@staix/agent-hub 0.27.0 → 0.28.0

package/src/hub/daemon.ts

@@ -38,11 +38,13 @@ import { isDenied, sbplString } from "../local/deny.ts";
 import { hostShellPath } from "./host-executable.ts";
 import { supersededDeliveryReason, deliveryTaskContext } from "./delivery-superseded.ts";
 import { renderHeldHint } from "./delivery-hints.ts";
+import { compactRow, pageTasks, parseListQuery } from "./task-list-page.ts";
 import { correctionInput, MemoryTelemetry } from "./memory-candidates.ts";
 import { MemoryObservations } from "./memory-observations.ts";
 import { createStalenessProbe } from "./memory-staleness.ts";
 import { matchingPlanFails, planGuardNodes, taskMemoryQueryNodes } from "./memory-plan-guard.ts";
 import { planningWipLimits } from "./planning.ts";
+import { ToolWriteRegistry, toolWriteOperation, toolWriteUnknownReply } from "./tool-request.ts";
 import { projectedDiff } from "./projected-diff.ts";
 import { listenWithoutPortCollision } from "./listen.ts";
 import { needs, type NeedsInput } from "../ui/needs.ts";
@@ -54,7 +56,7 @@ import { buildReviewBrief, withCodeSymbols } from "./review-brief.ts";
 import { profileName, projectProfile, resolveProfile, mergeProfileOverrides, type ProfileName } from "./profiles.ts";
 import { catalogAssignments, loadRoleCatalog, selectedRoles, roleIdentity } from "./roles.ts";
 import { ActivityRing } from "./activity.ts";
-import { JcodeOptionMismatch, isJcodePeer, jcodeVersionAsync, type JcodePeer } from "../adapters/jcode.ts";
+import { JcodeOptionMismatch, JcodeTuiRefusal, isJcodePeer, jcodeVersionAsync, type JcodePeer } from "../adapters/jcode.ts";
 import { VERSION_REFUSAL, configuredCommands, describe, isCompatId } from "../adapters/compat.ts";
 import { agentVersionsAsync, type AgentVersionRow } from "../cli/agents.ts";
 import { driftedAgents, noticeDrift, type DriftedAgent } from "./agent-drift.ts";
@@ -104,6 +106,7 @@ import { conductorRecoveryBinding } from "../cli/conductor-recovery.ts";
 import { createConfigEditor } from "./config-edit-host.ts";
 import { readEditable } from "./config-edit.ts";
 import { eventLog, readEvents, type RoleIdentity } from "./events.ts";
+import { SpecTaskInspector } from "./specs-task.ts";
 import { KimiUsage, kimiSeedRows } from "./kimi-usage.ts";
 import { TokenWindow } from "./token-window.ts";
 import { budgetNotes, type BudgetPeerNote } from "./budget-notes.ts";
@@ -193,7 +196,7 @@ import { projectChain } from "@staix/agent-mem";
 import { recallFor } from "../memory/recall.ts";
 import { conflictsOf } from "./conflicts.ts";
 import { Facts, FACTS_PREFIX, type FactScope } from "./facts.ts";
-import { crashPlan, lossNotice, readSessions, removeSessions, writeSessions, type SessionsFile } from "./crash.ts";
+import { crashPlan, lossNotice, openCrashNotices, readSessions, removeSessions, writeSessions, type CrashNotice, type SessionsFile } from "./crash.ts";
 import type { JournalDelivery } from "./delivery-journal.ts";
 import { DEFAULT_LIMITS, Limiter, PROJECT_LIMITS, type LimitsConfig } from "./limits.ts";
 import { soleWorktree, branchHeads, changedPaths, dirtySubmodules, submodulePaths, knownChangedPaths, hasTree, headState, headMoveCursor, incomingHeadPaths, repoOf, snapshot, SnapshotBudgetExceeded, budgetNow, Turns, type SnapshotBudget, type HeadMoveCursor, type Repo, type TurnRecord } from "./snapshots.ts";
@@ -218,6 +221,7 @@ import { SourceRegistry } from "./sources.ts";
 import { MEMORY_READ_TOOLS, memoryRead, validateMemoryRead, sourceRead, validateSourceRead } from "./read-tools.ts";
 import { nativeRecall } from "../memory/recall.ts";
 import { promotionScreen, withoutPii, mentionsPrivatePath } from "./memory-policy.ts";
+import { DEFAULT_SPECS_CONFIG, parseSpecsConfig, type SpecsConfig } from "./specs-config.ts";
 
 export interface HubConfig {
   adapter_modules?: readonly AdapterModuleDeclaration[];
@@ -260,6 +264,7 @@ export interface HubConfig {
   text_projection?: ProjectionConfig;
   /** #510: machine-local folders of plain notes the hub may index, read-only; vault folders are refused when the index reads them. */
   corpus: { paths: string[] };
+  specs: SpecsConfig;
   catalog_roles?: Record<string, string[]>;
   conductor: { feed: "own" | "all" | "off"; approval_wait_s: number };
   budget: BudgetConfig;
@@ -352,6 +357,7 @@ export const DEFAULT_CONFIG: HubConfig = {
   schedules: [],
   folder_triggers: [],
   corpus: { paths: [] },
+  specs: { ...DEFAULT_SPECS_CONFIG, roots: [] },
   checks: { timeout_s: 600 },
   // Off here like approvals.notify, so tests (whose cwd is this repository) write no objects; a project's config turns it on.
