears nothing.
-        throw new PreEffectToolRefusal(this.checking.get(t.id) === t.owner ? `task #${t.id}: its check is still running; its result comes as a task message` : `task #${t.id}: a check from before it changed hands is still running; call hub_task_done again in a few minutes`);
-      }
-      return t;
-    };
+    const valid = () => this.completionCurrent(id, by, true);
     // The PII screen reads the summary of a done that passes these checks (issue #198); they run again after it.
     const withheld = await this.withholds("summary", summary, valid());
     let task = valid();
@@ -2769,10 +3114,14 @@ export class Tasks {
       await this.planEntryGate(by, admission);
       task = valid();
     }
+    // #694: stage the identities the hub can verify; the gates read them, and only the admitted done persists them.
+    const link = this.d.sdlc && this.d.sdlc.config().mode !== "off" ? await this.identityLink(task, refs) : undefined;
+    const current = () => this.withLink(valid(), link, refs);
+    task = current();
     let reviewEvidence: PrEvidence | undefined;
-    if (this.d.sdlc && this.d.sdlc.config().mode !== "off") { reviewEvidence = await this.lifecycleGate(task, "review"); task = valid(); }
-    const reviewAdmission = task.reviewer ? await this.reviewRequestAdmission(task, refs, true, by, reviewEvidence) : undefined;
-    task = valid();
+    if (this.d.sdlc && this.d.sdlc.config().mode !== "off") { reviewEvidence = await this.lifecycleGate(task, "review"); task = current(); }
+    const reviewAdmission = task.reviewer || this.d.prepareReviewBrief ? await this.reviewRequestAdmission(task, refs, true, by, reviewEvidence, undefined, staged => this.withLink(staged, link, refs), !task.reviewer) : undefined;
+    task = current();
     // A member of a silent cohort (issue #107): its done is an intent, and the last of them integrates first.
     const cohort = this.cohorts.of(task.id);
     const silentMember = !!cohort?.silent && this.turnFree() && !!task.owner && !this.isPii(task);
@@ -2792,8 +3141,8 @@ export class Tasks {
       if (r.action === "request") return this.d.board.update(task.id, HUB, "integration requested", {}, this.integrationRequest(task, r));
       if (r.action === "unresolved") {
         this.d.notify(`task ${this.publicTitle(task)}: turn-free integration unresolved after ${MAX_REQUESTS} requests (${r.why}); its done is recorded, check the overlapping work by hand`);
-        task = this.d.board.update(task.id, HUB, "integration unresolved", {}, r.why);
-      } else if (r.integrated) task = this.d.board.update(task.id, HUB, "integrated", {}, `cohort #${cohort!.id}, revision ${cohort!.revision}`);
+        task = this.withLink(this.d.board.update(task.id, HUB, "integration unresolved", {}, r.why), link, refs);
+      } else if (r.integrated) task = this.withLink(this.d.board.update(task.id, HUB, "integrated", {}, `cohort #${cohort!.id}, revision ${cohort!.revision}`), link, refs);
     } else if (cohort?.held.size && !this.isPii(task)) {
       // No integration step for this member (silence lifted, a PII task open): the notices the silence held stand in
       // for it (issue #107, AC4).
@@ -2801,20 +3150,26 @@ export class Tasks {
       if (evidence && by === USER) this.d.notify(`task ${this.publicTitle(task)} done by the console; overlapping work finished meanwhile:\n${evidence}`);
       else if (evidence) this.doneNotes.set(task.id, `Overlapping work finished while you worked (no turn-free integration step ran):\n${evidence}`);
     }
-    if (task.state === "proposed" || task.state === "changes_requested") task = this.d.board.update(task.id, by, "accepted", { state: "in_progress" }, WITH_DONE); // done without a separate accept
+    if (task.state === "proposed" || task.state === "changes_requested") task = this.withLink(this.d.board.update(task.id, by, "accepted", { state: "in_progress" }, WITH_DONE), link, refs); // done without a separate accept
     const command = this.d.runCheck ? this.d.check?.(task.class, task) : undefined;
-    if (!command) return this.complete(task, by, summary, refs, "", withheld, "review", reviewAdmission);
+    if (!command) return this.complete(task, by, summary, refs, "", withheld, "review", reviewAdmission, link);
     // The tool call returns now; a check can outlast an agent's tool timeout. The result decides what comes next.
