@staix/agent-hub 0.15.0 → 0.16.0

package/src/hub/daemon.ts

@@ -1,3 +1,6 @@
+import { deriveMemoryCodeOverlay, unavailableMemoryCodeOverlay } from "./memory-code-overlay.ts";
+import { readMemoryCodeHead, type MemoryCodeHead } from "./memory-code-head.ts";
+import { canonicalMemorySymbolNode, resolveMemorySymbolNodes, type MemorySymbolNodes } from "./memory-symbols.ts";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { normalizeUsage } from "../omniroute/usage.ts";
 import { permissionPayload } from "./permission-payload.ts";
@@ -21,7 +24,7 @@ import { renderHeldHint } from "./delivery-hints.ts";
 import { correctionInput, MemoryTelemetry } from "./memory-candidates.ts";
 import { MemoryObservations } from "./memory-observations.ts";
 import { createStalenessProbe } from "./memory-staleness.ts";
-import { matchingPlanFails, planGuardNodes } from "./memory-plan-guard.ts";
+import { matchingPlanFails, planGuardNodes, taskMemoryQueryNodes } from "./memory-plan-guard.ts";
 import { planningWipLimits } from "./planning.ts";
 import { projectedDiff } from "./projected-diff.ts";
 import { listenWithoutPortCollision } from "./listen.ts";
@@ -67,11 +70,13 @@ import { createConfigEditor } from "./config-edit-host.ts";
 import { readEditable } from "./config-edit.ts";
 import { eventLog, readEvents, type RoleIdentity } from "./events.ts";
 import { KimiUsage, kimiSeedRows } from "./kimi-usage.ts";
+import { TokenWindow } from "./token-window.ts";
+import { budgetNotes, type BudgetPeerNote } from "./budget-notes.ts";
 import { kimiRowTotal } from "../adapters/kimi-wire-usage.ts";
 import { ExecutionBudget } from "./execution-budget.ts";
 import { claudeReportedTokens, readClaudeTranscriptCompletion, readClaudeTranscriptUsage, waitForClaudeCompletion } from "./usage.ts";
 import type { ServerWebSocket } from "bun";
-import { isAcpPeer, type AcpPeer, QwenIdentityError, type PermissionRequest } from "../adapters/acp.ts";
+import { isAcpPeer, type AcpPeer, QwenIdentityError, ACTION_BUDGET_OPTION, type PermissionRequest, type ActionGateVerdict } from "../adapters/acp.ts";
 import { isCodexPeer, type CodexPeer } from "../adapters/codex-appserver.ts";
 import { isPiPeer, type PiPeer } from "../adapters/pi.ts";
 import { startModelRelay, type ModelRelay } from "../models/relay.ts";
@@ -88,7 +93,7 @@ import { isReviewerPrintPeer, reviewerUnavailableReason, ReviewerUnavailableErro
 import { createReviewerMcpSession } from "../adapters/reviewer-mcp.ts";
 import { reviewerPoolConfig } from "./reviewer-pool-config.ts";
 import { reviewDiff } from "../adapters/claude-print.ts";
-import { Capture, skipTools } from "../memory/capture.ts";
+import { Capture } from "../memory/capture.ts";
 import { DEFAULT_OMNIROUTE, OmniRoute, type OmniRouteConfig } from "../omniroute/client.ts";
 import { Briefs } from "../memory/brief.ts";
 import { Board, isClosedTaskState, taskProposalAt, taskHasStarted, CLASSES, type Task, type TaskClass } from "./board.ts";
@@ -120,7 +125,7 @@ import { codeGroup } from "./task-code-group.ts";
 import { DAEMON_FEATURES, PROTOCOL, stateDirFor } from "./control-client.ts";
 import { MAX_HOP, newEnvelope, parseMarker, replyParent, sanitize, USER, type Envelope, type PeerId, type Priority } from "./envelope.ts";
 import { BasePeer, DEFAULT_WATCHDOG_MS, type PeerAdapter } from "./peers.ts";
-import { MemoryClient, workerUrl } from "../memory/client.ts";
+import { MemoryClient } from "../memory/client.ts";
 import { VERSION } from "../version.ts";
 import { appendRecords, taskRecords } from "./research.ts";
 import { benchReport, MIN_ATTEMPTS, readRuns, runSummary, type Measures, type RunSummary } from "./bench.ts";
@@ -144,9 +149,9 @@ import { grantablePath, instructionProtection, isPermissionMode, permissionBound
 import { ContextWindows, DEFAULT_CONTEXT, readNativeContext, type ContextConfig } from "./context-window.ts";
 import { projectFileTool, scopedWriteBlocked } from "../cli/facts-hook.ts";
 import { detectTooling } from "./tooling.ts";
-import { looksSecret, DEFAULT_LEASE_MS, extractNodes, memoryHome, SUGGESTED, taskKey, type CandidateStore, type MemoryStore, type GoalView, type Suggested, type View as MemoryView } from "@staix/agent-mem";
+import { looksSecret, DEFAULT_LEASE_MS, memoryHome, SUGGESTED, taskKey, type CandidateStore, type MemoryStore, type GoalView, type Suggested, type View as MemoryView } from "@staix/agent-mem";
 import { memoryProjectKey } from "@staix/agent-mem";
-import { AGENT_MEM_VERSION, MEMORY_SPLIT_INCOMPLETE, memoryProjectFor, openProfileMemory, openProfileCandidates, type MemoryProfileBinding, type UnboundMemoryProfileReceipt } from "./memory-profile.ts";
+import { AGENT_MEM_VERSION, MEMORY_SPLIT_INCOMPLETE, memoryProjectFor, openProfileMemory, openProfileCandidates, MemoryProfileBinding, type UnboundMemoryProfileReceipt } from "./memory-profile.ts";
 import { syncMemory } from "@staix/agent-mem";
 import { MEMORY_READ_TOOLS, memoryRead, validateMemoryRead } from "./read-tools.ts";
 import { nativeRecall } from "../memory/recall.ts";
@@ -177,7 +182,7 @@ export interface HubConfig {
   roster: PeerRoster;
   roles: Record<string, string[]>;
   /** #455: the one peer that holds the planner role; unset, the `roles` planners stand, or the hub assigns one. */
-  planner?: string;
+  planner?: string | string[];
   profile?: ProfileName;
   profile_overrides?: Record<string, unknown>;
   pii?: { paths: string[] };
@@ -286,11 +291,11 @@ export interface ConfigLayer { name: typeof CONFIG_FILES[number]; raw: Record<st
 const CONFIG_BLOCKS = ["action_policy", "memory", "roster", "roles", "catalog_roles", "pii", "data", "conductor", "budget", "context", "inference", "omniroute", ...NATIVE_CONFIG_BLOCKS, "approvals", "tasks", "task_sweep", "checks", "snapshots", "research", "bench", "limits", "review", "recovery", "capabilities", "mlx", "permission_modes", "peers", "terminal", "pet"];
 
 /** Connection-time policy refresh reads role/feed fields only, never launches or machine-local configuration. */
-export function loadConductorPolicy(cwd: string, layers?: readonly ConfigLayer[]): { roles: Record<string, string[]>; conductor: HubConfig["conductor"]; planner?: string; notices?: string[] } {
+export function loadConductorPolicy(cwd: string, layers?: readonly ConfigLayer[], scope: Pick<ReturnType<typeof readInstanceConfig>, "instances" | "catalog"> = readInstanceConfig(cwd, layers)): { roles: Record<string, string[]>; conductor: HubConfig["conductor"]; planner?: string | string[]; notices?: string[] } {
   const roles: Record<string, string[]> = { ...DEFAULT_ROLES };
   const conductor = { ...DEFAULT_CONFIG.conductor };
   const notices: string[] = [];
-  let planner: string | undefined;
+  let planner: string | string[] | undefined;
   for (const name of CONFIG_FILES) {
     let file: Record<string, unknown>;
     if (layers && !layers.some(layer => layer.name === name)) continue;
@@ -308,8 +313,11 @@ export function loadConductorPolicy(cwd: string, layers?: readonly ConfigLayer[]
       }
     }
     if (file.planner !== undefined) {
-      if (!(PLANNER_PEERS as readonly unknown[]).includes(file.planner)) throw new Error(`planner must be one of ${PLANNER_PEERS.join(", ")}`);
-      planner = file.planner as string;
+      if (file.planner === null) throw new Error("planner takes a peer id or a nonempty list of up to eight ids");
+      const def = instanceSettingDef("planner", scope.instances, scope.catalog);
+      if (typeof def === "string") throw new Error(def);
