@staix/agent-hub 0.15.0 → 0.17.0

package/src/hub/tasks.ts

@@ -1,3 +1,4 @@
+import { canonicalMemorySymbolNode, normalizeMemorySymbolInput, MEMORY_SYMBOL_LIMIT, type MemorySymbolNodes } from "./memory-symbols.ts";
 import { buildTaskCodeSymbols, publicTaskCodeSymbols, taskCodeSymbolsDisjoint, HOST_CODE_SYMBOLS } from "./task-code-symbols.ts";
 import { normalizePlanSymbol, symbolsOverlap } from "./symbol-normalizer.ts";
 import { publicTestIntegrity, readTestIntegrity, testIntegrityBlockers, type TestIntegrity } from "./test-integrity.ts";
@@ -28,7 +29,7 @@ import { isAbsolute, relative } from "node:path";
 import type { Briefs, NativeItem } from "../memory/brief.ts";
 import type { MemoryClient } from "../memory/client.ts";
 import { candidateTargetRevision, type CandidateInput, type CandidateStore, extractNodes, looksSecret, PROMOTED_KINDS, taskKey, type GoalView, type Kind, type MemoryStore, type Scope, type Tier } from "@staix/agent-mem";
-import { CLASSES, OUTCOMES_KEPT_MS, ALL_PLAN_KEYS, TASK_MOVE_REASONS, taskCanPlan, taskHasWorkEvidence, taskHasStarted, planningUndoEntry, isClosedTaskState, type TaskStall, type HistoryEntry, type ReviewerHistory, type Board, type Task, type TaskClass, type TaskMoveReason, type TaskPlan, type TaskRefs } from "./board.ts";
+import { CLASSES, OUTCOMES_KEPT_MS, ALL_PLAN_KEYS, TASK_MOVE_REASONS, taskCanPlan, taskHasWorkEvidence, taskHasStarted, planningUndoEntry, isClosedTaskState, type TaskStall, type HistoryEntry, type ReviewerHistory, type Board, type Task, type TaskClass, type TaskMoveReason, type TaskPlan, type TaskRefs, type PlannerBinding } from "./board.ts";
 import type { Bus } from "./bus.ts";
 import { HUB, newEnvelope, NOTE_KINDS, noteLine, sanitize, USER, type Envelope, type PeerId, type PeerState } from "./envelope.ts";
 import type { PiiVerdict, ScreenItem, ScreenRecord } from "./inference.ts";
@@ -43,9 +44,9 @@ import { coverageGap, renderReviewBrief, type ReviewBrief } from "./review-brief
 import { definitionOf as builtinDefinitionOf } from "../adapters/registry.ts";
 import { ADAPTERS, DEFAULT_REVIEW_POOL, definitionOf, familyOf, type ProjectAdapterCatalog } from "../adapters/registry.ts";
 import { plannerGrooming, nextSweep, taskSweepConfig, type TaskSweepConfig, type SweepRecord } from "./task-sweep.ts";
-import { linkedReceipt, openPrFor, readPrCostHistory, readReviewReadiness, reviewReadinessFromEvidence, type PrEvidence, type ReviewReadiness, readPlanIssueMetadata, canonicalStage, checklistOf, readSdlcPr, readSpecEdit, sdlcConfig, sdlcReceipt, sdlcStatus, specState, SPEC_STATE_TEXT, stageDefinition, lifecycleStage, type SdlcConfig, type PlanIssueMetadata, sdlcGh, type SdlcGh, type SdlcStatus, type SpecEdit, type SpecState } from "./sdlc.ts";
+import { planningIssueReceipt, linkedReceipt, openPrFor, readPrCostHistory, readReviewReadiness, reviewReadinessFromEvidence, type PrEvidence, type ReviewReadiness, readPlanIssueMetadata, canonicalStage, checklistOf, readSdlcPr, readSpecEdit, sdlcConfig, sdlcReceipt, sdlcStatus, specState, SPEC_STATE_TEXT, stageDefinition, lifecycleStage, type SdlcConfig, type PlanIssueMetadata, sdlcGh, type SdlcGh, type SdlcStatus, type SpecEdit, type SpecState } from "./sdlc.ts";
 
-export type TaskAssignmentRole = "owner" | "reviewer";
+export type TaskAssignmentRole = "owner" | "reviewer" | "planner";
 
 export interface ReleaseWindow { at: number; host: boolean; quota: boolean; idle: boolean; reasons: string[]; current?: () => boolean; close?: () => Promise<void>; }
 
@@ -56,6 +57,8 @@ export interface TasksDeps {
   /** Effective per-peer planner capacity, taken from the existing settings loader. */
   wipLimit?: (peer: PeerId) => number;
   recordPlanning?: (change: { by: string; task?: number; release?: number; fields: string[]; revision: number }) => void;
+  /** The clock of the planner board-changed notice window (#758); tests inject one. Absent: `Date.now`. */
+  now?: () => number;
   board: Board;
   bus: Bus;
   routing: () => Routing;
@@ -87,6 +90,8 @@ export interface TasksDeps {
   /** #520: the review brief for a task's commit (git only, bounded); undefined when the task names no commit. */
   prepareReviewBrief?: (task: Task) => Promise<void>;
   reviewBrief?: (task: Task) => ReviewBrief | { unavailable: string } | undefined;
+  /** Host-verified existing symbols at this task's admitted completion head; never plan guesses. */
+  memorySymbolNodes?: (task: Task) => MemorySymbolNodes | undefined;
   sdlc?: { config: () => SdlcConfig; gh?: SdlcGh };
   briefs?: Briefs;
   /** Screened live fail notes directly intersecting the task plan or refs; read-only advice. */
@@ -194,6 +199,7 @@ const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
 const QUIET_EVENTS = new Set(["answer", "reviewer changed", "idle sweep", "memory reference started"]);
 QUIET_EVENTS.add("ready held"); // #655: the hub's note that a ready task waits for its reserved owner's WIP slot.
 QUIET_EVENTS.add("plan observed"); // Host observation does not move the task or replace completion intent.
+QUIET_EVENTS.add("planner changed"); // Planning authority does not move the execution owner or revoke its handoff.
 /** The records of the `done (checking)` entry a passed check now completes: what the owner delivered then (#509a). */
 const latestPendingDeliverables = (task: Task): DeliverableRecord[] | undefined => {
   const checking = task.history.findLastIndex(entry => entry.event === "done (checking)");
@@ -294,6 +300,10 @@ const planText = (plan: TaskPlan = {}) => ALL_PLAN_KEYS.filter((k) => plan[k]?.l
 const screenText = (t: { title: string; detail: string; plan?: TaskPlan; external?: Task["external"] }) => [t.title, t.detail, planText(t.plan), t.external?.repo, t.external?.url].filter(value => value !== undefined).join("\n");
 /** Re-screens of one task whose verdict was unknown, per hub run (#198). */
 const RESCREEN_MAX = 10;
+/** #758: the planner "board changed" notice. Its body starts with this, so an unsettled copy is found (and replaced) by the prefix. */
+const GROOM_NOTICE_PREFIX = "The board changed";
+/** #758: a board change that needs no plan review is recorded at most once per planner in this window. */
+const GROOM_FYI_WINDOW_MS = 10 * 60_000;
 
 /**
  * The task flow. Adapters and tools never touch the board: every change comes through here, where assignment,
@@ -302,12 +312,35 @@ const RESCREEN_MAX = 10;
 /** #694: a PR staged at done with the commit or branch it was read for. */
 interface IdentityLink { repo: string; pr: number; basis: { commit?: string; branch?: string } }
 