   snapshots: { enabled: false, keep: 20 },
@@ -370,14 +376,14 @@ export const DEFAULT_CONFIG: HubConfig = {
 export { stateDirFor };
 
 /** Ids an external process may not claim: the console user and the adapters the daemon runs itself. */
-const READ_ONLY_HUB_TOOLS = new Set(["hub_capabilities", "hub_inbox", "hub_send", "hub_delivery_done", "hub_review", "hub_task_show", "hub_task_list", "hub_study_show", "hub_experiment_show", "hub_memory_search", "hub_memory_show", "hub_memory_graph", "hub_source_read", "hub_status"]);
+const READ_ONLY_HUB_TOOLS = new Set(["hub_capabilities", "hub_inbox", "hub_send", "hub_delivery_done", "hub_review", "hub_task_show", "hub_task_list", "hub_study_show", "hub_experiment_show", "hub_memory_search", "hub_memory_show", "hub_memory_graph", "hub_source_read", "hub_status", "hub_specs"]);
 const BASE_RESERVED_IDS = new Set<string>([USER, ...SUPPORTED_PEERS.filter(peer => definitionOf(peer)?.attach?.externalHello !== true), HUB, DIGEST]);
 const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
 /** The shared project config, then the machine's own file, which overrides it block by block (issue #17). */
 const CONFIG_FILES = INSTANCE_CONFIG_FILES;
 export interface ConfigLayer { name: typeof CONFIG_FILES[number]; raw: Record<string, any> }
-const CONFIG_BLOCKS = ["action_policy", "memory", "roster", "roles", "catalog_roles", "pii", "data", "conductor", "budget", "context", "inference", "omniroute", ...NATIVE_CONFIG_BLOCKS, "approvals", "tasks", "task_sweep", "bus", "adapter_timing", "model_relay", "console", "corpus", "checks", "snapshots", "research", "bench", "limits", "review", "recovery", "capabilities", "mlx", "permission_modes", "peers", "terminal", "start", "pet"];
+const CONFIG_BLOCKS = ["action_policy", "memory", "roster", "roles", "catalog_roles", "pii", "data", "conductor", "budget", "context", "inference", "omniroute", ...NATIVE_CONFIG_BLOCKS, "approvals", "tasks", "task_sweep", "bus", "adapter_timing", "model_relay", "console", "corpus", "specs", "checks", "snapshots", "research", "bench", "limits", "review", "recovery", "capabilities", "mlx", "permission_modes", "peers", "terminal", "start", "pet"];
 
 /** Older targets parse raw keys before placement/trust checks, so even an empty or refused declaration needs the floor. */
 function rawResearchRunnersPresent(cwd: string): boolean {
@@ -483,6 +489,7 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     resolveProfile(file.profile, file.profile_overrides);
     projectionConfig(file.text_projection);
     corpusConfig(file.corpus);
+    if (file.specs !== undefined) parseSpecsConfig(file.specs);
     queueBackpressurePolicy(file.tasks?.queue_backpressure);
     validateOperationalConfig(file);
     for (const [block, key] of [["pii", "paths"], ["data", "readonly"]] as const) {
@@ -599,6 +606,7 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     schedules: schedulesConfig(file.schedules),
     folder_triggers: foldersConfig(file.folder_triggers),
     corpus: corpusConfig(file.corpus),
+    specs: parseSpecsConfig(file.specs),
     checks: { ...DEFAULT_CONFIG.checks, ...file.checks, runner: file.checks?.runner === "remote" ? "remote" : file.checks?.runner === "container" ? "container" : undefined,
       ...(file.checks?.remote !== undefined || file.checks?.runner === "remote" ? { remote: remoteRunnerConfig(file.checks?.remote) } : {}) },
     snapshots: { ...DEFAULT_CONFIG.snapshots, enabled: true, ...file.snapshots },
@@ -656,6 +664,8 @@ export interface DaemonOptions {
   releaseHostAdmission?: (cwd: string) => Promise<ReleaseHostAdmission>;
   /** Host-only (#285): Kimi's data home for its wire-log usage reader; default `KIMI_CODE_HOME`, else `~/.kimi-code`. Never read from config or tools. */
   kimiHome?: string;
+  /** Host-only replay-window test ceiling (1..512); never read from project config or a tool. */
+  toolWriteReplayMaxEntries?: number;
   /** Host-only evidence seam; never supplied by project config or control messages. */
   releaseDocEvidence?: (root: string) => Promise<DocEvidence | undefined>;
   projectId?: string;
@@ -752,6 +762,9 @@ const RESOLUTION_CAUSES: [RegExp, string][] = [
   [/active delivery/i, "active delivery: it was handed to the peer and is not settled yet; wait for it, or resolve it once it is needs_review"],
   [/peer busy/i, "peer busy: the peer is working, and only a queued delivery can be discarded meanwhile"],
   [/stale delivery revision/i, "stale revision: the delivery changed since you read it; run ahub queue show again"],
+  // #1096: a row that already carries a resolution is settled history, not a stale read. `retry` leaves its parent in `failed` for good because the redelivery is a separate row.
+  [/already resolved by retry/i, "already resolved by retry: this failed row is settled history, its redelivery is a separate delivery (ahub queue list shows it); nothing is left to do for this row"],
+  [/already resolved by (completed|discard)/i, "already resolved: this delivery was already settled by a person or the conductor; nothing is left to do for this row"],
   [/unknown delivery|delivery not found/i, "unknown delivery: no such delivery id"],
   [/already terminal|already resolved/i, "already resolved: the delivery is settled"],
   [/already scheduled/i, "queued delivery is already scheduled: discard it, or wait for its turn"],
@@ -778,6 +791,7 @@ function capturedRecoverySourceDigest(): string | undefined {
 export async function startDaemon(opts: DaemonOptions) {
   // Refuse unknown formats before logs, session cleanup, module factories or any writable store is opened.
   assertHubDbCompatible(join(opts.stateDir, "hub.db"));
+  if (opts.toolWriteReplayMaxEntries !== undefined && (!Number.isSafeInteger(opts.toolWriteReplayMaxEntries) || opts.toolWriteReplayMaxEntries < 1 || opts.toolWriteReplayMaxEntries > 512)) throw new Error("invalid host tool write replay capacity");
   const resolveExecutionCwd = (peer: string, currentDeclarations: InstancesConfig | undefined, currentRoles: readonly string[], catalog: ReturnType<typeof createProjectAdapterCatalog>): string =>
     resolveInstanceExecutionCwd(opts.cwd, peer, currentDeclarations, currentRoles, catalog, undefined, undefined, opts.instanceExecutionGit);
   const projectId = opts.projectId ?? randomUUID();
@@ -1268,8 +1282,12 @@ export async function startDaemon(opts: DaemonOptions) {
   const continuityKind = ADAPTERS.find(adapter => adapter.start.daemonPort === "pi-rpc")!.kind;
   const piAutoStart = () => !!autoStartAdapter && onRoster(autoStartAdapter.kind) && config.pi.auto_start;
   const startedAt = Date.now();
-  /** What crash recovery did or asks the user to do, for `ahub status`. */
-  const crashReport: string[] = [];
+  /** What crash recovery did or asks the user to do, for `ahub status` (#1082: `crashView` shows the lines that still stand). */
+  const crashNotices: CrashNotice[] = [];
+  /** A crash was reported this run. It never clears: the Jcode headless hint (#1085) has its own end (`tuiServed`), not the notices'. */
+  let crashReported = false;
+  /** The deliveries the crash left in needs_review, by id; filled below once the journal is open. */
+  const crashLostIds = new Set<string>();
 
   // The hub's own model calls (digest condensation, task triage) are wired below, once the gateway client exists.