     this.checking.set(task.id, task.owner);
     const checkedRefs = cleanRefs(refs);
     this.warmRepository({ ...task, refs: { ...task.refs, ...checkedRefs } });
-    const pending = this.d.board.update(task.id, by, "done (checking)", { refs: checkedRefs }, summary, { withheld: withheld || undefined });
+    const pending = this.d.board.update(task.id, by, "done (checking)", { codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...checkedRefs } }), refs: checkedRefs, ...(task.sdlc ? { sdlc: task.sdlc } : {}) }, summary, { withheld: withheld || undefined }, task.history.length, HOST_CODE_SYMBOLS);
     this.releaseNotice(`task ${this.publicTitle(pending)} done by ${by}; its check is queued or running: ${command}`);
     const seen = { events: pending.history.length, owner: pending.owner };
     this.pendingChecks++;
     this.checkQueue = this.checkQueue
       .then(() => this.finishChecked(pending.id, by, summary, command, seen, withheld))
-      .catch((e: Error) => this.d.notify(`task #${pending.id}: its check result could not be recorded: ${e.message}`))
+      .catch((e: Error) => {
+        this.releaseNotice(`task #${pending.id}: its check result could not be recorded: ${e.message}`);
+        this.releaseNotice(`task #${pending.id}: its owner retry notice could not be published`, () => {
+          const current = this.d.board.get(pending.id);
+          if (current?.state === "in_progress" && current.owner === seen.owner) this.tell(current, `Task #${current.id}: its check completion was refused. Call hub_task_done again when it is ready.`, this.isPii(current));
+        });
+      })
       .finally(() => this.pendingChecks--);
     return pending;
   }
@@ -2850,7 +3205,7 @@ export class Tasks {
         const theirs = this.places(u);
         if (mine.repositoryKey !== theirs.repositoryKey) return [];
         const paths = t.profile && u.profile && (t.plan?.sections?.length && u.plan?.sections?.length) ? [] : mine.paths.filter((p) => theirs.paths.some((q) => samePlace(p, q)));
-        const symbols = mine.symbols.filter((x) => theirs.symbols.includes(x));
+        const symbols = mine.symbols.filter((x) => theirs.symbols.some((y) => symbolsOverlap(x, y)));
         return paths.length || symbols.length ? [this.completedNotice(u, { task: t, paths, symbols }, at.note, at.withheld)] : [];
       });
       if (!open.length && !done.length) continue;
@@ -2933,25 +3288,19 @@ export class Tasks {
   }
 
   /** `gated`: the transition `done()` already gated with no await since, so it is not read back twice (#382). */
-  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = "", withheld = false, gated?: "review", admission?: ReviewReadiness): Promise<Task> {
+  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = "", withheld = false, gated?: "review", admission?: ReviewReadiness, link?: IdentityLink): Promise<Task> {
     let selection = this.poolReview(task, refs);
     let reviewer = selection?.reviewer ?? task.reviewer, reviewEvidence: PrEvidence | undefined;
     if (this.d.sdlc && this.d.sdlc.config().mode !== "off" && gated !== (reviewer ? "review" : "approval")) {
       reviewEvidence = await this.lifecycleGate(task, reviewer ? "review" : "approval");
-      task = this.need(task.id, false, true);
-      this.mine(task, by, "owner", true);
-      // In every mode: another done may have landed during the readback.
-      if (task.state === "in_review" || isClosedTaskState(task.state)) throw new Error(`task #${task.id} is already ${task.state}`);
+      task = this.withLink(this.completionCurrent(task.id, by, false), link, refs);
       selection = this.poolReview(task, refs);
       reviewer = selection?.reviewer ?? task.reviewer;
     }
-    // A delayed local check needs a new readback; the immediate done path already admitted before effects.
-    if (reviewer && !admission && (this.d.sdlc?.config().mode ?? "off") !== "off") {
-      const observed = task;
-      admission = await this.reviewRequestAdmission(task, refs, false, by, reviewEvidence);
-      task = this.need(task.id);
-      this.mine(task, by, "owner");
-      if (task.history.length !== observed.history.length || task.state === "in_review" || isClosedTaskState(task.state)) throw new Error("task changed during review admission");
+    // A delayed local check needs a new readback; a completion-selected reviewer also needs optional facts in off mode.