+/** What one live check of a task's files says as a whole (#317): `unchanged` only when EVERY file measured unchanged. A change outranks a missing file, which outranks one the hub could not read. */
+export type DeliverableResult = "changed" | "missing" | "unknown" | "unchanged";
+export const deliverableResult = (states: readonly DeliverableStatus["state"][]): DeliverableResult =>
+  states.includes("changed") ? "changed" : states.includes("missing") ? "missing" : states.includes("unknown") || !states.length ? "unknown" : "unchanged";
+
+/** One row of `ahub deliverables` and one card's badge (#317): ids, hashes and sizes always; a path only where `publicDeliverables` allows it. */
+export interface DeliverableRow {
+  task: number; title: string; taskState: string; state: "delivered" | "approved";
+  /** True only when the files were measured for this row. Without it `changedSinceReview` is absent: the board alone cannot know. */
+  checked: boolean; changedSinceReview?: boolean;
+  /** Present only when `checked`: the whole-row reading of the measurement (never `unchanged` while any file is missing or unreadable). */
+  result?: DeliverableResult;
+  files: { id: string; path?: string; format: string; version?: string; sha256: string; bytes: number; private?: true; state?: DeliverableStatus["state"] }[];
+}
+
 export class Tasks {
+  private readonly planReviewRequests = new Map<number, string>();
   private readonly repositories: TaskRepositories;
   private readonly incomingBacklog = new Set<number>();
   private readonly plannerBacklog = new Map<PeerId, Set<number>>();
   private readonly plannerBlockedQueue = new Map<PeerId, string>();
   private readonly knownPlanners = new Set<PeerId>();
+  /**
+   * #758: what the planner board-changed notice has read of the board. `revision` is the board status revision last scanned, `lengths` each task's
+   * history length at that scan (so only entries added since are read), `pending` what each planner has not yet been told (`review`: a planning
+   * revision or dependency change of a card it plans; `other`: a state move, review or assignment) and `sent` when it was last told.
+   * ponytail: a scan lists the whole board once per status revision (at most one per flush); the upgrade is an indexed history read.
+   */
+  private readonly groomScan = { revision: -1, lengths: new Map<number, number>(), deps: new Map<number, string>(), pending: new Map<PeerId, { review: boolean; other: boolean }>(), sent: new Map<PeerId, { fyiAt: number }>() };
   /** Turn-free cohorts (issue #107): who works without messages, and who integrates. */
   readonly cohorts: Cohorts;
   private readonly coordinationModes = new Map<number, boolean>();
@@ -318,6 +351,7 @@ export class Tasks {
   constructor(private readonly d: TasksDeps) {
     d.board.trackPlanRevisions = () => (d.sdlc?.config().mode ?? "off") !== "off";
     this.repositories = new TaskRepositories(d.cwd, d.repository);
+    d.board.proposalPlanner = task => this.proposalPlanner(task);
     for (const task of d.board.list()) this.warmRepository(task);
     if (d.coordination) {
       const mode = d.coordination();
@@ -424,7 +458,7 @@ export class Tasks {
         if (finding.kind === "ready-unassigned") {
           this.d.board.update(task.id, HUB, "idle sweep", {}, undefined, { sweep: finding });
           recorded.push({ task: task.id, finding });
-          const planners = Object.entries(this.d.roles ?? {}).filter(([peer, roles]) => roles.includes("planner") && this.d.bus.isRostered(peer)).map(([peer]) => peer);
+          const planners = this.taskPlanner(task).filter(peer => this.d.bus.isRostered(peer));
           const text = `Task #${task.id}: ready-unassigned, idle escalation ${finding.step}/3.`;
           if (finding.step === 1 || finding.step === 2) {
             if (finding.step === 2 || !planners.length) this.releaseNotice(text);
@@ -452,8 +486,8 @@ export class Tasks {
           this.sweepNotice(task, responsible, `${message} Check its current state with hub_task_list and accept, complete or review your assigned work.`, finding.kind === "review-pending" ? "reviewer" : "owner");
         } else if (finding.step === 2) {
           this.d.notify(message);
-          for (const [peer, roles] of Object.entries(this.d.roles ?? {})) {
-            if (peer !== responsible && roles.includes("planner") && this.sweepAvailable(peer)) this.sweepNotice(task, peer, `${message} The assigned ${finding.kind === "review-pending" ? "reviewer" : "owner"} has not recorded fresh task activity; check the board before coordinating.`, "planner");
+          for (const peer of this.taskPlanner(task)) {
+            if (peer !== responsible && this.sweepAvailable(peer)) this.sweepNotice(task, peer, `${message} The assigned ${finding.kind === "review-pending" ? "reviewer" : "owner"} has not recorded fresh task activity; check the board before coordinating.`, "planner");
           }
         } else {
           const reviewer = finding.kind === "review-pending";
@@ -619,7 +653,10 @@ export class Tasks {
         if (this.isPii(row)) return false;
         const last = row.history.findLast(entry => entry.reviewFindings?.items.some(value => value.id === item.id));
         const finding = last?.reviewFindings?.items.find(value => value.id === item.id);
-        return !last?.withheld && finding && same(finding) && finding.disposition !== "false_positive" && this.findingTextAllowed(row, [finding]);
+        // #328: a follow-up that only records an earlier task's finding as fixed never had it; it counts once seen open.
+        // By id alone: a reclassified finding keeps its id (task note); a withheld review is never evidence.
+        const occurred = row.history.some(entry => !entry.withheld && entry.reviewFindings?.items.some(value => value.id === item.id && (value.disposition === "open" || value.disposition === "accepted")));
+        return !last?.withheld && finding && same(finding) && occurred && finding.disposition !== "false_positive" && this.findingTextAllowed(row, [finding]);
       });
       if (this.workUnits(holders) < 2) continue;
       const key = `Review finding key: ${item.pass}:${item.id}`;
@@ -653,6 +690,10 @@ export class Tasks {
       ...(h.supersededBy === undefined ? {} : { supersededBy: screenHistoryText(h.supersededBy, "supersession", h.withheld) }),
       ...(h.profile === undefined ? {} : { profile: screenHistoryText(h.profile, "profile") }),
       ...(h.owner === undefined ? {} : { owner: h.owner }),
+      ...(h.planner === undefined ? {} : { planner: h.planner }),
+      ...(h.plannerReason ? { plannerReason: h.plannerReason } : {}),
+      ...(h.planAuthor === undefined ? {} : { planAuthor: h.planAuthor }),
+      ...(h.selfReview ? { selfReview: true } : {}),
       ...(h.reviewerFamily ? { reviewerFamily: screenHistoryText(h.reviewerFamily, "reviewer family") } : {}),
       ...(h.reviewerReason ? { reviewerReason: h.reviewerReason } : {}),
       ...(h.unmetCriteria?.length ? { unmetCriteria: h.unmetCriteria } : {}),
@@ -783,7 +824,7 @@ export class Tasks {
   }
 
   /** Capability admission precedes explicit assignments/reservations, independent of readiness or transient peer health. */
-  private requireCapabilities(task: Parameters<typeof assign>[0], peer: PeerId, role: TaskAssignmentRole = "owner", preEffect = true): void {
+  private requireCapabilities(task: Parameters<typeof assign>[0], peer: PeerId, role: Exclude<TaskAssignmentRole, "planner"> = "owner", preEffect = true): void {
     const instances = this.d.instances?.(), adapter = (this.d.adapterCatalog?.definitionOf ?? definitionOf)(peer, instances);
     const declaredExtra = !!adapter && adapter.kind !== peer;
     if ((!this.d.capabilities || this.isPii(task)) && !declaredExtra) return;
@@ -797,7 +838,7 @@ export class Tasks {
   /**
    * #525-3: the settled planner holders, sorted: the one input of the planner walk. It comes from the same settled role map as planner
    * authority (`d.roles`), restricted to rostered peers, so assignment, planner notices and `route explain` agree on who the holders are.
-   * Read-only for now: the walk's result is shown and recorded nowhere until 525-2.
+   * Selection stays in assign(); task bindings only keep that selection while the holder remains eligible.
    */
   private plannerHolders(): PeerId[] {
     return Object.entries(this.d.roles ?? {}).filter(([peer, roles]) => Array.isArray(roles) && roles.includes("planner") && this.d.bus.isRostered(peer)).map(([peer]) => peer).sort();
@@ -806,7 +847,7 @@ export class Tasks {
   private weights(cls: TaskClass, task?: Task) {
     const now = Date.now();
     const quota = this.d.quota?.();
-    return { ...this.health(), planners: this.plannerHolders(), ...(task ? { reviewPool: this.reviewPoolOptions(task) } : {}), now, demoted: this.demoted(cls, now), reviews: this.reviewRecord(cls), ...(quota ? { quota } : {}), ...(this.d.review?.adaptive ? { adaptive: { min: this.d.review.min_reviews } } : {}) };
+    return { ...this.health(), planners: this.plannerHolders(), ...(task ? { reviewPool: this.reviewPoolOptions(task), ...(task.planner ? { keptPlanner: task.planner } : {}) } : {}), now, demoted: this.demoted(cls, now), reviews: this.reviewRecord(cls), ...(quota ? { quota } : {}), ...(this.d.review?.adaptive ? { adaptive: { min: this.d.review.min_reviews } } : {}) };
   }
 
   /**
@@ -901,13 +942,62 @@ export class Tasks {
     try { this.d.recordPlanning?.(change); } catch { /* telemetry never changes a durable result */ }
   }
 
-  private planningAuthority(by: PeerId): void {
-    if (by !== USER && !this.d.roles?.[by]?.includes("planner")) throw new PreEffectToolRefusal("planning requires a person or configured planner role");
+  /** A removed/off-roster binding falls back to legacy holders; a busy, paused or offline holder keeps authority. */
+  taskPlanner(task: Pick<Task, "planner">): PeerId[] {
+    const holders = Object.keys(this.d.roles ?? {}).filter(peer => this.d.roles?.[peer]?.includes("planner")).sort();
+    return task.planner && holders.includes(task.planner) && this.d.bus.isRostered(task.planner) ? [task.planner] : holders;
+  }
+
+  private planningAuthority(by: PeerId, task?: Pick<Task, "planner">): void {
+    if (by !== USER && (!this.d.roles?.[by]?.includes("planner") || task !== undefined && !this.taskPlanner(task).includes(by))) throw new PreEffectToolRefusal(`planning requires a person or configured planner role${task ? "; only the task's effective planner may act" : ""}`);
   }
 
-  private plannerWriteAuthority(by: PeerId): void {
+  private plannerWriteAuthority(by: PeerId, task?: Pick<Task, "planner">): void {
     if (by !== USER && this.d.privateTurn?.(by)) throw new PreEffectToolRefusal("planner writes are unavailable during a private turn");
-    this.planningAuthority(by);
+    this.planningAuthority(by, task);
+  }
+
+  /** Every new host proposal, including split children, consumes the same pure walk before its first notification. */
+  private proposalPlanner(task: Task): PlannerBinding {
+    const choice = assign({ ...task, state: "proposed" }, this.states(), this.d.routing(), { ...this.weights(task.class, task), candidates: [] });
+    return { planner: this.isPii(task) ? null : choice.planner ?? null, plannerReason: this.isPii(task) ? "none" : choice.plannerReason ?? "none" };
+  }
+
+  private plannerBinding(task: Task, assignment: Assignment, bindNull = false): PlannerBinding | undefined {
+    if (bindNull && task.planner == null) return { planner: this.isPii(task) ? null : assignment.planner ?? null, plannerReason: assignment.plannerReason ?? "none" };
+    return task.planner && this.plannerHolders().includes(task.planner) ? { planner: task.planner, plannerReason: "kept" } : undefined;
+  }
+
+  private planAuthor(task: Task): PeerId | null {
+    // Review scope bookkeeping preserves the existing plan-content author.
+    const authored = task.history.findLast(entry => entry.event !== "plan reviewed" && entry.planRevision !== undefined)
+      ?? task.history.findLast(entry => entry.event !== "plan reviewed" && (entry.planning?.fields as readonly string[] | undefined)?.includes("plan"));
+    if (authored && authored !== task.history[0]) return authored.by;
+    return ALL_PLAN_KEYS.some(key => !!task.plan?.[key]?.length) ? authored?.by ?? task.history[0]?.by ?? null : null;
+  }
+
+  private planReviewAuthority(by: PeerId, task: Task): { planAuthor: PeerId | null; selfReview?: true } {
+    this.plannerWriteAuthority(by); // Independent settled holders have review authority only, not the task's other planner powers.
+    const author = this.planAuthor(task);
+    const independent = this.plannerHolders().filter(peer => peer !== author && this.d.bus.stateOf(peer) !== "offline");
+    if (by !== USER && by === author && independent.length) throw new PreEffectToolRefusal("an independent planner reviews this plan");
+    return { planAuthor: author, ...(by === author ? { selfReview: true as const } : {}) };
+  }
+
+  private requestIndependentPlanReview(task: Task): void {
+    const author = this.planAuthor(task);
+    if (!author || !this.taskPlanner(task).includes(author)) return;
+    const planners = this.plannerHolders().filter(peer => peer !== author && this.d.bus.stateOf(peer) !== "offline");
+    if (!planners.length) return;
+    const selected = assign({ ...task, state: "proposed" }, this.states(), this.d.routing(), { ...this.weights(task.class, task), candidates: [], planners, keptPlanner: undefined }).planner;
+    if (!selected) return;
+    const revision = task.planningRevision ?? 0, signature = `${revision}:${author}:${selected}`;
+    if (this.planReviewRequests.get(task.id) === signature) return;
+    const view = this.publicView(task);
+    const queued = this.d.bus.publish(newEnvelope(HUB, `Independent plan review requested for task #${view.id}, revision ${revision}. Record hub_plan_review for that revision.`, {
+      to: [selected], kind: "task", refs: { task: String(task.id), planReview: revision, planReviewFlow: task.history.length, planAuthor: author }, ...(this.isPii(task) ? { private: true } : {}),
+    }));
+    if (queued.includes(selected)) this.planReviewRequests.set(task.id, signature);
   }
 