+      const normalized = checkSettingValue(def, file.planner) as string | string[];
+      planner = Array.isArray(file.planner) ? [...file.planner] as string[] : normalized;
     }
     if (file.conductor !== undefined) {
       if (!file.conductor || typeof file.conductor !== "object" || Array.isArray(file.conductor)) throw new Error("conductor must be an object");
@@ -418,7 +426,7 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     throw new Error("legacy MLX configuration requires explicit mlx.provider=legacy; migrate to provider=ollama to avoid Python serving");
   }
   const mlx = { ...(file.mlx?.provider === "legacy" ? { enabled: true, provider: "legacy" as const, maxInputTokens: 16_000, maxTokens: 2048 } : DEFAULT_CONFIG.mlx), ...file.mlx };
-  const conductorPolicy = loadConductorPolicy(cwd, captured);
+  const conductorPolicy = loadConductorPolicy(cwd, captured, instanceConfig);
   retired.push(...conductorPolicy.notices ?? []);
   const configuredRoles = Object.fromEntries(adapterCatalog.definitions.filter(d => !definitionOf(d.kind)).map(d => [d.kind, [...d.roles]]));
   const extraRoles = Object.fromEntries(Object.keys(instances ?? {}).map(id => [id, effectiveInstanceRoles(id, instances, conductorPolicy.roles, adapterCatalog)]));
@@ -501,6 +509,8 @@ function mlxPinProblem(routing: Routing, project: boolean): string | undefined {
 }
 
 export interface DaemonOptions {
+  /** Host-only test/embedding port; never read from project configuration or a tool. */
+  memoryClient?: MemoryClient;
   /** Host-only snapshot/probe seams; never read from project config or tool arguments. */
   snapshot?: typeof snapshot;
   snapshotBurstMs?: number;
@@ -735,8 +745,9 @@ export async function startDaemon(opts: DaemonOptions) {
   let policyRoles = structuredClone(config.roles);
   let plannerSource: "setting" | "roles" | "automatic" | "none" = "none";
   let plannerLogged = "";
+  const plannerEligible = new Set(projectSettings(declarations, adapterCatalog).find(def => def.key === "planner")?.values ?? []);
   const settlePlanner = () => {
-    const { roles, source } = resolveSettledRoles(policyRoles, config.planner, onRoster);
+    const { roles, source } = resolveSettledRoles(policyRoles, config.planner, onRoster, peer => plannerEligible.has(peer));
     for (const key of Object.keys(config.roles)) delete config.roles[key];
     Object.assign(config.roles, roles);
     plannerSource = source;
@@ -744,7 +755,6 @@ export async function startDaemon(opts: DaemonOptions) {
     if (line !== plannerLogged) { log(`planner: ${line}${source === "automatic" ? "; pin it with ahub settings set planner <peer>" : ""}`); plannerLogged = line; }
   };
   const plannerPeers = () => Object.keys(config.roles).filter(peer => config.roles[peer]!.includes("planner"));
-  if (config.planner !== undefined && !(PLANNER_PEERS as readonly string[]).includes(config.planner)) log(`planner: ${JSON.stringify(config.planner)} is not one of ${PLANNER_PEERS.join(", ")}; ignored`);
   settlePlanner();
   const catalog = loadRoleCatalog(opts.cwd);
   for (const error of catalog.errors) log(`catalog role ${error.id}: ${error.reason}`);
@@ -1053,7 +1063,6 @@ export async function startDaemon(opts: DaemonOptions) {
     }, delayMs);
     recoveryLeaseTimer.unref?.();
   };
-  const memory = new MemoryClient(config.memory.worker_url ?? workerUrl(), 2000, log);
   const chain = projectChain(opts.cwd);
   const recalled = new Set<PeerId>(); // once per peer per hub run, however often the peer's session restarts
   // #258: the hub's own store, machine-wide in ~/.agenthub/memory. Entries are filed under the project's memory key (its
@@ -1097,18 +1106,96 @@ export async function startDaemon(opts: DaemonOptions) {
    * Notes as they leave for a model (a recall preface, a brief, `ask` evidence) are screened again under the current
    * policy: a shared note was accepted under another project's patterns, and patterns change. A match is withheld.
    */
-  const screenMemory = <T extends { title: string | null; text: string }>(vs: T[]): T[] => withoutPii(vs, activeRouting(), opts.cwd, config.pii?.paths ?? []);
+  const screenMemory = <T extends { title: string | null; text: string }>(vs: T[]): T[] => withoutPii(vs.filter(v => !looksSecret(`${v.title ?? ""}\n${v.text}`) && !v.title?.startsWith(ASK_NOTE_TITLE)), activeRouting(), opts.cwd, config.pii?.paths ?? []);
   let candidates: CandidateStore | undefined;
   if (memoryStore) {
     try { candidates = openProfileCandidates(memoryBinding!); const opened = candidates; startupCleanup.push(() => opened.close()); }
     catch { log("memory candidate sidecar unavailable"); }
   }
+  let captureBinding = memoryBinding;
+  if (config.memory.enabled && !captureBinding && !memoryProblem) {
+    try { captureBinding = new MemoryProfileBinding({ project: memoryProject, projectKey: memoryProjectRaw }); }
+    catch { memoryUnavailable("memory profile unavailable; capture disabled"); }
+  }
+  const memory = opts.memoryClient ?? new MemoryClient({
+    project: memoryProject, store: memoryStore, candidates,
+    check: () => { if (memoryProblem || !captureBinding) throw new Error("memory unavailable"); captureBinding.assertCurrent(); if (memoryProjectFor(opts.cwd) !== memoryProject) throw new Error("memory project changed"); },
+    screen: rows => screenMemory(rows),
+    publicText: text => !looksSecret(text) && withoutPii([{ title: "", text }], activeRouting(), opts.cwd, config.pii?.paths ?? []).length === 1,
+    capture: () => ({ memoryDir: captureBinding!.home }), log,
+  });
   const memoryTelemetry = candidates && memoryStore ? new MemoryTelemetry(candidates, memoryStore, memoryProject, screenMemory, checkMemory) : undefined;
   const staleness = () => createStalenessProbe({ cwd: opts.cwd, privatePaths: config.pii?.paths ?? [], deny: config.local.deny });
   const memoryLine = (v: MemoryView) => `mem:${v.id.slice(0, 8)} ${v.kind} ${v.tier}: ${`${v.title ? `${v.title}: ` : ""}${v.text}`.replace(/\s+/g, " ").slice(0, 160)}`;
   /** A task's own nodes: what its title names (an issue, a path), its refs and plan paths, plan symbols, and the task itself. */
   const taskNodes = (t: { id?: number; created?: number; title?: string; refs: { paths?: string[] }; plan?: { paths?: string[]; symbols?: string[] } }) =>
-    extractNodes(t.title ?? "", { cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny, paths: [...(t.refs.paths ?? []), ...(t.plan?.paths ?? [])], symbols: t.plan?.symbols, ...(t.id !== undefined && t.created !== undefined ? { task: { id: t.id, created: t.created } } : {}) });
+    taskMemoryQueryNodes({ ...t, title: t.title ?? "" }, { cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny });
+
+  const memoryCodeCache = new Map<string, { code: import("./memory-code-overlay.ts").MemoryCodeOverlay; proof: MemoryCodeHead; expires: number }>();
+  const memoryCodeProofs = new Map<string, MemoryCodeHead>();
+  const memoryCodeSeeds = new WeakMap<object, Set<string>>();
+  let memoryCodeNextStart = 0;
+  async function memoryCode(starts: readonly string[], valid: () => boolean = () => true, cacheOnly = false) {
+    if (!memoryStore || !starts.length || !valid()) return unavailableMemoryCodeOverlay();
+    const key = JSON.stringify([memoryRepo, starts]), now = performance.now(), cached = memoryCodeCache.get(key);
+    if (cached && cached.expires > now && cached.proof.current() === cached.code.head) return cached.code;
+    if (cacheOnly || now < memoryCodeNextStart) return unavailableMemoryCodeOverlay();
+    memoryCodeNextStart = now + 5000;