+    if (!admission && ((reviewer && (this.d.sdlc?.config().mode ?? "off") !== "off") || this.d.prepareReviewBrief)) {
+      admission = await this.reviewRequestAdmission(task, refs, false, by, reviewEvidence, undefined, staged => this.withLink(staged, link, refs), !reviewer);
+      task = this.withLink(this.completionCurrent(task.id, by, false), link, refs);
     }
     selection = this.poolReview(task, refs);
     reviewer = selection?.reviewer ?? task.reviewer;
@@ -2961,7 +3310,7 @@ export class Tasks {
     const completedRefs = cleanRefs(refs);
     this.warmRepository({ ...task, refs: { ...task.refs, ...completedRefs } });
     const noWrites = this.noWritesRecorded({ ...task, refs: { ...task.refs, ...completedRefs } });
-    const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", ...(selection ? { reviewer: reviewer ?? USER } : {}), ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: completedRefs }, checkOutput ? `${routedSummary ?? ""}\n${checkOutput}`.trim() : routedSummary, { withheld: withheld || undefined, ...(noWrites ? { noWrites: true as const } : {}), ...this.reviewMetadata(selection), ...(reviewCost ? { reviewCost } : {}) });
+    const next = this.d.board.update(task.id, by, "done", { codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...completedRefs } }), state: reviewer ? "in_review" : "approved", ...(selection ? { reviewer: reviewer ?? USER } : {}), ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: completedRefs }, checkOutput ? `${routedSummary ?? ""}\n${checkOutput}`.trim() : routedSummary, { ...this.planObservation(task), withheld: withheld || undefined, ...(noWrites ? { noWrites: true as const } : {}), ...this.reviewMetadata(selection), ...(reviewCost ? { reviewCost } : {}) }, task.history.length, HOST_CODE_SYMBOLS);
     this.cohorts.closed(next.id); // its owner's next native turn end settles it in its cohort (issue #107)
     this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\n${summary ?? ""}`, withheld);
     this.tellCompleted(next, summary, withheld);
@@ -2971,7 +3320,7 @@ export class Tasks {
       this.releaseNotice(`task ${this.publicTitle(next)} done by ${by}, no reviewer: approved`);
       await this.releaseDependents(next);
     }
-    else if (reviewer === USER) this.releaseNotice(`task ${this.publicTitle(next)} done by ${by}: review it with ahub task show ${next.id}, then ahub review ${next.id} approved|changes_requested [note]`);
+    else if (reviewer === USER) this.releaseNotice(`task ${this.publicTitle(next)} done by ${by}: review it in the ahub console (Tasks, select #${next.id}, press r) or with ahub review ${next.id} approved|changes_requested [note]`);
     else this.releaseNotice(`task ${this.publicTitle(next)}: could not send the review request to ${reviewer}`, () => this.sendReview(next, reviewer, "", admission));
     return next;
   }
@@ -2985,6 +3334,9 @@ export class Tasks {
     const hits = this.overlapHits(task).filter((h) => h.task.owner !== USER && h.task.owner !== HUB);
     const cohort = this.cohorts.of(task.id);
     const silent = this.silentFor(task.id);
+    // #713: one notice per recipient per done, naming all of that recipient's overlapping tasks, and only for work the recipient has accepted. An offered or proposed
+    // task has nothing to check yet (its offer, or the accept that follows, already shows the current board), and a repeat done replaces the queued notice (see Bus.enqueue).
+    const byOwner = new Map<PeerId, typeof hits>();
     for (const hit of hits) {
       // A member of the same silent cohort (issue #107): the member that finishes last integrates instead
       // (Cohorts.completion). The notice is held, so something replaces it if no integration runs. Others hear it.
@@ -2992,9 +3344,23 @@ export class Tasks {
         cohort.held.add(task.id);
         continue;
       }
-      this.releaseNotice(`task ${this.publicTitle(task)}: could not publish the completed-change notice to ${hit.task.owner}`, () =>
-        this.whileOpen(hit.task.owner!, hit.task.id, this.completedNotice(task, hit, summary, withheld)));
+      // Accepted by its own owner since it last changed hands (`ownerAcceptance`, the rule the rest of this class uses), and still in work or review: an offered or proposed task is not.
+      if (!["in_progress", "changes_requested", "in_review"].includes(hit.task.state) || !this.ownerAcceptance(hit.task)) continue;
+      byOwner.set(hit.task.owner!, [...(byOwner.get(hit.task.owner!) ?? []), hit]);
     }
+    for (const [owner, mine] of byOwner) {
+      this.releaseNotice(`task ${this.publicTitle(task)}: could not publish the completed-change notice to ${owner}`, () =>
+        this.whileOpenFor(owner, task.id, mine.map((h) => h.task.id), this.completedNotice(task, mine, summary, withheld)));
+    }
+  }
+
+  /** Share the same screened observation rule between completion notices and read-only console detail. */
+  private sameFileDifferentSymbols(task: Task, hit: { task: Task; paths: string[] }): boolean {
+    const symbolRepository = task.codeSymbols && !this.isPii(task) ? this.codeSymbolsRepository(task) : undefined;
+    const otherRepository = hit.task.codeSymbols && !this.isPii(hit.task) ? this.codeSymbolsRepository(hit.task) : undefined;
+    return !!symbolRepository && symbolRepository.key === otherRepository?.key && !this.isPii(task) && !this.isPii(hit.task) && taskCodeSymbolsDisjoint(
+      task.codeSymbols, hit.task.codeSymbols, this.reviewHead(task), this.reviewHead(hit.task), symbolRepository.key,
+      hit.paths, false, this.publicMetadataText);
   }
 
   /**
@@ -3002,13 +3368,18 @@ export class Tasks {
    * included), and any item that matches a PII pattern is left out of what other owners get, the summary also when the
    * PII screen did not clear it (`withheld`, #198).
