@staix/agent-hub 0.24.0 → 0.26.0

package/src/hub/tasks.ts

@@ -1,8 +1,18 @@
+import { parseAttemptReceipt, parseResearchRunners, verifyAttemptReceipt } from "./research-runner.ts";
+import { approvalBinding, approvalText } from "./task-approval.ts";
 import type { InvocationRow } from "./invocations.ts";
 import type { ContextAdmission } from "./context-window.ts";
 import { queueBackpressure, queueBackpressurePolicy, type QueueBackpressureCode, type QueueBackpressurePolicy, type QueueBackpressureStatus, type QueuePressure } from "./queue-backpressure.ts";
 import { canonicalMemorySymbolNode, normalizeMemorySymbolInput, MEMORY_SYMBOL_LIMIT, type MemorySymbolNodes } from "./memory-symbols.ts";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+import { types } from "node:util";
+import { canonicalJson } from "./packs.ts";
+import { parseExperimentProtocol, parseExperimentAttempt, parseExperimentEvent, protocolHash, checkRunObservation, deliverableObservation, projectExperimentWithObservations, projectRunnerReceipt,
+  type ExperimentProtocolContract, type ExperimentProtocolRecord, type ExperimentAttemptRecord, type ExperimentWriteFence, type ExperimentHostEvidence, type ExperimentStatus } from "./research-experiments.ts";
+import { parseComparisonPlan, comparisonPlanHash, comparisonProjection, evaluatorIdentityHash, protocolApprovalBindingMatches, type ComparisonPlanV1 } from "./research-experiments.ts";
+import { parseResearchHandoff, studyProjection, campaignHash, parseResearchCampaign, type ResearchCampaignContract, type ResearchCampaignStatus } from "./research-campaign.ts";
+import type { ResearchCampaignRecord, ResearchUnitBinding, PreparedResearchUnit, HandoffOutboundRow } from "./board.ts";
+import { HANDOFF_EVENTS, HandoffRefusal, followBackLine, handoffEventFor, parseHandoff, type HandoffEvent } from "./handoff.ts";
 import { taskShellBindingValid, type TaskShellBinding } from "./task-shell-command.ts";
 import { buildTaskCodeSymbols, publicTaskCodeSymbols, taskCodeSymbolsDisjoint, HOST_CODE_SYMBOLS } from "./task-code-symbols.ts";
 import { normalizePlanSymbol, symbolsOverlap } from "./symbol-normalizer.ts";
@@ -12,7 +22,7 @@ import { completePlanInventory, planConformance, planConformanceBlockers, planFi
 import { RELEASE_TRAIN_HISTORY_LIMIT, releaseTrainData, releaseTrainReadiness, releaseMetrics } from "./sdlc-release.ts";
 import { cleanCostPlan, costMetrics, type CostPlan, type ReviewCost } from "./cost-governance.ts";
 import { qualifiedTitleRepos, siblingTitleRefs, specRefs } from "./spec-read.ts";
-import { folderDetail, MAX_NEW_PER_POLL, parseEvery, SOURCE_ID, scheduledDetail, scheduleKeyOf, type FolderEntry, type FolderRunResult, type FolderScan, type FolderStorePort, type ScannedFile, type ScheduleEntry, type ScheduleRunResult, type ScheduleStore } from "./schedules.ts";
+import { folderDetail, MAX_NEW_PER_POLL, scheduleNext, SOURCE_ID, scheduledDetail, scheduleKeyOf, type FolderEntry, type FolderRunResult, type FolderScan, type FolderStorePort, type ScannedFile, type ScheduleEntry, type ScheduleRunResult, type ScheduleStore } from "./schedules.ts";
 import { INTAKE_MAX_SOURCES, INTAKE_MAX_TEXT, intakeDetail, intakeSystemPrompt, intakeUserMessage, parseIntakeDetail, parseIntakeSplit, plannerRequestBody } from "./intake.ts";
 import { DEFAULT_BAND, EPISODE_LOOKBACK, sdlcMetrics, type BandMetric, type BandResult, type MetricTask, type MetricsReport, type SeriesPoint } from "./sdlc-metrics.ts";
 import { readSecurityScan } from "./security-baseline.ts";
@@ -30,7 +40,9 @@ import { CODE_SCOPE_LINE, evidenceOnlyNotice, type ReviewScope } from "./review-
 import { DEFAULT_MAX_NITS, parseReviewFindings, findingsForHead, findingHead as resolveFindingHead, findingTally, type ReviewFinding, type ReviewFindingSet } from "./review-findings.ts";
 import { readReleaseReadiness } from "./sdlc-release.ts";
 import { loadRoleCatalog, taskRole, taskRoleText, type RoleCatalog } from "./roles.ts";
-import { matchesPolicy } from "./path-policy.ts";
+import { matchesPolicy, policyRealPath, insideRoot } from "./path-policy.ts";
+import { isDenied } from "../local/deny.ts";
+import { foldSegment, isHubWritePath } from "./permission-mode.ts";
 import { correctionInput, resolveVisibleMemory } from "./memory-candidates.ts";
 import type { MemoryScreen } from "./read-tools.ts";
 import { withoutPii, mentionsPrivatePath } from "./memory-policy.ts";
@@ -48,7 +60,7 @@ const learnVerdict = (card: Pick<Task, "state" | "history">): "accepted" | "reje
 };
 import { approvedDeliverables, latestDeliverables, parseDeliverableClaims, publicDeliverables, type DeliverableRecord, type DeliverableStatus } from "./deliverables.ts";
 import { checkDeliverables, DeliverableRefusal, hashDeliverables, vetDeliverables, type DeliverablePorts } from "./deliverable-files.ts";
-import { isAbsolute, relative } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 import type { Briefs, NativeItem } from "../memory/brief.ts";
 import type { MemoryClient } from "../memory/client.ts";
 import { candidateTargetRevision, type CandidateInput, type CandidateStore, extractNodes, looksSecret, PROMOTED_KINDS, taskKey, type GoalView, type Kind, type MemoryStore, type Scope, type Tier } from "@staix/agent-mem";
@@ -174,6 +186,14 @@ export interface TasksDeps {
   quota?: () => Record<PeerId, { headroom: number; resetsAt?: number }>;
   /** Optional persisted task/run execution limits (issue #102). */
   executionBudget?: ExecutionBudget;
+  /** Project-scoped immutable-source metadata, read only before a study transaction. */
+  studySource?: (id: string) => { id: string; sha256: string; private: boolean } | undefined;
+  /** Host-only fixture clock; never read from model input or project configuration. */
+  studyNow?: () => number;
+  /** Host-only reader for this project's check-runner receipts; record inputs never supply a receipt. */
+  experimentCheck?: (run: string) => Promise<unknown>;
+  /** Fresh trusted machine-local runner registrations. A source-trust failure refuses new receipts. */
+  researchRunners?: () => unknown;
   /** Reviewer choice from recorded review outcomes (issue #35); off unless the project config turns it on. */
   review?: { adaptive: boolean; min_reviews: number; pool?: readonly string[]; rerotate?: boolean; same_family?: "fallback" | "never" };
   /** Peers whose recent deliveries all failed, with the reason (issue #89); routing skips them. */
@@ -375,6 +395,21 @@ export const GROOM_FYI_WINDOW_MS = 10 * 60_000;
  * PII handling, envelopes, briefs and memory notes are decided in one place.
  */
 /** #694: a PR staged at done with the commit or branch it was read for. */
+export interface ResearchCampaignReceipt { id: string; parentTaskId: number; revision: number; status: ResearchCampaignStatus; unitCount: number; units: ResearchUnitBinding[] }
+interface StudyReferences { parent: Task; adopted: Map<string, Task>; reused: Map<string, Task>; private: boolean; key: string }
+export interface ExperimentReceipt { kind: "protocol" | "attempt" | "event" | "receipt"; protocolHash: string; attemptId?: string; seq?: number; receiptId?: string }
+export interface ComparisonPlanReceipt { kind: "plan"; planHash: string }
+export interface ProtocolApprovalReceipt { protocolHash: string; evaluatorHash: string; approvedBy: string; approvedAt: number }
+export interface ExperimentAttemptView {
+  id: string; protocolHash: string; taskId: number; phase: "development" | "final"; status: ExperimentStatus; private: boolean;
+  protocol: unknown; events: unknown[]; evidence: Record<string, unknown>; eventsComplete: boolean; nextEventCursor?: number;
+  campaignRevision: number; approval: "approved" | "unapproved"; postHoc: "unknown" | "predeclared" | "post-hoc";
+  retryOf?: string; reproducesAttemptId?: string; independentlyReproduced: false;
+}
+export interface ExperimentView { attempts: ExperimentAttemptView[]; counts: { all: number; statuses: Record<ExperimentStatus, number> }; nextCursor?: number;
+  comparison?: { planHash: string; baselineAttemptId: string; variantAttemptId: string; approved: boolean; private: boolean; projection: ReturnType<typeof comparisonProjection> | "[pii]" } }
+interface ExperimentContext { task: Task; campaign: ResearchCampaignRecord; private: boolean; key: string; fence: ExperimentWriteFence }
+interface CompletionRefresh { revision: number; commit: string; state: "in_review" | "approved" }
 interface IdentityLink { repo: string; pr: number; basis: { commit?: string; branch?: string } }
 
 /** What one live check of a task's files says as a whole (#317): `unchanged` only when EVERY file measured unchanged. A change outranks a missing file, which outranks one the hub could not read. */
@@ -887,6 +922,7 @@ export class Tasks {
       ...(h.selfReview ? { selfReview: true } : {}),
       ...(h.reviewerFamily ? { reviewerFamily: screenHistoryText(h.reviewerFamily, "reviewer family") } : {}),
       ...(h.reviewerReason ? { reviewerReason: h.reviewerReason } : {}),
+      ...(h.reviewedHead ? { reviewedHead: h.reviewedHead } : {}),
       ...(h.reviewScope === "code" ? { reviewScope: "code" as const } : {}),
       ...(h.evidenceOnly ? { evidenceOnly: true as const } : {}),
       ...(h.unmetCriteria?.length ? { unmetCriteria: h.unmetCriteria } : {}),
@@ -901,7 +937,8 @@ export class Tasks {
     const sets = this.reviewFindingSets(task), current = findingsForHead(sets, this.findingHead(task));
     const symbolRepository = codeSymbols && this.codeSymbolsRepository(task);
     const publicSymbols = codeSymbols && symbolRepository ? publicTaskCodeSymbols(codeSymbols, this.reviewHead(task), symbolRepository.key, this.publicMetadataText) : undefined;
-    return { ...rest, ...(publicSymbols ? { codeSymbols: publicSymbols } : {}), ...(current.length ? { findings: findingTally(current) } : {}), ...(cancelled ? { cancelled: { ...cancelled, reason: screenHistoryText(cancelled.reason, "cancellation", cancelled.withheld), ...(cancelled.supersededBy ? { supersededBy: screenHistoryText(cancelled.supersededBy, "supersession", cancelled.withheld) } : {}) } } : {}), ...(external && this.nameable(external.url) ? { external } : {}), actualDates: actualTaskDates(task), ...(((this.d.sdlc?.config().mode ?? "off") !== "off" || this.d.sdlc?.config().workflow === "gsd-lite") ? { lifecycle: sdlcStatus(this.d.sdlc?.config() ?? sdlcConfig(undefined), task.sdlc, undefined, this.workflowView(task), undefined, sets, task.refs.commit) } : {}), title, detail, history: publicHistory };
+    const handedOff = this.d.board.handoffOrigin(task.id);   // #604: where another project's handoff came from; two ids, never text
+    return { ...rest, ...(approvalBinding(task) ? { approval: approvalBinding(task) } : {}), ...(handedOff ? { handoffOrigin: { projectId: handedOff.projectId, peer: handedOff.peer, ...(handedOff.originTask === null ? {} : { task: handedOff.originTask }) } } : {}), ...(publicSymbols ? { codeSymbols: publicSymbols } : {}), ...(current.length ? { findings: findingTally(current) } : {}), ...(cancelled ? { cancelled: { ...cancelled, reason: screenHistoryText(cancelled.reason, "cancellation", cancelled.withheld), ...(cancelled.supersededBy ? { supersededBy: screenHistoryText(cancelled.supersededBy, "supersession", cancelled.withheld) } : {}) } } : {}), ...(external && this.nameable(external.url) ? { external } : {}), actualDates: actualTaskDates(task), ...(((this.d.sdlc?.config().mode ?? "off") !== "off" || this.d.sdlc?.config().workflow === "gsd-lite") ? { lifecycle: sdlcStatus(this.d.sdlc?.config() ?? sdlcConfig(undefined), task.sdlc, undefined, this.workflowView(task), undefined, sets, task.refs.commit) } : {}), title, detail, history: publicHistory };
   }
 
   /** Console results expose direct approval and delivery holds, not just the chosen peer ids. */
@@ -1226,6 +1263,833 @@ export class Tasks {
     this.planningAuthority(by, task);
   }
 