   wipLimit(peer: PeerId): number {
@@ -966,6 +1056,7 @@ export class Tasks {
     const validate = () => {
       const task = this.d.board.get(input.id);
       if (!task || (task.planningRevision ?? 0) !== input.revision || task.state !== "backlog" || task.owner || !taskCanPlan(task) || task.pinned) throw new PreEffectToolRefusal("planner pull changed, pinned or already started");
+      this.planningAuthority(by, task);
       const release = task.release == null ? undefined : this.d.board.release(task.release);
       if (task.release != null && (!release || ["frozen", "shipped", "dropped"].includes(release.state))) throw new PreEffectToolRefusal("planner pull requires unfrozen release scope");
       if (this.waitsFor(task).length) throw new PreEffectToolRefusal("planner pull waits for dependency approval");
@@ -986,7 +1077,7 @@ export class Tasks {
         const refusal = task.reserved ? `reserved peer ${task.reserved} cannot take the planner pull: ${assignment.refusals?.find(row => row.role === "owner" && row.peer === task.reserved)?.reason ?? "not eligible"}; ${this.plannerRefusal(task)}` : this.plannerRefusal(task);
         throw new PreEffectToolRefusal(`${this.hasPersonReservation(task) ? "a person's reservation is retained; " : ""}${refusal}`);
       }
-      return { task, owner: assignment.owner };
+      return { task, owner: assignment.owner, assignment };
     };
     const initial = validate(), withheld = await this.withholds("note", input.reason, initial.task);
     authorized();
@@ -999,7 +1090,7 @@ export class Tasks {
           if (checked.task.history.length !== current.task.history.length || checked.owner !== current.owner) throw new PreEffectToolRefusal("planner pull changed during admission");
         } } });
     }
-    const pulled = this.d.board.pullPlanned(current.task.id, by, current.owner, input.revision, input.reason.trim(), withheld);
+    const pulled = this.d.board.pullPlanned(current.task.id, by, current.owner, input.revision, input.reason.trim(), withheld, this.plannerBinding(current.task, current.assignment, true));
     this.planningRecorded({ by, task: pulled.id, fields: ["pull", "reserved"], revision: pulled.planningRevision! });
     return pulled;
   }
@@ -1011,15 +1102,77 @@ export class Tasks {
   private addPlannerBacklog(peer: PeerId, ids: readonly number[]): void {
     if (!this.d.roles?.[peer]?.includes("planner")) return;
     const pending = this.plannerBacklog.get(peer) ?? new Set<number>();
-    for (const id of ids) if (this.d.board.get(id)?.state === "backlog") pending.add(id);
+    for (const id of ids) {
+      const task = this.d.board.get(id);
+      if (task?.state === "backlog" && this.taskPlanner(task).includes(peer)) pending.add(id);
+    }
     if (pending.size) this.plannerBacklog.set(peer, pending);
   }
-  private readonly groomingNotified = new Map<string, number>();
+  /**
+   * The planner "board changed" notice (#758). Read only what was added to a card's history since the last scan, and tell each attached planner of
+   * what it did not write itself and plans (`taskPlanner`, the #525-2 scoping): a planning revision or dependency change (in or outside a
+   * `planning` entry) or the creation of a card is a task notice, replacing a copy that
+   * is still unsettled so the planner meets the latest revision once; a state move, review or assignment is recorded at `fyi` weight (no turn),
+   * at most once per planner per ten minutes. The hub's own bookkeeping entries tell nobody. A planner with no earlier notice gets one task notice
+   * (a restart, or the first one after it was attached), as before.
+   */
+  private groomNotices(configured: readonly PeerId[], planners: readonly PeerId[]): void {
+    const scan = this.groomScan, revision = this.d.board.statusRevision(), first = scan.revision < 0;
+    if (scan.revision !== revision) {
+      for (const task of this.d.board.list()) {
+        const seen = scan.lengths.get(task.id), depsKey = JSON.stringify(task.deps ?? []), depsBefore = scan.deps.get(task.id);
+        scan.lengths.set(task.id, task.history.length); scan.deps.set(task.id, depsKey);
+        if (first || seen === task.history.length && depsBefore === depsKey) continue;
+        const holders = this.taskPlanner(task);
+        const tell = (author: string, review: boolean) => {
+          for (const holder of configured) {              // every configured planner, so a change made while one was offline is not lost
+            if (holder === author || !holders.includes(holder)) continue;
+            const pending = scan.pending.get(holder) ?? { review: false, other: false };
+            if (review) pending.review = true; else pending.other = true;
+            scan.pending.set(holder, pending);
+          }
+        };
+        // A card's creation (a propose, with or without `after`, a split child, a generated card) is new work to consolidate, so it needs a plan review.
+        if (seen === undefined) tell(task.history[0]?.by ?? HUB, true);
+        for (const entry of seen === undefined ? task.history.slice(1) : task.history.slice(seen)) {
+          if (entry.by === HUB && entry.planning === undefined) continue;   // the hub's own bookkeeping (lifecycle links, sweeps, holds) is not a board change to tell anyone about
+          tell(entry.by, entry.planning !== undefined);
+        }
+        // Dependencies changed outside a `planning` entry (a propose with `after`, a split, any other write): the same as a planning change.
+        // Its author is the last entry's only when this scan saw a new entry; a write with no entry has no known author, so no planner is skipped.
+        if (depsBefore !== undefined && depsBefore !== depsKey) tell(seen !== undefined && seen < task.history.length ? task.history.at(-1)!.by : "", true);
+      }
+      scan.revision = revision;
+    }
+    const now = this.d.now?.() ?? Date.now();
+    for (const peer of planners) {
+      const told = scan.sent.get(peer), pending = scan.pending.get(peer);
+      const review = told === undefined || pending?.review === true;
+      if (!review && !pending?.other) continue;
+      if (!review && now - told!.fyiAt < GROOM_FYI_WINDOW_MS) { scan.pending.delete(peer); continue; }
+      this.releaseNotice(`could not notify planner ${peer} about grooming`, () => {
+        if (review) this.sendGroomNotice(peer, revision);
+        else this.d.bus.publish(newEnvelope(HUB, `${GROOM_NOTICE_PREFIX} (revision ${revision}): state moves, reviews or assignments only. No plan review is needed.`, { to: [peer], kind: "task", priority: "fyi" }));
+        scan.pending.delete(peer);
+        scan.sent.set(peer, { fyiAt: review ? told?.fyiAt ?? 0 : now });
+      });
+    }
+  }
+
+  /** The task-weight notice: an unsettled earlier copy for this planner is withdrawn and replaced, never a second one queued. */
+  private sendGroomNotice(peer: PeerId, revision: number): void {
+    const body = `${GROOM_NOTICE_PREFIX} (revision ${revision}). Before offering or accepting build work, read hub_planner_groom, consolidate dependencies and priorities, and record hub_plan_review against the current planning revision.`;
+    for (const old of this.d.bus.pendingEnvelopes(peer)) if (old.from === HUB && old.kind === "task" && old.body.startsWith(GROOM_NOTICE_PREFIX)) this.d.bus.withdraw(old.id);
+    const recipients = this.d.bus.publish(newEnvelope(HUB, body, { to: [peer], kind: "task" }));
+    if (!recipients.includes(peer)) throw new Error("the notice was not queued");
+  }
+
   /** One bounded ids-only batch per attached planner; failed or evicted copies stay pending. */
   flushPlannerNotices(): number {
     const configured = Object.entries(this.d.roles ?? {}).filter(([, roles]) => roles.includes("planner")).map(([peer]) => peer);
     for (const peer of this.knownPlanners) if (!configured.includes(peer)) {
       this.knownPlanners.delete(peer); this.plannerBacklog.delete(peer); this.plannerBlockedQueue.delete(peer);
+      this.groomScan.pending.delete(peer); this.groomScan.sent.delete(peer);
     }
     for (const peer of configured) if (!this.knownPlanners.has(peer)) {
       this.knownPlanners.add(peer);
@@ -1028,18 +1181,7 @@ export class Tasks {
     }
     const planners = configured.filter(peer => this.d.bus.isRostered(peer) && this.d.bus.peers.has(peer) && this.d.bus.stateOf(peer) !== "offline");
     if (!planners.length) return 0;
-    if ((this.d.sdlc?.config().mode ?? "off") !== "off") {
-      const revision = this.d.board.statusRevision();
-      const body = "The board changed. Before offering or accepting build work, read hub_planner_groom, consolidate dependencies and priorities, and record hub_plan_review against the current planning revision.";
-      for (const peer of planners) if (this.groomingNotified.get(peer) !== revision) {
-        const queued = this.d.bus.pendingEnvelopes(peer).some(env => env.from === HUB && env.kind === "task" && env.body === body);
-        if (queued) continue;
-        this.releaseNotice(`could not notify planner ${peer} about grooming`, () => {
-          const recipients = this.d.bus.publish(newEnvelope(HUB, body, { to: [peer], kind: "task" }));
-          if (recipients.includes(peer)) this.groomingNotified.set(peer, revision);
-        });
-      }
-    }
+    if ((this.d.sdlc?.config().mode ?? "off") !== "off") this.groomNotices(configured, planners);
     for (const id of this.incomingBacklog) if (this.d.board.get(id)?.state !== "backlog") this.incomingBacklog.delete(id);
     const incoming = [...this.incomingBacklog].sort((a, b) => a - b).slice(0, 64);
     if (incoming.length) {
@@ -1053,10 +1195,17 @@ export class Tasks {
     for (const peer of planners) {
       const pending = this.plannerBacklog.get(peer);
       if (!pending) continue;
+      for (const id of pending) {
+        const task = this.d.board.get(id);
+        if (task?.state !== "backlog") pending.delete(id);
+        else if (!this.taskPlanner(task).includes(peer)) {
+          pending.delete(id);
+          for (const recipient of this.taskPlanner(task)) this.addPlannerBacklog(recipient, [id]);
+        }
+      }
       const blockedQueue = this.plannerBlockedQueue.get(peer);
       if (blockedQueue !== undefined && blockedQueue === JSON.stringify(this.d.bus.queueIds(peer))) continue;
       this.plannerBlockedQueue.delete(peer);
-      for (const id of pending) if (this.d.board.get(id)?.state !== "backlog") pending.delete(id);
       const ids = [...pending].sort((a, b) => a - b).slice(0, 64);
       if (!ids.length) continue;
       // Remove before publish: an immediate overflow callback may put this recipient's ids back.
@@ -1113,7 +1262,7 @@ export class Tasks {
     });
   }
 