   let inference: Inference | undefined;
@@ -1279,7 +1297,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const journal = new DeliveryJournal({ file: join(opts.stateDir, "hub.db"), projectRoot: opts.cwd, projectId, instanceId, operationId: recoveryOperation, terminalHistoryLimit });
   // What the crash left in flight, per recipient: opening the journal just marked these needs_review.
   const lost = new Map<PeerId, JournalDelivery[]>();
-  if (crashed) for (const d of journal.list()) if (d.state === "needs_review" && d.reason === "daemon stopped during delivery" && d.updatedAt >= startedAt) lost.set(d.peer, [...(lost.get(d.peer) ?? []), d]);
+  if (crashed) for (const d of journal.list()) if (d.state === "needs_review" && d.reason === "daemon stopped during delivery" && d.updatedAt >= startedAt) { lost.set(d.peer, [...(lost.get(d.peer) ?? []), d]); crashLostIds.add(d.id); }
   // Capabilities (issue #39): enforced here and in taskOp, never by role text alone. Unlisted peers keep everything.
   // A listed peer whose value is not a list gets nothing: whoever listed it meant to narrow it.
   const may = (peer: PeerId, cap: "propose" | "assign" | "remember" | "memory_correct" | "memory_read" | "important" | "spec_read" | "check_run" | "invoke"): boolean => {
@@ -2033,8 +2051,13 @@ export async function startDaemon(opts: DaemonOptions) {
     // Keep the last confirmed capability during a bounded, single-flight refresh; replace it only on a result.
     if (Date.now() - runnerStateAt >= 60_000) void refreshRunner();
     return Object.fromEntries([...new Set([...SUPPORTED_PEERS, ...bus.peers.keys()])].map(peer => {
-    if (!definitionOf(peer)?.trust.hubSandboxed) return [peer, { tests: true, spec: true }];
-    return [peer, { tests: runnerState.available && may(peer, "check_run"), spec: specState.available && may(peer, "spec_read"),
+    if (!definitionOf(peer)?.trust.hubSandboxed) return [peer, { tests: true, spec: true, network: true, worktree: true }];
+    // #1081: Pi and the local worker run their shell under one sandbox network setting (`local.bash_network`): false is no network at all, an egress proxy or "direct" is some.
+    const network = sandboxNetwork !== false;
+    // A hub sandbox never lets its shell run `git worktree add` (#270: it writes under the git common dir), so such a peer cannot create the task worktree. The hub-made writable worktree is #1115.
+    return [peer, { tests: runnerState.available && may(peer, "check_run"), spec: specState.available && may(peer, "spec_read"), network, worktree: false,
+      worktreeReason: "git worktree add runs outside the sandbox; this peer cannot create the task worktree (#270; a hub-made worktree is #1115)",
+      ...(network ? {} : { networkReason: "local.bash_network is off, so its shell has no network (ahub settings local.bash_network)" }),
       testsReason: !may(peer, "check_run") ? `capabilities.${peer}` : `runner unavailable: ${runnerState.reason ?? "unknown"}`,
       specReason: !may(peer, "spec_read") ? `capabilities.${peer}` : specState.reason ?? "gh unauthenticated" }];
     }));
@@ -2077,6 +2100,27 @@ export async function startDaemon(opts: DaemonOptions) {
     return () => token!==undefined && binding!==undefined && bus.peers.get(by)===peer && peer?.reviewToken(task)===token && tasks.reviewBindingCurrent(by,task,binding)
       ? undefined : `no review of task #${task} is running for ${by} at its bound head and revision`;
   };
+  type SpecRootSnapshot = { peer: PeerId; root: string; executionRoot: string; verifiedRoot?: string; owner?: PeerAdapter; attached?: PeerAdapter; cwd?: string; socket?: Sock; launchId?: string; generation?: string | number; repo?: string };
+  const specInspectors = new Map<string, SpecTaskInspector>();
+  const specInspectorAt = (root: string): SpecTaskInspector => {
+    const cached = specInspectors.get(root);
+    if (cached) { specInspectors.delete(root); specInspectors.set(root, cached); return cached; }
+    const created = new SpecTaskInspector(root, () => config.specs);
+    specInspectors.set(root, created);
+    if (specInspectors.size > 8) specInspectors.delete(specInspectors.keys().next().value!);
+    return created;
+  };
+  const specRootSnapshot = (task: Task): SpecRootSnapshot => {
+    const peer = task.owner ?? USER, binding = executionOwners.get(peer), execution = executionRoots.get(peer) ?? opts.cwd;
+    const root = binding?.socket && !currentExecutionOwner(peer) ? opts.cwd : execution;
+    const verifiedRoot = ownerWriteRoot(peer), attached = bus.peers.get(peer);
+    return { peer, root, executionRoot: execution, ...(verifiedRoot ? { verifiedRoot } : {}), ...(binding ? { owner: binding.owner, cwd: binding.cwd, ...(binding.socket ? { socket: binding.socket } : {}), ...(binding.launchId ? { launchId: binding.launchId } : {}), ...(binding.generation === undefined ? {} : { generation: binding.generation }) } : {}), ...(attached ? { attached } : {}), ...(task.refs.repo ? { repo: task.refs.repo } : {}) };
+  };
+  const sameSpecRoot = (left: SpecRootSnapshot, right: SpecRootSnapshot): boolean => left.peer === right.peer && left.root === right.root
+    && left.executionRoot === right.executionRoot && left.verifiedRoot === right.verifiedRoot && left.owner === right.owner && left.attached === right.attached
+    && left.cwd === right.cwd && left.socket === right.socket && left.launchId === right.launchId && left.generation === right.generation && left.repo === right.repo;
+  const projectSpecs = specInspectorAt(opts.cwd);
+  let specsMissingBlockHintShown = false;
   const tasks: Tasks = new Tasks({
     releaseWindow,
     researchRunners: () => {
@@ -2163,6 +2207,20 @@ export async function startDaemon(opts: DaemonOptions) {
       const brief = buildReviewBrief(root, task.refs.commit, { privatePath: path => isDenied(path, config.local.deny) || matchesPolicy(root, path, config.pii?.paths ?? [], true), nameable: tasks.nameable });
