@staix/agent-hub 0.19.0 → 0.21.0

package/src/hub/daemon.ts

@@ -1,4 +1,12 @@
-import { OperationalAuthorityError, OPERATIONAL_PERSON_GUIDANCE, operationalRosterSetting, operationalSetting, operationalRefusal, operationalRequestLabel } from "./operational-authority.ts";
+import { RoomStoreError } from "../rooms/store.ts";
+import { RoomCommands, type RoomPreview } from "../rooms/commands.ts";
+import { queueBackpressurePolicy, type QueueBackpressurePolicy } from "./queue-backpressure.ts";
+import { RoomChat } from "../rooms/service.ts";
+import { parseRemotePeerId } from "../rooms/application.ts";
+import { assertNativeProofPorts } from "../adapters/native-proof-ports.ts";
+import { externalInstanceCatalog } from "../adapters/external-metadata.ts";
+import { externalInstanceBinding, sameExternalInstanceBinding, externalInstanceStateDir, readExternalInstanceRecord, writeExternalInstanceRecord, type ExternalInstanceBinding } from "./external-instance.ts";
+import { OperationalAuthorityError, OPERATIONAL_PERSON_GUIDANCE, operationalRosterSetting, operationalSetting, operationalRefusal, operationalRequestLabel, CONDUCTOR_DAEMON_OPERATIONS, CONDUCTOR_TASK_OPS, conductorLocalOperation } from "./operational-authority.ts";
 import { operationalView, redactBusEvent } from "./operational-view.ts";
 import { inspectSelectedOrphans, stopSelectedOrphan, orphanProcessPorts } from "./orphan-process.ts";
 import { dogfoodLines } from "./dogfood-read.ts";
@@ -8,14 +16,16 @@ import { canonicalMemorySymbolNode, resolveMemorySymbolNodes, type MemorySymbolN
 import { AsyncLocalStorage } from "node:async_hooks";
 import { normalizeUsage } from "../omniroute/usage.ts";
 import { permissionPayload } from "./permission-payload.ts";
-import { readClaudeLaunchProof } from "./claude-launch-proof.ts";
+import { createClaudeFailureTrace, type ClaudeFailureTrace } from "./claude-failure-stage.ts";
+import { buildNativePermissionProbe, NATIVE_PERMISSION_PROBE_MAX_PER_LAUNCH, validateNativePermissionRequest } from "./native-permission-request.ts";
+import { createClaudeLaunchProof, readClaudeLaunchProof } from "./claude-launch-proof.ts";
 import { InboxPolling } from "./inbox-polling.ts";
 import { ActionBudgets, actionPolicyConfig, type ActionPolicyConfig } from "./action-policy.ts";
 import { actionGate, claudeActionClasses } from "./action-enforce.ts";
 import { ReleaseAuthorizations, releaseAuthorizationError } from "./sdlc-release-authorization.ts";
 import { parseReleaseGuardArgv, parseReleasePushUpdates } from "../cli/sdlc-release-guard.ts";
 import type { DocEvidence } from "./sdlc-release.ts";
-import { loadExternalAdapterDefinitions, readAdapterModuleDeclarations, type AdapterModuleDeclaration } from "../adapters/external-modules.ts";
+import { loadExternalAdapterDefinitions, readAdapterModuleDeclarations, externalModuleIdentity, externalModuleIdentityCurrent, type AdapterModuleDeclaration } from "../adapters/external-modules.ts";
 import { WsPeer, isWsPeer } from "../adapters/channel-peer.ts";
 import { ownerToolEffect, canonicalWriteUnknown } from "./no-writes.ts";
 import { NativeHookLaunches } from "./native-hook-launch.ts";
@@ -56,8 +66,8 @@ import { databaseBusySite, isDatabaseBusy, RecoveryDatabaseBusy } from "./recove
 import { ADAPTERS, DEFAULT_REVIEW_POOL, REVIEW_POOL_KINDS, QUOTA_HANDOFF_PLATFORMS, NATIVE_CONFIG_BLOCKS, nativeConfigurationDefaults, mergeNativeConfiguration, retainNativeRouting, DAEMON_PORTS, definitionOf, createProjectAdapterCatalog, isFixedBuiltinDefinition } from "../adapters/registry.ts";
 import { isSupportedPeer as registrySupportedPeer, definitionOf as builtinDefinitionOf, KNOWN_PEERS as BASE_KNOWN_PEERS, SUPPORTED_PEERS as BASE_SUPPORTED_PEERS, STARTABLE_PEERS as BASE_STARTABLE_PEERS } from "../adapters/registry.ts";
 import type { ReviewScope } from "./review-scope.ts";
-import { checkJcodeInstanceHomes, instanceDefinitionOf, effectiveInstanceRoles, instancePeerIds, validateInstances, type InstancesConfig } from "./instances.ts";
-import { INSTANCE_CONFIG_FILES, readInstanceConfig, readInstanceConfigLayers, readInstanceRoleConfig } from "./instance-config.ts";
+import { checkJcodeInstanceHomes, instanceDefinitionOf, effectiveInstanceRoles, isPlannerOnly, instancePeerIds, validateInstances, type InstancesConfig } from "./instances.ts";
+import { INSTANCE_CONFIG_FILES, readInstanceConfig, withoutInertInstancePolicy, readInstanceConfigLayers, readInstanceRoleConfig } from "./instance-config.ts";
 import { instanceBudgetHooks, projectBudgetHeadroom } from "./instance-budget.ts";
 import { resolveInstanceExecutionCwd } from "./instance-execution.ts";
 import { ProgressObserver, normalizeCodexObservation, normalizeClaudeObservation } from "./progress.ts";
@@ -70,10 +80,21 @@ import { spawn } from "node:child_process";
 import { childEnv } from "./child-process.ts";
 import { runCheck } from "./checks.ts";
 import { DEFAULT_TASK_SWEEP, taskSweepConfig, type TaskSweepConfig } from "./task-sweep.ts";
+import { CONTRADICTION_WINDOW_SETTING, DEMOTE_AT_SETTING, DEMOTION_HALF_LIFE_SETTING, GROOM_FYI_WINDOW_SETTING, RESCREEN_MAX_SETTING, SPLIT_FAILURE_SHARE_SETTING, SPLIT_MIN_SETTING, taskOperationalReaders } from "./operational-settings.ts";
+import { foldersConfig, scheduleViews, schedulesConfig, ScheduleStore, type FolderEntry, type ScheduleEntry } from "./schedules.ts";
+import { FolderStore, registerScanned, scanFolder, type FolderPolicy } from "./folder-trigger.ts";
+import type { ScannedFile } from "./schedules.ts";
+import { corpusConfig } from "./corpus-config.ts";
 import { ALL_MACHINE_LOCAL, configRepositoryPresent, configTracked, stripUntrusted } from "./config-trust.ts";
-import { authorizeConfigLeaf, configApply, configIdentityScope, configChanges, validateEffectiveConfig, validatePetConfig } from "./config-apply.ts";
+import { authorizeConfigLeaf, configApply, configIdentityScope, configChanges, validateEffectiveConfig, validateOperationalConfig, validatePetConfig } from "./config-apply.ts";
 import { resolveSettledRoles } from "./settled-roles.ts";
-import { CONFIG_SOURCE_FILES, configFingerprint, configSourceTexts, parseConfigSources, type ConfigSources } from "./config-reload.ts";
+import { CONFIG_SOURCE_FILES, configFingerprint, configSourceTexts, parseConfigSources, type ConfigSourceTexts, type ConfigSources } from "./config-reload.ts";
+import { issueConductorRecoveryAuthority, authorizeConductorRecovery, assertConductorRecovery, RecoveryAuthorityError, type ConductorRecoveryBinding } from "./recovery-authority.ts";
+import { captureRecoveryPolicy, readRecoveryPolicyInputs, recoveryRoutingFallback, assertRecoveryConfiguration, assertRecoveryRouting, assertRecoverySourceInputs, readRecoveryTargetFeatures } from "./recovery-policy.ts";
+import { operationPath, recoveryLock, readOperation } from "./recovery-store.ts";
+import { packageDigest, recoveryTargetDigest, verifyRecoveryTarget, exactVersion } from "../cli/recovery-package.ts";
+import { planFingerprint, registeredProjects, type UpgradePlan } from "../cli/upgrade.ts";
+import { conductorRecoveryBinding } from "../cli/conductor-recovery.ts";
 import { createConfigEditor } from "./config-edit-host.ts";
 import { readEditable } from "./config-edit.ts";
 import { eventLog, readEvents, type RoleIdentity } from "./events.ts";
@@ -84,7 +105,7 @@ import { kimiRowTotal } from "../adapters/kimi-wire-usage.ts";
 import { ExecutionBudget } from "./execution-budget.ts";
 import { claudeReportedTokens, readClaudeTranscriptCompletion, readClaudeTranscriptUsage, waitForClaudeCompletion } from "./usage.ts";
 import type { ServerWebSocket } from "bun";
-import { isAcpPeer, type AcpPeer, QwenIdentityError, ACTION_BUDGET_OPTION, type PermissionRequest, type ActionGateVerdict } from "../adapters/acp.ts";
+import { isAcpPeer, managedAcpLaunch, verifyManagedAcpLaunch, type AcpOptions, type AcpPeer, QwenIdentityError, ACTION_BUDGET_OPTION, type PermissionRequest, type ActionGateVerdict } from "../adapters/acp.ts";
 import { isCodexPeer, type CodexPeer } from "../adapters/codex-appserver.ts";
 import { isPiPeer, PiVersionRefusal, type PiPeer } from "../adapters/pi.ts";
 import { isQwenDualPeer, qwenDualVersionAsync, type QwenDualPeer } from "../adapters/qwen-dual.ts";
@@ -92,17 +113,18 @@ import { startModelRelay, type ModelRelay } from "../models/relay.ts";
 import { ensureMlx, type MlxOptions } from "../models/mlx.ts";
 import { PiToolReceipts, packPiShellResult } from "../pi/tool-receipts.ts";
 import { PreEffectToolRefusal } from "./tool-refusal.ts";
-import { processSignature } from "../pi/process-signature.ts";
+import { processSignature, processLiveness } from "../pi/process-signature.ts";
 import { PiSessionBookmarkMismatch, PiSessionUnresumable, recordPiReplacement, validatePiSession } from "../pi/session.ts";
 import { profile, proxyEnv, sandboxAvailable, type SandboxNetwork } from "../local/sandbox.ts";
 import { DEFAULT_NETWORK_ALLOW, startEgressProxy, type EgressProxy } from "../local/proxy.ts";
+import { webFetchAllow } from "../local/web-fetch-config.ts";
 import { runTool, toolResultFailed, TOOL_SCHEMAS, type ToolApproval, type ApprovalObserver, type ToolContext, type ShellPermitPolicy } from "../local/tools.ts";
 import { proveReadOnlyShell, ShellExecutionProofs } from "./read-only-shell-proof.ts";
 import { createHostShellWrapper, type HostShellWrapper } from "./claude-shell-wrapper.ts";
 import { readTaskShellDefaultBranch, readTaskShellBinding, proveTaskShell } from "./task-shell-proof.ts";
 import { taskShellSandboxRestrictions } from "./task-shell-sandbox.ts";
 import { hostShellEnvironment } from "../local/shell-environment.ts";
-import { hubGitArgv, hubGitEnv } from "./git.ts";
+import { hubGitArgv, hubGitEnv, hubGitSync } from "./git.ts";
 import { isLocalPeer, type LocalPeer } from "../adapters/local-worker.ts";
 import { isReviewerPrintPeer, reviewerNoVerdictLine, reviewerUnavailableReason, ReviewerUnavailableError, REVIEWER_FALLBACK_UNCONFIRMED, type ReviewerPrintPeer } from "../adapters/reviewer-print.ts";
 import { createReviewerMcpSession, type ReviewerToolName } from "../adapters/reviewer-mcp.ts";
@@ -110,7 +132,9 @@ import { reviewerPoolConfig } from "./reviewer-pool-config.ts";
 import { reviewDiff } from "../adapters/claude-print.ts";
 import { Capture } from "../memory/capture.ts";
 import { DEFAULT_OMNIROUTE, OmniRoute, type OmniRouteConfig } from "../omniroute/client.ts";
-import { Briefs } from "../memory/brief.ts";
+import { CorpusIndex } from "./corpus.ts";
+import { corpusEvidence } from "./corpus-evidence.ts";
+import { Briefs, type BriefTask } from "../memory/brief.ts";
 import { Board, isClosedTaskState, taskProposalAt, taskHasStarted, CLASSES, type Task, type TaskClass } from "./board.ts";
 import { UsageRollup, USAGE_GROUPS, LIMITS_MAX, type UsageGroup } from "./usage-rollup.ts";
 import { Budget, readNativeQuota, DEFAULT_BUDGET, type BudgetConfig } from "./budget.ts";
@@ -123,13 +147,13 @@ import { realPath, hubHome } from "./project.ts";
 import { mainCheckoutBranch, mainCheckoutWarning } from "./main-checkout.ts";
 import type { BusEvent, PublishResult } from "./bus.ts";
 import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, IMPLEMENTER_HUB_TOOL_NAMES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS, BOUNDED_TASK_TOOLS, profileTaskTools } from "./hub-tools.ts";
-import { Conductor, ConductorHolds, conductorPeer, requireConductor, conductorProgressSink, publicConductorTask, publicPeerBudget, type ConductEvent } from "./conductor.ts";
+import { Conductor, ConductorHolds, conductorPeer, requireConductor, conductorProgressSink, publicConductorTask, publicPeerBudget, taskShowAllowed, type ConductEvent } from "./conductor.ts";
 import { SupervisionFeed } from "./supervision.ts";
 import { drainCliAudits } from "../cli/identity-audit.ts";
 import { launcherPreview } from "../cli/preview.ts";
 import { AssignmentUndeliveredError, ESCALATE_AFTER, Tasks } from "./tasks.ts";
-import { DEFAULT_INFERENCE, DIGEST, Inference, screenPii, type InferenceConfig } from "./inference.ts";
-import { ask, ASK_NOTE_TITLE, RUN_START } from "./ask.ts";
+import { DEFAULT_INFERENCE, DIGEST, Inference, screenPii, type InferenceConfig, type PiiVerdict } from "./inference.ts";
+import { taskEvidencePrivacy, type TaskEvidencePrivacy, ask, ASK_NOTE_TITLE, RUN_START } from "./ask.ts";
 import { currentRouting, loadRouting, detectSignals, OVERLAY_FILE, overlayToml, parseRouting, routingText, type Routing } from "./routing.ts";
 import { NEVER_EDITABLE, projectSettings, checkSettingValue, ignoredLine, pendingUndo, pendingUndoIdentity, readOverlay, restoredValue, routingCandidate, storedLocally, sharedValue, settingDef as instanceSettingDef, settingRefusal, settingRows, settingText, undoSetting, valueAt, writeConfigSetting, writeRoutingSetting, type SettingAuthority, type SettingSource, type SettingDef, type SettingRow, type SettingValue, type UndoIdentity } from "./settings.ts";
 import { githubOriginRepository } from "./task-repository.ts";
@@ -140,7 +164,8 @@ import { startDashboard, dashboardView, type DashboardSession } from "./ui.ts";
 import { codeGroup } from "./task-code-group.ts";
 import { DAEMON_FEATURES, PROTOCOL, readControl, stateDirFor } from "./control-client.ts";
 import { MAX_HOP, newEnvelope, parseMarker, replyParent, sanitize, USER, type Envelope, type PeerId, type Priority } from "./envelope.ts";
-import { BasePeer, DEFAULT_WATCHDOG_MS, type PeerAdapter } from "./peers.ts";
+import { BasePeer, DEFAULT_WATCHDOG_MS, type FrontendProxyPort, type PeerAdapter } from "./peers.ts";
+import { ClaudeTodoSource, DoingTracker, readAiTitle, type DoingKind, type PeerDoing, type TitleCursor } from "./peer-doing.ts";
 import { MemoryClient } from "../memory/client.ts";
 import { VERSION } from "../version.ts";
 import { appendRecords, taskRecords } from "./research.ts";
@@ -152,10 +177,10 @@ import { Facts, FACTS_PREFIX, type FactScope } from "./facts.ts";
 import { crashPlan, lossNotice, readSessions, removeSessions, writeSessions, type SessionsFile } from "./crash.ts";
 import type { JournalDelivery } from "./delivery-journal.ts";
 import { DEFAULT_LIMITS, Limiter, PROJECT_LIMITS, type LimitsConfig } from "./limits.ts";
-import { soleWorktree, branchHeads, changedPaths, knownChangedPaths, hasTree, headState, headMoveCursor, incomingHeadPaths, repoOf, snapshot, SnapshotBudgetExceeded, budgetNow, Turns, type SnapshotBudget, type HeadMoveCursor, type Repo, type TurnRecord } from "./snapshots.ts";
+import { soleWorktree, branchHeads, changedPaths, dirtySubmodules, submodulePaths, knownChangedPaths, hasTree, headState, headMoveCursor, incomingHeadPaths, repoOf, snapshot, SnapshotBudgetExceeded, budgetNow, Turns, type SnapshotBudget, type HeadMoveCursor, type Repo, type TurnRecord } from "./snapshots.ts";
 import { archiveRestartSnapshot, readRecoveryWaivers, readRestartSnapshot, removeRestartSnapshot, restartPath, writeRestartSnapshot, type RecoveryPhase, type RestartPeerSnapshot, type RestartSnapshot } from "./restart.ts";
 import { consumeRecoveryContinuity, readRecoveryContinuity, retireRecoveryContinuity } from "./recovery-continuity.ts";
-import { shellQuote, publishTerminalLaunch, terminalLaunchCandidate } from "../cli/terminal-recovery.ts";
+import { shellQuote, publishTerminalLaunch, terminalLaunchCandidate, launcherOf } from "../cli/terminal-recovery.ts";
 import { TerminalLaunches, terminalOwnerReads } from "./terminal-launch.ts";
 
 import { peerStartConfig, PEER_START_RETRY_MS, startModeOf, terminalTemplate, type PeerStartConfig, type StartMode } from "./start-mode.ts";
@@ -169,7 +194,8 @@ import { looksSecret, DEFAULT_LEASE_MS, memoryHome, SUGGESTED, taskKey, type Can
 import { memoryProjectKey } from "@staix/agent-mem";
 import { AGENT_MEM_VERSION, MEMORY_SPLIT_INCOMPLETE, memoryProjectFor, openProfileMemory, openProfileCandidates, MemoryProfileBinding, type UnboundMemoryProfileReceipt } from "./memory-profile.ts";
 import { syncMemory, createIntentBriefSource, createStandalonePolicy } from "@staix/agent-mem";
-import { MEMORY_READ_TOOLS, memoryRead, validateMemoryRead } from "./read-tools.ts";
+import { SourceRegistry } from "./sources.ts";
+import { MEMORY_READ_TOOLS, memoryRead, validateMemoryRead, sourceRead, validateSourceRead } from "./read-tools.ts";
 import { nativeRecall } from "../memory/recall.ts";
 import { promotionScreen, withoutPii, mentionsPrivatePath } from "./memory-policy.ts";
 
@@ -204,6 +230,8 @@ export interface HubConfig {
   pii?: { paths: string[] };
   data?: { readonly: string[] };
   text_projection?: ProjectionConfig;
+  /** #510: machine-local folders of plain notes the hub may index, read-only; vault folders are refused when the index reads them. */
+  corpus: { paths: string[] };
   catalog_roles?: Record<string, string[]>;
   conductor: { feed: "own" | "all" | "off"; approval_wait_s: number };
   budget: BudgetConfig;
@@ -213,13 +241,17 @@ export interface HubConfig {
   pi: { enabled: boolean; auto_start: boolean; cmd: string[]; backend: "auto" | "dgx" | "mlx"; dgx_coding: string; dgx_fast: string; max_steps: number };
   mlx: { enabled: boolean } & Pick<MlxOptions, "provider" | "host" | "runtimeDir" | "modelPath" | "port" | "model" | "sourceModel" | "contextWindow" | "maxInputTokens" | "maxTokens" | "maxConcurrency">;
   /** `bash_network`: true is network through the egress proxy to `network_allow` (#65); "direct" is everything, until 0.13.0 (#83). */
-  local: { deny: string[]; bash_network: boolean | "direct"; network_allow: string[]; max_steps: number; read_allow: string[] };
+  local: { deny: string[]; bash_network: boolean | "direct"; network_allow: string[]; max_steps: number; read_allow: string[]; /** #515: offer the local worker `doc_read` (PDF, DOCX, HWPX through `text_projection`); off by default, machine-local. */ doc_read: boolean; /** #515b: the hosts the local worker's `web_fetch` may read; empty (the default) means the tool does not exist. Machine-local. */ web_fetch: { allow: string[] } };
   /** Pending permission requests: how long they wait, and whether the desktop is told (issue #5). */
   approvals: { timeout_s: number; notify: boolean };
   /** An owner offline this long loses its open tasks back to routing; 0 turns it off (issue #6). */
-  tasks: { release_after_min: number; wip_limits?: Record<string, number>; escalate_after: number };
+  tasks: { release_after_min: number; wip_limits?: Record<string, number>; escalate_after: number; groom_fyi_window_min?: number; demote_at?: number; demotion_half_life_h?: number; contradiction_window_days?: number; rescreen_max?: number; split_min_observations?: number; split_max_failure_share?: number; /** #785 P1c: pull the top explicitly reserved ready card when a slot frees; machine-local, default off. */ auto_pull?: boolean; queue_backpressure?: Partial<QueueBackpressurePolicy> };
   /** Between-turn task escalation, disabled unless explicitly enabled (#186). */
   task_sweep: TaskSweepConfig;
+  /** #512a: machine-local schedules; checked by `schedulesConfig`, never set from a committed file. */
+  schedules: ScheduleEntry[];
+  /** #512c: machine-local folder triggers, polled on the schedules timer; checked by `foldersConfig`, never set from a committed file. */
+  folder_triggers: FolderEntry[];
   /** A command per task class run when the owner marks the task done, and its timeout (issue #7). */
   checks: { timeout_s: number; runner?: "container" | "remote"; remote?: RemoteRunnerConfig; [cls: string]: string | number | RemoteRunnerConfig | undefined };
   /** A git tree at each turn boundary for `ahub turns` and `ahub undo`, the last `keep` per peer (issue #33). */
@@ -278,8 +310,11 @@ export const DEFAULT_CONFIG: HubConfig = {
   ...nativeDefaults.sandbox,
   // Off here, so tests and a hub without a config file stay silent; a project's config defaults it on for macOS.
   approvals: { timeout_s: 120, notify: false },
-  tasks: { release_after_min: 30, escalate_after: ESCALATE_AFTER },
+  tasks: { release_after_min: 30, escalate_after: ESCALATE_AFTER, groom_fyi_window_min: GROOM_FYI_WINDOW_SETTING.defaultValue, demote_at: DEMOTE_AT_SETTING.defaultValue, demotion_half_life_h: DEMOTION_HALF_LIFE_SETTING.defaultValue, contradiction_window_days: CONTRADICTION_WINDOW_SETTING.defaultValue, rescreen_max: RESCREEN_MAX_SETTING.defaultValue, split_min_observations: SPLIT_MIN_SETTING.defaultValue, split_max_failure_share: SPLIT_FAILURE_SHARE_SETTING.defaultValue, auto_pull: false },
   task_sweep: DEFAULT_TASK_SWEEP,
+  schedules: [],
+  folder_triggers: [],
+  corpus: { paths: [] },
   checks: { timeout_s: 600 },
   // Off here like approvals.notify, so tests (whose cwd is this repository) write no objects; a project's config turns it on.
   snapshots: { enabled: false, keep: 20 },
@@ -297,14 +332,14 @@ export const DEFAULT_CONFIG: HubConfig = {
 export { stateDirFor };
 
 /** Ids an external process may not claim: the console user and the adapters the daemon runs itself. */
-const READ_ONLY_HUB_TOOLS = new Set(["hub_inbox", "hub_send", "hub_delivery_done", "hub_review", "hub_task_show", "hub_task_list", "hub_memory_search", "hub_memory_show", "hub_memory_graph", "hub_status"]);
+const READ_ONLY_HUB_TOOLS = new Set(["hub_inbox", "hub_send", "hub_delivery_done", "hub_review", "hub_task_show", "hub_task_list", "hub_memory_search", "hub_memory_show", "hub_memory_graph", "hub_source_read", "hub_status"]);
 const BASE_RESERVED_IDS = new Set<string>([USER, ...SUPPORTED_PEERS.filter(peer => definitionOf(peer)?.attach?.externalHello !== true), HUB, DIGEST]);
 const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
 /** The shared project config, then the machine's own file, which overrides it block by block (issue #17). */
 const CONFIG_FILES = INSTANCE_CONFIG_FILES;
 export interface ConfigLayer { name: typeof CONFIG_FILES[number]; raw: Record<string, any> }
-const CONFIG_BLOCKS = ["action_policy", "memory", "roster", "roles", "catalog_roles", "pii", "data", "conductor", "budget", "context", "inference", "omniroute", ...NATIVE_CONFIG_BLOCKS, "approvals", "tasks", "task_sweep", "checks", "snapshots", "research", "bench", "limits", "review", "recovery", "capabilities", "mlx", "permission_modes", "peers", "terminal", "pet"];
+const CONFIG_BLOCKS = ["action_policy", "memory", "roster", "roles", "catalog_roles", "pii", "data", "conductor", "budget", "context", "inference", "omniroute", ...NATIVE_CONFIG_BLOCKS, "approvals", "tasks", "task_sweep", "corpus", "checks", "snapshots", "research", "bench", "limits", "review", "recovery", "capabilities", "mlx", "permission_modes", "peers", "terminal", "pet"];
 
 /** Connection-time policy refresh reads role/feed fields only, never launches or machine-local configuration. */
 export function loadConductorPolicy(cwd: string, layers?: readonly ConfigLayer[], scope: Pick<ReturnType<typeof readInstanceConfig>, "instances" | "catalog"> = readInstanceConfig(cwd, layers)): { roles: Record<string, string[]>; conductor: HubConfig["conductor"]; planner?: string | string[]; notices?: string[] } {
@@ -381,7 +416,7 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     let file: Record<string, any>; // parsed JSON, checked field by field below
     if (!captured.some(layer => layer.name === name)) return [];
     try {
-      file = structuredClone(captured.find(layer => layer.name === name)!.raw);
+      file = withoutInertInstancePolicy(structuredClone(captured.find(layer => layer.name === name)!.raw), instanceConfig.declaredExternalInstances);
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
       throw error;
@@ -394,6 +429,9 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     profileName(file.profile);
     resolveProfile(file.profile, file.profile_overrides);
     projectionConfig(file.text_projection);
+    corpusConfig(file.corpus);
+    queueBackpressurePolicy(file.tasks?.queue_backpressure);
+    validateOperationalConfig(file);
     for (const [block, key] of [["pii", "paths"], ["data", "readonly"]] as const) {
       const raw = file[block];
       if (raw !== undefined && (!raw || typeof raw !== "object" || Array.isArray(raw) || Object.keys(raw).some(k => k !== key))) throw new Error(block + " must be a bounded path policy block");
@@ -411,6 +449,7 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     terminalTemplate(file.terminal?.open);
     if (file.pet !== undefined) validatePetConfig(file.pet, "config.pet");
     if (file.pet && typeof file.pet === "object" && !Object.keys(file.pet).length) delete file.pet;
+    delete file.declaredExternalInstances; // host-derived refusal rows, never a file claim
     delete file.permission_default_sources; // provenance is loader-owned, never a file claim
     if (file.checks?.runner === "remote" || file.checks?.remote !== undefined) {
       if (name !== "config.local.json" || configTracked(cwd, name) !== false) throw new Error("remote checks require untracked config.local.json");
@@ -423,6 +462,8 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
   });
   if (!files.length) return routingRetired.length ? { ...DEFAULT_CONFIG, retired: [...routingRetired] } : DEFAULT_CONFIG;
   const file = files.reduce((a, b) => ({ ...a, ...b, ...Object.fromEntries(CONFIG_BLOCKS.filter((k) => a[k] !== undefined && b[k] !== undefined).map((k) => [k, { ...a[k], ...b[k] }])) }));
+  const pressureLayers = files.filter(layer => layer.tasks?.queue_backpressure !== undefined);
+  if (pressureLayers.length) file.tasks = { ...file.tasks, queue_backpressure: pressureLayers.reduce((prior, layer) => ({ ...prior, ...layer.tasks.queue_backpressure }), {}) };
   const wipLayers = files.filter(layer => layer.tasks?.wip_limits !== undefined);
   if (wipLayers.length) file.tasks = { ...file.tasks, wip_limits: wipLayers.reduce((prior, layer) => ({ ...prior, ...planningWipLimits(layer.tasks.wip_limits) }), {} as Record<string, number>) };
   const overrides = files.reduce<unknown>((prior, layer) => mergeProfileOverrides(prior, layer.profile_overrides), undefined);
@@ -478,7 +519,7 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     memory: { ...DEFAULT_CONFIG.memory, native: true, ...file.memory, ...(file.memory?.short_ttl_days !== undefined ? { short_ttl_days: ttlDays(file.memory.short_ttl_days) } : {}),
       ...(file.memory?.sync_interval_min !== undefined ? { sync_interval_min: syncMinutes(file.memory.sync_interval_min) } : {}) }, // the native store is on with any project config (#258)
     roster: peerRosterConfig(file.roster, instances, adapterCatalog, inertModuleRoster),
-    roles: { ...configuredRoles, ...conductorPolicy.roles, ...extraRoles },
+    roles: Object.fromEntries(Object.entries({ ...configuredRoles, ...conductorPolicy.roles, ...extraRoles }).filter(([id]) => !instanceConfig.declaredExternalInstances?.some(row => row.id === id || row.kind === id))),
     planner: conductorPolicy.planner,
     conductor: conductorPolicy.conductor,
     budget: { ...DEFAULT_CONFIG.budget, wait_max_min: 30, ...file.budget }, // on with any project config (issue #36)
@@ -492,6 +533,9 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     },
     tasks: { ...DEFAULT_CONFIG.tasks, ...file.tasks, ...(file.tasks?.wip_limits !== undefined ? { wip_limits: planningWipLimits(file.tasks.wip_limits) } : {}) },
     task_sweep: taskSweepConfig(file.task_sweep),
+    schedules: schedulesConfig(file.schedules),
+    folder_triggers: foldersConfig(file.folder_triggers),
+    corpus: corpusConfig(file.corpus),
     checks: { ...DEFAULT_CONFIG.checks, ...file.checks, runner: file.checks?.runner === "remote" ? "remote" : file.checks?.runner === "container" ? "container" : undefined,
       ...(file.checks?.remote !== undefined || file.checks?.runner === "remote" ? { remote: remoteRunnerConfig(file.checks?.remote) } : {}) },
     snapshots: { ...DEFAULT_CONFIG.snapshots, enabled: true, ...file.snapshots },
@@ -534,11 +578,15 @@ export interface DaemonOptions {
   memoryClient?: MemoryClient;
   /** Host-only remote-default evidence seam; never read from config or control messages. */
   shellDefaultBranchProbe?: typeof readTaskShellDefaultBranch;
+  /** Host-only workspace-validation Git seam; never supplied by project config or control messages. */
+  instanceExecutionGit?: typeof hubGitSync;
   /** Host-only snapshot/probe seams; never read from project config or tool arguments. */
   snapshot?: typeof snapshot;
   snapshotBurstMs?: number;
   /** Host-only (#661): the clock the shared snapshot Git budget reads (default performance.now). A test holds it fixed so a slow runner cannot spend the 250 ms; production never sets it and no config key or tool reaches it. */
   snapshotClock?: () => number;
+  /** Host-only bounds of the per-head CI watcher (#785 P1b); tests shorten them, never read from config or a tool. */
+  ciWatch?: { deadlineMs?: number; pollMs?: number };
   checkoutBranch?: typeof mainCheckoutBranch;
   /** Host-only admission transport; never selected by project config or tools. */
   releaseHostAdmission?: (cwd: string) => Promise<ReleaseHostAdmission>;
@@ -578,8 +626,28 @@ export interface DaemonOptions {
   agentDriftEveryMs?: number;
   /** Test seam: an extra hold on the SDLC band evaluation, like a storage error. */
   bandsHeld?: () => boolean;
+  /** Test seam: the schedules clock and the period of the due check (default Date.now and one minute). */
+  schedulesNow?: () => number;
+  schedulesEveryMs?: number;
+  /** Test seam: an extra hold on the schedules timer, like a storage error. */
+  schedulesHeld?: () => boolean;
+  /** Test seam: replaces the PII screen's model call, so a test can hold a screen open. */
+  piiScreen?: (text: string) => Promise<PiiVerdict>;
+  /** Test seam: how often the scheduled security-scan baseline checks whether a scan is due, default one hour (the configured `every_h` still decides). */
+  securityScanEveryMs?: number;
   /** How long a research record waits after an approval for the task's open turns to end (#247). Tests shrink this. */
   researchGraceMs?: number;
+  /**
+   * Host-only test seam (#546), never read from config or a control message: `false` leaves the config file watcher off, so an
+   * explicit `settings_reload` is the only publisher. With it on, the watcher and a reload of the same bytes race: whichever runs
+   * second reports `applied: []`, and a watcher pass between a preview and its confirm replaces the confirmation token.
+   */
+  configWatch?: boolean;
+  /**
+   * Host-only test seam (#553), never read from config or a control message: the transport the `web_fetch` tool uses instead of the global `fetch`, so a daemon test
+   * does not make a real round trip to a public host. The tool still gets the daemon's own proxy URL and allowlist; only the request itself is replaced.
+   */
+  webFetchTransport?: import("../local/web-fetch.ts").WebFetchPort["fetch"];
   /** Tests observe timer-driven sync without opening a remote; production uses the package sync. */
   memorySync?: typeof syncMemory;
   /** Host-only test/embedding transports. Never read from config or tool input. */
@@ -595,6 +663,7 @@ interface Client {
   role?: "peer" | "console" | "tools";
   peer?: PeerId;
   launchId?: string;
+  externalOwner?: { owner: PeerAdapter; launchId: string; generation?: string };
   toolsOwner?: { owner: PeerAdapter; launchId: string; generation: string; cwd: string };
   tail?: () => void;
   watch?: () => void;
@@ -626,22 +695,59 @@ export function resolutionRefusal(error: unknown): string {
 /** No remote set and a stop are not failures: agent-mem words the missing remote "no sync remote" (v1) or "no generation sync remote configured". */
 export const quietSyncError = (error: string | undefined): boolean => /^(no (generation )?sync remote|stopped)/.test(error ?? "");
 