-  async planBacklog(by: PeerId, input: { id: number; revision: number; fields: unknown; reason: string }): Promise<Task> {
+  async planBacklog(by: PeerId, input: { id: number; revision: number; fields?: unknown; reason: string }): Promise<Task> {
     this.planningAuthority(by);
     if (!Number.isSafeInteger(input.id) || input.id <= 0 || !Number.isSafeInteger(input.revision) || input.revision < 0) throw new PreEffectToolRefusal("invalid planning identity or revision");
     if (typeof input.reason !== "string" || !input.reason.trim() || input.reason.length > 1000) throw new PreEffectToolRefusal("planning needs a bounded reason");
@@ -1122,6 +1271,12 @@ export class Tasks {
     const validate = () => {
       const task = this.d.board.get(input.id);
       if (!task || (task.planningRevision ?? 0) !== input.revision) throw new PreEffectToolRefusal("planning revision changed");
+      this.planningAuthority(by, task);
+      if (patch.sdlc !== undefined) {
+        if (task.state !== "backlog" || task.owner || taskHasStarted(task)) throw new PreEffectToolRefusal("issue identity changes require unstarted backlog work");
+        if (by !== USER && this.isPii(task)) throw new PreEffectToolRefusal("private issue identity changes require the person");
+        if (!this.isPii(task) && !this.publicMetadataText(JSON.stringify(patch.sdlc))) throw new PreEffectToolRefusal("planning identity metadata is private or sensitive");
+      }
       if (isClosedTaskState(task.state)) throw new PreEffectToolRefusal("closed work is final");
       if (by !== USER && (task.state !== "backlog" || !taskCanPlan(task) || task.pinned || Object.hasOwn(patch, "pinned"))) throw new PreEffectToolRefusal("planner changes only unpinned backlog work");
       if (by !== USER && patch.rank !== undefined && task.history.some(entry => entry.by === USER && entry.planning?.fields.includes("rank"))) throw new PreEffectToolRefusal("a person's backlog order is retained");
@@ -1154,6 +1309,7 @@ export class Tasks {
       for (const id of new Set([task.release, target])) {
         if (id == null) continue;
         const release = this.d.board.release(id)!;
+        if (Object.hasOwn(patch, "release")) this.planningAuthority(by, release);
         if (["shipped", "dropped"].includes(release.state)) throw new PreEffectToolRefusal("settled release scope is final");
         if (by !== USER && release.state === "frozen") throw new PreEffectToolRefusal("frozen release changes require a person");
       }
@@ -1161,8 +1317,11 @@ export class Tasks {
     };
     const task = validate(), withheld = await this.withholds("note", input.reason, task);
     this.planningAuthority(by); // #455: or moved the planner
-    validate(); // a person may have changed planning or frozen a release while the screen ran
-    const updated = this.d.board.plan(task.id, by, patch, input.revision, input.reason.trim(), withheld);
+    const latest = validate(); // a person may have changed planning or frozen a release while the screen ran
+    let receipt: Task["sdlc"];
+    try { receipt = patch.sdlc === undefined ? undefined : planningIssueReceipt(patch.sdlc, latest.sdlc, this.d.sdlc?.config() ?? sdlcConfig(undefined)); }
+    catch (error) { throw new PreEffectToolRefusal((error as Error).message); }
+    const updated = this.d.board.plan(task.id, by, patch, input.revision, input.reason.trim(), withheld, receipt);
     this.planningRecorded({ by, task: task.id, fields: Object.keys(patch), revision: updated.planningRevision! });
     return updated; // persistence/readback failures must never claim no effect
   }
@@ -1171,6 +1330,7 @@ export class Tasks {
     this.planningAuthority(by);
     const task = this.d.board.get(id), entry = task ? planningUndoEntry(task) : undefined;
     if (!task || !entry?.planning || entry.planning.revision !== revision || (task.planningRevision ?? 0) !== revision || by !== USER && entry.by !== by) throw new PreEffectToolRefusal("planning undo is stale or not owned");
+    this.planningAuthority(by, task);
     if (entry.planning.split) {
       const release = task.release == null ? undefined : this.d.board.release(task.release);
       if (task.state !== "backlog" || task.owner || taskHasStarted(task) || release && ["shipped", "dropped"].includes(release.state) || by !== USER && (task.pinned || release?.state === "frozen")) throw new PreEffectToolRefusal("split undo is no longer eligible");
@@ -1240,6 +1400,7 @@ export class Tasks {
       if (!parent || parent.state !== "backlog" || parent.owner || taskHasStarted(parent) || (parent.planningRevision ?? 0) !== revision || by !== USER && parent.pinned) throw new PreEffectToolRefusal("split changed, pinned or already started");
       const release = parent.release == null ? undefined : this.d.board.release(parent.release);
       if (parent.release != null && (!release || ["shipped", "dropped"].includes(release.state) || by !== USER && release.state === "frozen")) throw new PreEffectToolRefusal("split release scope is frozen or final");
+      this.planningAuthority(by, parent);
       const profile = parent.profile ?? "dev";
       const drafts = rows.map((part, index) => {
         if (!part || typeof part !== "object" || Array.isArray(part) || Object.keys(part).some(key => !["title", "detail", "class", "refs", "plan", "after", "afterParts"].includes(key)) || typeof part.title !== "string" || !part.title.trim() || part.title.length > 300 || part.detail !== undefined && (typeof part.detail !== "string" || part.detail.length > 8000) || part.class !== undefined && typeof part.class !== "string") throw new PreEffectToolRefusal("invalid split part");
@@ -1304,10 +1465,12 @@ export class Tasks {
       this.plannerWriteAuthority(by);
       const task = this.d.board.get(input.id);
       if (!task || (task.planningRevision ?? 0) !== input.revision) throw new PreEffectToolRefusal("release assignment changed");
+      this.plannerWriteAuthority(by, task);
       if (by !== USER && (this.isPii(task) || task.pinned)) throw new PreEffectToolRefusal("private or pinned release scope requires the person");
       for (const id of new Set([task.release, input.release])) if (id != null) {
         const release = this.d.board.release(id);
         if (!release || ["frozen", "shipped", "dropped"].includes(release.state)) throw new PreEffectToolRefusal("release scope is frozen or final");
+        this.plannerWriteAuthority(by, release);
       }
       return task;
     };
@@ -1326,6 +1489,7 @@ export class Tasks {
       if (!Number.isSafeInteger(input.id) || input.id <= 0 || !Number.isSafeInteger(input.revision) || input.revision < 0) throw new PreEffectToolRefusal("invalid release identity or revision");
       const release = this.d.board.release(input.id);
       if (!release || release.revision !== input.revision || !["planning", "active"].includes(release.state)) throw new PreEffectToolRefusal("release revision changed or scope frozen");
+      this.plannerWriteAuthority(by, release);
       if (input.state !== undefined && input.state !== "active") throw new PreEffectToolRefusal("invalid train state");
       if (input.cut !== undefined && (!Number.isSafeInteger(input.cut) || input.cut <= 0 || input.cut > 8_640_000_000_000_000)) throw new PreEffectToolRefusal("release cut must be a positive safe UTC timestamp");
       const dates = [release.plannedStart, input.cut ?? release.cut, release.ship].filter((date): date is number => date !== null);
@@ -1369,6 +1533,7 @@ export class Tasks {
       if (!Number.isSafeInteger(input.id) || input.id <= 0 || !Number.isSafeInteger(input.revision) || input.revision < 0) throw new PreEffectToolRefusal("invalid release identity or revision");
       const release = this.d.board.release(input.id);
       if (!release || release.revision !== input.revision || release.state !== "active") throw new PreEffectToolRefusal("release revision changed or train is not active");
+      this.plannerWriteAuthority(by, release);
       if (this.d.board.releases().some(row => row.id !== input.id && ["active", "frozen"].includes(row.state))) throw new PreEffectToolRefusal("one open release train at a time");
       if ((release.train?.history.length ?? 0) > RELEASE_TRAIN_HISTORY_LIMIT - 2) throw new PreEffectToolRefusal("release train history full; cut needs slots for cut and ship, drop this train and create a replacement");
       const report = this.releaseReport(by, input.id);
@@ -1412,7 +1577,7 @@ export class Tasks {
     if (!this.nameable(text) || this.screenOn() && (await this.screenCall(text)).label !== "clear") throw new PreEffectToolRefusal("release text was not cleared for public planning");
     this.plannerWriteAuthority(by); // Privacy and planner identity may change while screening.
     if (this.d.board.releases().some(release => release.name === input.name)) throw new PreEffectToolRefusal("release name already exists");
-    const release = this.d.board.newRelease(input.name, input.goal.trim(), input.order);
+    const release = this.d.board.newRelease(input.name, input.goal.trim(), input.order, by === USER ? null : by);
     this.planningRecorded({ by, release: release.id, fields: ["created"], revision: release.revision });
     return release;
   }
@@ -1421,6 +1586,7 @@ export class Tasks {
     this.planningAuthority(by);
     const release = this.d.board.release(input.id);
     if (!Number.isSafeInteger(input.id) || input.id <= 0 || !Number.isSafeInteger(input.revision) || !release || release.revision !== input.revision) throw new PreEffectToolRefusal("release revision changed");
+    this.planningAuthority(by, release);
     if (["shipped", "dropped"].includes(release.state)) throw new PreEffectToolRefusal("settled release is final");
     if (by !== USER && (release.state === "frozen" || input.state === "frozen" || input.state === "shipped" || input.state === "dropped")) throw new PreEffectToolRefusal("freeze, ship, drop and frozen changes require a person");
     if (input.state === "shipped" && this.d.board.list().some(task => task.release === release.id && !isClosedTaskState(task.state))) throw new PreEffectToolRefusal("every release task must be approved, cancelled, or moved out before ship");
@@ -1551,6 +1717,7 @@ export class Tasks {
       || typeof input.reason !== "string" || !input.reason.trim() || input.reason.length > 1000) throw new PreEffectToolRefusal("untouched return needs an id, revision and bounded reason");
     const validate = () => {
       const task = this.need(input.id, false, true);
+      this.plannerWriteAuthority(by, task);
       if (!["proposed", "in_progress"].includes(task.state) || (task.planningRevision ?? 0) !== input.revision || taskHasWorkEvidence(task)) throw new PreEffectToolRefusal("work has execution evidence or its planning revision changed");
       if (by !== USER && task.pinned) throw new PreEffectToolRefusal("pinned work requires the person");
       const release = task.release == null ? undefined : this.d.board.release(task.release);
@@ -1783,9 +1950,18 @@ export class Tasks {
     if (env.from === HUB && env.kind === "task" && env.refs?.backlog) {
       const ids = env.refs.backlog;
       if (!Array.isArray(ids) || !ids.length || ids.length > 64 || ids.some(id => !Number.isSafeInteger(id) || id <= 0)) return false;
-      const current = ids.filter(id => this.d.board.get(id)?.state === "backlog");
+      const current = ids.filter(id => {
+        const task = this.d.board.get(id);
+        return task?.state === "backlog" && this.taskPlanner(task).includes(peer);
+      });
       if (current.length !== ids.length || !this.d.roles?.[peer]?.includes("planner") || !this.d.bus.isRostered(peer)) {
         this.addPlannerBacklog(peer, current);
+        for (const id of ids) {
+          const task = this.d.board.get(id);
+          if (task?.state === "backlog" && !this.taskPlanner(task).includes(peer)) {
+            for (const recipient of this.taskPlanner(task)) this.addPlannerBacklog(recipient, [id]);
+          }
+        }
         return false;
       }
       return true;
@@ -1793,6 +1969,10 @@ export class Tasks {
     if (env.from === HUB && env.refs?.task) {
       const task = this.d.board.get(Number(env.refs.task));
       if (task?.state === "cancelled") return env.kind === "task" && typeof env.refs.taskCancelled === "number" && env.refs.taskCancelled === task.cancelled?.flowRevision;
+      if (env.refs.taskRecipient === "planner") return !!task && this.taskPlanner(task).includes(peer);
+      if (env.refs.planReview !== undefined) return !!task && !isClosedTaskState(task.state) && (task.planningRevision ?? 0) === env.refs.planReview
+        && this.plannerHolders().includes(peer) && this.planAuthor(task) !== peer && Number.isSafeInteger(env.refs.planReviewFlow)
+        && !task.history.slice(env.refs.planReviewFlow).some(entry => entry.event === "plan reviewed");
     }
     const c = this.conditional.get(env.id);
     if (!c || c.peer !== peer) return true;
@@ -2035,6 +2215,7 @@ export class Tasks {
       }
       task = current; // Reviewer-only and quiet bookkeeping updates do not supersede ownership authority.
       if (gap) {
+        this.requestIndependentPlanReview(current);
         this.releaseNotice(`task ${this.publicTitle(current)}: ${gap}; planner: call hub_planner_groom then hub_plan_review`);
         if (mode === "enforce") {
           if (opts.claim && opts.namedOwner === by) stagedClaimGap = gap;
@@ -2080,10 +2261,11 @@ export class Tasks {
     const lasting = opts.event === "escalated" && task.owner && (opts.reason === "rejections" || opts.reason === "manual");
     opts.plannerPull?.guard();
     const assignmentNote = this.assignmentNote(`${opts.note ?? `to ${a.owner}`}${passed}`, a);
-    const assignmentExtra = { ...this.reviewMetadata(a), ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}) };
+    const binding = this.plannerBinding(task, a, !!opts.plannerPull);
+    const assignmentExtra = { ...this.reviewMetadata(a), ...(binding ? { plannerReason: binding.plannerReason } : {}), ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}) };
     const next = opts.plannerPull
-      ? this.d.board.pullAssigned(task.id, by, a.owner, opts.plannerPull.revision, opts.plannerPull.note, opts.plannerPull.withheld, a.reviewer ?? null, assignmentNote, assignmentExtra, task.history.length)
-      : this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(opts.roster && task.state === "in_progress" ? { state: "proposed" as const } : {}), ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, assignmentNote, assignmentExtra, opts.expectedFlowRevision);
+      ? this.d.board.pullAssigned(task.id, by, a.owner, opts.plannerPull.revision, opts.plannerPull.note, opts.plannerPull.withheld, a.reviewer ?? null, assignmentNote, assignmentExtra, task.history.length, binding)
+      : this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(binding ? { planner: binding.planner } : {}), ...(opts.roster && task.state === "in_progress" ? { state: "proposed" as const } : {}), ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, assignmentNote, assignmentExtra, opts.expectedFlowRevision);
     if (opts.plannerPull) this.planningRecorded({ by, task: next.id, fields: ["pull", "reserved"], revision: next.planningRevision! });
     // What calibration reads (issue #109): routing chose the first owner (no single named candidate, no claim; not an
     // escalation, relay or reassignment of work already begun), and the work overlaps another owner's task not started
@@ -2367,7 +2549,7 @@ export class Tasks {
     this.releaseNotice(text);
     try { this.d.stallNotice?.(stall); } catch { /* advisory never changes task authority */ }
     // Advice joins the planner's next delivery; it must not manufacture a turn beside a withheld backlog batch.
-    for (const [peer, roles] of Object.entries(this.d.roles ?? {})) if (roles.includes("planner") && this.d.bus.isRostered(peer)) this.releaseNotice(`task #${task.id}: stall notice unavailable`, () => this.d.tell?.(peer, noteLine(HUB, "finding", text)));
+    for (const peer of this.taskPlanner(task).filter(peer => this.d.bus.isRostered(peer))) this.releaseNotice(`task #${task.id}: stall notice unavailable`, () => this.d.tell?.(peer, noteLine(HUB, "finding", text)));
   }
   async cancel(id: unknown, by: PeerId, input: { reason: string; supersededBy?: string; expectedFlowRevision?: number }): Promise<Task> {
     if (typeof input.reason !== "string" || !input.reason.trim() || Buffer.byteLength(input.reason) > 4000 || input.supersededBy !== undefined && (typeof input.supersededBy !== "string" || !input.supersededBy.trim() || Buffer.byteLength(input.supersededBy) > 1000)) throw new PreEffectToolRefusal("cancellation needs a bounded reason and supersession reference");
@@ -2378,7 +2560,7 @@ export class Tasks {
       if (isClosedTaskState(task.state)) throw new PreEffectToolRefusal(`task #${task.id} is already ${task.state}`);
       if (by !== USER && this.d.privateTurn?.(by) && !this.isPii(task)) throw new PreEffectToolRefusal("cancellation on ordinary work is unavailable during a private turn");
       if (by !== USER) {
-        this.planningAuthority(by);
+        this.planningAuthority(by, task);
         const proposer = task.history.find(h => h.event === "proposed" || h.event === "backlogged")?.by;
         if (proposer !== by || !["backlog", "proposed"].includes(task.state) || taskHasStarted(task)) throw new PreEffectToolRefusal("planner may cancel only its own historically unaccepted backlog or proposed work");
       }
@@ -2573,7 +2755,16 @@ export class Tasks {
       if (issue) issues.set(key, issue);
     }
     this.planningAuthority(by);
-    const current = this.d.board.list().filter(included), visible = current.filter(task => !this.isPii(task));
+    const all = this.d.board.list(), current = all.filter(included), visible = current.filter(task => !this.isPii(task));
+    // Include only bounded public dependency context, so approved intermediate phases do not disappear from reachability.
+    const indexed = new Map(all.map(task => [task.id, task])), dependencies = new Map<number, readonly number[]>();
+    const pending = visible.slice(0, 500).map(task => task.id).reverse(), visited = new Set<number>();
+    while (pending.length && visited.size < 500) {
+      const id = pending.pop()!; if (visited.has(id)) continue; visited.add(id);
+      const task = indexed.get(id); if (!task || this.isPii(task)) continue;
+      dependencies.set(id, task.deps ?? []); pending.push(...task.deps ?? []);
+    }
+    const dependencyTruncated = pending.some(id => !visited.has(id));
     const peers = [...new Set([...Object.keys(this.states()), ...current.flatMap(task => task.owner ? [task.owner] : [])])];
     const reviewedIssues = new Map(visible.flatMap(task => task.sdlc?.planReview?.issue ? [[task.id, task.sdlc.planReview.issue] as const] : []));
     const acceptedIssues = new Map(visible.flatMap(task => task.sdlc?.acceptance ? [[task.id, task.sdlc.acceptance] as const] : []));
@@ -2587,7 +2778,7 @@ export class Tasks {
       if (!result.owner) for (const refusal of result.refusals ?? []) if (refusal.role === "owner") blockers.push({ task: task.id, code: refusal.code === "instance" || refusal.code === "family" ? "policy" : refusal.code });
       if (this.waitsFor(task).length) blockers.push({ task: task.id, code: "dependency" });
     }
-    const digest = plannerGrooming(visible, { repository: this.d.repository ?? `path:${realPath(this.d.cwd)}`,
+    const digest = plannerGrooming(visible, { dependencies, dependencyTruncated, repository: this.d.repository ?? `path:${realPath(this.d.cwd)}`,
       limits: Object.fromEntries(peers.map(peer => [peer, this.wipLimit(peer)])), wip: Object.fromEntries(peers.map(peer => [peer, this.wip(peer)])),
       states, issues, reviewedIssues, acceptedIssues, blockers });
     return { ...digest, truncated: digest.truncated || incomplete, ...(current.some(task => this.isPii(task)) ? { privateTasks: "withheld" } : {}) };
@@ -2770,6 +2961,7 @@ export class Tasks {
     if (Object.keys(raw).some(key => !["revision", "reason", "review", "ci"].includes(key)) || !Number.isSafeInteger(raw.revision) || (raw.revision as number) < 0
       || typeof raw.reason !== "string" || !raw.reason.trim() || raw.reason.length > 1000) throw new PreEffectToolRefusal("plan review needs a current revision and bounded reason");
     const task = this.need(id, false, true, true), revision = raw.revision as number;
+    this.planReviewAuthority(by, task);
     if (isClosedTaskState(task.state)) throw new PreEffectToolRefusal("closed work is final");
     if ((task.planningRevision ?? 0) !== revision) throw new PreEffectToolRefusal("planning revision changed");
     let scope: CostPlan;
@@ -2783,6 +2975,7 @@ export class Tasks {
     const flow = task.history.length, withheld = await this.withholds("note", raw.reason, task);
     this.plannerWriteAuthority(by);
     const observed = this.need(task.id, false, true, true);
+    this.planReviewAuthority(by, observed);
     if (observed.history.length !== flow || (observed.planningRevision ?? 0) !== revision) throw new PreEffectToolRefusal("plan review changed during readback");
     const identity = this.planIssueIdentity(observed);
     if (identity?.issue && this.isPii(observed)) throw new PreEffectToolRefusal("private issue plan review readback unavailable");
@@ -2791,10 +2984,12 @@ export class Tasks {
     if (issue && !this.isPii(task) && !this.nameable(JSON.stringify(issue))) throw new PreEffectToolRefusal("plan review metadata matches a PII pattern");
     this.plannerWriteAuthority(by);
     const current = this.need(task.id, false, true, true);
+    const authorship = this.planReviewAuthority(by, current);
     if (current.history.length !== flow || (current.planningRevision ?? 0) !== revision) throw new PreEffectToolRefusal("plan review changed during readback");
     const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
     let updated = this.d.board.update(current.id, by, "plan reviewed", { ...(Object.keys(scope).length ? { plan: { ...current.plan, ...scope } } : {}), sdlc: { ...current.sdlc, stage: current.sdlc?.stage ?? lifecycleStage(config, "plan"),
-      planReview: { planner: by, planningRevision: revision, recordedAt: Date.now(), ...(Object.keys(scope).length ? { scope } : {}), ...(issue ? { issue } : {}) } } }, raw.reason.trim(), { ...(withheld ? { withheld: true } : {}) }, flow);
+      planReview: { planner: by, ...authorship, planningRevision: revision, recordedAt: Date.now(), ...(Object.keys(scope).length ? { scope } : {}), ...(issue ? { issue } : {}) } } }, raw.reason.trim(), { ...authorship, ...(withheld ? { withheld: true } : {}) }, flow);
+    this.planReviewRequests.delete(updated.id);
     if (config.mode !== "off") updated = this.linkIssue(updated); // #694
     if (updated.state === "proposed" && !updated.owner) {
       this.offered.delete(updated.id);
@@ -2823,19 +3018,22 @@ export class Tasks {
 
