@staix/agent-hub 0.16.0 → 0.17.0

package/src/hub/daemon.ts

@@ -46,7 +46,7 @@ import { peerRosterConfig, rosterAllows, staleInstanceKey, type PeerRoster } fro
 import { KNOWN_PEERS, OPTIONAL_PEERS, PLANNER_PEERS, SUPPORTED_PEERS, START_MODE_PEERS, isSupportedPeer, STARTABLE_PEERS, isStartablePeer } from "../adapters/registry.ts";
 import { RecoveryDeferredHubError } from "./deferred-hub.ts";
 import { databaseBusySite, isDatabaseBusy, RecoveryDatabaseBusy } from "./recovery-error.ts";
-import { ADAPTERS, DEFAULT_REVIEW_POOL, REVIEW_POOL_KINDS, QUOTA_HANDOFF_PLATFORMS, NATIVE_CONFIG_BLOCKS, nativeConfigurationDefaults, mergeNativeConfiguration, retainNativeRouting, DAEMON_PORTS, definitionOf, createProjectAdapterCatalog } from "../adapters/registry.ts";
+import { ADAPTERS, DEFAULT_REVIEW_POOL, REVIEW_POOL_KINDS, QUOTA_HANDOFF_PLATFORMS, NATIVE_CONFIG_BLOCKS, nativeConfigurationDefaults, mergeNativeConfiguration, retainNativeRouting, DAEMON_PORTS, definitionOf, createProjectAdapterCatalog, isFixedBuiltinDefinition } from "../adapters/registry.ts";
 import { isSupportedPeer as registrySupportedPeer, definitionOf as builtinDefinitionOf, KNOWN_PEERS as BASE_KNOWN_PEERS, SUPPORTED_PEERS as BASE_SUPPORTED_PEERS, STARTABLE_PEERS as BASE_STARTABLE_PEERS } from "../adapters/registry.ts";
 import { checkJcodeInstanceHomes, instanceDefinitionOf, effectiveInstanceRoles, instancePeerIds, validateInstances, type InstancesConfig } from "./instances.ts";
 import { INSTANCE_CONFIG_FILES, readInstanceConfig, readInstanceConfigLayers, readInstanceRoleConfig } from "./instance-config.ts";
@@ -79,6 +79,7 @@ import type { ServerWebSocket } from "bun";
 import { isAcpPeer, type AcpPeer, QwenIdentityError, ACTION_BUDGET_OPTION, type PermissionRequest, type ActionGateVerdict } from "../adapters/acp.ts";
 import { isCodexPeer, type CodexPeer } from "../adapters/codex-appserver.ts";
 import { isPiPeer, type PiPeer } from "../adapters/pi.ts";
+import { isQwenDualPeer, qwenDualVersionAsync, type QwenDualPeer } from "../adapters/qwen-dual.ts";
 import { startModelRelay, type ModelRelay } from "../models/relay.ts";
 import { ensureMlx, type MlxOptions } from "../models/mlx.ts";
 import { PiToolReceipts, packPiShellResult } from "../pi/tool-receipts.ts";
@@ -89,8 +90,8 @@ import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
 import { DEFAULT_NETWORK_ALLOW, startEgressProxy, type EgressProxy } from "../local/proxy.ts";
 import { runTool, toolResultFailed, TOOL_SCHEMAS, type ToolApproval, type ApprovalObserver, type ToolContext } from "../local/tools.ts";
 import { isLocalPeer, type LocalPeer } from "../adapters/local-worker.ts";
-import { isReviewerPrintPeer, reviewerUnavailableReason, ReviewerUnavailableError, type ReviewerPrintPeer } from "../adapters/reviewer-print.ts";
-import { createReviewerMcpSession } from "../adapters/reviewer-mcp.ts";
+import { isReviewerPrintPeer, reviewerNoVerdictLine, reviewerUnavailableReason, ReviewerUnavailableError, REVIEWER_FALLBACK_UNCONFIRMED, type ReviewerPrintPeer } from "../adapters/reviewer-print.ts";
+import { createReviewerMcpSession, type ReviewerToolName } from "../adapters/reviewer-mcp.ts";
 import { reviewerPoolConfig } from "./reviewer-pool-config.ts";
 import { reviewDiff } from "../adapters/claude-print.ts";
 import { Capture } from "../memory/capture.ts";
@@ -152,7 +153,7 @@ import { detectTooling } from "./tooling.ts";
 import { looksSecret, DEFAULT_LEASE_MS, memoryHome, SUGGESTED, taskKey, type CandidateStore, type MemoryStore, type GoalView, type Suggested, type View as MemoryView } from "@staix/agent-mem";
 import { memoryProjectKey } from "@staix/agent-mem";
 import { AGENT_MEM_VERSION, MEMORY_SPLIT_INCOMPLETE, memoryProjectFor, openProfileMemory, openProfileCandidates, MemoryProfileBinding, type UnboundMemoryProfileReceipt } from "./memory-profile.ts";
-import { syncMemory } from "@staix/agent-mem";
+import { syncMemory, createIntentBriefSource, createStandalonePolicy } from "@staix/agent-mem";
 import { MEMORY_READ_TOOLS, memoryRead, validateMemoryRead } from "./read-tools.ts";
 import { nativeRecall } from "../memory/recall.ts";
 import { promotionScreen, withoutPii, mentionsPrivatePath } from "./memory-policy.ts";
@@ -593,6 +594,9 @@ export function resolutionRefusal(error: unknown): string {
   return RESOLUTION_CAUSES.find(([pattern]) => pattern.test(text))?.[1] ?? "resolution refused: inspect ahub queue show for the delivery's state";
 }
 
+/** No remote set and a stop are not failures: agent-mem words the missing remote "no sync remote" (v1) or "no generation sync remote configured". */
+export const quietSyncError = (error: string | undefined): boolean => /^(no (generation )?sync remote|stopped)/.test(error ?? "");
+
 export async function startDaemon(opts: DaemonOptions) {
   const projectId = opts.projectId ?? randomUUID();
   const instanceId = opts.instanceId ?? randomUUID();
@@ -630,6 +634,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const executionOwners = new Map<string, { owner: PeerAdapter; cwd: string; socket?: Sock; launchId?: string; generation?: string | number }>();
   const verifiedTerminalRootsThisTurn = new Set<object>();
   const reviewerUnavailable = new Map<string, string>();
+  const reviewerToolObservers = new Map<string, (task: number, tool: ReviewerToolName, refusal?: string) => void>();
   const roles = { ...Object.fromEntries(adapterCatalog.definitions.filter(d => configuredIds.includes(d.kind)).map(d => [d.kind, [...d.roles]])), ...loadedConfig.roles };
   const permissionModesFromInstances: Record<string, PermissionMode> = {};
   const startModesFromInstances: PeerStartConfig = {};
@@ -1197,6 +1202,47 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   async function taskMemoryItems(task: import("../memory/brief.ts").BriefTask) { return (await taskMemoryResult(task)).items; }
 