+let recoverySourcePackageDigest: string | null | undefined;
+function capturedRecoverySourceDigest(): string | undefined {
+  if (recoverySourcePackageDigest === undefined) {
+    try { recoverySourcePackageDigest = packageDigest(resolve(import.meta.dir, "../..")); }
+    catch { recoverySourcePackageDigest = null; }
+  }
+  return recoverySourcePackageDigest ?? undefined;
+}
+
 export async function startDaemon(opts: DaemonOptions) {
+  const resolveExecutionCwd = (peer: string, currentDeclarations: InstancesConfig | undefined, currentRoles: readonly string[], catalog: ReturnType<typeof createProjectAdapterCatalog>): string =>
+    resolveInstanceExecutionCwd(opts.cwd, peer, currentDeclarations, currentRoles, catalog, undefined, undefined, opts.instanceExecutionGit);
   const projectId = opts.projectId ?? randomUUID();
+  const sourcePackageDigest = capturedRecoverySourceDigest();
   const instanceId = opts.instanceId ?? randomUUID();
   const startupCleanup: (() => void | Promise<void>)[] = [];
   let ready = false;
   try {
   let startupLayers: ReturnType<typeof readInstanceConfigLayers>;
-  try { startupLayers = readInstanceConfigLayers(opts.cwd); }
-  catch (error) { if (!opts.config) throw error; startupLayers = []; } // Explicit embeddings may ignore unreadable file config; no code is loaded from it.
+  let recoveryConfiguration: HubConfig | undefined, recoveryRouting: Routing | undefined, recoverySources: ConfigSourceTexts | undefined, recoveryDefaultRouting: string | undefined;
+  const recoveryInitiator = process.env.AGENTHUB_RECOVERY_CONDUCTOR;
+  if (recoveryInitiator !== undefined) {
+    // Before module imports or factories: the exact startup snapshot must match the source-issued policy.
+    try {
+      const operationId = process.env.AGENTHUB_RECOVERY_OPERATION;
+      if (!operationId) throw new RecoveryAuthorityError();
+      const operation = readOperation<import("../cli/upgrade.ts").RecoveryOperation>(operationId);
+      if (!operation || operation.id !== operationId) throw new RecoveryAuthorityError();
+      const snapshot = readRestartSnapshot(opts.stateDir, { projectRoot: opts.cwd, projectId, operationId });
+      if (!snapshot) throw new RecoveryAuthorityError();
+      const inputs = readRecoveryPolicyInputs(opts.cwd, operation.conductorRoutingDefaults?.[projectId]);
+      const candidate = loadConfig(opts.cwd, inputs.layers, inputs.routing.retired ?? [], []);
+      const expected = conductorRecoveryBinding(operation, { root: opts.cwd, id: projectId, stateDir: opts.stateDir }, recoveryInitiator, { config: candidate, inputs });
+      if (expected.sourceInstanceId !== snapshot.sourceInstanceId || expected.targetRoot !== resolve(import.meta.dir, "../..") || expected.targetDigest !== sourcePackageDigest) throw new RecoveryAuthorityError();
+      const proof = authorizeConductorRecovery(opts.stateDir, expected, () => { const value = captureRecoveryPolicy({ root: opts.cwd, id: projectId, stateDir: opts.stateDir }, recoveryInitiator, candidate, inputs); return value.policyDigest === expected.policyDigest && value.boardDigest === expected.boardDigest; });
+      assertConductorRecovery(proof);
+      startupLayers = inputs.layers; recoveryConfiguration = candidate; recoveryRouting = inputs.routing; recoverySources = inputs.texts; recoveryDefaultRouting = inputs.routingFallback;
+    } catch { throw new RecoveryAuthorityError(); }
+    delete process.env.AGENTHUB_RECOVERY_CONDUCTOR;
+    delete process.env.AGENTHUB_RECOVERY_CONTINUATION;
+    if (process.env.AGENTHUB_PEER_ID === recoveryInitiator) delete process.env.AGENTHUB_PEER_ID;
+  } else {
+    try { startupLayers = readInstanceConfigLayers(opts.cwd); }
+    catch (error) { if (!opts.config) throw error; startupLayers = []; }
+  } // Explicit embeddings may ignore unreadable file config; no code is loaded from it.
   const externalAdapterRefusals: import("../adapters/external-modules.ts").ExternalAdapterRefusalRecord[] = [];
   const externalDefinitions = await loadExternalAdapterDefinitions(opts.cwd, startupLayers, refusal => externalAdapterRefusals.push(refusal));
   const externalAdapters = externalDefinitions.map(({ kind, displayName }) => ({ kind, displayName }));
   const externalIds = new Set(externalAdapters.map(item => item.kind));
   const moduleDeclarations = readAdapterModuleDeclarations(opts.cwd, startupLayers).modules;
-  const loadedConfig = opts.config ? { ...opts.config, adapter_modules: moduleDeclarations.length ? moduleDeclarations : undefined }
-    : loadConfig(opts.cwd, startupLayers, undefined, externalDefinitions);
+  const startupDeclarationRows = readInstanceConfig(opts.cwd, startupLayers, externalDefinitions).declaredExternalInstances ?? [];
+  const loadedConfig = recoveryConfiguration ?? (opts.config ? { ...opts.config, adapter_modules: moduleDeclarations.length ? moduleDeclarations : undefined }
+    : loadConfig(opts.cwd, startupLayers, undefined, externalDefinitions));
   reviewerPoolConfig(loadedConfig.review, DEFAULT_REVIEW_POOL, REVIEW_POOL_KINDS);
   const lifecycleConfig = loadSdlc(opts.cwd, VERSION);
   // Preserve embedding-owned policy references, but never publish reloads into shared defaults.
@@ -661,6 +767,9 @@ export async function startDaemon(opts: DaemonOptions) {
   const childToolAuthority = new AsyncLocalStorage<{ by: string; current: () => boolean }>();
   const implementerTranscripts = new Map<string, string>();
   const executionOwners = new Map<string, { owner: PeerAdapter; cwd: string; socket?: Sock; launchId?: string; generation?: string | number }>();
+  const externalLaunches = new Map<string, { owner: PeerAdapter; options: AcpOptions; launchId: string; binding: ExternalInstanceBinding; workspace: string; generation?: string }>();
+  const externalBindings = new Map<string, ExternalInstanceBinding>();
+  const externalSessions = new Map<string, string>();
   const verifiedTerminalRootsThisTurn = new Set<object>();
   const reviewerUnavailable = new Map<string, string>();
   const reviewerToolObservers = new Map<string, (task: number, tool: ReviewerToolName, refusal?: string) => void>();
@@ -684,6 +793,66 @@ export async function startDaemon(opts: DaemonOptions) {
     roles, conductor: { ...DEFAULT_CONFIG.conductor, ...loadedConfig.conductor } };
   // The resolver and catalogs are bound to this daemon, never published into the process-global builtin registry.
   const definitionOf = (peer: string) => adapterCatalog.definitionOf(peer, declarations);
+  const externalInstanceIds = extraIds.filter(id => externalIds.has(declarations[id]!.kind));
+  // Instance declarations and their effective role ceiling are restart-bound, even for a fresh native session.
+  const externalStartupPolicies = new Map(externalInstanceIds.map(id => [id, { declaration: structuredClone(declarations[id]!), roles: [...(config.roles[id] ?? [])] }]));
+  const externalRefusedRows = new Map(startupDeclarationRows.map(row => [row.id, row]));
+  const allExternalInstanceIds = () => [...new Set([...(restored?.peers ?? []).filter(row => row.externalInstance).map(row => row.id), ...externalInstanceIds, ...externalRefusedRows.keys()])];
+  const isExternalInstance = (peer: string) => externalInstanceIds.includes(peer);
+  // ponytail: each instance costs about 10 synchronous Git calls per fresh turn (64 instances maximum);
+  // a stat-keyed evidence cache is the upgrade path, preserving fresh effect-boundary rechecks.
+  const externalEvidenceThisTurn = new Map<string, { binding: ExternalInstanceBinding; workspace: string } | undefined>();
+  let externalEvidenceExpiryQueued = false;
+  function externalEvidence(peer: string, fresh = false): { binding: ExternalInstanceBinding; workspace: string } | undefined {
+    if (!fresh && externalEvidenceThisTurn.has(peer)) return externalEvidenceThisTurn.get(peer);
+    let evidence: { binding: ExternalInstanceBinding; workspace: string } | undefined;
+    try {
+      if (externalRefusedRows.has(peer)) throw new Error("external instance module refused");
+      const binding = captureExternalBinding(peer);
+      const retained = externalBindings.get(peer);
+      if (retained && !sameExternalInstanceBinding(retained, binding)) throw new Error("external instance binding changed");
+      evidence = { binding, workspace: externalWorkspaceIdentity(binding.executionCwd) };
+      externalBindings.set(peer, binding);
+    } catch { /* Unavailable evidence is cached only for this synchronous turn, never authority. */ }
+    externalEvidenceThisTurn.set(peer, evidence);
+    if (!externalEvidenceExpiryQueued) {
+      externalEvidenceExpiryQueued = true;
+      queueMicrotask(() => { externalEvidenceThisTurn.clear(); externalEvidenceExpiryQueued = false; });
+    }
+    return evidence;
+  }
+  function externalWorkspaceIdentity(cwd: string): string {
+    const info = lstatSync(cwd);
+    if (!info.isDirectory() || info.isSymbolicLink()) throw new Error("external workspace directory changed");
+    const branch = hubGitSync(["-C", cwd, "symbolic-ref", "-q", "HEAD"], { encoding: "utf8", timeout: 1000, maxBuffer: 4096 });
+    if (branch.error || branch.status !== 0 && branch.status !== 1) throw new Error("external workspace branch evidence unavailable");
+    return `${info.dev}:${info.ino}:${branch.status === 0 ? branch.stdout.trim() : "detached"}`;
+  }
+  function captureExternalBinding(peer: string, resumeSessionId?: string): ExternalInstanceBinding {
+    const definition = definitionOf(peer), identity = definition && externalModuleIdentity(definition);
+    if (!identity || !externalModuleIdentityCurrent(definition!)) throw new Error("external instance module binding changed");
+    const current = readInstanceConfig(opts.cwd, undefined, externalDefinitions);
+    const declaration = current.instances?.[peer];
+    if (!declaration || declaration.kind !== declarations[peer]?.kind) throw new Error("external instance declaration changed");
+    const policy = loadConductorPolicy(opts.cwd, undefined, current);
+    const currentRoles = effectiveInstanceRoles(peer, current.instances, policy.roles, current.catalog);
+    const cwd = resolveExecutionCwd(peer, current.instances, currentRoles, current.catalog);
+    const binding = externalInstanceBinding(identity, peer, declaration, currentRoles, cwd);
+    const startup = externalStartupPolicies.get(peer);
+    if (!startup || binding.policyDigest !== externalInstanceBinding(identity, peer, startup.declaration, startup.roles, cwd).policyDigest) throw new Error("external instance policy changed; restart the hub before starting under its new policy");
+    const record = readExternalInstanceRecord(opts.stateDir, peer);
+    const sameBinding = record && sameExternalInstanceBinding(record.externalInstance, binding);
+    if (resumeSessionId !== undefined) {
+      if (record && !sameBinding) throw new Error("external instance retained record binding changed");
+      if (!record || record.sessionId !== resumeSessionId) throw new Error("external instance resume requires its recorded native session id");
+    }
+    if (sameBinding) externalSessions.set(peer, record.sessionId);
+    else externalSessions.delete(peer); // Changed continuity does not prevent a person's fresh session. Successful start replaces the record.
+    return binding;
+  }
+  function retainedExternalBinding(peer: string, fresh = false): ExternalInstanceBinding | undefined {
+    return externalEvidence(peer, fresh)?.binding;
+  }
   const KNOWN_PEERS: readonly string[] = [...BASE_KNOWN_PEERS, ...configuredIds, ...extraIds];
   const SUPPORTED_PEERS: readonly string[] = [...BASE_SUPPORTED_PEERS, ...configuredIds, ...extraIds];
   const STARTABLE_PEERS: readonly string[] = [...BASE_STARTABLE_PEERS, ...configuredIds, ...extraIds.filter(id => !channelExtras.includes(id))];
@@ -692,8 +861,29 @@ export async function startDaemon(opts: DaemonOptions) {
   const RESERVED_IDS = new Set([...BASE_RESERVED_IDS, ...configuredIds, ...extraIds.filter(id => !channelExtras.includes(id))]);
   // #223 R2: a declared instance whose effective roles are exactly reviewer gets review requests and its own task notices only.
   const reviewOnlyPeer = (peer: string): boolean => Object.hasOwn(declarations, peer) && config.roles[peer]?.length === 1 && config.roles[peer]![0] === "reviewer";
+  /** Display the same runtime form/role ceilings used by declarations; these fields grant no authority. */
+  function roleVisibility(peer: string): { form?: string; capableRoles: string[] } {
+    const definition = definitionOf(peer), declaration = declarations[peer];
+    if (!definition) return { capableRoles: [] };
+    const fixed = isFixedBuiltinDefinition(definition);
+    const candidates: readonly string[] = fixed ? definition.routing?.reviewOnly ? definition.roles : definition.instances?.roles ?? ["planner", "implementer", "verifier", "reviewer", "conductor"]
+      : declaration ? definition.headlessInstances?.roles ?? definition.roles : definition.roles;
+    const capableRoles = candidates.filter(role => (!definition.routing?.allowedRoles || definition.routing.allowedRoles.includes(role))
+      && (role !== "planner" || (fixed ? definition.projection?.plannerEligible === true : !declaration && definition.roles.includes(role)))
+      && (fixed || role !== "conductor"));
+    const owner = bus.peers.get(peer);
+    const form = !declaration ? owner && "form" in owner ? owner.form : startMode(peer) : definition.instances?.mode === "external"
+      ? (config.roles[peer] ?? []).some(role => role === "implementer" || role === "verifier") ? "terminal-implementer" : "channel" : "headless";
+    return { form, capableRoles: [...capableRoles] };
+  }
+
   /** #520: a task under review shows its review brief to whoever may read it (owner, reviewer, conductor). */
   const briefField = (task: Task): { brief?: string } => { if (task.state !== "in_review") return {}; const text = tasks.briefText(task); return text ? { brief: text } : {}; };
+  const holderReasons = (view: Record<string, unknown>) => ({
+    ...(typeof view.plannerReason === "string" ? { plannerReason: view.plannerReason } : {}),
+    ...(typeof view.ownerReason === "string" ? { ownerReason: view.ownerReason } : {}),
+    ...(typeof view.reviewerReason === "string" ? { reviewerReason: view.reviewerReason } : {}),
+  });
   /** #223 R2: a review-only instance reads the spec, refs and earlier verdicts of a task, never the builder's narrative. */
   const reviewerView = (peer: string, view: Record<string, unknown>): Record<string, unknown> => {
     if (!reviewOnlyPeer(peer) || !Array.isArray(view.history)) return view;
@@ -731,7 +921,8 @@ export async function startDaemon(opts: DaemonOptions) {
   const projectRosterAllows = (roster: PeerRoster, peer: string, piEnabled: boolean) => rosterAllows(roster, peer, piEnabled, declarations, adapterCatalog, moduleDeclarations.length > 0);
   const onRoster = (peer: string) => projectRosterAllows(config.roster, peer, config.pi.enabled);
   // pi.enabled historically gates starts, not retained queues or tools sockets. Only an explicit roster.pi changes those.
-  const membershipAllowed = (peer: string) => definitionOf(peer)?.enabledSwitchStartOnly && config.roster[peer] === undefined ? true : onRoster(peer);
+  const remoteRoster = new Set<string>();
+  const membershipAllowed = (peer: string) => peer.includes("@") ? remoteRoster.has(peer) : definitionOf(peer)?.enabledSwitchStartOnly && config.roster[peer] === undefined ? true : onRoster(peer);
   conductorPeer(config.roles); // reject ambiguous leadership before opening a control listener
   const mlxConfigProblem = mlxLaunchProblem(config, config.pi) ?? disabledMlxPolicyProblem(config, opts.cwd);
   if (mlxConfigProblem) throw new Error(mlxConfigProblem);
@@ -745,8 +936,10 @@ export async function startDaemon(opts: DaemonOptions) {
     let publicLine:string|undefined,view:ReturnType<typeof operationalView>|undefined;
     for(const [sock,current] of operationalLogSubscribers)try {current();if(sock.getBufferedAmount()>64*1024)throw new Error("slow log consumer");view??=publicOperationalView();publicLine??=view.line(text);sock.send(JSON.stringify({t:"operational_log",line:publicLine,complete:view.complete,...(!view.complete?{incompleteReason:view.incompleteReason}:{})}));}catch{operationalLogSubscribers.delete(sock);try{sock.close(4403,"operational log authority ended");}catch{/* The subscription is already gone. */}}
   };
-  let runningRouting = currentRouting(opts.cwd, log);
-  let acceptedSources = parseConfigSources(configSourceTexts(opts.cwd), runningRouting, opts.cwd, externalAdapters);
+  let runningRoutingDefault = recoveryDefaultRouting;
+  if (runningRoutingDefault === undefined) try { runningRoutingDefault = recoveryRoutingFallback(); } catch { /* unknown defaults refuse conductor recovery */ }
+  let runningRouting = recoveryRouting ?? currentRouting(opts.cwd, log);
+  let acceptedSources = parseConfigSources(recoverySources ?? configSourceTexts(opts.cwd), runningRouting, opts.cwd, externalAdapters, externalDefinitions);
   const startupSources = structuredClone(acceptedSources.trustLayers);
   const embeddedConfig = structuredClone(config);
   let desiredConfig = structuredClone(config);
@@ -943,6 +1136,16 @@ export async function startDaemon(opts: DaemonOptions) {
     ? readRestartSnapshot(opts.stateDir, { projectRoot: opts.cwd, projectId, operationId: recoveryOperation })
     : undefined;
   if ((restartFilePresent && !restored) || (recoveryOperation && !restored)) throw new Error("restart state is unreadable, missing, or does not match this project and recovery operation");
+  for (const peer of restored?.peers ?? []) if (peer.externalInstance) {
+    try {
+      if (!isExternalInstance(peer.id) || !sameExternalInstanceBinding(peer.externalInstance, captureExternalBinding(peer.id))) throw new Error("external instance retained binding is unavailable");
+    } catch {
+      // Preserve historical correlation/integrity while refusing this instance alone. Builtins still restore.
+      externalRefusedRows.set(peer.id, { id: peer.id, kind: peer.externalInstance.kind, availability: "refused", refusalCode: "module-refused" });
+    }
+    externalBindings.set(peer.id, peer.externalInstance);
+    if (peer.sessionId) externalSessions.set(peer.id, peer.sessionId);
+  }
 
   // A session record left by a run that never shut down means it crashed (issue #37). A controlled restart has its own.
   const crashed = !recoveryOperation && !restartFilePresent ? readSessions(opts.stateDir) : undefined;
@@ -1028,6 +1231,15 @@ export async function startDaemon(opts: DaemonOptions) {
     log(`network: egress proxy on 127.0.0.1:${egress.port}, ${allow.length} allowed host(s) (local.network_allow)`);
   }
   const sandboxNetwork: SandboxNetwork = config.local.bash_network === "direct" ? true : egress ? { proxyPort: egress.port } : false;
+  // #515b: `web_fetch` has its own egress proxy, whose allowlist is `local.web_fetch.allow` and nothing else. It never shares the bash proxy (whose list is `network_allow`: package
+  // registries and code hosts), so listing a host for the model to read opens nothing to a shell command, and the reverse. Started only when the project listed a host.
+  const webAllow = () => webFetchAllow(config.local.web_fetch?.allow);
+  let webEgress: EgressProxy | undefined;
+  if (webAllow().length) {
+    webEgress = await startEgressProxy({ allow: webAllow(), log, allowFn: webAllow });
+    startupCleanup.push(() => void webEgress?.close());
+    log(`network: web_fetch egress proxy on 127.0.0.1:${webEgress.port}, ${webAllow().length} allowed host(s) (local.web_fetch.allow)`);
+  }
   const admit = (env: Envelope, parent?: string): string | undefined => {
     // [FYI] is recorded and costs nobody a turn: nothing to limit.
     if (env.from === USER || env.from === HUB || env.from === DIGEST || env.priority === "fyi") return undefined;
@@ -1077,9 +1289,27 @@ export async function startDaemon(opts: DaemonOptions) {
   const staleOff = () => config.experiments?.stale_notices === "deliver";
   if (staleOff()) log("experiment: stale notices are delivered as before 0.12.4 (the issue #106 ablation)");
   const requestedPeerStops = new Set<string>();
-  const bus = new Bus({ rostered: membershipAllowed, deliveryHeld: peer => requestedPeerStops.has(peer) || rosterChanging === peer, journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs), admit, relevant: (peer, env) => reviewOnlyPeer(peer) && !reviewOnlyItem(peer, env) ? `not for ${peer}: a review-only instance receives review requests only` : env.refs?.boundedCheck || env.refs?.supervision || env.refs?.backlog ? relevantNotice(peer, env) : staleOff() || relevantNotice(peer, env), silence,
+  const queuePolicy = () => queueBackpressurePolicy(config.tasks.queue_backpressure);
+  let remotePending = (_room: string): readonly string[] => [];
+  let remoteQueueChanged = () => {};
+  const bus: Bus = new Bus({ rostered: membershipAllowed, trackQueuePressure: () => { const policy = queuePolicy(); return policy.max_queued > 0 || policy.max_oldest_s > 0; }, deliveryHeld: peer => requestedPeerStops.has(peer) || rosterChanging === peer, journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs), admit, relevant: (peer, env) => reviewOnlyPeer(peer) && !reviewOnlyItem(peer, env) ? `not for ${peer}: a review-only instance receives review requests only` : env.refs?.boundedCheck || env.refs?.supervision || env.refs?.backlog ? relevantNotice(peer, env) : staleOff() || relevantNotice(peer, env), silence,
+    remotePending: room => remotePending(room),
+    remotePrivate: (env): boolean => {
+      const task = env.refs?.task;
+      if (task !== undefined) {
+        if (typeof task !== "string" || !/^[1-9][0-9]*$/.test(task) || !Number.isSafeInteger(Number(task))) return true;
+        const row = board.get(Number(task)); if (!row || tasks.isPii(row)) return true;
+      }
+      return env.from === USER ? false : !bus.peers.has(env.from) || !!turns.get(env.from)?.private || contextPii(env.from);
+    },
+    doing: (peer, kind, text) => observeDoing(peer, kind, text),
     onImportantQueued: (peer, counts) => { const p = bus.peers.get(peer); if (isWsPeer(p)) p.notifyQueued(counts); } });
   startupCleanup.push(() => bus.closeJournal());
+  const claudeLaunchProof = createClaudeLaunchProof({ stateDir: opts.stateDir, cwd: opts.cwd, instanceId, definitionOf, peer: peer => bus.peers.get(peer) });
+  function frontendProxyState(peer: string, owner: PeerAdapter | undefined): { present: boolean; port: FrontendProxyPort | undefined } {
+    if (!owner || !isFixedBuiltinDefinition(definitionOf(peer)) || !("frontendProxy" in owner)) return { present: false, port: undefined };
+    return { present: true, port: owner.frontendProxy };
+  }
   const manualPaused = new Set<PeerId>(bus.manualPausedPeers()); // recovery never lifts an operator's pause
   const conductorHolds = new ConductorHolds(join(opts.stateDir, "hub.db"));
   startupCleanup.push(() => conductorHolds.close());
@@ -1497,7 +1727,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const checkBindings = new Map<string, Pick<RunReceipt, "task" | "owner" | "generation" | "updated" | "revision">>();
   const connectionGeneration = (id: string): string | undefined => {
     const peer = bus.peers.get(id);
-    if (!peer || peer.state === "offline") return undefined;
+    if (!peer || peer.state === "offline" || isExternalInstance(id) && !currentExecutionOwner(id)) return undefined;
     let token = checkConnections.get(peer);
     if (!token) { token = randomUUID(); checkConnections.set(peer, token); }
     const hasGeneration = "sessionGeneration" in peer;
@@ -1513,6 +1743,25 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const boundedSafe = (text: string) => !looksSecret(text) && screenMemory([{ title: null, text }]).length === 1
     && !mentionsPrivatePath(text, [], [...(config.pii?.paths ?? []), ...config.local.deny], opts.cwd);
+  let corpusRuntime: { key: string; index: CorpusIndex } | undefined;
+  const corpusPolicyVersion = () => JSON.stringify({ revision: configRevision, paths: config.corpus.paths, pii: config.pii?.paths ?? [], deny: config.local.deny, signals: activeRouting().signals });
+  const publicCorpus = (query: string, allowed: () => boolean) => {
+    if (!allowed() || !config.corpus.paths.length) return [];
+    const key = corpusPolicyVersion();
+    if (!corpusRuntime || corpusRuntime.key !== key) corpusRuntime = { key, index: new CorpusIndex({ cwd: opts.cwd, paths: [...config.corpus.paths], piiPaths: [...config.pii?.paths ?? []], deny: [...config.local.deny], piiPatterns: [...activeRouting().signals.pii_patterns] }) };
+    return corpusEvidence(query, corpusRuntime.index, {
+      allowed, version: corpusPolicyVersion,
+      safe: (text, paths) => boundedSafe(text) && !mentionsPrivatePath(text, paths.map(path => `path:${path}`), [...config.pii?.paths ?? [], ...config.local.deny], opts.cwd),
+    });
+  };
+  const corpusBriefAllowed = (task: BriefTask) => {
+    const latest = task.id === undefined ? undefined : board.get(task.id);
+    return !stopping && !!latest && latest.created === task.created && latest.updated === task.updated && latest.owner === task.owner
+      && (!task.history || latest.history.length === task.history.length) && !tasks.isPii(latest)
+      && !turns.get(latest.owner ?? "")?.private && !contextPii(latest.owner ?? "")
+      && boundedSafe(JSON.stringify({ title: task.title, refs: task.refs, plan: task.plan }));
+  };
+
   const publicCheck = (receipt: RunReceipt) => {
     const safeTail = boundedSafe(receipt.tail), safeError = !receipt.error || boundedSafe(receipt.error);
     return { run: receipt.run, task: receipt.task, status: receipt.status, sha: receipt.sha, tree: receipt.tree, lockfile: receipt.lockfile,
@@ -1611,6 +1860,12 @@ export async function startDaemon(opts: DaemonOptions) {
   const tasks: Tasks = new Tasks({
     releaseWindow,
     capabilities: peerCapabilities, repository: memoryRepo,
+    contextAdmission: () => ({
+      policy: { max_used: config.context.max_assignment_used ?? 0, stale_min: config.context.stale_min },
+      peers: (config.context.max_assignment_used ?? 0) > 0 ? Object.fromEntries(bus.knownPeers().filter(peer => definitionOf(peer)?.budget?.context).map(peer => [peer,
+        contexts.admission(peer, contextSession(peer), bus.peers.has(peer) && ["idle", "busy", "paused"].includes(bus.stateOf(peer))),
+      ])) : {},
+    }),
     plannerBlocks: () => Object.fromEntries(bus.knownPeers().map(peer => {
       const codes: ("approvals" | "quota")[] = [];
       if ([...permissions.values()].some(request => request.peer === peer && request.expiresAt > Date.now())) codes.push("approvals");
@@ -1627,6 +1882,8 @@ export async function startDaemon(opts: DaemonOptions) {
       const scope = childToolAuthority.getStore();
       return scope?.by === by ? () => scope.current() ? undefined : "Claude child generation or execution root changed" : undefined;
     },
+    // #933: a conductor task op admitted in onMessage runs inside operationalContext; the role is rechecked on every ask.
+    operational: by => { const scope = operationalContext.getStore(); if (!scope || scope.actor !== by) return false; scope.current(); return true; },
     // #223 R4: fresh only when the verdict comes from a reviewer session the hub started for this task's review.
     reviewContext: (by, task) => !!definitionOf(by)?.reviewer && (bus.peers.get(by) as ReviewerPrintPeer | undefined)?.reviewing === task ? "fresh" : "continuing",
     // Proof belongs to the adapter generation actually started in the validated root. A role-only
@@ -1638,6 +1895,8 @@ export async function startDaemon(opts: DaemonOptions) {
     recordPlanning: change => event({ type: "planning", ...change }),
     wipLimit: peer => Object.hasOwn(config.tasks.wip_limits ?? {}, peer) ? config.tasks.wip_limits![peer]! : 1,
     escalateAfter: () => config.tasks.escalate_after ?? ESCALATE_AFTER,
+    groomFyiWindowMin: () => config.tasks.groom_fyi_window_min ?? GROOM_FYI_WINDOW_SETTING.defaultValue,
+    ...taskOperationalReaders(() => config), // #489 H2
     profile: profileName(config.profile),
     profileData: resolvedProfile,
     piiPaths: config.pii?.paths,
@@ -1688,11 +1947,15 @@ export async function startDaemon(opts: DaemonOptions) {
     ...(config.memory.enabled ? { memory } : {}),
     candidates, candidateScreen: screenMemory, privateTurn: peer => !!turns.get(peer)?.private || contextPii(peer),
     memoryCheck: checkMemory,
-    ...(config.memory.enabled || memoryStore ? { briefs: new Briefs(config.memory.enabled ? memory : undefined, chain.at(-1)!, () => config.memory.brief_items,
+    briefs: new Briefs(config.memory.enabled ? memory : undefined, chain.at(-1)!, () => config.memory.brief_items,
       memoryStore ? taskMemoryItems : undefined,
       (peer, task, counts) => event({ type: "memory_brief", source: "amem", peer, task, ...counts }),
       items => { const stale = staleness(); return items.map(item => `${item.line}${stale(item.about ?? []) ? " (stale?)" : ""}`); },
-      memoryStore ? taskIntentBrief : undefined) } : {}),
+      memoryStore ? taskIntentBrief : undefined,
+      {
+        allowed: corpusBriefAllowed, policyVersion: corpusPolicyVersion,
+        read: task => publicCorpus([task.title, ...task.refs.paths ?? [], ...task.plan?.paths ?? [], ...task.plan?.symbols ?? []].join(" "), () => corpusBriefAllowed(task)).map(item => ({ id: item.id, kind: "note", line: `${item.id}: ${item.text.replace(/\s+/g, " ")}` })),
+      }),
     ...(memoryStore ? { planFails: (task: import("./board.ts").Task) => {
       checkMemory();
       const context = { cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny };
@@ -1705,7 +1968,8 @@ export async function startDaemon(opts: DaemonOptions) {
     ...(memoryStore ? { store: { store: memoryStore, project: memoryProject, repo: memoryRepo, deny: config.local.deny, onNote: (id: string) => void suggestEdges(id) } } : {}),
     notify,
     recordOverlap: (task, owner, others) => event({ type: "overlap", task, owner, others }),
-    ...(checksAllowed ? { check: (cls: string, task?: import("./board.ts").Task) => checkCommands[task?.profileClass ?? cls] ?? checkCommands[cls], runCheck: async (command: string) => (checksClosed ? interrupted : runCheck(command, opts.cwd, checkTimeoutS * 1000, runningChecks)) } : {}),
+    ...(checksAllowed ? { check: (cls: string, task?: import("./board.ts").Task) => checkCommands[task?.profileClass ?? cls] ?? checkCommands[cls],
+      checkKey: (cls: string, task?: import("./board.ts").Task) => { const own = task?.profileClass ?? cls; return checkCommands[own] !== undefined ? own : checkCommands[cls] !== undefined ? cls : undefined; }, runCheck: async (command: string) => (checksClosed ? interrupted : runCheck(command, opts.cwd, checkTimeoutS * 1000, runningChecks)) } : {}),
     // What a peer learned reaches the peers working now, on their next delivery, instead of at their next session (#68).
     // Fail-open: the note is already saved, so a bus that cannot persist costs the sharing, not the tool call.
     share: (by, line) => {
@@ -1723,16 +1987,23 @@ export async function startDaemon(opts: DaemonOptions) {
       }
     },
     triage: { classify: (title, detail) => inference?.triage(title, detail) ?? Promise.resolve(undefined), onCampus: () => onCampus() },
+    // #334: the hub model's split, validated against the same `hub_backlog_split` parts schema a planner's call is, and the source registry for `--source`.
+    intake: { split: (system, user, opts) => inference?.split(system, user, opts) ?? Promise.resolve(undefined), sourceKnown: id => sourceRegistry.get(id) !== undefined,
+      partsSchema: () => profileTaskTools(resolvedProfile, lifecycleConfig.stages, lifecycleConfig.mode !== "off").find(tool => tool.name === "hub_backlog_split")?.inputSchema.properties.parts },
     // The PII screen (issue #198): the model on this machine when MLX/Ollama is enabled, else the gateway on campus only.
-    piiScreen: (text) => screenPii(text, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model }),
+    piiScreen: opts.piiScreen ?? ((text) => screenPii(text, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })),
     recordScreen: (record) => event({ type: "pii_screen", ...record }),
     quota: (): ReturnType<Budget["headroom"]> => projectBudgetHeadroom(budget.headroom(), accountMembers), // budget is built below; this runs at assignment time
     review: config.review,
     sweep: taskSweepConfig(config.task_sweep),
     sweepHeld: () => stopping || recoveryActive(),
+    submodules: () => factsRepo ? submodulePaths(factsRepo) : [], // #798 D1: read from .gitmodules, no git call
+    ciWatch: opts.ciWatch,
+    autoPull: () => config.tasks.auto_pull === true,
+    queueBackpressure: queuePolicy,
     cancellationHeld: () => stopping || recoveryActive(),
     offerRead: (peer, envelopeId) => journal.offerRead(peer, envelopeId),
-    offerPullOnly: (id) => { const peer = bus.peers.get(id); return isWsPeer(peer) && peer.pullOnly; },
+    offerPullOnly: (id) => { const peer = bus.peers.get(id); return peer?.pullOnly === true; },
     stallNotice: stall => { supervision.taskStalled(stall); },
     roles: config.roles,
     turnFree,
@@ -2011,12 +2282,47 @@ export async function startDaemon(opts: DaemonOptions) {
     const p = bus.peers.get(peer);
     if (isWsPeer(p) && p.claiming) return undefined;
     if (definitionOf(peer)?.transport === "claude-channel") { const c = claudeSession(peer); return c.sessionId ? `${c.sessionId}:${c.launchId ?? ""}` : undefined; }
-    if (isCodexPeer(p)) return p.thread || undefined;
-    if (isAcpPeer(p) || isPiPeer(p)) { const id = p.recoveryMetadata().sessionId; return typeof id === "string" ? id : undefined; }
-    return undefined;
+    const session = p?.nativeSession;
+    return typeof session === "string" ? session : undefined;
   };
   const activityRings: Record<string, ActivityRing> = Object.fromEntries(SUPPORTED_PEERS.filter(peer => definitionOf(peer)?.capabilities?.watch).map(peer => [peer, new ActivityRing()]));
   const contextPii = (peer: PeerId) => !!turns.get(peer)?.private || board.list().some(t => !isClosedTaskState(t.state) && (t.owner === peer || t.reviewer === peer) && tasks.isPii(t));
+  // #878: what each peer is doing. Daemon memory only: never persisted (status.json leaves it out), logged, captured or relayed.
+  const doings = new Map<PeerId, DoingTracker>();
+  const observeDoing = (peer: PeerId, kind: DoingKind, text?: unknown, learnedPrivate = false) => {
+    if (kind === "reset") { doings.delete(peer); claudeDoing.delete(peer); return; }
+    let tracker = doings.get(peer);
+    if (!tracker) doings.set(peer, tracker = new DoingTracker());
+    // Private when learned or observed in a PII context or refused by the public metadata screen; a throw is private too.
+    tracker.observe(kind, text, value => learnedPrivate || contextPii(peer) || !tasks.publicMetadataText(value));
+  };
+  /** Shown only for an attached peer; a stub while it owns or reviews a PII task or is in a private turn. */
+  const doingRows = (ids: string[]): Record<string, PeerDoing> => {
+    const live = ids.filter(id => doings.has(id) && bus.stateOf(id) !== "offline");
+    if (!live.length) return {};
+    const pii = board.list().filter(t => !isClosedTaskState(t.state) && tasks.isPii(t));
+    return Object.fromEntries(live.flatMap(id => {
+      const view = doings.get(id)!.view(!!turns.get(id)?.private || pii.some(t => t.owner === id || t.reviewer === id));
+      return view ? [[id, view]] : [];
+    }));
+  };
+  // A Claude session's title, read from its transcript where the last read stopped; its current item from PreToolUse input.
+  const claudeDoing = new Map<PeerId, { session: string; cursor: TitleCursor; todos: ClaudeTodoSource }>();
+  const observeClaudeDoing = (peer: PeerId, session: string, transcript: string | undefined, tool: string, input: Record<string, unknown>) => {
+    let source = claudeDoing.get(peer);
+    if (source?.session !== session) {
+      observeDoing(peer, "reset");
+      claudeDoing.set(peer, source = { session, cursor: { path: "", offset: 0, skip: false }, todos: new ClaudeTodoSource() });
+    }
+    if (transcript) {
+      // ponytail: one bounded read per hook call, so a long transcript first seen mid-session catches up over several calls.
+      if (source.cursor.path !== transcript) source.cursor = { path: transcript, offset: 0, skip: false };
+      const title = readAiTitle(source.cursor);
+      if (title !== undefined) observeDoing(peer, "title", title);
+    }
+    const item = tool ? source.todos.item(tool, input, subject => contextPii(peer) || !tasks.publicMetadataText(subject)) : undefined;
+    if (item !== undefined) observeDoing(peer, "todo", item?.text, item?.private === true);
+  };
   const requestCheckpoint = (peer: PeerId, reason: "quota" | "context"): Promise<string | undefined> => {
     // One outstanding request per peer. A quota transition may proceed without a summary rather than steal a context waiter.
     if (checkpointWaits.has(peer) || recoveryActive() || stopping) return Promise.resolve(undefined);
@@ -2158,11 +2464,13 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const supervisionTurns = new Map<PeerId, { id: string; at: number; tokens?: number; session?: string }>();
   bus.onDeliver = (peer, originals) => {
+    if (peer.includes("@")) return;
     pendingDeliveryTask.delete(peer);
     const task = deliveryTask(originals);
     if (task !== undefined) pendingDeliveryTask.set(peer, task);
   };
   bus.onDelivered = (peer, originals) => {
+    if (peer.includes("@")) return;
     pendingDeliveryTask.delete(peer);
     if (!originals.some(env => env.from === HUB && env.refs?.supervision) || supervisionTurns.has(peer)) return;
     const turn = turns.get(peer);
@@ -2193,8 +2501,9 @@ export async function startDaemon(opts: DaemonOptions) {
     if (row && tasks.isPii(row)) return;
     return { ...(row ? { task: taskKey(memoryProject, row) } : {}), turn: turns.get(peer)?.id ?? null, session: contextSession(peer) ?? null };
   }) : undefined;
-  bus.onMemoryDelivery = (peer, id, out, field) => { if (!out.some(env => env.refs?.boundedCheck)) memoryObservations?.delivery(peer, id, out, field); };
+  bus.onMemoryDelivery = (peer, id, out, field) => { if (!peer.includes("@") && !out.some(env => env.from.includes("@") || env.to?.some(id => id.includes("@")) || env.refs?.boundedCheck)) memoryObservations?.delivery(peer, id, out, field); };
   const citeMemory = (peer: PeerId, text: string, id: string, envs: readonly Envelope[] = []) => {
+    if (peer.includes("@") || envs.some(env => env.from.includes("@") || env.to?.some(id => id.includes("@")))) return;
     if (!tasks.nameable(text) || looksSecret(text) || !screenMemory([{ title: null, text }]).length) return;
     memoryObservations?.cite(peer, text, id, envs);
   };
@@ -2245,9 +2554,15 @@ export async function startDaemon(opts: DaemonOptions) {
     executionOwners.delete(peer); executionRoots.delete(peer);
     worktreeFacts.delete(peer); worktreeProjections.delete(peer);
   }
-  function currentExecutionOwner(peer: string) {
+  function currentExecutionOwner(peer: string, fresh = false) {
     const bound = executionOwners.get(peer);
-    if (bound?.socket) {
+    if (bound && isExternalInstance(peer)) {
+      const launch = externalLaunches.get(peer), receipt = launch && managedAcpLaunch(bound.owner, launch.options);
+      const evidence = externalEvidence(peer, fresh), current = evidence?.binding, workspace = evidence?.workspace;
+      if (!launch || workspace !== launch.workspace || launch.owner !== bound.owner || bus.peers.get(peer) !== bound.owner || !receipt || receipt.generation !== launch.generation || receipt.cwd !== bound.cwd || !current || !sameExternalInstanceBinding(launch.binding, current)) {
+        revokeTerminalExecution(peer); return undefined;
+      }
+    } else if (bound?.socket) {
       const launch = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
       if (!isFixedBuiltinDefinition(definitionOf(peer)) || !isWsPeer(bound.owner) || bound.owner.sessionGeneration !== bound.generation || !launch?.privateRecord || launch.launchId !== bound.launchId || launch.executionCwd !== bound.cwd) {
         revokeTerminalExecution(peer);
@@ -2257,7 +2572,7 @@ export async function startDaemon(opts: DaemonOptions) {
       // an admission/effect. Reuse only within synchronous code, never across an await.
       if (!verifiedTerminalRootsThisTurn.has(bound)) {
         try {
-          if (resolveInstanceExecutionCwd(opts.cwd, peer, declarations, config.roles[peer] ?? [], adapterCatalog) !== bound.cwd) throw new Error("execution root changed");
+          if (resolveExecutionCwd(peer, declarations, config.roles[peer] ?? [], adapterCatalog) !== bound.cwd) throw new Error("execution root changed");
         } catch { revokeTerminalExecution(peer); return undefined; }
         verifiedTerminalRootsThisTurn.add(bound);
         queueMicrotask(() => verifiedTerminalRootsThisTurn.delete(bound));
@@ -2268,13 +2583,23 @@ export async function startDaemon(opts: DaemonOptions) {
       try {
         if (bound.owner !== bus.peers.get(peer) || bound.owner.state === "offline" || bound.cwd === opts.cwd) throw new Error("execution root changed");
         if (!verifiedTerminalRootsThisTurn.has(bound)) {
-          if (resolveInstanceExecutionCwd(opts.cwd, peer, declarations, config.roles[peer] ?? [], adapterCatalog) !== bound.cwd) throw new Error("execution root changed");
+          if (resolveExecutionCwd(peer, declarations, config.roles[peer] ?? [], adapterCatalog) !== bound.cwd) throw new Error("execution root changed");
           verifiedTerminalRootsThisTurn.add(bound); queueMicrotask(() => verifiedTerminalRootsThisTurn.delete(bound));
         }
       } catch { revokeTerminalExecution(peer); return undefined; }
     }
     return bound;
   }
+  /** Last verified roots for display only; no filesystem/Git probe and never owner-admission authority. */
+  function ownerIsolationProjection(): Readonly<Record<string, boolean>> {
+    return Object.fromEntries(extraIds.map(peer => {
+      const bound = executionOwners.get(peer), owner = bus.peers.get(peer);
+      if (!bound || !owner || bound.owner !== owner || owner.state === "offline" || bound.cwd === opts.cwd || bound.cwd !== executionRoots.get(peer)) return [peer, false];
+      if (bound.socket && (!isFixedBuiltinDefinition(definitionOf(peer)) || !isWsPeer(bound.owner)
+          || bound.owner.sessionGeneration !== bound.generation || !bound.owner.owns(bound.socket))) return [peer, false];
+      return [peer, true];
+    }));
+  }
   function ownerWriteRoot(peer: string): string | undefined {
     if (declarations[peer]) {
       const bound = currentExecutionOwner(peer);
@@ -2282,10 +2607,19 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     return executionRoot(peer);
   }
+  function currentExternalTools(client: Client, fresh = false): boolean {
+    const peer = client.peer, bound = client.externalOwner;
+    if (!peer || !bound || stopping || recoveryActive() || !membershipAllowed(peer)) return false;
+    const launch = externalLaunches.get(peer), current = currentExecutionOwner(peer, fresh);
+    if (launch && current && launch.owner === bound.owner && current.owner === bound.owner && launch.launchId === bound.launchId && launch.generation && bound.generation === undefined) bound.generation = launch.generation;
+    return !!launch && !!current && launch.owner === bound.owner && current.owner === bound.owner && launch.launchId === bound.launchId && launch.generation === bound.generation;
+  }
   function implementerChatTask(peer: string): number | undefined {
     const owned = board.list("in_progress").filter(task => task.owner === peer && !tasks.isPii(task));
     return owned.length === 1 ? owned[0]!.id : undefined;
   }
+  type ImplementerFailureEntry = { launchId: string; generation: string; signal: AbortSignal; trace: ClaudeFailureTrace; probeCount: number; permissionAttempt: number };
+  const implementerFailures = new WeakMap<PeerAdapter, ImplementerFailureEntry>();
   function currentImplementerTools(c: Client, verifyRoot = true): ReturnType<NonNullable<PeerAdapter["ownedTools"]>> {
     const bound = c.toolsOwner, peer = c.peer;
     if (!bound || !peer || c.role !== "tools" || stopping || recoveryActive() || !membershipAllowed(peer) || contextPii(peer) || definitionOf(peer)?.start.daemonPort !== "claude-implementer" || bus.peers.get(peer) !== bound.owner) return undefined;
@@ -2303,6 +2637,10 @@ export async function startDaemon(opts: DaemonOptions) {
     const binding = c.toolsOwner, launch = currentImplementerTools(c);
     return () => c.toolsOwner === binding && !!launch && currentImplementerTools(c) === launch;
   }
+  function currentImplementerFailure(c: Client, launch = currentImplementerTools(c)): ImplementerFailureEntry | undefined {
+    const owner = c.toolsOwner?.owner, entry = owner && implementerFailures.get(owner);
+    return launch && entry && entry.launchId === launch.launchId && entry.generation === launch.generation && entry.signal === launch.signal && !entry.signal.aborted ? entry : undefined;
+  }
   const shellProjectRepository = githubOriginRepository(opts.cwd);
   const shellNeedsDefault = Object.keys(declarations).some(peer => instanceDefinitionOf(peer, declarations, adapterCatalog)?.start.daemonPort === "claude-implementer");
   const shellDefaultBranch = shellNeedsDefault && shellProjectRepository
@@ -2310,7 +2648,7 @@ export async function startDaemon(opts: DaemonOptions) {
     : undefined;
   let implementerShellStart: Promise<HostShellWrapper> | undefined;
   const implementerShellProfiles = new WeakMap<object, { key: string; sandbox: { profile: string; readOnlyData: boolean } }>();
-  async function automaticImplementerShell(c: Client, tool: string, original: Record<string, unknown>, current: () => boolean): Promise<{ command: string; timeout: number; description: string } | undefined> {
+  async function automaticImplementerShell(c: Client, tool: string, original: Record<string, unknown>, current: () => boolean, failure?: { entry: ImplementerFailureEntry; attempt: number }): Promise<{ command: string; timeout: number; description: string } | undefined> {
     const peer = c.peer, launch = currentImplementerTools(c), root = peer && ownerWriteRoot(peer), policy = config;
     if (!peer || !launch || !root || launch.task === undefined || tool !== "Bash" || permissionMode(peer) !== "ask-when-needed") return;
     if (Object.keys(original).some(key => !["command", "description", "timeout"].includes(key)) || typeof original.command !== "string"
@@ -2379,7 +2717,8 @@ export async function startDaemon(opts: DaemonOptions) {
     const argv = readProof?.program === "git" ? hubGitArgv([...proof.argv]).slice(1) : proof.argv;
     const command = wrapper.issue({ peer, task: taskId, generation: launch.generation, root, branch: binding.branch, executable: proof.executable, argv,
       env: taskProof?.env ?? (git ? Object.fromEntries(Object.entries(hubGitEnv(env, { repositoryIsolation: true })).filter((entry): entry is [string, string] => entry[1] !== undefined)) : env),
-      signal: launch.signal, timeoutMs: Number(input.timeout ?? 120_000), current: recheck, activity: () => c.toolsOwner?.owner.keepApprovalAlive?.(), ...(sandbox ? { sandbox } : {}) });
+      signal: launch.signal, timeoutMs: Number(input.timeout ?? 120_000), current: recheck, activity: () => c.toolsOwner?.owner.keepApprovalAlive?.(),
+      onRefused: () => { if (failure && failure.entry.permissionAttempt === failure.attempt) failure.entry.trace.record("wrapper_refused"); }, ...(sandbox ? { sandbox } : {}) });
     if (command) log(`permission auto-allowed for ${peer}: bash (host wrapper ${readProof ? "read-only shell" : "task command"})`);
     return command && { command: command.command, timeout: Math.min(600_000, Number(input.timeout ?? 120_000) + 2000), description: "Hub-owned task command" };
   }
@@ -2565,6 +2904,11 @@ export async function startDaemon(opts: DaemonOptions) {
         bandsRevision = `${board.statusRevision()}:${state.signature}`; // after the write: the cards this pass made are not a reason to run again
       } catch (error) { log(`sdlc band evaluation failed: ${sanitize((error as Error).message).slice(0, 160)}`); }
     }, opts.bandsEveryMs ?? 300_000),
+    // #481 S7: the scheduled security-scan baseline. The tick only asks whether a scan is due; the configured interval, the holds and the lifecycle mode decide inside.
+    setInterval(() => {
+      if (stopping || recoveryActive() || opts.bandsHeld?.()) return;
+      void tasks.runSecurityScan().catch(error => log(`sdlc security scan failed: ${sanitize((error as Error).message).slice(0, 160)}`));
+    }, opts.securityScanEveryMs ?? 3_600_000),
     setInterval(() => {
       if (!ready || !memoryBinding) return;
       const before = memoryProblem;
@@ -2605,6 +2949,54 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   rescheduleSweep();
   startupCleanup.push(() => clearInterval(sweepTimer));
+  // #512a: the schedules timer is its own interval, started whenever `schedules` is configured, whatever `task_sweep.enabled` says, and re-armed on reload.
+  // It runs no task sweep. Held while stopping or recovering (inside `proposeFromSchedules`), where a due schedule counts the skip and coalesces.
+  const schedulesStore = new ScheduleStore(join(opts.stateDir, "hub.db"));
+  startupCleanup.push(() => schedulesStore.close());
+  const folderStore = new FolderStore(join(opts.stateDir, "hub.db"));
+  startupCleanup.push(() => folderStore.close());
+  let schedulesTimer: ReturnType<typeof setInterval> | undefined;
+  const scheduleNow = () => opts.schedulesNow?.() ?? Date.now();
+  /** The pass in flight, so a stop can wait for it before the board and the store close. */
+  let schedulesPass: Promise<void> | undefined;
+  /** #335: `ahub schedule run` calls in flight. They are not the timer's pass, but `stopOnce` waits for them just the same. */
+  const manualSchedulePasses = new Set<Promise<void>>();
+  const runSchedules = (): Promise<void> => {
+    if (stopping || schedulesPass) return Promise.resolve();
+    schedulesPass = runSchedulesOnce().finally(() => { schedulesPass = undefined; });
+    return schedulesPass;
+  };
+  const runSchedulesOnce = async () => {
+    try {
+      for (const run of await tasks.proposeFromSchedules(schedulesStore, config.schedules, scheduleNow(), () => opts.schedulesHeld?.() === true)) {
+        if (run.outcome === "ran") log(`schedule ${run.id}: proposed task #${run.task}`);
+        else if (run.outcome === "failed") log(`schedule ${run.id}: could not propose; see ahub status`);
+      }
+      if (config.folder_triggers.length) {
+        const policy: FolderPolicy = { cwd: opts.cwd, dataPaths: config.data?.readonly ?? [], piiPaths: config.pii?.paths ?? [], deny: config.local.deny };
+        // Registration is the same two steps `ahub source add` takes (`registerScanned`): one decision about privacy, then the registry. The scan kept no bytes, so the file
+        // is read again there and refused if it no longer hashes to what the scan saw. A file under pii.paths or whose text matches a PII pattern is a private source.
+        const register = (file: ScannedFile) => registerScanned(file, { registry: sourceRegistry, cwd: opts.cwd, piiPaths: config.pii?.paths ?? [], piiPatterns: () => activeRouting().signals.pii_patterns,
+          project: (extension, data) => projections.projectBytes(join(opts.cwd, `source${extension}`), data)?.text });
+        for (const run of await tasks.runFolderTriggers(folderStore, config.folder_triggers, entry => scanFolder(entry, policy, (real, size, mtime) => folderStore.known(entry.id, real, size, mtime)), register, scheduleNow(), () => opts.schedulesHeld?.() === true)) {
+          if (run.outcome === "ran") log(`folder trigger ${run.id}: proposed ${run.tasks.map(id => `task #${id}`).join(", ")}`);
+          else if (run.outcome === "failed" || run.outcome === "refused") log(`folder trigger ${run.id}: ${run.outcome}: ${sanitize(run.reason ?? "").slice(0, 160)}`);
+        }
+      }
+      if (!stopping) writeStatus(); // a pass that ends during shutdown must not republish the status file shutdown is about to remove
+    } catch (error) { log(`schedules pass failed: ${sanitize((error as Error).message).slice(0, 160)}`); }
+  };
+  const rescheduleSchedules = () => {
+    if (schedulesTimer) clearInterval(schedulesTimer);
+    schedulesTimer = undefined;
+    if (!config.folder_triggers.length) { try { folderStore.prune([]); } catch { /* the store is closed while stopping */ } }
+    if (!config.schedules.length && !config.folder_triggers.length) { try { schedulesStore.prune([]); } catch { /* the store is closed while stopping */ } return; }
+    if (!config.schedules.length) { try { schedulesStore.prune([]); } catch { /* the store is closed while stopping */ } }
+    schedulesTimer = setInterval(() => { void runSchedules(); }, opts.schedulesEveryMs ?? 60_000);
+    schedulesTimer.unref?.();
+  };
+  rescheduleSchedules();
+  startupCleanup.push(() => clearInterval(schedulesTimer));
   for (const i of intervals) i.unref?.();
   startupCleanup.push(() => { for (const i of intervals) clearInterval(i); });
 