    */
-  private completedNotice(task: Task, hit: { task: Task; paths: string[]; symbols: string[] }, summary?: string, withheld = false): string {
+  private completedNotice(task: Task, hitOrHits: { task: Task; paths: string[]; symbols: string[] } | { task: Task; paths: string[]; symbols: string[] }[], summary?: string, withheld = false): string {
+    const hits = Array.isArray(hitOrHits) ? hitOrHits : [hitOrHits];
     const paths = this.places(task).paths.filter(this.nameable);
     const signatures = (task.plan?.signatures ?? []).filter(this.nameable);
     const first = (summary ?? "").split("\n").find((l) => l.trim())?.trim().slice(0, 300);
     const line = first && !withheld && this.nameable(first) ? first : undefined;
+    // One line per overlapping task of the recipient, so a single notice names all of them (#713).
+    const touches = hits.map((hit) => `#${hit.task.id} on ${this.where(hit)}${this.sameFileDifferentSymbols(task, hit) ? " (same file, different symbols; observed names only, deleted definitions may be missing)" : ""}`);
+    const open = hits.length > 1 ? `your open tasks ${touches.join("; ")}` : `your open ${touches[0]}`;
+
     return [
-      `Task #${task.id} (owner ${task.owner}) is done and touches your open #${hit.task.id} on ${this.where(hit)}. Check your work against it before you go on.`,
+      `Task #${task.id} (owner ${task.owner}) is done and touches ${open}. Check your work against it before you go on.`,
       paths.length ? `Changed files: ${paths.join(", ")}` : "",
       signatures.length ? `New or changed signatures: ${signatures.join("; ")}` : "",
       line ? `Summary: ${line}` : "",
@@ -3049,33 +3420,51 @@ export class Tasks {
 
   /** The one place a review request is written: the first reviewer and a replacement get the same text, refs and privacy. */
   /** Review admission is separate from brief construction (#228). All refusals precede the requesting done's writes. */
-  private async reviewRequestAdmission(task: Task, refs?: TaskRefs, preEffect = true, actor: PeerId = task.owner ?? USER, previous?: PrEvidence, sameRequest?: () => boolean): Promise<ReviewReadiness | undefined> {
+  private async reviewRequestAdmission(task: Task, refs?: TaskRefs, preEffect = true, actor: PeerId = task.owner ?? USER, previous?: PrEvidence, sameRequest?: () => boolean, stage: (task: Task) => Task = task => task, prepareOnly = false): Promise<ReviewReadiness | undefined> {
     const mode = (this.d.sdlc?.config() ?? sdlcConfig(undefined)).mode;
-    if (mode === "off") return undefined;
+    if (mode === "off" && !this.d.prepareReviewBrief) return undefined;
+    let quietDrift = false;
     const guard = () => {
       if (actor !== USER && actor !== task.owner) {
         const holders = Object.entries(this.d.roles ?? {}).filter(([, roles]) => Array.isArray(roles) && roles.includes("conductor")).map(([peer]) => peer);
         if (holders.length !== 1 || holders[0] !== actor) throw new (preEffect ? PreEffectToolRefusal : Error)("review admission authority changed");
       }
-      const current = this.need(task.id, false, preEffect);
-      if ((this.d.sdlc?.config().mode ?? "off") !== mode || current.history.length !== task.history.length && !sameRequest?.() || current.owner !== task.owner || current.reviewer !== task.reviewer
+      // #694: the board copy seen through the same staged identity link the caller's task carries.