+  async function taskIntentBrief(task: import("../memory/brief.ts").BriefTask): Promise<import("../memory/brief.ts").IntentBriefContext> {
+    checkMemory();
+    const initial = task.id === undefined ? undefined : board.get(task.id), revision = configRevision;
+    const allowed = () => {
+      const current = task.id === undefined ? undefined : board.get(task.id);
+      return !stopping && configRevision === revision && !!initial && !!current && current.created === task.created && current.updated === initial.updated
+        && current.history.length === initial.history.length && current.owner === initial.owner && !tasks.isPii(current)
+        && !turns.get(current.owner ?? "")?.private && !contextPii(current.owner ?? "");
+    };
+    const assertCurrent = () => { checkMemory(); if (!allowed()) throw Error("memory brief context changed"); };
+    assertCurrent();
+    // Derived code neighbours are additional read-time selectors, never persisted memory or authority.
+    const starts = taskNodes(task).filter(node => node.startsWith("symbol:"));
+    let extra: string[] = [];
+    if (starts.length && tasks.memoryCodeEligible(initial!)) {
+      try {
+        const prepared = await memoryCode(starts, allowed);
+        assertCurrent();
+        extra = currentMemoryCode(prepared).nodes.map(node => node.id).filter(node => node.startsWith("symbol:")).map(node => node.slice(7));
+      } catch { /* Optional code evidence never removes direct intent memory. */ }
+    }
+    assertCurrent();
+    const stale = staleness();
+    const policy = createStandalonePolicy({ denyPaths: config.local.deny, host: { screen: async value => {
+      assertCurrent();
+      if (value && typeof value === "object" && "id" in value) {
+        const row = value as MemoryView;
+        return screenMemory([row]).length === 1 && tasks.publicMetadataText(JSON.stringify(row));
+      }
+      // The trusted host locator is not note content (a private directory can contain this project).
+      const { cwd: _cwd, ...query } = value as Record<string, unknown>;
+      return boundedSafe(JSON.stringify(query));
+    } } });
+    return { source: createIntentBriefSource(memoryStore!, memoryProject), options: {
+      project: memoryProject, cwd: opts.cwd, repo: memoryRepo, intent: task.title,
+      paths: [...task.refs.paths ?? [], ...task.plan?.paths ?? []], symbols: [...task.plan?.symbols ?? [], ...extra],
+      policy: () => policy, policyVersion: () => String(configRevision), allowed, assertCurrent,
+      stale: row => stale(row.about), now: () => memoryStore!.readNow(),
+    } };
+  }
+
   const leaseNoticed = new Set<string>();
   const goalLine = (g: GoalView) => `goal:${g.id.slice(0, 8)} ${g.state} ${g.title}${g.lease.holder ? ` (held by ${g.lease.holder === memoryStore?.machine.id ? "this machine" : `machine ${g.lease.holder.slice(0, 8)}`} until ${g.lease.until}${g.lease.conflict.length ? `; conflicting claim from ${g.lease.conflict.map((m) => m.slice(0, 8)).join(", ")}` : ""})` : ""}`;
   /**
@@ -1256,7 +1302,7 @@ export async function startDaemon(opts: DaemonOptions) {
       try {
         checkMemory();
         const r = await (opts.memorySync ?? syncMemory)(memoryStore!, { signal: syncStop.signal });
-        if (!r.ok && !/^(no sync remote|stopped)/.test(r.error ?? "")) log(`hub memory sync failed: ${r.error}`);
+        if (!r.ok && !quietSyncError(r.error)) log(`hub memory sync failed: ${r.error}`);
         else if (r.warning) log(`hub memory sync: ${r.warning}`);
       } catch { /* A stale binding disables native memory, never the bus. */ }
       finally { syncRun = undefined; }
@@ -1497,7 +1543,8 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   // Bind both legacy print transports and task-MCP calls to the child's original review request.
   const runningReviewAuthority = (by: PeerId, task: number): (() => string | undefined) | undefined => {
-    if (!definitionOf(by)?.reviewer) return undefined;
+    // #792: only a reviewer backend runs bound reviews; an unavailable placeholder slot (agy) fences nothing.
+    if (!definitionOf(by)?.reviewer?.backend) return undefined;
     const attached=bus.peers.get(by), peer=isReviewerPrintPeer(attached)?attached:undefined, token=peer?.reviewToken(task), binding=peer?.reviewBinding(task);
     return () => token!==undefined && binding!==undefined && bus.peers.get(by)===peer && peer?.reviewToken(task)===token && tasks.reviewBindingCurrent(by,task,binding)
       ? undefined : `no review of task #${task} is running for ${by} at its bound head and revision`;
@@ -1584,7 +1631,8 @@ export async function startDaemon(opts: DaemonOptions) {
     ...(config.memory.enabled || memoryStore ? { briefs: new Briefs(config.memory.enabled ? memory : undefined, chain.at(-1)!, () => config.memory.brief_items,
       memoryStore ? taskMemoryItems : undefined,
       (peer, task, counts) => event({ type: "memory_brief", source: "amem", peer, task, ...counts }),
-      items => { const stale = staleness(); return items.map(item => `${item.line}${stale(item.about ?? []) ? " (stale?)" : ""}`); }) } : {}),
+      items => { const stale = staleness(); return items.map(item => `${item.line}${stale(item.about ?? []) ? " (stale?)" : ""}`); },
+      memoryStore ? taskIntentBrief : undefined) } : {}),
     ...(memoryStore ? { planFails: (task: import("./board.ts").Task) => {
       checkMemory();
       const context = { cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny };
@@ -2141,7 +2189,7 @@ export async function startDaemon(opts: DaemonOptions) {
     const bound = executionOwners.get(peer);
     if (bound?.socket) {
       const launch = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
-      if (!isWsPeer(bound.owner) || bound.owner.sessionGeneration !== bound.generation || !launch?.privateRecord || launch.launchId !== bound.launchId || launch.executionCwd !== bound.cwd) {
+      if (!isFixedBuiltinDefinition(definitionOf(peer)) || !isWsPeer(bound.owner) || bound.owner.sessionGeneration !== bound.generation || !launch?.privateRecord || launch.launchId !== bound.launchId || launch.executionCwd !== bound.cwd) {
         revokeTerminalExecution(peer);
         return undefined;
       }
@@ -2423,6 +2471,9 @@ export async function startDaemon(opts: DaemonOptions) {
     if (nativeTurn && effectful) nativeTurn.effectsPending = (nativeTurn.effectsPending ?? 0) + 1;
     const conducted = conductorPeer(config.roles) === by && conductedMutations.has(op);
     const admittedId = typeof input?.id === "number" && Number.isSafeInteger(input.id) && input.id > 0 ? input.id : undefined;
+    const reviewTool = op === "hub_review" || op === "hub_task_show" ? op : undefined;
+    const traceId = admittedId ?? (typeof input?.id === "string" && /^[1-9][0-9]{0,15}$/.test(input.id) && Number.isSafeInteger(Number(input.id)) ? Number(input.id) : undefined);
+    if (reviewTool && traceId !== undefined) reviewerToolObservers.get(by)?.(traceId, reviewTool);
     taskOpsInFlight++;
     try {
       const readAuthority=op==="hub_task_show"?runningReviewAuthority(by,Number(input?.id)):undefined;
@@ -2438,6 +2489,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const hint = args[3] ? ownHeldHint(by) : "";
       return hint ? `${text}\n\n${hint}` : text;
     } catch (error) {
+      if (reviewTool && traceId !== undefined) reviewerToolObservers.get(by)?.(traceId, reviewTool, error instanceof Error ? error.message : "review tool refused");
       if (nativeTurn && effectful && !(error instanceof PreEffectToolRefusal) && turns.get(by) === nativeTurn) nativeTurn.taskEffect = true;
       // Keep proven pre-effect refusal identity/code for native receipts; only add body-free metadata.
       const hint = args[3] ? ownHeldHint(by) : "";
@@ -2793,7 +2845,7 @@ export async function startDaemon(opts: DaemonOptions) {
         // `ahub undo --context` (issue #33): the conversation half of an undo; the CLI restores the files itself.
         const turn = turnLog?.get(String(a.turn));
         if (!turn) throw new Error(`no turn ${a.turn} recorded`);
-        if (!definitionOf(turn.peer)?.session.nativeRevert || !turn.native) throw new Error(`turn ${turn.id} has no Codex conversation turn to revert`);