   recordLifecycle(by: PeerId, id: unknown, input: unknown, deliverables?: DeliverableRecord[]): Task {
     const task = this.need(id, false, true);
-    if (by !== USER && by !== task.owner && by !== task.reviewer) throw new PreEffectToolRefusal("only the task owner, reviewer or console user may record lifecycle evidence");
     const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
     const next = sdlcReceipt(input, task.sdlc, config, VERSION);
+    const definition = stageDefinition(config, next.stage);
+    const plannerStage = !!input && typeof input === "object" && !Array.isArray(input) && Object.hasOwn(input, "stage")
+      && Object.keys(input).every(key => ["stage", "repo", "issue"].includes(key))
+      && (definition?.actor === "planner" || definition?.actor === "owner/planner") && this.taskPlanner(task).includes(by);
+    if (by !== USER && by !== task.owner && by !== task.reviewer && !plannerStage) throw new PreEffectToolRefusal("only the task owner, reviewer or console user may record lifecycle evidence; a stage planner may record stage identity");
     // The spec identity is person-owned in enforce. No observation cache or restart can reopen a relink bypass.
     const specRelink = (task.sdlc?.repo !== undefined && next.repo !== task.sdlc.repo) || (task.sdlc?.issue !== undefined && next.issue !== task.sdlc.issue);
     if (config.mode === "enforce" && by !== USER && specRelink) throw new PreEffectToolRefusal("only the person may relink an established repository or issue in enforce");
-    const definition = stageDefinition(config, next.stage);
     if (next.redFirst && input && typeof input === "object" && "redFirst" in input && !this.isPii(task) && !this.publicMetadataText(JSON.stringify(next.redFirst))) throw new PreEffectToolRefusal("red-first metadata matches a PII pattern; use private work");
     // #481 S1: entering a build stage in enforce needs the person's spec acceptance; the person may move any stage.
     if (config.mode === "enforce" && by !== USER && next.stage !== task.sdlc?.stage && definition && canonicalStage(definition.base) === "build" && specState(next, undefined) === "missing") throw new PreEffectToolRefusal(this.specText(task, "missing", "blocked"));
     if (config.mode === "enforce" && config.definitions && input && typeof input === "object" && "stage" in input && next.stage !== task.sdlc?.stage && by !== USER) {
       const actor = definition?.actor;
-      const acts = actor === "owner" ? by === task.owner : actor === "reviewer" ? by === task.reviewer : actor === "planner" ? this.d.roles?.[by]?.includes("planner") : actor === "owner/planner" && (by === task.owner || this.d.roles?.[by]?.includes("planner"));
+      const acts = actor === "owner" ? by === task.owner : actor === "reviewer" ? by === task.reviewer : actor === "planner" ? this.taskPlanner(task).includes(by) : actor === "owner/planner" && (by === task.owner || this.taskPlanner(task).includes(by));
       if (!acts) throw new PreEffectToolRefusal(`lifecycle stage requires its ${actor ?? "unknown"} actor or the person`);
     }
     if (input && typeof input === "object" && ("criteria" in input || "phase" in input)) {
@@ -3325,7 +3523,49 @@ export class Tasks {
       const { sha256, id, format, version, path, private: hidden } = shown[i]!;
       return { id, sha256, state: check.state, ...(path ? { path } : {}), format, ...(version ? { version } : {}), ...(hidden ? { private: true as const } : {}) };
     });
-    return { state: approved ? "approved" : "delivered", changedSinceReview: files.some(file => file.state === "changed"), files };
+    const changedSinceReview = files.some(file => file.state === "changed");
+    this.deliverableSeen.set(task.id, { key: Tasks.deliverableKey(basis), at: Date.now(), result: deliverableResult(files.map(file => file.state)) });
+    return { state: approved ? "approved" : "delivered", changedSinceReview, files };
+  }
+
+  /** The last live check per task (#317): what the dashboard may say about "changed since review" without hashing on its 1 s poll. Keyed by the records it measured. */
+  private deliverableSeen = new Map<number, { key: string; at: number; result: DeliverableResult }>();
+  private static deliverableKey = (records: readonly DeliverableRecord[]) => records.map(record => `${record.id}:${record.sha256}`).join(",");
+
+  /**
+   * #317: the deliverables of the board's tasks, newest task first, for `ahub deliverables`. `approved` is what a reviewer's approval bound (else what was delivered).
+   * Without `check` this reads the board only: no file is opened, so no row claims `changedSinceReview`. With `check` every file is measured now (one task at a time).
+   * Every path goes through `publicDeliverables`, so a PII task or a path under `pii.paths` shows id, hash and size only.
+   */
+  async deliverableList(opts: { task?: number; approvedOnly?: boolean; check?: boolean } = {}): Promise<DeliverableRow[]> {
+    const rows: DeliverableRow[] = [];
+    const tasks = (opts.task !== undefined ? [this.d.board.get(opts.task)].filter((task): task is Task => !!task) : this.d.board.list()).sort((a, b) => b.id - a.id);
+    for (const task of tasks) {
+      const delivered = latestDeliverables(task.history);
+      if (!delivered) continue;
+      const approved = task.state === "approved" ? approvedDeliverables(task.history) : undefined;
+      if (opts.approvedOnly && !approved) continue;
+      const basis = approved ?? delivered, shown = publicDeliverables(basis, this.nameable)!;
+      const row: DeliverableRow = { task: task.id, title: this.publicTitle(task), taskState: task.state, state: approved ? "approved" : "delivered", checked: false,
+        files: shown.map(({ id, path, format, version, sha256, bytes, private: hidden }) => ({ id, ...(path ? { path } : {}), format, ...(version ? { version } : {}), sha256, bytes, ...(hidden ? { private: true as const } : {}) })) };
+      if (opts.check) {
+        const status = await this.deliverableStatus(task);
+        if (status) { row.checked = true; row.changedSinceReview = status.changedSinceReview; row.result = deliverableResult(status.files.map(file => file.state)); row.files = row.files.map((file, i) => ({ ...file, state: status.files[i]!.state })); }
+      }
+      rows.push(row);
+    }
+    return rows;
+  }
+
+  /** What the dashboard card shows: the board's records, plus the last live check when it measured exactly these records. Opens no file. */
+  deliverableBadge(task: Task): { state: "delivered" | "approved"; files: DeliverableRow["files"]; checked?: { at: number; result: DeliverableResult } } | undefined {
+    const delivered = latestDeliverables(task.history);
+    if (!delivered) return undefined;
+    const approved = task.state === "approved" ? approvedDeliverables(task.history) : undefined;
+    const basis = approved ?? delivered, seen = this.deliverableSeen.get(task.id);
+    return { state: approved ? "approved" : "delivered",
+      files: publicDeliverables(basis, this.nameable)!.map(({ id, path, format, version, sha256, bytes, private: hidden }) => ({ id, ...(path ? { path } : {}), format, ...(version ? { version } : {}), sha256, bytes, ...(hidden ? { private: true as const } : {}) })),
+      ...(seen && seen.key === Tasks.deliverableKey(basis) ? { checked: { at: seen.at, result: seen.result } } : {}) };
   }
 