+      const current = stage(this.need(task.id, false, preEffect));
+      const changed = current.history.length !== task.history.length;
+      const quiet = current.history.length > task.history.length && current.history.slice(task.history.length).every(entry => QUIET_EVENTS.has(entry.event));
+      const sameHistory = !changed || (mode === "advise" && quiet) || !!sameRequest?.();
+      if ((this.d.sdlc?.config().mode ?? "off") !== mode || !sameHistory || current.owner !== task.owner || mode !== "advise" && current.reviewer !== task.reviewer
         || this.isPii(current) !== this.isPii(task) || JSON.stringify(current.sdlc ?? null) !== JSON.stringify(task.sdlc ?? null)
+        || mode === "advise" && (current.state !== task.state || current.refs.commit !== task.refs.commit)
         || actor !== USER && this.d.privateTurn?.(actor) && !this.isPii(current)) throw new (preEffect ? PreEffectToolRefusal : Error)("task or authority changed during review admission");
+      quietDrift ||= mode === "advise" && changed && quiet;
       return current;
     };
     guard();
+    if (!this.isPii(task) && this.d.prepareReviewBrief) {
+      try { await this.d.prepareReviewBrief({ ...task, refs: { ...task.refs, ...cleanRefs(refs) } }); }
+      catch { /* Optional code facts must not refuse a review. */ }
+      guard();
+    }
+    if (mode === "off" || prepareOnly) return undefined;
     const expected = cleanRefs(refs).commit ?? task.refs.commit ?? task.sdlc?.head ?? task.sdlc?.localHead;
-    const read: SdlcGh = (args, timeout, cwd, cap) => { guard(); return (this.d.sdlc?.gh ?? sdlcGh)(args, timeout, cwd, cap); };
+    const read: SdlcGh = (args, timeout, cwd, cap) => {
+      guard();
+      if (quietDrift) throw new Error("review readiness unknown: task changed during readback");
+      return (this.d.sdlc?.gh ?? sdlcGh)(args, timeout, cwd, cap);
+    };
     const evidence: ReviewReadiness = this.isPii(task)
       ? { ready: false, blockers: ["private review readiness unavailable"] }
       : task.sdlc ? reviewReadinessFromEvidence(previous, expected, this.d.sdlc?.config().requiredChecks ?? []) ?? await readReviewReadiness(task.sdlc, expected, read, this.d.sdlc?.config().requiredChecks ?? []) : { ready: false, blockers: ["review PR identity missing"] };
     const current = guard();
-    if (!evidence.ready) {
-      const message = `task ${this.publicTitle(current)}: premature review: ${evidence.blockers.join("; ")}`;
+    const admitted: ReviewReadiness = quietDrift ? { ready: false, blockers: ["review readiness unknown: task changed during readback"] } : evidence;
+    if (!admitted.ready) {
+      const message = `task ${this.publicTitle(current)}: premature review: ${admitted.blockers.join("; ")}`;
       if (mode === "enforce") throw new (preEffect ? PreEffectToolRefusal : Error)(message);
       this.releaseNotice(message);
     }
-    return evidence;
+    return admitted;
   }
 
   private sendReview(task: Task, reviewer: PeerId, why = "", admission?: ReviewReadiness): void {
@@ -3092,12 +3481,29 @@ export class Tasks {
     // A checklist that maps the change to its contract (issue #35): reviewers who check against the written plan catch more.
     const plan = planText(task.plan);
     const check = [...task.history].reverse().find((h) => h.event === "check passed");
+    const cachedPlanRead = this.planReads.get(task.id);
+    const planRead = this.planReport(task, cachedPlanRead?.identity === this.planReadIdentity(task) && cachedPlanRead.evidence.head === this.findingHead(task) ? cachedPlanRead.evidence : undefined);
+    const conformanceText = mode !== "off" ? this.screen(task, `Plan conformance: ${JSON.stringify(planRead)}`, "plan conformance", reviewer) + "\n" : "";
+    const profile = (task.profile ?? "dev") === (this.d.profile ?? "dev") ? profileData(this.d.profileData ?? task.profile ?? "dev") : profileData(task.profile);
+    const target = plan ? `the plan (${plan})` : task.detail ? "the task detail above" : "the task title";
+    const noCheckWording = profile.name === "research" || profile.name === "writing"
+      ? "No check ran for this class: verify the claims and sources yourself."
+      : profile.name === "general"
+        ? "No check ran for this class: verify the outcome yourself."
+        : "No check ran for this class: run the affected tests yourself.";
+    const checkResult = check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : noCheckWording;
+    const checklistTemplates = profile.review_checklist ?? [
+      "Map the changed signatures and call sites to {target}, and name each one that does not match.",
+      "{check}",
+      "List what is unmet in hub_review's unmet, one item each.",
+    ];
+    const checklistLines = checklistTemplates.map(template =>
+      template.replaceAll("{target}", target).replaceAll("{check}", checkResult)
+    );
     const checklist = [
       "Checklist:",
       ...this.planGuardItems(task).map(item => `- Check the plan against this live fail before the remaining checks: ${item.line}`),
-      `- Map the changed signatures and call sites to ${plan ? `the plan (${plan})` : task.detail ? "the task detail above" : "the task title"}, and name each one that does not match.`,
-      `- ${check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : "No check ran for this class: run the affected tests yourself."}`,
-      `- List what is unmet in hub_review's unmet, one item each.`,
+      ...checklistLines.map(line => `- ${line}`),
     ].join("\n");
     // #223 R2: a reviewer-only instance judges from facts; the builder's narrative stays out, earlier findings go in.