+        if (!isFixedBuiltinDefinition(definitionOf(turn.peer)) || !definitionOf(turn.peer)?.session.nativeRevert || !turn.native) throw new Error(`turn ${turn.id} has no Codex conversation turn to revert`);
         if (turnLog!.latest(turn.peer)?.id !== turn.id) throw new Error(`turn ${turn.id} is not Codex's latest turn; reverting it would drop the later ones too`);
         const codex = bus.peers.get(turn.peer);
         if (!isCodexPeer(codex)) throw new Error("codex is not attached");
@@ -3190,7 +3242,7 @@ export async function startDaemon(opts: DaemonOptions) {
     ...(dashboard ? { uiOrigin: dashboard.origin } : {}),
     codexProxyPort: opts.codexProxyPort,
     peers: Object.fromEntries(
-      peerIds.map((id) => { const p = bus.peers.get(id); const summary = bus.queueSummary(id); const context = contexts.view(id, contextSession(id), !!p && ["idle", "busy", "paused"].includes(bus.stateOf(id))); return [id, { state: bus.stateOf(id), ...(!membershipAllowed(id) ? { rostered: false, rosterNote: "off roster" } : {}), ...permissionStatus(id, p), ...(isCodexPeer(p) && p.statusNotice ? { statusNotice: p.statusNotice } : {}), ...(context.source !== null || context.measuredAt !== null ? { context } : {}), queued: bus.queued(id), ...(p ? {} : { attached: false }), ...(declarations[id] && config.roles[id]?.includes("implementer") && definitionOf(id)?.transport === "claude-channel" ? { ownerIsolation: !!ownerWriteRoot(id) && ownerWriteRoot(id) !== opts.cwd, ...(!ownerWriteRoot(id) ? { ownerIsolationNote: "terminal execution root not verified; owner admission refused" } : {}) } : {}), ...(summary.needsReview ? { needsReview: summary.needsReview } : {}), ...(summary.liveAccepted ? { liveAccepted: summary.liveAccepted, settlementNote: "awaiting adapter completion (Claude: correlated reply or hub_delivery_done); task state is independent" } : {}), ...queueHoldStatus(id, summary.heldBy), ...(summary.oldestQueuedAt !== undefined ? { oldestQueuedAt: summary.oldestQueuedAt } : {}), ...(bus.queuedImportant(id) ? { queuedImportant: bus.queuedImportant(id) } : {}), ...importantWaitingStatus(id, p), ...pausedNote(id), ...(reviewerUnavailable.has(id) ? { reviewerUnavailable: reviewerUnavailable.get(id) } : {}), ...jcodeModelSource(id), ...(isLocalPeer(p) && p.lastServedBy ? { servedBy: p.lastServedBy } : {}), ...(isWsPeer(p) && p.claiming ? { claiming: true } : {}), ...(isWsPeer(p) && p.pullOnly ? { pullOnly: true, toolsOnly: definitionOf(id)?.attach?.pullOnlyNotice ?? "tools-only: messages wait for hub_inbox; for pushes restart Claude with ahub claude", lastInboxAt: p.lastInboxAt ?? null } : {}), ...(isPiPeer(p) ? { requestedModel: p.getRequestedModel(), backends: modelRelays.get(id)?.status().backends ?? [] } : {}) }]; }),
+      peerIds.map((id) => { const p = bus.peers.get(id); const summary = bus.queueSummary(id); const context = contexts.view(id, contextSession(id), !!p && ["idle", "busy", "paused"].includes(bus.stateOf(id))); return [id, { state: bus.stateOf(id), ...(!membershipAllowed(id) ? { rostered: false, rosterNote: "off roster" } : {}), ...permissionStatus(id, p), ...(isFixedBuiltinDefinition(definitionOf(id)) && (isCodexPeer(p) || isQwenDualPeer(p)) && p.statusNotice ? { statusNotice: p.statusNotice } : {}), ...(context.source !== null || context.measuredAt !== null ? { context } : {}), queued: bus.queued(id), ...(p ? {} : { attached: false }), ...(declarations[id] && config.roles[id]?.includes("implementer") && definitionOf(id)?.transport === "claude-channel" ? { ownerIsolation: !!ownerWriteRoot(id) && ownerWriteRoot(id) !== opts.cwd, ...(!ownerWriteRoot(id) ? { ownerIsolationNote: "terminal execution root not verified; owner admission refused" } : {}) } : {}), ...(summary.needsReview ? { needsReview: summary.needsReview } : {}), ...(summary.liveAccepted ? { liveAccepted: summary.liveAccepted, settlementNote: "awaiting adapter completion (Claude: correlated reply or hub_delivery_done); task state is independent" } : {}), ...queueHoldStatus(id, summary.heldBy), ...(summary.oldestQueuedAt !== undefined ? { oldestQueuedAt: summary.oldestQueuedAt } : {}), ...(bus.queuedImportant(id) ? { queuedImportant: bus.queuedImportant(id) } : {}), ...importantWaitingStatus(id, p), ...pausedNote(id), ...(reviewerUnavailable.has(id) ? { reviewerUnavailable: reviewerUnavailable.get(id) } : {}), ...jcodeModelSource(id), ...(isLocalPeer(p) && p.lastServedBy ? { servedBy: p.lastServedBy } : {}), ...(isWsPeer(p) && p.claiming ? { claiming: true } : {}), ...(isWsPeer(p) && p.pullOnly ? { pullOnly: true, toolsOnly: definitionOf(id)?.attach?.pullOnlyNotice ?? "tools-only: messages wait for hub_inbox; for pushes restart Claude with ahub claude", lastInboxAt: p.lastInboxAt ?? null } : {}), ...(isPiPeer(p) ? { requestedModel: p.getRequestedModel(), backends: modelRelays.get(id)?.status().backends ?? [] } : {}) }]; }),
     ),
     taskWip: Object.fromEntries(peerIds.map(id => [id, { wip: tasks.wip(id), wipLimit: tasks.wipLimit(id) }])),
     boardReadCapabilities: { releaseFilter: true, columnMetadata: true },
@@ -3265,7 +3317,7 @@ export async function startDaemon(opts: DaemonOptions) {
     settlingSuperseded = true;
     try {
       for (const row of bus.queueList(undefined, true)) {
-        if (row.state !== "needs_review" || row.reason?.startsWith("requested stop:")) continue;
+        if (row.state !== "needs_review" || row.reason?.startsWith("requested stop:") || row.reason?.startsWith(REVIEWER_FALLBACK_UNCONFIRMED)) continue;
         const reason = supersededDeliveryReason(row.originals, board, row.peer);
         if (!reason) continue;
         try { bus.resolveDelivery(row.id, row.revision, "completed", reason, "hub"); }
@@ -3984,6 +4036,7 @@ export async function startDaemon(opts: DaemonOptions) {
     const owner = bus.peers.get(peer);
     const stopNotice = definitionOf(peer)?.cli.stopNotice?.(isWsPeer(owner) ? "tui" : !owner ? startMode(peer) : "headless", owner);
     if (stopNotice) return { ok: false, error: stopNotice };
+    if (isQwenDualPeer(owner)) return { ok: false, error: "Qwen belongs to its own terminal; end it there (the hub never signals a person's Qwen)" };
     if (!(isAcpPeer(owner) || isPiPeer(owner) || isLocalPeer(owner) || isReviewerPrintPeer(owner) || definitionOf(peer)?.start.daemonPort === "claude-implementer" && !!owner?.ownedTools)) return { ok: false, error: "unknown or non-owned peer; run ahub status and choose a hub-owned headless peer" };
     if (isPiPeer(owner) && owner.mode !== "headless") return { ok: false, error: "Pi belongs to a native TUI terminal; end it in its terminal" };
     if (owner.state === "offline" && !(isAcpPeer(owner) && owner.pendingOwnedProcess)) return { ok: false, error: `peer is already offline; start it with ${startCommand(peer)} before stopping it` };
@@ -4083,6 +4136,12 @@ export async function startDaemon(opts: DaemonOptions) {
       if (args.model !== undefined && !["dgx/coding", "dgx/fast", "mlx/fast"].includes(args.model)) return { ok: false, error: "unknown Pi model alias" };
     }
     const existing = bus.peers.get(peer);
+    if (adapter?.start.createTui && existing) {
+      // One Qwen at a time, in one form: a headless worker and the person's TUI would both read the same session's work. The TUI is judged by the process it holds, not by peer
+      // state: a detached TUI reads offline while the person's Qwen keeps running, and replacing that adapter would strand it and admit a second Qwen beside it.
+      if (isQwenDualPeer(existing) && existing.holdsTerminal()) return args.mode === "tui" ? { ok: true, already: true } : { ok: false, error: "Qwen runs in its own terminal; end it there before starting a headless one" };
+      if (args.mode === "tui" && !isQwenDualPeer(existing) && existing.state !== "offline") return { ok: false, error: "Qwen is running headless; run ahub stop qwen before starting its TUI" };
+    }
     if (args.replaceSession) {
       if (recoveryActive()) return { ok: false, error: "recovery is holding session replacement" };
       if (!args.sessionFile || args.sessionId || args.fresh) return { ok: false, error: "Pi replacement requires --replace-session --session-file <managed-file>, without --session-id or fresh" };
@@ -4130,12 +4189,49 @@ export async function startDaemon(opts: DaemonOptions) {