@@ -2626,6 +3018,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const taskOp = async (...args: Parameters<typeof taskOpBody>): Promise<string> => {
     const [by, op, input] = args;
     if (readOnlyPeer(by) && !READ_ONLY_HUB_TOOLS.has(op)) throw new PreEffectToolRefusal("read-only instance cannot mutate hub state");
+    const sourceCurrent = op === "hub_source_read" ? sourceReadCurrent(by, args[3] ?? false, args[4] ?? false) : undefined;
     const nativeTurn = turns.get(by);
     const effectful = ownerToolEffect(op, input);
     if (nativeTurn && effectful) nativeTurn.effectsPending = (nativeTurn.effectsPending ?? 0) + 1;
@@ -2639,6 +3032,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const readAuthority=op==="hub_task_show"?runningReviewAuthority(by,Number(input?.id)):undefined;
       const before=readAuthority?.();if(before)throw new PreEffectToolRefusal(before);
       const text = await taskOpBody(...args);
+      if (sourceCurrent && !sourceCurrent()) throw new PreEffectToolRefusal("source read unavailable");
       if (nativeTurn && effectful && turns.get(by) === nativeTurn) nativeTurn.taskEffect = true;
       const after=readAuthority?.();if(after)throw new PreEffectToolRefusal(after);
       if (conducted) {
@@ -2646,13 +3040,13 @@ export async function startDaemon(opts: DaemonOptions) {
         const id = Number.isSafeInteger(proposed) && proposed! > 0 ? proposed : admittedId;
         auditConduct({ kind: "conduct", actor: by, action: op.slice(4), ...(id === undefined ? {} : { task: id }) });
       }
-      const hint = args[3] ? ownHeldHint(by) : "";
+      const hint = args[3] && op !== "hub_source_read" ? ownHeldHint(by) : "";
       return hint ? `${text}\n\n${hint}` : text;
     } catch (error) {
       if (reviewTool && traceId !== undefined) reviewerToolObservers.get(by)?.(traceId, reviewTool, error instanceof Error ? error.message : "review tool refused");
       if (nativeTurn && effectful && !(error instanceof PreEffectToolRefusal) && turns.get(by) === nativeTurn) nativeTurn.taskEffect = true;
       // Keep proven pre-effect refusal identity/code for native receipts; only add body-free metadata.
-      const hint = args[3] ? ownHeldHint(by) : "";
+      const hint = args[3] && op !== "hub_source_read" ? ownHeldHint(by) : "";
       if (hint && error instanceof Error) error.message += `\n\n${hint}`;
       throw error;
     } finally {
@@ -2660,8 +3054,9 @@ export async function startDaemon(opts: DaemonOptions) {
       taskOpsInFlight--;
     }
   };
+  const deliveryRetryAllowed = (owner: PeerAdapter | undefined): boolean => !owner || !("deliveryOnly" in owner) || owner.deliveryOnly === false;
   function ownHeldHint(peer: PeerId): string {
-    try { return renderHeldHint(bus.heldDeliveryHints(peer), Date.now(), !(isLocalPeer(bus.peers.get(peer)) || isAcpPeer(bus.peers.get(peer)))); }
+    try { return renderHeldHint(bus.heldDeliveryHints(peer), Date.now(), deliveryRetryAllowed(bus.peers.get(peer))); }
     catch { return ""; } // unavailable telemetry is not a zero count or a reason to fail the tool itself
   }
   /** A model-written peer argument: a peer id, or nothing for absent, null or "". Anything else is refused. */
@@ -2671,6 +3066,16 @@ export async function startDaemon(opts: DaemonOptions) {
     if (!id || !PEER_ID.test(id)) throw new PreEffectToolRefusal(`${name} must be a peer id, not ${JSON.stringify(v).slice(0, 60)}`);
     return id;
   };
+  function sourceReadCurrent(by: PeerId, inProcess: boolean, piiTurn: boolean): () => boolean {
+    const owner = bus.peers.get(by), generation = connectionGeneration(by);
+    const authority = childToolAuthority.getStore();
+    const routing = activeRouting(), policyKey = JSON.stringify({ signals: routing.signals, constraints: routing.constraints, paths: config.pii?.paths ?? [], mlx: config.mlx, model: routing.local.fixed_model });
+    return () => !stopping && bus.peers.get(by) === owner && connectionGeneration(by) === generation
+      && (!authority || authority.by === by && authority.current())
+      && (!inProcess || !piiTurn || holdsPii(by))
+      && policyKey === JSON.stringify({ signals: activeRouting().signals, constraints: activeRouting().constraints, paths: config.pii?.paths ?? [], mlx: config.mlx, model: activeRouting().local.fixed_model });
+  }
+  const sourceRegistry = new SourceRegistry(opts.stateDir);
   async function taskOpBody(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
     if (BOUNDED_TASK_TOOLS.has(op)) {
       const keys = op === "hub_task_spec" ? ["id"] : op === "hub_check_start" ? ["id", "check", "files"] : ["run"];
@@ -2711,6 +3116,29 @@ export async function startDaemon(opts: DaemonOptions) {
       need("propose", "propose tasks");
       if (a.owner && a.owner !== by) need("assign", "hand tasks to other peers");
     }
+    if (op === "hub_source_read") {
+      validateSourceRead(a);
+      const valid = sourceReadCurrent(by, inProcess, piiTurn);
+      return JSON.stringify(await sourceRead(sourceRegistry, a, {
+        valid,
+        canReadPrivate: async () => {
+          const eligible = () => valid() && inProcess && piiTurn && holdsPii(by)
+            && isFixedBuiltinDefinition(definitionOf(by)) && definitionOf(by)?.trust.onPrem === true;
+          if (!eligible()) return false;
+          const campus = await onCampus().catch(() => false);
+          return campus && eligible();
+        },
+        screen: async (text, meta) => {
+          if (meta.origins.some(origin => origin.kind === "file" && matchesPolicy(opts.cwd, origin.origin, config.pii?.paths ?? []))) return false;
+          try { if (looksSecret(text) || activeRouting().signals.pii_patterns.some(pattern => new RegExp(pattern).test(text))) return false; }
+          catch { return false; }
+          if (!tasks.screenOn()) return true;
+          // Reuse the bounded host screen. Oversized/unknown is private, never an unscreened excerpt.
+          const verdict = await (opts.piiScreen ?? ((value: string) => screenPii(value, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })))(text).catch(() => undefined);
+          return verdict?.label === "clear";
+        },
+      }));
+    }
     if (MEMORY_READ_TOOLS.has(op)) {
       validateMemoryRead(op, a);
       need("memory_read", "read shared memory");
@@ -2803,7 +3231,7 @@ export async function startDaemon(opts: DaemonOptions) {
     switch (op) {
       case "hub_delivery_retry": {
         if (by === USER || by === HUB || !a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => key !== "delivery_id") || typeof a.delivery_id !== "string" || a.delivery_id.length < 1 || a.delivery_id.length > 256) throw new PreEffectToolRefusal("hub_delivery_retry accepts only your delivery_id; completed and discard require the person");
-        if (isLocalPeer(bus.peers.get(by)) || isAcpPeer(bus.peers.get(by))) throw new PreEffectToolRefusal("delivery-only peers require the person to resolve held deliveries");
+        if (!deliveryRetryAllowed(bus.peers.get(by))) throw new PreEffectToolRefusal("delivery-only peers require the person to resolve held deliveries");
         if (stopping || recoveryActive()) throw new PreEffectToolRefusal("recovery or shutdown is holding delivery mutations");
         bus.retryDelivery(by, a.delivery_id);
         return `retry queued for delivery ${a.delivery_id}; check for earlier effects before acting`;
@@ -2849,10 +3277,11 @@ export async function startDaemon(opts: DaemonOptions) {
       case "hub_task_propose": {
         const t = await tasks.propose(by, a);
         const repoHint = tasks.refsRepoHint(t); // #723: advice only; never part of the write
-        if (t.state === "backlog") return [line(t), repoHint].filter(Boolean).join("\n");
+        const submodules = tasks.submoduleNotice(t); // #798 D1: advice only too
+        if (t.state === "backlog") return [line(t), repoHint, submodules].filter(Boolean).join("\n");
         const overlap = tasks.overlaps(t, t.owner === by);
         if (t.owner === by && tasks.silentFor(t.id) && factsOn()) factsFor(by).sawPlans(by, tasks.overlapTasks(t)); // as for an accept
-        return [line(t), tasks.namedOwnerNote(t, a.owner as PeerId | undefined, by), overlap, tasks.claimRoleGuidance(t, by), t.owner === by ? tasks.planGuardText(t) : "", repoHint].filter(Boolean).join("\n");
+        return [line(t), tasks.namedOwnerNote(t, a.owner as PeerId | undefined, by), overlap, tasks.claimRoleGuidance(t, by), t.owner === by ? tasks.planGuardText(t) : "", repoHint, submodules].filter(Boolean).join("\n");
       }
       case "hub_task_accept": {
         // S1 spec acceptance and S9 plan review are checked against one task snapshot before acceptance.
@@ -2861,7 +3290,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const silent = tasks.silentFor(t.id);
         const overlap = a.plan == null && a.refs == null && !silent ? "" : tasks.overlaps(t);
         if (silent && factsOn()) factsFor(by).sawPlans(by, tasks.overlapTasks(t)); // the plans in this answer need no fact later
-        return [line(t), overlap, tasks.planGuardText(t)].filter(Boolean).join("\n");
+        return [line(t), overlap, tasks.planGuardText(t), tasks.submoduleNotice(t)].filter(Boolean).join("\n"); // #798 D1
       }
       case "hub_task_cancel": {
         if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => !["id", "reason", "superseded_by", "revision"].includes(key))
@@ -2924,7 +3353,7 @@ export async function startDaemon(opts: DaemonOptions) {
           if (!release) throw new PreEffectToolRefusal("no such release");
           releaseId = release.id;
         }
-        return JSON.stringify(board.list(a.ready === true ? "proposed" : a.state).filter((t) => (by === USER || t.state !== "backlog") && (releaseId === undefined || t.release === releaseId) && (a.ready !== true || !tasks.waitsFor(t).length)).map((t) => { const view: Record<string, unknown> = onPrem ? { ...t } : tasks.publicView(t); const { history: _h, ...rest } = view; return { ...rest, flowRevision: t.history.length, ...(a.columnMetadata === true ? { started: taskHasStarted(t) } : {}) }; }));
+        return JSON.stringify(board.list(a.ready === true ? "proposed" : a.state).filter((t) => (by === USER || t.state !== "backlog") && (releaseId === undefined || t.release === releaseId) && (a.ready !== true || !tasks.waitsFor(t).length)).map((t) => { const publicTask = tasks.publicView(t); const view: Record<string, unknown> = onPrem ? { ...t, ...holderReasons(publicTask) } : publicTask; const { history: _h, ...rest } = view; return { ...rest, flowRevision: t.history.length, ...(a.columnMetadata === true ? { started: taskHasStarted(t) } : {}) }; }));
       }
     }
     if (op === "task_show" && by !== USER) {
@@ -2938,12 +3367,31 @@ export async function startDaemon(opts: DaemonOptions) {
       if (a.id !== undefined && board.get(Number(a.id))?.state === "backlog") throw new PreEffectToolRefusal("backlog is read through planner tools");
       return tasks.publicExplain(a.id !== undefined ? Number(a.id) : { title: String(a.title ?? ""), class: a.class as TaskClass }).join("\n");
     }
-    if (by !== USER) throw new Error(`${op} is a console command`);
+    if (op === "deliverables" && by !== USER) {
+      // #933: an agent's list holds only the rows hub_task_show would show it (conductor or planner any non-backlog task, an owner or reviewer its own), through the same public records.
+      if (a.task !== undefined && (!Number.isSafeInteger(a.task) || (a.task as number) <= 0)) throw new PreEffectToolRefusal("task must be a positive integer");
+      const visible = (task: Task) => taskShowAllowed(by, task, config.roles, tasks.isConfiguredPlanner(by));
+      return JSON.stringify(await tasks.deliverableList({ ...(a.task !== undefined ? { task: a.task as number } : {}), approvedOnly: a.approved === true, check: a.check === true, visible }));
+    }
+    if (op === "task_label_check" && by !== USER) {
+      // #933: an agent labels only a task it owns; the CLI writes the research record after this answer.
+      const task = Number.isSafeInteger(a.id) && a.id > 0 ? board.get(a.id) : undefined;
+      if (!task || task.owner !== by) throw new PreEffectToolRefusal(`task #${Number.isSafeInteger(a.id) ? a.id : "?"} is not yours: an agent labels its own task only`);
+      return JSON.stringify({ task: task.id, owner: by });
+    }
+    if (op === "task_unassign" && by !== USER) {
+      if (a.role !== undefined && a.role !== "owner" && a.role !== "reviewer") throw new PreEffectToolRefusal("role must be owner or reviewer");
+      if (a.revision !== undefined && (!Number.isSafeInteger(a.revision) || a.revision < 0)) throw new PreEffectToolRefusal("revision must be a nonnegative integer");
+      return line(await tasks.unassign(a.id, by, true, a.role, a.revision));
+    }
+    if (by !== USER && !(Object.hasOwn(CONDUCTOR_TASK_OPS, op) && operationalContext.getStore()?.actor === by)) throw new Error(`${op} is a console command`);
     switch (op) {
       case "release_new":
         return JSON.stringify(await tasks.newRelease(by, { name: a.name, goal: a.goal, order: a.order }));
+      case "claim_verdict": // #901: a person's verdict on one declared claim; the reply names the slot and the verdict only, never a claim
+        return JSON.stringify((({ id, history }) => ({ task: id, recorded: history.at(-1)?.claim }))(tasks.recordClaimVerdict(by, a.id, { slot: a.slot, verdict: a.verdict, ...(a.model === undefined ? {} : { model: a.model }), ...(a.modelVerdict === undefined ? {} : { modelVerdict: a.modelVerdict }) })));
       case "github_import":
-        return JSON.stringify(await tasks.importGitHub(USER, { repo: a.repo, label: a.label, milestone: a.milestone }));
+        return JSON.stringify(await tasks.importGitHub(by, { repo: a.repo, label: a.label, milestone: a.milestone }));
       case "release_show": {
         const release = a.id !== undefined ? (Number.isSafeInteger(a.id) && a.id > 0 ? board.release(a.id) : undefined) : board.releases().find(release => release.name === a.name);
         if (!release) throw new PreEffectToolRefusal("no such release");
@@ -2959,6 +3407,31 @@ export async function startDaemon(opts: DaemonOptions) {
       case "backlog_pull":
       case "backlog_return":
         return line(await tasks.moveBacklog(by, a.id, op === "backlog_pull"));
+      // #335: the person's schedule commands; #933: the admitted conductor's too. Tasks refuses any other actor.
+      case "schedule_list":
+        if (by !== USER) throw new PreEffectToolRefusal("schedule list is a console command");
+        return JSON.stringify(scheduleViews(config.schedules, schedulesStore.rows(), scheduleNow(), tasks.openScheduled(), tasks.schedulesHeld() || opts.schedulesHeld?.() === true));
+      case "schedule_run": {
+        // The run is registered with the shutdown drain, so `stopOnce` waits for it, as for a timer pass, before the board and the store close (#335). A run that arrives
+        // once stop has begun is refused earlier still, by the control layer ("hub is stopping"); the test below holds that, so nothing here repeats it.
+        const run = tasks.runScheduleNow(by, schedulesStore, config.schedules, a.id, scheduleNow(), () => opts.schedulesHeld?.() === true);
+        const drained = run.then(() => undefined, () => undefined);
+        manualSchedulePasses.add(drained); void drained.finally(() => manualSchedulePasses.delete(drained));
+        return JSON.stringify(await run);
+      }
+      case "schedule_pause":
+      case "schedule_resume":
+        tasks.setSchedulePaused(by, schedulesStore, config.schedules, a.id, op === "schedule_pause", scheduleNow());
+        return JSON.stringify(scheduleViews(config.schedules, schedulesStore.rows(), scheduleNow(), tasks.openScheduled(), tasks.schedulesHeld() || opts.schedulesHeld?.() === true).filter(view => view.id === a.id));
+      // #334: natural-language intake. Person only, except approve for the admitted conductor (#933): Tasks refuses any other actor.
+      case "intake": {
+        const result = await tasks.intake(by, { text: a.text, sources: a.sources });
+        return JSON.stringify({ draft: tasks.publicView(result.draft), children: result.children.map(child => tasks.publicView(child)), split: result.split, ...(result.reason ? { reason: result.reason } : {}) });
+      }
+      case "intake_approve":
+        return JSON.stringify((await tasks.approveIntake(by, a.id)).map(task => tasks.publicView(task)));
+      case "intake_discard":
+        return JSON.stringify((await tasks.discardIntake(by, a.id)).map(task => tasks.publicView(task)));
       case "review_brief": {
         const task = board.get(Number(a.id));
         return task ? tasks.briefText(task) || `task #${task.id} names no commit, or is private: no brief` : `no task #${a.id}`;
@@ -2967,12 +3440,12 @@ export async function startDaemon(opts: DaemonOptions) {
         const task = board.get(Number(a.id));
         if (!task) return JSON.stringify(`no task #${a.id}`);
         const { codeSymbols: _storedCodeSymbols, ...detail } = task;
-        const codeSymbols = tasks.publicView(task).codeSymbols;
+        const publicTask = tasks.publicView(task), codeSymbols = publicTask.codeSymbols;
         const consoleDeliverables = await tasks.deliverableStatus(task);
         const related = tasks.isPii(task) ? undefined : await taskMemoryResult(task, true).catch(() => ({ items: [], state: "unknown" as const }));
         const fresh = board.get(task.id);
         const relatedMemory = related && fresh?.updated === task.updated && !tasks.isPii(fresh) ? { state: related.state, count: related.items.length, ...("head" in related ? { head: related.head } : {}) } : { state: "unknown" };
-        return JSON.stringify({ ...detail, relatedMemory, ...(codeSymbols ? { codeSymbols } : {}), ...(consoleDeliverables ? { deliverables: consoleDeliverables } : {}), symbolOverlaps: tasks.symbolOverlaps(task), flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) }, null, 2);
+        return JSON.stringify({ ...detail, ...holderReasons(publicTask), relatedMemory, ...(codeSymbols ? { codeSymbols } : {}), ...(consoleDeliverables ? { deliverables: consoleDeliverables } : {}), symbolOverlaps: tasks.symbolOverlaps(task), flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) }, null, 2);
       }
       case "deliverables": {
         // #317 (`ahub deliverables`): the board's deliverable records, person only. `check` measures the files now; without it nothing is opened.
@@ -3008,12 +3481,12 @@ export async function startDaemon(opts: DaemonOptions) {
         if (!isFixedBuiltinDefinition(definitionOf(turn.peer)) || !definitionOf(turn.peer)?.session.nativeRevert || !turn.native) throw new Error(`turn ${turn.id} has no Codex conversation turn to revert`);
         if (turnLog!.latest(turn.peer)?.id !== turn.id) throw new Error(`turn ${turn.id} is not Codex's latest turn; reverting it would drop the later ones too`);
         const codex = bus.peers.get(turn.peer);
-        if (!isCodexPeer(codex)) throw new Error("codex is not attached");
+        if (!codex?.revertTurn) throw new Error("codex is not attached");
         const workspace = turnLog!.workspace(turn.id);
         if (workspace !== undefined) {
           const current = readInstanceRoleConfig(opts.cwd), adapter = instanceDefinitionOf(turn.peer, current.instances, current.catalog);
           if (!current.instances?.[turn.peer] || adapter?.kind !== definitionOf(turn.peer)?.kind) throw new Error("turn workspace declaration changed; inspect before reverting");
-          const validated = resolveInstanceExecutionCwd(opts.cwd, turn.peer, current.instances, effectiveInstanceRoles(turn.peer, current.instances, current.roles, current.catalog), current.catalog);
+          const validated = resolveExecutionCwd(turn.peer, current.instances, effectiveInstanceRoles(turn.peer, current.instances, current.roles, current.catalog), current.catalog);
           const bound = executionOwners.get(turn.peer);
           if (validated !== workspace || executionRoot(turn.peer) !== workspace || bound?.owner !== codex || bound.cwd !== workspace) throw new Error("turn workspace differs from the current native owner; inspect before reverting");
         }
@@ -3021,7 +3494,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const held = bus.stateOf(turn.peer) !== "paused";
         if (held) bus.pause(turn.peer);
         try {
-          await codex.revert(turn.native);
+          await codex.revertTurn(turn.native);
         } finally {
           if (held && !manualPaused.has(turn.peer) && !budget.record(turn.peer) && !conductorHolds.has(turn.peer)) bus.resume(turn.peer);
         }
@@ -3077,11 +3550,11 @@ export async function startDaemon(opts: DaemonOptions) {
   // adapter with the gate, and only while its native mode is `ask`: Kimi's `yolo` and `auto` modes send no request for a call they allow.
   const actionEnforcement = (peer: PeerId): { enforced: boolean; reason?: string } => {
     if (definitionOf(peer)?.transport === "claude-channel") {
-      const launch = claudePermissionLaunch(peer), attached = bus.peers.get(peer);
+      const launch = claudeLaunchProof.permissionLaunch(peer), attached = claudeLaunchProof.owner(peer);
       // The launch record outlives the process, so it proves nothing alone: the attached session must be the generation whose hook last spoke to the hub.
       if (!launch) return { enforced: false, reason: "no hub permission hook in this Claude session (start it with ahub claude)" };
       if (launch.unattended) return { enforced: false, reason: "this Claude launch is --unattended: its permission checks, hooks included, are off" };
-      if (!isWsPeer(attached) || attached.state === "offline" || claudePermissionGenerations.get(peer) !== attached.sessionGeneration)
+      if (!attached || attached.state === "offline" || !claudeLaunchProof.verified(peer))
         return { enforced: false, reason: "no live Claude session has run the hub permission hook yet" };
       return { enforced: true };
     }
@@ -3104,9 +3577,35 @@ export async function startDaemon(opts: DaemonOptions) {
   const unattendedPeers = new Set<string>();
   const startingUnattended = new Map<string, boolean>();
   const nativeUnattended = (peer: string): boolean => startingUnattended.get(peer) ?? unattendedPeers.has(peer);
-  const claudePermissionGenerations = new Map<string, string>();
   const permissions = new Map<string, { push: string; peer: string; tool?: string; createdAt: number; expiresAt: number; done: (optionId: string | undefined, surface?: "console" | "dashboard" | "terminal", reason?: "expired" | "cancelled") => boolean }>();
   let stopping = false;
+  const roomChat = new RoomChat({ bus, cwd: opts.cwd, routing: activeRouting, piiPaths: () => config.pii?.paths ?? [],
+    senderPrivate: peer => peer === USER ? false : bus.peers.has(peer) && !peer.includes("@") ? !!turns.get(peer)?.private || contextPii(peer) : undefined,
+    taskPrivate: id => { const task = board.get(id); return task ? tasks.isPii(task) : undefined; },
+    modelScreenOn: () => tasks.screenOn(),
+    screen: opts.piiScreen ?? (text => screenPii(text, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })),
+    policyVersion: () => configRevision,
+    limits: () => config.limits,
+    notice: value => notify(value.code === "application_capacity" ? `room ${value.room}: application capacity reached (${value.count}); resolve incoming uncertainty with ahub room resolve` : `room ${value.room}: signed frame sequence gap ${value.count} from ${value.sender}`),
+    roster: ids => { remoteRoster.clear(); for (const id of ids) remoteRoster.add(id); },
+    changed: () => { if (ready && !stopping) writeStatus(); },
+  });
+  remotePending = room => roomChat.pendingIds(room);
+  remoteQueueChanged = () => roomChat.queueChanged();
+  const roomCommands = new RoomCommands({ stateDir: opts.stateDir, cwd: opts.cwd,
+    presence: () => [...bus.peers].filter(([id]) => !id.includes("@") && membershipAllowed(id)).map(([id, peer]) => ({ id, state: peer.state })), chat: roomChat,
+  });
+  // Room crypto/state failure disables only this optional outbound service, never local work.
+  void roomCommands.start().catch(() => log("rooms unavailable"));
+  let roomInboxExpiryFailed = false;
+  const roomInboxExpiry = setInterval(() => {
+    if (stopping || recoveryActive() || bus.isRecoveryHeld) return;
+    try { roomCommands.expireInbox(); roomInboxExpiryFailed = false; }
+    catch { if (!roomInboxExpiryFailed) log("room inbox expiry unavailable"); roomInboxExpiryFailed = true; }
+  }, 30_000);
+  roomInboxExpiry.unref?.(); intervals.push(roomInboxExpiry);
+  const roomTickets = new WeakMap<Sock, { id: string; expires: number; preview: RoomPreview }>();
+
   const releaseAuthorizations = new ReleaseAuthorizations(opts.cwd, {
     docs: opts.releaseDocEvidence,
     gh: (args, timeout) => sdlcGh(args, timeout, opts.cwd),
@@ -3144,7 +3643,7 @@ export async function startDaemon(opts: DaemonOptions) {
    * waited past `budget.stale_min` the status says so, and the person decides. Read-only.
    */
   const importantWaitingStatus = (id: PeerId, peer: PeerAdapter | undefined): Record<string, unknown> => {
-    if (!isAcpPeer(peer) || (peer as PeerAdapter).steer || bus.stateOf(id) !== "busy") return {};
+    if (definitionOf(id)?.transport !== "acp" || peer?.steer || bus.stateOf(id) !== "busy") return {};
     const since = bus.oldestQueuedImportantAt(id);
     if (since === undefined || Date.now() - since < config.budget.stale_min * 60_000) return {};
     const count = bus.queuedImportant(id), minutes = Math.floor((Date.now() - since) / 60_000);
@@ -3157,8 +3656,11 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   let releasing = false; // gone-owner release (#6) and the ready sweep (#34): one run at a time, and a recovery commit waits for it
   const recoveryReady = () => {
-    if (!recoveryActive() || releasing || taskOpsInFlight !== 0 || tasks.checksPending() !== 0 || piCallsInFlight() !== 0 || permissions.size !== 0 || starting.size !== 0 || requestedPeerStops.size !== 0 || rosterChanging !== undefined || !budget.recoverySettled || [...bus.peers.values()].some((peer) => peer.state === "busy" || (isPiPeer(peer) && !peer.recoveryReady))) return false;
+    if (!recoveryActive() || releasing || taskOpsInFlight !== 0 || tasks.checksPending() !== 0 || piCallsInFlight() !== 0 || permissions.size !== 0 || starting.size !== 0 || requestedPeerStops.size !== 0 || rosterChanging !== undefined || !budget.recoverySettled || [...bus.peers.values()].filter(peer => !peer.id.includes("@")).some((peer) => peer.state === "busy" || ("recoveryReady" in peer && peer.recoveryReady !== true))) return false;
     if (checkPending.size !== 0) return false;
+    if (tasks.autoPullsPending() !== 0) return false; // #785 P1c: an automatic backlog pull mid-admission would write after the commit's digest; its own line keeps the line above exact for scripts/seeds.json
+    if (tasks.queuePressureRechecksPending() !== 0) return false;
+    if (tasks.schedulesPending() !== 0) return false; // #512a: a scheduled run mid-admission (its PII screen is awaited) would write after the commit's digest; the hold fence refuses its write, and this waits for it to end
     if (!recoveryPeerSnapshot) return true;
     const current = recoveryPeers();
     return recoveryPeerSnapshot.every((saved) => {
@@ -3279,7 +3781,14 @@ export async function startDaemon(opts: DaemonOptions) {
   } };
   const claudeUsageTimer = setInterval(collectClaudeUsage, 2000);
   claudeUsageTimer.unref(); intervals.push(claudeUsageTimer);
-  const recoveryPeers = (): Record<string, RestartPeerSnapshot> => Object.fromEntries([...bus.peers].map(([id, peer]) => {
+  const recoveryPeers = (): Record<string, RestartPeerSnapshot> => Object.fromEntries([...new Set([...bus.peers.keys(), ...allExternalInstanceIds()])].filter(id => !id.includes("@")).map(id => {
+    const peer = bus.peers.get(id);
+    if (isExternalInstance(id) || externalRefusedRows.has(id)) {
+      const binding = externalRefusedRows.has(id) ? externalBindings.get(id) : retainedExternalBinding(id), receipt = peer && externalLaunches.get(id) ? managedAcpLaunch(peer, externalLaunches.get(id)!.options) : undefined;
+      const saved = restored?.peers.find(row => row.id === id);
+      return [id, { id, state: peer?.state ?? "offline", queueIds: bus.queueIds(id), ...(binding ? { externalInstance: binding } : {}), ...(receipt?.sessionId ? { sessionId: receipt.sessionId } : externalSessions.has(id) ? { sessionId: externalSessions.get(id) } : saved?.sessionId ? { sessionId: saved.sessionId } : {}) }];
+    }
+    if (!peer) throw new Error("recovery peer disappeared");
     const metadata = peer.recoveryMetadata?.() ?? {};
     const row: RestartPeerSnapshot = { id, state: peer.state, queueIds: bus.queueIds(id), ...(metadata.launch ? { launch: metadata.launch as Record<string, unknown> } : {}) };
     if (typeof metadata.threadId === "string") row.threadId = metadata.threadId;
@@ -3301,7 +3810,7 @@ export async function startDaemon(opts: DaemonOptions) {
       return row;
     });
     const budgetState = budget.persistedPauseDigestRows().sort((a, b) => a.peer.localeCompare(b.peer));
-    return { queues, manualPaused: [...manualPaused].sort(), boardDigest: digest(boardState), budgetDigest: digest(budgetState) };
+    return { queues, manualPaused: [...manualPaused].sort(), boardDigest: digest(boardState), budgetDigest: digest(budgetState), ...(allExternalInstanceIds().length ? { externalBindingsDigest: digest(allExternalInstanceIds().sort().map(id => [id, (externalRefusedRows.has(id) ? externalBindings.get(id) : retainedExternalBinding(id)) ?? null])) } : {}) };
   };
   /** The integrity in the shape `expected` was recorded in: the current one unless only an older shape matches. */
   const integrityAs = (expected: unknown) => {
@@ -3324,9 +3833,10 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const permissionDisplay = (id: string, peer: PeerAdapter | undefined): string => {
     if (readOnlyPeer(id)) return "read-only";
-    if (definitionOf(id)?.transport === "claude-channel" && isWsPeer(peer) && peer.state !== "offline") {
-      const launch = claudePermissionLaunch(id);
-      if (!launch || claudePermissionGenerations.get(id) !== peer.sessionGeneration) return "unverified";
+    const channelOwner = claudeLaunchProof.owner(id);
+    if (channelOwner && channelOwner === peer && channelOwner.state !== "offline") {
+      const launch = claudeLaunchProof.permissionLaunch(id);
+      if (!launch || !claudeLaunchProof.verified(id)) return "unverified";
     }
     const native = peer?.permissionModeState;
     // An offline ask clears the hub choice, not a stopped ACP runtime's retained native field.
@@ -3335,7 +3845,7 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const permissionStatus = (id: string, peer: PeerAdapter | undefined): Record<string, unknown> => {
     const note = definitionOf(id)?.permission.unmanagedStatusNote;
-    if (note && isWsPeer(peer) && peer.pullOnly) return { permissionNote: note };
+    if (note && peer?.pullOnly === true) return { permissionNote: note };
     const mode = permissionDisplay(id, peer);
     return mode === "ask" ? {} : { permissionMode: mode };
   };
@@ -3348,11 +3858,11 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const statusPeerIds = (open: ReturnType<Board["statusTasks"]>) => {
     const reservations = board.statusReservations();
-    const ids = new Set([...bus.knownPeers(), ...extraIds, ...reservations]);
+    const ids = new Set([...bus.knownPeers(), ...extraIds, ...allExternalInstanceIds(), ...reservations].filter(id => !id.includes("@")));
     for (const peer of configuredIds) if (onRoster(peer)) ids.add(peer);
     if (!Object.keys(config.roster).some(peer => !membershipAllowed(peer))) return [...ids];
     for (const task of open) for (const peer of [task.owner, task.reviewer]) if (peer && !membershipAllowed(peer)) ids.add(peer);
-    return [...ids].filter(peer => membershipAllowed(peer) || reservations.includes(peer) || bus.queued(peer) > 0 || (() => { const summary = bus.queueSummary(peer); return summary.needsReview > 0 || !!summary.liveAccepted?.length; })() || open.some(task => task.owner === peer || task.reviewer === peer));
+    return [...ids].filter(peer => !peer.includes("@") && (isExternalInstance(peer) || externalRefusedRows.has(peer) || membershipAllowed(peer) || reservations.includes(peer) || bus.queued(peer) > 0 || (() => { const summary = bus.queueSummary(peer); return summary.needsReview > 0 || !!summary.liveAccepted?.length; })() || open.some(task => task.owner === peer || task.reviewer === peer)));
   };
   let checkoutInTick: { branch: ReturnType<typeof mainCheckoutBranch> } | undefined;
   const checkoutBranch = () => {
@@ -3362,20 +3872,25 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     return checkoutInTick.branch;
   };
-  const status = (includeAttentionItems = false, includeAttentionInput = false) => {
+  const status = (includeAttentionItems = false, includeAttentionInput = false, includeDoing = false) => {
     const taskNeeds = board.statusTasks();
-    const taskStalls = tasks.stalled();
+    const ownerIsolation = ownerIsolationProjection();
+    const taskStalls = tasks.stalled({ ownerIsolation });
     const pendingTaskOffers = tasks.pendingOffers().filter(offer => offer.pullOnly === true);
     const peerIds = byKind(statusPeerIds(taskNeeds));
+    const queueBackpressure = tasks.queuePressureStatus(peerIds);
     const view = {
+    ...(queueBackpressure ? { queueBackpressure } : {}),
     ...(crashReport.length ? { crash: crashReport } : {}),
     projectId,
     instanceId,
+    rooms: roomCommands.statusView(),
     version: VERSION,
     pluginBundle: SERVER_JS,
     pendingRestart: allPendingRestart(),
     retainedConfig,
     ...(agentDrift.length ? { agentDrift } : {}),
+    ...(config.schedules.length ? { schedules: scheduleViews(config.schedules, schedulesStore.rows(), scheduleNow(), tasks.openScheduled(), tasks.schedulesHeld() || opts.schedulesHeld?.() === true) } : {}),
     ...(() => { const warning = mainCheckoutWarning(opts.cwd, tasks.publicMetadataText, checkoutBranch); return warning ? { mainCheckout: warning } : {}; })(),
     startModes: Object.fromEntries([...START_MODE_PEERS, ...configuredIds].map(peer => [peer, startModeOf(config.peers, peer, declarations, adapterCatalog)])),
     memoryProfile: memoryProfileStatus(includeAttentionItems),
@@ -3389,13 +3904,21 @@ export async function startDaemon(opts: DaemonOptions) {
     features: DAEMON_FEATURES,
     configuredAdapters: configuredIds,
     ...(externalAdapters.length ? { externalAdapters } : {}),
+    ...(allExternalInstanceIds().length ? { externalInstanceCatalog: externalInstanceCatalog({ schema: 1, projectRoot: opts.cwd, epoch: instanceId,
+      fingerprint: digest(allExternalInstanceIds().map(id => [id, externalBindings.get(id) ?? null])), instances: allExternalInstanceIds().map(id => {
+        const refused = externalRefusedRows.get(id);
+        if (refused) return { id, kind: refused.kind, displayName: refused.kind, roles: [], form: "headless", readOnly: false, permissionState: "unknown", availability: "refused", refusalCode: refused.refusalCode };
+        const bound = retainedExternalBinding(id), current = currentExecutionOwner(id), owner = bus.peers.get(id);
+        return { id, kind: declarations[id]!.kind, displayName: definitionOf(id)!.displayName, roles: config.roles[id] ?? [], form: "headless", readOnly: readOnlyPeer(id), permissionState: owner?.permissionModeState ?? "unknown",
+          availability: !bound ? "refused" : current ? "ready" : "offline", ...(!bound ? { refusalCode: "binding-changed" } : !owner ? { refusalCode: "not-started" } : !current ? { refusalCode: "ownership-unverified" } : {}) };
+      }) }) } : {}),
     ...(externalAdapterRefusals.length ? { externalAdapterRefusals } : {}),
     startablePeers: SUPPORTED_PEERS.filter(isStartablePeer),
     readOnlyPeers: extraIds.filter(readOnlyPeer),
     // #450 I3: the instance ids this daemon bound at startup; a launcher selects only one of these.
     activeInstances: extraIds,
-    ownerIsolation: Object.fromEntries(extraIds.map(id => [id, !!ownerWriteRoot(id) && ownerWriteRoot(id) !== opts.cwd])),
-    ownerIsolationNotes: Object.fromEntries(extraIds.filter(id => definitionOf(id)?.transport === "claude-channel" && !ownerWriteRoot(id)).map(id => [id, "terminal execution root not verified; owner admission refused"])),
+    ownerIsolation,
+    ownerIsolationNotes: Object.fromEntries(extraIds.filter(id => !ownerIsolation[id]).map(id => [id, declarations[id]?.worktree ? definitionOf(id)?.transport === "claude-channel" ? "terminal execution root not verified; owner admission refused" : "execution root not verified" : "no declared write worktree"])),
     stopping,
     pid: process.pid,
     cwd: opts.cwd,
@@ -3403,12 +3926,12 @@ export async function startDaemon(opts: DaemonOptions) {
     ...(dashboard ? { uiOrigin: dashboard.origin } : {}),
     codexProxyPort: opts.codexProxyPort,
     peers: Object.fromEntries(
-      peerIds.map((id) => { const p = bus.peers.get(id); const summary = bus.queueSummary(id); const context = contexts.view(id, contextSession(id), !!p && ["idle", "busy", "paused"].includes(bus.stateOf(id))); return [id, { state: bus.stateOf(id), ...(!membershipAllowed(id) ? { rostered: false, rosterNote: "off roster" } : {}), ...permissionStatus(id, p), ...(isFixedBuiltinDefinition(definitionOf(id)) && (isCodexPeer(p) || isQwenDualPeer(p)) && p.statusNotice ? { statusNotice: p.statusNotice } : {}), ...(context.source !== null || context.measuredAt !== null ? { context } : {}), queued: bus.queued(id), ...(p ? {} : { attached: false }), ...(declarations[id] && config.roles[id]?.includes("implementer") && definitionOf(id)?.transport === "claude-channel" ? { ownerIsolation: !!ownerWriteRoot(id) && ownerWriteRoot(id) !== opts.cwd, ...(!ownerWriteRoot(id) ? { ownerIsolationNote: "terminal execution root not verified; owner admission refused" } : {}) } : {}), ...(summary.needsReview ? { needsReview: summary.needsReview } : {}), ...(summary.liveAccepted ? { liveAccepted: summary.liveAccepted, settlementNote: "awaiting adapter completion (Claude: correlated reply or hub_delivery_done); task state is independent" } : {}), ...queueHoldStatus(id, summary.heldBy), ...(summary.oldestQueuedAt !== undefined ? { oldestQueuedAt: summary.oldestQueuedAt } : {}), ...(bus.queuedImportant(id) ? { queuedImportant: bus.queuedImportant(id) } : {}), ...importantWaitingStatus(id, p), ...pausedNote(id), ...(reviewerUnavailable.has(id) ? { reviewerUnavailable: reviewerUnavailable.get(id) } : {}), ...jcodeModelSource(id), ...(reviewOnlyPeer(id) ? { reviewScope: reviewScopeOf(id) } : {}), ...(isLocalPeer(p) && p.lastServedBy ? { servedBy: p.lastServedBy } : {}), ...(isWsPeer(p) && p.claiming ? { claiming: true } : {}), ...(isWsPeer(p) && p.pullOnly ? { pullOnly: true, toolsOnly: definitionOf(id)?.attach?.pullOnlyNotice ?? "tools-only: messages wait for hub_inbox; for pushes restart Claude with ahub claude", lastInboxAt: p.lastInboxAt ?? null } : {}), ...(isPiPeer(p) ? { requestedModel: p.getRequestedModel(), backends: modelRelays.get(id)?.status().backends ?? [] } : {}) }]; }),
+      peerIds.map((id) => { const p = bus.peers.get(id); const summary = bus.queueSummary(id); const pressure = queueBackpressure?.peers[id]; const oldestQueuedAt = pressure ? pressure.oldestQueuedAt : summary.oldestQueuedAt; const context = contexts.view(id, contextSession(id), !!p && ["idle", "busy", "paused"].includes(bus.stateOf(id))); const statusNotice = isFixedBuiltinDefinition(definitionOf(id)) ? p?.statusNotice : undefined; return [id, { state: bus.stateOf(id), ...(includeAttentionItems && isExternalInstance(id) && !externalRefusedRows.has(id) && retainedExternalBinding(id) ? { externalInstance: retainedExternalBinding(id) } : {}), ...(!membershipAllowed(id) ? { rostered: false, rosterNote: "off roster" } : {}), ...permissionStatus(id, p), ...(statusNotice ? { statusNotice } : {}), ...(context.source !== null || context.measuredAt !== null ? { context } : {}), queued: bus.queued(id), ...(p ? {} : { attached: false }), ...(declarations[id] && config.roles[id]?.includes("implementer") && definitionOf(id)?.transport === "claude-channel" ? { ownerIsolation: ownerIsolation[id] === true, ...(ownerIsolation[id] !== true ? { ownerIsolationNote: "terminal execution root not verified; owner admission refused" } : {}) } : {}), ...(summary.needsReview ? { needsReview: summary.needsReview } : {}), ...(summary.liveAccepted ? { liveAccepted: summary.liveAccepted, settlementNote: "awaiting adapter completion (Claude: correlated reply or hub_delivery_done); task state is independent" } : {}), ...queueHoldStatus(id, summary.heldBy), ...(typeof oldestQueuedAt === "number" ? { oldestQueuedAt } : {}), ...(bus.queuedImportant(id) ? { queuedImportant: bus.queuedImportant(id) } : {}), ...importantWaitingStatus(id, p), ...pausedNote(id), ...(reviewerUnavailable.has(id) ? { reviewerUnavailable: reviewerUnavailable.get(id) } : {}), ...jcodeModelSource(id), ...(reviewOnlyPeer(id) ? { reviewScope: reviewScopeOf(id) } : {}), ...(isLocalPeer(p) && p.lastServedBy ? { servedBy: p.lastServedBy } : {}), ...(isWsPeer(p) && p.claiming ? { claiming: true } : {}), ...(isWsPeer(p) && p.pullOnly ? { pullOnly: true, toolsOnly: definitionOf(id)?.attach?.pullOnlyNotice ?? "tools-only: messages wait for hub_inbox; for pushes restart Claude with ahub claude", lastInboxAt: p.lastInboxAt ?? null } : {}), ...(isPiPeer(p) ? { requestedModel: p.getRequestedModel(), backends: modelRelays.get(id)?.status().backends ?? [] } : {}) }]; }),
     ),
     taskWip: tasks.wipBreakdown(peerIds),
     boardReadCapabilities: { releaseFilter: true, columnMetadata: true },
     actionPolicyInfo: Object.fromEntries(peerIds.map(id => { const e = actionEnforcement(id); return [id, actionBudgets.status(id, e.enforced, e.reason)]; })),
-    roleInfo: Object.fromEntries(peerIds.map(id => [id, { flowRoles: config.roles[id] ?? [], catalogRoles: roleState(id), ...(config.roles[id]?.includes("planner") ? { planner: plannerSource } : {}) }])),
+    roleInfo: Object.fromEntries(peerIds.map(id => [id, { flowRoles: config.roles[id] ?? [], catalogRoles: roleState(id), ...roleVisibility(id), ...(config.roles[id]?.includes("planner") ? { planner: plannerSource } : {}) }])),
     planner: { peers: plannerPeers(), source: plannerSource },
     ...(pendingPermissionDefaults.size ? { permissionDefaults: [...pendingPermissionDefaults].map(([peer, source]) => ({ peer, mode: "never-ask", source })) } : {}),
     ...(modelRelay ? { models: modelRelay.status() } : {}),
@@ -3419,6 +3942,8 @@ export async function startDaemon(opts: DaemonOptions) {
     ...(bus.storageError ? { deliveryError: bus.storageError } : {}),
     ...(recoveryOperationId ? { recovery: { operationId: recoveryOperationId, phase: recoveryPhase, ready: recoveryReady() } } : {}),
     };
+    // #878: live readers only (the status reply, the dashboard); writeStatus never asks, so status.json never holds it.
+    if (includeDoing) for (const [id, doing] of Object.entries(doingRows(peerIds))) Object.assign(view.peers[id]!, { doing });
     const peerNeeds: Record<string, NonNullable<NeedsInput["peers"]>[string]> = Object.fromEntries(Object.entries(view.peers).map(([peer, row]) => [peer, { state: row.state, attached: row.attached, needsReview: row.needsReview, heldBy: row.heldBy }]));
     // Lazy legacy peer lists need not contain a persisted owner that is now offline.
     for (const task of taskNeeds) if (task.owner && task.owner !== USER && task.owner !== HUB && !Object.hasOwn(peerNeeds, task.owner)) {
@@ -3488,8 +4013,10 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   const noticedHolds = new Set<string>();
   let reportingQueues = false;
+  let queuePressureStatusQueued = false;
   bus.onQueues = () => {
     if (stopping || settlingSuperseded || reportingQueues) return;
+    remoteQueueChanged();
     reportingQueues = true;
     try {
       settleSupersededDeliveries();
@@ -3501,6 +4028,18 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       writeStatus();
     } finally { reportingQueues = false; }
+    if (ready) {
+      tasks.scheduleQueuePressureRecheck();
+      const policy = queuePolicy();
+      if ((policy.max_queued > 0 || policy.max_oldest_s > 0) && !queuePressureStatusQueued) {
+        queuePressureStatusQueued = true;
+        // withdraw() notifies before its synchronous checkpoint. Refresh only after it commits.
+        queueMicrotask(() => {
+          queuePressureStatusQueued = false;
+          if (!stopping) try { writeStatus(); } catch { log("queue pressure status unavailable"); }
+        });
+      }
+    }
   };
   // Opening the journal/restoring the snapshot preceded callbacks; classify those holds too.
   settleSupersededDeliveries();
@@ -3684,7 +4223,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (piContinuity.state === "ready" && (!isPiPeer(pi) || pi.state === "offline" || !pi.sessionGeneration || !pi.recoveryReady)) {
       piContinuity = readRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd });
     }
-    const peers = [...bus.peers.values()].filter((p) => p.state !== "offline").map((p) => {
+    const peers = [...bus.peers.values()].filter((p) => p.state !== "offline" && !p.id.includes("@")).map((p) => {
       let meta: Record<string, unknown> = {};
       try { meta = (p as { recoveryMetadata?: () => Record<string, unknown> }).recoveryMetadata?.() ?? {}; } catch { /* not ready yet: the id alone */ }
       return { peer: p.id, meta };
@@ -3704,6 +4243,7 @@ export async function startDaemon(opts: DaemonOptions) {
     report(`the previous hub run stopped without shutting down${lostCount ? `; ${lostCount} deliveries it had in flight are in needs_review (ahub queue list)` : ""}`);
     const start = (peer: string, args: Parameters<typeof startPeer>[1]) => startPeer(peer, args).catch((e: Error) => ({ ok: false, error: e.message }));
     for (const step of crashPlan(prev.peers, declarations, adapterCatalog)) {
+      if (isExternalInstance(step.peer)) { report(`${step.peer}: external module instance stays stopped; use an explicit same-binding start`); continue; }
       if (!declarations[step.peer] && definitionOf(step.peer)?.session.restoreOnStart && archivedPiContinuity) { report("pi: archived continuity evidence holds crash-session resume and fresh fallback; pi.auto_start uses only the recorded archived session"); continue; }
       // `pi.auto_start` already asks for Pi (#66): its recorded headless session comes back, auto-resume or not, and a
       // fresh one starts when that fails or there is nothing headless to resume. Pi runs on-prem: no cloud quota.
@@ -3740,8 +4280,11 @@ export async function startDaemon(opts: DaemonOptions) {
     uiEvents.push({ seq: ++uiSequence, event: e });
     if (uiEvents.length > 200) uiEvents.shift();
     if (e.t === "state") {
+      roomCommands.changed();
       log(`state ${e.peer} -> ${e.state}`);
       event({ type: "state", peer: e.peer, state: e.state });
+      if (ready) tasks.scheduleQueuePressureRecheck();
+      if (e.peer.includes("@")) { if (!stopping) writeStatus(); return; }
       // #248: the add-ons it works with, once per attach (names and versions only).
       // A result is written unless a later attachment began meanwhile: a peer that detached before its probe settled
       // still did its work under that attachment.
@@ -3849,7 +4392,11 @@ export async function startDaemon(opts: DaemonOptions) {
             }
           }
           snapshotMs = (snapshotMs ?? 0) + end.ms;
-          try { turnLog.end(open.id, end.tree, changed, Math.max(1, Number(config.snapshots.keep) || 20)); } catch (error) { log(`turn record ${open.id}: ${(error as Error).message}`); }
+          // #798 D2: a submodule's own edits never move the superproject's gitlink, so the diff above cannot see them. Name the dirty ones as unobserved (never as changed:
+          // undo would try to restore them). Only for a turn whose trees are known; a read git cannot answer, or the budget cut short, records nothing, which stays unknown.
+          let unobserved: string[] | undefined;
+          if (open.tree && end.tree && end.repo) try { unobserved = dirtySubmodules(end.repo, end.budget); } catch (error) { snapshotFailure(`the submodules of ${open.id}`, error); }
+          try { turnLog.end(open.id, end.tree, changed, Math.max(1, Number(config.snapshots.keep) || 20), unobserved); } catch (error) { log(`turn record ${open.id}: ${(error as Error).message}`); }
           // After the turn_end event: a notice delivered at once starts the peer's next turn, which must come after it.
           if (changed.length) afterTurn = () => detectConflicts(e.peer, open.id, open.start, changed);
         }
@@ -3948,7 +4495,10 @@ export async function startDaemon(opts: DaemonOptions) {
   const permissionAnswerEpoch = (peer: string) => permissionAnswerEpochs.get(peer) ?? 0;
   type PermissionResult = { outcome: "answered" | "expired" | "cancelled"; optionId?: string };
   async function onPermission(req: PermissionRequest, signal?: AbortSignal): Promise<string | undefined> {
+    const external = isExternalInstance(req.peer) ? currentExecutionOwner(req.peer, true) : undefined;
+    if (isExternalInstance(req.peer) && !external) return undefined;
     const result = await requestPermission(req, signal);
+    if (external && (currentExecutionOwner(req.peer, true) !== external || !membershipAllowed(req.peer))) return undefined;
     return result.outcome === "answered" ? result.optionId : undefined;
   }
   /** The managed local/Pi execution boundary: a classed call asks before any native mode or tool-wide grant. */
@@ -3973,7 +4523,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     return !gate.denyOnly && picked.optionId === "allow";
   }
-  async function requestPermission(req: PermissionRequest, signal?: AbortSignal, observe?: ApprovalObserver, requirePerson = false): Promise<PermissionResult> {
+  async function requestPermission(req: PermissionRequest, signal?: AbortSignal, observe?: ApprovalObserver, requirePerson = false, lifecycle?: { registered(id: string): void; expired(id: string): void }): Promise<PermissionResult> {
     const requestEpoch = permissionAnswerEpoch(req.peer);
     const observed = (source: "person" | "automatic" | "expired" | "aborted") => {
       try { observe?.({ source, answerEpoch: permissionAnswerEpoch(req.peer), ...(source === "expired" ? { eligibleExpiry: requestEpoch === permissionAnswerEpoch(req.peer) } : {}) }); }
@@ -4011,6 +4561,7 @@ export async function startDaemon(opts: DaemonOptions) {
         signal?.removeEventListener("abort", aborted);
         permissions.delete(id); // withdrawal happens before any observer, resolution or late grant
         writeStatus(); // token-free readers must observe withdrawal before settlement callbacks
+        if (!option && reason === "expired") { try { lifecycle?.expired(id); } catch { /* Host diagnostics never change approval settlement. */ } }
         const outcome = option ? "answered" : reason;
         if (surface) permissionAnswerEpochs.set(req.peer, permissionAnswerEpoch(req.peer) + 1);
         observed(surface ? "person" : outcome === "expired" ? "expired" : "aborted");
@@ -4024,6 +4575,7 @@ export async function startDaemon(opts: DaemonOptions) {
         return true;
       };
       permissions.set(id, { push, done, peer: req.peer, ...(publicTool ? { tool: publicTool } : {}), createdAt, expiresAt });
+      try { lifecycle?.registered(id); } catch { /* Host diagnostics never change approval admission. */ }
       writeStatus(); // an approval can wait without any subsequent bus event
       timer = setTimeout(() => done(undefined, undefined, "expired"), timeoutMs);
       signal?.addEventListener("abort", aborted, { once: true });
@@ -4048,8 +4600,13 @@ export async function startDaemon(opts: DaemonOptions) {
     replacingPi.add(pi);
     try { await pi.stop(); } finally { replacingPi.delete(pi); }
   }
-  function startPeer(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }, replacementAuthority?: symbol): Promise<Record<string, unknown>> {
+  function startPeer(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }, replacementAuthority?: symbol, startCurrent?: () => void): Promise<Record<string, unknown>> {
+    startCurrent?.();
+    if (startCurrent && starting.has(peer)) return Promise.resolve({ ok: false, error: "controlled recovery cannot join another pending start" });
+    if (peer.includes("@")) return Promise.resolve({ ok: false, error: "remote peers have no local runtime or control authority" });
+    if (isExternalInstance(peer) && (Object.keys(args).some(key => !["mode", "sessionId"].includes(key)) || args.mode !== undefined && args.mode !== "headless")) return Promise.resolve({ ok: false, error: "external module instances permit only a headless start and recorded session id" });
     if (args.replaceSession !== undefined && (args.replaceSession !== true || replacementAuthority !== piReplacementAuthority || definitionOf(peer)?.start.daemonPort !== "pi-rpc")) return Promise.resolve({ ok: false, error: "Pi session replacement requires explicit person authorization" });
+    if (externalRefusedRows.has(peer)) return Promise.resolve({ ok: false, error: "instance kind is unavailable in the startup catalog; check its kind spelling and person-owned module declarations, then restart the hub" });
     if (stopping) return Promise.resolve({ ok: false, error: "hub is stopping" });
     if (!membershipAllowed(peer)) return Promise.resolve({ ok: false, error: `${peer} is off roster; a person can add it with ahub roster add ${peer}` });
     if (rosterChanging === peer) return Promise.resolve({ ok: false, error: `${peer} roster change is in progress` });
@@ -4062,11 +4619,13 @@ export async function startDaemon(opts: DaemonOptions) {
       return joined;
     }
     if (definitionOf(peer)?.permission.trackUnattended) startingUnattended.set(peer, args.unattended === true);
-    const running = startPeerOnce(peer, args).then(async result => {
+    const running = startPeerOnce(peer, args, startCurrent).then(async result => {
+      startCurrent?.();
       if (!result.ok && definitionOf(peer)?.permission.trackUnattended) unattendedPeers.delete(peer);
       if (!result.ok || result.already) return result;
       if (definitionOf(peer)?.session.restoreOnStart) recordSessions();
       return permissionChange(peer, async () => {
+        startCurrent?.();
         if (definitionOf(peer)?.permission.trackUnattended) { if (args.unattended) unattendedPeers.add(peer); else unattendedPeers.delete(peer); }
         logPermissionStart(peer); writeStatus(); return result;
       }, true);
@@ -4122,7 +4681,9 @@ export async function startDaemon(opts: DaemonOptions) {
   });
   // Printed for a person's explicit reconciliation only; never executed by auto-start.
   const continuityCleanup = () => `After inspection, archive the active bookmark with ${["mv", "-n", "--", join(opts.stateDir, "recovery-continuity.json"), join(opts.stateDir, `recovery-continuity.retired.manual.${randomUUID()}.json`)].map(shellQuote).join(" ")} before choosing another session`;
-  async function hubStart(peer: unknown, by: string): Promise<Record<string, unknown>> {
+  async function hubStart(peer: unknown, by: string, person = false): Promise<Record<string, unknown>> {
+    if (typeof peer === "string" && peer.includes("@")) return { ok: false, error: "remote peers have no local runtime or control authority" };
+    if (typeof peer === "string" && isExternalInstance(peer) && !person) return { ok: false, error: "external module instances require an explicit person start" };
     if (stopping) return { ok: false, error: "hub is stopping" };
     if (rosterChanging !== undefined && rosterChanging === peer) return { ok: false, error: `${String(peer)} roster change is in progress` };
     if (!isStartablePeer(peer)) return { ok: false, error: "unknown peer; the hub starts claude, codex, kimi, qwen (when on roster), pi (when enabled) and local" };
@@ -4196,12 +4757,13 @@ export async function startDaemon(opts: DaemonOptions) {
     if (stopping || recoveryActive()) return { ok: false, error: "recovery or shutdown is holding peer stops; finish the operation before retrying" };
     if (typeof peer !== "string" || !PEER_ID.test(peer)) return { ok: false, error: "unknown peer; run ahub status and choose a hub-owned headless peer" };
     const owner = bus.peers.get(peer);
-    const stopNotice = definitionOf(peer)?.cli.stopNotice?.(isWsPeer(owner) ? "tui" : !owner ? startMode(peer) : "headless", owner);
+    if (owner && "form" in owner && owner.form === undefined) return { ok: false, error: "peer form is unknown; refresh ahub status before stopping it" };
+    const stopNotice = definitionOf(peer)?.cli.stopNotice?.(owner?.form ?? (owner ? "headless" : startMode(peer)), owner);
     if (stopNotice) return { ok: false, error: stopNotice };
     if (isQwenDualPeer(owner)) return { ok: false, error: "Qwen belongs to its own terminal; end it there (the hub never signals a person's Qwen)" };
-    if (!(isAcpPeer(owner) || isPiPeer(owner) || isLocalPeer(owner) || isReviewerPrintPeer(owner) || definitionOf(peer)?.start.daemonPort === "claude-implementer" && !!owner?.ownedTools)) return { ok: false, error: "unknown or non-owned peer; run ahub status and choose a hub-owned headless peer" };
-    if (isPiPeer(owner) && owner.mode !== "headless") return { ok: false, error: "Pi belongs to a native TUI terminal; end it in its terminal" };
-    if (owner.state === "offline" && !(isAcpPeer(owner) && owner.pendingOwnedProcess)) return { ok: false, error: `peer is already offline; start it with ${startCommand(peer)} before stopping it` };
+    if (!owner || owner.hubOwned !== true) return { ok: false, error: "unknown or non-owned peer; run ahub status and choose a hub-owned headless peer" };
+    if (owner.form === "tui") return { ok: false, error: `${definitionOf(peer)?.displayName ?? peer} belongs to a native TUI terminal; end it in its terminal` };
+    if (owner.state === "offline" && (isExternalInstance(peer) ? owner.pendingOwnedProcess === false : owner.pendingOwnedProcess !== true)) return { ok: false, error: `peer is already offline; start it with ${startCommand(peer)} before stopping it` };
     if (starting.has(peer) || requestedPeerStops.has(peer) || permissionChanges.has(peer)) return { ok: false, error: "peer lifecycle or permission change is in progress; wait for ahub status before retrying" };
     requestedPeerStops.add(peer); // fence delivery, starts and recovery before the first asynchronous stop step
     try {
@@ -4210,7 +4772,7 @@ export async function startDaemon(opts: DaemonOptions) {
         operational?.current();
         const reason = `requested stop: ahub stop ${peer}`; // ids only, never task or message text
         // Pi persists a session only after its first message: take live empty-session proof before stopping.
-        if (isPiPeer(owner) && owner.state === "idle") {
+        if (owner.captureResume && owner.state === "idle") {
           try { await owner.captureResume(); }
           catch { log(`requested stop ${peer}: resume evidence unavailable; later start requires verified persisted history`); }
         }
@@ -4219,7 +4781,7 @@ export async function startDaemon(opts: DaemonOptions) {
         await owner.stop(reason);
         writeStatus();
         const state = bus.stateOf(peer);
-        if (state !== "offline" || bus.peers.get(peer) !== owner) return { ok: false, error: "peer stop did not reach offline on its owner; inspect ahub status and its terminal before retrying" };
+        if (state !== "offline" || bus.peers.get(peer) !== owner || isExternalInstance(peer) && owner.pendingOwnedProcess !== false) return { ok: false, error: "peer stop did not reach offline on its owner; inspect ahub status and its terminal before retrying" };
         try { notify(rosterRemoval ? `${peer} stopped for roster removal; add it with ahub roster add ${peer} before starting it again` : `${peer} stopped by ${operational?.actor ?? "the console"}; start it again with ${startCommand(peer)}`); } catch { /* owner stop and readback remain authoritative */ }
         return { ok: true, state };
       });
@@ -4246,31 +4808,35 @@ export async function startDaemon(opts: DaemonOptions) {
     };
   }
 