       return "unavailable" in brief ? brief : withCodeSymbols(brief, reviewSymbols.get(JSON.stringify([root, brief.head, brief.mergeBase])) ?? { state: "unknown" }, task.plan?.symbols, tasks.publicMetadataText);
     },
+    specsConfig: () => config.specs,
+    specNotice: task => {
+      const snapshot = specRootSnapshot(task);
+      return specInspectorAt(snapshot.root).notice(task.refs.paths ?? []);
+    },
+    inspectSpecs: async (task, head, changedFiles, acks) => {
+      const snapshot = specRootSnapshot(task), inspector = specInspectorAt(snapshot.root);
+      const report = await Promise.resolve(inspector.inspect(head, changedFiles, { complete: changedFiles !== undefined, acks }));
+      const current = specRootSnapshot(task), currentTask = board.get(task.id);
+      if (!sameSpecRoot(snapshot, current) || !currentTask || currentTask.owner !== task.owner) throw new PreEffectToolRefusal("task repository scope changed during spec inspection; retry hub_task_done");
+      if (config.specs.enabled !== true || config.specs.review === "off") return undefined;
+      return report;
+    },
+    specsRead: (action, paths) => projectSpecs.read(action, paths),
     sdlc: { config: () => lifecycleConfig, gh: (args, timeout, _cwd, bound) => sdlcGh(args, timeout, opts.cwd, bound) },
     board,
     bus,
@@ -2514,7 +2572,7 @@ export async function startDaemon(opts: DaemonOptions) {
     return typeof session === "string" ? session : undefined;
   };
   const activityRings: Record<string, ActivityRing> = Object.fromEntries(SUPPORTED_PEERS.filter(peer => definitionOf(peer)?.capabilities?.watch).map(peer => [peer, new ActivityRing()]));
-  const contextPii = (peer: PeerId) => !!turns.get(peer)?.private || board.list().some(t => !isClosedTaskState(t.state) && (t.owner === peer || t.reviewer === peer) && tasks.isPii(t));
+  const contextPii = (peer: PeerId) => !!turns.get(peer)?.private || board.peerTaskSignals(peer).some(task => !isClosedTaskState(task.state) && tasks.isPii(task));
   // #878: what each peer is doing. Daemon memory only: never persisted (status.json leaves it out), logged, captured or relayed.
   const doings = new Map<PeerId, DoingTracker>();
   const observeDoing = (peer: PeerId, kind: DoingKind, text?: unknown, learnedPrivate = false) => {
@@ -3244,6 +3302,73 @@ export async function startDaemon(opts: DaemonOptions) {
   // commit waits for those in flight, or its integrity digest misses their later writes. Completion checks outlive
   // their op, so recoveryReady() also waits for `tasks.checksPending()`: a check the commit's stop kills would write.
   let taskOpsInFlight = 0;
+  const toolWriteRegistry = new ToolWriteRegistry(instanceId, opts.toolWriteReplayMaxEntries === undefined ? {} : { maxEntries: opts.toolWriteReplayMaxEntries });
+  const toolWriteScope = (c: Client, operation: string): string => {
+    const actor = c.peer ?? USER, peer = c.peer ? bus.peers.get(c.peer) : undefined;
+    const binding = c.toolsOwner ?? c.externalOwner;
+    return JSON.stringify({ actor, role: c.role ?? "", operation, session: c.session === true, launchId: c.launchId ?? null,
+      generation: binding?.generation ?? (c.peer ? connectionGeneration(c.peer) ?? null : null), owner: binding?.owner.id ?? peer?.id ?? null,
+      executionRoot: c.peer ? executionRoots.get(c.peer) ?? null : null });
+  };
+  const taskWriteId = (value: unknown): number | undefined => {
+    const id = typeof value === "number" ? value : typeof value === "string" && /^\s*\d+\s*$/.test(value) ? Number(value) : NaN;
+    return Number.isInteger(id) ? id : undefined;
+  };
+  const toolWriteCurrent = (c: Client, sock: Sock, operation: string, payload: Record<string, unknown>, scope: string, result?: Record<string, unknown>): boolean => {
+    try {
+      const actor = c.peer ?? USER;
+      if (!c.authed || c.closed || sock.readyState !== WebSocket.OPEN || !c.role || stopping || recoveryActive() && recoveryPhase !== "preparing"
+        || c.peer && !membershipAllowed(c.peer) || c.externalOwner && !currentExternalTools(c, true) || c.toolsOwner && !currentImplementerTools(c)) return false;
+      if (c.session && sessionGate(actor, payload)) return false;
+      if (toolWriteScope(c, operation) !== scope || readOnlyPeer(actor) && !READ_ONLY_HUB_TOOLS.has(operation)
+        || c.toolsOwner && !IMPLEMENTER_HUB_TOOL_NAMES.includes(operation)) return false;
+      const privateContext = actor !== USER && (!!turns.get(actor)?.private || contextPii(actor));
+      const args = payload.args && typeof payload.args === "object" && !Array.isArray(payload.args) ? payload.args as Record<string, unknown> : {};
+      const requestedOwner = typeof args.owner === "string" ? args.owner.trim().toLowerCase() : "";
+      if (operation === "hub_task_propose" && (!may(actor, "propose") || requestedOwner && PEER_ID.test(requestedOwner)
+        && ![actor, USER, HUB, "digest"].includes(requestedOwner) && !may(actor, "assign"))) return false;
+      const safePiiProposalReceipt = operation === "hub_task_propose" && actor !== USER && result?.ok === true && typeof result.text === "string"
+        && /^task #[1-9]\d*: (?:backlog|proposed|in_progress|in_review|approved|changes_requested|cancelled), owner (?:none|[a-z][a-z0-9-]{0,31}), reviewer (?:none|[a-z][a-z0-9-]{0,31})$/.test(result.text);
+      const taskId = operation === "hub_review" ? taskWriteId(args.id)
+        : result?.ok === true && typeof result.text === "string" ? Number(/task #(\d+):/.exec(result.text)?.[1]) : undefined;
+      if (taskId !== undefined) {
+        const task = Number.isSafeInteger(taskId) && taskId > 0 ? board.get(taskId) : undefined;
+        if (!task) {
+          // Let the original Tasks.review validation return its specific pre-effect refusal for a new/bad target.