       if (adapter && configuredIds.includes(adapter.kind) && args.sessionId !== undefined && args.sessionId !== adapter.session.currentId(existing)) {
         return { ok: false, error: "configured ACP is already running a different native session; stop it before selecting another" };
       }
-      return { ok: true, already: true, ...(isCodexPeer(existing) ? { proxyUrl: existing.proxyUrl } : {}) };
+      return { ok: true, already: true, ...(isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(existing) ? { proxyUrl: existing.proxyUrl } : {}) };
     }
     if (!adapter?.start.reconfigureWhileAttached) {
       if (isPiPeer(existing)) await stopPiForReplacement(existing);
       else await existing?.stop();
     }
+    if (adapter?.start.createTui && args.mode === "tui") {
+      // #286 Part 3: Qwen's own TUI, driven through its dual-output files. The person's terminal runs it; the hub prepares the files and returns the launch.
+      if (declarations[peer]) return { ok: false, error: "declared instances support headless starts only" };
+      if (!onRoster(peer)) return { ok: false, error: "qwen is off roster; a person can add it with ahub roster add qwen" };
+      if (existing && existing.state !== "offline") return { ok: false, error: "Qwen is running headless; run ahub stop qwen before starting its TUI" };
+      // The compat entry of the dual-output contract, not the headless ACP entry: 0.26.1 only.
+      const verdict = await qwenDualVersionAsync(config.qwen_cmd, executionCwd);
+      if (!verdict.ok) return { ok: false, error: verdict.reason };
+      if (verdict.note) log(verdict.note);
+      if (args.sessionId !== undefined && !adapter.session.crashIdentity?.({ sessionId: args.sessionId }).sessionId) return { ok: false, error: "invalid Qwen session identity" };
+      actionBudgets.revoke(peer);
+      const nativeRoot = nativeStateDir(peer);
+      mkdirSync(nativeRoot, { recursive: true });
+      const qwenState = join(nativeRoot, "qwen");
+      const tui: QwenDualPeer = adapter.start.createTui({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["qwen-dual"]({
+        cwd: executionCwd, stateDir: qwenState, cmd: config.qwen_cmd, ...(args.model ? { model: args.model } : {}), ...(args.sessionId ? { sessionId: args.sessionId } : {}),
+        mcpServers: [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: toolEnv(peer, true) }],
+        watchdogMs: config.watchdog_ms, preamble: sessionRoleContract(peer),
+        // The hub's own tools only, by their exact `mcp__agent-hub__<name>`; everything else asks the console. Never a prefix, never a title.
+        autoApprove: name => !stopping && HUB_TOOL_TITLES.has(name),
+        // `stateDir` is the hub's own state dir: the adapter refuses any Qwen write or command that names it (the input file is a prompt channel).
+        guardDir: opts.stateDir,
+        onPermission, actionGate: (call, session) => acpActionGate(peer)({ names: call.names, input: call.input }, session),
+        onStalled: () => writeStatus(),
+        onNotice: text => { try { notify(text); } catch { /* the notice is advisory */ } },
+        onExit: () => { notify(`Qwen's terminal ended; start it again with ahub qwen --mode tui`); writeStatus(); },
+        log,
+      }) }) as QwenDualPeer;
+      recoveryTaskPreface(peer); await ensurePreface(peer);
+      executionOwners.set(peer, { owner: tui, cwd: executionCwd });
+      try {
+        await tui.start();
+        bus.add(tui);
+        if (tui.state !== "offline") tui.onState?.(tui.state);
+      } catch (error) { await tui.stop().catch(stop => log(`qwen tui stop after a failed start: ${(stop as Error).message}`)); throw error; }
+      return { ok: true, mode: "tui", ...(tui.adopted ? { adopted: true } : { launch: tui.launch }) };
+    }
     if (adapter?.start.daemonPort === "owned-acp") {
       if (!jcodeMcpReady(opts.cwd, opts.stateDir, SERVER_JS)) return { ok: false, error: "Jcode project MCP entry missing or stale; the person runs ahub jcode to configure it" };
       // #691: name a version refusal before the owned daemon starts; the ACP identity check stays the binding one.
@@ -4638,7 +4734,8 @@ export async function startDaemon(opts: DaemonOptions) {
         privatePaths: [opts.stateDir, ...(config.pii?.paths ?? []), ...config.local.deny],
         bindingCurrent: (task,binding) => tasks.reviewBindingCurrent(peer,task,binding),
         taskMcp: (task, current) => createReviewerMcpSession({ task, current, tools: [...TASK_TOOLS, ...CONDUCTOR_TOOLS],
-          call: (name, args) => taskOp(peer, name, args, true, contextPii(peer)) }),
+          call: (name, args) => taskOp(peer, name, args, true, contextPii(peer)),
+          onTool: (tool, refusal) => { if (bus.peers.get(peer) === reviewer) reviewer.recordToolTrace(task, { tool, ...(refusal === undefined ? {} : { refusal }) }); } }),
         admit: env => {
           if (env.private || contextPii(peer) || !reviewOnlyPeer(peer) || !tasks.reviewBindingCurrent(peer, Number(env.refs?.task),
             { head: env.refs?.commit, flowRevision: Number(env.refs?.reviewRevision) })) return false;
@@ -4652,16 +4749,26 @@ export async function startDaemon(opts: DaemonOptions) {
         facts: env => env.private ? undefined : reviewDiff(executionCwd, env.refs?.commit, { privatePath: path => isDenied(path, config.local.deny) || matchesPolicy(executionCwd, path, config.pii?.paths ?? [], true), nameable: tasks.nameable }),
         verdictSince: (task, since) => board.get(task)?.history.some(h => h.by === peer && h.at >= since && (h.event === "approved" || h.event === "changes_requested")) === true,
         onUsage: usage => void addTokens(peer, (usage.input_tokens ?? 0) + (usage.output_tokens ?? 0)),
+        onNoVerdict: (diagnostic, current) => {
+          const task = board.get(diagnostic.task);
+          const visible = current() && bus.peers.get(peer) === reviewer && !!task && !tasks.isPii(task) && !contextPii(peer)
+            && tasks.reviewBindingCurrent(peer, diagnostic.task, diagnostic);
+          // Screen the complete refusal before any sanitization or bound; no task text or model output is logged.
+          const hostSafe = visible && !diagnostic.refusalUncertain && (diagnostic.hostRefusal === undefined || boundedSafe(diagnostic.hostRefusal) && tasks.publicMetadataText(diagnostic.hostRefusal));
+          const safe = visible && hostSafe && diagnostic.refusal !== undefined && boundedSafe(diagnostic.refusal) && tasks.publicMetadataText(diagnostic.refusal) ? diagnostic.refusal : undefined;
+          log(reviewerNoVerdictLine(peer, diagnostic, safe, !visible));
+        },
         onUnavailable: (failure, current) => {
           const attached = () => current() && bus.peers.get(peer) === reviewer;
-          if (!attached()) return;
+          if (!attached()) return false;
           if (failure.cause === "start_failed") {
             // #722: the class (a closed list) is the only detail; never a path, native text or token.
             const reason = reviewerUnavailableReason(failure.causeClass ?? "unknown", failure.causeDetail);
             log(`reviewer ${peer} unavailable for task #${failure.task}: ${sanitize(reason).slice(0, 300)}`);
             reviewerUnavailable.set(peer, sanitize(reason).slice(0, 1000));
           }
-          return tasks.retryReviewer(failure.task, peer, failure, attached).then(() => undefined);
+          let confirmed = false;
+          return tasks.retryReviewer(failure.task, peer, failure, attached, () => { confirmed = true; }).then(() => confirmed);
         },
         log,
       }) }) as ReviewerPrintPeer;
@@ -4677,6 +4784,10 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       reviewerUnavailable.delete(peer);
       executionOwners.set(peer, { owner: reviewer, cwd: executionCwd });
+      reviewerToolObservers.set(peer, (task, tool, refusal) => {
+        try { if (bus.peers.get(peer) === reviewer) reviewer.recordToolTrace(task, { tool, ...(refusal === undefined ? {} : { refusal }) }); }
+        catch { /* Diagnostics never change a host tool's result or authority. */ }
+      });
       bus.add(reviewer);
       return { ok: true };
     }
@@ -5797,6 +5908,7 @@ export async function startDaemon(opts: DaemonOptions) {
   }
 