+  private studiesRunning = 0;
+  private studyStopped = false;
+  private readonly studyDrainWaiters = new Set<() => void>();
+  studiesPending = (): number => this.studiesRunning;
+
+  async stopStudies(): Promise<void> {
+    this.studyStopped = true;
+    if (this.studiesRunning) await new Promise<void>(resolve => this.studyDrainWaiters.add(resolve));
+  }
+
+  private studyHold(): string | undefined {
+    try {
+      if (this.studyStopped || this.d.sweepHeld?.() || this.d.bus.isRecoveryHeld || this.d.bus.storageError)
+        return "study writes are held by recovery, shutdown or storage failure";
+    } catch { return "study write admission is unavailable"; }
+    return undefined;
+  }
+
+  private async studyWrite<T>(write: () => Promise<T>): Promise<T> {
+    this.studiesRunning++;
+    try { return await write(); } finally {
+      if (--this.studiesRunning === 0) { for (const resolve of this.studyDrainWaiters) resolve(); this.studyDrainWaiters.clear(); }
+    }
+  }
+
+  private studyFields(input: unknown, allowed: readonly string[]): Record<string, unknown> {
+    if (!input || typeof input !== "object" || Array.isArray(input) || types.isProxy(input)
+      || ![Object.prototype, null].includes(Object.getPrototypeOf(input)) || Object.getOwnPropertySymbols(input).length)
+      throw new PreEffectToolRefusal("study request must be a plain data object");
+    const fields = Object.getOwnPropertyDescriptors(input);
+    if (Object.entries(fields).some(([key, descriptor]) => !allowed.includes(key) || !Object.hasOwn(descriptor, "value")))
+      throw new PreEffectToolRefusal("study request has unknown fields or accessors");
+    return Object.fromEntries(Object.entries(fields).map(([key, descriptor]) => [key, descriptor.value]));
+  }
+
+  private studyId(value: unknown): string {
+    if (typeof value !== "string" || !/^rc-[a-f0-9]{12}$/.test(value)) throw new PreEffectToolRefusal("study id is invalid");
+    return value;
+  }
+
+  private studyNumber(value: unknown, field: string): number {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new PreEffectToolRefusal(`${field} must be a positive integer`);
+    return value;
+  }
+
+  private studyContract(value: unknown): ResearchCampaignContract {
+    try { return parseResearchCampaign(value); }
+    catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "invalid study contract"); }
+  }
+
+  private studyTime(): number {
+    const now = this.d.studyNow?.() ?? Date.now();
+    if (!Number.isFinite(now)) throw new PreEffectToolRefusal("study clock is unavailable");
+    return now;
+  }
+
+  private studyRecord(id: string, revision?: number): ResearchCampaignRecord {
+    let record: ResearchCampaignRecord | undefined;
+    try { record = this.d.board.researchCampaign(id, revision); }
+    catch { throw new PreEffectToolRefusal("study record is unavailable or invalid"); }
+    if (!record || record.project !== this.d.project) throw new PreEffectToolRefusal("study is unavailable in this project");
+    return record;
+  }
+
+  private studyParent(id: number): Task {
+    const parent = this.need(id, false, true, true);
+    if (this.places(parent).repositoryKey !== this.repositories.scope({}).key) throw new PreEffectToolRefusal("study parent is outside this project");
+    return parent;
+  }
+
+  /** Write receipts expose no contract text; only person-only approval returns the unit mapping. */
+  private studyReceipt(record: ResearchCampaignRecord, includeMapping = false): ResearchCampaignReceipt {
+    const units = this.d.board.researchCampaignBindings(record.id, record.revision);
+    return { id: record.id, parentTaskId: record.parentTaskId, revision: record.revision, status: record.status,
+      unitCount: units.length, units: includeMapping ? units : [] };
+  }
+
+  private studySource(id: string): { id: string; sha256: string; private: boolean } | undefined {
+    try {
+      const source = this.d.studySource?.(id);
+      return source && source.id === id && /^[a-f0-9]{64}$/.test(source.sha256) && typeof source.private === "boolean"
+        ? { id: source.id, sha256: source.sha256, private: source.private } : undefined;
+    } catch { return undefined; }
+  }
+
+  private studyLatest(id: string, revision: number): ResearchCampaignRecord {
+    const record = this.studyRecord(id);
+    if (record.revision !== revision || record.status === "closed") throw new PreEffectToolRefusal("study revision is stale or closed");
+    return record;
+  }
+
+  private studyFamily(parent: Task): Set<number> {
+    if (!parent.history.some(entry => entry.event === "draft approved")) throw new PreEffectToolRefusal("adoption requires an approved intake family");
+    const family = new Set<number>(), pending = [...(parent.deps ?? [])];
+    // ponytail: 512 dependency nodes bound intake provenance walks; a larger family needs indexed family identities.
+    while (pending.length) {
+      const id = pending.pop()!;
+      if (family.has(id)) continue;
+      if (family.size >= 512) throw new PreEffectToolRefusal("study intake family exceeds its bounded scope");
+      const task = this.d.board.get(id);
+      if (!task) throw new PreEffectToolRefusal("study intake family is incomplete");
+      family.add(id); pending.push(...(task.deps ?? []));
+    }
+    family.delete(parent.id);
+    return family;
+  }
+
+  private studyReferences(parentId: number, contract: ResearchCampaignContract, campaignId?: string): StudyReferences {
+    const parent = this.studyParent(parentId);
+    const profile = parent.profile ?? "dev", storedProfile = profile === (this.d.profile ?? "dev") ? this.d.profileData ?? profile : profile;
+    try {
+      if (profileClass(parent.profileClass ?? parent.class, storedProfile) !== parent.class) throw new Error("changed class");
+    } catch { throw new PreEffectToolRefusal("study parent profile class is unavailable or changed"); }
+    const sources = contract.sourceIds.map(id => {
+      const source = this.studySource(id);
+      if (!source)
+        throw new PreEffectToolRefusal("study source is unavailable in this project");
+      return source;
+    });
+    if (contract.budget) {
+      const budget = this.d.executionBudget?.status(contract.budget.id);
+      if (!budget || Array.isArray(budget)) throw new PreEffectToolRefusal("study budget is unavailable");
+    }
+    const adopted = new Map<string, Task>();
+    const family = contract.units.some(unit => unit.adoptTaskId !== undefined) ? this.studyFamily(parent) : new Set<number>();
+    for (const unit of contract.units) if (unit.adoptTaskId !== undefined) {
+      const task = this.studyParent(unit.adoptTaskId);
+      if (!family.has(task.id) || task.draft || !task.history.some(entry => entry.event === "draft approved"))
+        throw new PreEffectToolRefusal("study unit must adopt an approved intake child");
+      const binding = this.d.board.researchTaskBinding(task.id);
+      if (binding && (binding.campaignId !== campaignId || binding.unitId !== unit.id)) throw new PreEffectToolRefusal("intake child is already bound to another study unit");
+      adopted.set(unit.id, task);
+    }
+    const reused = new Map<string, Task>();
+    if (campaignId) for (const unit of contract.units) {
+      const previous = this.d.board.researchLatestUnitBinding(campaignId, unit.id);
+      if (previous) reused.set(unit.id, this.studyParent(previous.taskId));
+    }
+    const priv = this.isPii(parent) || sources.some(source => source.private) || [...adopted.values(), ...reused.values()].some(task => this.isPii(task))
+      || !this.nameable(JSON.stringify(contract));
+    const flows = (rows: Map<string, Task>) => [...rows].map(([unit, task]) => [unit, task.id, task.history.length]);
+    return { parent, adopted, reused, private: priv, key: JSON.stringify([parent.history.length, sources, flows(adopted), flows(reused), priv]) };
+  }
+
+  /** Always re-read persisted approval and limits at the dispatch write, including after a metadata await. */
+  private studyDispatchReason(task: Task, owner?: PeerId): string | undefined {
+    try {
+      const bound = this.d.board.researchDispatchBinding(task.id);
+      if (!bound) return undefined;
+      const { campaign, binding } = bound;
+      if (campaign.project !== this.d.project || campaign.status !== "approved" || !binding) return "study revision is not approved or its unit was removed";
+      const stop = campaign.contract.stopPolicy;
+      if (Date.parse(stop.deadline) <= this.studyTime()) return "study deadline has expired";
+      const units = this.d.board.researchCampaignBindings(campaign.id, campaign.revision);
+      if (units.length > stop.maxUnits || binding.round > stop.maxFollowUpRounds) return "study stop limit exceeded";
+      const budget = campaign.contract.budget;
+      if (budget?.hardCap.length) {
+        const ledger = this.d.executionBudget, current = ledger?.status(budget.id);
+        if (!ledger || !current || Array.isArray(current) || !campaign.eligibleOwners?.length ||
+          budget.hardCap.some(resource => resource === "tokens" || current.limits[resource] === undefined || resource === "model_calls" && current.limits.tokens !== undefined)) return "study hard-cap budget is unavailable";
+        if (budget.hardCap.some(resource => !current.units[resource] || current.units[resource]!.remaining <= 0 || current.units[resource]!.reason === "unknown_usage")) return "study hard-cap budget is exhausted or usage is unknown";
+        if (owner && (!campaign.eligibleOwners.includes(owner) || !ledger.covers(budget.id, task.id, owner, budget.hardCap)))
+          return "study owner is not covered by its named hard-cap budget";
+      }
+      return undefined;
+    } catch { return "study dispatch evidence is unavailable"; }
+  }
+
+  private studyDispatchCheck(task: Task, owner?: PeerId): void {
+    const reason = this.studyDispatchReason(task, owner);
+    if (reason) throw new PreEffectToolRefusal(reason);
+  }
+
+  private studyExcludedOwners(task: Task): PeerId[] {
+    return Object.keys(this.states()).filter(peer => this.studyDispatchReason(task, peer) !== undefined);
+  }
+
+  private studyEligibleOwners(contract: ResearchCampaignContract): string[] | undefined {
+    if (!contract.budget?.hardCap.length) return undefined;
+    const ledger = this.d.executionBudget, budget = ledger?.status(contract.budget.id);
+    if (!ledger || !budget || Array.isArray(budget) || contract.budget.hardCap.some(resource => resource === "tokens" || budget.limits[resource] === undefined || resource === "model_calls" && budget.limits.tokens !== undefined))
+      throw new PreEffectToolRefusal("study hard-cap requires an enabled budget with supported resource limits");
+    const eligible = budget.peers.filter(peer => ledger.instrumented(peer)).sort();
+    if (!eligible.length) throw new PreEffectToolRefusal("study hard-cap has no instrumented eligible owner");
+    return eligible;
+  }
+
+  private studyRoundCheck(original: ResearchCampaignRecord, contract: ResearchCampaignContract): void {
+    const added = contract.units.filter(unit => unit.round > 0 && !original.contract.units.some(previous => previous.id === unit.id && previous.round === unit.round));
+    if (!added.length) return;
+    const stored = this.d.board.researchCampaignBindings(original.id, original.revision), handoffs = this.d.board.researchHandoffs(original.id, original.revision);
+    for (const unit of added) {
+      // The revised contract decides which discovery units precede this round: a discovery added in the same revision has no stored binding, so it has no handoff and refuses.
+      const previous = contract.units.filter(value => value.round === unit.round - 1 && value.purpose === "discovery");
+      if (!previous.length || previous.some(value => {
+        const binding = stored.find(bound => bound.unitId === value.id && bound.round === value.round && bound.purpose === "discovery");
+        const handoff = binding && handoffs.find(handoff => handoff.handoff.unitId === value.id);
+        return !handoff || !handoff.handoff.insufficientEvidence && value.sourceIds.some(source => !handoff.handoff.evidence.some(item => item.sourceId === source));
+      })) throw new PreEffectToolRefusal("follow-up rounds require complete stored discovery handoffs or insufficientEvidence");
+    }
+  }
+
+  async studyHandoff(by: PeerId, input: unknown): Promise<{ campaignId: string; unitId: string; seq: number }> {
+    const requestCheck = this.requestCheck(by, () => this.studyHold());
+    let handoff: ReturnType<typeof parseResearchHandoff>;
+    try { handoff = parseResearchHandoff(input); } catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "invalid study handoff"); }
+    return this.studyWrite(async () => {
+      const campaign = this.studyRecord(handoff.campaignId, handoff.revision), task = this.studyParent(handoff.taskId);
+      if (by !== task.owner || task.state !== "in_progress" || this.d.privateTurn?.(by) && !this.isPii(task)) throw new PreEffectToolRefusal("handoff requires the current in-progress unit owner");
+      const sources = campaign.contract.sourceIds.map(id => this.studySource(id));
+      if (sources.some(source => !source)) throw new PreEffectToolRefusal("study handoff source is unavailable");
+      const sourceKey = JSON.stringify(sources);
+      const text = JSON.stringify(handoff);
+      const withheld = !this.nameable(text) || looksSecret(text) || await this.withholds("note", text, task);
+      requestCheck();
+      const current = this.studyParent(task.id);
+      if (current.history.length !== task.history.length || current.owner !== by || current.state !== "in_progress") throw new PreEffectToolRefusal("study handoff task changed during screening");
+      if (JSON.stringify(campaign.contract.sourceIds.map(id => this.studySource(id))) !== sourceKey) throw new PreEffectToolRefusal("study handoff sources changed during screening");
+      if ((withheld || this.studyReplayPrivacy(campaign, this.studyParent(campaign.parentTaskId))) && !this.isPii(current)) throw new PreEffectToolRefusal("study handoff privacy requires private task authority");
+      requestCheck();
+      try {
+        const saved = this.d.board.recordResearchHandoff(handoff, this.d.project, by, this.studyTime(), current.history.length);
+        return { campaignId: saved.handoff.campaignId, unitId: saved.handoff.unitId, seq: saved.seq };
+      } catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "study handoff was not saved"); }
+    });
+  }
+
+  /**
+   * #601: one page of receipts, one per campaign of this project, newest revision, never its question, scope, sources or unit text. At most 50 rows per call (the spec's readback bound), in id
+   * order, strictly after the optional cursor `after`; `next` names the last id of a page that has more behind it. The bound is in the Board query, not in a slice after loading everything.
+   */
+  studyList(by: PeerId, input: unknown): { campaigns: ResearchCampaignReceipt[]; next?: string } {
+    requireLocalTaskPeer(by);
+    const fields = this.studyFields(input, ["after"]);
+    const after = fields.after === undefined ? undefined : this.studyId(fields.after);
+    const page = this.d.board.researchCampaignPage(this.d.project, after, 50);
+    return { campaigns: page.ids.map(id => this.studyReceipt(this.studyRecord(id))), ...(page.next ? { next: page.next } : {}) };
+  }
+
+  studyShow(by: PeerId, input: unknown): ReturnType<typeof studyProjection> {
+    requireLocalTaskPeer(by);
+    const fields = this.studyFields(input, ["id"]), campaign = this.studyRecord(this.studyId(fields.id));
+    const bindings = this.d.board.researchCampaignBindings(campaign.id, campaign.revision);
+    const tasks = bindings.map(unit => this.d.board.get(unit.taskId)).filter((task): task is Task => !!task);
+    const ledger = this.d.executionBudget, configured = campaign.contract.budget, budget = configured && ledger?.status(configured.id);
+    const instrumentedPeers = tasks.flatMap(task => task.owner && ledger?.instrumented(task.owner) ? [task.owner] : []);
+    const projection = studyProjection({ campaign, bindings, tasks, handoffs: this.d.board.researchHandoffs(campaign.id), now: this.studyTime(), instrumentedPeers,
+      ...(budget && !Array.isArray(budget) ? { budget: { ...budget, coveredTaskIds: tasks.filter(task => task.owner && ledger?.covers(budget.id, task.id, task.owner, [])).map(task => task.id) } } : {}) });
+    projection.reasons = [...new Set([...projection.reasons, ...tasks.flatMap(task => { const reason = this.studyDispatchReason(task, task.owner ?? undefined); return reason ? [reason] : []; })])];
+    projection.held = projection.reasons.length > 0;
+    if (this.studyReplayPrivacy(campaign, this.studyParent(campaign.parentTaskId))) {
+      // IDs, counts, states and resource names only. Source references are private view data too.
+      for (const unit of projection.units) { unit.sourceIds = []; unit.duplicateSourceIds = []; unit.handoff.coveredSourceIds = []; }
+    }
+    return projection;
+  }
+
+  private studyReplayPrivacy(record: ResearchCampaignRecord, parent: Task): boolean {
+    return record.private || this.isPii(parent) || record.contract.sourceIds.some(id => {
+      const source = this.studySource(id);
+      return !source || source.private;
+    }) || this.d.board.researchCampaignBindings(record.id, record.revision).some(unit => {
+      const task = this.d.board.get(unit.taskId); return !task || this.isPii(task);
+    });
+  }
+
+  /**
+   * #604 (agent-hub#1030), ORIGIN side. Who may hand work to another project: the person, or a configured planner, or the conductor. The host (the daemon) has already resolved and
+   * checked the target; this is the authority and privacy gate before anything leaves this project, so a refusal here leaves no row in either board.
+   */
+  handoffOutAuthority(by: PeerId, piiTask?: Task): void {
+    requireLocalTaskPeer(by);
+    if (by !== USER && this.d.privateTurn?.(by)) throw new HandoffRefusal("pii_turn", "a handoff is unavailable during a private turn: nothing from it may leave this project");
+    if (piiTask && this.isPii(piiTask)) throw new HandoffRefusal("pii_task", "a [pii] task is not handed off: nothing about it leaves this project");
+    if (by !== USER && !this.d.roles?.[by]?.includes("planner") && this.d.operational?.(by) !== true) throw new HandoffRefusal("no_authority", "a handoff needs the person, a configured planner or the conductor");
+  }
+
+  /** ORIGIN side: remember what was handed over, once the target answered with its task id. */
+  handoffSent(by: PeerId, target: { projectId: string }, remoteTask: number, title: string, localTask?: number): void {
+    this.d.board.recordHandoffOutbound({ remoteProject: target.projectId, remoteTask, originPeer: by, ...(localTask === undefined ? {} : { localTask }), title: title.slice(0, 300), state: "proposed" });
+  }
+
+  /**
+   * TARGET side. The origin peer gets no identity or authority here: the task is an ownerless proposal made by the hub on the origin's behalf, with the origin recorded in its own table.
+   * The request was parsed closed by the origin and is parsed again here, because a control message is data from another process: the body is bounded, control characters are refused and the
+   * text is sanitized before it is stored. A `[pii]` result is refused whole, and nothing is left behind.
+   */
+  async handoffIn(origin: { projectId: unknown; peer: unknown; taskId?: unknown }, input: unknown, fence: () => string | undefined = () => undefined): Promise<{ task: number; state: string; note?: string }> {
+    const request = parseHandoff({ ...(input && typeof input === "object" && !Array.isArray(input) ? input as Record<string, unknown> : { invalid: true }), project: "local" });
+    if (typeof origin.projectId !== "string" || !origin.projectId || origin.projectId.length > 200 || typeof origin.peer !== "string" || !/^[a-z][a-z0-9-]{0,31}$/.test(origin.peer)
+      || origin.taskId !== undefined && (!Number.isSafeInteger(origin.taskId) || (origin.taskId as number) < 1)) throw new HandoffRefusal("invalid", "handoff origin is malformed");
+    if (origin.projectId === this.d.project) throw new HandoffRefusal("same_project", "that is this project: a task for this project goes through hub_task_propose");
+    // The fence is asked right before the board write and after every await: a recovery that began while the PII screen was pending must find nothing written (agent-hub#1030, review).
+    const held = (): void => { const reason = fence(); if (reason) throw new HandoffRefusal("invalid", reason); };
+    held();
+    // The spec issue the caller named is kept in the task itself, as its own line: the target's planner reads it from the detail, and `ahub task show` shows it there.
+    const issueLine = request.issue === undefined ? "" : `spec issue: #${request.issue} in this repository`;
+    const detail = sanitize([request.detail, issueLine, `[handed off from project ${origin.projectId} by ${origin.peer}${origin.taskId === undefined ? "" : ` (their task #${origin.taskId})`}]`].filter(Boolean).join("\n\n"));
+    const refs: TaskRefs = { ...(request.paths.length ? { paths: request.paths } : {}) };
+    const signals = this.signalsFor({ title: request.title, detail, refs, plan: {} });
+    if (signals.includes("pii")) throw new HandoffRefusal("pii_task", "the handed-off text matches a PII pattern; it is not stored here");
+    const screening = this.screenOn();
+    const screened = screening ? await this.screenCall(screenText({ title: request.title, detail: [detail, ...request.paths].join("\n"), plan: {} })) : undefined;
+    held();
+    if (screening && (!screened || screened.label !== "clear")) throw new HandoffRefusal("pii_task", "the handed-off text could not be cleared by the PII screen; it is not stored here");
+    let task = this.d.board.propose(HUB, { title: request.title, detail, class: request.class, refs, plan: {}, signals });
+    this.d.board.setHandoffOrigin(task.id, { projectId: origin.projectId, peer: origin.peer, ...(origin.taskId === undefined ? {} : { originTask: origin.taskId as number }) });
+    // From here the task and its origin are saved, so nothing below may fail the handoff: the origin must learn the task id, or the target keeps work nobody can track.
+    try { task = this.linkOnWrite(task); } catch { /* the lifecycle link is advice */ }
+    try { this.d.notify(`task ${this.publicTitle(task)} handed off from project ${origin.projectId} by ${origin.peer}`); } catch { /* never throw after a board write */ }
+    let note: string | undefined;
+    try { task = await this.assignOwner(task, HUB, {}); }
+    catch (error) {
+      if (error instanceof AssignmentUndeliveredError) { task = error.task; note = "the assignment is saved but its delivery is not confirmed yet; this hub retries it"; }
+      else note = "the task is saved but was not offered to an owner yet; this hub's routing offers it"; // a routing refusal leaves an ordinary proposal for the planner
+    }
+    return { task: task.id, state: task.state, ...(note ? { note } : {}) };
+  }
+
+  /** TARGET side: the origin recorded for a task, for `ahub task show` and the board. */
+  handoffOriginOf(taskId: number): { projectId: string; peer: string; originTask: number | null } | undefined {
+    const origin = this.d.board.handoffOrigin(taskId);
+    return origin ? { projectId: origin.projectId, peer: origin.peer, originTask: origin.originTask } : undefined;
+  }
+
+  /** ORIGIN side: the target reported a state change. Records it and tells the origin peer with one `kind: task` envelope. Idempotent: a state already recorded sends nothing. */
+  handoffEvent(input: unknown): { recorded: boolean } {
+    if (!input || typeof input !== "object" || Array.isArray(input)) throw new HandoffRefusal("invalid", "handoff event must be a data object");
+    const e = input as Record<string, unknown>;
+    if (typeof e.projectId !== "string" || !e.projectId || e.projectId.length > 200 || !Number.isSafeInteger(e.remoteTask) || (e.remoteTask as number) < 1
+      || typeof e.state !== "string" || !(HANDOFF_EVENTS as readonly string[]).includes(e.state)) throw new HandoffRefusal("invalid", "handoff event is malformed");
+    const row = this.d.board.handoffOutboundFor(e.projectId, e.remoteTask as number);
+    if (!row) throw new HandoffRefusal("invalid", "no handoff of ours is recorded for that task");
+    const pr = Number.isSafeInteger(e.pr) && (e.pr as number) > 0 ? e.pr as number : undefined, head = typeof e.head === "string" && /^[0-9a-f]{40}$/.test(e.head) ? e.head : undefined;
+    if (row.state === e.state && (pr === undefined || pr === row.pr) && (head === undefined || head === row.head)) return { recorded: false };
+    this.d.board.recordHandoffOutbound({ remoteProject: row.remoteProject, remoteTask: row.remoteTask, originPeer: row.originPeer, ...(row.localTask === null ? {} : { localTask: row.localTask }), title: row.title, state: e.state, ...(pr === undefined ? {} : { pr }), ...(head === undefined ? {} : { head }) });
+    const body = followBackLine(row.remoteTask, e.state as HandoffEvent, { pr, head });
+    if (row.originPeer !== USER && row.originPeer !== HUB) {
+      try { this.d.bus.publish(newEnvelope(HUB, body, { to: [row.originPeer], kind: "task", priority: "important", refs: { task: String(row.localTask ?? row.remoteTask) } })); }
+      catch { /* never throw after a board write */ }
+    }
+    return { recorded: true };
+  }
+
+  /**
+   * TARGET side, catch-up (#1030 design 4): the origin asks for the current state of the tasks it handed us, by id, after it was down. Answers only for tasks whose recorded origin IS the asking
+   * project, and only with the same fields a live event carries (the event name, a PR number, a full head), so an origin learns nothing it could not have been told live.
+   */
+  handoffStatesFor(projectId: unknown, taskIds: unknown): { task: number; state: HandoffEvent | "proposed"; pr?: number; head?: string }[] {
+    if (typeof projectId !== "string" || !projectId || projectId.length > 200 || !Array.isArray(taskIds) || taskIds.length > 200 || !taskIds.every(id => Number.isSafeInteger(id) && id > 0)) throw new HandoffRefusal("invalid", "handoff state request is malformed");
+    const out: { task: number; state: HandoffEvent | "proposed"; pr?: number; head?: string }[] = [];
+    for (const id of taskIds as number[]) {
+      const origin = this.d.board.handoffOrigin(id), task = origin?.projectId === projectId ? this.d.board.get(id) : undefined;
+      if (!task) continue;
+      const entry = task.history.findLast(h => handoffEventFor(h.event, task.state) !== undefined);
+      const state = entry ? handoffEventFor(entry.event, task.state) ?? "proposed" : "proposed";
+      const pr = typeof task.sdlc?.pr === "number" && Number.isSafeInteger(task.sdlc.pr) && task.sdlc.pr > 0 ? task.sdlc.pr : undefined;
+      const rawHead = task.refs.commit ?? task.sdlc?.head ?? task.sdlc?.localHead, head = typeof rawHead === "string" && /^[0-9a-f]{40}$/.test(rawHead) ? rawHead : undefined;   // the owner's commit, else the receipt's head; only a full SHA crosses
+      out.push({ task: id, state, ...(pr === undefined ? {} : { pr }), ...(head === undefined ? {} : { head }) });
+    }
+    return out;
+  }
+
+  /** ORIGIN side: record what a target answered to the catch-up, and tell the origin peer about a change this project missed while it was down. */
+  handoffCaughtUp(projectId: string, rows: { task: number; state: string; pr?: number; head?: string }[]): number {
+    let changed = 0;
+    for (const row of rows) {
+      if (!(HANDOFF_EVENTS as readonly string[]).includes(row.state)) continue;
+      try { if (this.handoffEvent({ projectId, remoteTask: row.task, state: row.state, ...(row.pr === undefined ? {} : { pr: row.pr }), ...(row.head === undefined ? {} : { head: row.head }) }).recorded) changed++; }
+      catch { /* a row we hold no handoff for is not ours */ }
+    }
+    return changed;
+  }
+
+  /** ORIGIN side, readback: what this project handed over, with the last state each target reported. */
+  handoffList(): HandoffOutboundRow[] { return this.d.board.handoffOutbound(); }
+
+  async studyDraft(by: PeerId, input: unknown): Promise<ResearchCampaignReceipt> {
+    const requestCheck = this.requestCheck(by, () => this.studyHold()); this.plannerWriteAuthority(by);
+    const fields = this.studyFields(input, ["parentTaskId", "contract"]), parentId = this.studyNumber(fields.parentTaskId, "parentTaskId");
+    const contract = this.studyContract(fields.contract);
+    if (contract.units.some(unit => unit.round !== 0)) throw new PreEffectToolRefusal("an initial study contains only round zero");
+    return this.studyWrite(async () => {
+      this.plannerWriteAuthority(by, this.studyParent(parentId));
+      const before = this.studyReferences(parentId, contract);
+      const withheld = await this.withholds("note", JSON.stringify(contract), before.parent);
+      requestCheck();
+      const current = this.studyReferences(parentId, contract); this.plannerWriteAuthority(by, current.parent);
+      if (current.key !== before.key) throw new PreEffectToolRefusal("study references changed during draft screening");
+      const record: ResearchCampaignRecord = { id: `rc-${randomBytes(6).toString("hex")}`, project: this.d.project, parentTaskId: parentId,
+        revision: 1, status: "draft", contract, hash: campaignHash(contract), private: current.private || withheld, createdBy: by, createdAt: this.studyTime() };
+      let saved: ResearchCampaignRecord;
+      requestCheck(); this.plannerWriteAuthority(by, current.parent);
+      try { saved = this.d.board.saveResearchCampaignDraft(record, undefined, current.parent.history.length); }
+      catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "study draft was not saved"); }
+      this.releaseNotice(`study ${saved.id} revision ${saved.revision} drafted`);
+      return this.studyReceipt(saved);
+    });
+  }
+
+  async studyRevise(by: PeerId, input: unknown): Promise<ResearchCampaignReceipt> {
+    const requestCheck = this.requestCheck(by, () => this.studyHold()); this.plannerWriteAuthority(by);
+    const fields = this.studyFields(input, ["id", "revision", "contract"]), id = this.studyId(fields.id), revision = this.studyNumber(fields.revision, "revision");
+    const contract = this.studyContract(fields.contract);
+    return this.studyWrite(async () => {
+      const original = this.studyLatest(id, revision);
+      this.plannerWriteAuthority(by, this.studyParent(original.parentTaskId));
+      const before = this.studyReferences(original.parentTaskId, contract, id);
+      this.studyRoundCheck(original, contract);
+      const withheld = await this.withholds("note", JSON.stringify(contract), before.parent);
+      requestCheck();
+      const latest = this.studyLatest(id, revision), current = this.studyReferences(latest.parentTaskId, contract, id);
+      this.plannerWriteAuthority(by, current.parent);
+      if (latest.hash !== original.hash || current.key !== before.key) throw new PreEffectToolRefusal("study changed during revision screening");
+      this.studyRoundCheck(latest, contract);
+      const next: ResearchCampaignRecord = { id, project: this.d.project, parentTaskId: latest.parentTaskId, revision: revision + 1, status: "draft",
+        contract, hash: campaignHash(contract), private: latest.private || current.private || withheld, createdBy: by, createdAt: this.studyTime() };
+      let saved: ResearchCampaignRecord;
+      requestCheck(); this.plannerWriteAuthority(by, current.parent);
+      try { saved = this.d.board.saveResearchCampaignDraft(next, revision, current.parent.history.length); }
+      catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "study revision was not saved"); }
+      this.releaseNotice(`study ${id} revision ${saved.revision} drafted`);
+      return this.studyReceipt(saved);
+    });
+  }
+
+  async studyApprove(by: PeerId, input: unknown): Promise<ResearchCampaignReceipt> {
+    const requestCheck = this.requestCheck(by, () => this.studyHold());
+    if (by !== USER) throw new PreEffectToolRefusal("study approval requires the person");
+    const fields = this.studyFields(input, ["id", "revision"]), id = this.studyId(fields.id), revision = this.studyNumber(fields.revision, "revision");
+    return this.studyWrite(async () => {
+      const original = this.studyRecord(id, revision), parent = this.studyParent(original.parentTaskId);
+      if (original.status === "approved") {
+        const privacy = this.studyReplayPrivacy(original, parent); requestCheck();
+        const replay = this.d.board.activateCampaign(id, revision, this.d.project, by, this.studyTime(), [], parent.history.length, privacy);
+        return this.studyReceipt(replay.campaign, true);
+      }
+      this.studyLatest(id, revision);
+      if (original.status !== "draft" || parent.draft) throw new PreEffectToolRefusal("study approval requires a draft and an approved parent input");
+      this.studyEligibleOwners(original.contract);
+      const before = this.studyReferences(parent.id, original.contract, id);
+      let priv = original.private || before.private || await this.withholds("note", JSON.stringify(original.contract), parent);
+      const prepared: PreparedResearchUnit[] = [];
+      for (const unit of original.contract.units) {
+        requestCheck();
+        const reused = before.reused.get(unit.id);
+        if (reused) { prepared.push({ unitId: unit.id, reuse: { taskId: reused.id, flowRevision: reused.history.length } }); continue; }
+        const adopted = before.adopted.get(unit.id);
+        if (adopted) { prepared.push({ unitId: unit.id, adopt: { taskId: adopted.id, flowRevision: adopted.history.length } }); continue; }
+        const title = `Study unit ${unit.id}`, detail = `Study: ${id} unit ${unit.id}\nQuestion: ${unit.question}\nPerspective: ${unit.perspective}\nRequired output: ${unit.requiredOutput}\nSources: ${unit.sourceIds.join(", ")}`;
+        priv ||= await this.withholds("task", detail, parent);
+        const refs = cleanRefs(parent.refs), signals = [...new Set([...this.signalsFor({ title, detail, refs }), ...parent.signals.filter(signal => ["pii", "pii_path", "urgent"].includes(signal))])];
+        prepared.push({ unitId: unit.id, create: { title, detail, class: parent.class, refs, signals,
+          ...(parent.profile ? { profile: parent.profile } : {}), ...(parent.profileClass ? { profileClass: parent.profileClass } : {}),
+        } });
+      }
+      requestCheck();
+      const latest = this.studyLatest(id, revision), current = this.studyReferences(parent.id, original.contract, id);
+      if (latest.hash !== original.hash || current.key !== before.key) throw new PreEffectToolRefusal("study changed during approval screening");
+      const now = this.studyTime(), deadline = Date.parse(original.contract.stopPolicy.deadline);
+      if (deadline <= now || deadline - now > 90 * 86_400_000) throw new PreEffectToolRefusal("study deadline must be in the next ninety days at approval");
+      priv ||= latest.private || current.private;
+      if (priv && [...current.adopted.values(), ...current.reused.values()].some(task => !this.isPii(task)))
+        throw new PreEffectToolRefusal("a private study cannot retain a public task without changing its authority");
+      for (const unit of prepared) if (unit.create) {
+        if (priv && !unit.create.signals?.includes("pii")) unit.create.signals = [...(unit.create.signals ?? []), "pii"];
+        const planner = this.proposalPlanner({ ...parent, ...unit.create, signals: unit.create.signals ?? [], refs: unit.create.refs ?? {}, draft: undefined, state: "backlog", owner: null, reviewer: null });
+        unit.create.planner = planner.planner; unit.create.plannerReason = planner.plannerReason;
+        this.warmRepository({ refs: unit.create.refs ?? {}, plan: unit.create.plan });
+      }
+      const mode = this.d.coordination?.();
+      let result: ReturnType<Board["activateCampaign"]>;
+      requestCheck();
+      try { result = this.d.board.activateCampaign(id, revision, this.d.project, by, now, prepared, current.parent.history.length, priv, { eligibleOwners: this.studyEligibleOwners(original.contract) }); }
+      catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "study approval was not saved"); }
+      for (const child of result.children) {
+        this.incomingBacklog.add(child.id);
+        if (mode !== undefined) this.coordinationModes.set(child.id, mode);
+      }
+      this.releaseNotice(`study ${id} revision ${revision} approved; ${result.bindings.length} units`);
+      await this.studyReoffer(result.bindings.map(unit => unit.taskId));
+      return this.studyReceipt(result.campaign, true);
+    });
+  }
+
+  /**
+   * A unit held only because a newer draft existed lost its queued offer at delivery. Once a revision is approved, each retained unit task whose offer was dropped, that still has
+   * the same owner and has not been accepted, gets a fresh offer through the one offer path (`sendTask`), which re-runs `studyDispatchCheck`. The approval is already saved: a
+   * refusal here is a notice, never a failure of the approval.
+   */
+  private async studyReoffer(taskIds: readonly number[]): Promise<void> {
+    for (const taskId of taskIds) {
+      let owner: PeerId | undefined;
+      try { owner = this.d.board.researchDroppedOffer(taskId); } catch (e) { this.releaseNotice(`task #${taskId}: study dropped-offer record is unreadable: ${e instanceof Error ? e.message : String(e)}`); continue; }
+      if (owner === undefined) continue;
+      const task = this.d.board.get(taskId);
+      // The record names an owner that no longer holds the unproposed task: it is stale, not a pending offer.
+      if (!task || task.owner !== owner || task.state !== "proposed") { this.d.board.clearResearchDroppedOffer(taskId); continue; }
+      try {
+        await this.sendTask(task, { owner, ...(task.reviewer ? { reviewer: task.reviewer } : {}), trace: [] });
+        this.d.board.clearResearchDroppedOffer(taskId);   // after the offer is published: a refusal keeps the record for the next approval
+      } catch (e) { this.releaseNotice(`task ${this.publicTitle(task)}: could not re-offer after the study was approved: ${e instanceof Error ? e.message : String(e)}`); }
+    }
+  }
+
+  async studyClose(by: PeerId, input: unknown): Promise<ResearchCampaignReceipt> {
+    const requestCheck = this.requestCheck(by, () => this.studyHold()); this.plannerWriteAuthority(by);
+    const fields = this.studyFields(input, ["id", "revision", "reason"]), id = this.studyId(fields.id), revision = this.studyNumber(fields.revision, "revision");
+    if (typeof fields.reason !== "string" || !fields.reason.trim() || Buffer.byteLength(fields.reason, "utf8") > 512) throw new PreEffectToolRefusal("study close needs a bounded reason");
+    const reason = fields.reason;
+    return this.studyWrite(async () => {
+      const original = this.studyLatest(id, revision), parent = this.studyParent(original.parentTaskId);
+      this.plannerWriteAuthority(by, parent);
+      const withheld = await this.withholds("note", reason, parent);
+      requestCheck();
+      const latest = this.studyLatest(id, revision), currentParent = this.studyParent(latest.parentTaskId);
+      this.plannerWriteAuthority(by, currentParent);
+      if (latest.hash !== original.hash || currentParent.history.length !== parent.history.length) throw new PreEffectToolRefusal("study changed during close screening");
+      const priv = this.studyReplayPrivacy(latest, currentParent) || withheld || !this.nameable(reason);
+      let closed: ResearchCampaignRecord;
+      requestCheck(); this.plannerWriteAuthority(by, currentParent);
+      try { closed = this.d.board.closeCampaign(id, revision, this.d.project, by, this.studyTime(), reason, currentParent.history.length, priv); }
+      catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "study close was not saved"); }
+      this.releaseNotice(`study ${id} revision ${revision} closed`);
+      return this.studyReceipt(closed);
+    });
+  }
+
+  private experimentHash(input: unknown): string { return createHash("sha256").update(canonicalJson(input)).digest("hex"); }
+
+  private experimentId(input: unknown): string {
+    if (typeof input !== "string" || !/^ra-[a-f0-9]{12}$/.test(input)) throw new PreEffectToolRefusal("experiment identity is invalid");
+    return input;
+  }
+
+  private experimentProtocol(hash: string): ExperimentProtocolRecord {
+    try {
+      const record = this.d.board.experimentProtocol(hash);
+      if (record?.project === this.d.project) return record;
+    } catch { /* damaged records are never returned as evidence */ }
+    throw new PreEffectToolRefusal("experiment protocol is unavailable in this project");
+  }
+
+  private experimentAttempt(id: string): ExperimentAttemptRecord {
+    try {
+      const record = this.d.board.experimentAttempt(id);
+      if (record?.project === this.d.project) return record;
+    } catch { /* fail closed without including any stored body */ }
+    throw new PreEffectToolRefusal("experiment attempt is unavailable in this project");
+  }
+
+  private experimentContext(by: PeerId, taskId: number, protocol: ExperimentProtocolContract, recordedForTaskId = taskId): ExperimentContext {
+    const task = this.studyParent(taskId), bound = this.d.board.researchDispatchBinding(taskId);
+    if (task.owner !== by || task.state !== "in_progress") throw new PreEffectToolRefusal("experiment records require the current in-progress task owner");
+    if (this.d.privateTurn?.(by) && !this.isPii(task)) throw new PreEffectToolRefusal("a private turn cannot write experiment records on a public task");
+    const campaign = bound?.campaign;
+    // ponytail: new attempts against an older revision's protocol are refused; upgrade: explicit membership+source fence.
+    if (!bound?.binding || !campaign || campaign.project !== this.d.project || campaign.id !== protocol.campaignId || campaign.revision !== protocol.campaignRevision || campaign.status !== "approved")
+      throw new PreEffectToolRefusal("experiment task must be a unit of the protocol's current approved campaign revision");
+    const recording = this.d.board.researchDispatchBinding(recordedForTaskId), origin = this.studyParent(recordedForTaskId);
+    if (!recording?.binding || recording.campaign.id !== campaign.id || recording.campaign.revision !== campaign.revision || recording.campaign.status !== "approved")
+      throw new PreEffectToolRefusal("experiment recording task is no longer a unit of this campaign");
+    const sources = protocol.inputs.map(input => {
+      const source = this.studySource(input.sourceId);
+      if (!campaign.contract.sourceIds.includes(input.sourceId) || !source || source.sha256 !== input.sha256) throw new PreEffectToolRefusal("experiment input source identity or hash is unavailable in this campaign");
+      return source;
+    });
+    let artifactPrivate = false;
+    if ("deliverable" in protocol.code) {
+      const reference = protocol.code.deliverable, artifact = latestDeliverables(origin.history)?.find(value => value.id === reference.id && value.sha256 === reference.sha256);
+      if (!artifact) throw new PreEffectToolRefusal("experiment code deliverable identity is not recorded for its task");
+      artifactPrivate = artifact.private === true;
+    }
+    const privateRecord = this.studyReplayPrivacy(campaign, this.studyParent(campaign.parentTaskId)) || this.isPii(task) || this.isPii(origin) || artifactPrivate || sources.some(source => source.private);
+    const fence: ExperimentWriteFence = { project: this.d.project, taskId, taskFlowRevision: task.history.length, owner: by,
+      campaignId: campaign.id, campaignRevision: campaign.revision, campaignHash: campaign.hash };
+    return { task, campaign, private: privateRecord, fence, key: JSON.stringify([fence, sources, privateRecord, origin.history.length, recording.binding]) };
+  }
+
+  private experimentFresh(before: ExperimentContext, by: PeerId, protocol: ExperimentProtocolContract, recordedForTaskId?: number): ExperimentContext {
+    const current = this.experimentContext(by, before.task.id, protocol, recordedForTaskId);
+    if (current.key !== before.key) throw new PreEffectToolRefusal("experiment authority, source or campaign changed during admission");
+    return current;
+  }
+
+  private async experimentScreen(text: string, task: Task): Promise<void> {
+    if (!this.isPii(task) && (!this.nameable(text) || looksSecret(text) || await this.withholds("note", text, task)))
+      throw new PreEffectToolRefusal("experiment text was not cleared; nothing was recorded");
+  }
+
+  private experimentPlanContext(by: PeerId, taskId: number, plan: ComparisonPlanV1): ExperimentContext {
+    const task = this.studyParent(taskId), bound = this.d.board.researchDispatchBinding(taskId), campaign = bound?.campaign;
+    if (task.owner !== by || task.state !== "in_progress" || !bound?.binding || !campaign || campaign.project !== this.d.project
+      || campaign.id !== plan.campaignId || campaign.status !== "approved")
+      throw new PreEffectToolRefusal("comparison plans require the current in-progress campaign unit owner");
+    if (this.d.privateTurn?.(by) && !this.isPii(task)) throw new PreEffectToolRefusal("a private turn cannot write comparison plans on a public task");
+    const sources = plan.fixed.inputs.map(input => {
+      const source = this.studySource(input.sourceId);
+      if (!campaign.contract.sourceIds.includes(input.sourceId) || !source || source.sha256 !== input.sha256)
+        throw new PreEffectToolRefusal("comparison input source identity or hash is unavailable in this campaign");
+      return source;
+    });
+    const privateRecord = this.studyReplayPrivacy(campaign, this.studyParent(campaign.parentTaskId)) || this.isPii(task) || sources.some(source => source.private);
+    const fence: ExperimentWriteFence = { project: this.d.project, taskId, taskFlowRevision: task.history.length, owner: by,
+      campaignId: campaign.id, campaignRevision: campaign.revision, campaignHash: campaign.hash };
+    return { task, campaign, private: privateRecord, fence, key: canonicalJson([fence, privateRecord, sources, bound.binding]) };
+  }
+
+  private experimentApproved(record: ExperimentProtocolRecord): boolean {
+    const approval = this.d.board.experimentProtocolApproval(record.hash);
+    return protocolApprovalBindingMatches(record.protocol, approval && { protocolHash: approval.protocolHash, evaluatorHash: approval.evaluatorHash });
+  }
+
+  /** Approval is an explicit person's decision about immutable bytes, including historical protocols. */
+  async experimentApproveProtocol(by: PeerId, input: unknown): Promise<ProtocolApprovalReceipt> {
+    const requestCheck = this.requestCheck(by, () => this.studyHold());
+    if (by !== USER) throw new PreEffectToolRefusal("protocol approval is person only");
+    const fields = this.studyFields(input, ["hash"]);
+    if (typeof fields.hash !== "string" || fields.hash.length !== 64 || !/^[a-f0-9]{64}$/.test(fields.hash)) throw new PreEffectToolRefusal("protocol approval needs an exact protocol hash");
+    const hash = fields.hash;
+    return this.studyWrite(async () => {
+      requestCheck();
+      const record = this.experimentProtocol(hash), evaluatorHash = evaluatorIdentityHash(record.protocol);
+      requestCheck();
+      let saved;
+      try { saved = this.d.board.approveExperimentProtocol(this.d.project, hash, evaluatorHash, by, this.studyTime()); }
+      catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "protocol approval was not saved"); }
+      return { protocolHash: saved.protocolHash, evaluatorHash: saved.evaluatorHash, approvedBy: saved.approvedBy, approvedAt: saved.at };
+    });
+  }
+
+  /** Record evidence only: this path never runs a check, a shell command or a runner. */
+  async experimentRecord(by: PeerId, input: { kind: "plan"; [key: string]: unknown }): Promise<ComparisonPlanReceipt>;
+  async experimentRecord(by: PeerId, input: { kind: "protocol" | "attempt" | "event" | "receipt"; [key: string]: unknown }): Promise<ExperimentReceipt>;
+  async experimentRecord(by: PeerId, input: unknown): Promise<ExperimentReceipt | ComparisonPlanReceipt>;
+  async experimentRecord(by: PeerId, input: unknown): Promise<ExperimentReceipt | ComparisonPlanReceipt> {
+    const requestCheck = this.requestCheck(by, () => this.studyHold());
+    const envelope = this.studyFields(input, ["kind", "taskId", "protocol", "attempt", "attemptId", "idempotencyKey", "event", "plan", "receipt", "signature"]);
+    return this.studyWrite(async () => {
+      try {
+        if (envelope.kind === "receipt") {
+          const fields = this.studyFields(input, ["kind", "receipt", "signature"]), receipt = parseAttemptReceipt(fields.receipt);
+          const attempt = this.experimentAttempt(receipt.attemptId), record = this.experimentProtocol(attempt.attempt.protocolHash);
+          const relayOwner = by === USER ? this.studyParent(attempt.attempt.taskId).owner : by;
+          if (!relayOwner) throw new PreEffectToolRefusal("receipt relay requires a current task owner");
+          const before = this.experimentContext(relayOwner, attempt.attempt.taskId, record.protocol, record.recordedForTaskId);
+          requestCheck();
+          const proof = (stored: NonNullable<ReturnType<Board["runnerReceipt"]>>): ExperimentReceipt => ({ kind: "receipt", protocolHash: record.hash,
+            attemptId: attempt.attemptId, seq: stored.seq, receiptId: receipt.receiptId });
+          const known = this.d.board.runnerReceipt(receipt.receiptId);
+          if (known) {
+            if (canonicalJson(known.receipt) !== canonicalJson(receipt) || known.signature !== fields.signature)
+              throw new PreEffectToolRefusal("receiptId already records different signed bytes");
+            this.experimentFresh(before, relayOwner, record.protocol, record.recordedForTaskId); requestCheck();
+            return proof(known); // immutable stored proof: do not re-verify against a revoked/replaced registration or write on replay
+          }
+          const registrations = parseResearchRunners(this.d.researchRunners?.() ?? {}), registrationKey = canonicalJson(registrations);
+          const context = { projectId: this.d.project, attempt: { id: attempt.attemptId, projectId: attempt.project, protocolHash: attempt.attempt.protocolHash,
+            ...("commit" in record.protocol.code ? { codeCommit: record.protocol.code.commit } : {}) } };
+          verifyAttemptReceipt(receipt, fields.signature, { ...context, runners: registrations });
+          const lastSeq = this.d.board.experimentLastSeq(attempt.attemptId);
+          await this.experimentScreen(canonicalJson(receipt), before.task); requestCheck();
+          const current = this.experimentFresh(before, relayOwner, record.protocol, record.recordedForTaskId);
+          const latest = parseResearchRunners(this.d.researchRunners?.() ?? {});
+          if (canonicalJson(latest) !== registrationKey) throw new PreEffectToolRefusal("runner registration changed during receipt admission");
+          verifyAttemptReceipt(receipt, fields.signature, { ...context, runners: latest }); requestCheck();
+          const saved = this.d.board.appendRunnerReceipt({ receipt, signature: fields.signature as string, publicKey: latest[receipt.runner]!.publicKey,
+            by, at: this.studyTime(), private: current.private || record.private || attempt.private }, lastSeq, current.fence);
+          return proof(saved);
+        }
+        if (envelope.kind === "plan") {
+          const fields = this.studyFields(input, ["kind", "taskId", "plan"]), taskId = this.studyNumber(fields.taskId, "taskId"), plan = parseComparisonPlan(fields.plan);
+          const before = this.experimentPlanContext(by, taskId, plan);
+          await this.experimentScreen(canonicalJson(plan), before.task); requestCheck();
+          const current = this.experimentPlanContext(by, taskId, plan);
+          if (current.key !== before.key) throw new PreEffectToolRefusal("comparison authority, source or campaign changed during admission");
+          requestCheck();
+          const saved = this.d.board.saveExperimentComparisonPlan({ hash: comparisonPlanHash(plan), project: this.d.project, recordedForTaskId: taskId,
+            plan, by, at: this.studyTime(), private: current.private }, current.fence);
+          return { kind: "plan", planHash: saved.hash };
+        }
+        if (envelope.kind === "protocol") {
+          const fields = this.studyFields(input, ["kind", "taskId", "protocol"]), taskId = this.studyNumber(fields.taskId, "taskId"), protocol = parseExperimentProtocol(fields.protocol);
+          const before = this.experimentContext(by, taskId, protocol);
+          for (const reference of [protocol.variantOf, protocol.supersedes]) if (reference) {
+            const previous = this.experimentProtocol(reference);
+            if (previous.protocol.campaignId !== protocol.campaignId || reference === protocol.supersedes && previous.protocol.lineage !== protocol.lineage)
+              throw new PreEffectToolRefusal("experiment protocol reference belongs to another campaign or lineage");
+          }
+          await this.experimentScreen(canonicalJson(protocol), before.task); requestCheck();
+          const current = this.experimentFresh(before, by, protocol); requestCheck();
+          const saved = this.d.board.saveExperimentProtocol({ hash: protocolHash(protocol), project: this.d.project, recordedForTaskId: taskId, protocol, by, at: this.studyTime(), private: current.private }, current.fence);
+          return { kind: "protocol", protocolHash: saved.hash };
+        }
+        if (envelope.kind === "attempt") {
+          const fields = this.studyFields(input, ["kind", "attempt"]), attempt = parseExperimentAttempt(fields.attempt), record = this.experimentProtocol(attempt.protocolHash);
+          const before = this.experimentContext(by, attempt.taskId, record.protocol, record.recordedForTaskId);
+          for (const reference of [attempt.retryOf, attempt.reproducesAttemptId]) if (reference) {
+            const previous = this.experimentAttempt(reference), protocol = this.experimentProtocol(previous.attempt.protocolHash);
+            if (protocol.protocol.campaignId !== record.protocol.campaignId) throw new PreEffectToolRefusal("attempt reference belongs to another campaign");
+          }
+          await this.experimentScreen(canonicalJson(attempt), before.task); requestCheck();
+          const current = this.experimentFresh(before, by, record.protocol, record.recordedForTaskId); requestCheck();
+          const saved = this.d.board.createExperimentAttempt({ attemptId: `ra-${randomBytes(6).toString("hex")}`, project: this.d.project, attempt, bodyHash: this.experimentHash(attempt), by, at: this.studyTime(), private: current.private || record.private }, current.fence);
+          return { kind: "attempt", protocolHash: saved.attempt.protocolHash, attemptId: saved.attemptId };
+        }
+        if (envelope.kind === "event") {
+          const fields = this.studyFields(input, ["kind", "attemptId", "idempotencyKey", "event"]), id = this.experimentId(fields.attemptId), key = fields.idempotencyKey;
+          if (typeof key !== "string" || !key.trim() || key.length > 64 || Buffer.byteLength(key, "utf8") > 64 || Buffer.from(key, "utf8").toString("utf8") !== key) throw new PreEffectToolRefusal("event idempotencyKey needs at most 64 UTF-8 bytes");
+          const attempt = this.experimentAttempt(id), record = this.experimentProtocol(attempt.attempt.protocolHash), event = parseExperimentEvent(fields.event, record.protocol);
+          const before = this.experimentContext(by, attempt.attempt.taskId, record.protocol, record.recordedForTaskId), lastSeq = this.d.board.experimentLastSeq(id);
+          await this.experimentScreen(canonicalJson([key, event]), before.task); requestCheck();
+          this.experimentFresh(before, by, record.protocol, record.recordedForTaskId);
+          const observations: ExperimentHostEvidence[] = [];
+          let outputPrivate = event.kind === "output" && "path" in event.body ? this.experimentOutputPrivate(before.task, event.body.path) : false;
+          if (event.kind === "end" && event.body.run && this.d.experimentCheck) {
+            let receipt: unknown;
+            try { receipt = await this.d.experimentCheck(event.body.run); } catch { /* unavailable is unknown */ }
+            requestCheck(); this.experimentFresh(before, by, record.protocol, record.recordedForTaskId);
+            const observation = checkRunObservation(receipt, event.body.run, before.task.id, record.protocol);
+            if (observation) observations.push(observation);
+          } else if (event.kind === "output" && "path" in event.body) {
+            try {
+              const measured = await hashDeliverables([event.body], this.deliverablePorts(before.task));
+              const output = measured[0];
+              if (output) { observations.push(deliverableObservation(output)); outputPrivate ||= output.private === true; }
+            } catch { /* #509 refusal, missing or unreadable means unknown; never use a declared fallback hash */ }
+            requestCheck(); this.experimentFresh(before, by, record.protocol, record.recordedForTaskId);
+          }
+          const current = this.experimentFresh(before, by, record.protocol, record.recordedForTaskId); requestCheck();
+          if (event.kind === "output" && "path" in event.body) outputPrivate ||= this.experimentOutputPrivate(current.task, event.body.path);
+          const saved = this.d.board.appendExperimentEvent(id, key, event, observations, by, this.studyTime(), current.private || record.private || attempt.private || outputPrivate, lastSeq, current.fence);
+          return { kind: "event", protocolHash: record.hash, attemptId: id, seq: saved.event.seq };
+        }
+        throw new PreEffectToolRefusal("unsupported experiment record kind");
+      } catch (error) {
+        if (error instanceof PreEffectToolRefusal) throw error;
+        throw new PreEffectToolRefusal(error instanceof Error ? error.message : "experiment record was not saved");
+      }
+    });
+  }
+
+  private runnerKeyStatus(stored: NonNullable<ReturnType<Board["runnerReceipt"]>>): "active" | "revoked" | "replaced" | "unavailable" {
+    try {
+      const runners = parseResearchRunners(this.d.researchRunners?.() ?? {});
+      if (!Object.hasOwn(runners, stored.receipt.runner)) return "unavailable";
+      const current = runners[stored.receipt.runner]!;
+      if (current.publicKey !== stored.publicKey) return "replaced";
+      if (current.revoked) return "revoked";
+      return current.projects.includes(stored.receipt.projectId) ? "active" : "unavailable";
+    } catch { return "unavailable"; }
+  }
+
+  private experimentPrivate(record: ExperimentProtocolRecord, attempt: ExperimentAttemptRecord): boolean {
+    try {
+      const campaign = this.d.board.researchCampaign(record.protocol.campaignId, record.protocol.campaignRevision), task = this.d.board.get(attempt.attempt.taskId);
+      return record.private || attempt.private || !campaign || this.studyReplayPrivacy(campaign, this.studyParent(campaign.parentTaskId)) || !task || this.isPii(task)
+        || record.protocol.inputs.some(input => { const source = this.studySource(input.sourceId); return !source || source.private; });
+    } catch { return true; }
+  }
+
+  async experimentShow(by: PeerId, input: unknown): Promise<ExperimentView> {
+    return this.experimentRead(by, input);
+  }
+
+  private experimentRead(by: PeerId, input: unknown): ExperimentView {
+    requireLocalTaskPeer(by);
+    const fields = this.studyFields(input, ["attemptId", "campaignId", "after", "eventAfter", "limit", "planHash", "baselineAttemptId", "variantAttemptId"]);
+    const cursor = (value: unknown, name: string) => value === undefined ? 0 : typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : (() => { throw new PreEffectToolRefusal(`${name} must be a nonnegative integer`); })();
+    const after = cursor(fields.after, "after"), eventAfter = cursor(fields.eventAfter, "eventAfter"), limit = fields.limit === undefined ? 50 : this.studyNumber(fields.limit, "limit");
+    if (limit > 50) throw new PreEffectToolRefusal("experiment readback is limited to 50 rows");
+    if (fields.planHash !== undefined || fields.baselineAttemptId !== undefined || fields.variantAttemptId !== undefined) {
+      if (fields.attemptId !== undefined || fields.campaignId !== undefined || fields.after !== undefined
+        || typeof fields.planHash !== "string" || fields.planHash.length !== 64 || !/^[a-f0-9]{64}$/.test(fields.planHash))
+        throw new PreEffectToolRefusal("comparison readback needs one plan hash and two attempt ids");
+      const plan = this.d.board.experimentComparisonPlan(fields.planHash);
+      if (!plan || plan.project !== this.d.project) throw new PreEffectToolRefusal("comparison plan is unavailable in this project");
+      const baseline = this.experimentAttempt(this.experimentId(fields.baselineAttemptId)), variant = this.experimentAttempt(this.experimentId(fields.variantAttemptId));
+      const first = this.experimentProtocol(baseline.attempt.protocolHash), second = this.experimentProtocol(variant.attempt.protocolHash);
+      if (first.protocol.campaignId !== plan.plan.campaignId || second.protocol.campaignId !== plan.plan.campaignId)
+        throw new PreEffectToolRefusal("comparison attempts must belong to the plan's campaign");
+      const left = this.experimentRead(by, { attemptId: baseline.attemptId, eventAfter, limit });
+      const right = this.experimentRead(by, { attemptId: variant.attemptId, eventAfter, limit });
+      let planPrivate = true;
+      try {
+        const campaign = this.studyRecord(plan.plan.campaignId);
+        planPrivate = plan.private || this.studyReplayPrivacy(campaign, this.studyParent(campaign.parentTaskId))
+          || plan.plan.fixed.inputs.some(input => { const source = this.studySource(input.sourceId); return !source || source.private; });
+      } catch { /* an unavailable privacy classification withholds the comparison */ }
+      const privateRecord = planPrivate || left.attempts.some(row => row.private) || right.attempts.some(row => row.private);
+      return { attempts: [...left.attempts, ...right.attempts], counts: left.counts,
+        comparison: { planHash: plan.hash, baselineAttemptId: baseline.attemptId, variantAttemptId: variant.attemptId,
+          approved: this.experimentApproved(first) && this.experimentApproved(second), private: privateRecord,
+          projection: privateRecord ? "[pii]" : comparisonProjection(plan.plan, first.protocol, second.protocol) } };
+    }
+    let campaignId: string, attempts: ExperimentAttemptRecord[], nextCursor: number | undefined;
+    if (fields.attemptId !== undefined) {
+      if (fields.campaignId !== undefined || fields.after !== undefined) throw new PreEffectToolRefusal("choose one attempt or campaign page");
+      const attempt = this.experimentAttempt(this.experimentId(fields.attemptId));
+      campaignId = this.experimentProtocol(attempt.attempt.protocolHash).protocol.campaignId; attempts = [attempt];
+    } else {
+      campaignId = this.studyId(fields.campaignId); this.studyRecord(campaignId);
+      const page = this.d.board.experimentAttempts(this.d.project, campaignId, after, limit); attempts = page.rows;
+      if (!page.done) nextCursor = page.afterRow;
+    }
+    const summary = this.d.board.experimentSummary(this.d.project, campaignId), views: ExperimentAttemptView[] = [];
+    for (const attempt of attempts) {
+      const record = this.experimentProtocol(attempt.attempt.protocolHash), page = this.d.board.experimentEvents(attempt.attemptId, eventAfter, limit);
+      const runnerReceipts = this.d.board.runnerReceipts(attempt.attemptId);
+      const privateRecord = this.experimentPrivate(record, attempt) || page.rows.some(row => row.private)
+        || runnerReceipts.some(row => row.private || !this.nameable(canonicalJson(row.receipt)) || looksSecret(canonicalJson(row.receipt)));
+      const status = this.d.board.experimentAttemptStatus(attempt.attemptId);
+      const observations = page.rows.flatMap(row => row.observations), events = page.rows.map(row => row.event);
+      const evidence = { ...projectExperimentWithObservations(record.protocol, events, observations),
+        ...(runnerReceipts.length ? { runnerAttested: runnerReceipts.map(row => ({ ...projectRunnerReceipt(record.protocol, row.receipt), key: { hash: row.keyHash, status: this.runnerKeyStatus(row) } })) } : {}) };
+      views.push({ id: attempt.attemptId, protocolHash: record.hash, taskId: attempt.attempt.taskId, phase: attempt.attempt.phase, status, private: privateRecord,
+        campaignRevision: record.protocol.campaignRevision, approval: this.experimentApproved(record) ? "approved" : "unapproved",
+        postHoc: this.d.board.experimentProtocolContext(record.hash).state,
+        ...(attempt.attempt.retryOf ? { retryOf: attempt.attempt.retryOf } : {}), ...(attempt.attempt.reproducesAttemptId ? { reproducesAttemptId: attempt.attempt.reproducesAttemptId } : {}), independentlyReproduced: false,
+        protocol: { value: privateRecord ? "[pii]" : record.protocol, provenance: "declared" },
+        events: page.rows.map(row => privateRecord ? { seq: row.event.seq, kind: row.event.kind, at: row.event.at, provenance: row.event.provenance, body: "[pii]" } : row.event),
+        evidence: privateRecord ? { declared: "[pii]", measured: evidence.measured.map(row => ({ eventSeq: row.eventSeq, source: row.source, provenance: "host-observed", values: "[pii]" })), ...(runnerReceipts.length ? { runnerAttested: runnerReceipts.map(() => ({ provenance: "runner-attested", values: "[pii]" })) } : {}) } : evidence,
+        eventsComplete: page.done, ...(!page.done ? { nextEventCursor: page.afterSeq } : {}) });
+    }
+    return { attempts: views, counts: { all: summary.total, statuses: summary.statuses }, ...(nextCursor === undefined ? {} : { nextCursor }) };
+  }
+
   /** Every new host proposal, including split children, consumes the same pure walk before its first notification. */
   private proposalPlanner(task: Task): PlannerBinding {
     const choice = assign({ ...task, state: "proposed" }, this.states(), this.d.routing(), { ...this.weights(task.class, task), candidates: [] });
@@ -1449,7 +2313,7 @@ export class Tasks {
     const states = this.states();
     const full = this.plannerFull(task);
     // Preview the To Do transition without routing or offering the persisted backlog row.
-    return assign({ ...task, state: "proposed" }, states, routing, { exclude: this.excluded(task), excludeOwners: full, ...(reservedOnly && task.reserved ? { candidates: [task.reserved], namedOwner: task.reserved } : {}), waitsFor: this.waitsFor(task), ...this.weights(task.class, task, projectedHealth), ...(queueOverride ? { queueOverride, contextOverride: true } : {}) });
+    return assign({ ...task, state: "proposed" }, states, routing, { exclude: this.excluded(task), excludeOwners: [...full, ...this.studyExcludedOwners(task)], ...(reservedOnly && task.reserved ? { candidates: [task.reserved], namedOwner: task.reserved } : {}), waitsFor: this.waitsFor(task), ...this.weights(task.class, task, projectedHealth), ...(queueOverride ? { queueOverride, contextOverride: true } : {}) });
   }
 