+          // A successful cached verdict without its task row is no longer safe to replay.
+          if (operation !== "hub_review" || result?.ok === true) return false;
+        } else {
+          const piiTask = tasks.isPii(task);
+          // ponytail: non-console review/PII replays remain held; narrower privacy needs host-proven per-operation private-turn authority.
+          if (operation === "hub_review" && actor !== USER && privateContext) return false;
+          if (actor !== USER && piiTask && !safePiiProposalReceipt
+            || operation === "hub_review" && actor !== USER && task.reviewer !== actor
+            || actor !== USER && result?.ok === true && typeof result.text === "string" && !tasks.publicMetadataText(result.text) && !safePiiProposalReceipt) return false;
+        }
+      }
+      if (actor !== USER && operation === "hub_task_propose" && result?.ok === true && typeof result.text === "string") {
+        const overlapLines = result.text.split(/\r?\n/).filter(line => line.startsWith("Overlaps "));
+        if (overlapLines.length > 1) return false;
+        if (overlapLines.length === 1) {
+          const line = overlapLines[0]!;
+          const markers = [...line.matchAll(/#([1-9]\d*) \(owner ([^)\r\n]{1,128})\)/g)];
+          const markerPrefixes = [...line.matchAll(/#([^()\r\n]{1,128}) \(owner /g)];
+          if (!markers.length || markers.length > 64 || markerPrefixes.length !== markers.length) return false;
+          const refs = new Set<number>();
+          for (const marker of markers) {
+            const id = Number(marker[1]);
+            if (!Number.isSafeInteger(id) || id < 1) return false;
+            refs.add(id);
+          }
+          if (refs.size !== markers.length) return false;
+          const facts = board.taskPrivacySignals([...refs]);
+          if (facts.length !== refs.size || facts.some(task => tasks.isPii(task))) return false;
+        }
+      }
+      if (actor !== USER && typeof result?.error === "string" && result.outcome !== "unknown" && !tasks.publicMetadataText(result.error)) return false;
+      return true;
+    } catch { return false; }
+  };
   /**
    * #604 ORIGIN side. Order matters: the caller's authority and the PII gates run first (nothing has left this project), then the target is resolved from the machine registry and its own
    * status descriptor is read, and only then is the request sent. The target answers with the task id it created, which is recorded here. A refusal at any step leaves no row in either board.
@@ -3354,6 +3479,10 @@ export async function startDaemon(opts: DaemonOptions) {
     try { return renderHeldHint(bus.heldDeliveryHints(peer), Date.now(), deliveryRetryAllowed(bus.peers.get(peer))); }
     catch { return ""; } // unavailable telemetry is not a zero count or a reason to fail the tool itself
   }
+  function inboxHeldMetadata(peer: PeerId) {
+    try { return bus.heldDeliveryHints(peer); }
+    catch { return undefined; } // the inbox pull is already settled; advisory held-row metadata cannot hide its result
+  }
   /** A model-written peer argument: a peer id, or nothing for absent, null or "". Anything else is refused. */
   const peerArg = (v: unknown, name: string): PeerId | undefined => {
     if (v == null || v === "") return undefined;
@@ -3504,14 +3633,19 @@ export async function startDaemon(opts: DaemonOptions) {
         return JSON.stringify({ invocation: row.id, state: "queued", note: "the result arrives later as one message from the hub, addressed to you only; do not wait for it in this turn" });
   }
   async function taskOpBody(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
+    if (inProcess && (op === "hub_task_propose" || op === "hub_review") && a && typeof a === "object" && Object.hasOwn(a, "request_id")) throw new PreEffectToolRefusal("request_id replay keys require the control-protocol task transport");
     if (BOUNDED_TASK_TOOLS.has(op)) {
       const keys = op === "hub_task_spec" ? ["id"] : op === "hub_check_start" ? ["id", "check", "files"] : ["run"];
       if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => !keys.includes(key))
         || (keys.includes("id") ? !Number.isSafeInteger(a.id) || a.id < 1 : typeof a.run !== "string" || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(a.run))) throw new PreEffectToolRefusal("invalid bounded task request");
       if (by !== USER && (piiTurn || turns.get(by)?.private || contextPii(by))) throw new PreEffectToolRefusal("bounded task tools unavailable during a PII turn");
     }
+    if (op === "hub_specs" && (piiTurn || turns.get(by)?.private || contextPii(by))) throw new PreEffectToolRefusal("spec inspection unavailable during a private turn");
     if (MEMORY_READ_TOOLS.has(op)) validateMemoryRead(op, a);
     if (op === "hub_memory_correct") correctionInput(a);
+    if (op === "hub_task_propose" && by !== USER && (piiTurn || turns.get(by)?.private)) {
+      throw new PreEffectToolRefusal("hub_task_propose is not available while working on a PII task: its text must not leave this machine");
+    }
     if (CONDUCTOR_TOOL_NAMES.has(op)) {
       if (piiTurn && ["hub_task_assign", "hub_task_escalate", "hub_peer_start"].includes(op)) throw new PreEffectToolRefusal("conductor mutations are unavailable during a PII turn");
       const result = await conductor.execute(by, op, a);
@@ -3682,6 +3816,9 @@ export async function startDaemon(opts: DaemonOptions) {
       return JSON.stringify(publicCheck(receipt));
     }
     switch (op) {
+      case "hub_specs":
+        if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => key !== "action" && key !== "paths")) throw new PreEffectToolRefusal("hub_specs accepts only action and paths");
+        return JSON.stringify(tasks.specsRead(by, a.action, a.paths));
       case "hub_delivery_retry": {
         if (by === USER || by === HUB || !a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => key !== "delivery_id") || typeof a.delivery_id !== "string" || a.delivery_id.length < 1 || a.delivery_id.length > 256) throw new PreEffectToolRefusal("hub_delivery_retry accepts only your delivery_id; completed and discard require the person");
         if (!deliveryRetryAllowed(bus.peers.get(by))) throw new PreEffectToolRefusal("delivery-only peers require the person to resolve held deliveries");
@@ -3689,6 +3826,16 @@ export async function startDaemon(opts: DaemonOptions) {
         bus.retryDelivery(by, a.delivery_id);
         return `retry queued for delivery ${a.delivery_id}; check for earlier effects before acting`;
       }