   function claudePermissionLaunch(peer: string): { launchId: string; unattended: boolean; hookPurpose?: string } | undefined {
+    if (!isFixedBuiltinDefinition(definitionOf(peer))) return undefined;
     const row = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
     return row?.permissionHook ? row : undefined;
   }
@@ -5811,7 +5923,7 @@ export async function startDaemon(opts: DaemonOptions) {
       // A Codex proxy outlives its TUI and keeps its own copy of the mode: clear that too, or the next TUI that attaches
       // to it would run a mode the status no longer shows.
       // It is never refused here: a leftover non-ask mode must always be undoable while the peer is away.
-      const note = isCodexPeer(owner) && !owner.clearPermissionMode() ? "The detached session's own approval policy was never reported, so its thread keeps what it last got; a new ahub codex session starts in ask" : undefined;
+      const note = isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && !owner.clearPermissionMode() ? "The detached session's own approval policy was never reported, so its thread keeps what it last got; a new ahub codex session starts in ask" : undefined;
       if (note) log(`permission mode codex: ${note}`);
       const from = permissionMode(peer);
       permissionModes.set(peer, "ask"); permissionModeSources.set(peer, "human runtime command"); pendingPermissionDefaults.delete(peer);
@@ -5819,7 +5931,7 @@ export async function startDaemon(opts: DaemonOptions) {
       log(`permission mode ${peer}: ${from} -> ask (offline hub choice cleared)`); writeStatus();
       return { ok: true, peer, permissionMode: "ask", ...(note ? { note } : {}) };
     }
-    if (isCodexPeer(owner) && !owner.proxyAttached) return { ok: false, error: "Codex TUI is not behind the hub proxy; reconnect with ahub codex" };
+    if (isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && !owner.proxyAttached) return { ok: false, error: "Codex TUI is not behind the hub proxy; reconnect with ahub codex" };
     if (!owner || owner.state === "offline") return { ok: false, error: `${peer} is not attached; start it through ahub first` };
     if (mode === undefined) return { ok: true, peer, permissionMode: permissionDisplay(peer, owner) };
     if (!isPermissionMode(mode)) return { ok: false, error: "mode must be ask, ask-when-needed or never-ask" };
@@ -5828,7 +5940,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const launch = claudePermissionLaunch(peer);
       if (!launch || !isWsPeer(owner) || claudePermissionGenerations.get(peer) !== owner.sessionGeneration) return { ok: false, error: "Claude has no verified ahub claude permission hook; restart with ahub claude and run a tool first" };
       if (launch.unattended) return { ok: false, error: "Claude started --unattended already skips prompts; run ahub permission claude ask after it stops to clear the hub choice, then restart without --unattended" };
-    } else if (isCodexPeer(owner)) {
+    } else if (isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner)) {
       if (!owner.proxyAttached) return { ok: false, error: "Codex TUI is not behind the hub proxy; reconnect with ahub codex" };
       if (nativeUnattended(peer)) return { ok: false, error: "Codex started --unattended already skips prompts; run ahub permission codex ask after it stops to clear the hub choice, then restart without --unattended" };
     }
@@ -5860,7 +5972,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     const owner = bus.peers.get(peer);
     if (definitionOf(peer)?.permission.trackUnattended && nativeUnattended(peer)) return { ok: false, error: "Codex started --unattended cannot confirm a permission default; run ahub permission codex ask after it stops, or restart without --unattended" };
-    if (!starting.has(peer) && isCodexPeer(owner) && owner.state === "offline") return { ok: false, error: "connect the Codex TUI through the hub proxy before confirming its default" };
+    if (!starting.has(peer) && isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && owner.state === "offline") return { ok: false, error: "connect the Codex TUI through the hub proxy before confirming its default" };
     if (!starting.has(peer) && owner && owner.state !== "offline") {
       const result = await changePermission(peer, "never-ask", true);
       if (!result.ok) return result;
@@ -5891,9 +6003,9 @@ export async function startDaemon(opts: DaemonOptions) {
     const result = await permissionChange(peer, async () => {
       if (stopping) return { ok: false, error: "hub is stopping" };
       const selected = permissionMode(peer);
-      if (isCodexPeer(owner) && nativeUnattended(peer) && selected !== "ask") return { ok: false, error: "Codex --unattended cannot take a non-ask mode; run ahub permission codex ask, or restart without --unattended" };
+      if (isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && nativeUnattended(peer) && selected !== "ask") return { ok: false, error: "Codex --unattended cannot take a non-ask mode; run ahub permission codex ask, or restart without --unattended" };
       if (!readOnlyPeer(peer) && !(isAcpPeer(owner) && owner.permissionModeState === "unmanaged") && owner.getPermissionMode() !== selected) {
-        if (isCodexPeer(owner) && !owner.proxyAttached) owner.setStartupPermissionMode(selected);
+        if (isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && !owner.proxyAttached) owner.setStartupPermissionMode(selected);
         else await owner.setPermissionMode(selected);
       }
       // The bus may immediately drain at add(): do not expose an idle adapter until its current choice is applied.
@@ -5972,7 +6084,7 @@ export async function startDaemon(opts: DaemonOptions) {
         preparedSessionRoles.delete(c.peer); // an external transport has no receipt for this daemon's native preamble
         preparedSessionRoleIdentities.delete(c.peer);
         ws.claim(sock, msg.channel === false);
-        if (declarations[c.peer] && definitionOf(c.peer)?.transport === "claude-channel") {
+        if (declarations[c.peer] && isFixedBuiltinDefinition(definitionOf(c.peer)) && definitionOf(c.peer)?.transport === "claude-channel") {
           revokeTerminalExecution(c.peer);
           const launch = readClaudeLaunchProof(opts.stateDir, c.peer, instanceId);
           try {