+    const proof = readMemoryCodeHead(opts.cwd); if (!proof) return unavailableMemoryCodeOverlay();
+    const head = proof.head; memoryCodeProofs.set(head, proof);
+    if (memoryCodeProofs.size > 32) memoryCodeProofs.delete(memoryCodeProofs.keys().next().value!);
+    const code = await deriveMemoryCodeOverlay(starts, {
+      context: () => ({ cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny }),
+      head: () => head,
+      valid: () => { checkMemory(); return !stopping && valid() && proof.current() === head; },
+      publicMetadataText: text => tasks.publicMetadataText(text) && boundedSafe(text),
+      neighbours: (root, head, selector, depth) => codeFacts.neighbours(root, head, selector, depth, { priority: "optional" }),
+      related: (nodes, limit) => screenMemory(memoryStore!.related(memoryProject, [...nodes], limit)).map(v => ({ id: `mem:${v.id}`, line: memoryLine(v), kind: v.kind, about: v.about })),
+    });
+    memoryCodeSeeds.set(code, new Set(starts.map(raw => canonicalMemorySymbolNode(raw, { cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny, allowed: tasks.publicMetadataText })).filter((id): id is string => !!id)));
+    memoryCodeCache.set(key, { code, proof, expires: performance.now() + (code.state === "known" ? 30_000 : 5000) });
+    if (memoryCodeCache.size > 32) memoryCodeCache.delete(memoryCodeCache.keys().next().value!);
+    return code;
+  }
+  function currentMemoryCode(code: import("./memory-code-overlay.ts").MemoryCodeOverlay) {
+    try {
+      checkMemory();
+      if (!code.head || memoryCodeProofs.get(code.head)?.current() !== code.head || !tasks.publicMetadataText(JSON.stringify({ ...code, notes: [] })) || !boundedSafe(JSON.stringify({ ...code, notes: [] }))) return unavailableMemoryCodeOverlay();
+      const context = { cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny, allowed: (text: string) => tasks.publicMetadataText(text) && boundedSafe(text) };
+      if (code.nodes.some(node => canonicalMemorySymbolNode(node.id, context) !== node.id)) return unavailableMemoryCodeOverlay();
+      for (const note of code.notes) {
+        const row = memoryStore?.get(note.id.slice(4), memoryProject);
+        if (!row || `mem:${row.id}` !== note.id || !screenMemory([row]).length || !boundedSafe(JSON.stringify(row))) return unavailableMemoryCodeOverlay();
+      }
+      const seeds = memoryCodeSeeds.get(code) ?? new Set<string>();
+      const neighbours = code.nodes.map(node => node.id).filter(id => !seeds.has(id));
+      const rows = memoryStore && neighbours.length ? screenMemory(memoryStore.related(memoryProject, neighbours, 128)) : [];
+      const notes = rows.filter(row => row.about.some(id => neighbours.includes(id)) && boundedSafe(JSON.stringify(row)))
+        .sort((a, b) => Number(b.kind === "fail") - Number(a.kind === "fail") || b.at.localeCompare(a.at)).slice(0, 16)
+        .map(row => ({ id: `mem:${row.id}`, line: memoryLine(row), kind: row.kind, about: row.about, tier: row.tier, peer: row.peer, machine: row.machine, at: row.at }));
+      return { ...code, notes };
+    } catch { return unavailableMemoryCodeOverlay(); }
+  }
+  async function taskMemoryResult(task: import("../memory/brief.ts").BriefTask, cacheOnly = false) {
+    const maximum = config.memory.brief_items;
+    const current = () => task.id === undefined ? undefined : board.get(task.id), initial = current();
+    const valid = () => { const value = current(); return !!initial && !!value && value.created === task.created && value.updated === initial.updated && value.history.length === initial.history.length && value.owner === initial.owner && tasks.memoryCodeEligible(value) && !turns.get(value.owner ?? "")?.private && !contextPii(value.owner ?? ""); };
+    if (!memoryStore || initial && tasks.isPii(initial)) return { items: [], state: "unknown" as const };
+    const starts = taskNodes(task).filter(node => node.startsWith("symbol:"));
+    let code = unavailableMemoryCodeOverlay();
+    try { if (valid() && starts.length) { const prepared = await memoryCode(starts, valid, cacheOnly); if (valid()) code = currentMemoryCode(prepared); } }
+    catch { /* Optional code failure must not discard existing direct memory advice. */ }
+    checkMemory();
+    const latest = current(); if (latest && tasks.isPii(latest)) return { items: [], state: "unknown" as const };
+    // Optional code evidence never suppresses the existing direct path/title/symbol memory brief.
+    const direct = screenMemory(memoryStore.related(memoryProject, taskNodes(task), 128)).map(v => ({ id: `mem:${v.id}`, line: memoryLine(v), kind: v.kind, about: v.about }));
+    const items = [...new Map([...direct, ...code.notes].map(row => [row.id, row])).values()]
+      .filter(row => [row.line, ...(row.about ?? [])].every(tasks.publicMetadataText))
+      .sort((a, b) => Number(b.kind === "fail") - Number(a.kind === "fail") || Number(b.kind === "decision") - Number(a.kind === "decision"))
+      .slice(0, maximum);
+    return { items, state: starts.length ? code.state : "known" as const, ...(code.head ? { head: code.head } : {}) };
+  }
+  async function taskMemoryItems(task: import("../memory/brief.ts").BriefTask) { return (await taskMemoryResult(task)).items; }
 
   const leaseNoticed = new Set<string>();
   const goalLine = (g: GoalView) => `goal:${g.id.slice(0, 8)} ${g.state} ${g.title}${g.lease.holder ? ` (held by ${g.lease.holder === memoryStore?.machine.id ? "this machine" : `machine ${g.lease.holder.slice(0, 8)}`} until ${g.lease.until}${g.lease.conflict.length ? `; conflicting claim from ${g.lease.conflict.map((m) => m.slice(0, 8)).join(", ")}` : ""})` : ""}`;
@@ -1180,7 +1267,7 @@ export async function startDaemon(opts: DaemonOptions) {
   /** Session-start cross-platform recall. Awaited before the peer can receive anything, so it rides on the first delivery. Fail-open. */
   async function ensurePreface(peer: PeerId): Promise<void> {
     if ((!config.memory.enabled && !memoryStore) || recalled.has(peer) || reviewOnlyPeer(peer)) return; // #223 R2: no shared memory in a fresh review
-    // The hub's own long-term decisions, contracts and fails lead; claude-mem's recent work follows, each with half the budget.
+    // The hub's own long-term decisions, contracts and fails lead; amem's curated short-term notes follow, each with half the budget.
     let own: string | undefined;
     try {
       checkMemory();
@@ -1247,6 +1334,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const board = new Board(join(opts.stateDir, "hub.db"));
   const codeFacts = new CodeFacts();
   const reviewSymbols = new Map<string, CodeFactResult<CodeSymbol[]>>();
+  const memorySymbols = new Map<string, MemorySymbolNodes>();
   startupCleanup.push(() => board.close());
   startupCleanup.push(() => codeFacts.close());
   const supervision = new SupervisionFeed({
@@ -1460,8 +1548,23 @@ export async function startDaemon(opts: DaemonOptions) {
       const brief = buildReviewBrief(root, task.refs.commit, { privatePath: path => isDenied(path, config.local.deny) || matchesPolicy(root, path, config.pii?.paths ?? [], true), nameable: tasks.nameable });
       if ("unavailable" in brief) return;
       const key = JSON.stringify([root, brief.head, brief.mergeBase]);
-      reviewSymbols.set(key, await codeFacts.changedSymbols(root, brief.mergeBase, brief.head));
-      if (reviewSymbols.size > 64) reviewSymbols.delete(reviewSymbols.keys().next().value!);
+      // prepareOnly and completion share one exact-tree pass, including an unknown result.