   async pullPlanned(by: PeerId, input: { id: number; revision: number; reason: string }, opts: { onBehalfOf?: PeerId; guard?: () => void } = {}): Promise<Task> {
@@ -1491,6 +2355,7 @@ export class Tasks {
         const refusal = task.reserved ? `reserved peer ${task.reserved} cannot take the planner pull: ${assignment.refusals?.find(row => row.role === "owner" && row.peer === task.reserved)?.reason ?? "not eligible"}; ${this.plannerRefusal(task)}` : this.plannerRefusal(task);
         throw new PreEffectToolRefusal(`${this.hasPersonReservation(task) ? "a person's reservation is retained; " : ""}${refusal}`);
       }
+      this.studyDispatchCheck(task, assignment.owner);
       return { task, owner: assignment.owner, assignment };
     };
     const initial = validate(), withheld = await this.withholds("note", input.reason, initial.task);
@@ -1505,6 +2370,7 @@ export class Tasks {
         } } });
     }
     opts.guard?.();
+    this.studyDispatchCheck(current.task, current.owner);
     const pulled = this.d.board.pullPlanned(current.task.id, by, current.owner, input.revision, input.reason.trim(), withheld, this.plannerBinding(current.task, current.assignment, true));
     this.planningRecorded({ by, task: pulled.id, fields: ["pull", "reserved"], revision: pulled.planningRevision! });
     return pulled;
@@ -2489,6 +3355,12 @@ export class Tasks {
     }
     if (env.from === HUB && env.refs?.task) {
       const task = this.d.board.get(Number(env.refs.task));
+      if (env.kind === "task" && env.refs.taskOffer !== undefined && task?.owner === peer && this.studyDispatchReason(task, peer)) {
+        // The bus discards a false verdict for good and cannot hold the envelope. Remember the owner it was for (on the board, so it survives a restart), so approving the study again offers the retained task afresh.
+        try { this.d.board.recordResearchDroppedOffer(task.id, peer); }
+        catch (e) { this.releaseNotice(`task ${this.publicTitle(task)}: could not record the dropped study offer: ${e instanceof Error ? e.message : String(e)}`); }
+        return false;
+      }
       if (task?.state === "cancelled") return env.kind === "task" && typeof env.refs.taskCancelled === "number" && env.refs.taskCancelled === task.cancelled?.flowRevision;
       if (env.refs.taskRecipient === "planner") return !!task && this.taskPlanner(task).includes(peer);
       if (env.refs.planReview !== undefined) return !!task && !isClosedTaskState(task.state) && (task.planningRevision ?? 0) === env.refs.planReview
@@ -2728,6 +3600,12 @@ export class Tasks {
   private async assignOwner(task: Task, by: PeerId, opts: { current?: () => void; conductorManual?: true; queueOverride?: "owner"; candidates?: PeerId[]; namedOwner?: PeerId; event?: string; note?: string; reason?: TaskMoveReason; clearOnFail?: boolean; exclude?: PeerId[]; context?: string; contextWithheld?: boolean; claim?: boolean; override?: boolean; roster?: boolean; planner?: boolean; expectedFlowRevision?: number; refuseNamed?: "pre" | "plain"; plannerPull?: { revision: number; note: string; withheld: boolean; guard: () => void } } = {}): Promise<Task> {
     opts.current?.();
     if (task.state === "backlog" && !opts.plannerPull) throw new PreEffectToolRefusal(`task #${task.id}: pull backlog work before assigning it`);
+    const studyReason = this.studyDispatchReason(task, opts.namedOwner);
+    if (studyReason) {
+      if (opts.refuseNamed || opts.plannerPull || opts.claim) throw new PreEffectToolRefusal(studyReason);
+      if (task.state === "proposed" && !task.owner) this.holdReady(task, "study dispatch", studyReason);
+      return task;
+    }
     const mode = (this.d.sdlc?.config() ?? sdlcConfig(undefined)).mode;
     let stagedClaimGap: string | undefined;
     if (mode !== "off" && this.isBuildTask(task)) {
@@ -2755,7 +3633,7 @@ export class Tasks {
     const waits = this.waitsFor(task);
     const plannedMove = opts.planner || this.plannerPullRecord(task)?.pull === true && (by === HUB || opts.roster) && (opts.reason !== "manual" || opts.roster);
     const plannerFull = plannedMove ? this.plannerFull(task) : [];
-    const a = assign(opts.plannerPull ? { ...task, state: "proposed" } : task, this.states(), this.d.routing(), { exclude: [...(opts.override ? [] : this.excluded(task)), ...(opts.exclude ?? []), ...(opts.event === "escalated" && task.owner ? [task.owner] : [])], excludeOwners: plannerFull, ...(opts.candidates ? { candidates: opts.candidates } : {}), waitsFor: waits, ...this.weights(task.class, task), ...(opts.namedOwner ? { namedOwner: opts.namedOwner } : {}), // A self-claim hands over no envelope; reviewer admission remains automatic.
+    const a = assign(opts.plannerPull ? { ...task, state: "proposed" } : task, this.states(), this.d.routing(), { exclude: [...(opts.override ? [] : this.excluded(task)), ...(opts.exclude ?? []), ...(opts.event === "escalated" && task.owner ? [task.owner] : [])], excludeOwners: [...plannerFull, ...this.studyExcludedOwners(task)], ...(opts.candidates ? { candidates: opts.candidates } : {}), waitsFor: waits, ...this.weights(task.class, task), ...(opts.namedOwner ? { namedOwner: opts.namedOwner } : {}), // A self-claim hands over no envelope; reviewer admission remains automatic.
       contextOverride: !!(opts.queueOverride || opts.claim),
       ...(opts.queueOverride || opts.claim ? { queueOverride: opts.queueOverride ?? "owner" as const } : {}) });
 