package/src/hub/memory-plan-guard.ts

@@ -1,42 +1,17 @@
-import { normalizeMemorySymbolInput } from "./memory-symbols.ts";
-import { extractNodes, nodePath, type View } from "@staix/agent-mem";
+import { extractNodes, planGuardNodes as libraryPlanGuardNodes, matchingPlanFails as libraryMatchingPlanFails, type PlanGuardContext, type View } from "@staix/agent-mem";
 import type { BriefTask } from "../memory/brief.ts";
+export type { PlanGuardContext } from "@staix/agent-mem";
 
-export interface PlanGuardContext { cwd: string; project: string; repo: string; deny?: string[] }
-
-/** Explicit plan/ref names only, with no filesystem probes or free-text inference. */
+/** Preserve the hub task-shaped API while the library owns all matching logic. */
 export function planGuardNodes(task: BriefTask, context: PlanGuardContext): string[] {
-  // Task refs/plan allow 150 explicit inputs; v1 note extraction caps each result at 64 nodes.
-  // Normalize each input separately, retaining the original single-file symbol qualification rule.
-  const nodes = new Set<string>();
-  for (const path of [...(task.refs.paths ?? []), ...(task.plan?.paths ?? [])]) {
-    for (const node of extractNodes("", { ...context, paths: [path], checkExists: false })) nodes.add(node);
-  }
-  const onlyPath = nodes.size === 1 ? nodePath([...nodes][0]!) : undefined;
-  for (const symbol of task.plan?.symbols ?? []) {
-    if (typeof symbol !== "string") continue;
-    for (const form of new Set([symbol, normalizeMemorySymbolInput(symbol)])) {
-      for (const node of extractNodes("", { ...context, paths: onlyPath ? [onlyPath] : [], symbols: [form], checkExists: false })) nodes.add(node);
-    }
-  }
-  return [...nodes].sort();
+  return libraryPlanGuardNodes(task, context);
+}
+export function matchingPlanFails<T extends Pick<View, "kind" | "about" | "supersededBy">>(task: BriefTask, notes: readonly T[], context: PlanGuardContext): T[] {
+  return libraryMatchingPlanFails(task, notes, context);
 }
+
 /** Retrieval nodes retain the title/task context as well as the explicit plan query. */
 export function taskMemoryQueryNodes(task: BriefTask, context: PlanGuardContext): string[] {
   const ordinary = extractNodes(task.title, { ...context, paths: [...(task.refs.paths ?? []), ...(task.plan?.paths ?? [])], ...(task.id !== undefined && task.created !== undefined ? { task: { id: task.id, created: task.created } } : {}) });
   return [...new Set([...ordinary, ...planGuardNodes(task, context)])].sort();
 }
-const samePath = (a: string, b: string) => a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
-
-/** Fail.about is the source of the graph's rules_out edges in v1; there is no additional stored rules_out field. */
-export function matchingPlanFails<T extends Pick<View, "kind" | "about" | "supersededBy">>(task: BriefTask, notes: readonly T[], context: PlanGuardContext): T[] {
-  const nodes = planGuardNodes(task, context);
-  if (!nodes.length) return [];
-  return notes.filter(note => note.kind === "fail" && !note.supersededBy && note.about.some(about => nodes.some(node => {
-    if (node === about) return true;
-    if (node.startsWith("symbol:") && about.startsWith("symbol:")) return false; // Qualified symbols require both name and file identity.
-    const path = nodePath(node), other = nodePath(about);
-    // File/directory scope intersects at a whole path component, never a lexical substring.
-    return !!path && !!other && samePath(path, other);
-  })));
-}