+      if (memoryStore && memorySymbols.has(key)) return;
+      const observed = await codeFacts.changedSymbols(root, brief.mergeBase, brief.head);
+      reviewSymbols.set(key, observed);
+      const candidates = tasks.memorySymbolCandidates(task);
+      if (memoryStore && candidates && !tasks.isPii(board.get(task.id) ?? task)) {
+        const nodes = await resolveMemorySymbolNodes(candidates,
+          { cwd: root, project: memoryProject, repo: memoryRepo, deny: config.local.deny, allowed: tasks.publicMetadataText },
+          name => { const current = board.get(task.id); return !current || current.owner !== task.owner || tasks.isPii(current) ? Promise.resolve({ state: "unknown" }) : codeFacts.exists(root, brief.head, name); });
+        memorySymbols.set(key, nodes);
+      }
+      if (reviewSymbols.size > 64) { const oldest = reviewSymbols.keys().next().value!; reviewSymbols.delete(oldest); memorySymbols.delete(oldest); }
+    },
+    memorySymbolNodes: task => {
+      if (tasks.isPii(task) || !task.codeSymbols || task.codeSymbols.head !== task.refs.commit) return undefined;
+      const root = executionRoot(task.owner ?? "");
+      return memorySymbols.get(JSON.stringify([root, task.codeSymbols.head, task.codeSymbols.mergeBase]));
     },
     reviewBrief: task => {
       const root = executionRoot(task.owner ?? "");
@@ -1479,8 +1582,8 @@ export async function startDaemon(opts: DaemonOptions) {
     candidates, candidateScreen: screenMemory, privateTurn: peer => !!turns.get(peer)?.private || contextPii(peer),
     memoryCheck: checkMemory,
     ...(config.memory.enabled || memoryStore ? { briefs: new Briefs(config.memory.enabled ? memory : undefined, chain.at(-1)!, () => config.memory.brief_items,
-      memoryStore ? (t) => { checkMemory(); return screenMemory(memoryStore!.related(memoryProject, taskNodes(t), Number.MAX_SAFE_INTEGER)).slice(0, config.memory.brief_items).map((v) => ({ id: `mem:${v.id}`, line: memoryLine(v), kind: v.kind, about: v.about })); } : undefined,
-      (peer, task, counts) => event({ type: "memory_brief", peer, task, ...counts }),
+      memoryStore ? taskMemoryItems : undefined,
+      (peer, task, counts) => event({ type: "memory_brief", source: "amem", peer, task, ...counts }),
       items => { const stale = staleness(); return items.map(item => `${item.line}${stale(item.about ?? []) ? " (stale?)" : ""}`); }) } : {}),
     ...(memoryStore ? { planFails: (task: import("./board.ts").Task) => {
       checkMemory();
@@ -1915,11 +2018,18 @@ export async function startDaemon(opts: DaemonOptions) {
         cacheReadTokens: row.inputCacheRead, cacheWriteTokens: row.inputCacheCreation, totalTokens: kimiRowTotal(row),
         ...taskAttribution(peer), ...(row.model ? { servedModel: row.model } : {}) });
     },
-    report: (peer, window) => budget.report(peer, [{ id: "tokens", used: window.used, resetsAt: window.resetsAt, source: `hub count, kimi wire log, of kimi_tokens_5h ${window.ceiling}` }]),
-    forget: peer => budget.forget(peer, "tokens"),
+    report: (peer, window) => budget.report(peer, [{ id: "tokens", kind: "count", used: window.used, resetsAt: window.resetsAt, source: `hub count, kimi wire log, of kimi_tokens_5h ${window.ceiling}` }]),
+    forget: peer => budget.forget(peer, "tokens", "count"),
     notice: line => notify(line),
   });
   kimiUsage.seed(kimiSeedRows(startupEvents, Math.max(0, ...startupEvents.flatMap(e => e.type === "budget_resume" && definitionOf(e.peer)?.budget?.resetSoftTokensOnResume ? [Date.parse(e.at)] : []).filter(Number.isFinite))));
+  /** Why a peer shows no number (no quota, nothing read yet): one line each, from the definition and the counters, never from a log's text. */
+  const budgetPeerNotes = (): BudgetPeerNote[] => {
+    const quota = budget.status();
+    const peers = [...new Set([...bus.knownPeers().filter(peer => bus.peers.has(peer) && bus.stateOf(peer) !== "offline"), ...Object.keys(quota)])].filter(peer => peer !== USER && peer !== HUB);
+    return budgetNotes({ peers, windows: peer => quota[accountOf(peer)]?.windows.length ?? 0, definition: peer => definitionOf(peer), softTokens: () => kimiUsage.status(),
+      hubTokens5h: peer => hubTokenWindows.get(peer)?.sum(Date.now()) });
+  };
   /** A peer whose definition keeps host-owned soft token accounting (Kimi): its rows are read at a turn start (the floor), a turn end and a usage_update. */
   const softTokenPeer = (peer: PeerId): boolean => !!definitionOf(peer)?.budget?.resetSoftTokensOnResume;
   const collectKimiUsage = (peer: PeerId): void => { if (!softTokenPeer(peer)) return; try { kimiUsage.collect(peer); } catch (error) { log(`kimi usage: ${(error as Error).name}`); } };
@@ -2145,7 +2255,16 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   /** Tokens a peer used, as increments. */
   let codexUsageSeq = 0; // per hub run: with the run id and peer it names one usage record
+  // #285 AC6: a peer with no provider quota (Pi, local) still shows what the hub counted for it in the last 5 h, as information, never as a meter or a gate.
+  const hubTokenWindows = new Map<PeerId, TokenWindow>();
+  const noQuotaPeer = (peer: PeerId): boolean => !!definitionOf(peer)?.budget?.noQuotaReason;
+  const hubTokenWindow = (peer: PeerId): TokenWindow => hubTokenWindows.get(peer) ?? hubTokenWindows.set(peer, new TokenWindow(5 * 3_600_000)).get(peer)!;
+  // Replayed through `seed`, which skips rows older than 5 h before inserting any: a long-lived project's whole log costs one pass, not one search per row.
+  const seedNow = Date.now(), seedRows = new Map<PeerId, { at: number; n: number }[]>();
+  for (const e of startupEvents) if (e.type === "tokens" && noQuotaPeer(e.peer)) (seedRows.get(e.peer) ?? seedRows.set(e.peer, []).get(e.peer)!).push({ at: Date.parse(e.at), n: e.n });
+  for (const [peer, rows] of seedRows) hubTokenWindow(peer).seed(rows, seedNow);
   const addTokens = (peer: PeerId, n: number, task?: number): number => {
+    if (n > 0 && noQuotaPeer(peer)) hubTokenWindow(peer).add(Date.now(), Math.round(n));
     const supervisionTurn = supervisionTurns.get(peer);
     if (supervisionTurn && Number.isFinite(n) && n >= 0) supervisionTurn.tokens = (supervisionTurn.tokens ?? 0) + n;
     if (n > 0) {
@@ -2356,10 +2475,10 @@ export async function startDaemon(opts: DaemonOptions) {
       return JSON.stringify(shown ? { ...reviewerView(by, result as Record<string, unknown>), ...briefField(shown) } : result);
     }
     // Inside a PII turn the worker's words may carry the PII whatever they are attached to: a note would go to
-    // claude-mem (a cloud observer) and a new task could be routed to a cloud peer without matching any pattern.
+    // shared memory and a new task could be routed to a cloud peer without matching any pattern.
     if (piiTurn && (MEMORY_READ_TOOLS.has(op) || op === "hub_memory_correct" || op === "hub_remember" || op === "hub_task_propose" || op === "hub_sdlc_record" || op === "hub_plan_review" || op === "hub_sdlc_costs" || op === "hub_sdlc_metrics" || op.startsWith("hub_release_") || op === "hub_backlog_return_untouched" || op === "hub_backlog_plan" || op === "hub_backlog_undo" || op === "hub_backlog_pull" || op === "hub_backlog_split" || op === "release_new")) throw new PreEffectToolRefusal(`${op} is not available while working on a PII task: its text must not leave this machine`);
     // The same words attached to an ordinary task would reach its reviewer, its owner, overlapping owners (a plan, the
-    // completed-change notice) and claude-mem. A turn that holds a PII task acts on ordinary tasks in a turn of its own.