+      case "hub_delivery_resolve": {
+        if (by === USER || by === HUB || !a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => !["delivery_id", "revision", "action", "reason"].includes(key))
+          || typeof a.delivery_id !== "string" || !a.delivery_id.trim() || a.delivery_id.length > 256
+          || !Number.isSafeInteger(a.revision) || a.revision < 0 || !["completed", "discard"].includes(a.action)
+          || typeof a.reason !== "string" || !a.reason.trim() || a.reason.trim().length > 1000 || a.reason.length > 1000
+          || !tasks.publicMetadataText(a.reason.trim()) || !boundedSafe(a.reason.trim())) throw new PreEffectToolRefusal("hub_delivery_resolve needs only delivery_id, revision (the whole number hub_inbox showed), action completed or discard, and a public reason of 1 to 1000 characters; call hub_inbox for the revision and keep private or sensitive text out of the reason");
+        if (stopping || recoveryActive()) throw new PreEffectToolRefusal("the hub is not accepting delivery changes now (recovery or shutdown); run ahub status, then call hub_delivery_resolve again after it recovers");
+        bus.resolveOwnDelivery(by, a.delivery_id, a.revision, a.action, a.reason.trim());
+        return `your held delivery was marked ${a.action}`;
+      }
       case "hub_backlog_list":
         return JSON.stringify(tasks.backlogList(by));
       case "hub_release_new":
@@ -3764,19 +3911,21 @@ export async function startDaemon(opts: DaemonOptions) {
         const t = await tasks.propose(by, a);
         const repoHint = tasks.refsRepoHint(t); // #723: advice only; never part of the write
         const submodules = tasks.submoduleNotice(t); // #798 D1: advice only too
-        if (t.state === "backlog") return [line(t), repoHint, submodules].filter(Boolean).join("\n");
+        const specs = tasks.specNotice(t, by);
+        if (t.state === "backlog") return [line(t), specs, repoHint, submodules].filter(Boolean).join("\n");
         const overlap = tasks.overlaps(t, t.owner === by);
         if (t.owner === by && tasks.silentFor(t.id) && factsOn()) factsFor(by).sawPlans(by, tasks.overlapTasks(t)); // as for an accept
-        return [line(t), tasks.namedOwnerNote(t, a.owner as PeerId | undefined, by), overlap, tasks.claimRoleGuidance(t, by), t.owner === by ? tasks.planGuardText(t) : "", repoHint, submodules].filter(Boolean).join("\n");
+        return [line(t), specs, tasks.namedOwnerNote(t, a.owner as PeerId | undefined, by), overlap, tasks.claimRoleGuidance(t, by), t.owner === by ? tasks.planGuardText(t) : "", repoHint, submodules].filter(Boolean).join("\n");
       }
       case "hub_task_accept": {
         // S1 spec acceptance and S9 plan review are checked against one task snapshot before acceptance.
         const t = await tasks.acceptReviewed(by, a.id, a.plan, a.refs);
+        const specs = tasks.specNotice(t, by);
         // A silent cohort (issue #107): the owners' plans come with every accept, as what the newcomer works from.
         const silent = tasks.silentFor(t.id);
         const overlap = a.plan == null && a.refs == null && !silent ? "" : tasks.overlaps(t);
         if (silent && factsOn()) factsFor(by).sawPlans(by, tasks.overlapTasks(t)); // the plans in this answer need no fact later
-        return [line(t), overlap, tasks.planGuardText(t), tasks.submoduleNotice(t)].filter(Boolean).join("\n"); // #798 D1
+        return [line(t), specs, overlap, tasks.planGuardText(t), tasks.submoduleNotice(t)].filter(Boolean).join("\n"); // #798 D1
       }
       case "hub_task_cancel": {
         if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => !["id", "reason", "superseded_by", "revision"].includes(key))
@@ -3789,7 +3938,7 @@ export async function startDaemon(opts: DaemonOptions) {
       case "hub_task_decline":
         return line(await tasks.decline(by, a.id, a.reason, a.capacity === true));
       case "hub_task_done": {
-        const t = await tasks.done(by, a.id, a.summary, a.refs, a.deliverables);
+        const t = await tasks.done(by, a.id, a.summary, a.refs, a.deliverables, a.spec_ack);
         const completion = t.history.findLast(h => h.by === by && (h.event === "done" || h.event === "done (checking)"));
         if (!piiTurn && !tasks.isPii(t) && completion && !completion.withheld && typeof a.summary === "string" && completion.note?.startsWith(a.summary)) {
           citeMemory(by, a.summary, `summary:${t.id}:${t.history.indexOf(completion)}`, [newEnvelope(by, "", { refs: { task: String(t.id) } })]);
@@ -3798,8 +3947,10 @@ export async function startDaemon(opts: DaemonOptions) {
         const last = t.history.at(-1);
         if (last?.event === "integration requested" && last.by === HUB) return last.note ?? "";
         const extra = [tasks.takeDoneNote(t.id), tasks.checkoutNote()].filter(Boolean).join("\n"); // held silence notices, then the #572 checkout advisory
-        const result = tasks.isChecking(t.id) ? `${line(t)}; its check is queued or running, and the result comes as a task message` : line(t);
-        return extra ? `${result}\n${extra}` : result;
+        const doneLine = by === USER ? tasks.resultLine(t, by) : line(t);
+        const result = tasks.isChecking(t.id) ? `${doneLine}; its check is queued or running, and the result comes as a task message` : doneLine;
+        const specReport = by === USER ? "" : tasks.specReportText(t, by);
+        return [result, specReport, extra].filter(Boolean).join("\n");
       }
       case "hub_sdlc_record":
         await tasks.specStageGate(by, a.id, a.receipt); // #481 S1: a live spec edit-time check before a build stage
@@ -3839,7 +3990,13 @@ export async function startDaemon(opts: DaemonOptions) {
           if (!release) throw new PreEffectToolRefusal("no such release");
           releaseId = release.id;
         }
-        return JSON.stringify(board.list(a.ready === true ? "proposed" : a.state).filter((t) => (by === USER || t.state !== "backlog") && (releaseId === undefined || t.release === releaseId) && (a.ready !== true || !tasks.waitsFor(t).length)).map((t) => { const publicTask = tasks.publicView(t); const view: Record<string, unknown> = onPrem ? { ...t, ...holderReasons(publicTask) } : publicTask; const { history: _h, ...rest } = view; return { ...rest, flowRevision: t.history.length, ...(a.columnMetadata === true ? { started: taskHasStarted(t) } : {}) }; }));
+        // #1083: an agent always pages (default 50 compact rows) because the whole board is over every tool-output limit; the person's console keeps the full array unless it names a paging argument.