     const reviewOnly = this.d.reviewOnly?.(reviewer) === true;
@@ -3105,6 +3511,9 @@ export class Tasks {
     const specRepo = task.sdlc?.repo ?? task.external?.repo, specIssue = task.sdlc?.issue ?? task.external?.issue;
     const spec = reviewOnly && specRepo && specIssue ? `Spec issue: ${specRepo}#${specIssue}\n` : "";
     const findings = reviewOnly ? task.history.filter(h => h.event === "changes_requested" && h.note).map(h => `- ${h.by}: ${this.screen(task, h.note!, "review note", reviewer, h.withheld)}`) : [];
+    const carried = findingsForHead(this.reviewFindingSets(task), this.findingHead(task)).filter(item => item.severity === "important" && item.disposition === "open");
+    const visible = this.isPii(task) ? [] : carried.filter(item => this.findingTextAllowed(task, [item]) && !task.history.some(entry => entry.withheld && entry.reviewFindings?.items.some(value => value.id === item.id)));
+    const carriedText = carried.length ? `Open Important findings carried until explicitly dispositioned: ${carried.length}\n${visible.map(({ id, pass, severity, path }) => JSON.stringify({ id, pass, severity, ...(path ? { path } : {}) })).join("\n")}${visible.length < carried.length ? "\nSome finding details withheld." : ""}\n` : "";
     const guidance = this.roleGuidance(task, reviewer, true);
     let projection = "";
     try { const text = this.d.projectedReview?.(task); if (text) projection = this.screen(task, sanitize(text), "document projection", reviewer); }
@@ -3112,7 +3521,7 @@ export class Tasks {
     const brief = this.briefText(task);
     // #572 AC3: advisory only, from git state never from task text, so it is safe for a PII task too.
     const checkout = mainCheckoutWarning(this.d.cwd, this.publicMetadataText);
-    const body = `Review task #${task.id} [${profileTaskLabel(task)}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${last?.noWrites ? "no writes recorded since acceptance\n" : ""}${spec}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${guidance ? guidance + "\n" : ""}${projection ? projection + "\n" : ""}${brief ? brief + "\n" : ""}${checkout ? `Note: ${checkout}.\n` : ""}${findings.length ? `Earlier findings (set a disposition for each):\n${findings.join("\n")}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
+    const body = `Review task #${task.id} [${profileTaskLabel(task)}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${last?.noWrites ? "no writes recorded since acceptance\n" : ""}${spec}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${guidance ? guidance + "\n" : ""}${projection ? projection + "\n" : ""}${brief ? brief + "\n" : ""}${checkout ? `Note: ${checkout}.\n` : ""}${findings.length ? `Earlier findings (set a disposition for each):\n${findings.join("\n")}\n` : ""}${carriedText}${conformanceText}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet, findings: [{id, pass: "bugs" | "security" | "compliance", severity: "important" | "nit", path?, disposition: "open" | "fixed" | "false_positive"}]}. Reuse finding ids when updating their disposition; only the person may accept a finding with a rationale.`;
     this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, ...(this.reviewHead(task) ? { commit: this.reviewHead(task)! } : {}), task: String(task.id), reviewRevision: String(this.reviewRequestRevision(task)) }, ...(this.isPii(task) ? { private: true } : {}) }));
   }
 
@@ -3151,6 +3560,29 @@ export class Tasks {
     return next;
   }
 
+  private codeSymbolsRepository(task: Task) {
+    try {
+      const repository = this.repositories.scope(task.refs);
+      if (task.sdlc?.repo && this.repositories.scope({ repo: task.sdlc.repo }).key !== repository.key) return undefined;
+      return repository;
+    } catch { return undefined; }
+  }
+
+  /** Host observations are saved only with an admitted transition, never by an optional read. */
+  private observedCodeSymbols(task: Task) {
+    if (this.isPii(task) || !task.refs.commit) return undefined;
+    const repository = this.codeSymbolsRepository(task);
+    // ponytail: the brief analyzes the validated project execution root. Foreign repositories stay unknown
+    // until the brief carries independent repository provenance; a model's refs.repo cannot supply that proof.
+    if (!repository || repository.key !== this.repositories.project.key) return undefined;
+    try {
+      const brief = this.d.reviewBrief?.(task);
+      const observation = brief && !("unavailable" in brief) ? buildTaskCodeSymbols(brief, repository.key, this.publicMetadataText) : undefined;
+      // A resolved short ref or a stale provider result is unknown advice, never a reason to refuse done.