+    // completed-change notice) and shared memory. A turn that holds a PII task acts on ordinary tasks in a turn of its own.
     if (piiTurn && (op === "hub_task_done" || op === "hub_review" || (op === "hub_task_accept" && (a.plan != null || a.refs != null)))) {
       const target = board.get(Number(a.id));
       if (target && !tasks.isPii(target)) throw new PreEffectToolRefusal(`${op} on task #${target.id} is not available while working on a PII task: its text would reach other peers; do it in a turn without the PII task`);
@@ -2381,9 +2500,17 @@ export async function startDaemon(opts: DaemonOptions) {
       if (a.owner && a.owner !== by) need("assign", "hand tasks to other peers");
     }
     if (MEMORY_READ_TOOLS.has(op)) {
+      validateMemoryRead(op, a);
       need("memory_read", "read shared memory");
+      if (!boundedSafe(JSON.stringify(a))) throw new PreEffectToolRefusal("memory read unavailable");
       checkMemory();
-      return memoryRead(memoryStore, memoryProject, screenMemory, op, a, staleness());
+      const generation = connectionGeneration(by);
+      const valid = () => may(by, "memory_read") && connectionGeneration(by) === generation && !turns.get(by)?.private && !contextPii(by);
+      const symbolStarts = op === "hub_memory_graph" ? (a.starts as string[]).filter(node => node.startsWith("symbol:")) : [];
+      const code = symbolStarts.length ? await memoryCode(symbolStarts, valid).catch(() => unavailableMemoryCodeOverlay()) : undefined;
+      if (!valid()) throw new PreEffectToolRefusal("memory read unavailable");
+      checkMemory();
+      return memoryRead(memoryStore, memoryProject, screenMemory, op, a, staleness(), code ? currentMemoryCode(code) : undefined);
     }
     if (op === "hub_memory_correct") { need("memory_correct", "propose memory corrections"); return tasks.correct(by, a); }
     if (op === "hub_remember") need("remember", "save notes to shared memory");
@@ -2568,7 +2695,7 @@ export async function startDaemon(opts: DaemonOptions) {
           chmodSync(`${file}.tmp`, 0o600);
           renameSync(`${file}.tmp`, file);
           pending.done(summary);
-          if (config.memory.enabled) await memory.save({ text: summary, title: `agent-hub ${by} context checkpoint`, project: opts.cwd, metadata: { peer: by, kind: "handover" } }).catch(() => undefined);
+          if (config.memory.enabled) await memory.save({ text: summary, title: `agent-hub ${by} context checkpoint`, project: memoryProject, metadata: { peer: by, kind: "handover" } }).catch(() => undefined);
           notify(`context: ${by} checkpoint saved locally; no tasks or session changed`);
           return "context checkpoint saved locally; keep your tasks and session, the operator decides the next step";
         }
@@ -2630,13 +2757,21 @@ export async function startDaemon(opts: DaemonOptions) {
         const { codeSymbols: _storedCodeSymbols, ...detail } = task;
         const codeSymbols = tasks.publicView(task).codeSymbols;
         const consoleDeliverables = await tasks.deliverableStatus(task);
-        return JSON.stringify({ ...detail, ...(codeSymbols ? { codeSymbols } : {}), ...(consoleDeliverables ? { deliverables: consoleDeliverables } : {}), symbolOverlaps: tasks.symbolOverlaps(task), flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) }, null, 2);
+        const related = tasks.isPii(task) ? undefined : await taskMemoryResult(task, true).catch(() => ({ items: [], state: "unknown" as const }));
+        const fresh = board.get(task.id);
+        const relatedMemory = related && fresh?.updated === task.updated && !tasks.isPii(fresh) ? { state: related.state, count: related.items.length, ...("head" in related ? { head: related.head } : {}) } : { state: "unknown" };
+        return JSON.stringify({ ...detail, relatedMemory, ...(codeSymbols ? { codeSymbols } : {}), ...(consoleDeliverables ? { deliverables: consoleDeliverables } : {}), symbolOverlaps: tasks.symbolOverlaps(task), flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) }, null, 2);
+      }
+      case "deliverables": {
+        // #317 (`ahub deliverables`): the board's deliverable records, person only. `check` measures the files now; without it nothing is opened.
+        if (a.task !== undefined && (!Number.isSafeInteger(a.task) || (a.task as number) <= 0)) throw new PreEffectToolRefusal("task must be a positive integer");
+        return JSON.stringify(await tasks.deliverableList({ ...(a.task !== undefined ? { task: a.task as number } : {}), approvedOnly: a.approved === true, check: a.check === true }));
       }
       case "task_assign":
       case "task_assign_checked": {
         const peer = peerArg(a.peer, "peer");
         if (!peer) throw new Error("peer is required");
-        if (a.role !== undefined && a.role !== "owner" && a.role !== "reviewer") throw new Error("role must be owner or reviewer");
+        if (a.role !== undefined && a.role !== "owner" && a.role !== "reviewer" && a.role !== "planner") throw new Error("role must be owner, reviewer or planner");
         if (op === "task_assign_checked" && (typeof a.revision !== "number" || !Number.isSafeInteger(a.revision) || a.revision < 0)) throw new Error("revision must be a nonnegative integer");
         return line(await tasks.assignTo(a.id, peer, USER, true, a.role, op === "task_assign_checked" ? a.revision : undefined));
       }
@@ -2714,7 +2849,13 @@ export async function startDaemon(opts: DaemonOptions) {
       else delete defaultSources[peer];
     }
   };
-  const actionBudgets = new ActionBudgets(() => config.action_policy, contextSession);
+  // Action allowances have their own host session port; adding local here must not change checkpoints, context telemetry or supervision.
+  const actionSession = (peer: PeerId): string | undefined => {
+    const owner = bus.peers.get(peer);
+    if (isLocalPeer(owner)) { const id = owner.recoveryMetadata().sessionId; return typeof id === "string" ? id : undefined; }
+    return contextSession(peer);
+  };
+  const actionBudgets = new ActionBudgets(() => config.action_policy, actionSession);
   // #636 slice 2: the always-ask gate of an ACP peer, built per peer from the host's own ports (root, task, PII screen); never from the agent.
   const acpActionGate = (peer: PeerId) => actionGate({ budgets: actionBudgets, policy: () => config.action_policy, root: executionRoot,
     task: p => board.list("in_progress").find(t => t.owner === p), publicView: task => tasks.publicView(task), isPrivate: p => !!turns.get(p)?.private || contextPii(p),
@@ -2733,11 +2874,18 @@ export async function startDaemon(opts: DaemonOptions) {
       return { enforced: true };
     }
     const owner = bus.peers.get(peer);
+    if (definitionOf(peer)?.start.daemonPort === "claude-implementer") {
+      const generation = owner?.sessionGeneration;
+      return owner?.state === "busy" && typeof generation === "string" && generation.length > 0 ? { enforced: true } : { enforced: false, reason: "no current managed Claude implementer child" };
+    }
+    if (isCodexPeer(owner)) return { enforced: false, reason: owner.actionGated ? "Codex approval RPCs are gated, but native policy can execute without sending one (never-ask sends approvalPolicy never)" : "this Codex proxy has no hub approval gate" };
+    if (isLocalPeer(owner)) return owner.state !== "offline" ? { enforced: true } : { enforced: false, reason: "the local worker is offline" };
+    if (isPiPeer(owner)) return owner.state !== "offline" && owner.acceptingTools ? { enforced: true } : { enforced: false, reason: "Pi has no verified live tool bridge" };
     if (isAcpPeer(owner) && owner.actionGated) {
       const mode = owner.permissionModeState;
       return mode === "ask" ? { enforced: true } : { enforced: false, reason: mode === "unknown" || mode === "unmanaged" ? "its native approval mode is not managed by the hub, so a request may never be sent" : `its native mode ${mode} sends no request for a call it allows` };
     }
-    return { enforced: false };
+    return { enforced: false, reason: "this adapter has no hub pre-tool approval path" };
   };
   const permissionMode = (peer: string): PermissionMode => permissionModes.get(peer) ?? "ask";
   const permissionModeSources = new Map(Object.entries(defaultSources).map(([peer, value]) => [peer, value.source]));
@@ -3018,6 +3166,7 @@ export async function startDaemon(opts: DaemonOptions) {
     ...(() => { const warning = mainCheckoutWarning(opts.cwd, tasks.publicMetadataText, checkoutBranch); return warning ? { mainCheckout: warning } : {}; })(),
     startModes: Object.fromEntries([...START_MODE_PEERS, ...configuredIds].map(peer => [peer, startModeOf(config.peers, peer, declarations, adapterCatalog)])),
     memoryProfile: memoryProfileStatus(includeAttentionItems),
+    memoryRead: memory.readStatus(),
     lifecycleStages: [...lifecycleConfig.stages],
     // ponytail: off keeps the #257 phase schema until RETIRED_WORKFLOW_FROM, when the alias and this flag go together.