-  async function startPeerOnce(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }): Promise<Record<string, unknown>> {
+  async function startPeerOnce(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }, startCurrent?: () => void): Promise<Record<string, unknown>> {
+    startCurrent?.();
     let unmute: (() => void) | undefined;
     try {
+      if (isExternalInstance(peer) && bus.peers.get(peer)?.state !== undefined && bus.peers.get(peer)?.state !== "offline" && !currentExecutionOwner(peer)) return { ok: false, error: "external instance owner binding changed; stop the retained owner before starting again" };
       if (declarations[peer] && args.mode !== undefined && args.mode !== "headless") return { ok: false, error: "declared instances support headless starts only" };
       let executionCwd: string;
-      try { executionCwd = resolveInstanceExecutionCwd(opts.cwd, peer, declarations, config.roles[peer] ?? [], adapterCatalog); }
+      try { executionCwd = resolveExecutionCwd(peer, declarations, config.roles[peer] ?? [], adapterCatalog); }
       catch (error) { return { ok: false, error: (error as Error).message }; }
       executionRoots.set(peer, executionCwd);
       applyPendingPermissionDefault(peer);
-      if (definitionOf(peer)?.start.refreshTools) { await ensureSpec(true); await refreshRunner(); }
-      const result = await startPeerBody(peer, args, (p) => { unmute = muteState(p); }, executionCwd);
+      if (definitionOf(peer)?.start.refreshTools) { await ensureSpec(true); startCurrent?.(); await refreshRunner(); startCurrent?.(); }
+      const result = await startPeerBody(peer, args, (p) => { unmute = muteState(p); }, executionCwd, startCurrent);
+      startCurrent?.();
       return result.ok && declarations[peer] ? { ...result, executionCwd } : result;
     } finally {
       unmute?.();
     }
   }
 