package/src/hub/tasks.ts

@@ -653,7 +653,10 @@ export class Tasks {
         if (this.isPii(row)) return false;
         const last = row.history.findLast(entry => entry.reviewFindings?.items.some(value => value.id === item.id));
         const finding = last?.reviewFindings?.items.find(value => value.id === item.id);
-        return !last?.withheld && finding && same(finding) && finding.disposition !== "false_positive" && this.findingTextAllowed(row, [finding]);
+        // #328: a follow-up that only records an earlier task's finding as fixed never had it; it counts once seen open.
+        // By id alone: a reclassified finding keeps its id (task note); a withheld review is never evidence.
+        const occurred = row.history.some(entry => !entry.withheld && entry.reviewFindings?.items.some(value => value.id === item.id && (value.disposition === "open" || value.disposition === "accepted")));
+        return !last?.withheld && finding && same(finding) && occurred && finding.disposition !== "false_positive" && this.findingTextAllowed(row, [finding]);
       });
       if (this.workUnits(holders) < 2) continue;
       const key = `Review finding key: ${item.pass}:${item.id}`;
@@ -4003,12 +4006,12 @@ export class Tasks {
     return admitted;
   }
 
-  private sendReview(task: Task, reviewer: PeerId, why = "", admission?: ReviewReadiness): void {
+  private sendReview(task: Task, reviewer: PeerId, why = "", admission?: ReviewReadiness): boolean {
     const mode = (this.d.sdlc?.config() ?? sdlcConfig(undefined)).mode;
     if (mode === "enforce" && !admission?.ready) {
       // Background roster/quota role changes are retained, but never invent a remotely admitted review request.
       this.releaseNotice(`task ${this.publicTitle(task)}: premature review held; retry the reviewer assignment after current CI and bot replies are verified`);
-      return;
+      return false;
     }
 
     const r = task.refs;
@@ -4070,7 +4073,7 @@ export class Tasks {
     // #572 AC3: advisory only, from git state never from task text, so it is safe for a PII task too.
     const checkout = mainCheckoutWarning(this.d.cwd, this.publicMetadataText);
     const body = `Review task #${task.id} [${profileTaskLabel(task)}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${last?.noWrites ? "no writes recorded since acceptance\n" : ""}${spec}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${guidance ? guidance + "\n" : ""}${projection ? projection + "\n" : ""}${brief ? brief + "\n" : ""}${checkout ? `Note: ${checkout}.\n` : ""}${findings.length ? `Earlier findings (set a disposition for each):\n${findings.join("\n")}\n` : ""}${carriedText}${conformanceText}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet, findings: [{id, pass: "bugs" | "security" | "compliance", severity: "important" | "nit", path?, disposition: "open" | "fixed" | "false_positive"}]}. Reuse finding ids when updating their disposition; only the person may accept a finding with a rationale.`;
-    this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, ...(this.reviewHead(task) ? { commit: this.reviewHead(task)! } : {}), task: String(task.id), reviewRevision: String(this.reviewRequestRevision(task)) }, ...(this.isPii(task) ? { private: true } : {}) }));
+    return this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, ...(this.reviewHead(task) ? { commit: this.reviewHead(task)! } : {}), task: String(task.id), reviewRevision: String(this.reviewRequestRevision(task)) }, ...(this.isPii(task) ? { private: true } : {}) })).includes(reviewer);
   }
 
   private reviewRequestRevision(task: Task): number {
@@ -4086,25 +4089,35 @@ export class Tasks {
   }
 
   /** Host-only failure report, bound to the exact review request and its still-current child generation. */
-  async retryReviewer(id: number, failedPeer: PeerId, failure: { head?: string; flowRevision?: number; cause: "start_failed" | "quota" | "no_verdict" }, current: () => boolean): Promise<Task> {
+  async retryReviewer(id: number, failedPeer: PeerId, failure: { head?: string; flowRevision?: number; cause: "start_failed" | "quota" | "no_verdict" }, current: () => boolean, onReoffered?: () => void): Promise<Task> {
     if (!failure || !["start_failed", "quota", "no_verdict"].includes(failure.cause) || !/^[a-z][a-z0-9-]{0,63}$/.test(failedPeer) || !Number.isSafeInteger(failure.flowRevision) || failure.flowRevision! < 1 || failure.head !== undefined && (typeof failure.head !== "string" || text(failure.head) !== failure.head || Buffer.byteLength(failure.head) > 1200 || /\p{Cc}/u.test(failure.head))) throw new PreEffectToolRefusal("invalid reviewer failure binding");
     const valid = () => {
       const task = this.need(id, false, true);
-      if (!current() || task.state !== "in_review" || task.reviewer !== failedPeer || this.reviewRequestRevision(task) !== failure.flowRevision || this.reviewHead(task) !== failure.head || this.isPii(task) || this.manuallyNamedReviewer(task)) throw new PreEffectToolRefusal("reviewer failure is no longer current");
+      if (!current() || task.state !== "in_review" || task.reviewer !== failedPeer || this.reviewRequestRevision(task) !== failure.flowRevision || this.reviewHead(task) !== failure.head || this.isPii(task) || this.manuallyNamedReviewer(task) && failure.cause !== "no_verdict") throw new PreEffectToolRefusal("reviewer failure is no longer current");
       return task;
     };
     const before = valid();
     const admission = await this.reviewRequestAdmission(before, undefined, true, before.owner ?? USER, undefined, () => { valid(); return true; });
     const task = valid();
     const options = this.reviewPoolOptions(task);
-    const selection = assign(task, this.states(), this.d.routing(), { ...this.weights(task.class, task), candidates: [], ...(task.owner ? { notReviewer: task.owner } : {}), reviewPool: { ...options, failed: [...options.failed, failedPeer] } });
-    if (!selection.reviewSelection) throw new PreEffectToolRefusal("no declared reviewer pool can receive the fallback");
-    const reviewer = selection.reviewer ?? USER;
+    // A person-selected reviewer never falls through to an agent the person did not select.
+    const manual = this.manuallyNamedReviewer(task);
+    const selection = manual ? undefined : assign(task, this.states(), this.d.routing(), { ...this.weights(task.class, task), candidates: [], ...(task.owner ? { notReviewer: task.owner } : {}), reviewPool: { ...options, failed: [...options.failed, failedPeer] } });
+    if (!selection?.reviewSelection && failure.cause !== "no_verdict") throw new PreEffectToolRefusal("no declared reviewer pool can receive the fallback");
+    const reviewer = selection?.reviewSelection ? selection.reviewer ?? USER : USER;
     valid();
-    const next = this.d.board.update(task.id, HUB, "reviewer unavailable", { reviewer }, this.assignmentNote(`reviewer unavailable: ${failure.cause}`, selection), { ...this.reviewMetadata(selection), reviewerFailure: { peer: failedPeer, cause: failure.cause, ...(failure.head ? { head: failure.head } : {}) } }, task.history.length);
+    const note = manual ? "named reviewer recorded no verdict; the person must review"
+      : selection?.reviewSelection ? this.assignmentNote(`reviewer unavailable: ${failure.cause}`, selection) : "no declared reviewer pool can receive the fallback; the person must review";
+    const next = this.d.board.update(task.id, HUB, "reviewer unavailable", { reviewer }, note, { ...this.reviewMetadata(selection), ...(reviewer === USER ? { reviewBlocked: true } : {}), reviewerFailure: { peer: failedPeer, cause: failure.cause, ...(failure.head ? { head: failure.head } : {}) } }, task.history.length);
     this.releaseNotice(`task ${this.publicTitle(next)}: former review request withdrawal incomplete`, () => this.withdrawRoleRequest(task, next, "reviewer"));
-    if (reviewer === USER) this.releaseNotice(`task ${this.publicTitle(next)}: blocked: no reviewer can run; the planner or person must review`);
-    else this.releaseNotice(`task ${this.publicTitle(next)}: fallback review request unavailable`, () => this.sendReview(next, reviewer, "", admission));
+    let offered = false;
+    if (reviewer === USER) {
+      const notice = `task ${this.publicTitle(next)}: blocked: the person must review`;
+      this.releaseNotice(notice, () => { this.d.notify(notice); offered = true; });
+    } else this.releaseNotice(`task ${this.publicTitle(next)}: fallback review request unavailable`, () => { offered = this.sendReview(next, reviewer, "", admission); });
+    if (offered && current() && this.reviewBindingCurrent(reviewer, next.id, { head: this.reviewHead(next), flowRevision: this.reviewRequestRevision(next) })) {
+      try { onReoffered?.(); } catch { /* Unconfirmed host settlement retains the delivery hold. */ }
+    }
     return next;
   }
 