@@ -2795,6 +3673,7 @@ export class Tasks {
     const binding = this.plannerBinding(task, a, !!opts.plannerPull);
     const assignmentExtra = { ...this.reviewMetadata(a, task), ...(binding ? { plannerReason: binding.plannerReason } : {}), ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}), ...(opts.conductorManual ? { conductorManual: true as const } : {}) };
     opts.current?.();
+    this.studyDispatchCheck(this.d.board.get(task.id) ?? task, a.owner);
     const next = opts.plannerPull
       ? this.d.board.pullAssigned(task.id, by, a.owner, opts.plannerPull.revision, opts.plannerPull.note, opts.plannerPull.withheld, a.reviewer ?? null, assignmentNote, assignmentExtra, task.history.length, binding)
       : this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(binding ? { planner: binding.planner } : {}), ...(opts.roster && task.state === "in_progress" ? { state: "proposed" as const } : {}), ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, assignmentNote, assignmentExtra, opts.expectedFlowRevision);
@@ -2857,6 +3736,7 @@ export class Tasks {
         this.releaseNotice(this.specText(next, "missing", "advice"));
       }
       if (stagedClaimGap) return next; // An explicit claim may reserve its owner, but no offer or acceptance bypasses review.
+      this.studyDispatchCheck(next, by);
       const claimed = this.d.board.update(next.id, by, "accepted", { state: "in_progress" });
       this.captureOwnerAcceptance(claimed);
       this.releaseNotice(`task ${this.publicTitle(claimed)} claimed by ${by}`);
@@ -2917,6 +3797,7 @@ export class Tasks {
     currentAuthority?.();
     const current = this.d.board.get(task.id);
     if (!current || !this.ownerAssignmentCurrent(task, current)) throw new AssignmentSupersededError(current ?? task);
+    this.studyDispatchCheck(current, current.owner ?? undefined);
     task = current;
     const pii = this.isPii(task), delivery = { ...a, reviewer: task.reviewer ?? undefined };
     const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${this.screen(task, h.note ?? "", "review note", delivery.owner, h.withheld)}`);
@@ -2945,8 +3826,10 @@ export class Tasks {
     const idle = this.d.bus.stateOf(owner) === "idle";
     const env = newEnvelope(HUB, body, { to: [owner], kind: "task", priority: "important", refs: { ...task.refs, task: String(task.id), taskRecipient: "owner", taskOffer: task.history.length }, ...(pii ? { private: true } : {}) });
     currentAuthority?.();
+    this.studyDispatchCheck(task, owner);
     this.d.board.recordTaskOffer(task.id, { envelopeId: env.id, owner, assignmentFlowRevision: task.history.length, ...(this.d.offerPullOnly ? { pullOnly: this.d.offerPullOnly(owner) } : {}) }, task.history.length);
     currentAuthority?.();
+    this.studyDispatchCheck(task, owner);
     this.d.bus.publish(env);
     if (idle && this.d.bus.stateOf(owner) === "busy" && !this.d.bus.queueIds(owner).includes(env.id)) this.sent.set(handOver(task, owner), owner);
   }
@@ -3767,7 +4650,7 @@ export class Tasks {
       for (const entry of entries) {
         const row = store.ensure(entry.id, now);
         if (row.paused) continue; // #335: a person's pause is neither a run nor a skipped tick
-        if (now < row.anchor + parseEvery(entry.every)) continue;
+        if (now < scheduleNext(entry, row.anchor)) continue;
         out.push(await this.runSchedule(store, entry, now, extraHold));
       }
     } finally { this.schedulesRunning = false; }
@@ -4028,7 +4911,7 @@ export class Tasks {
 