-  async function startPeerBody(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }, mute: (p: PeerAdapter) => void, executionCwd: string): Promise<Record<string, unknown>> {
+  async function startPeerBody(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; replaceSession?: boolean; fresh?: boolean; unattended?: boolean; providerProfile?: string }, mute: (p: PeerAdapter) => void, executionCwd: string, startCurrent?: () => void): Promise<Record<string, unknown>> {
+    startCurrent?.();
     const adapter = definitionOf(peer);
     if (adapter && configuredIds.includes(adapter.kind) && args.sessionId !== undefined
       && (typeof args.sessionId !== "string" || !args.sessionId.trim() || Buffer.byteLength(args.sessionId) > 4096 || /[\p{Cc}\p{Cf}]/u.test(args.sessionId))) {
       return { ok: false, error: "configured ACP session selector is invalid" };
     }
     const retainedOwner = bus.peers.get(peer);
-    if (adapter?.permission.genericAcp && isAcpPeer(retainedOwner) && retainedOwner.pendingOwnedProcess && retainedOwner.state === "offline") return { ok: false, error: "configured ACP previous process teardown is unconfirmed; retry ahub stop before starting again" };
+    if ((adapter?.permission.genericAcp || isExternalInstance(peer)) && retainedOwner?.state === "offline" && (isExternalInstance(peer) || "pendingOwnedProcess" in retainedOwner) && retainedOwner.pendingOwnedProcess !== false) return { ok: false, error: "configured ACP previous process teardown is unconfirmed; retry ahub stop before starting again" };
     if (adapter?.permission.genericAcp && (args.model || args.route || args.backend || args.unattended || args.providerProfile || args.sessionFile || args.fresh)) return { ok: false, error: "configured ACP accepts no native launch overrides" };
     if (adapter?.reviewer?.unavailable) return { ok: false, error: adapter.reviewer.unavailable };
     const preflight = adapter?.start.preflight?.({ instance: peer, form: args.mode });
@@ -4315,7 +4881,7 @@ export async function startDaemon(opts: DaemonOptions) {
       recordPiReplacement(nativeStateDir(peer), instanceId, previous, selected);
       args = { ...args, ...selected };
       mute(existing);
-      await stopPiForReplacement(existing);
+      await stopPiForReplacement(existing); startCurrent?.();
     }
     if (isPiPeer(existing) && !args.replaceSession) {
       let saved = existing.recoveryMetadata();
@@ -4332,18 +4898,18 @@ export async function startDaemon(opts: DaemonOptions) {
         // process from the abandoned CLI cannot claim the replacement owner.
         // The replacement's start event is the only state change the console should see (issue #42).
         mute(existing);
-        await stopPiForReplacement(existing);
+        await stopPiForReplacement(existing); startCurrent?.();
       } else if (changesOwner) {
-        saved = await existing.captureResume();
+        saved = await existing.captureResume(); startCurrent?.();
         if (!saved.sessionId) return { ok: false, error: "Pi session identity is not ready for handover" };
         args = { ...args, backend: args.backend ?? launch.backend as "auto" | "dgx" | "mlx", model: args.model ?? (args.backend === undefined && typeof launch.model === "string" ? launch.model : undefined), sessionId: String(saved.sessionId), sessionFile: typeof saved.sessionFile === "string" ? saved.sessionFile : undefined };
         // Same as the unclaimed handover: no offline flash between the adapters (issue #42).
         mute(existing);
-        await stopPiForReplacement(existing);
+        await stopPiForReplacement(existing); startCurrent?.();
       } else if (existing.state !== "offline") {
         return mode === "tui" ? { ok: false, error: "Pi already owns a native terminal; use that terminal or switch to headless first" } : { ok: true, already: true };
       } else if (saved.sessionId) {
-        saved = await existing.captureResume();
+        saved = await existing.captureResume(); startCurrent?.();
         args = { ...args, backend: args.backend ?? launch.backend as "auto" | "dgx" | "mlx", model: args.model ?? (args.backend === undefined && typeof launch.model === "string" ? launch.model : undefined), sessionId: String(saved.sessionId), sessionFile: typeof saved.sessionFile === "string" ? saved.sessionFile : undefined };
       }
     }
@@ -4353,11 +4919,14 @@ export async function startDaemon(opts: DaemonOptions) {
       if (adapter && configuredIds.includes(adapter.kind) && args.sessionId !== undefined && args.sessionId !== adapter.session.currentId(existing)) {
         return { ok: false, error: "configured ACP is already running a different native session; stop it before selecting another" };
       }
-      return { ok: true, already: true, ...(isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(existing) ? { proxyUrl: existing.proxyUrl } : {}) };
+      const proxy = frontendProxyState(peer, existing);
+      if (proxy.present && proxy.port === undefined) return { ok: false, error: "frontend proxy state unknown" };
+      return { ok: true, already: true, ...(proxy.port ? { proxyUrl: proxy.port.url } : {}) };
     }
     if (!adapter?.start.reconfigureWhileAttached) {
       if (isPiPeer(existing)) await stopPiForReplacement(existing);
       else await existing?.stop();
+      startCurrent?.();
     }
     if (adapter?.start.createTui && args.mode === "tui") {
       // #286 Part 3: Qwen's own TUI, driven through its dual-output files. The person's terminal runs it; the hub prepares the files and returns the launch.
@@ -4366,6 +4935,7 @@ export async function startDaemon(opts: DaemonOptions) {
       if (existing && existing.state !== "offline") return { ok: false, error: "Qwen is running headless; run ahub stop qwen before starting its TUI" };
       // The compat entry of the dual-output contract, not the headless ACP entry: 0.26.1 only.
       const verdict = await qwenDualVersionAsync(config.qwen_cmd, executionCwd);
+      startCurrent?.();
       if (!verdict.ok) return { ok: false, error: verdict.reason };
       if (verdict.note) log(verdict.note);
       if (args.sessionId !== undefined && !adapter.session.crashIdentity?.({ sessionId: args.sessionId }).sessionId) return { ok: false, error: "invalid Qwen session identity" };
@@ -4373,6 +4943,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const nativeRoot = nativeStateDir(peer);
       mkdirSync(nativeRoot, { recursive: true });
       const qwenState = join(nativeRoot, "qwen");
+      startCurrent?.();
       const tui: QwenDualPeer = adapter.start.createTui({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["qwen-dual"]({
         cwd: executionCwd, stateDir: qwenState, cmd: config.qwen_cmd, ...(args.model ? { model: args.model } : {}), ...(args.sessionId ? { sessionId: args.sessionId } : {}),
         mcpServers: [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: toolEnv(peer, true) }],
@@ -4387,10 +4958,10 @@ export async function startDaemon(opts: DaemonOptions) {
         onExit: () => { notify(`Qwen's terminal ended; start it again with ahub qwen --mode tui`); writeStatus(); },
         log,
       }) }) as QwenDualPeer;
-      recoveryTaskPreface(peer); await ensurePreface(peer);
+      recoveryTaskPreface(peer); await ensurePreface(peer); startCurrent?.();
       executionOwners.set(peer, { owner: tui, cwd: executionCwd });
       try {
-        await tui.start();
+        startCurrent?.(); await tui.start(); startCurrent?.();
         bus.add(tui);
         if (tui.state !== "offline") tui.onState?.(tui.state);
       } catch (error) { await tui.stop().catch(stop => log(`qwen tui stop after a failed start: ${(stop as Error).message}`)); throw error; }
@@ -4400,6 +4971,7 @@ export async function startDaemon(opts: DaemonOptions) {
       if (!jcodeMcpReady(opts.cwd, opts.stateDir, SERVER_JS)) return { ok: false, error: "Jcode project MCP entry missing or stale; the person runs ahub jcode to configure it" };
       // #691: name a version refusal before the owned daemon starts; the ACP identity check stays the binding one.
       const jcodeVerdict = await jcodeVersionAsync(config.jcode_cmd, executionCwd);
+      startCurrent?.();
       if (!jcodeVerdict.ok) return { ok: false, error: jcodeVerdict.reason };
       if (jcodeVerdict.note) log(jcodeVerdict.note);
       // #685: an extra instance runs its own native home and model fields; the base peer keeps jcode_home and the global provider profile.
@@ -4407,20 +4979,36 @@ export async function startDaemon(opts: DaemonOptions) {
       // #685 scope update 2: the person authenticates inside Jcode against that home. The hub passes -p, -m and --provider-profile as
       // written and reads or writes no credential; the only preflight is that the declared home is a directory the person owns.
       if (instance?.jcode_home) { const refusal = jcodeHomeRefusal(peer, instance.jcode_home); if (refusal) return { ok: false, error: refusal }; }
+      startCurrent?.();
       const jcode: JcodePeer = adapter!.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["owned-acp"]({ peer, command: config.jcode_cmd, home: instance?.jcode_home ?? config.jcode_home,
         providerProfile: (args.providerProfile ?? instance?.provider_profile ?? config.jcode_provider_profile) || undefined,
         ...(instance?.provider ? { provider: instance.provider } : {}),
         ...(args.model ?? instance?.model ? { launchModel: (args.model ?? instance?.model)! } : {}), ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}), cwd: executionCwd, watchdogMs: config.watchdog_ms,
-        preamble: sessionRoleContract(peer), log: () => log("Jcode native diagnostic: details withheld") }) }) as JcodePeer;
+        preamble: sessionRoleContract(peer), log: () => log("Jcode native diagnostic: details withheld"),
+        // #801: Jcode 0.99.1's usage_update is `{ used, size }`, the live session's context occupancy: a context reading bound to the adapter's own session id, never a tokens event
+        // or a quota window. An invalid shape reports a null reading (unknown, not the previous value).
+        onUsageDiagnostic: (observation, sessionId) => {
+          if (observation.source !== "usage_update" || observation.shape !== "context-used") return;
+          const current = contextSession(peer); if (!current) return;
+          const reading = readNativeContext(adapter, { used: observation.contextUsed, size: observation.contextCapacity }, sessionId, Date.now());
+          if (reading) contexts.report(peer, reading, current);
+        },
+        // One prompt's own counters (a sum over its provider calls), recorded as a usage event and never as a running total: `tokens` events and the hub token window stay as they were.
+        onTurnUsage: (usage) => {
+          if (bus.peers.get(peer) !== jcode) return;   // a replaced adapter's late result is not this peer's
+          event({ type: "usage", peer, source: "jcode_acp", id: `jcode:${runId}:${peer}:${++codexUsageSeq}`, inputTokens: usage.inputTokens, outputTokens: usage.outputTokens,
+            ...(usage.cacheReadTokens !== undefined ? { cacheReadTokens: usage.cacheReadTokens } : {}), ...(usage.cacheWriteTokens !== undefined ? { cacheWriteTokens: usage.cacheWriteTokens } : {}), ...taskAttribution(peer) });
+        } }) }) as JcodePeer;
       jcodeLaunches.set(peer, jcode);
-      recoveryTaskPreface(peer); await ensurePreface(peer);
-      try { await jcode.start(); await reconcileNativeStart(peer, jcode); }
+      recoveryTaskPreface(peer); await ensurePreface(peer); startCurrent?.();
+      try { startCurrent?.(); await jcode.start(); startCurrent?.(); await reconcileNativeStart(peer, jcode, startCurrent); }
       catch { await jcode.stop().catch(() => {}); if (jcodeLaunches.get(peer) === jcode) jcodeLaunches.delete(peer); throw new Error("Jcode startup not verified; check native version, provider profile, MCP store and owned daemon (details withheld)"); }
       return { ok: true, policy: "unmanaged" };
     }
     if (adapter?.start.acpCommand) {
       const cmd = adapter.start.acpCommand(config.kimi_cmd, args.model);
       actionBudgets.revoke(peer); // a new owner never inherits the allowance of the one it replaces, even for the same session id
+      startCurrent?.();
       const kimi: AcpPeer = adapter!.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["acp"]({
         onActivity: item => activityRings[peer]?.append(item),
         isPrivateTurn: () => !!turns.get(peer)?.private || contextPii(peer),
@@ -4461,10 +5049,10 @@ export async function startDaemon(opts: DaemonOptions) {
         preamble: sessionRoleContract(peer),
       }) }) as AcpPeer;
       recoveryTaskPreface(peer);
-      await ensurePreface(peer);
+      await ensurePreface(peer); startCurrent?.();
       try {
-        await kimi.start();
-        await reconcileNativeStart(peer, kimi);
+        startCurrent?.(); await kimi.start(); startCurrent?.();
+        await reconcileNativeStart(peer, kimi, startCurrent);
       } catch (error) { await kimi.stop().catch(stop => log(`kimi stop after a failed start: ${(stop as Error).message}`)); throw error; }
       return { ok: true };
     }
@@ -4475,12 +5063,17 @@ export async function startDaemon(opts: DaemonOptions) {
       const mcpServers = [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: Object.entries(toolEnv(peer, true)).map(([name, value]) => ({ name, value })) }];
       const permission = readOnlyPeer(peer) ? "read-only" as const : permissionMode(peer);
       actionBudgets.revoke(peer); // a new owner never inherits the allowance of the one it replaces, even for the same session id
-      const owner = adapter.start.create({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: undefined, permission, mcpServers, daemon: { acp: {
+      const externalBinding = isExternalInstance(peer) ? captureExternalBinding(peer, args.sessionId) : undefined;
+      const externalWorkspace = externalBinding ? externalWorkspaceIdentity(executionCwd) : undefined;
+      if (externalBinding && permission !== "read-only" && defaultSources[peer] && !adapter.permission.genericAcp?.modes?.[permission]) throw new Error("external instance configured permission mode has no native mapping");
+      const externalLaunchId = externalBinding ? randomUUID() : undefined;
+      if (externalLaunchId) for (const server of mcpServers) server.env.push({ name: "AGENTHUB_LAUNCH_ID", value: externalLaunchId });
+      const acpOptions: AcpOptions = {
         onActivity: item => activityRings[peer]?.append(item),
         isPrivateTurn: () => !!turns.get(peer)?.private || contextPii(peer),
         actionGate: acpActionGate(peer),
         kind: adapter.kind, cmd: [launch.cmd, ...launch.args], permissionMode: permission === "read-only" ? "ask" : permission,
-        ...(externalIds.has(adapter.kind) ? { requireOwnedGroup: true, requireLoadSessionEcho: true, nativePolicy: adapter.permission.genericAcp ?? {} } : {}),
+        ...(externalIds.has(adapter.kind) ? { requireOwnedGroup: true, requireLoadSessionEcho: true, nativePolicy: { ...(adapter.permission.genericAcp ?? {}), ...(readOnlyPeer(peer) ? { lockedReadOnly: true } : {}) } } : {}),
         ...(args.model ? { launchModel: args.model } : {}), ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}),
         cwd: executionCwd, watchdogMs: config.watchdog_ms, onPermission,
         autoApprove: title => !externalIds.has(adapter.kind) && !stopping && HUB_TOOL_TITLES.has(title),
@@ -4495,13 +5088,37 @@ export async function startDaemon(opts: DaemonOptions) {
         onTurnFailure: () => { supervisionTurns.delete(peer); },
         mcpServers,
         preamble: sessionRoleContract(peer),
-      } } });
-      if (!isAcpPeer(owner) || owner.id !== peer) throw new Error("ACP factory did not return its bound native transport");
-      recoveryTaskPreface(peer); await ensurePreface(peer);
-      try { await owner.start(); await reconcileNativeStart(peer, owner); }
+      };
+      if (externalBinding) {
+        if (acpOptions.nativePolicy?.modes) Object.freeze(acpOptions.nativePolicy.modes);
+        if (acpOptions.nativePolicy) Object.freeze(acpOptions.nativePolicy);
+        Object.freeze(acpOptions.cmd); for (const server of mcpServers) { server.env.forEach(Object.freeze); Object.freeze(server.env); Object.freeze(server.args); Object.freeze(server); } Object.freeze(mcpServers); Object.freeze(acpOptions);
+        externalInstanceStateDir(opts.stateDir, peer);
+      }
+      startCurrent?.();
+      const owner = adapter.start.create({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, ...(externalBinding ? { instanceStateDir: nativeStateDir(peer) } : {}), kindConfig: undefined, permission, mcpServers, daemon: { acp: acpOptions } });
+      if (externalBinding && externalLaunchId) externalLaunches.set(peer, { owner, options: acpOptions, launchId: externalLaunchId, binding: externalBinding, workspace: externalWorkspace! });
+      assertNativeProofPorts(adapter, owner);
+      if (!isAcpPeer(owner) || owner.id !== peer || owner.deliveryOnly !== true || owner.hubOwned !== true || owner.form !== "headless") throw new Error("ACP factory did not return its bound native transport");
+      recoveryTaskPreface(peer); await ensurePreface(peer); startCurrent?.();
+      try {
+        if (externalBinding && (!membershipAllowed(peer) || externalWorkspaceIdentity(executionCwd) !== externalWorkspace || !sameExternalInstanceBinding(externalBinding, captureExternalBinding(peer, args.sessionId)))) throw new Error("external instance binding changed before native spawn");
+        startCurrent?.(); await owner.start(); startCurrent?.();
+        if (externalBinding) {
+          if (!await verifyManagedAcpLaunch(owner, acpOptions)) throw new Error("external ACP managed launch is unverified");
+          startCurrent?.();
+          const receipt = managedAcpLaunch(owner, acpOptions), current = captureExternalBinding(peer, args.sessionId);
+          if (!receipt || externalWorkspaceIdentity(executionCwd) !== externalWorkspace || receipt.cwd !== executionCwd || !sameExternalInstanceBinding(externalBinding, current)) throw new Error("external instance startup binding changed");
+          externalLaunches.get(peer)!.generation = receipt.generation;
+          externalBindings.set(peer, externalBinding);
+          externalSessions.set(peer, receipt.sessionId);
+          writeExternalInstanceRecord(opts.stateDir, externalBinding, receipt.sessionId);
+        }
+        await reconcileNativeStart(peer, owner, startCurrent);
+      }
       catch (error) {
         await owner.stop().catch(() => log(`${peer}: ACP stop after failed startup was not confirmed`));
-        if (configuredIds.includes(adapter.kind) && owner.pendingOwnedProcess) bus.add(owner); // Retain the failed owner for explicit stop retry; never replace its live child.
+        if (configuredIds.includes(adapter.kind) && (isExternalInstance(peer) ? owner.pendingOwnedProcess !== false : owner.pendingOwnedProcess)) bus.add(owner); // Retain the failed owner for explicit stop retry; never replace its live child.
         if (configuredIds.includes(adapter.kind)) throw new Error(`${peer}: ACP startup identity, session, permission or owned-group verification failed (details withheld)`);
         if (error instanceof QwenIdentityError) throw error;
         throw new Error(`${adapter.displayName} could not reach its provider or complete its startup handshake; verify the provider connection and native CLI${isCompatId(adapter.kind) ? ` (${describe(adapter.kind)})` : ""}; see ahub agents (details withheld)`);
@@ -4512,9 +5129,11 @@ export async function startDaemon(opts: DaemonOptions) {
       if (args.unattended && permissionMode(peer) !== "ask") return { ok: false, error: "Codex --unattended cannot take a non-ask mode; run ahub permission codex ask first, or restart without --unattended" };
       let codexSteering = false;
       actionBudgets.revoke(peer);
+      startCurrent?.();
       const codex: CodexPeer = adapter!.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["codex-appserver"]({
         admitAttach: () => membershipAllowed(peer),
         permissionMode: permissionMode(peer),
+        ...(declarations[peer] ? { threadSandbox: () => isPlannerOnly(config.roles[peer] ?? []) ? declarations[peer]?.worktree ? "unavailable" as const : "read-only" as const : undefined } : {}),
         actionGate: acpActionGate(peer), onPermission,
         onTokens: (added) => void addTokens(peer, added),
         // #683 U1: the same update split into Codex's own kinds, next to the unchanged `tokens` event. One record per update:
@@ -4580,12 +5199,14 @@ export async function startDaemon(opts: DaemonOptions) {
         log,
       }) }) as CodexPeer;
       recoveryTaskPreface(peer);
-      await ensurePreface(peer);
+      await ensurePreface(peer); startCurrent?.();
       try {
-        await codex.start();
-        await reconcileNativeStart(peer, codex);
+        startCurrent?.(); await codex.start(); startCurrent?.();
+        await reconcileNativeStart(peer, codex, startCurrent);
       } catch (error) { await codex.stop().catch(stop => log(`codex stop after a failed start: ${(stop as Error).message}`)); throw error; }
-      return { ok: true, proxyUrl: codex.proxyUrl };
+      const proxy = frontendProxyState(peer, codex);
+      if (proxy.present && proxy.port === undefined) return { ok: false, error: "frontend proxy state unknown" };
+      return { ok: true, ...(proxy.port ? { proxyUrl: proxy.port.url } : {}) };
     }
     if (adapter?.start.daemonPort === "pi-rpc") {
       if (!onRoster(peer)) return { ok: false, error: config.roster.pi === undefined ? "Pi is disabled; set pi.enabled in .agenthub/config.json" : "pi is off roster" };
@@ -4606,6 +5227,7 @@ export async function startDaemon(opts: DaemonOptions) {
         },
       });
       modelRelays.set(peer, modelRelay);
+      startCurrent?.();
       if (!declarations[peer]) globalModelRelay(modelRelay);
       const nativeRoot = nativeStateDir(peer);
       mkdirSync(nativeRoot, { recursive: true });
@@ -4669,6 +5291,7 @@ export async function startDaemon(opts: DaemonOptions) {
         },
       };
       const routing = activeRouting();
+      startCurrent?.();
       const pi: PiPeer = adapter!.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["pi-rpc"]({
         cwd: executionCwd, stateDir: nativeRoot, ...(declarations[peer] ? { hubStateDir: opts.stateDir } : {}), cmd: config.pi.cmd, mode, backend,
         model: args.model,
@@ -4778,11 +5401,11 @@ export async function startDaemon(opts: DaemonOptions) {
         watchdogMs: config.watchdog_ms, maxSteps: config.pi.max_steps, log,
       }) }) as PiPeer;
       recoveryTaskPreface(peer);
-      await ensurePreface(peer);
+      await ensurePreface(peer); startCurrent?.();
       executionOwners.set(peer, { owner: pi, cwd: executionCwd });
       bus.add(pi);
       // The start's own error is the one reported; a stop that fails too is logged beside it (#115).
-      try { await pi.start(); } catch (error) {
+      try { startCurrent?.(); await pi.start(); } catch (error) {
         await pi.stop().catch((stop: Error) => log(`pi stop after a failed start: ${stop.message}`));
         if (error instanceof PiVersionRefusal) return { ok: false, error: sanitize(error.message).slice(0, 1000) };
         throw error;
@@ -4799,9 +5422,10 @@ export async function startDaemon(opts: DaemonOptions) {
       // It stays held; holdPeer validates the restored choice before an operator can resume it.
       if (recoveryActive() && manualPaused.has(peer)) log("local: availability deferred while controlled recovery retains its manual pause");
       else await validateLocalChoice(route, fixedModel);
+      startCurrent?.();
       // Validation can await network: a queued delivery may have started meanwhile.
       if (existing?.state === "busy") return { ok: false, error: "local is busy; retry when it is idle" };
-      if (existing) { mute(existing); await existing.stop(); }
+      if (existing) { mute(existing); await existing.stop(); startCurrent?.(); }
       const capture = config.memory.enabled
         ? new Capture(memory, { project: memoryProject, cwd: executionCwd, deny: config.local.deny })
         : undefined;
@@ -4843,6 +5467,7 @@ export async function startDaemon(opts: DaemonOptions) {
         shellProofs.ordinary(input, current);
         return current() ? true : "aborted";
       };
+      startCurrent?.();
       const local: LocalPeer = adapter!.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["local-worker"]({
         cwd: executionCwd,
         omni,
@@ -4857,7 +5482,11 @@ export async function startDaemon(opts: DaemonOptions) {
         turnId: () => turns.get(peer)?.id,
         onTool: (observation, task) => observeProgress(peer, observation, task),
         fixedModel: args.model ?? routing.local.fixed_model,
-        tools: { deny: config.local.deny, bashNetwork: sandboxNetwork, readAllow: config.local.read_allow, readOnly: config.data?.readonly, permit, shellExecutionCheck: input => shellProofs.check(input) },
+        tools: { deny: config.local.deny, bashNetwork: sandboxNetwork, readAllow: config.local.read_allow, readOnly: config.data?.readonly, permit, shellExecutionCheck: input => shellProofs.check(input),
+          // #515: `doc_read` exists only when the project opted in. The projections are this worker's execution root's (the hub's own facts and review use the same ones).
+          // #515b: `web_fetch` exists only when the project listed a host. A PII turn is refused inside the tool, so the port carries no PII logic of its own.
+          ...(webEgress ? { webFetch: { allow: webAllow, proxyUrl: () => webEgress?.url, ...(opts.webFetchTransport ? { fetch: opts.webFetchTransport } : {}) } } : {}),
+          ...(config.local.doc_read === true ? { docRead: { projections: () => projectionsFor(peer), piiPaths: () => config.pii?.paths ?? [], piiPatterns: () => activeRouting().signals.pii_patterns } } : {}) },
         onApprovalStop: reason => notify(reason),
         ...(capture ? { capture } : {}),
         profile: resolvedProfile,
@@ -4875,24 +5504,25 @@ export async function startDaemon(opts: DaemonOptions) {
         log,
       }) }) as LocalPeer;
       recoveryTaskPreface(peer);
-      await ensurePreface(peer);
+      await ensurePreface(peer); startCurrent?.();
       executionOwners.set(peer, { owner: local, cwd: executionCwd });
       bus.add(local);
-      await local.start();
+      startCurrent?.(); await local.start();
       return { ok: true, model: route ? `${route} (fallback ${routing.local.fixed_model})` : (args.model ?? routing.local.fixed_model) };
     }
     if (adapter?.start.daemonPort === "claude-implementer") {
       if (args.unattended) return { ok: false, error: "Claude implementer refuses unattended permission bypass" };
       const currentRoot = () => {
         const roles = config.roles[peer] ?? [];
-        return !stopping && !recoveryActive() && membershipAllowed(peer) && !contextPii(peer) && roles.includes("implementer") && roles.every(role => role === "implementer" || role === "verifier") && permissionMode(peer) !== "never-ask" && resolveInstanceExecutionCwd(opts.cwd, peer, declarations, roles, adapterCatalog) === executionCwd && executionCwd !== opts.cwd;
+        return !stopping && !recoveryActive() && membershipAllowed(peer) && !contextPii(peer) && roles.includes("implementer") && roles.every(role => role === "implementer" || role === "verifier") && permissionMode(peer) !== "never-ask" && resolveExecutionCwd(peer, declarations, roles, adapterCatalog) === executionCwd && executionCwd !== opts.cwd;
       };
       try { if (!declarations[peer]?.worktree || !currentRoot()) return { ok: false, error: "Claude implementer requires an isolated worktree and ask permissions" }; }
       catch { return { ok: false, error: "Claude implementer execution root unavailable" }; }
       if (existing?.state === "busy") return { ok: false, error: "Claude implementer is busy; cleanup must finish before restart" };
-      if (existing) { mute(existing); await existing.stop(); if (!currentRoot()) throw new Error("Claude implementer startup admission changed"); }
+      if (existing) { mute(existing); await existing.stop(); startCurrent?.(); if (!currentRoot()) throw new Error("Claude implementer startup admission changed"); }
       const selected = permissionMode(peer);
       if (selected !== "ask" && selected !== "ask-when-needed") return { ok: false, error: "Claude implementer refuses never-ask" };
+      startCurrent?.();
       const implementer = adapter.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: selected, mcpServers: [], daemon: DAEMON_PORTS["claude-implementer"]({
         cwd: executionCwd, stateDir: opts.stateDir, projectRoot: opts.cwd, instanceId, server: SERVER_JS,
         factsHook: join(import.meta.dir, "..", "cli", "facts-hook.ts"), systemPrompt: sessionRoleContract(peer), mode: selected, watchdogMs: config.watchdog_ms, ...(declarations[peer]?.model ? { model: declarations[peer].model } : {}),
@@ -4905,6 +5535,25 @@ export async function startDaemon(opts: DaemonOptions) {
           } catch { return false; }
         },
         chatTask: () => implementerChatTask(peer),
+        failureTrace: (launch, nativeVersion) => {
+          const trace = createClaudeFailureTrace({ instanceId, nativeVersion, current: () => {
+            const active = implementer.ownedTools?.(launch.launchId);
+            return bus.peers.get(peer) === implementer && implementerFailures.get(implementer) === entry
+              && active?.generation === launch.generation && active.signal === launch.signal && !launch.signal.aborted;
+          } });
+          const entry: ImplementerFailureEntry = { launchId: launch.launchId, generation: launch.generation, signal: launch.signal, trace, probeCount: 0, permissionAttempt: 0 };
+          implementerFailures.set(implementer, entry);
+          return trace;
+        },
+        failurePrivate: taskId => {
+          try {
+            if (bus.peers.get(peer) !== implementer || !turns.has(peer) || contextPii(peer)) return true;
+            if (taskId === undefined) return false;
+            const task = board.get(taskId);
+            return !task || task.owner !== peer || tasks.isPii(task);
+          } catch { return true; }
+        },
+        failureLog: message => log(message),
         transcriptPersisted: (task, session) => {
           const path = implementerTranscripts.get(`${peer}:${task}:${session}`);
           return path ? pathEvidence(path, lstatSync) : "unknown";
@@ -4917,10 +5566,11 @@ export async function startDaemon(opts: DaemonOptions) {
             ...(total !== undefined ? { totalTokens: total } : {}), ...taskAttribution(peer, task) });
         }, notify,
       }) });
-      await implementer.start();
+      startCurrent?.(); await implementer.start();
       try {
+        startCurrent?.();
         if (!currentRoot()) throw new Error("Claude implementer startup admission changed");
-        recoveryTaskPreface(peer); await ensurePreface(peer);
+        recoveryTaskPreface(peer); await ensurePreface(peer); startCurrent?.();
         if (!currentRoot()) throw new Error("Claude implementer startup admission changed");
         executionOwners.set(peer, { owner: implementer, cwd: executionCwd }); bus.add(implementer);
         return { ok: true };
@@ -4931,8 +5581,9 @@ export async function startDaemon(opts: DaemonOptions) {
       if (!backend || !adapter.start.create) return { ok: false, error: "reviewer has no verified runtime" };
       // #519: each backend proves isolation before admission, then starts one fresh child per review.
       if (existing?.state === "busy") return { ok: false, error: `${peer} is reviewing; retry when it is idle` };
-      if (existing) { mute(existing); await existing.stop(); }
+      if (existing) { mute(existing); await existing.stop(); startCurrent?.(); }
       const reviewPolicies = new Map<string, string>();
+      startCurrent?.();
       const reviewer = adapter.start.create!({ instance: peer, projectRoot: opts.cwd, stateDir: opts.stateDir, kindConfig: config, permission: permissionMode(peer), mcpServers: [], daemon: DAEMON_PORTS["reviewer-print"]({
         backend, cwd: executionCwd,
         mcpConfig: JSON.stringify({ mcpServers: { "agent-hub": { command: process.execPath, args: ["run", SERVER_JS], env: toolEnv(peer, true) } } }),
@@ -4979,9 +5630,10 @@ export async function startDaemon(opts: DaemonOptions) {
         },
         log,
       }) }) as ReviewerPrintPeer;
-      try { await reviewer.start(); }
+      try { startCurrent?.(); await reviewer.start(); startCurrent?.(); }
       catch (error) {
         await reviewer.stop().catch(() => {});
+        startCurrent?.();
         // #691: a version refusal names only versions and the trust command, so it is shown for every backend.
         const reason = error instanceof Error && (backend.nativePolicy || error.message.startsWith(VERSION_REFUSAL)) ? sanitize(error.message).slice(0, 1000)
           : reviewerUnavailableReason(error instanceof ReviewerUnavailableError ? error.causeClass : "unknown", error instanceof ReviewerUnavailableError ? error.detail : undefined);
@@ -5061,11 +5713,12 @@ export async function startDaemon(opts: DaemonOptions) {
     status: () => {
       const quota = budget.status();
       const ids = [...new Set([...bus.knownPeers(), ...Object.keys(quota), ...conductorHolds.list().map(h => h.peer)])];
+      const doing = doingRows(ids);
       return {
         peers: ids.map(peer => {
           const summary = bus.queueSummary(peer);
           return { peer, state: bus.stateOf(peer), attached: !!bus.peers.get(peer) && bus.peers.get(peer)!.state !== "offline", queued: bus.queued(peer), needsReview: summary.needsReview,
-            manualHeld: manualPaused.has(peer), hold: conductorHolds.get(peer), budgetPause: quota[accountOf(peer)]?.paused ?? null,
+            manualHeld: manualPaused.has(peer), hold: conductorHolds.get(peer), budgetPause: quota[accountOf(peer)]?.paused ?? null, doing: doing[peer] ?? null,
             ...(quota[accountOf(peer)] ? { windows: quota[accountOf(peer)]!.windows.map(w => ({ id: w.id, ...(w.stale || (w.resetsAt !== undefined && w.resetsAt <= Date.now()) ? {} : { used: w.used }), resetsAt: w.resetsAt, at: w.at, source: w.source, kind: w.kind, ...(w.superseded ? { superseded: true } : {}) })) } : {}) };
         }),
         taskCounts: board.counts(), approvals: [...permissions.values()].map(p => ({ peer: p.peer, tool: p.tool, at: p.createdAt })),
@@ -5107,6 +5760,7 @@ export async function startDaemon(opts: DaemonOptions) {
     const privateDelivery = originals.some((env) => env.private || publicOnly && env.refs?.task && (()=>{const task=board.get(Number(env.refs!.task));return !task || tasks.isPii(task);})());
     return {
       id: row.id, peer: row.peer, state: row.state, revision: row.revision,
+      ...roomChat.evidence(row.peer, row.id),
       ...(!membershipAllowed(row.peer) ? { rostered: false, holdReason: "off roster" } : {}),
       createdAt: row.createdAt, updatedAt: row.updatedAt,
       envelopeIds: originals.map((env) => env.id),
@@ -5191,7 +5845,7 @@ export async function startDaemon(opts: DaemonOptions) {
       rows: report.rows.map(row => row.private || privatePrs.has(row.pr) ? { private: true, ready: false, tasks: [], after: [], blockers: ["private lifecycle evidence unavailable"] }
         : mixed ? { pr: row.pr, tasks: row.tasks.filter(id => !privateIds.has(id)), ready: false, after: [], blockers: ["private dependency evidence unavailable"] }
         : { pr: row.pr, tasks: row.tasks, head: row.head, ready: row.ready, blockers: row.blockers, after: row.after,
-          ...(row.findings ? { findings: row.findings } : {}), ...(row.planConformance ? { planConformance: row.planConformance } : {}), ...(row.testIntegrity ? { testIntegrity: row.testIntegrity } : {}) }),
+          ...(row.findings ? { findings: row.findings } : {}), ...(row.planConformance ? { planConformance: row.planConformance } : {}), ...(row.testIntegrity ? { testIntegrity: row.testIntegrity } : {}), ...(row.evalGate ? { evalGate: row.evalGate } : {}) }),
       order: mixed ? [] : report.order, ...(report.unordered ? { unordered: mixed ? [] : report.unordered } : {}), conflicts: mixed ? [] : report.conflicts });
   }
   /** A public read may use host GitHub authentication only for this project's current public scope. */
@@ -5203,14 +5857,23 @@ export async function startDaemon(opts: DaemonOptions) {
       || githubOriginRepository(opts.cwd) === identity;
   }
   const publicReadPrivacy = () => JSON.stringify(board.list().map(task => [task.id, tasks.isPii(task), task.history.length]));
-  function operationalCurrent(sock:Sock,acceptedAfterClose=false):()=>void {
+  function operationalCurrent(sock:Sock,acceptedAfterClose=false,committedRecovery=false):()=>void {
     const client=sock.data,peer=client.peer;
     return ()=>{
-      if(!peer || sock.data!==client || client.role!=="tools" || !acceptedAfterClose && sock.readyState!==WebSocket.OPEN || client.toolsOwner || readOnlyPeer(peer) || stopping || !membershipAllowed(peer) || contextPii(peer))throw new OperationalAuthorityError("operational conductor authority unavailable");
+      if(!peer || sock.data!==client || client.role!=="tools" || !acceptedAfterClose && sock.readyState!==WebSocket.OPEN || client.toolsOwner || readOnlyPeer(peer) || stopping && !committedRecovery || !membershipAllowed(peer) || contextPii(peer))throw new OperationalAuthorityError("operational conductor authority unavailable");
       try {requireConductor(peer,config.roles);}
       catch {throw new OperationalAuthorityError("this operation requires the explicit conductor role","conductor");}
     };
   }
+  function currentRecoveryPolicy(peer: string) {
+    const inputs = readRecoveryPolicyInputs(opts.cwd, runningRoutingDefault);
+    const candidate = loadConfig(opts.cwd, inputs.layers, inputs.routing.retired ?? [], []);
+    assertRecoverySourceInputs(acceptedSources.trustLayers, inputs);
+    // Compare accepted declarations; config.roles also contains the settled planner projection.
+    assertRecoveryConfiguration({ ...config, roles: policyRoles }, candidate);
+    assertRecoveryRouting(activeRouting(), inputs.routing);
+    return captureRecoveryPolicy({ root: opts.cwd, id: projectId, stateDir: opts.stateDir }, peer, candidate, inputs);
+  }
   function admitOperational(sock:Sock,command:string):()=>void {
     const current=operationalCurrent(sock);current();
     if(!event({type:"agent_cli",peer:sock.data.peer!,command,refused:false}))throw new Error("CLI audit event was not retained");
@@ -5301,7 +5964,7 @@ export async function startDaemon(opts: DaemonOptions) {
         return ta && tb && CONFLICT_STATES.includes(ta.state) && CONFLICT_STATES.includes(tb.state) ? [{ kind: "conflict" as const, tasks: conflict.tasks, peers: conflict.peers }] : [];
       }),
     ];
-    const attentionStatus = status(false, true);
+    const attentionStatus = status(false, true, true);
     let pet; try { const config = loadPetConfig(opts.cwd); pet = { enabled: config.enabled, character: config.character ?? "stai", blink: config.blink }; } catch { pet = { enabled: false }; }
     const peerView = Object.fromEntries(Object.entries(attentionStatus.peers).map(([id, peer]) => [id, { ...peer, ...turnView(id as PeerId) }])), boardTasks = board.list();
     const usageView = (open: boolean) => {
@@ -5346,11 +6009,14 @@ export async function startDaemon(opts: DaemonOptions) {
       projectId,
       instanceId,
       attention: attentionStatus.attentionInput,
+      rooms: attentionStatus.rooms,
       pet,
-      status: { peers: peerView, pendingRestart: allPendingRestart(), retainedConfig, taskWip: attentionStatus.taskWip, roleInfo: attentionStatus.roleInfo },
+      status: { peers: peerView, pendingRestart: allPendingRestart(), retainedConfig, taskWip: attentionStatus.taskWip, roleInfo: attentionStatus.roleInfo, ownerIsolation: attentionStatus.ownerIsolation, ownerIsolationNotes: attentionStatus.ownerIsolationNotes },
       boardCapabilities: { backlog: true },
       planningCapabilities: { enabled: true, wipPull: true, split: true },
       releases: tasks.releaseList(USER),
+      // #335: each schedule's next run, ids and times only (a title or detail is task text). Absent when none is configured, so an older page and an unconfigured project see no change.
+      ...(config.schedules.length ? { schedules: scheduleViews(config.schedules, schedulesStore.rows(), scheduleNow(), tasks.openScheduled(), tasks.schedulesHeld() || opts.schedulesHeld?.() === true) } : {}),
       boardLegend: Object.entries(peerView).map(([id, peer]) => ({
         peer: id, state: peer.state,
         permissionMode: "permissionNote" in peer && peer.permissionNote ? "unmanaged" : permissionDisplay(id, bus.peers.get(id)),
@@ -5361,7 +6027,7 @@ export async function startDaemon(opts: DaemonOptions) {
       tasks: boardTasks.map((task) => {
         const view = tasks.publicView(task);
         // Refs and history can themselves quote private text. The dashboard needs neither.
-        return { id: task.id, title: view.title, detail: view.detail, class: task.class, ...(task.profile ? { profile: task.profile, profileClass: task.profileClass } : {}), ...(task.role ? { role: task.role } : {}), state: task.state, owner: task.owner, reviewer: task.reviewer, deps: view.deps ?? [], ...(task.reserved ? { reserved: task.reserved } : {}), planningRevision: task.planningRevision ?? 0, rank: task.rank ?? null, priority: task.priority ?? null, release: task.release ?? null, plannedStart: task.plannedStart ?? null, due: task.due ?? null, pinned: task.pinned === true, actualDates: view.actualDates, ...(view.codeSymbols ? { codeSymbols: view.codeSymbols } : {}), ...(() => { const group = codeGroup(task, view.codeSymbols, task.plan?.symbols, tasks.publicMetadataText, tasks.isPii(task)); return group ? { codeGroup: group } : {}; })(), ...(view.cancelled ? { cancelled: view.cancelled } : {}), ...(view.external ? { external: view.external } : {}), started: taskHasStarted(task), urgent: task.signals.includes("urgent"), updated: task.updated, reworkRound: task.history.filter(entry => entry.event === "changes_requested").length, checking: tasks.isChecking(task.id), ...(view.lifecycle ? { lifecycle: view.lifecycle } : {}), ...(() => { const deliverables = tasks.deliverableBadge(task); return deliverables ? { deliverables } : {}; })() };
+        return { id: task.id, title: view.title, detail: view.detail, class: task.class, ...(task.profile ? { profile: task.profile, profileClass: task.profileClass } : {}), ...(task.role ? { role: task.role } : {}), state: task.state, owner: task.owner, planner: view.planner ?? null, reviewer: task.reviewer, ...holderReasons(view), deps: view.deps ?? [], ...(task.reserved ? { reserved: task.reserved } : {}), planningRevision: task.planningRevision ?? 0, rank: task.rank ?? null, priority: task.priority ?? null, release: task.release ?? null, plannedStart: task.plannedStart ?? null, due: task.due ?? null, pinned: task.pinned === true, actualDates: view.actualDates, ...(view.codeSymbols ? { codeSymbols: view.codeSymbols } : {}), ...(() => { const group = codeGroup(task, view.codeSymbols, task.plan?.symbols, tasks.publicMetadataText, tasks.isPii(task)); return group ? { codeGroup: group } : {}; })(), ...(view.cancelled ? { cancelled: view.cancelled } : {}), ...(view.external ? { external: view.external } : {}), started: taskHasStarted(task), urgent: task.signals.includes("urgent"), updated: task.updated, reworkRound: task.history.filter(entry => entry.event === "changes_requested").length, checking: tasks.isChecking(task.id), ...(view.lifecycle ? { lifecycle: view.lifecycle } : {}), ...(() => { const deliverables = tasks.deliverableBadge(task); return deliverables ? { deliverables } : {}; })() };
       }),
       links: links.filter(link => link.tasks.every(id => { const task = board.get(id); return task && !tasks.isPii(task); })),
       budget: Object.fromEntries(peers.map((id) => [id, { ...(quota[accountOf(id)] ?? { windows: [] }), ...(budgetNoteOf.get(id) ? { note: budgetNoteOf.get(id)!.note, noteKind: budgetNoteOf.get(id)!.kind } : {}), context: contexts.view(id, contextSession(id), bus.peers.has(id) && ["idle", "busy", "paused"].includes(bus.stateOf(id))) }])),
@@ -5544,6 +6210,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const raw = valueAt(next, path.split("."));
         const winning = [...sources.trustLayers].reverse().find(source => source.name.endsWith(name.endsWith(".toml") ? ".toml" : ".json") && valueAt(source.raw, path.split(".")) !== undefined);
         if (raw !== undefined && winning?.name !== name) continue; // a shadowed edit was never authorized by its no-op effective value
+        if (raw === undefined && valueAt(layer.raw, path.split(".")) === undefined) continue;
         putConfig(layer.raw, path, raw);
       }
     }
@@ -5553,7 +6220,7 @@ export async function startDaemon(opts: DaemonOptions) {
     const texts = configSourceTexts(opts.cwd), next = configSourceTexts(scratch);
     texts["config.json"] = next["config.json"];
     texts["config.local.json"] = next["config.local.json"];
-    const prepared = prepareConfiguration(parseConfigSources(texts, undefined, opts.cwd, externalAdapters), authority, scope);
+    const prepared = prepareConfiguration(parseConfigSources(texts, undefined, opts.cwd, externalAdapters, externalDefinitions), authority, scope);
     const refusal = prepared.rejected.find(item => item.key === scope);
     if (refusal) throw new Error(`${refusal.key}: ${refusal.reason}`);
     return prepared.fileConfig;
@@ -5561,7 +6228,7 @@ export async function startDaemon(opts: DaemonOptions) {
   function routingWriteCheck(authority: SettingAuthority, overlay: import("./routing.ts").RoutingOverlay | undefined, scope?: string): void {
     const texts = configSourceTexts(opts.cwd);
     texts["routing.local.toml"] = overlay === undefined ? null : overlayToml(overlay);
-    const prepared = prepareConfiguration(parseConfigSources(texts, undefined, opts.cwd, externalAdapters), authority, scope);
+    const prepared = prepareConfiguration(parseConfigSources(texts, undefined, opts.cwd, externalAdapters, externalDefinitions), authority, scope);
     const refusal = prepared.rejected.find(item => item.key === scope);
     if (refusal) throw new Error(`${refusal.key}: ${refusal.reason}`);
   }
@@ -5579,7 +6246,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const texts = configSourceTexts(opts.cwd);
       fingerprint = configFingerprint(texts);
       if (confirm !== undefined && (typeof confirm !== "string" || authority !== "terminal" || scope || !reloadConfirmation || reloadConfirmation.token !== confirm || reloadConfirmation.fingerprint !== fingerprint || reloadConfirmation.revision !== configRevision)) return { ok: false, error: "configuration confirmation is stale or changed; run ahub settings reload again" };
-      const sources = parseConfigSources(texts, undefined, opts.cwd, externalAdapters);
+      const sources = parseConfigSources(texts, undefined, opts.cwd, externalAdapters, externalDefinitions);
       const prepared = prepareConfiguration(sources, authority, scope, confirm === undefined ? [] : reloadConfirmation!.keys);
       if (confirm !== undefined && prepared.rejected.some(item => reloadConfirmation!.keys.includes(item.key))) return { ok: false, error: "configuration trust changed; run ahub settings reload again" };
       if (scope && prepared.rejected.some(item => item.key === scope)) return { ok: false, error: prepared.rejected.find(item => item.key === scope)!.reason };
@@ -5605,6 +6272,7 @@ export async function startDaemon(opts: DaemonOptions) {
       config.permission_default_sources = candidate.permission_default_sources;
       for (const peer of changedPermissionDefaults) applyPendingPermissionDefault(peer);
       if (changes.some(change => change.key === "task_sweep" || change.key.startsWith("task_sweep."))) rescheduleSweep();
+      if (changes.some(change => change.key === "schedules" || change.key.startsWith("schedules.") || change.key === "folder_triggers" || change.key.startsWith("folder_triggers."))) rescheduleSchedules();
       if (changes.some(change => ["batch_max", "batch_ms", "queue_cap"].includes(change.key))) bus.configureScheduling({ batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap });
       if (changes.some(change => change.key === "watchdog_ms")) for (const peer of bus.peers.values()) if (peer instanceof BasePeer) peer.configureWatchdog(config.watchdog_ms);
       Object.assign(limits, config.limits);
@@ -5614,6 +6282,7 @@ export async function startDaemon(opts: DaemonOptions) {
       desiredRouting = structuredClone(prepared.routing);
       acknowledgeConfiguration(sources, prepared.accepted);
       if (priorDesired !== JSON.stringify([desiredConfig, desiredRouting, acceptedSources.trustLayers])) configRevision++;
+      if (ready && changes.some(change => change.key === "tasks.queue_backpressure" || change.key.startsWith("tasks.queue_backpressure."))) tasks.scheduleQueuePressureRecheck();
       pendingRestart = configChanges({ ...config, roles: policyRoles }, candidate, [{ catalog: adapterCatalog, instances: declarations }, configIdentityScope(acceptedSources.identity), configIdentityScope(sources.identity)]).filter(change => change.applies === "restart").map(change => ({ key: change.key, reason: change.reason! }));
       pendingRestart.push(...routingChanges.filter(key => configApply(key).applies === "restart").map(key => ({ key, reason: configApply(key).reason! })));
       retainedConfig = retainedConfigAfterReload(sources, prepared.fileConfig, prepared.rejected, scope);
@@ -5711,13 +6380,13 @@ export async function startDaemon(opts: DaemonOptions) {
     return undefined;
   }
   function codexResumeCommand(peer: string): string {
-    const owner = bus.peers.get(peer), thread = isCodexPeer(owner) ? owner.thread || lastCodexThreads.get(peer) : lastCodexThreads.get(peer);
+    const owner = bus.peers.get(peer), thread = owner?.nativeSession ?? lastCodexThreads.get(peer);
     const command = declarations[peer] ? `ahub codex --as ${peer} resume` : "ahub codex resume";
     return thread && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(thread) ? `${command} ${thread}` : command;
   }
   function retainedTerminalNotice(peer: string): string | undefined {
     const owner = bus.peers.get(peer);
-    return definitionOf(peer)?.cli.retainedTerminalNotice?.(peer, isPiPeer(owner) ? owner.mode : undefined, codexResumeCommand(peer));
+    return definitionOf(peer)?.cli.retainedTerminalNotice?.(peer, owner?.form, codexResumeCommand(peer));
   }
 