     ...(lifecycleConfig.mode !== "off" ? { lifecycleCriteria: true } : {}),
@@ -3589,6 +3738,28 @@ export async function startDaemon(opts: DaemonOptions) {
     const result = await requestPermission(req, signal);
     return result.outcome === "answered" ? result.optionId : undefined;
   }
+  /** The managed local/Pi execution boundary: a classed call asks before any native mode or tool-wide grant. */
+  async function classedToolPermission(peer: string, root: string, title: string, tool: string | undefined, input: unknown, signal: AbortSignal | undefined, current: () => boolean, observe?: ApprovalObserver): Promise<ToolApproval | undefined> {
+    if (!tool || input === undefined) return undefined;
+    if (stopping || signal?.aborted || !current()) return "aborted";
+    // runTool executes in this host root and ignores model-supplied cwd/workdir fields.
+    const effective = input && typeof input === "object" && !Array.isArray(input) ? { ...input, cwd: root, workdir: root } : input;
+    let gate: ActionGateVerdict | undefined;
+    try { gate = acpActionGate(peer)({ names: [tool], input: effective }, actionSession(peer) ?? "", title); }
+    catch { gate = { title: "Action approval: the always-ask check failed; command withheld", denyOnly: true }; }
+    if (!gate) return undefined;
+    const options: PermissionRequest["options"] = [{ optionId: "allow", name: "Allow once", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }];
+    if (gate.denyOnly) options.splice(0, 1);
+    if (!gate.denyOnly && gate.budget) options.push({ optionId: ACTION_BUDGET_OPTION, name: `Allow ${gate.budget.label} for this session`, kind: "allow_once" });
+    const picked = await requestPermission({ peer, title: gate.title, tool, classed: true, options }, signal, observe);
+    if (picked.outcome === "expired") return "expired";
+    if (stopping || signal?.aborted || !current()) return "aborted";
+    if (picked.outcome !== "answered") return false;
+    if (!gate.denyOnly && picked.optionId === ACTION_BUDGET_OPTION) {
+      try { return gate.budget?.approve() === true; } catch { return false; }
+    }
+    return !gate.denyOnly && picked.optionId === "allow";
+  }
   async function requestPermission(req: PermissionRequest, signal?: AbortSignal, observe?: ApprovalObserver): Promise<PermissionResult> {
     const requestEpoch = permissionAnswerEpoch(req.peer);
     const observed = (source: "person" | "automatic" | "expired" | "aborted") => {
@@ -4080,9 +4251,11 @@ export async function startDaemon(opts: DaemonOptions) {
     if (adapter?.start.daemonPort === "codex-appserver") {
       if (args.unattended && permissionMode(peer) !== "ask") return { ok: false, error: "Codex --unattended cannot take a non-ask mode; run ahub permission codex ask first, or restart without --unattended" };
       let codexSteering = false;
+      actionBudgets.revoke(peer);
       const codex: CodexPeer = adapter!.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["codex-appserver"]({
         admitAttach: () => membershipAllowed(peer),
         permissionMode: permissionMode(peer),
+        actionGate: acpActionGate(peer), onPermission,
         onTokens: (added) => void addTokens(peer, added),
         // #683 U1: the same update split into Codex's own kinds, next to the unchanged `tokens` event. One record per update:
         // the id names the hub run, peer and a per-run sequence, so it is unique across restarts. It never carries the native thread: usage telemetry has no session id (docs/events.md).
@@ -4181,7 +4354,11 @@ export async function startDaemon(opts: DaemonOptions) {
       let piReply: Envelope | undefined;
       // Tools the person allowed "always" for this Pi start; a new start gets a new set (#209).
       const piAlways = new Set<string>();
-      const piPermit = async (title: string, tool: string, signal?: AbortSignal, path?: string, valid: () => boolean = () => true, observe?: ApprovalObserver, originalPath?: string): Promise<ToolApproval> => {
+      actionBudgets.revoke(peer);
+      const piPermit = async (title: string, tool: string, signal?: AbortSignal, path?: string, valid: () => boolean = () => true, observe?: ApprovalObserver, originalPath?: string, input?: unknown): Promise<ToolApproval> => {
+        if (stopping || signal?.aborted || !valid() || !pi.acceptingTools || bus.peers.get(peer) !== pi) return "aborted";
+        const classed = await classedToolPermission(peer, executionCwd, title, tool, input, signal, () => valid() && pi.acceptingTools && bus.peers.get(peer) === pi, observe);
+        if (classed !== undefined) return classed;
         if (stopping || signal?.aborted || !valid() || !pi.acceptingTools || bus.peers.get(peer) !== pi) return "aborted";
         const selected = permissionMode(peer);
         if (selected === "never-ask" || (selected === "ask-when-needed" && PI_EDIT_TOOLS.has(tool) && !!path && grantablePath(realPath(executionCwd), path, originalPath, config.protect_instruction_files))) {
@@ -4231,8 +4408,8 @@ export async function startDaemon(opts: DaemonOptions) {
             const nativeTurn = pi.observationTurn;
             const output = TASK_TOOL_NAMES.has(name) || CONDUCTOR_TOOL_NAMES.has(name) ? await taskOp(peer, name, raw as Record<string, unknown>, true) : await runTool(name, JSON.stringify(raw), { ...ctx, signal,
               ...(humanBash ? { onProcessExit: (code: number | null) => { exitCode = code; } } : {}),
-              permit: async (title, tool, toolSignal, path, _observe, originalPath) => {
-                const picked = humanBash ? (toolSignal?.aborted || context?.isCurrent() !== true ? "aborted" : true) : await piPermit(title, tool ?? name, toolSignal, path, context?.isCurrent, context?.onApproval, originalPath);
+              permit: async (title, tool, toolSignal, path, _observe, originalPath, input) => {
+                const picked = humanBash ? (toolSignal?.aborted || context?.isCurrent() !== true ? "aborted" : true) : await piPermit(title, tool ?? name, toolSignal, path, context?.isCurrent, context?.onApproval, originalPath, input);
                 return picked; // never turn a nonempty expiry/abort string into authorization
               },
             });
@@ -4342,9 +4519,13 @@ export async function startDaemon(opts: DaemonOptions) {
       if (existing?.state === "busy") return { ok: false, error: "local is busy; retry when it is idle" };
       if (existing) { mute(existing); await existing.stop(); }
       const capture = config.memory.enabled
-        ? new Capture(memory, { project: chain.at(-1)!, cwd: executionCwd, skip: skipTools(), deny: config.local.deny })
+        ? new Capture(memory, { project: memoryProject, cwd: executionCwd, deny: config.local.deny })
         : undefined;
-      const permit = async (title: string, tool?: string, signal?: AbortSignal, path?: string, observe?: ApprovalObserver, originalPath?: string): Promise<ToolApproval> => {
+      actionBudgets.revoke(peer);
+      const permit = async (title: string, tool?: string, signal?: AbortSignal, path?: string, observe?: ApprovalObserver, originalPath?: string, input?: unknown): Promise<ToolApproval> => {
+        if (stopping || signal?.aborted || bus.peers.get(peer) !== local) return "aborted";
+        const classed = await classedToolPermission(peer, executionCwd, title, tool, input, signal, () => bus.peers.get(peer) === local, observe);
+        if (classed !== undefined) return classed;
         if (stopping || signal?.aborted || bus.peers.get(peer) !== local) return "aborted";
         const selected = permissionMode(peer);