   /** Check records against the owner's root; with that root unproven every file is `unknown` (never `unchanged`, never an exception). */
@@ -3610,7 +3850,8 @@ export class Tasks {
     const noWrites = this.noWritesRecorded({ ...task, refs: { ...task.refs, ...completedRefs } });
     const next = this.d.board.update(task.id, by, "done", { codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...completedRefs } }), state: reviewer ? "in_review" : "approved", ...(selection ? { reviewer: reviewer ?? USER } : {}), ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: completedRefs }, checkOutput ? `${routedSummary ?? ""}\n${checkOutput}`.trim() : routedSummary, { ...this.planObservation(task), withheld: withheld || undefined, ...(noWrites ? { noWrites: true as const } : {}), ...this.reviewMetadata(selection), ...(reviewCost ? { reviewCost } : {}), ...(records ? { deliverables: records } : {}) }, task.history.length, HOST_CODE_SYMBOLS);
     this.cohorts.closed(next.id); // its owner's next native turn end settles it in its cohort (issue #107)
-    this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\n${summary ?? ""}`, withheld);
+    const memorySymbols = this.completionMemorySymbols(next);
+    this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\nChanged-symbol memory anchors: ${memorySymbols.state === "known" ? memorySymbols.nodes.length : "unknown (no complete code facts)"}\n${summary ?? ""}`, withheld, memorySymbols);
     this.tellCompleted(next, summary, withheld);
     if (!reviewer) {
       this.settleMemory(next);
@@ -3765,12 +4006,12 @@ export class Tasks {
     return admitted;
   }
 