   async function changeRosterSetting(def: SettingDef, value: SettingValue, source: SettingSource, confirm: unknown, now: boolean, undo = false, authority: SettingAuthority = "ordinary", reason?: string, undoIdentity?: UndoIdentity): Promise<Record<string, unknown>> {
@@ -5749,10 +6418,11 @@ export async function startDaemon(opts: DaemonOptions) {
       if (!after) {
         for (const pending of permissions.values()) if (pending.peer === peer) pending.done(undefined);
         const owner = bus.peers.get(peer);
-        if (isWsPeer(owner)) { owner.detachForRoster(); if (definitionOf(peer)?.attach?.admission) clearKimiAdmission(); }
-        else if (isCodexPeer(owner)) owner.detachForRoster(config.permission_modes[peer] === "never-ask" ? "ask" : config.permission_modes[peer] ?? "ask");
-        else if (isPiPeer(owner) && owner.mode === "tui") await owner.detachForRoster();
-        else if (owner && owner.state !== "offline") {
+        if (owner?.detachForRoster && owner.form !== "headless") {
+          await owner.detachForRoster(config.permission_modes[peer] === "never-ask" ? "ask" : config.permission_modes[peer] ?? "ask");
+          if (definitionOf(peer)?.attach?.admission) clearKimiAdmission();
+        }
+        else if (owner && (owner.state !== "offline" || isExternalInstance(peer) && owner.pendingOwnedProcess !== false)) {
           const result = await stopPeer(peer, true, authority==="conductor"?operationalContext.getStore():undefined);
           if (result.ok !== true) throw new Error(`roster saved; ${peer} stop is unconfirmed; permission reset and task handoff were not attempted; inspect ahub status and reapply ${def.key} false to retry`);
         }
@@ -5766,7 +6436,7 @@ export async function startDaemon(opts: DaemonOptions) {
         handoff = await tasks.reassignForRoster(peer, handoffCurrent);
       } else {
         const owner = bus.peers.get(peer);
-        if (isPiPeer(owner) && owner.mode === "tui") await owner.resumeFromRoster();
+        if (owner?.form !== "headless") await owner?.resumeFromRoster?.();
       }
       checkOperational(authority);
       const reloaded = await reloadConfig(authority, `roster.${peer}`);
@@ -5940,7 +6610,7 @@ export async function startDaemon(opts: DaemonOptions) {
       if (file !== "config.local.json") return;
       const texts = configSourceTexts(opts.cwd);
       texts["config.local.json"] = text;
-      const sources = parseConfigSources(texts, undefined, opts.cwd, externalAdapters);
+      const sources = parseConfigSources(texts, undefined, opts.cwd, externalAdapters, externalDefinitions);
       const candidate = loadConfig(opts.cwd, sources.layers, sources.routing.retired ?? [], externalDefinitions);
       // Bounds and kinds are the raw-config check parseConfigSources just ran; the effective merge below is loadConfig itself.
       checkJcodeInstanceHomes(sources.identity.instances, candidate.jcode_home);
@@ -6041,7 +6711,7 @@ export async function startDaemon(opts: DaemonOptions) {
       case "start_peer": {
         // #269: the hub's own start of a peer from the closed list, in the mode a person set. No argument reaches a command.
         if (!peer()) return bad;
-        const result = await hubStart(a.peer, "the dashboard");
+        const result = await hubStart(a.peer, "the dashboard", session?.liveTest !== true);
         if (result.ok === true) return { ok: true, text: result.already ? `${a.peer} is already attached.` : result.opened ? `Opened a terminal running ${result.command}; ${a.peer} attaches when its TUI is ready.` : `${a.peer} started (headless).${watchSentence(result.watch)}` };
         // A refusal the hub worded itself carries the command to run by hand; an adapter's own failure text stays in the log.
         if (typeof result.command === "string" || typeof a.peer === "string" && !membershipAllowed(a.peer)) return { ok: false, error: sanitize(String(result.error)) };
@@ -6066,6 +6736,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
   }
 
+  const recoverySessionDigest = (id: string | undefined) => id === undefined ? undefined : createHash("sha256").update(id).digest("hex");
   const recoveryView = () => ({
     operationId: recoveryOperationId,
     phase: recoveryPhase,
@@ -6075,25 +6746,33 @@ export async function startDaemon(opts: DaemonOptions) {
     blockers: [
       ...(starting.size ? ["peer startup in progress"] : []),
       ...(!budget.recoverySettled ? ["budget transition in progress"] : []),
-      ...([...bus.peers].filter(([, peer]) => peer.state === "busy").map(([id]) => `${id} is busy`)),
+      ...([...bus.peers].filter(([id, peer]) => !id.includes("@") && peer.state === "busy").map(([id]) => `${id} is busy`)),
       ...(permissions.size ? ["pending approvals"] : []),
       // #272: the rest of what recoveryReady() waits for, so the upgrade screen can name the wait. Display only.
       ...(taskOpsInFlight !== 0 ? ["a task command in flight"] : []),
       ...(tasks.checksPending() !== 0 ? ["completion checks queued or running"] : []),
+      ...(tasks.autoPullsPending() !== 0 ? ["an automatic backlog pull in flight"] : []),
+      ...(tasks.queuePressureRechecksPending() !== 0 ? ["a queue-pressure assignment recheck in flight"] : []),
+      ...(tasks.schedulesPending() !== 0 ? ["a scheduled task proposal in flight"] : []),
       ...(checkPending.size !== 0 ? ["isolated checks queued or running"] : []),
       ...(piCallsInFlight() !== 0 ? ["Pi tool calls in flight"] : []),
       ...(releasing ? ["ready tasks being released"] : []),
-      ...([...bus.peers].filter(([, peer]) => isPiPeer(peer) && peer.state !== "busy" && !peer.recoveryReady).map(([id, peer]) => !membershipAllowed(id) && isPiPeer(peer) && peer.mode === "tui" ? `${id} is not settled; end the retained Pi TUI, then prepare again` : `${id} is not settled`)),
+      ...([...bus.peers].filter(([id, peer]) => !id.includes("@") && peer.state !== "busy" && "recoveryReady" in peer && peer.recoveryReady !== true).map(([id, peer]) => !membershipAllowed(id) && peer.form === "tui" ? `${id} is not settled; end the retained ${definitionOf(id)?.displayName ?? id} TUI, then prepare again` : `${id} is not settled`)),
     ],
     integrity: { current: integrityAs(restored?.integrity), ...(restored?.integrity ? { expected: restored.integrity } : {}) },
     peers: Object.fromEntries([...(recoveryPeerSnapshot ?? []), ...Object.values(recoveryPeers()).filter((peer) => !(recoveryPeerSnapshot ?? []).some((saved) => saved.id === peer.id))].map((peer) => {
       const now = recoveryPeers()[peer.id];
-      if (recoveryPhase === "restored" || recoveryPhase === "released") return [peer.id, now ?? { id: peer.id, state: "offline", queueIds: bus.queueIds(peer.id) }];
-      return [peer.id, now ? { ...peer, ...now, queueIds: now.queueIds } : peer];
+      const owner = bus.peers.get(peer.id), definition = definitionOf(peer.id);
+      const observation = definition?.transport === "claude-channel" && isWsPeer(owner)
+        ? { kind: definition.kind, attached: owner.attached, ...(now?.sessionId === undefined ? {} : { sessionDigest: recoverySessionDigest(now.sessionId) }) } : undefined;
+      const visible = recoveryPhase === "restored" || recoveryPhase === "released" ? now ?? { id: peer.id, state: "offline", queueIds: bus.queueIds(peer.id) }
+        : now ? { ...peer, ...now, queueIds: now.queueIds } : peer;
+      return [peer.id, { ...visible, ...(observation === undefined ? {} : { observation }) }];
     })),
   });
   const recoveryError = (error: string) => ({ t: "recovery", ok: false, error });
-  async function recoveryOp(msg: any): Promise<Record<string, unknown>> {
+  async function recoveryOp(msg: any, checkCurrent: () => void = () => {}): Promise<Record<string, unknown>> {
+    checkCurrent();
     if (typeof msg.op !== "string" || !["inspect", "prepare", "commit", "abort", "release"].includes(msg.op)) return recoveryError("unknown recovery operation");
     if (typeof msg.expectedInstanceId !== "string" || msg.expectedInstanceId !== instanceId) return recoveryError("expected daemon instance does not match");
     const incompatibleCancellationTarget = () => {
@@ -6102,6 +6781,9 @@ export async function startDaemon(opts: DaemonOptions) {
         ? `target lacks task_cancel; cancelled tasks: ${ids.map(id => `#${id}`).join(", ")}` : undefined;
     };
     const incompatibleRecoveryTarget = () => {
+      if (board.hasConductorManualState() && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("conductor_recovery"))) return "target lacks conductor_recovery; open conductor manual-assignment intent cannot be preserved";
+      if (allExternalInstanceIds().length && (!Array.isArray(msg.targetFeatures) || !["external_adapter_instances", "external_adapter_modules", "peer_instances"].every(feature => msg.targetFeatures.includes(feature)))) return "target lacks external_adapter_instances or its module/instance prerequisites";
+      if (!(msg.op === "inspect" && recoveryPhase === "restored")) for (const id of allExternalInstanceIds()) if (!retainedExternalBinding(id, true)) return "external instance retained binding changed or unavailable";
       const cancelled = incompatibleCancellationTarget();
       if (cancelled) return cancelled;
       if (externalIds.size && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("external_adapter_modules"))) return "target lacks external_adapter_modules; verified external definitions cannot be preserved by that daemon";
@@ -6120,8 +6802,9 @@ export async function startDaemon(opts: DaemonOptions) {
     }
 
     if (msg.op === "inspect" || msg.op === "prepare" || msg.op === "commit") {
-      for (const pi of bus.peers.values()) if (isPiPeer(pi) && pi.state === "idle") {
-        try { await pi.captureResume(); } catch (error) { return recoveryError((error as Error).message); }
+      for (const [id, peer] of bus.peers) if (isExternalInstance(id) && (peer.state !== "offline" || peer.pendingOwnedProcess !== false)) return recoveryError("external module has no verified controlled-recovery driver; stop it explicitly and restart with its recorded native session id");
+      for (const peer of bus.peers.values()) if (peer.captureResume && peer.state === "idle") {
+        try { await peer.captureResume(); checkCurrent(); } catch (error) { return recoveryError((error as Error).message); }
         if (checkTarget) { const error = incompatibleRecoveryTarget(); if (error) return recoveryError(error); }
       }
     }
@@ -6146,8 +6829,9 @@ export async function startDaemon(opts: DaemonOptions) {
       budget.setRecoveryHold(true);
       bus.setRecoveryHold(true, Array.isArray(msg.targetFeatures) && msg.targetFeatures.includes("recovery_deferred_hub"));
       await bus.fenceRecovery();
+      checkCurrent();
       { const error = incompatibleRecoveryTarget(); if (error) return recoveryError(error); }
-      const blocked = [...bus.peers].filter(([, peer]) => peer.state === "busy").map(([id]) => id);
+      const blocked = [...bus.peers].filter(([id, peer]) => !id.includes("@") && peer.state === "busy").map(([id]) => id);
       if (!blocked.length && permissions.size === 0 && recoveryReady()) {
         recoveryPeerSnapshot ??= Object.values(recoveryPeers());
         recoveryPhase = "prepared";
@@ -6167,7 +6851,7 @@ export async function startDaemon(opts: DaemonOptions) {
       recoveryPhase = undefined;
       recoveryPeerSnapshot = undefined;
       clearTimeout(recoveryLeaseTimer);
-      budget.setRecoveryHold(false);
+      budget.setRecoveryHold(false); tasks.scheduleQueuePressureRecheck();
       writeStatus();
       return { t: "recovery", ok: true, aborted: true, recovery: recoveryView() };
     }
@@ -6207,11 +6891,12 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     if (msg.op === "release") {
       if (recoveryPhase === "released") {
-        bus.setRecoveryHold(false); budget.setRecoveryHold(false);
+        bus.setRecoveryHold(false); budget.setRecoveryHold(false); tasks.scheduleQueuePressureRecheck();
         return { t: "recovery", ok: true, released: true, recovery: recoveryView() };
       }
       if (recoveryPhase !== "restored") return recoveryError("recovery is not restored");
       await bus.fenceRecovery();
+      checkCurrent();
       const current = recoveryPeers();
       const missing = (recoveryPeerSnapshot ?? []).filter((saved) => saved.state !== "offline" && !manualPaused.has(saved.id) && !budget.record(saved.id) && (!current[saved.id] || current[saved.id]!.state === "offline"));
       if (missing.length) return recoveryError(`required peers are not attached: ${missing.map((peer) => peer.id).join(", ")}`);
@@ -6223,30 +6908,28 @@ export async function startDaemon(opts: DaemonOptions) {
       recoveryPhase = "released";
       clearTimeout(recoveryLeaseTimer);
       bus.setRecoveryHold(false);
-      budget.setRecoveryHold(false);
+      budget.setRecoveryHold(false); tasks.scheduleQueuePressureRecheck();
       writeStatus();
       return { t: "recovery", ok: true, released: true, recovery: recoveryView() };
     }
     return recoveryError("unknown recovery operation");
   }
 