+        const listQuery = parseListQuery(a, by !== USER);
+        const shown = board.list(a.ready === true ? "proposed" : a.state).filter((t) => (by === USER || t.state !== "backlog") && (releaseId === undefined || t.release === releaseId) && (a.ready !== true || !tasks.waitsFor(t).length));
+        const listRow = (t: Task) => { const publicTask = tasks.publicView(t); const view: Record<string, unknown> = onPrem ? { ...t, ...holderReasons(publicTask) } : publicTask; const { history: _h, ...rest } = view; return { ...rest, flowRevision: t.history.length, ...(a.columnMetadata === true ? { started: taskHasStarted(t) } : {}) }; };
+        if (!listQuery) return JSON.stringify(shown.map(listRow));
+        const page = pageTasks(shown, listQuery);
+        return JSON.stringify({ tasks: page.rows.map(t => listQuery.detail ? listRow(t) : compactRow(listRow(t))), total: page.total, ...(page.next ? { next: page.next } : {}) });
       }
     }
     if (op === "task_show" && by !== USER) {
@@ -4533,6 +4690,18 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     return checkoutInTick.branch;
   };
+  /**
+   * The crash-recovery lines that still stand (#1082), read when status is asked: a line about a peer goes once that peer is attached, and the headline's count is the crash's own deliveries that are
+   * still in needs_review, so it matches `ahub queue list` and reaches zero when the operator has resolved them.
+   */
+  const crashView = (): string[] => {
+    if (!crashNotices.length) return [];
+    const attached = new Set<string>();
+    for (const notice of crashNotices) if (notice.peer !== undefined && bus.peers.has(notice.peer) && bus.peers.get(notice.peer)!.state !== "offline") attached.add(notice.peer);
+    let inFlight = 0;
+    if (crashLostIds.size) { try { for (const row of bus.queueList(undefined, true)) if (row.state === "needs_review" && crashLostIds.has(row.id)) inFlight++; } catch { inFlight = crashLostIds.size; } }
+    return openCrashNotices(crashNotices, { attached, inFlight });
+  };
   const status = (includeAttentionItems = false, includeAttentionInput = false, includeDoing = false) => {
     const taskNeeds = board.statusTasks();
     const ownerIsolation = ownerIsolationProjection();
@@ -4540,9 +4709,10 @@ export async function startDaemon(opts: DaemonOptions) {
     const pendingTaskOffers = tasks.pendingOffers().filter(offer => offer.pullOnly === true);
     const peerIds = byKind(statusPeerIds(taskNeeds));
     const queueBackpressure = tasks.queuePressureStatus(peerIds);
+    const crashLines = crashView();
     const view = {
     ...(queueBackpressure ? { queueBackpressure } : {}),
-    ...(crashReport.length ? { crash: crashReport } : {}),
+    ...(crashLines.length ? { crash: crashLines } : {}),
     projectId,
     instanceId,
     rooms: roomCommands.statusView(),
@@ -4900,34 +5070,35 @@ export async function startDaemon(opts: DaemonOptions) {
     } catch (error) { log(`session record not written: ${(error as Error).message}`); }
   };
   const recoverAfterCrash = async (prev: SessionsFile) => {
-    const report = (line: string) => (crashReport.push(line), notify(`crash recovery: ${line}`));
+    // `peer` marks a line that asks something of that peer's owner (it clears when the peer attaches); a line with neither is what recovery found or did and stays (#1082).
+    const report = (line: string, notice: { peer?: string; inFlight?: true } = {}, shown = line) => { crashNotices.push({ text: line, ...notice }); crashReported = true; notify(`crash recovery: ${shown}`); };
     const lostCount = [...lost.values()].reduce((n, l) => n + l.length, 0);
-    report(`the previous hub run stopped without shutting down${lostCount ? `; ${lostCount} deliveries it had in flight are in needs_review (ahub queue list)` : ""}`);
+    report("the previous hub run stopped without shutting down", { inFlight: true }, `the previous hub run stopped without shutting down${lostCount ? `; ${lostCount} deliveries it had in flight are in needs_review (ahub queue list)` : ""}`);
     const start = (peer: string, args: Parameters<typeof startPeer>[1]) => startPeer(peer, args).catch((e: Error) => ({ ok: false, error: e.message }));
     for (const step of crashPlan(prev.peers, declarations, adapterCatalog)) {
-      if (isExternalInstance(step.peer)) { report(`${step.peer}: external module instance stays stopped; use an explicit same-binding start`); continue; }
-      if (!declarations[step.peer] && definitionOf(step.peer)?.session.restoreOnStart && archivedPiContinuity) { report("pi: archived continuity evidence holds crash-session resume and fresh fallback; pi.auto_start uses only the recorded archived session"); continue; }
+      if (isExternalInstance(step.peer)) { report(`${step.peer}: external module instance stays stopped; use an explicit same-binding start`, { peer: step.peer }); continue; }
+      if (!declarations[step.peer] && definitionOf(step.peer)?.session.restoreOnStart && archivedPiContinuity) { report("pi: archived continuity evidence holds crash-session resume and fresh fallback; pi.auto_start uses only the recorded archived session", { peer: step.peer }); continue; }
       // `pi.auto_start` already asks for Pi (#66): its recorded headless session comes back, auto-resume or not, and a
       // fresh one starts when that fails or there is nothing headless to resume. Pi runs on-prem: no cloud quota.
       if (!declarations[step.peer] && definitionOf(step.peer)?.session.restoreOnStart && piAutoStart()) {
         if (step.resume) {
           const r = await start(step.peer, step.resume as Parameters<typeof startPeer>[1]);
           if (r.ok) { report(`pi resumed (pi.auto_start): ${step.how}`); continue; }
-          report(`pi not resumed (${String(r.error)}); ${step.how}`);
+          report(`pi not resumed (${String(r.error)}); ${step.how}`); // what happened, true after a fresh start too: history. Whether Pi is back is the last line of this branch.
         } else report(step.how);
         // #269: a Pi that ran in a terminal is not replaced by a headless one unless headless is its start mode.