-  private sendReview(task: Task, reviewer: PeerId, why = "", admission?: ReviewReadiness): void {
+  private sendReview(task: Task, reviewer: PeerId, why = "", admission?: ReviewReadiness): boolean {
     const mode = (this.d.sdlc?.config() ?? sdlcConfig(undefined)).mode;
     if (mode === "enforce" && !admission?.ready) {
       // Background roster/quota role changes are retained, but never invent a remotely admitted review request.
       this.releaseNotice(`task ${this.publicTitle(task)}: premature review held; retry the reviewer assignment after current CI and bot replies are verified`);
-      return;
+      return false;
     }
 
     const r = task.refs;
@@ -3832,7 +4073,7 @@ export class Tasks {
     // #572 AC3: advisory only, from git state never from task text, so it is safe for a PII task too.
     const checkout = mainCheckoutWarning(this.d.cwd, this.publicMetadataText);
     const body = `Review task #${task.id} [${profileTaskLabel(task)}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${last?.noWrites ? "no writes recorded since acceptance\n" : ""}${spec}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${guidance ? guidance + "\n" : ""}${projection ? projection + "\n" : ""}${brief ? brief + "\n" : ""}${checkout ? `Note: ${checkout}.\n` : ""}${findings.length ? `Earlier findings (set a disposition for each):\n${findings.join("\n")}\n` : ""}${carriedText}${conformanceText}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet, findings: [{id, pass: "bugs" | "security" | "compliance", severity: "important" | "nit", path?, disposition: "open" | "fixed" | "false_positive"}]}. Reuse finding ids when updating their disposition; only the person may accept a finding with a rationale.`;
-    this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, ...(this.reviewHead(task) ? { commit: this.reviewHead(task)! } : {}), task: String(task.id), reviewRevision: String(this.reviewRequestRevision(task)) }, ...(this.isPii(task) ? { private: true } : {}) }));
+    return this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, ...(this.reviewHead(task) ? { commit: this.reviewHead(task)! } : {}), task: String(task.id), reviewRevision: String(this.reviewRequestRevision(task)) }, ...(this.isPii(task) ? { private: true } : {}) })).includes(reviewer);
   }
 
   private reviewRequestRevision(task: Task): number {
@@ -3848,25 +4089,35 @@ export class Tasks {
   }
 
   /** Host-only failure report, bound to the exact review request and its still-current child generation. */
-  async retryReviewer(id: number, failedPeer: PeerId, failure: { head?: string; flowRevision?: number; cause: "start_failed" | "quota" | "no_verdict" }, current: () => boolean): Promise<Task> {
+  async retryReviewer(id: number, failedPeer: PeerId, failure: { head?: string; flowRevision?: number; cause: "start_failed" | "quota" | "no_verdict" }, current: () => boolean, onReoffered?: () => void): Promise<Task> {
     if (!failure || !["start_failed", "quota", "no_verdict"].includes(failure.cause) || !/^[a-z][a-z0-9-]{0,63}$/.test(failedPeer) || !Number.isSafeInteger(failure.flowRevision) || failure.flowRevision! < 1 || failure.head !== undefined && (typeof failure.head !== "string" || text(failure.head) !== failure.head || Buffer.byteLength(failure.head) > 1200 || /\p{Cc}/u.test(failure.head))) throw new PreEffectToolRefusal("invalid reviewer failure binding");
     const valid = () => {
       const task = this.need(id, false, true);
-      if (!current() || task.state !== "in_review" || task.reviewer !== failedPeer || this.reviewRequestRevision(task) !== failure.flowRevision || this.reviewHead(task) !== failure.head || this.isPii(task) || this.manuallyNamedReviewer(task)) throw new PreEffectToolRefusal("reviewer failure is no longer current");
+      if (!current() || task.state !== "in_review" || task.reviewer !== failedPeer || this.reviewRequestRevision(task) !== failure.flowRevision || this.reviewHead(task) !== failure.head || this.isPii(task) || this.manuallyNamedReviewer(task) && failure.cause !== "no_verdict") throw new PreEffectToolRefusal("reviewer failure is no longer current");
       return task;
     };
     const before = valid();
     const admission = await this.reviewRequestAdmission(before, undefined, true, before.owner ?? USER, undefined, () => { valid(); return true; });
     const task = valid();
     const options = this.reviewPoolOptions(task);
-    const selection = assign(task, this.states(), this.d.routing(), { ...this.weights(task.class, task), candidates: [], ...(task.owner ? { notReviewer: task.owner } : {}), reviewPool: { ...options, failed: [...options.failed, failedPeer] } });
-    if (!selection.reviewSelection) throw new PreEffectToolRefusal("no declared reviewer pool can receive the fallback");
-    const reviewer = selection.reviewer ?? USER;
+    // A person-selected reviewer never falls through to an agent the person did not select.
+    const manual = this.manuallyNamedReviewer(task);
+    const selection = manual ? undefined : assign(task, this.states(), this.d.routing(), { ...this.weights(task.class, task), candidates: [], ...(task.owner ? { notReviewer: task.owner } : {}), reviewPool: { ...options, failed: [...options.failed, failedPeer] } });
+    if (!selection?.reviewSelection && failure.cause !== "no_verdict") throw new PreEffectToolRefusal("no declared reviewer pool can receive the fallback");
+    const reviewer = selection?.reviewSelection ? selection.reviewer ?? USER : USER;
     valid();
-    const next = this.d.board.update(task.id, HUB, "reviewer unavailable", { reviewer }, this.assignmentNote(`reviewer unavailable: ${failure.cause}`, selection), { ...this.reviewMetadata(selection), reviewerFailure: { peer: failedPeer, cause: failure.cause, ...(failure.head ? { head: failure.head } : {}) } }, task.history.length);
+    const note = manual ? "named reviewer recorded no verdict; the person must review"
+      : selection?.reviewSelection ? this.assignmentNote(`reviewer unavailable: ${failure.cause}`, selection) : "no declared reviewer pool can receive the fallback; the person must review";
+    const next = this.d.board.update(task.id, HUB, "reviewer unavailable", { reviewer }, note, { ...this.reviewMetadata(selection), ...(reviewer === USER ? { reviewBlocked: true } : {}), reviewerFailure: { peer: failedPeer, cause: failure.cause, ...(failure.head ? { head: failure.head } : {}) } }, task.history.length);
     this.releaseNotice(`task ${this.publicTitle(next)}: former review request withdrawal incomplete`, () => this.withdrawRoleRequest(task, next, "reviewer"));
-    if (reviewer === USER) this.releaseNotice(`task ${this.publicTitle(next)}: blocked: no reviewer can run; the planner or person must review`);
-    else this.releaseNotice(`task ${this.publicTitle(next)}: fallback review request unavailable`, () => this.sendReview(next, reviewer, "", admission));
+    let offered = false;
+    if (reviewer === USER) {
+      const notice = `task ${this.publicTitle(next)}: blocked: the person must review`;
+      this.releaseNotice(notice, () => { this.d.notify(notice); offered = true; });
+    } else this.releaseNotice(`task ${this.publicTitle(next)}: fallback review request unavailable`, () => { offered = this.sendReview(next, reviewer, "", admission); });
+    if (offered && current() && this.reviewBindingCurrent(reviewer, next.id, { head: this.reviewHead(next), flowRevision: this.reviewRequestRevision(next) })) {
+      try { onReoffered?.(); } catch { /* Unconfirmed host settlement retains the delivery hold. */ }
+    }
     return next;
   }
 
@@ -3878,6 +4129,39 @@ export class Tasks {
     } catch { return undefined; }
   }
 
+  /** Read-time code advice uses this project's tree only; declared foreign or inconsistent scope is unknown. */
+  memoryCodeEligible(task: Task): boolean {
+    if (this.isPii(task)) return false;
+    const repository = this.codeSymbolsRepository(task);
+    return !!repository && repository.key === this.repositories.project.key && !this.repositories.mismatch(task.refs, task.plan);
+  }
+
+  /** Read-only host input for exists verification; private/foreign/stale observations supply nothing. */
+  memorySymbolCandidates(task: Task): string[] | undefined {
+    if (this.isPii(task) || !this.d.store) return undefined;
+    const observed = this.observedCodeSymbols(task);
+    return observed?.state === "known" ? observed.symbols.map(symbol => symbol.id) : undefined;
+  }
+
+  /** Only current host observations and positive exists checks may anchor the completion note. */
+  private completionMemorySymbols(task: Task): MemorySymbolNodes {
+    const unknown: MemorySymbolNodes = { state: "unknown", nodes: [], unknown: 0, truncated: false };
+    if (this.isPii(task) || !this.d.store) return unknown;
+    const repository = this.codeSymbolsRepository(task);
+    if (!repository || repository.key !== this.repositories.project.key) return unknown;
+    const observed = publicTaskCodeSymbols(task.codeSymbols, this.reviewHead(task), repository.key, this.publicMetadataText);
+    if (!observed || observed.state !== "known") return unknown;
+    try {
+      const verified = this.d.memorySymbolNodes?.(task);
+      if (!verified) return unknown;
+      const context = { cwd: this.d.cwd, project: this.d.store.project, repo: this.d.store.repo, deny: this.d.store.deny, allowed: this.publicMetadataText };
+      const actual = new Set(observed.symbols.map(symbol => canonicalMemorySymbolNode(symbol.id, context)).filter(Boolean));
+      const nodes = [...new Set(verified.nodes)].filter(node => actual.has(node) && canonicalMemorySymbolNode(node, context) === node).slice(0, MEMORY_SYMBOL_LIMIT);
+      const complete = observed.complete && verified.state === "known" && nodes.length === verified.nodes.length;
+      return { state: complete ? "known" : "unknown", nodes, unknown: verified.unknown, truncated: verified.truncated || nodes.length !== verified.nodes.length };
+    } catch { return unknown; }
+  }
+
   /** Host observations are saved only with an admitted transition, never by an optional read. */
   private observedCodeSymbols(task: Task) {
     if (this.isPii(task) || !task.refs.commit) return undefined;
@@ -4127,7 +4411,7 @@ export class Tasks {
   }
 
   /** Withdraw only a former role's queued request, then tell it that its authority changed. */
-  private withdrawRoleRequest(previous: Task, next: Task, role: TaskAssignmentRole): void {
+  private withdrawRoleRequest(previous: Task, next: Task, role: Exclude<TaskAssignmentRole, "planner">): void {
     const peer = previous[role];
     if (!peer || peer === next[role]) return;
     const kind = role === "owner" ? "task" : "review";
@@ -4151,7 +4435,18 @@ export class Tasks {
 