   /** The board as the merge queue and the guarded merge read it (#786): ids, dependencies, privacy, receipts, findings and plans. */
   private deliveryLinks(config: SdlcConfig): DeliveryTask[] {
-    return this.d.board.list().map(t => ({ id: t.id, after: t.deps ?? [], private: this.isPii(t), receipt: t.sdlc, phase: this.isPii(t) ? undefined : this.workflowView(t), findings: this.isPii(t) ? undefined : this.reviewFindingSets(t), plan: config.mode === "off" || this.isPii(t) ? undefined : { paths: this.planPaths(t), revision: t.history.findLast(h => h.planRevision)?.planRevision?.revision ?? 0, fingerprint: planFingerprint(t.plan ?? {}), accepted: this.validPlanDepartures(t) } }));
+    return this.d.board.list().map(t => ({ id: t.id, after: t.deps ?? [], private: this.isPii(t), latestHead: this.reviewHead(t), approval: approvalBinding(t), receipt: t.sdlc, phase: this.isPii(t) ? undefined : this.workflowView(t), findings: this.isPii(t) ? undefined : this.reviewFindingSets(t), plan: config.mode === "off" || this.isPii(t) ? undefined : { paths: this.planPaths(t), revision: t.history.findLast(h => h.planRevision)?.planRevision?.revision ?? 0, fingerprint: planFingerprint(t.plan ?? {}), accepted: this.validPlanDepartures(t) } }));
   }
 