-  function claudePermissionLaunch(peer: string): { launchId: string; unattended: boolean; hookPurpose?: string } | undefined {
-    if (!isFixedBuiltinDefinition(definitionOf(peer))) return undefined;
-    const row = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
-    return row?.permissionHook ? row : undefined;
-  }
   async function changePermission(peer: unknown, mode: unknown, confirmed: unknown): Promise<Record<string, unknown>> {
     if (!isSupportedPeer(peer)) return { ok: false, error: "unknown permission peer" };
     if (readOnlyPeer(peer)) return { ok: false, error: "read-only ceiling is locked for this instance" };
     if (definitionOf(peer)?.permission.unmanaged) return { ok: false, error: definitionOf(peer)!.permission.unmanaged };
-    if (definitionOf(peer)?.permission.unmanagedForms?.includes("tui") && (isWsPeer(bus.peers.get(peer)) || (!bus.peers.has(peer) && startMode(peer) === "tui"))) return { ok: false, error: definitionOf(peer)!.permission.unmanagedNote };
-    if (requestedPeerStops.has(peer)) return { ok: false, error: "peer stop is in progress; wait for ahub status before changing its mode" };
     const owner = bus.peers.get(peer);
+    const unmanagedForm = owner ? owner.form === "tui" || "form" in owner && owner.form === undefined : startMode(peer) === "tui";
+    if (definitionOf(peer)?.permission.unmanagedForms?.includes("tui") && unmanagedForm) return { ok: false, error: definitionOf(peer)!.permission.unmanagedNote };
+    if (requestedPeerStops.has(peer)) return { ok: false, error: "peer stop is in progress; wait for ahub status before changing its mode" };
+    const proxy = frontendProxyState(peer, owner);
+    if (proxy.present && proxy.port === undefined) return { ok: false, error: "frontend proxy state unknown" };
     if (mode === "ask" && (!owner || owner.state === "offline")) {
       // A Codex proxy outlives its TUI and keeps its own copy of the mode: clear that too, or the next TUI that attaches
       // to it would run a mode the status no longer shows.
       // It is never refused here: a leftover non-ask mode must always be undoable while the peer is away.
-      const note = isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && !owner.clearPermissionMode() ? "The detached session's own approval policy was never reported, so its thread keeps what it last got; a new ahub codex session starts in ask" : undefined;
+      const note = proxy.port && !proxy.port.clearPermissionMode() ? "The detached session's own approval policy was never reported, so its thread keeps what it last got; a new ahub codex session starts in ask" : undefined;
       if (note) log(`permission mode codex: ${note}`);
       const from = permissionMode(peer);
       permissionModes.set(peer, "ask"); permissionModeSources.set(peer, "human runtime command"); pendingPermissionDefaults.delete(peer);
@@ -6254,17 +6937,17 @@ export async function startDaemon(opts: DaemonOptions) {
       log(`permission mode ${peer}: ${from} -> ask (offline hub choice cleared)`); writeStatus();
       return { ok: true, peer, permissionMode: "ask", ...(note ? { note } : {}) };
     }
-    if (isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && !owner.proxyAttached) return { ok: false, error: "Codex TUI is not behind the hub proxy; reconnect with ahub codex" };
+    if (proxy.port && !proxy.port.attached) return { ok: false, error: "Codex TUI is not behind the hub proxy; reconnect with ahub codex" };
     if (!owner || owner.state === "offline") return { ok: false, error: `${peer} is not attached; start it through ahub first` };
     if (mode === undefined) return { ok: true, peer, permissionMode: permissionDisplay(peer, owner) };
     if (!isPermissionMode(mode)) return { ok: false, error: "mode must be ask, ask-when-needed or never-ask" };
     if (mode === "never-ask" && confirmed !== true) return { ok: false, error: "never-ask needs --yes or console confirmation" };
     if (definitionOf(peer)?.transport === "claude-channel") {
-      const launch = claudePermissionLaunch(peer);
-      if (!launch || !isWsPeer(owner) || claudePermissionGenerations.get(peer) !== owner.sessionGeneration) return { ok: false, error: "Claude has no verified ahub claude permission hook; restart with ahub claude and run a tool first" };
+      const launch = claudeLaunchProof.permissionLaunch(peer);
+      if (!launch || claudeLaunchProof.owner(peer) !== owner || !claudeLaunchProof.verified(peer)) return { ok: false, error: "Claude has no verified ahub claude permission hook; restart with ahub claude and run a tool first" };
       if (launch.unattended) return { ok: false, error: "Claude started --unattended already skips prompts; run ahub permission claude ask after it stops to clear the hub choice, then restart without --unattended" };
-    } else if (isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner)) {
-      if (!owner.proxyAttached) return { ok: false, error: "Codex TUI is not behind the hub proxy; reconnect with ahub codex" };
+    } else if (proxy.port) {
+      if (!proxy.port.attached) return { ok: false, error: "Codex TUI is not behind the hub proxy; reconnect with ahub codex" };
       if (nativeUnattended(peer)) return { ok: false, error: "Codex started --unattended already skips prompts; run ahub permission codex ask after it stops to clear the hub choice, then restart without --unattended" };
     }
     const from = permissionMode(peer);
@@ -6294,8 +6977,10 @@ export async function startDaemon(opts: DaemonOptions) {
       writeStatus(); return { ok: true, peer, permissionMode: permissionMode(peer) };
     }
     const owner = bus.peers.get(peer);
+    const proxy = frontendProxyState(peer, owner);
+    if (proxy.present && proxy.port === undefined) return { ok: false, error: "frontend proxy state unknown" };
     if (definitionOf(peer)?.permission.trackUnattended && nativeUnattended(peer)) return { ok: false, error: "Codex started --unattended cannot confirm a permission default; run ahub permission codex ask after it stops, or restart without --unattended" };
-    if (!starting.has(peer) && isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && owner.state === "offline") return { ok: false, error: "connect the Codex TUI through the hub proxy before confirming its default" };
+    if (!starting.has(peer) && proxy.port && owner?.state === "offline") return { ok: false, error: "connect the Codex TUI through the hub proxy before confirming its default" };
     if (!starting.has(peer) && owner && owner.state !== "offline") {
       const result = await changePermission(peer, "never-ask", true);
       if (!result.ok) return result;
@@ -6322,16 +7007,34 @@ export async function startDaemon(opts: DaemonOptions) {
     try { return await action(); } finally { permissionChanges.delete(peer); release(); }
   }
 