+      return observation?.head === task.refs.commit ? observation : undefined;
+    } catch { return undefined; } // Optional metadata never costs the admitted result.
+  }
+
   /** #520: the rendered review brief of a non-PII task's commit, or why there is none; empty without a commit. */
   briefText(task: Task): string {
     if (this.isPii(task) || !task.refs.commit) return "";
@@ -3161,11 +3593,13 @@ export class Tasks {
     } catch { return "Review brief unavailable: it could not be built."; }
   }
 
-  async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown, head?: unknown, coverage?: unknown): Promise<Task> {
+  async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown, head?: unknown, coverage?: unknown, findings?: unknown): Promise<Task> {
     const authority = by === USER ? undefined : this.d.reviewAuthority?.(by, Number(id));
+    let findingGuard: ((task: Task) => void) | undefined;
     // #520: what the coverage was checked against, pinned through every await: the commit and the lifecycle receipt (the
     // inherited reviewedHead lives there).
     let covered: { commit: string | undefined; receipt: string } | undefined;
+    let conformanceIdentity: string | undefined;
     const valid = (): Task => {
       const refused = authority?.();
       if (refused) throw new PreEffectToolRefusal(refused); // rechecked after every await, right before each write
@@ -3174,13 +3608,42 @@ export class Tasks {
       this.mine(t, by, "reviewer", true);
       if (verdict !== "approved" && verdict !== "changes_requested") throw new PreEffectToolRefusal('verdict must be "approved" or "changes_requested"');
       if (t.state !== "in_review") throw new PreEffectToolRefusal(`task #${t.id} is ${t.state}: cannot move to ${verdict} before its owner calls hub_task_done`);
+      if (conformanceIdentity !== undefined && conformanceIdentity !== this.planIdentity(t)) throw new PreEffectToolRefusal("plan conformance identity changed during verdict");
+      findingGuard?.(t);
       return t;
     };
+    if ((this.d.sdlc?.config().mode ?? "off") !== "off") conformanceIdentity = this.planIdentity(valid());
     const items = textList(unmet);
     if (items.length) note = `${note ?? ""}\nUnmet: ${items.join("; ")}`.trim();
     // #520: an approval accounts for every reviewable path of the brief. enforce refuses before any effect, advise records
     // the gap in the verdict note, off and a person's own verdict skip it.
     const mode = this.d.sdlc?.config().mode ?? "off";
+    const initial = valid(), suppliedFindings = findings !== undefined;
+    let parsed: ReviewFinding[];
+    try { parsed = parseReviewFindings(findings, { person: by === USER, maxNits: this.d.sdlc?.config().maxNits ?? DEFAULT_MAX_NITS }); }
+    catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "invalid structured findings"); }
+    const resolvedHead = this.findingHead(initial);
+    let findingHead = resolvedHead;
+    if (head !== undefined) {
+      try { findingHead = sdlcReceipt({ reviewedHead: head }, initial.sdlc, this.d.sdlc?.config() ?? sdlcConfig(undefined)).reviewedHead; }
+      catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "invalid finding head"); }
+    }
+    const report: ReviewFindingSet | undefined = suppliedFindings ? { ...(findingHead ? { head: findingHead } : {}), items: parsed } : undefined;
+    const proposedSets = (task: Task) => [...this.reviewFindingSets(task), ...(report ? [report] : [])];
+    if (head !== undefined || suppliedFindings || this.reviewFindingSets(initial).length) {
+      const identity = (task: Task) => JSON.stringify({ owner: task.owner, reviewer: task.reviewer, commit: task.refs.commit, receipt: task.sdlc, resolvedHead: this.findingHead(task), private: this.isPii(task), findings: this.reviewFindingSets(task) });
+      const original = identity(initial);
+      findingGuard = task => {
+        if (identity(task) !== original) throw new PreEffectToolRefusal("task review identity, privacy or findings changed during the verdict; review current work again");
+        if (by !== USER && suppliedFindings && this.d.privateTurn?.(by) && !this.isPii(task)) throw new PreEffectToolRefusal("structured review of ordinary work is unavailable during a private turn");
+        if (parsed.filter(item => item.severity === "nit").length > (this.d.sdlc?.config().maxNits ?? DEFAULT_MAX_NITS)) throw new PreEffectToolRefusal("review nit cap exceeded");
+        if (report?.items.length && !report.head && this.d.sdlc?.config().mode === "enforce") throw new PreEffectToolRefusal("a finding report requires a resolvable full reviewed head in enforce");
+        const current = findingsForHead(proposedSets(task), findingHead);
+        if (current.length > 64) throw new PreEffectToolRefusal("one reviewed head supports at most 64 distinct finding IDs");
+        if (verdict === "approved" && this.d.sdlc?.config().mode === "enforce" && findingTally(current).openImportant) throw new PreEffectToolRefusal("approval blocked: open important review findings on this head");
+      };
+      findingGuard(initial);
+    }
     // A Tasks without a brief provider (library use; the daemon always has one) has no coverage gate.