   /**
@@ -4155,6 +5038,8 @@ export class Tasks {
   private mergeRecordCurrent(id:number,by:PeerId,record:MergeRecord,artifactCurrent:()=>boolean):Task|undefined {
     const now=this.d.board.get(id);
     return artifactCurrent() && now && now.sdlc?.repo===record.repo && now.sdlc.pr===record.pr && now.sdlc.reviewedHead===record.head
+      && (!approvalBinding(now) || approvalBinding(now)!.current && approvalBinding(now)!.head === record.head)
+      && (!this.reviewHead(now) || this.reviewHead(now) === record.head)
       && now.state==="approved" && !this.isPii(now) && !this.d.privateTurn?.(by) && this.mergeAuthority(by)
       && !this.d.bus.isRecoveryHeld && !this.d.bus.storageError ? now : undefined;
   }
@@ -4566,6 +5451,7 @@ export class Tasks {
     this.mine(task, by, "owner", true);
     this.ready(task, true);
     if (task.state !== "proposed" && task.state !== "changes_requested" && task.state !== "in_progress") throw new PreEffectToolRefusal(`task #${task.id} is ${task.state}: cannot move to in_progress`);
+    this.studyDispatchCheck(task, task.owner ?? undefined);
     this.acceptanceCapacity(task);
     // S1 spec acceptance and S9 plan review are independent prerequisites; retain S1's missing-spec refusal first.
     if (this.specGated(task) && this.d.sdlc?.config().mode === "enforce" && specState(task.sdlc, undefined) === "missing") throw new PreEffectToolRefusal(this.specText(task, "missing", "blocked"));
@@ -4593,6 +5479,7 @@ export class Tasks {
     this.warmRepository(draft);
     const repositoryChanged = this.repositories.scope(task.refs).key !== this.repositories.scope(draft.refs).key;
     const before = new Set(this.overlapHits(task).map((h) => h.task.id));
+    this.studyDispatchCheck(task, task.owner ?? undefined);
     const next = this.linkOnWrite(this.d.board.update(task.id, by, "accepted", { state: "in_progress", ...(cleaned ? { plan: cleaned } : {}), ...(metadata ? { refs: metadata } : {}) })); // #723: refs.repo may have just arrived
     this.captureOwnerAcceptance(next);
     this.d.notify(`task ${this.publicTitle(next)} accepted by ${by}`);
@@ -4745,13 +5632,23 @@ export class Tasks {
   }
 