-  async function reconcileNativeStart(peer: string, owner: AcpPeer | CodexPeer): Promise<void> {
+  async function reconcileNativeStart(peer: string, owner: AcpPeer | CodexPeer, startCurrent?: () => void): Promise<void> {
+    startCurrent?.();
     const result = await permissionChange(peer, async () => {
+      startCurrent?.();
       if (stopping) return { ok: false, error: "hub is stopping" };
       const selected = permissionMode(peer);
-      if (isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && nativeUnattended(peer) && selected !== "ask") return { ok: false, error: "Codex --unattended cannot take a non-ask mode; run ahub permission codex ask, or restart without --unattended" };
-      if (!readOnlyPeer(peer) && !(isAcpPeer(owner) && owner.permissionModeState === "unmanaged") && owner.getPermissionMode() !== selected) {
-        if (isFixedBuiltinDefinition(definitionOf(peer)) && isCodexPeer(owner) && !owner.proxyAttached) owner.setStartupPermissionMode(selected);
+      const proxy = frontendProxyState(peer, owner);
+      if (proxy.present && proxy.port === undefined) return { ok: false, error: "frontend proxy state unknown" };
+      if (isFixedBuiltinDefinition(definitionOf(peer)) && definitionOf(peer)?.permission.trackUnattended && nativeUnattended(peer) && selected !== "ask") return { ok: false, error: "Codex --unattended cannot take a non-ask mode; run ahub permission codex ask, or restart without --unattended" };
+      if (!readOnlyPeer(peer) && owner.permissionModeState !== "unmanaged" && owner.getPermissionMode() !== selected) {
+        if (proxy.port && !proxy.port.attached) proxy.port.setStartupPermissionMode(selected);
         else await owner.setPermissionMode(selected);
+        startCurrent?.();
+      }
+      if (isExternalInstance(peer)) {
+        const launch = externalLaunches.get(peer), current = captureExternalBinding(peer);
+        if (!membershipAllowed(peer) || !launch || launch.owner !== owner || !await verifyManagedAcpLaunch(owner, launch.options) || !sameExternalInstanceBinding(launch.binding, current)) return { ok: false, error: "external instance admission changed" };
+        startCurrent?.();
+        if (stopping || recoveryActive() || !membershipAllowed(peer) || externalWorkspaceIdentity(current.executionCwd) !== launch.workspace || !sameExternalInstanceBinding(launch.binding, captureExternalBinding(peer))) return { ok: false, error: "external instance admission changed" };
+      }
+      // Roles may change while native startup/mode acknowledgement is awaited; the current workspace policy still owns admission.
+      if (declarations[peer]) {
+        try {
+          if (resolveExecutionCwd(peer, declarations, config.roles[peer] ?? [], adapterCatalog) !== executionRoots.get(peer)) return { ok: false, error: "instance execution policy changed during startup" };
+        } catch { return { ok: false, error: "instance execution policy changed during startup" }; }
       }
       // The bus may immediately drain at add(): do not expose an idle adapter until its current choice is applied.
+      startCurrent?.();
       executionOwners.set(peer, { owner, cwd: executionRoots.get(peer) ?? opts.cwd });
       bus.add(owner);
       // start() finished before the bus installed its state hook: replay the current state to drain queued work and record it.
@@ -6346,6 +7049,7 @@ export async function startDaemon(opts: DaemonOptions) {
     let refusalRecorded=false;
     const reply = (body: Record<string, unknown>) => {
       const label=operationalRequestLabel(msg);
+      if (msg.t !== "hello" && c.externalOwner && !currentExternalTools(c)) body = { ok: false, error: "external instance launch or execution root changed" };
       if (c.toolsOwner && !currentImplementerTools(c)) body = { ok: false, error: "Claude child generation or execution root changed", ...(label ? {authorityRefused:true,authorityScope:"operational"}: {}) };
       if(c.authed && c.role==="tools" && c.peer && body.ok===false && label) {
         if(body.authorityRefused===true) {
@@ -6358,6 +7062,7 @@ export async function startDaemon(opts: DaemonOptions) {
     };
     if (!c.authed) {
       if (msg.t !== "hello" || msg.token !== token) return sock.close(4401, "bad token");
+      if (typeof msg.peer === "string" && msg.peer.includes("@")) return sock.close(4403, "remote identities have no control connection");
       if (msg.v !== PROTOCOL) {
         // An outdated plugin would drop every digest without a trace. Refuse it loudly instead.
         log(`refused ${msg.role} ${msg.peer ?? ""}: wire version ${msg.v ?? 1}, hub speaks ${PROTOCOL} (claude plugin update agent-hub@agent-hub)`);
@@ -6375,6 +7080,7 @@ export async function startDaemon(opts: DaemonOptions) {
         // Acts for a peer the hub manages itself (kimi, codex): may send and use the board as that peer, is never a delivery target.
         c.peer = String(msg.peer ?? "");
         if (!PEER_ID.test(c.peer) || c.peer === USER || c.peer === "hub") return sock.close(4403, "peer id is reserved or malformed");
+        if (externalRefusedRows.has(c.peer)) return sock.close(4403, "instance kind is unavailable in the startup catalog");
         if (!membershipAllowed(c.peer)) return sock.close(4000, "peer is off roster; retry when a person adds it");
         if (definitionOf(c.peer)?.start.daemonPort === "claude-implementer") {
           const owner = bus.peers.get(c.peer), launch = owner?.ownedTools?.(msg.launchId), root = ownerWriteRoot(c.peer);
@@ -6383,6 +7089,14 @@ export async function startDaemon(opts: DaemonOptions) {
           c.toolsOwner = { owner, launchId: launch.launchId, generation: launch.generation, cwd: root };
           if (!currentImplementerTools(c)) return sock.close(4403, "Claude child admission changed");
         }
+        if (isExternalInstance(c.peer)) {
+          const launch = externalLaunches.get(c.peer), current = currentExecutionOwner(c.peer);
+          if (!launch || typeof msg.launchId !== "string" || msg.launchId !== launch.launchId || (!current && !starting.has(c.peer))) return sock.close(4403, "external instance launch or execution root is not current");
+          // ACP may initialize its MCP server during session/new. Authenticate the pending launch,
+          // but currentExternalTools fences every operation until the verified spawn joins the bus.
+          c.externalOwner = { owner: launch.owner, launchId: launch.launchId, ...(launch.generation ? { generation: launch.generation } : {}) };
+          if (current && !currentExternalTools(c)) return sock.close(4403, "external instance admission changed");
+        }
         // #368: a hub-tools socket for an owned Jcode (a project-file MCP entry, which names no peer) is admitted only with the launch id of that
         // peer's current owned launch. A forged AGENTHUB_PEER_ID in some other process has no such id, so it never acts as that peer.
         if (definitionOf(c.peer)?.start.daemonPort === "owned-acp") {
@@ -6391,18 +7105,15 @@ export async function startDaemon(opts: DaemonOptions) {
         }
       } else {
         c.peer = String(msg.peer ?? defaultChannelPeer(undefined));
+        if (isExternalInstance(c.peer)) return sock.close(4403, "external module instances require their managed ACP launch");
         if (definitionOf(c.peer)?.transport === "ws-pull" && msg.channel !== false) return sock.close(4403, "this native peer supports pull-only attachment; use hub_inbox");
         const kimiPull = !!definitionOf(c.peer)?.attach?.admission && (kimiSessionMode ?? startMode(c.peer)) === "tui" && msg.channel === false;
         if (!PEER_ID.test(c.peer) || (RESERVED_IDS.has(c.peer) && !kimiPull)) return sock.close(4403, definitionOf(c.peer)?.attach?.admission?.reservedRefusal ?? "peer id is reserved or malformed");
+        if (externalRefusedRows.has(c.peer)) return sock.close(4403, "instance kind is unavailable in the startup catalog");
         if (!membershipAllowed(c.peer)) return sock.close(4000, "peer is off roster; retry when a person adds it");
         if (!recoveryPeerAllowed(c.peer)) return sock.close(4403, "peer id is not part of the recovery roster");
         if (definitionOf(c.peer)?.transport === "claude-channel" && msg.launchId !== undefined) {
-          let currentLaunch: unknown;
-          try {
-            const launch = readClaudeLaunchProof(opts.stateDir, c.peer, instanceId);
-            if (launch) currentLaunch = launch.launchId;
-          } catch { /* No current launch evidence: retain plain/pre-daemon attachment compatibility. */ }
-          if (currentLaunch !== undefined && msg.launchId !== currentLaunch) return sock.close(4430, "Claude launch ended; start a new session with ahub claude");
+          if (claudeLaunchProof.helloLaunch(c.peer, msg.launchId) === "refuse") return sock.close(4430, "Claude launch ended; start a new session with ahub claude");
           if (typeof msg.launchId === "string" && msg.launchId.length <= 128) c.launchId = msg.launchId;
         }
         let peer = bus.peers.get(c.peer);
@@ -6420,7 +7131,7 @@ export async function startDaemon(opts: DaemonOptions) {
           revokeTerminalExecution(c.peer);
           const launch = readClaudeLaunchProof(opts.stateDir, c.peer, instanceId);
           try {
-            const root = resolveInstanceExecutionCwd(opts.cwd, c.peer, declarations, config.roles[c.peer] ?? [], adapterCatalog);
+            const root = resolveExecutionCwd(c.peer, declarations, config.roles[c.peer] ?? [], adapterCatalog);
             if (root !== opts.cwd && launch?.privateRecord && launch.launchId === c.launchId && launch.executionCwd === root && typeof msg.cwd === "string" && realPath(msg.cwd) === root) {
               executionRoots.set(c.peer, root);
               executionOwners.set(c.peer, { owner: ws, cwd: root, socket: sock, launchId: launch.launchId, generation: ws.sessionGeneration });
@@ -6439,13 +7150,29 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       return void reply({ t: "welcome", projectId, instanceId, cwd: opts.cwd, protocol: PROTOCOL, features: DAEMON_FEATURES });
     }
-    if (stopping && msg.t !== "status" && msg.t !== "kill" && !(c.role === "console" && msg.t === "native_hook_launch" && msg.op === "end")) return void reply({ ok: false, error: "hub is stopping" });
+    const committedSourceProof = c.role === "tools" && msg.t === "recovery_authority" && msg.op === "verify" && recoveryCommitted
+      && msg.binding?.operationId === recoveryOperationId && msg.binding?.sourceInstanceId === instanceId;
+    if (stopping && !committedSourceProof && msg.t !== "status" && msg.t !== "kill" && !(c.role === "console" && msg.t === "native_hook_launch" && msg.op === "end")) return void reply({ ok: false, error: "hub is stopping" });
     if (c.role !== "console" && c.peer && !membershipAllowed(c.peer)) return void reply({ ok: false, error: `${c.peer} is off roster` });
+    if (c.externalOwner && !currentExternalTools(c)) return void reply({ ok: false, error: "external instance launch or execution root changed" });
     if (c.toolsOwner && !currentImplementerTools(c)) return void reply({ ok: false, error: "Claude child generation or execution root changed" });
     switch (msg.t) {
+      case "permission_failure_probe": {
+        const launch = currentImplementerTools(c), entry = currentImplementerFailure(c, launch);
+        if (!entry || ++entry.probeCount > NATIVE_PERMISSION_PROBE_MAX_PER_LAUNCH) return void reply({ ok: false, error: "permission diagnostic unavailable" });
+        // Validation input is temporary. No caller-selected stage, native id or body is retained or echoed.
+        const probe = buildNativePermissionProbe(msg.request);
+        if (!probe || validateNativePermissionRequest(probe.request)) return void reply({ ok: false, error: "permission diagnostic unavailable" });
+        entry.permissionAttempt++;
+        const recorded = entry.trace.record("invalid_permission_request");
+        return void reply(recorded ? { ok: true } : { ok: false, error: "permission diagnostic unavailable" });
+      }
       case "permission_request": {
         const peer = c.peer, launch = currentImplementerTools(c), current = captureImplementerTools(c);
         if (!peer || !launch || c.role !== "tools" || typeof msg.tool !== "string" || !msg.input || typeof msg.input !== "object" || Array.isArray(msg.input)) return void reply({ ok: false, behavior: "deny", message: "permission unavailable" });
+        const failure = currentImplementerFailure(c, launch), attempt = failure ? ++failure.permissionAttempt : 0;
+        failure?.trace.permissionObserved();
+        const failureCurrent = () => !!failure && failure.permissionAttempt === attempt && currentImplementerFailure(c) === failure;
         const shown = permissionPayload(msg.tool, msg.input, tasks.publicMetadataText);
         const pending = new AbortController(), abortPending = () => pending.abort();
         launch.signal.addEventListener("abort", abortPending, { once: true });
@@ -6454,10 +7181,13 @@ export async function startDaemon(opts: DaemonOptions) {
         const heartbeat = setInterval(() => { if (currentImplementerTools(c, false) === launch) c.toolsOwner?.owner.keepApprovalAlive?.(); else pending.abort(); }, Math.max(10, Math.min(1000, Math.floor(config.watchdog_ms / 3)))); heartbeat.unref();
         c.toolsOwner?.owner.keepApprovalAlive?.();
         void (async () => {
-          const updatedInput = msg.wrapperProtocol === 1 ? await automaticImplementerShell(c, msg.tool, msg.input, () => sock.readyState === WebSocket.OPEN && current()) : undefined;
+          const updatedInput = msg.wrapperProtocol === 1 ? await automaticImplementerShell(c, msg.tool, msg.input, () => sock.readyState === WebSocket.OPEN && current(), failure ? { entry: failure, attempt } : undefined) : undefined;
           if (updatedInput && current()) return void reply({ ok: true, behavior: "allow", wrapperProtocol: 1, updatedInput });
           if (!current()) return void reply({ ok: true, behavior: "deny", message: "permission denied" });
-          const result = await requestPermission({ peer, title: shown.title, tool: shown.tool, classed: true, options: [{ optionId: "allow", name: "Allow once", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }, pending.signal);
+          const result = await requestPermission({ peer, title: shown.title, tool: shown.tool, classed: true, options: [{ optionId: "allow", name: "Allow once", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }, pending.signal, undefined, false, {
+            registered: id => { if (failureCurrent()) failure!.trace.permissionObserved(id); },
+            expired: id => { if (failureCurrent()) failure!.trace.record("manual_queue_expired", id); },
+          });
           const allowed = current() && result.outcome === "answered" && result.optionId === "allow";
           reply({ ok: true, behavior: allowed ? "allow" : "deny", ...(allowed ? {} : { message: result.outcome === "expired" ? "no person answered" : "permission denied" }) });
         })().catch(() => reply({ ok: true, behavior: "deny", message: "hub permission unavailable" })).finally(() => { clearInterval(heartbeat); launch.signal.removeEventListener("abort", abortPending); }).catch(() => {});
@@ -6465,12 +7195,12 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       case "conductor_operational": {
         try {
-          if(!["authorize","logs","export","orphans"].includes(msg.op))return void reply({ok:false,error:"unknown operational request"});
-          const commands=["roster add","roster remove","stop","queue show","queue resolve","queue discard","task cancel","settings set","doctor orphans kill","logs","export"];
-          const command=msg.op==="authorize"?msg.command:msg.op==="orphans"?"doctor orphans kill":msg.op;
-          if(!commands.includes(command))return void reply({ok:false,error:"unknown operational command"});
+          if(!["authorize","admit","logs","export","orphans"].includes(msg.op))return void reply({ok:false,error:"unknown operational request"});
+          const command=msg.op==="authorize"||msg.op==="admit"?msg.command:msg.op==="orphans"?"doctor orphans kill":msg.op;
+          // #933: `admit` is the one audited admission of a form whose effect runs in the CLI process; `authorize` only checks the role for a form whose own request admits.
+          if(msg.op==="admit"?!conductorLocalOperation(command):!(CONDUCTOR_DAEMON_OPERATIONS as readonly string[]).includes(command))return void reply({ok:false,error:"unknown operational command"});
           const current=msg.op==="authorize"?operationalCurrent(sock):admitOperational(sock,command);current();
-          if(msg.op==="authorize")return void reply({ok:true,instanceId});
+          if(msg.op==="authorize"||msg.op==="admit")return void reply({ok:true,instanceId});
           if(msg.op==="logs" || msg.op==="export") {
             const lines=dogfoodLines(join(opts.stateDir,msg.op==="logs"?"hub.log":"events.jsonl"),128*1024);
             if(!lines.available)return void reply({ok:false,error:"operational history unavailable"});
@@ -6523,14 +7253,15 @@ export async function startDaemon(opts: DaemonOptions) {
         }
         if(c.role!=="console" && msg.reason!==undefined && (typeof msg.reason!=="string" || !tasks.publicMetadataText(msg.reason)))return void reply({ok:false,error:"queue reason withheld by privacy policy"});
         if (msg.op === "list") {
-          if (msg.peer !== undefined && (typeof msg.peer !== "string" || !PEER_ID.test(msg.peer))) return void reply({ ok: false, error: "invalid peer" });
+          if (msg.peer !== undefined && (typeof msg.peer !== "string" || !PEER_ID.test(msg.peer) && !parseRemotePeerId(msg.peer))) return void reply({ ok: false, error: "invalid peer" });
           return void reply({ ok: true, deliveries: bus.queueList(msg.peer).map((row) => queueView(row,false,c.role!=="console")) });
         }
         if (msg.op === "discard") {
           // #713: the person's bulk clear of one peer's backlog. Without `confirmed` it only counts; with it, every queued (or needs_review) delivery of that peer is discarded
           // through the same `resolveDelivery` as one by one, each with the reason, so the journal records each as a `resolve ... discard`. Push peers' queues are never touched
           // because only the named peer is read. Refused while recovery or shutdown holds queue mutations, like every queue resolution.
-          if (typeof msg.peer !== "string" || !PEER_ID.test(msg.peer)) return void reply({ ok: false, error: "peer must be a peer id" });
+          if (typeof msg.peer !== "string" || !PEER_ID.test(msg.peer) && !parseRemotePeerId(msg.peer)) return void reply({ ok: false, error: "peer must be a peer id" });
+          if (msg.peer.includes("@") && c.role !== "console") return void reply({ ok: false, error: "remote delivery disposition is person-only" });
           const state = msg.state === undefined ? "queued" : msg.state;
           if (state !== "queued" && state !== "needs_review") return void reply({ ok: false, error: "state is queued or needs_review" });
           const rows = bus.queueList(msg.peer).filter((row) => row.state === state);
@@ -6544,7 +7275,9 @@ export async function startDaemon(opts: DaemonOptions) {
             const current = bus.queueShow(row.id) ?? bus.queueList(msg.peer).find((r) => r.id === row.id);
             try {
               if (!current || current.state !== state) throw new Error("unknown delivery");
-              bus.resolveDelivery(row.id, current.revision, "discard", msg.reason.trim()); discarded++;
+              bus.resolveDelivery(row.id, current.revision, "discard", msg.reason.trim());
+              if (row.peer.includes("@")) roomChat.disposition(row.peer, row.id, "discard");
+              discarded++;
             }
             catch (error) { const why = resolutionRefusal(error).split(":")[0]!; refused[why] = (refused[why] ?? 0) + 1; }
           }
@@ -6559,7 +7292,10 @@ export async function startDaemon(opts: DaemonOptions) {
         if (msg.op !== "resolve" || !["completed", "retry", "discard"].includes(msg.action) || !Number.isSafeInteger(msg.revision) || msg.revision < 0 || typeof msg.reason !== "string" || !msg.reason.trim() || msg.reason.length > 2000) return void reply({ ok: false, error: "resolution needs an action, observed revision and reason" });
         if (recoveryActive() || stopping) return void reply({ ok: false, error: "recovery or shutdown is holding queue mutations" });
         try {
+          const before = bus.queueShow(msg.id);
+          if (before?.peer.includes("@") && c.role !== "console") return void reply({ ok: false, error: "remote delivery disposition is person-only" });
           bus.resolveDelivery(msg.id, msg.revision, msg.action, msg.reason.trim());
+          if (before?.peer.includes("@")) roomChat.disposition(before.peer, msg.id, msg.action);
           writeStatus();
           return void reply({ ok: true, delivery: queueView(bus.queueShow(msg.id),false,c.role!=="console") });
         } catch (error) { return void reply({ ok: false, error: resolutionRefusal(error) }); }
@@ -6631,9 +7367,131 @@ export async function startDaemon(opts: DaemonOptions) {
           return void reply({ ok: false, error: "unknown execution budget operation" });
         } catch (error) { return void reply({ ok: false, error: (error as Error).message }); }
       }
-      case "recovery":
-        if (c.role !== "console") return void reply(recoveryError("recovery is a console command"));
-        void recoveryOp(msg).then(reply, (error) => {
+      case "recovery_restore": {
+        try {
+          const current = admitOperational(sock, "recovery restore"); current();
+          const raw = msg.authority as ConductorRecoveryBinding;
+          if (!raw || raw.peer !== c.peer || raw.projectRoot !== opts.cwd || raw.projectId !== projectId || raw.stateDir !== opts.stateDir
+            || !restored || restored.operationId !== raw.operationId || restored.sourceInstanceId !== raw.sourceInstanceId
+            || recoveryPhase !== "restored" || recoveryOperationId !== raw.operationId || instanceId === raw.sourceInstanceId
+            || recoveryTargetDigest(raw.kind, resolve(import.meta.dir, "../..")) !== raw.targetDigest) throw new RecoveryAuthorityError();
+          const proof = authorizeConductorRecovery(opts.stateDir, raw, () => { current(); const value = currentRecoveryPolicy(c.peer!); return value.policyDigest === raw.policyDigest && value.boardDigest === raw.boardDigest; });
+          const fence = () => { current(); assertConductorRecovery(proof); if (recoveryPhase !== "restored" || recoveryOperationId !== raw.operationId) throw new RecoveryAuthorityError(); };
+          const saved = restored.peers.find(row => row.id === msg.peer);
+          if (!saved || saved.state === "offline" || saved.launch?.mode === "tui" || definitionOf(saved.id)?.transport === "claude-channel" || !definitionOf(saved.id)?.session.restoreArgs) throw new RecoveryAuthorityError();
+          // Host snapshot only. No argv, model, session or launch field supplied by the tools caller is used.
+          const launch = saved.launch ?? {};
+          const args: Parameters<typeof startPeer>[1] = { mode: "headless",
+            ...(typeof launch.model === "string" ? { model: launch.model } : {}), ...(typeof launch.route === "string" ? { route: launch.route } : {}),
+            ...(launch.backend === "auto" || launch.backend === "dgx" || launch.backend === "mlx" ? { backend: launch.backend } : {}),
+            ...(saved.sessionId ? { sessionId: saved.sessionId } : {}), ...(typeof launch.sessionFile === "string" ? { sessionFile: launch.sessionFile } : {}),
+            ...(typeof launch.providerProfile === "string" ? { providerProfile: launch.providerProfile } : {}) };
+          fence();
+          void startPeer(saved.id, args, undefined, fence).then(result => { try { fence(); reply(result); } catch { reply({ ok: false, error: "conductor recovery authority unavailable" }); } }, () => reply({ ok: false, error: "conductor recovery restore refused" }));
+        } catch { reply({ ok: false, error: "conductor recovery authority unavailable; the person runs it in ahub console or a terminal" }); }
+        return;
+      }
+      case "recovery_authority": {
+        void (async () => { try {
+          const settlingSource = msg.op === "verify" && recoveryCommitted && msg.binding?.operationId === recoveryOperationId && msg.binding?.sourceInstanceId === instanceId;
+          const current = operationalCurrent(sock, false, settlingSource); current();
+          if (msg.op === "authorize" && ["restart", "upgrade"].includes(msg.command)) { currentRecoveryPolicy(c.peer!); const inputs = readRecoveryPolicyInputs(opts.cwd, runningRoutingDefault); current(); return void reply({ ok: true, instanceId, ...(inputs.routingFallback === undefined ? {} : { routingDefault: inputs.routingFallback }) }); }
+          if (!["issue", "verify"].includes(msg.op)) throw new RecoveryAuthorityError();
+          const raw = msg.binding as ConductorRecoveryBinding;
+          if (!raw || raw.peer !== c.peer || raw.projectRoot !== opts.cwd || raw.projectId !== projectId || raw.stateDir !== opts.stateDir) throw new RecoveryAuthorityError();
+          const project = { root: opts.cwd, id: projectId, stateDir: opts.stateDir };
+          const expected = { ...raw, ...currentRecoveryPolicy(c.peer!) };
+          const fresh = () => { current(); return JSON.stringify(currentRecoveryPolicy(c.peer!)) === JSON.stringify({ policyDigest: raw.policyDigest, boardDigest: raw.boardDigest }); };
+          if (msg.op === "issue") {
+            const plan = msg.plan as UpgradePlan;
+            const { fingerprint, ...body } = plan ?? {} as UpgradePlan;
+            if (!plan || !["restart", "upgrade"].includes(plan.kind) || plan.projects.some(row => row.terminals.length > 0) || planFingerprint(body) !== fingerprint || fingerprint !== raw.planFingerprint || plan.kind !== raw.kind || existsSync(operationPath(raw.operationId))
+              || raw.sourceInstanceId !== instanceId || recoveryActive() || recoveryLock() || !plan.projects.some(row => row.project.id === projectId && row.project.root === opts.cwd && row.project.stateDir === opts.stateDir && row.source.instanceId === instanceId)) throw new RecoveryAuthorityError();
+            if (plan.kind === "restart" && plan.projects.length !== 1) throw new RecoveryAuthorityError();
+            if (plan.kind === "upgrade") {
+              // Shared package/plugin effects cover every running or uncertain registered project, not a caller-selected subset.
+              const affected = registeredProjects().filter(project => {
+                const control = readControl(project.stateDir);
+                return control ? processLiveness(control.pid, control.pidSignature) !== "gone" : project.pid !== null && processLiveness(project.pid, project.pidSignature) !== "gone";
+              });
+              if (affected.length !== plan.projects.length || affected.some(project => !plan.projects.some(row => row.project.id === project.id && row.project.root === project.root && row.project.stateDir === project.stateDir))) throw new RecoveryAuthorityError();
+            }
+            const selected = plan.projects.find(row => row.project.id === projectId)!;
+            const reconnect = new Map<string, import("../cli/upgrade.ts").RecoveryPeer["observation"]>();
+            const reconnectCurrent: Array<() => boolean> = [];
+            if (selected.reconnectOnly !== undefined) {
+              if (!Array.isArray(selected.reconnectOnly) || new Set(selected.reconnectOnly).size !== selected.reconnectOnly.length) throw new RecoveryAuthorityError();
+              for (const id of selected.reconnectOnly) {
+                const row = selected.source.peers.find(peer => peer.id === id), owner = bus.peers.get(id), definition = definitionOf(id);
+                if (!row || selected.freshStart?.includes(id) || Object.keys(row).some(key => !["id", "state", "observation"].includes(key)) || !row.observation
+                  || Object.keys(row.observation).some(key => !["kind", "attached", "sessionDigest"].includes(key))
+                  || !isWsPeer(owner) || definition?.transport !== "claude-channel" || !owner.attached || owner.managedLaunchId || claudeLaunchProof.verified(id)
+                  || row.observation.kind !== definition.kind || row.observation.attached !== owner.attached || row.observation.sessionDigest !== recoverySessionDigest(claudeSession(id).sessionId)) throw new RecoveryAuthorityError();
+                const generation = owner.sessionGeneration;
+                const launcher = await launcherOf(id, opts.cwd, { stateDir: opts.stateDir, instanceId }); current();
+                if (launcher && launcher.state !== "gone" || bus.peers.get(id) !== owner || owner.sessionGeneration !== generation || !owner.attached || owner.managedLaunchId || claudeLaunchProof.verified(id)) throw new RecoveryAuthorityError();
+                reconnectCurrent.push(() => bus.peers.get(id) === owner && owner.sessionGeneration === generation && owner.attached && !owner.managedLaunchId && !claudeLaunchProof.verified(id)
+                  && definitionOf(id)?.kind === row.observation!.kind && owner.attached === row.observation!.attached && recoverySessionDigest(claudeSession(id).sessionId) === row.observation!.sessionDigest);
+                reconnect.set(id, row.observation);
+              }
+            }
+            if (reconnectCurrent.some(check => !check())) throw new RecoveryAuthorityError();
+            const normalize = (row: { id: string; state: string; observation?: { kind: string; attached: boolean; sessionDigest?: string }; threadId?: string; sessionId?: string; sessionFile?: string; args?: Record<string, string>; launch?: Record<string, unknown> }) => {
+              const launch = row.args ?? row.launch ?? {};
+              const observed = reconnect.get(row.id);
+              return { id: row.id, active: row.state !== "offline", threadId: row.threadId, sessionId: observed ? undefined : row.sessionId,
+                ...(observed ? { sessionDigest: row.observation?.sessionDigest ?? recoverySessionDigest(row.sessionId) } : {}),
+                ...(observed ? { kind: row.observation?.kind ?? definitionOf(row.id)?.kind, attached: row.observation?.attached ?? (isWsPeer(bus.peers.get(row.id)) && (bus.peers.get(row.id) as import("../adapters/channel-peer.ts").WsPeer).attached) } : {}),
+                sessionFile: row.sessionFile ?? (typeof launch.sessionFile === "string" ? launch.sessionFile : undefined),
+                args: Object.fromEntries(Object.entries(launch).filter(([key, value]) => ["model", "route", "sessionFile", "mode", "backend"].includes(key) && typeof value === "string").sort(([a], [b]) => a.localeCompare(b))) };
+            };
+            const ordered = (rows: Parameters<typeof normalize>[0][]) => rows.map(normalize).sort((a, b) => a.id.localeCompare(b.id));
+            if (JSON.stringify(ordered(selected.source.peers)) !== JSON.stringify(ordered(Object.values(recoveryPeers())))) throw new RecoveryAuthorityError();
+            exactVersion(plan.version);
+            if (verifyRecoveryTarget(raw.kind, raw.targetRoot, plan.version) !== raw.targetDigest) throw new RecoveryAuthorityError();
+            readRecoveryTargetFeatures(raw.targetRoot);
+            if (raw.kind === "restart") {
+              if (!sourcePackageDigest || raw.targetDigest !== sourcePackageDigest) throw new RecoveryAuthorityError();
+            } else {
+              const staged = join(hubHome(), "releases", plan.version);
+              if (raw.targetRoot !== join(staged, "node_modules/@staix/agent-hub")) throw new RecoveryAuthorityError();
+              const verified = JSON.parse(readFileSync(join(staged, "verified.json"), "utf8"));
+              if (verified.digest !== raw.targetDigest || verified.integrity !== plan.integrity) throw new RecoveryAuthorityError();
+            }
+            if (!sourcePackageDigest || plan.sourceDigest !== sourcePackageDigest && (plan.kind !== "upgrade" || plan.sourceDigest !== raw.targetDigest)) throw new RecoveryAuthorityError();
+            current();
+            if (!event({ type: "agent_cli", peer: c.peer!, command: raw.kind, refused: false })) throw new RecoveryAuthorityError();
+            current();
+            issueConductorRecoveryAuthority(opts.stateDir, expected, fresh);
+          } else {
+            if (instanceId !== raw.sourceInstanceId && (restored?.operationId !== raw.operationId || restored.sourceInstanceId !== raw.sourceInstanceId || recoveryTargetDigest(raw.kind, resolve(import.meta.dir, "../..")) !== raw.targetDigest)) throw new RecoveryAuthorityError();
+            assertConductorRecovery(authorizeConductorRecovery(opts.stateDir, expected, fresh));
+          }
+          current(); return void reply({ ok: true, instanceId, target: restored?.operationId === raw.operationId && instanceId !== raw.sourceInstanceId, operationId: recoveryOperationId, phase: recoveryPhase });
+        } catch { return void reply({ ok: false, error: "conductor recovery authority unavailable; the person runs it in ahub console or a terminal" }); }
+        })().catch(() => reply({ ok: false, error: "conductor recovery authority unavailable" }));
+        return;
+      }
+      case "recovery": {
+        let recoveryMessage = msg;
+        let recoveryCurrent: () => void = () => {};
+        if (c.role !== "console") {
+          try {
+            if (!["inspect", "prepare", "commit", "abort", "release"].includes(msg.op)) throw new RecoveryAuthorityError();
+            const current = msg.op === "inspect" ? operationalCurrent(sock) : admitOperational(sock, `recovery ${msg.op}`); current();
+            if (msg.op !== "inspect" || msg.operationId !== undefined) {
+              const raw = msg.authority as ConductorRecoveryBinding;
+              if (!raw || raw.peer !== c.peer || raw.operationId !== msg.operationId || raw.projectRoot !== opts.cwd || raw.projectId !== projectId || raw.stateDir !== opts.stateDir) throw new RecoveryAuthorityError();
+              if (instanceId !== raw.sourceInstanceId && (restored?.operationId !== raw.operationId || restored.sourceInstanceId !== raw.sourceInstanceId || recoveryTargetDigest(raw.kind, resolve(import.meta.dir, "../..")) !== raw.targetDigest)) throw new RecoveryAuthorityError();
+              const proof = authorizeConductorRecovery(opts.stateDir, raw, () => { current(); const value = currentRecoveryPolicy(c.peer!); return value.policyDigest === raw.policyDigest && value.boardDigest === raw.boardDigest; });
+              recoveryCurrent = () => { current(); assertConductorRecovery(proof); if (recoveryTargetDigest(raw.kind, raw.targetRoot) !== raw.targetDigest) throw new RecoveryAuthorityError(); };
+              recoveryCurrent();
+              recoveryMessage = { ...msg, targetFeatures: readRecoveryTargetFeatures(raw.targetRoot) };
+            } else recoveryCurrent = current;
+            recoveryCurrent();
+          } catch { return void reply(recoveryError("conductor recovery authority unavailable; the person runs it in ahub console or a terminal")); }
+        }
+        void recoveryOp(recoveryMessage, recoveryCurrent).then(reply, (error) => {
           if (isDatabaseBusy(error)) {
             try { log(`recovery ${sanitize(String(msg.op))} database contention: ${databaseBusySite(error).join("\n")}`); } catch { /* the reply still settles its rid */ }
             const busy = new RecoveryDatabaseBusy();
@@ -6642,17 +7500,24 @@ export async function startDaemon(opts: DaemonOptions) {
           else reply(recoveryError((error as Error)?.message ?? "recovery operation failed"));
         });
         return;
+      }
       case "send": {
         if (recoveryActive()) return void reply({ t: "sent", ok: false, error: "recovery is holding new deliveries" });
         // A human at the console should not wait out the batch window; agents default to status.
         const { priority, body } = parseMarker(String(msg.body ?? ""), c.peer ? "status" : "important");
         if (!body) return void reply({ t: "sent", ok: false, error: "empty body" });
-        const to: PeerId[] | undefined = Array.isArray(msg.to) && msg.to.length ? [...new Set<string>(msg.to.map(String))] : undefined;
+        const recipients = typeof msg.to === "string" && msg.to.length ? [msg.to] : msg.to;
+        if (Object.hasOwn(msg, "to") && (!Array.isArray(recipients) || recipients.some(id => typeof id !== "string" || !id.length))) {
+          return void reply({ t: "sent", ok: false, error: "to must be an array of peer ids" });
+        }
+        const to: PeerId[] | undefined = Array.isArray(recipients) && recipients.length ? [...new Set<string>(recipients)] : undefined;
         const unknown = to?.filter((id) => !bus.knownPeers().includes(id) && membershipAllowed(id)) ?? [];
         if (unknown.length) return void reply({ t: "sent", ok: false, error: `unknown peer: ${unknown.join(", ")}` });
         const inReplyTo = msg.reply_to ? bus.get(String(msg.reply_to)) : undefined;
         // Built first: limits count the audience it really has (a reply goes to the parent's sender).
         let env = newEnvelope(c.peer ?? USER, body, { priority, ...(to ? { to } : {}), ...(inReplyTo ? { inReplyTo } : {}) });
+        try { bus.checkRemotePublication(env); }
+        catch (error) { return void reply({ t: "sent", ok: false, error: error instanceof Error && /^(?:room|remote) /.test(error.message) ? sanitize(error.message).slice(0, 8192) : "message admission unavailable" }); }
         const offRoster = bus.offRosterRecipients(env);
         if (offRoster.length && offRoster.length === new Set(env.to?.filter(id => id !== env.from)).size) return void reply({ t: "sent", ok: false, error: `off roster: ${offRoster.join(", ")}` });
         const admittedEnv = offRoster.length ? { ...env, to: env.to!.filter(id => !offRoster.includes(id)) } : env;
@@ -6662,7 +7527,10 @@ export async function startDaemon(opts: DaemonOptions) {
         const heldBack = hushed.length > 0 && hushed.length === bus.audience(env).length;
         const refused = c.peer && !heldBack ? admit(admittedEnv, inReplyTo?.id) : undefined;
         if (refused) return void reply({ t: "sent", ok: false, error: refused });
-        const { targets, dropped } = bus.publishResult(env);
+        let published: ReturnType<Bus["publishResult"]>;
+        try { published = bus.publishResult(env); }
+        catch (error) { return void reply({ t: "sent", ok: false, error: error instanceof Error && /^(?:room|remote) /.test(error.message) ? sanitize(error.message).slice(0, 8192) : "message admission unavailable" }); }
+        const { targets, dropped } = published;
         if (c.peer && inReplyTo) bus.completeReply(c.peer, inReplyTo.id); // the delivery it answers was handled all the same
         if (dropped === "hop") return void reply({ t: "sent", ok: true, targets, dropped, recorded: priority === "fyi",
           notice: `not delivered: reply chain reached the hop cap (${MAX_HOP}); send a new message without reply_to` });
@@ -6775,21 +7643,13 @@ export async function startDaemon(opts: DaemonOptions) {
             const actionClasses = phase === "pre" && typeof msg.tool === "string" ? claudeActionClasses(actionBudgets, msg.tool, msg.input, root) : [];
             return void reply({ t: "facts", ok: true, ...(phase === "pre" ? { permission: mode === "ask-when-needed" && blocked ? "ask" : mode, projectRoot: root, protectInstructionFiles: config.protect_instruction_files, ...(actionClasses.length ? { actionClasses } : {}) } : {}) });
           }
-          let nativeClaude = false;
+          let nativeClaude = false, nativeTranscript: string | undefined;
           if (definitionOf(peer)?.transport === "claude-channel" && sessionId && msg.nativeInstanceId === instanceId) {
-            let expectedLaunch: string | undefined;
-            try {
-              const rows = JSON.parse(readFileSync(join(opts.stateDir, "terminal-recovery.json"), "utf8"));
-              expectedLaunch = Array.isArray(rows) ? rows.find(row => row?.peer === peer && definitionOf(row.peer)?.transport === "claude-channel" && row?.projectRoot === opts.cwd && row?.instanceId === instanceId)?.launchId : undefined;
-            } catch { /* an ordinary terminal has no Orca recovery identity */ }
-            try {
-              const launch = readClaudeLaunchProof(opts.stateDir, peer, instanceId);
-              if (launch) expectedLaunch = launch.launchId;
-            } catch { /* older/manual launches do not have a launcher marker */ }
+            const expectedLaunch = claudeLaunchProof.expectedLaunch(peer);
             const current = claudeSession(peer);
             if ((phase === "stop" || phase === "post") && current.sessionId && current.sessionId !== sessionId) return void reply({ t: "facts", ok: false });
             if (!expectedLaunch || msg.nativeLaunchId === expectedLaunch) {
-              const transcript = claudeTranscript(sessionId, msg.transcriptPath, peer);
+              const transcript = nativeTranscript = claudeTranscript(sessionId, msg.transcriptPath, peer);
               const launchId = typeof msg.nativeLaunchId === "string" ? msg.nativeLaunchId : undefined;
               const file = join(opts.stateDir, claudeStateFile("claude-session", peer));
               writeFileSync(`${file}.hook.tmp`, JSON.stringify({ at: Date.now(), instanceId, sessionId, ...(launchId ? { launchId } : {}), ...(transcript ? { transcriptPath: transcript } : {}) }), { mode: 0o600 });
@@ -6799,22 +7659,28 @@ export async function startDaemon(opts: DaemonOptions) {
             if (!nativeClaude) return void reply({ t: "facts", ok: false });
           }
           if (definitionOf(peer)?.transport === "claude-channel" && msg.nativeInstanceId !== undefined && msg.nativeInstanceId !== instanceId) return void reply({ t: "facts", ok: false });
-          const nativePeer = nativeClaude ? bus.peers.get(peer) : undefined;
-          const permissionLaunch = definitionOf(peer)?.transport === "claude-channel" ? claudePermissionLaunch(peer) : undefined;
+          if (nativeClaude && (phase === "pre" || phase === "stop")) {
+            try { observeClaudeDoing(peer, sessionId!, nativeTranscript, phase === "pre" ? tool : "", input); } catch { /* #878: a display value never costs the hook its answer */ }
+          }
+          const nativePeer = nativeClaude ? claudeLaunchProof.owner(peer) : undefined;
+          const permissionLaunch = definitionOf(peer)?.transport === "claude-channel" ? claudeLaunchProof.permissionLaunch(peer) : undefined;
           const writeRoot = declarations[peer]?.worktree ? ownerWriteRoot(peer) : executionRoot(peer);
           if (declarations[peer]?.worktree && writeRoot === undefined) return void reply({ t: "facts", ok: false });
           const permission = nativeClaude && permissionLaunch && !permissionLaunch.unattended && msg.nativeLaunchId === permissionLaunch.launchId && writeRoot !== undefined ? permissionMode(peer) : undefined;
-          if (permission !== undefined && isWsPeer(nativePeer)) claudePermissionGenerations.set(peer, nativePeer.sessionGeneration);
+          if (permission !== undefined && nativePeer) claudeLaunchProof.bindGeneration(peer, nativePeer.sessionGeneration);
           const protectedWrite = scopedWriteBlocked(phase, permission, msg.tool, () => projectFileTool(msg.tool, msg.input, writeRoot ?? opts.cwd, config.protect_instruction_files, config.data?.readonly));
           // Always-ask (#636): a classed call is asked about in every permission mode. The hub names only the classes, under the same verified root as the file policy above; the hook turns them into `ask`.
           const actionClasses = phase === "pre" && permission !== undefined && typeof msg.tool === "string" ? claudeActionClasses(actionBudgets, msg.tool, msg.input, writeRoot ?? opts.cwd) : [];
-          const permissionReply = phase === "pre" && permission !== undefined ? { permission: permission === "ask-when-needed" && protectedWrite ? "ask" : permission, projectRoot: writeRoot ?? opts.cwd, protectInstructionFiles: config.protect_instruction_files, ...(actionClasses.length ? { actionClasses } : {}) } : {};
+          const plannerOnly = !!declarations[peer] && definitionOf(peer)?.transport === "claude-channel" && isPlannerOnly(config.roles[peer] ?? []);
+          // Older hooks do not know mutationGrants; the existing permission field must also withhold their mutation grant.
+          const plannerMutation = plannerOnly && !["Read", "LS", "Glob", "Grep"].includes(tool);
+          const permissionReply = phase === "pre" && permission !== undefined ? { permission: plannerMutation || permission === "ask-when-needed" && protectedWrite ? "ask" : permission, projectRoot: writeRoot ?? opts.cwd, protectInstructionFiles: config.protect_instruction_files, ...(plannerOnly ? { mutationGrants: false } : {}), ...(actionClasses.length ? { actionClasses } : {}) } : {};
           // Permission-only hooks carry no native-turn evidence and must never drive busy state.
           const purpose = permissionLaunch?.hookPurpose ?? msg.hookPurpose;
           const observesNative = purpose === "facts" || purpose === "idle" || purpose === "facts-and-idle" || (purpose === undefined && (config.coordination === "turn-free" || config.task_sweep.enabled || config.roles[peer]?.includes("conductor")));
           if (nativeClaude && !observesNative) return void reply({ t: "facts", ok: true, ...permissionReply });
           if (phase === "session") { recordSessions(); return void reply({ t: "facts", ok: true }); }
-          if ((phase === "start" || phase === "pre") && isWsPeer(nativePeer)) {
+          if ((phase === "start" || phase === "pre") && nativePeer) {
             const previous = nativeTurnStart.get(peer);
             const current = claudeSession(peer);
             if (phase === "start" || nativePeer.state !== "busy" || previous?.generation !== nativePeer.sessionGeneration || previous?.session !== sessionId || previous?.launch !== (current.launchId ?? "")) {
@@ -6837,7 +7703,7 @@ export async function startDaemon(opts: DaemonOptions) {
               const st = hookStats.get(peer)!;
               event({ type: "hook_stats", peer, n: st.n, startupMs: Math.round(st.startupMs), hubMs: Math.round(st.hubMs), maxStartupMs: Math.round(st.maxStartupMs) });
               hookStats.delete(peer);
-              if (id && isWsPeer(nativePeer)) nativePeer.nativeStopped(sessionId!);
+              if (id && nativePeer) nativePeer.nativeStopped(sessionId!);
               if (factsOn()) { factSession(peer, sessionId); readbacks(peer, claudeTranscript(sessionId, msg.transcriptPath, peer)); }
             };
             if (!nativeClaude) { finishStop(); reply({ t: "facts", ok: true }); return; } // legacy bookkeeping cannot certify native completion
@@ -6846,13 +7712,13 @@ export async function startDaemon(opts: DaemonOptions) {
             const readCompletion = () => { transcript ??= claudeTranscript(sessionId, msg.transcriptPath, peer); return session.sessionId && transcript ? readClaudeTranscriptCompletion(session.sessionId, transcript) : undefined; };
             const completionId = (id: string) => createHash("sha256").update(`${sessionId}:${session.launchId ?? "legacy"}:${id}`).digest("hex");
             const started = nativeTurnStart.get(peer);
-            const activeStart = !!started && started.session === sessionId && started.launch === (session.launchId ?? "") && isWsPeer(nativePeer) && started.generation === nativePeer.sessionGeneration;
+            const activeStart = !!started && started.session === sessionId && started.launch === (session.launchId ?? "") && !!nativePeer && started.generation === nativePeer.sessionGeneration;
             // A seen previous completion is a duplicate only outside an active start. During B it is B's baseline.
             if (!activeStart) {
               const latest = readCompletion();
               if (latest?.at && nativeStopsSeen.has(completionId(latest.id))) return void reply({ t: "facts", ok: true });
             }
-            if (!started || !activeStart || !isWsPeer(nativePeer)) { log("native Stop refused for claude: current native turn start unavailable"); return void reply({ t: "facts", ok: false }); }
+            if (!started || !activeStart || !nativePeer) { log("native Stop refused for claude: current native turn start unavailable"); return void reply({ t: "facts", ok: false }); }
             const scopeCurrent = () => {
               const now = claudeSession(peer);
               return !stopping && bus.peers.get(peer) === nativePeer && nativePeer.sessionGeneration === started.generation && now.sessionId === started.session && (now.launchId ?? "") === started.launch;
@@ -7018,7 +7884,7 @@ export async function startDaemon(opts: DaemonOptions) {
               if (tasks.isPii(now)) return { id: now.id, title: tasks.publicTitle(now), private: true };
               if (task.history.length !== now.history.length || !statuses.has(task.id)) throw new Error("task changed");
               const status = statuses.get(task.id)!;
-              const safeStatus = Object.fromEntries(["mode", "stage", "blockers", "ready", "actor", "next", "spec", "playbook", "criteria", "definition", "entry", "exit", "planConformance", "testIntegrity", "findings"].filter(key => key in status).map(key => [key, publicReadValue(status[key as keyof typeof status])]));
+              const safeStatus = Object.fromEntries(["mode", "stage", "blockers", "ready", "actor", "next", "spec", "playbook", "criteria", "definition", "entry", "exit", "planConformance", "testIntegrity", "evalGate", "findings"].filter(key => key in status).map(key => [key, publicReadValue(status[key as keyof typeof status])]));
               return { id: now.id, title: tasks.publicTitle(now), receipt: publicReadValue(tasks.publicView(now).sdlc), ...safeStatus };
             });
             current(); reply({ ok: true, public: true, mode: lifecycleConfig.mode, rows, truncated: selected.length > 100 });
@@ -7080,8 +7946,70 @@ export async function startDaemon(opts: DaemonOptions) {
         })().catch(() => reply({ ok: false, error: "lifecycle readback unavailable" }));
         return;
       }
+      case "room": {
+        const client = sock.data;
+        const personRoom = c.role === "console";
+        const roomCurrent = () => !stopping && !recoveryActive() && !bus.isRecoveryHeld
+          && sock.data === client && sock.readyState === WebSocket.OPEN && personRoom;
+        const roomFailure = () => reply({ ok: false, error: "room operation refused; check room state, authority and arguments" });
+        if (msg.op === "list" || msg.op === "status") {
+          if (msg.input !== undefined && (!msg.input || typeof msg.input !== "object" || Array.isArray(msg.input)
+            || Object.keys(msg.input).some(key => key !== "name") || (msg.input.name !== undefined && typeof msg.input.name !== "string"))) return roomFailure();
+          void roomCommands.rows(msg.input?.name, msg.op === "status").then(rooms => reply({ ok: true, rooms }), roomFailure);
+          return;
+        }
+        if (["inbox_list", "inbox_show", "inbox_done", "inbox_discard"].includes(msg.op)) {
+          if (!personRoom) return void reply({ ok: false, error: "room inbox is person-only" });
+          if (!roomCurrent() || Object.keys(msg).some(key => !["t", "op", "input", "rid"].includes(key))) return roomFailure();
+          const input = msg.input;
+          if (!input || typeof input !== "object" || Array.isArray(input)) return roomFailure();
+          if (msg.op === "inbox_list") {
+            if (Object.keys(input).some(key => key !== "name") || (input.name !== undefined && typeof input.name !== "string")) return roomFailure();
+            void roomCommands.inboxRows(input.name, roomCurrent).then(inbox => {
+              if (!roomCurrent()) return roomFailure();
+              reply({ ok: true, inbox });
+            }, error => {
+              if (!roomCurrent()) return roomFailure();
+              if (error instanceof RoomStoreError && error.code === "inbox_list_limit") return reply({ ok: false, code: "inbox_list_limit" });
+              roomFailure();
+            });
+            return;
+          }
+          if (Object.keys(input).length !== 1 || typeof input.id !== "string" || !Object.hasOwn(input, "id")) return roomFailure();
+          const operation = msg.op === "inbox_show" ? roomCommands.inboxShow(input.id, roomCurrent)
+            : roomCommands.inboxDispose(input.id, msg.op === "inbox_done" ? "done" : "discard", roomCurrent);
+          void operation.then(item => {
+            if (!roomCurrent()) return roomFailure();
+            if (!item) return reply({ ok: false, code: "inbox_not_found" });
+            reply({ ok: true, item });
+            if (msg.op !== "inbox_show") roomCommands.retryInboxPending();
+          }, roomFailure);
+          return;
+        }
+        if (!personRoom) return void reply({ ok: false, error: "room mutations are person-only" });
+        if (!roomCurrent()) return roomFailure();
+        if (msg.op === "preview") {
+          roomTickets.delete(sock);
+          void roomCommands.preview(msg.action, msg.input, roomCurrent).then(preview => {
+            if (!roomCurrent()) return roomFailure();
+            const ticket = crypto.randomUUID();
+            roomTickets.set(sock, { id: ticket, expires: Date.now() + 30_000, preview });
+            reply({ ok: true, owner: preview.owner, member: preview.member, ticket });
+          }, roomFailure);
+          return;
+        }
+        if (msg.op === "execute") {
+          const ticket = roomTickets.get(sock); roomTickets.delete(sock);
+          if (!ticket || msg.ticket !== ticket.id || Date.now() >= ticket.expires
+            || typeof msg.confirm !== "string" || !/^[0-9a-f]{16,64}$/.test(msg.confirm) || !ticket.preview.member.startsWith(msg.confirm)
+            || Object.keys(msg).some(key => !["t", "op", "ticket", "confirm", "rid"].includes(key))) return roomFailure();
+          void ticket.preview.commit().then(result => reply({ ok: true, ...result }), roomFailure);
+          return;
+        }
+        return void reply({ ok: false, error: "unknown room operation" });
+      }
       case "status":
-        return void reply({ t: "status", status: status(c.role === "console") });
+        return void reply({ t: "status", status: status(c.role === "console", false, true) });
       case "cli_audit_ack": {
         if (c.role !== "console") return void reply({ ok: false, error: "cli_audit_ack is a console command" });
         if (typeof msg.auditId !== "string" || !/^[a-f0-9-]{36}$/.test(msg.auditId)) return void reply({ ok: false, error: "invalid audit id" });
@@ -7102,9 +8030,10 @@ export async function startDaemon(opts: DaemonOptions) {
         void uiAction(msg.action).then((result) => reply(result as Record<string, unknown>), () => reply({ ok: false, error: "dashboard action failed; check its inputs" }));
         return;
       case "task_catalog_role":
-        if (c.role !== "console") return void reply({ ok: false, error: "task roles are a person command" });
+        // #933: an agent changes its own task's role (Tasks.setRole refuses another peer's task); a child, read-only or private context never does.
+        if (c.role !== "console" && (c.role !== "tools" || !c.peer || c.toolsOwner || c.externalOwner || readOnlyPeer(c.peer) || contextPii(c.peer))) return void reply({ ok: false, error: "task roles are a person command" });
         if (recoveryActive() || stopping) return void reply({ ok: false, error: "recovery or shutdown is holding task role changes" });
-        try { const task = tasks.setRole(USER, msg.id, msg.role); return void reply({ ok: true, text: `task #${task.id}: catalog role ${task.role ?? "none"}` }); }
+        try { const task = tasks.setRole(c.role === "console" ? USER : c.peer!, msg.id, msg.role); return void reply({ ok: true, text: `task #${task.id}: catalog role ${task.role ?? "none"}` }); }
         catch (error) { return void reply({ ok: false, error: (error as Error).message }); }
       case "settings_get":
         if (c.role !== "console") {
@@ -7167,7 +8096,7 @@ export async function startDaemon(opts: DaemonOptions) {
       case "peer_start":
         // #269: a start the hub makes in the peer's start mode, for a console child with no terminal of its own.
         if (c.role !== "console") return void reply({ ok: false, error: "peer_start is a console command; use hub_peer_start with the conductor role" });
-        void hubStart(msg.peer, "the console").then(result => reply(includeRetainedLaunchConfig(String(msg.peer), result)), (error) => { log(`peer_start ${String(msg.peer)} failed: ${(error as Error).message}`); reply({ ok: false, error: "peer start failed; inspect ahub status and hub.log" }); });
+        void hubStart(msg.peer, "the console", true).then(result => reply(includeRetainedLaunchConfig(String(msg.peer), result)), (error) => { log(`peer_start ${String(msg.peer)} failed: ${(error as Error).message}`); reply({ ok: false, error: "peer start failed; inspect ahub status and hub.log" }); });
         return;
       case "peer_stop":
         let stopCurrent:(()=>void)|undefined;
@@ -7186,13 +8115,34 @@ export async function startDaemon(opts: DaemonOptions) {
           });
         return;
       case "task":
+        if (c.role === "tools" && msg.op === "task_unassign") {
+          if (conductorPeer(config.roles) !== c.peer) return void reply({ t: "task", ok: false, error: "task_unassign is a console command" });
+          try {
+            const current = admitOperational(sock, "task unassign");
+            void childToolAuthority.run({ by: c.peer!, current: () => { current(); return true; } },
+              () => taskOp(c.peer!, "task_unassign", msg.args ?? {})).then(
+                text => reply({ t: "task", ok: true, text }),
+                error => reply({ t: "task", ok: false, error: error instanceof Error ? error.message : "unassign refused" }));
+          } catch (error) { reply({ t: "task", ok: false, error: error instanceof Error ? error.message : "unassign refused" }); }
+          return;
+        }
         if (c.role === "tools" && msg.op === "release_show") {
           try { const current = publicReadCurrent(sock); current(); const release = publicReleaseShow(msg.args ?? {}); current(); return void reply({ t: "task", ok: true, text: JSON.stringify(release) }); }
           catch { return void reply({ t: "task", ok: false, error: "public release read unavailable" }); }
         }
         if (c.toolsOwner && !IMPLEMENTER_HUB_TOOL_NAMES.includes(String(msg.op))) return void reply({ t: "task", ok: false, error: "tool is not available to this Claude implementer child" });
         if (recoveryActive() && recoveryPhase !== "preparing" && String(msg.op) !== "hub_checkpoint") return void reply({ t: "task", ok: false, error: "recovery is holding mutations" });
-        (c.toolsOwner ? childToolAuthority.run({ by: c.peer!, current: captureImplementerTools(c) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : taskOp(c.peer ?? USER, String(msg.op), msg.args ?? {})).then(
+        if (c.role === "tools" && c.peer && Object.hasOwn(CONDUCTOR_TASK_OPS, String(msg.op))) {
+          // #933: a console task op the conductor may run: admitted (role recheck and one audit row) before Tasks sees it; Tasks asks `operational` again.
+          let current: () => void;
+          try { current = admitOperational(sock, CONDUCTOR_TASK_OPS[String(msg.op)]!); } catch (error) { return void reply({ t: "task", ...operationalFailure(error) }); }
+          void operationalContext.run({ actor: c.peer, current }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})).then(
+            (text) => reply({ t: "task", ok: true, text }),
+            (e: Error) => reply({ t: "task", ...operationalFailure(e) }),
+          );
+          return;
+        }
+        (c.externalOwner ? childToolAuthority.run({ by: c.peer!, current: () => currentExternalTools(c, true) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : c.toolsOwner ? childToolAuthority.run({ by: c.peer!, current: captureImplementerTools(c) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : taskOp(c.peer ?? USER, String(msg.op), msg.args ?? {})).then(
           (text) => reply({ t: "task", ok: true, text }),
           (e: Error) => reply({ t: "task", ok: false, error: e.message }),
         );
@@ -7205,23 +8155,41 @@ export async function startDaemon(opts: DaemonOptions) {
         return;
       }
       case "goal_link":
-        // #258: a person links a board task to a long-term task (`ahub goal link`); the link goes through Tasks.
-        if (c.role !== "console") return void reply({ t: msg.t, ok: false, error: "goal_link is a console command" });
+        // #258: a person links a board task to a long-term task (`ahub goal link`); the link goes through Tasks. #933: the configured conductor too, admitted and audited here.
+        if (c.role !== "console" && c.role !== "tools") return void reply({ t: msg.t, ok: false, error: "goal_link is a console command" });
         try {
-          const text = tasks.linkGoal(USER, msg.task, msg.goal);
+          if (c.role === "tools") admitOperational(sock, "goal link");
+          const text = tasks.linkGoal(c.role === "console" ? USER : c.peer!, msg.task, msg.goal);
           const linked = board.get(Number(msg.task));
           if (linked?.state === "in_progress" && !tasks.isPii(linked)) renewLeases(linked); // already being worked on: hold it now
           return void reply({ t: msg.t, ok: true, text });
         }
-        catch (e) { return void reply({ t: msg.t, ok: false, error: (e as Error).message }); }
-      case "ask":
+        catch (e) { return void reply({ t: msg.t, ...operationalFailure(e) }); }
+      case "ask": {
         // Console only: the evidence may hold PII task text (on campus), and the answer is for the person at the terminal.
         if (c.role !== "console") return void reply({ t: "ask", ok: false, error: "ask is a console command" });
+        const client = sock.data, revision = configRevision, policy = corpusPolicyVersion();
+        const callerPrivate = () => !!client.peer && contextPii(client.peer);
+        const initialPrivate = callerPrivate();
+        const isPiiText = (text: string) => activeRouting().constraints.pii === "local_only" && detectSignals({ title: text, detail: "", refs: {} }, activeRouting(), opts.cwd).includes("pii");
+        let evidencePrivacy: readonly TaskEvidencePrivacy[] = [];
+        const askCurrent = () => !stopping && sock.data === client && sock.readyState === WebSocket.OPEN
+          && configRevision === revision && corpusPolicyVersion() === policy && callerPrivate() === initialPrivate
+          && evidencePrivacy.every(previous => {
+            const latest = board.get(previous.id);
+            if (!latest || latest.created !== previous.created) return false;
+            const privacy = taskEvidencePrivacy(latest, { isPii: task => tasks.isPii(task), isPiiText });
+            return privacy.pii === previous.pii && privacy.notePii === previous.notePii;
+          });
         ask(String(msg.question ?? ""), {
           board,
           isPii: (t) => tasks.isPii(t),
           onCampus,
-          isPiiText: (q) => activeRouting().constraints.pii === "local_only" && detectSignals({ title: q, detail: "", refs: {} }, activeRouting(), opts.cwd).includes("pii"),
+          current: askCurrent,
+          privateContext: callerPrivate,
+          bindTaskEvidence: rows => { evidencePrivacy = rows; },
+          corpus: keys => publicCorpus(keys.join(" "), askCurrent),
+          isPiiText,
           ...(config.memory.enabled ? { memory } : {}),
           // #258: entries that match the question, then the graph neighbourhood of what they are about.
           ...(memoryStore ? { native: (keys: string[]) => {
@@ -7237,6 +8205,7 @@ export async function startDaemon(opts: DaemonOptions) {
           ...(inference ? { inference } : {}),
         })
           .then(async (res) => {
+            if (!askCurrent()) return void reply({ t: "ask", ok: true, found: false, evidence: [], pii: true, note: "evidence context changed" });
             let saved: string | undefined;
             if (msg.remember) {
               if (res.pii) saved = "not saved: PII is involved";
@@ -7257,6 +8226,7 @@ export async function startDaemon(opts: DaemonOptions) {
           })
           .catch((e: Error) => reply({ t: "ask", ok: false, error: e.message }));
         return;
+      }
       case "budget":
         if (c.role !== "console") {
           if (msg.resume !== undefined || msg.set !== undefined) return void reply({ t: "budget", ok: false, error: "budget mutations are console commands" });
@@ -7333,6 +8303,8 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   async function stopOnce(): Promise<void> {
     stopping = true;
+    roomCommands.stop();
+    tasks.stopQueuePressureRechecks();
     let implementerShellCleanupFailed = false;
     const implementerShellStopped = implementerShellStart?.then(wrapper => wrapper.close()).catch(() => { implementerShellCleanupFailed = true; log("host shell cleanup failed during shutdown"); });
     terminalLaunches.clear();
@@ -7349,10 +8321,19 @@ export async function startDaemon(opts: DaemonOptions) {
     dashboard?.stop();
     stopConfigWatch();
     clearInterval(sweepTimer);
+    clearInterval(schedulesTimer);
+    tasks.stopCiWatchers(); // #785 P1b: no per-head CI watcher outlives the hub
     for (const i of intervals) clearInterval(i);
     for (const pending of checkpointWaits.values()) pending.done(undefined);
     for (const p of permissions.values()) p.done(undefined);
     try {
+      // A schedules pass may be inside its PII screen: `stopping` is set, so its fence refuses the write when the screen returns. Wait for it (bounded, the screen has
+      // its own timeout) before the peers stop, the board closes and the store closes, so no pass runs against a closed database.
+      if (schedulesPass || manualSchedulePasses.size) {
+        let timer: ReturnType<typeof setTimeout> | undefined;
+        await Promise.race([Promise.all([schedulesPass?.catch(() => undefined), ...manualSchedulePasses]), new Promise<void>(resolve => { timer = setTimeout(resolve, 5_000); timer.unref?.(); })]);
+        clearTimeout(timer);
+      }
       await Promise.all([terminalReadsStopped, codeFactsStopped, implementerShellStopped]);
       await terminalLaunches.settled();
       // A peer can still be inside memory recall or its native handshake when kill arrives.
@@ -7370,10 +8351,13 @@ export async function startDaemon(opts: DaemonOptions) {
       await runnerStopped;
       await Promise.all([...modelRelays.values()].map(relay => relay.close()));
       await egress?.close();
+      await webEgress?.close();
       await Promise.all([...piReceiptLedgers.values()].map(ledger => ledger.close()));
       collectClaudeUsage();
       for (const id of [...researchPending.keys()]) writeResearch(id); // the peers have stopped, so their turns have ended
       budget.close();
+      schedulesStore.close();
+      folderStore.close();
       conductorHolds.close();
       executionBudget.close();
       syncStop.abort(); // a sync in flight kills its git step and ends before the store closes
@@ -7417,7 +8401,8 @@ export async function startDaemon(opts: DaemonOptions) {
   bus.onQueues(); // initial restored holds are reported only after the listener is bound; writes status.json too
   log(`${RUN_START}${process.pid} control=127.0.0.1:${server.port} cwd=${opts.cwd}`);
   ready = true;
-  for (const name of CONFIG_SOURCE_FILES) {
+  tasks.scheduleQueuePressureRecheck();
+  for (const name of opts.configWatch === false ? [] : CONFIG_SOURCE_FILES) {
     const path = join(opts.cwd, ".agenthub", name);
     const listener = (current: import("node:fs").Stats, previous: import("node:fs").Stats) => {
       if (stopping || current.mtimeMs === previous.mtimeMs && current.size === previous.size && current.ino === previous.ino && current.nlink === previous.nlink) return;
@@ -7458,7 +8443,8 @@ export async function startDaemon(opts: DaemonOptions) {
   if (piAutoStart() && !recoveryActive() && !piRecovered) autoStartPi();
   // #843 AC3: at hub start, after the roster and the control socket exist; never awaited, so a slow probe delays no start.
   void sweepAgentDrift();
-  return { bus, token, port: server.port as number, bandEvaluations: () => bandEvaluations, sdlcFileReads: () => sdlcFileReads, stop, stopped: new Promise<void>((r) => (onStop = r)) };
+  // #515b: the loopback ports of the two egress proxies, for a host-only test that connects to the proxy this daemon actually started. Ports only: no list, no authority.
+  return { bus, token, port: server.port as number, egressPorts: () => ({ bash: egress?.port, web: webEgress?.port }), bandEvaluations: () => bandEvaluations, sdlcFileReads: () => sdlcFileReads, stop, stopped: new Promise<void>((r) => (onStop = r)) };
   } finally {
     if (!ready) for (const cleanup of startupCleanup.reverse()) { try { await cleanup(); } catch { /* preserve startup error */ } }
   }