package/src/memory/brief.ts

@@ -1,3 +1,4 @@
+import { buildIntentBrief, type IntentBriefOptions, type IntentBriefSource } from "@staix/agent-mem";
 import type { PeerId } from "../hub/envelope.ts";
 import type { MemoryClient } from "./client.ts";
 
@@ -30,17 +31,20 @@ export async function related(client: MemoryClient, project: string, query: stri
 /** A native memory line for a brief (#258): `mem:<id8> <kind> <tier>: <title or text>`, fails first. */
 export interface NativeItem { id: string; line: string; kind?: string; about?: readonly string[]; tier?: string; peer?: string; machine?: string; at?: string }
 export type NativeBrief = (task: BriefTask) => NativeItem[] | Promise<NativeItem[]>;
+export interface IntentBriefContext { source: IntentBriefSource; options: IntentBriefOptions }
+/** Host-owned policy and store binding; the library owns relevance, ordering and text. */
+export type IntentBriefHost = (task: BriefTask) => IntentBriefContext | Promise<IntentBriefContext>;
 export interface BriefTask { id?: number; created?: number; title: string; refs: { paths?: string[] }; plan?: { paths?: string[]; symbols?: string[] } }
 
 /**
- * Task briefs: what memory already knows about a piece of work, handed over with it. The hub's own store first (#258:
- * entries one or two hops from the task's paths, symbols, issue and task, a linked fail first, superseded entries
- * dropped), then amem: index first (search), then the neighbourhood of the top hit (timeline); details stay in
- * the store for the receiver to fetch by id. `brief_items` caps both together. A peer is never shown the same entry
- * twice in one hub run, except a directly matching plan fail that must accompany a new task.
+ * Production task briefs use the library's intent retrieval and rendering with host policy and bindings.
+ * The hub applies its per-peer delivery dedupe and item cap to complete library rows, reserving the front
+ * for host-screened plan fails even when the library's byte cap omitted them. Injected clients without
+ * the library port retain the legacy index/timeline bridge; intent mode retires its related/readNotice path.
  */
 export class Briefs {
   private readonly seen = new Map<PeerId, Set<string>>();
+  private readonly libraryRuns = new Map<PeerId, Promise<unknown>>();
 
   constructor(
     private readonly client: MemoryClient | undefined,
@@ -50,11 +54,47 @@ export class Briefs {
     /** Counts of what a brief carried, for the research records (#258 AC11); never its text. */
     private readonly observe?: (peer: PeerId, task: number, counts: { native: number; fails: number; claudeMem: number }) => void,
     private readonly displayNative?: (items: readonly NativeItem[]) => string[],
+    private readonly intent?: IntentBriefHost,
   ) {}
 
   async forTask(peer: PeerId, task: BriefTask, priority: readonly NativeItem[] = []): Promise<string | undefined> {
     // A brief snapshots its configured cap once, before either optional source is selected.
     const maximum = typeof this.maxItems === "function" ? this.maxItems() : this.maxItems;
+    if (this.intent) {
+      // Serialize only this peer's library reads, so awaited policy cannot duplicate a delivered note.
+      const previous = this.libraryRuns.get(peer);
+      const run = (async () => {
+        await previous?.catch(() => undefined);
+        if (maximum < 1) return undefined;
+        try {
+          const context = await this.intent!(task);
+          const seen = this.seen.get(peer) ?? new Set<string>();
+          this.seen.set(peer, seen);
+          const revision = context.options.policyVersion();
+          const result = await buildIntentBrief(context.source, context.options);
+          if (result.state === "unknown" || context.options.allowed?.() === false || context.options.policyVersion() !== revision) return undefined;
+          context.options.assertCurrent?.();
+          const lines = result.text.split("\n");
+          const rendered = new Map(result.items.map((item, index) => [`mem:${item.id}`, lines[index + 1]!]));
+          const selected: NativeItem[] = [];
+          // Priority is already screened and sanitized by the host's plan guard. Its advice must survive
+          // the standalone library's byte cap or narrower retrieval policy, and recur with the next task.
+          for (const item of priority) if (selected.length < maximum && !selected.some(row => row.id === item.id)) selected.push({ ...item, line: rendered.get(item.id) ?? item.line });
+          for (const item of result.items) {
+            const id = `mem:${item.id}`;
+            if (selected.length < maximum && !seen.has(id) && !selected.some(row => row.id === id)) selected.push({ id, line: rendered.get(id)!, kind: item.kind });
+          }
+          if (!selected.length) return undefined;
+          // Preserve complete library rows (including graph neighbours after a seen direct bridge).
+          const text = [lines[0] || "Live fail notes for this plan (advice, not a block):", ...selected.map(item => item.line)].join("\n");
+          for (const item of selected) seen.add(item.id);
+          if (task.id !== undefined) try { this.observe?.(peer, task.id, { native: selected.length, fails: selected.filter(item => item.kind === "fail").length, claudeMem: 0 }); } catch { /* telemetry never fails a brief */ }
+          return text;
+        } catch { return undefined; }
+      })();
+      this.libraryRuns.set(peer, run);
+      try { return await run; } finally { if (this.libraryRuns.get(peer) === run) this.libraryRuns.delete(peer); }
+    }
     const seen = this.seen.get(peer) ?? new Set<string>();
     this.seen.set(peer, seen);
     let native: NativeItem[] = [];