   /** What the deliverable reader needs from the host: the project root, the secrets denylist, and which files make a record private (#509a). */
-  private deliverablePorts(task: Task): DeliverablePorts {
+  private deliverablePorts(task: Task, policy: { failClosedOnDiscoveryLimit?: boolean } = {}): DeliverablePorts {
     const taskPrivate = this.isPii(task);
     // The owner's own root: a declared worktree instance writes under its worktree, so its deliverables are hashed there, never in the canonical
     // checkout (which holds a different file or none). With the root unproven there is nothing safe to hash: refuse rather than guess.
     const root = !this.d.executionRoot || !task.owner || task.owner === USER ? this.d.cwd : this.d.executionRoot(task.owner);
     if (root === undefined) throw new DeliverableRefusal(`deliverables: ${task.owner}'s execution root is not verified right now, so its files cannot be hashed`);
-    return { cwd: root, deny: this.d.deny ?? [], private: path => taskPrivate || matchesPolicy(root, path, this.d.piiPaths ?? [], true) };
+    return { cwd: root, deny: this.d.deny ?? [], private: path => taskPrivate || matchesPolicy(root, path, this.d.piiPaths ?? [], true, policy) };
+  }
+
+  /** Path privacy exists even when measurement cannot open the output. Use the #509 policies on both names. */
+  private experimentOutputPrivate(task: Task, path: string): boolean {
+    try {
+      const ports = this.deliverablePorts(task, { failClosedOnDiscoveryLimit: true }), root = realPath(ports.cwd), deny = [...ports.deny];
+      const typed = relative(root, resolve(root, path)), actual = relative(root, policyRealPath(resolve(root, path)));
+      return !insideRoot(typed) || !insideRoot(actual) || ports.private(path)
+        || [typed, actual].some(name => isHubWritePath(name) || isDenied(name, deny) || isDenied(foldSegment(name), deny.map(foldSegment)));
+    } catch { return true; }
   }
 
   /**
@@ -4782,26 +5679,73 @@ export class Tasks {
   /** Whether a completion check is still running for this task. */
   isChecking = (id: number) => this.checking.has(id);
 
-  private completionCurrent(id: unknown, by: PeerId, preEffect: boolean): Task {
+  /** Invalidate stale artifact evidence without changing spec acceptance or open findings. */
+  private completionDraft(task: Task, refresh?: Pick<CompletionRefresh, "commit">): Task {
+    if (!refresh || !task.sdlc) return task;
+    const sdlc = { ...task.sdlc };
+    if (sdlc.head !== refresh.commit) { delete sdlc.head; delete sdlc.observed; }
+    if (sdlc.reviewedHead !== refresh.commit) delete sdlc.reviewedHead;
+    if (sdlc.localHead !== refresh.commit) { delete sdlc.localHead; delete sdlc.localResult; }
+    delete sdlc.merge;
+    return { ...task, sdlc };
+  }
+
+  private completionCurrent(id: unknown, by: PeerId, preEffect: boolean, refresh?: CompletionRefresh): Task {
     const task = this.need(id, false, preEffect);
     this.mine(task, by, "owner", preEffect);
+    if (refresh && (task.state !== refresh.state || task.history.length !== refresh.revision))
+      throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id}: review changed during re-file; retry on current work`);
     if (preEffect) {
-      if (task.state === "in_review" || isClosedTaskState(task.state)) throw new PreEffectToolRefusal(`task #${task.id} is already ${task.state}`);
+      if (task.state === "in_review" && !refresh || isClosedTaskState(task.state) && !(task.state === "approved" && refresh)) throw new PreEffectToolRefusal(`task #${task.id} is already ${task.state}`);
     } else {
-      if (task.state === "in_review" || isClosedTaskState(task.state)) throw new Error(`task #${task.id} is already ${task.state}`);
+      if (task.state === "in_review" && !refresh || isClosedTaskState(task.state) && !(task.state === "approved" && refresh)) throw new Error(`task #${task.id} is already ${task.state}`);
     }
+    if (task.sdlc?.merge?.state === "merged") throw new (preEffect ? PreEffectToolRefusal : Error)(`task #${task.id}: PR is merged`);
     this.ready(task, preEffect);
     if (task.state === "proposed" || task.state === "changes_requested") this.acceptanceCapacity(task);
     if (this.checking.has(task.id)) {
       // The result goes only to the owner the check was started for: anyone who took the task since hears nothing.
       throw new (preEffect ? PreEffectToolRefusal : Error)(this.checking.get(task.id) === task.owner ? `task #${task.id}: its check is still running; its result comes as a task message` : `task #${task.id}: a check from before it changed hands is still running; call hub_task_done again in a few minutes`);
     }
-    return task;
+    return this.completionDraft(task, refresh);
+  }
+
+  /** An approval may reopen only while its linked PR is known not to be merged, even with lifecycle gates off. */
+  private async unmergedForReopen(task: Task, valid: () => Task): Promise<void> {
+    valid();
+    if (task.sdlc?.merge?.state === "merged") throw new PreEffectToolRefusal(`task #${task.id}: PR is merged`);
+    const { repo, pr } = task.sdlc ?? {};
+    if (!repo || !pr) return;
+    if (this.isPii(task)) throw new PreEffectToolRefusal(`task #${task.id}: PR merge state unavailable for private work`);
+    const original = this.need(task.id, false, true);
+    const identity = JSON.stringify([original.sdlc, original.refs, original.history.length]);
+    let state: unknown;
+    try {
+      const reply = await (this.d.sdlc?.gh ?? sdlcGh)(["pr", "view", String(pr), "--repo", repo, "--json", "state"]);
+      if (reply.code === 0) state = JSON.parse(reply.stdout).state;
+    } catch { /* unknown merge state refuses before effects */ }
+    valid();
+    const current = this.need(task.id, false, true);
+    if (JSON.stringify([current.sdlc, current.refs, current.history.length]) !== identity) throw new PreEffectToolRefusal(`task #${task.id}: task changed during merge-state read`);
+    if (state === "MERGED") throw new PreEffectToolRefusal(`task #${task.id}: PR is merged`);
+    if (state !== "OPEN" && state !== "CLOSED") throw new PreEffectToolRefusal(`task #${task.id}: PR merge state unavailable; cannot reopen approval`);
   }
 
   async done(by: PeerId, id: unknown, summary?: string, refs?: TaskRefs, deliverables?: unknown): Promise<Task> {
     const requestCheck = this.requestCheck(by);
-    const valid = () => { requestCheck(); return this.completionCurrent(id, by, true); };
+    const initial = this.need(id, false, true);
+    this.mine(initial, by, "owner", true);
+    let refresh: CompletionRefresh | undefined;
+    if (initial.state === "in_review" || initial.state === "approved") {
+      const commit = cleanRefs(refs).commit;
+      if (!commit || !/^[a-f0-9]{40}$/.test(commit) || commit === this.reviewHead(initial))
+        throw new PreEffectToolRefusal(`task #${initial.id} is already ${initial.state}; re-file requires a different full head SHA`);
+      refresh = { revision: initial.history.length, commit, state: initial.state };
+    }
+    const submittedCommit = cleanRefs(refs).commit;
+    const draft = refresh ?? (submittedCommit && /^[a-f0-9]{40}$/.test(submittedCommit) ? { commit: submittedCommit } : undefined);
+    const valid = () => { requestCheck(); return this.completionDraft(this.completionCurrent(id, by, true, refresh), draft); };
+    if (initial.state === "approved") { await this.unmergedForReopen(initial, valid); valid(); }
     // #509a: a bad claim (a claimed hash, an outside or denied path, a missing file) is refused before any effect, with nothing recorded.
     const claims = deliverables === undefined ? undefined : this.deliverableClaims(deliverables, valid());
     // The PII screen reads the summary of a done that passes these checks (issue #198); they run again after it.
@@ -4823,7 +5767,7 @@ export class Tasks {
     task = current();
     let reviewEvidence: PrEvidence | undefined;
     if (this.d.sdlc && this.d.sdlc.config().mode !== "off") { reviewEvidence = await this.lifecycleGate(task, "review"); task = current(); }
-    const reviewAdmission = task.reviewer || this.d.prepareReviewBrief ? await this.reviewRequestAdmission(task, refs, true, by, reviewEvidence, undefined, staged => this.withLink(staged, link, refs), !task.reviewer) : undefined;
+    const reviewAdmission = task.reviewer || this.d.prepareReviewBrief ? await this.reviewRequestAdmission(task, refs, true, by, reviewEvidence, undefined, staged => this.withLink(this.completionDraft(staged, draft), link, refs), !task.reviewer) : undefined;
     task = current();
     // A member of a silent cohort (issue #107): its done is an intent, and the last of them integrates first.
     const cohort = this.cohorts.of(task.id);
@@ -4855,12 +5799,14 @@ export class Tasks {
     }
     if (task.state === "proposed" || task.state === "changes_requested") task = this.withLink(this.d.board.update(task.id, by, "accepted", { state: "in_progress" }, WITH_DONE), link, refs); // done without a separate accept
     const command = this.d.runCheck ? this.d.check?.(task.class, task) : undefined;
-    if (!command) return this.complete(task, by, summary, refs, "", withheld, "review", reviewAdmission, link, records, requestCheck);
+    if (!command) return this.complete(task, by, summary, refs, "", withheld, "review", reviewAdmission, link, records, requestCheck, refresh);
     // The tool call returns now; a check can outlast an agent's tool timeout. The result decides what comes next.
+    if (refresh?.state === "approved") { await this.unmergedForReopen(task, valid); task = current(); }
     this.checking.set(task.id, task.owner);
     const checkedRefs = cleanRefs(refs);
     this.warmRepository({ ...task, refs: { ...task.refs, ...checkedRefs } });
-    const pending = this.d.board.update(task.id, by, "done (checking)", { codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...checkedRefs } }), refs: checkedRefs, ...(task.sdlc ? { sdlc: task.sdlc } : {}) }, summary, { withheld: withheld || undefined, ...(records ? { deliverables: records } : {}) }, task.history.length, HOST_CODE_SYMBOLS);
+    const pending = this.d.board.update(task.id, by, "done (checking)", { ...(refresh ? { state: "in_progress" as const } : {}), ...(refresh?.state === "approved" && !task.reviewer ? { reviewer: USER } : {}), codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...checkedRefs } }), refs: checkedRefs, ...(task.sdlc ? { sdlc: task.sdlc } : {}) }, summary, { withheld: withheld || undefined, ...(records ? { deliverables: records } : {}) }, task.history.length, HOST_CODE_SYMBOLS);
+    if (refresh) { this.ciWatchers.cancel(pending.id); this.heldReviews.delete(pending.id); }
     this.releaseNotice(`task ${this.publicTitle(pending)} done by ${by}; its check is queued or running: ${command}`);
     const seen = { events: pending.history.length, owner: pending.owner };
     this.pendingChecks++;
@@ -5005,35 +5951,42 @@ export class Tasks {
   }
 