   /** Caller authority is checked by the daemon; keep the real actor in task history. */
   async assignTo(id: unknown, peer: PeerId, by: PeerId = USER, preEffect = false, role: TaskAssignmentRole = "owner", expectedFlowRevision?: number): Promise<Task> {
-    if (role !== "owner" && role !== "reviewer") throw new (preEffect ? PreEffectToolRefusal : Error)("role must be owner or reviewer");
+    if (role !== "owner" && role !== "reviewer" && role !== "planner") throw new (preEffect ? PreEffectToolRefusal : Error)("role must be owner, reviewer or planner");
+    if (role === "planner") {
+      if (by !== USER) throw new PreEffectToolRefusal("only the person may name a task planner");
+      const task = this.need(id, false, preEffect);
+      this.checkFlowRevision(task, expectedFlowRevision, preEffect);
+      if (isClosedTaskState(task.state) || this.isPii(task)) throw new PreEffectToolRefusal("closed or private work cannot name a planner");
+      const choice = assign({ ...task, state: "proposed" }, this.states(), this.d.routing(), { ...this.weights(task.class, task), candidates: [], namedPlanner: peer });
+      if (choice.planner !== peer) throw new PreEffectToolRefusal("named planner must be a rostered settled planner holder");
+      const next = this.d.board.update(task.id, by, "planner changed", { planner: peer }, "named", { plannerReason: "named" }, expectedFlowRevision);
+      if (next.state === "backlog") { this.incomingBacklog.add(next.id); this.addPlannerBacklog(peer, [next.id]); }
+      return next;
+    }
     if (role === "reviewer" && by !== USER) {
       const conductors = Object.entries(this.d.roles ?? {}).filter(([, roles]) => Array.isArray(roles) && roles.includes("conductor")).map(([actor]) => actor);
       if (conductors.length !== 1 || conductors[0] !== by) throw new (preEffect ? PreEffectToolRefusal : Error)("only the console user or the configured conductor may name a reviewer");
@@ -4335,28 +4630,31 @@ export class Tasks {
     const requestCheck = this.requestCheck(by);
     const text = composeRememberText(input);
     const task = input.task !== undefined ? this.d.board.get(Number(input.task)) : undefined;
-    if (task && this.isPii(task)) throw new Error("notes about a PII task are not saved: claude-mem processes what it stores with a cloud model");
+    if (task && this.isPii(task)) throw new Error("notes about a PII task are not saved: shared memory excludes private data");
     // Shared with every other peer as well, so text that matches a PII pattern is refused like a note about a PII task.
     const title = String(input.title ?? "").trim();
-    if (this.isPii({ signals: detectSignals({ title, detail: text, refs: {} }, this.d.routing(), this.d.cwd) })) throw new Error("this note matches a PII pattern and is not saved: claude-mem processes what it stores with a cloud model");
+    if (this.isPii({ signals: detectSignals({ title, detail: text, refs: {} }, this.d.routing(), this.d.cwd) })) throw new Error("this note matches a PII pattern and is not saved: shared memory excludes private data");
     if (input.horizon !== undefined && input.horizon !== "short" && input.horizon !== "long") throw new Error('horizon is "short" or "long"');
     if (input.scope !== undefined && input.scope !== "project" && input.scope !== "shared") throw new Error('scope is "project" or "shared"');
     if (!this.d.memory && !this.d.store) return "memory is disabled; nothing saved";
-    // Long-term notes leave the machine (#258), and claude-mem's observer is a cloud model: a secret goes to neither.
+    // Long-term notes can leave the machine (#258); local storage does not relax secret exclusion.
     if (looksSecret(`${title}\n${text}`)) throw new Error("this note looks like it holds a secret (a key, token or password) and is not saved");
     if (this.aboutPrivatePath(title, text, task)) throw new Error("this note is about a path the project keeps private (pii.paths) and is not saved");
-    if (await this.withholds("note", `${title}\n${text}`, task)) throw new Error("the PII screen did not clear this note, so it is not saved: claude-mem processes what it stores with a cloud model");
+    if (await this.withholds("note", `${title}\n${text}`, task)) throw new Error("the PII screen did not clear this note, so it is not saved: shared memory excludes private data");
     requestCheck();
     const kind = (NOTE_KINDS as readonly string[]).includes(String(input.kind)) ? String(input.kind) as Kind : "finding";
     const native = this.saveNative(by, kind, text, title, task, input.horizon === "long" || input.horizon === "short" ? input.horizon : undefined, input.scope === "shared" ? "shared" : "project");
     if (task && this.d.memory) this.markMemoryReference(task, by);
-    const res = this.d.memory ? await this.d.memory.save({ text, ...(title ? { title } : {}), project: this.d.project, metadata: { peer: by, kind, ...(task ? { task: task.id } : {}) } }) : undefined;
-    if (!res && !native) return this.d.memory ? "memory worker unavailable; nothing saved" : "memory store unavailable; nothing saved";
+    const res = !native && this.d.memory ? await this.d.memory.save({ text, ...(title ? { title } : {}), project: this.d.project, metadata: { peer: by, kind, ...(task ? { task: task.id } : {}) } }) : undefined;
+    if (!res && !native) return "memory store unavailable; nothing saved";
+    if (!native && res && typeof res === "object" && "status" in res && res.status === "candidate") {
+      return "saved as a pending memory candidate; a person must review it before it becomes shared evidence";
+    }
     const line = noteLine(by, kind, title ? `${title}: ${text}` : text);
     this.d.notify(line);
     // Display identity only: a queued recall may already contain this saved entry. Stored/captured text stays unchanged.
     this.d.share?.(by, native ? noteLine(by, kind, `mem:${native.id} ${title ? `${title}: ` : ""}${text}`) : line);
-    return `saved to shared memory${native ? ` (hub memory ${native.id.slice(0, 8)}, ${native.tier}-term${this.d.memory && !res ? "; claude-mem unavailable" : ""})` : ""}; the other agents get it with their next message`;
+    return `saved to shared memory${native ? ` (hub memory ${native.id.slice(0, 8)}, ${native.tier}-term)` : ""}; the other agents get it with their next message`;
   }
 
   /** The task's key in the hub's store: unique across `ahub reset --all`, which restarts the ids. */
@@ -4399,7 +4697,7 @@ export class Tasks {
    * long, decisions, contracts and fails are long-term. Fail-open: a store that cannot be written costs one notice.
    * The caller has screened the text for PII; never a PII task's.
    */
-  private saveNative(by: PeerId, kind: Kind, text: string, title: string, task: Task | undefined, horizon?: Tier, scope: Scope = "project"): { id: string; tier: Tier } | undefined {
+  private saveNative(by: PeerId, kind: Kind, text: string, title: string, task: Task | undefined, horizon?: Tier, scope: Scope = "project", symbols?: MemorySymbolNodes): { id: string; tier: Tier } | undefined {
     const st = this.d.store;
     if (!st || (task && this.isPii(task))) return undefined;
     try { // never throws: callers run after a board write
@@ -4407,7 +4705,12 @@ export class Tasks {
       // Approved, or settled in the store already: the snapshot the caller holds can predate an approval made while it awaited.
       const approved = !!task && (task.state === "approved" || st.store.settled(this.memoryKey(task)));
       const tier: Tier = horizon ?? (approved && PROMOTED_KINDS.includes(kind) ? "long" : "short");
-      const about = extractNodes(`${title}\n${text}`, { cwd: this.d.cwd, project: st.project, repo: st.repo, deny: st.deny, paths: [...(task?.refs.paths ?? []), ...(task?.plan?.paths ?? [])], symbols: task?.plan?.symbols, ...(task ? { task: { id: task.id, created: task.created } } : {}) });
+      const about = extractNodes(`${title}\n${text}`, { cwd: this.d.cwd, project: st.project, repo: st.repo, deny: st.deny, paths: [...(task?.refs.paths ?? []), ...(task?.plan?.paths ?? [])], symbols: symbols ? [] : task?.plan?.symbols?.map(normalizeMemorySymbolInput), ...(task ? { task: { id: task.id, created: task.created } } : {}) });
+      // Existing notes remain immutable; the completion note connects actual symbols through the shared task node.
+      if (symbols && task) {
+        const taskNode = `task:${this.memoryKey(task)}`;
+        about.splice(0, about.length, ...[...new Set([taskNode, ...symbols.nodes, ...about])].slice(0, 64).sort());
+      }
       // A short-term note on a task already approved (before hub memory existed, or late): the task is settled first, so
       // the note gets its own deadline and is never taken for a source waiting for promotion.
       if (task && approved && tier === "short" && !st.store.settled(this.memoryKey(task))) st.store.settle(this.memoryKey(task), by);
@@ -4457,16 +4760,15 @@ export class Tasks {
   }
 
   /** Auto notes: only transitions that carry content, never for PII. */
-  private note(task: Task, by: PeerId, kind: Kind, text: string, withheld = false): void {
+  private note(task: Task, by: PeerId, kind: Kind, text: string, withheld = false, symbols?: MemorySymbolNodes): void {
     if (this.isPii(task) || (!this.d.memory && !this.d.store)) return;
-    // claude-mem's observer is a cloud model: model-written text that matches a PII pattern, or that the PII screen did
-    // not clear (#198), is not sent (#69). Long-term hub memory leaves the machine (#258): the same rule, and no secrets.
+    // Model-written text must clear the host PII screen (#198/#69); long-term memory may sync (#258). No secrets.
     if (withheld || !this.nameable(text)) return this.releaseNotice(`task #${task.id}: a ${kind} note was not saved to shared memory (${this.whyWithheld(text)})`);
     if (looksSecret(text)) return this.releaseNotice(`task #${task.id}: a ${kind} note was not saved to shared memory (it looks like it holds a secret)`);
     const title = `agent-hub task #${task.id}: ${task.title}`.slice(0, 120);
     if (this.aboutPrivatePath(title, text, task)) return this.releaseNotice(`task #${task.id}: a ${kind} note was not saved to shared memory (it is about a private path)`);
-    this.saveNative(by, kind, text, title, task);
-    if (this.d.memory) {
+    const native = this.saveNative(by, kind, text, title, task, undefined, "project", symbols);
+    if (!native && this.d.memory) {
       try { this.markMemoryReference(task, by); } catch { return this.releaseNotice(`task #${task.id}: memory reference could not be recorded; note was not saved`); }
       void this.d.memory.save({ text, title, project: this.d.project, metadata: { peer: by, task: task.id, kind } });
     }