     if (verdict === "approved" && by !== USER && mode !== "off" && this.d.reviewBrief) {
       const t = valid(), enforce = mode === "enforce", list = (paths: string[]) => `${paths.slice(0, 20).join(", ")}${paths.length > 20 ? ", ..." : ""}`;
@@ -3206,15 +3669,17 @@ export class Tasks {
         if (gap.length) note = `${note ?? ""}\nCoverage gap (${gap.length}): ${list(gap)}`.trim();
       }
     }
+    if (head !== undefined && resolvedHead && findingHead !== resolvedHead) throw new PreEffectToolRefusal("supplied review head differs from the task resolved head");
     // The PII screen reads the note of a review that passes these checks (issue #198); they run again after it.
-    const withheld = await this.withholds("review note", note, valid());
+    const withheld = await this.withholds("review note", parsed.length ? JSON.stringify({ note, findings: parsed }) : note, valid())
+      || parsed.length > 0 && !this.findingTextAllowed(initial, parsed);
     let task = valid();
     let reviewedHead: string | undefined;
     if (head !== undefined) {
       const checked = sdlcReceipt({ reviewedHead: head }, task.sdlc, this.d.sdlc?.config() ?? sdlcConfig(undefined));
       reviewedHead = checked.reviewedHead;
     }
-    if (verdict === "approved" && this.d.sdlc && this.d.sdlc.config().mode !== "off") { await this.lifecycleGate(task, "approval", reviewedHead); task = valid(); }
+    if (verdict === "approved" && this.d.sdlc && this.d.sdlc.config().mode !== "off") { await this.lifecycleGate(task, "approval", reviewedHead, proposedSets(task)); task = valid(); }
     let candidate: Extract<CandidateInput, { kind: "fail" }> | undefined;
     if (verdict === "changes_requested" && items.length && this.d.candidates && !withheld && !this.isPii(task) && !this.d.privateTurn?.(by)) {
       const input: CandidateInput = { project: this.d.store?.project ?? this.d.project, kind: "fail", approach: this.publicTitle(task), symptom: items.join("\n"),
@@ -3232,7 +3697,7 @@ export class Tasks {
     const family = by === USER ? undefined : (this.d.adapterCatalog?.familyOf ?? familyOf)(by, this.d.instances?.());
     const reviewerFamily = poolRequest?.reviewerFamily === family ? family : undefined;
     const reviewerReason = reviewerFamily ? poolRequest?.reviewerReason : undefined;
-    const flag = { withheld: withheld || undefined, ...(reviewContext ? { reviewContext } : {}), ...(reviewerFamily ? { reviewerFamily } : {}), ...(reviewerReason ? { reviewerReason } : {}) };
+    const flag = { ...this.planObservation(task), withheld: withheld || undefined, ...(report ? { reviewFindings: report } : {}), ...(reviewContext ? { reviewContext } : {}), ...(reviewerFamily ? { reviewerFamily } : {}), ...(reviewerReason ? { reviewerReason } : {}) };
     if (verdict === "approved") {
       const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0, ...(reviewedHead && task.sdlc ? { sdlc: { ...task.sdlc, reviewedHead, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), "merge") } } : {}) }, note, flag);
       if (next.owner) {
@@ -3248,9 +3713,12 @@ export class Tasks {
       this.releaseNotice(`task ${this.publicTitle(next)}: could not tell ${next.owner ?? "its owner"} it was approved`, () =>
         this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${this.screen(next, note, "review note", next.owner, withheld)}` : ""}`, pii));
       await this.releaseDependents(next);
+      // A proposal storage failure cannot roll back the saved verdict; another matching verdict retries it.
+      this.releaseNotice(`task #${next.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(next, by, parsed, withheld));
       return next;
     }
     const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: task.rejections + 1 }, note, flag);
+    this.releaseNotice(`task #${rejected.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(rejected, by, parsed, withheld));
     if (candidate && !pii && !this.d.privateTurn?.(by) && this.candidateTextAllowed(JSON.stringify({ candidate, refs: rejected.refs, plan: rejected.plan }), rejected)) {
       try { this.d.memoryCheck?.(); this.d.candidates?.put({ ...candidate, evidenceRefs: [...candidate.evidenceRefs, `review:${rejected.id}:${rejected.history.length}`] }, "public"); } catch { /* a saved review remains authoritative if the optional sidecar fails */ }
     }