   /** `gated`: the transition `done()` already gated with no await since, so it is not read back twice (#382). */
-  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = "", withheld = false, gated?: "review", admission?: ReviewReadiness, link?: IdentityLink, records?: DeliverableRecord[], requestCheck: () => void = () => {}): Promise<Task> {
+  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = "", withheld = false, gated?: "review", admission?: ReviewReadiness, link?: IdentityLink, records?: DeliverableRecord[], requestCheck: () => void = () => {}, refresh?: CompletionRefresh): Promise<Task> {
     requestCheck();
     // A check's completion carries the records its `done (checking)` bound: the same bytes the owner delivered, not a later read.
     records ??= latestPendingDeliverables(task);
+    const submittedCommit = cleanRefs(refs).commit;
+    const draft = refresh ?? (submittedCommit && /^[a-f0-9]{40}$/.test(submittedCommit) ? { commit: submittedCommit } : undefined);
+    task = this.completionDraft(task, draft);
     let selection = this.poolReview(task, refs);
-    let reviewer = selection?.reviewer ?? task.reviewer, reviewEvidence: PrEvidence | undefined;
+    let reviewer = selection?.reviewer ?? task.reviewer ?? (refresh?.state === "approved" ? USER : undefined), reviewEvidence: PrEvidence | undefined;
     if (this.d.sdlc && this.d.sdlc.config().mode !== "off" && gated !== (reviewer ? "review" : "approval")) {
       reviewEvidence = await this.lifecycleGate(task, reviewer ? "review" : "approval");
       requestCheck();
-      task = this.withLink(this.completionCurrent(task.id, by, false), link, refs);
+      task = this.withLink(this.completionDraft(this.completionCurrent(task.id, by, false, refresh), draft), link, refs);
       selection = this.poolReview(task, refs);
-      reviewer = selection?.reviewer ?? task.reviewer;
+      reviewer = selection?.reviewer ?? task.reviewer ?? (refresh?.state === "approved" ? USER : undefined);
     }
     // A delayed local check needs a new readback; a completion-selected reviewer also needs optional facts in off mode.
     if (!admission && ((reviewer && (this.d.sdlc?.config().mode ?? "off") !== "off") || this.d.prepareReviewBrief)) {
-      admission = await this.reviewRequestAdmission(task, refs, false, by, reviewEvidence, undefined, staged => this.withLink(staged, link, refs), !reviewer);
+      admission = await this.reviewRequestAdmission(task, refs, false, by, reviewEvidence, undefined, staged => this.withLink(this.completionDraft(staged, draft), link, refs), !reviewer);
       requestCheck();
-      task = this.withLink(this.completionCurrent(task.id, by, false), link, refs);
+      task = this.withLink(this.completionDraft(this.completionCurrent(task.id, by, false, refresh), draft), link, refs);
     }
     selection = this.poolReview(task, refs);
-    reviewer = selection?.reviewer ?? task.reviewer;
+    reviewer = selection?.reviewer ?? task.reviewer ?? (refresh?.state === "approved" ? USER : undefined);
     const reviewCost: ReviewCost | undefined = reviewer && task.plan && (task.plan.review || task.plan.ci)
       ? { ...cleanCostPlan(task.plan), ...(admission?.ready && admission.head ? { head: admission.head } : {}) } : undefined;
     const routedSummary = selection?.reviewSelection?.blocked ? `${summary ?? ""}\nReview routing: ${this.assignmentNote("pool unavailable", selection)}`.trim() : summary;
+    if (refresh?.state === "approved") {
+      await this.unmergedForReopen(task, () => { requestCheck(); return this.completionCurrent(task.id, by, true, refresh); });
+      task = this.withLink(this.completionDraft(this.completionCurrent(task.id, by, true, refresh), draft), link, refs);
+    }
     const completedRefs = cleanRefs(refs);
     this.warmRepository({ ...task, refs: { ...task.refs, ...completedRefs } });
     const noWrites = this.noWritesRecorded({ ...task, refs: { ...task.refs, ...completedRefs } });
     const capacity = this.capacityBefore(task);
-    const next = this.d.board.update(task.id, by, "done", { codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...completedRefs } }), state: reviewer ? "in_review" : "approved", ...(selection ? { reviewer: reviewer ?? USER } : {}), ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: completedRefs }, checkOutput ? `${routedSummary ?? ""}\n${checkOutput}`.trim() : routedSummary, { ...this.planObservation(task), withheld: withheld || undefined, ...(noWrites ? { noWrites: true as const } : {}), ...this.reviewMetadata(selection, { ...task, refs: { ...task.refs, ...completedRefs } }), ...(reviewCost ? { reviewCost } : {}), ...(records ? { deliverables: records } : {}) }, task.history.length, HOST_CODE_SYMBOLS);
+    const next = this.d.board.update(task.id, by, "done", { codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...completedRefs } }), state: reviewer ? "in_review" : "approved", ...(selection || refresh?.state === "approved" ? { reviewer: reviewer ?? USER } : {}), ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: completedRefs }, checkOutput ? `${routedSummary ?? ""}\n${checkOutput}`.trim() : routedSummary, { ...this.planObservation(task), withheld: withheld || undefined, ...(noWrites ? { noWrites: true as const } : {}), ...this.reviewMetadata(selection, { ...task, refs: { ...task.refs, ...completedRefs } }), ...(reviewCost ? { reviewCost } : {}), ...(records ? { deliverables: records } : {}) }, task.history.length, HOST_CODE_SYMBOLS);
     this.queueReviewWritten(next);
     this.writePlannerNotices(next, capacity, next.state === "approved");
     this.ciWatchers.cancel(next.id); this.heldReviews.delete(next.id); // a newer head or a move ends the old head's watcher (#785 P1b)
@@ -5462,12 +6415,15 @@ export class Tasks {
 
   /** #520: the rendered review brief of a non-PII task's commit, or why there is none; empty without a commit. */
   briefText(task: Task): string {
-    if (this.isPii(task) || !task.refs.commit) return "";
+    if (this.isPii(task)) return "";
+    const approval = approvalText(approvalBinding(task));
+    const prefix = (brief: string) => [approval, brief].filter(Boolean).join("\n");
+    if (!task.refs.commit) return approval;
     try {
       const brief = this.d.reviewBrief?.(task);
-      if (!brief) return "";
-      return "unavailable" in brief ? `Review brief unavailable: ${brief.unavailable}.` : sanitize(renderReviewBrief(brief));
-    } catch { return "Review brief unavailable: it could not be built."; }
+      if (!brief) return approval;
+      return prefix("unavailable" in brief ? `Review brief unavailable: ${brief.unavailable}.` : sanitize(renderReviewBrief(brief)));
+    } catch { return prefix("Review brief unavailable: it could not be built."); }
   }
 
   async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown, head?: unknown, coverage?: unknown, findings?: unknown): Promise<Task> {
@@ -5478,16 +6434,22 @@ export class Tasks {
     // inherited reviewedHead lives there).
     let covered: { commit: string | undefined; receipt: string } | undefined;
     let conformanceIdentity: string | undefined;
+    let reviewRound: number | undefined;
+    let withdrawalRevision: number | undefined;
+    const withdrawing = this.need(id, false, true).state === "approved" && verdict === "changes_requested";
     const valid = (): Task => {
       requestCheck();
       const refused = authority?.();
       if (refused) throw new PreEffectToolRefusal(refused); // rechecked after every await, right before each write
       const t = this.need(id, false, true);
+      if (withdrawalRevision !== undefined && t.history.length !== withdrawalRevision) throw new PreEffectToolRefusal(`task #${t.id}: approval changed during withdrawal`);
+      if (reviewRound !== undefined && this.reviewRequestRevision(t) !== reviewRound) throw new PreEffectToolRefusal(`task #${t.id}: review request changed during the verdict; review the new head`);
       if (covered && (t.refs.commit !== covered.commit || JSON.stringify(t.sdlc ?? null) !== covered.receipt)) throw new PreEffectToolRefusal(`task #${t.id}'s commit or lifecycle receipt changed during the verdict: review the new head`);
       this.mine(t, by, "reviewer", true);
       if (verdict !== "approved" && verdict !== "changes_requested") throw new PreEffectToolRefusal('verdict must be "approved" or "changes_requested"');
-      if (t.state !== "in_review") throw new PreEffectToolRefusal(`task #${t.id} is ${t.state}: cannot move to ${verdict} before its owner calls hub_task_done`);
+      if (t.state !== (withdrawing ? "approved" : "in_review")) throw new PreEffectToolRefusal(`task #${t.id} is ${t.state}: cannot move to ${verdict} before its owner calls hub_task_done`);
       if (conformanceIdentity !== undefined && conformanceIdentity !== this.planIdentity(t)) throw new PreEffectToolRefusal("plan conformance identity changed during verdict");
+      if (t.sdlc?.merge?.state === "merged") throw new PreEffectToolRefusal(`task #${t.id}: PR is merged`);
       findingGuard?.(t);
       return t;
     };
@@ -5498,6 +6460,9 @@ export class Tasks {
     // the gap in the verdict note, off and a person's own verdict skip it.
     const mode = this.d.sdlc?.config().mode ?? "off";
     const initial = valid(), suppliedFindings = findings !== undefined;
+    reviewRound = this.reviewRequestRevision(initial);
+    if (withdrawing) withdrawalRevision = initial.history.length;
+    if (withdrawing) { await this.unmergedForReopen(initial, valid); valid(); }
     let parsed: ReviewFinding[];
     try { parsed = parseReviewFindings(findings, { person: by === USER, maxNits: this.d.sdlc?.config().maxNits ?? DEFAULT_MAX_NITS }); }
     catch (error) { throw new PreEffectToolRefusal(error instanceof Error ? error.message : "invalid structured findings"); }
@@ -5602,6 +6567,7 @@ export class Tasks {
       task = valid();
       if (cleared && context === JSON.stringify({ title: task.title, detail: task.detail, refs: task.refs, plan: task.plan, signals: task.signals })) candidate = input; // Async screening cannot authorize a verdict under an obsolete role/state.
     }
+    if (withdrawing) { await this.unmergedForReopen(task, valid); task = valid(); }
     const pii = this.isPii(task);
     const reviewContext = by === USER ? undefined : this.d.reviewContext?.(by, task.id);
     const poolRequest = task.history.findLast(entry => ["done", "reviewer changed", "reviewer unavailable"].includes(entry.event));
@@ -5611,7 +6577,7 @@ export class Tasks {
     // #507b: unmet items that start with a recorded criterion id name that criterion. The ids come from the checklist on the board as it is at this
     // write (the `task` just rechecked by valid()), never from the caller; a PII task carries none, its checklist being private.
     const unmetCriteria = pii ? [] : unmetCriteriaIds(items, checklistOf(task.sdlc));
-    const flag = { ...this.planObservation(task), withheld: withheld || undefined, ...(report ? { reviewFindings: report } : {}), ...(unmetCriteria.length ? { unmetCriteria } : {}), ...(boundDeliverables ? { deliverables: boundDeliverables } : {}), ...(reviewContext ? { reviewContext } : {}), ...(codeScope ? { reviewScope: "code" as const } : {}), ...(evidenceOnly ? { evidenceOnly: true as const } : {}), ...(reviewerFamily ? { reviewerFamily } : {}), ...(reviewerReason ? { reviewerReason } : {}) };
+    const flag = { ...(findingHead ? { reviewedHead: findingHead } : {}), ...this.planObservation(task), withheld: withheld || undefined, ...(report ? { reviewFindings: report } : {}), ...(unmetCriteria.length ? { unmetCriteria } : {}), ...(boundDeliverables ? { deliverables: boundDeliverables } : {}), ...(reviewContext ? { reviewContext } : {}), ...(codeScope ? { reviewScope: "code" as const } : {}), ...(evidenceOnly ? { evidenceOnly: true as const } : {}), ...(reviewerFamily ? { reviewerFamily } : {}), ...(reviewerReason ? { reviewerReason } : {}) };
     if (verdict === "approved") {
       const capacity = this.capacityBefore(task);
       this.ciWatchers.cancel(task.id); this.heldReviews.delete(task.id);
@@ -5637,7 +6603,7 @@ export class Tasks {
       return next;
     }
     this.ciWatchers.cancel(task.id); this.heldReviews.delete(task.id);
-    const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: evidenceOnly ? task.rejections : task.rejections + 1 }, note, flag);
+    const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: evidenceOnly ? task.rejections : task.rejections + 1 }, note, flag, task.history.length);
     void this.mirrorVerdict(rejected, by, "changes_requested", reviewedHead ?? rejected.sdlc?.reviewedHead, note, withheld);
     if (!evidenceOnly) this.releaseNotice(`task #${rejected.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(rejected, by, parsed, withheld));
     if (!evidenceOnly) this.releaseNotice(`task #${rejected.id}: review saved but recurring-criterion proposal unavailable`, () => this.proposeCriterionCandidates(rejected, by, withheld));
@@ -5650,6 +6616,11 @@ export class Tasks {
     if (!evidenceOnly) this.contradict(rejected);
     this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`, withheld);
     if (evidenceOnly) this.tellConductorEvidenceOnly(rejected, by);
+    if (withdrawing) {
+      this.releaseNotice(`task ${this.publicTitle(rejected)}: could not tell its owner the approval was withdrawn`, () =>
+        this.tell(rejected, `Task #${rejected.id}: ${by} withdrew approval and requests changes. Review the findings, then call hub_task_done with the updated head.`, pii));
+      return rejected;
+    }
     if (!evidenceOnly && rejected.rejections >= (this.d.escalateAfter?.() ?? ESCALATE_AFTER)) {
       let moved: Task;
       try {