         if (selected === "never-ask" || (selected === "ask-when-needed" && !!tool && PI_EDIT_TOOLS.has(tool) && !!path && grantablePath(realPath(executionCwd), path, originalPath, config.protect_instruction_files))) {
@@ -4567,7 +4748,7 @@ export async function startDaemon(opts: DaemonOptions) {
           const summary = bus.queueSummary(peer);
           return { peer, state: bus.stateOf(peer), attached: !!bus.peers.get(peer) && bus.peers.get(peer)!.state !== "offline", queued: bus.queued(peer), needsReview: summary.needsReview,
             manualHeld: manualPaused.has(peer), hold: conductorHolds.get(peer), budgetPause: quota[accountOf(peer)]?.paused ?? null,
-            ...(quota[accountOf(peer)] ? { windows: quota[accountOf(peer)]!.windows.map(w => ({ id: w.id, ...(w.stale || (w.resetsAt !== undefined && w.resetsAt <= Date.now()) ? {} : { used: w.used }), resetsAt: w.resetsAt, at: w.at, source: w.source })) } : {}) };
+            ...(quota[accountOf(peer)] ? { windows: quota[accountOf(peer)]!.windows.map(w => ({ id: w.id, ...(w.stale || (w.resetsAt !== undefined && w.resetsAt <= Date.now()) ? {} : { used: w.used }), resetsAt: w.resetsAt, at: w.at, source: w.source, kind: w.kind, ...(w.superseded ? { superseded: true } : {}) })) } : {}) };
         }),
         taskCounts: board.counts(), approvals: [...permissions.values()].map(p => ({ peer: p.peer, tool: p.tool, at: p.createdAt })),
       };
@@ -4664,9 +4845,25 @@ export async function startDaemon(opts: DaemonOptions) {
         entries: rows.map((v) => shape(v)), ...(node ? { node, graph: memoryStore.graph(memoryProject, node, hops, 200), ...(selected ? { detail: shape(selected, true) } : {}) } : {}) } };
     } catch (e) { log(`hub memory view failed: ${(e as Error).message}`); return {}; } // an unreadable store never breaks the dashboard
   }
+  async function uiMemorySnapshot(after: number, input?: Record<string, unknown>, session?: DashboardSession) {
+    const query = input?.memory as Record<string, unknown> | undefined;
+    const start = input?.view === "memory" && query && query.codeNeighbours === true && typeof query.node === "string" && query.node.startsWith("symbol:") && Buffer.byteLength(query.node) <= 512 ? query.node : undefined;
+    const code = start ? await memoryCode([start]).catch(() => unavailableMemoryCodeOverlay()) : undefined;
+    const snapshot = uiSnapshot(after, input, session);
+    if (code && "memory" in snapshot && snapshot.memory && typeof snapshot.memory === "object") {
+      const published = currentMemoryCode(code), tier = query?.tier === "goals" ? "goals" : query?.tier === "short" ? "short" : "long";
+      const search = typeof query?.q === "string" ? query.q.toLowerCase() : undefined;
+      published.notes = published.notes.filter(note => note.tier === tier && (!query?.kind || note.kind === query.kind) && (!query?.peer || note.peer === query.peer) && (!query?.machine || note.machine === query.machine)
+        && (!query?.since || typeof query.since !== "string" || !note.at || note.at >= query.since)
+        && (!search || (() => { const row = memoryStore?.get(note.id.slice(4), memoryProject); return !!row && `${row.title ?? ""} ${row.text}`.toLowerCase().includes(search); })()));
+      Object.assign(snapshot.memory, { code: published });
+    }
+    return snapshot;
+  }
   function uiSnapshot(after: number, _input?: Record<string, unknown>, session?: DashboardSession) {
     const quota = budget.status();
     const peers = [...new Set([...Object.keys(quota), ...bus.knownPeers()])];
+    const budgetNoteOf = new Map(budgetPeerNotes().map(note => [note.peer, note] as const));
     // #264 (phase 3): turn, checking and links are additive optional fields that older pages ignore,
     // so PROTOCOL and EVENTS_SCHEMA stay unchanged. They carry ids and enums only.
     const turnView = (peer: PeerId) => {
@@ -4744,10 +4941,10 @@ export async function startDaemon(opts: DaemonOptions) {
       tasks: boardTasks.map((task) => {
         const view = tasks.publicView(task);
         // Refs and history can themselves quote private text. The dashboard needs neither.
-        return { id: task.id, title: view.title, detail: view.detail, class: task.class, ...(task.profile ? { profile: task.profile, profileClass: task.profileClass } : {}), ...(task.role ? { role: task.role } : {}), state: task.state, owner: task.owner, reviewer: task.reviewer, deps: view.deps ?? [], ...(task.reserved ? { reserved: task.reserved } : {}), planningRevision: task.planningRevision ?? 0, rank: task.rank ?? null, priority: task.priority ?? null, release: task.release ?? null, plannedStart: task.plannedStart ?? null, due: task.due ?? null, pinned: task.pinned === true, actualDates: view.actualDates, ...(view.codeSymbols ? { codeSymbols: view.codeSymbols } : {}), ...(() => { const group = codeGroup(task, view.codeSymbols, task.plan?.symbols, tasks.publicMetadataText, tasks.isPii(task)); return group ? { codeGroup: group } : {}; })(), ...(view.cancelled ? { cancelled: view.cancelled } : {}), ...(view.external ? { external: view.external } : {}), started: taskHasStarted(task), urgent: task.signals.includes("urgent"), updated: task.updated, reworkRound: task.history.filter(entry => entry.event === "changes_requested").length, checking: tasks.isChecking(task.id), ...(view.lifecycle ? { lifecycle: view.lifecycle } : {}) };
+        return { id: task.id, title: view.title, detail: view.detail, class: task.class, ...(task.profile ? { profile: task.profile, profileClass: task.profileClass } : {}), ...(task.role ? { role: task.role } : {}), state: task.state, owner: task.owner, reviewer: task.reviewer, deps: view.deps ?? [], ...(task.reserved ? { reserved: task.reserved } : {}), planningRevision: task.planningRevision ?? 0, rank: task.rank ?? null, priority: task.priority ?? null, release: task.release ?? null, plannedStart: task.plannedStart ?? null, due: task.due ?? null, pinned: task.pinned === true, actualDates: view.actualDates, ...(view.codeSymbols ? { codeSymbols: view.codeSymbols } : {}), ...(() => { const group = codeGroup(task, view.codeSymbols, task.plan?.symbols, tasks.publicMetadataText, tasks.isPii(task)); return group ? { codeGroup: group } : {}; })(), ...(view.cancelled ? { cancelled: view.cancelled } : {}), ...(view.external ? { external: view.external } : {}), started: taskHasStarted(task), urgent: task.signals.includes("urgent"), updated: task.updated, reworkRound: task.history.filter(entry => entry.event === "changes_requested").length, checking: tasks.isChecking(task.id), ...(view.lifecycle ? { lifecycle: view.lifecycle } : {}), ...(() => { const deliverables = tasks.deliverableBadge(task); return deliverables ? { deliverables } : {}; })() };
       }),
       links: links.filter(link => link.tasks.every(id => { const task = board.get(id); return task && !tasks.isPii(task); })),
-      budget: Object.fromEntries(peers.map((id) => [id, { ...(quota[accountOf(id)] ?? { windows: [] }), context: contexts.view(id, contextSession(id), bus.peers.has(id) && ["idle", "busy", "paused"].includes(bus.stateOf(id))) }])),
+      budget: Object.fromEntries(peers.map((id) => [id, { ...(quota[accountOf(id)] ?? { windows: [] }), ...(budgetNoteOf.get(id) ? { note: budgetNoteOf.get(id)!.note, noteKind: budgetNoteOf.get(id)!.kind } : {}), context: contexts.view(id, contextSession(id), bus.peers.has(id) && ["idle", "busy", "paused"].includes(bus.stateOf(id))) }])),
       permissions: [...permissions.values()].map(({ push }) => {
         const req = JSON.parse(push);
         // Local tool titles quote file contents and commands, including those of PII turns.
@@ -4804,7 +5001,7 @@ export async function startDaemon(opts: DaemonOptions) {
   function roleHolders(candidate: HubConfig): { planners: string[]; conductors: string[] } {
     // A valid transfer may briefly have two conductors while its leaves are planned. Validate the final map later.
     const policy = Object.fromEntries(Object.entries(candidate.roles).map(([peer, roles]) => [peer, roles.filter(role => role !== "conductor")]));
-    const settled = resolveSettledRoles(policy, candidate.planner, peer => projectRosterAllows(candidate.roster, peer, candidate.pi.enabled));
+    const settled = resolveSettledRoles(policy, candidate.planner, peer => projectRosterAllows(candidate.roster, peer, candidate.pi.enabled), peer => plannerEligible.has(peer));
     return { planners: settled.planners, conductors: Object.keys(candidate.roles).filter(peer => candidate.roles[peer]!.includes("conductor")).sort() };
   }
   function prepareConfiguration(sources: ConfigSources, authority: SettingAuthority, scope?: string, confirmed: readonly string[] = []) {
@@ -5061,7 +5258,7 @@ export async function startDaemon(opts: DaemonOptions) {
       },
     });
     const undo = pendingUndo(opts.stateDir);
-    const planner = `In force: ${plannerPeers().join(", ") || "nobody"} (${plannerSource}). Setting it makes that peer the only planner; agents cannot change it.`;
+    const planner = `In force: ${plannerPeers().join(", ") || "nobody"} (${plannerSource}). Setting it pins the listed peers as the only planners; new tasks select one of those holders. Agents cannot change this setting.`;
     return { pendingRestart: allPendingRestart(), retainedConfig, rows: rows.map(row => row.key === "planner" ? { ...row, hint: planner } : row), ...(undo ? { undo } : {}) };
   }
   /** The same announcement whatever surface made the change: events.jsonl, hub.log and every open console. */
@@ -5477,6 +5674,8 @@ export async function startDaemon(opts: DaemonOptions) {
       if (configuredIds.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("configured_acp"))) return "target lacks configured_acp; project adapter definitions cannot be preserved by that daemon";
       if (extraIds.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("peer_instances"))) return "target lacks peer_instances; declared instance identities cannot be restored by that daemon";
       if (extraIds.some(id => adapterCatalog.definitionOf(declarations[id]!.kind)?.transport === "claude-channel" && declarations[id]!.roles?.includes("implementer")) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("role_stages"))) return "target lacks role_stages; declared Claude implementer authority cannot be restored by that daemon";
+      if ((Array.isArray(config.planner) || typeof config.planner === "string" && extraIds.includes(config.planner) || extraIds.some(id => declarations[id]!.roles?.includes("planner")) || board.hasPlannerState())
+        && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("task_planners"))) return "target lacks task_planners; configured or persisted planner authority cannot be restored by that daemon";
       if (board.releases().some(release => release.train && ["active", "frozen"].includes(release.state)) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("release_trains"))) return "target lacks release_trains; active or frozen train safeguards cannot be preserved";
       if ((extraIds.some(id => !!definitionOf(id)?.reviewer) || config.review.pool !== undefined) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("reviewer_pool"))) return "target lacks reviewer_pool; fresh review-only variants and pool policy cannot be preserved";
       return undefined;
@@ -6263,7 +6462,7 @@ export async function startDaemon(opts: DaemonOptions) {
       case "ui":
         if (c.role !== "console") return void reply({ t: "ui", ok: false, error: "ui is a console command" });
         try {
-          dashboard ??= startDashboard({ snapshot: uiSnapshot, action: uiAction });
+          dashboard ??= startDashboard({ snapshot: uiMemorySnapshot, action: uiAction });
           writeStatus();
           // #269: `ahub ui --settings` is the same person's command; its ticket marks the session it opens.
           if (msg.settings === true) notify("settings session opened from ahub ui --settings: for 15 minutes that dashboard session may change permission modes, routing and start settings");
@@ -6352,7 +6551,8 @@ export async function startDaemon(opts: DaemonOptions) {
       case "ui_snapshot":
         if (c.role !== "console") return void reply({ ok: false, error: "ui_snapshot is a console command" });
         if (!Number.isSafeInteger(msg.after ?? 0) || (msg.after ?? 0) < 0) return void reply({ ok: false, error: "invalid cursor" });
-        return void reply(uiSnapshot(msg.after ?? 0, msg.memory !== undefined || dashboardView(msg.view) ? { ...(msg.memory !== undefined ? { memory: msg.memory } : {}), ...(dashboardView(msg.view) ? { view: msg.view } : {}) } : undefined));
+        void uiMemorySnapshot(msg.after ?? 0, msg.memory !== undefined || dashboardView(msg.view) ? { ...(msg.memory !== undefined ? { memory: msg.memory } : {}), ...(dashboardView(msg.view) ? { view: msg.view } : {}) } : undefined).then(value => reply(value), () => reply({ ok: false, error: "memory view unavailable" }));
+        return;
       case "ui_action":
         if (c.role !== "console") return void reply({ ok: false, error: "ui_action is a console command" });
         if (recoveryActive()) return void reply({ ok: false, error: "recovery is holding mutations" });
@@ -6480,7 +6680,7 @@ export async function startDaemon(opts: DaemonOptions) {
             // Screened before the caps: withheld entries never crowd out readable evidence.
             const hits = screenMemory(memoryStore!.list({ project: memoryProject, limit: Number.MAX_SAFE_INTEGER })).map((v) => [v, score(v)] as const).filter(([, n]) => n > 0).sort((a, b) => b[1] - a[1]).slice(0, 6).map(([v]) => v);
             const near = screenMemory(memoryStore!.related(memoryProject, [...new Set(hits.flatMap((v) => v.about))], Number.MAX_SAFE_INTEGER)).slice(0, 6);
-            return [...hits, ...near].map((v) => ({ id: `mem:${v.id.slice(0, 8)}`, text: memoryLine(v).slice(13) }));
+            return [...hits, ...near].map((v) => ({ id: `mem:${v.id}`, text: memoryLine(v).slice(13) }));
           } } : {}),
           project: chain.at(-1)!,
           logFile,
@@ -6500,7 +6700,7 @@ export async function startDaemon(opts: DaemonOptions) {
                   project: chain.at(-1)!,
                   metadata: { peer: "hub", asked_by: USER, kind: "finding", source: "ahub ask" },
                 });
-                saved = ok ? "saved to shared memory as a model-written answer" : "memory worker unavailable; nothing saved";
+                saved = ok ? "saved as a candidate model-written answer; a person must review it" : "memory store unavailable; nothing saved";
               }
             }
             reply({ t: "ask", ok: true, ...res, ...(saved ? { saved } : {}) });
@@ -6510,7 +6710,7 @@ export async function startDaemon(opts: DaemonOptions) {
       case "budget":
         if (c.role !== "console") {
           if (msg.resume !== undefined || msg.set !== undefined) return void reply({ t: "budget", ok: false, error: "budget mutations are console commands" });
-          return void reply({ t: "budget", ok: true, budget: publicPeerBudget(budget.status(), text => tasks.nameable(text)), gate: config.budget.gate });
+          return void reply({ t: "budget", ok: true, budget: publicPeerBudget(budget.status(), text => tasks.nameable(text)), peers: budgetPeerNotes(), kimiSource: kimiUsage.status(), gate: config.budget.gate });
         }
         if (recoveryActive()) return void reply({ t: "budget", ok: false, error: "recovery is holding mutations" });
         if (msg.resume) {
@@ -6519,9 +6719,9 @@ export async function startDaemon(opts: DaemonOptions) {
           const used = Number(msg.set.used);
           if (!bus.peers.has(String(msg.set.peer)) && !budget.record(String(msg.set.peer))) return void reply({ t: "budget", ok: false, error: `unknown peer: ${msg.set.peer}` });
           if (!(used >= 0 && used <= 1)) return void reply({ t: "budget", ok: false, error: "used must be between 0 and 1" });
-          budget.report(String(msg.set.peer), [{ id: msg.set.window === "week" ? "week" : "5h", used, ...(msg.set.resetsInMs ? { resetsAt: Date.now() + Number(msg.set.resetsInMs) } : {}), source: "ahub budget set" }]);
+          budget.report(String(msg.set.peer), [{ id: msg.set.window === "week" ? "week" : "5h", kind: "manual", used, ...(msg.set.resetsInMs ? { resetsAt: Date.now() + Number(msg.set.resetsInMs) } : {}), source: "ahub budget set" }]);
         }
-        return void reply({ t: "budget", ok: true, budget: budget.status(), gate: config.budget.gate });
+        return void reply({ t: "budget", ok: true, budget: budget.status(), peers: budgetPeerNotes(), kimiSource: kimiUsage.status(), gate: config.budget.gate });
       case "usage": {
         // #683 U2: the console, the person and a configured planner read usage; every other agent is refused. Always answered (rid).
         const planner = c.role === "tools" && !!c.peer && !!config.roles[c.peer]?.includes("planner");
@@ -6626,6 +6826,7 @@ export async function startDaemon(opts: DaemonOptions) {
       executionBudget.close();
       syncStop.abort(); // a sync in flight kills its git step and ends before the store closes
       await syncRun?.catch(() => undefined);
+      memory.close();
       candidates?.close();
       memoryStore?.close();
       board.close();