-        if (step.tui && startMode(step.peer) === "tui") { report("pi.auto_start starts no headless Pi in place of a terminal one: run the command above, or set peers.pi.start_mode to headless"); continue; }
+        if (step.tui && startMode(step.peer) === "tui") { report("pi.auto_start starts no headless Pi in place of a terminal one: run the command above, or set peers.pi.start_mode to headless", { peer: step.peer }); continue; }
         const fresh = await start(step.peer, { ...(step.fresh as Parameters<typeof startPeer>[1]), fresh: true });
         const back = step.tui ? `; to go back to the recorded session, run ahub kill, start the hub without pi.auto_start, then the command above` : "";
-        report(fresh.ok ? `pi.auto_start started a fresh session${back}` : `pi.auto_start could not start Pi either (${String(fresh.error)})`);
+        report(fresh.ok ? `pi.auto_start started a fresh session${back}` : `pi.auto_start could not start Pi either (${String(fresh.error)})`, fresh.ok ? {} : { peer: step.peer });
         continue;
       }
       if (!step.resume || !autoResume()) {
-        report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}`);
+        report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}`, { peer: step.peer });
         continue;
       }
       const r = await start(step.peer, step.resume as Parameters<typeof startPeer>[1]);
-      report(r.ok ? `${step.peer} resumed: ${step.how}` : `${step.peer} not resumed (${String(r.error)}); ${step.how}`);
+      report(r.ok ? `${step.peer} resumed: ${step.how}` : `${step.peer} not resumed (${String(r.error)}); ${step.how}`, r.ok ? {} : { peer: step.peer });
     }
     writeStatus();
   };
@@ -5361,7 +5532,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (!isStartablePeer(peer)) return { ok: false, error: "unknown peer; the hub starts claude, codex, kimi, qwen (when on roster), pi (when enabled) and local" };
     if (!membershipAllowed(peer)) return { ok: false, error: `${peer} is off roster; a person can add it with ahub roster add ${peer}` };
     if (!startable(peer)) return { ok: false, error: "unknown peer; the hub starts claude, codex, kimi, pi (when enabled) and local" };
-    if (recoveryActive()) return { ok: false, error: "recovery is holding mutations" };
+    if (recoveryActive()) return { ok: false, error: startHeldByRecovery(peer) };
     const continuity = definitionOf(peer)?.start.autoStart === by
       ? piContinuity.state === "ready" ? (piContinuity = readRecoveryContinuity(opts.stateDir, { projectId, projectRoot: opts.cwd })) : piContinuity
       : undefined;
@@ -5423,6 +5594,15 @@ export async function startDaemon(opts: DaemonOptions) {
   /** The CLI command that starts a peer: `ahub <kind> --as <id>` for a declared instance. */
   const startCommand = (peer: string): string => { const kind = definitionOf(peer)?.kind; return kind && kind !== peer ? `ahub ${kind} --as ${peer}` : `ahub ${peer}`; };
 
+  /** The refusal of a start request while recovery holds mutations (#1088): the old sentence first, then whether the peer already runs and the step that works. */
+  const startHeldByRecovery = (peer: unknown): string => {
+    const held = "recovery is holding mutations";
+    if (typeof peer !== "string" || !PEER_ID.test(peer)) return `${held}; no peer was started. Wait for the recovery to finish (ahub recovery status shows where it is), then start the peer again`;
+    const owner = bus.peers.get(peer);
+    if (owner && owner.state !== "offline") return `${held}, and ${peer} is already running, so there is nothing to start. Wait for the recovery to finish (ahub recovery status shows where it is), then check ${peer} with ahub status. If the recovery names ${peer} as blocked, a person repairs it with ahub recovery reattach <operation-id> ${peer}, or ends the hold with ahub recovery resume or abort`;
+    return `${held}, so ${peer} was not started. Wait for the recovery to finish (ahub recovery status shows where it is), then start it with ${startCommand(peer)}`;
+  };
+
   async function stopPeer(peer: unknown, rosterRemoval = false, operational?: {actor:string;current:()=>void}): Promise<Record<string, unknown>> {
     operational?.current();
     if (!rosterRemoval && rosterChanging !== undefined && rosterChanging === peer) return { ok: false, error: `${String(peer)} roster change is in progress` };
@@ -5657,6 +5837,7 @@ export async function startDaemon(opts: DaemonOptions) {
         ...(instance?.provider ? { provider: instance.provider } : {}),
         ...(args.model ?? instance?.model ? { launchModel: (args.model ?? instance?.model)! } : {}), ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}), cwd: executionCwd, watchdogMs: config.watchdog_ms,
         toolCeilingMs: adapterTiming.acpToolCeilingMs(), activityBatchMs: adapterTiming.acpActivityBatchMs(), steerTimeoutMs: adapterTiming.jcodeSteerTimeoutMs(),
+        tuiHintContext: () => ({ tui: startMode(peer) === "tui", afterCrash: crashReported }),
         preamble: sessionRoleContract(peer), log: () => log("Jcode native diagnostic: details withheld"),
         // #801: Jcode 0.99.1's usage_update is `{ used, size }`, the live session's context occupancy: a context reading bound to the adapter's own session id, never a tokens event
         // or a quota window. An invalid shape reports a null reading (unknown, not the previous value).
@@ -6437,6 +6618,7 @@ export async function startDaemon(opts: DaemonOptions) {
     return {
       id: row.id, peer: row.peer, state: row.state, revision: row.revision,
       ...roomChat.evidence(row.peer, row.id),
+      ...(detail && bus.deliveryResolution(row.id) ? { resolvedBy: bus.deliveryResolution(row.id) } : {}),
       ...(!membershipAllowed(row.peer) ? { rostered: false, holdReason: "off roster" } : {}),
       createdAt: row.createdAt, updatedAt: row.updatedAt,
       envelopeIds: originals.map((env) => env.id),
@@ -7605,6 +7787,7 @@ export async function startDaemon(opts: DaemonOptions) {
         ? `target lacks task_cancel; cancelled tasks: ${ids.map(id => `#${id}`).join(", ")}` : undefined;
     };
     const incompatibleRecoveryTarget = () => {
+      if (config.specs.enabled && config.specs.review === "require" && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("design_specs"))) return "target lacks design_specs; specs.enabled is on and specs.review is require; use a supporting release or explicitly change specs.enabled/specs.review";
       if (board.hasConductorManualState() && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("conductor_recovery"))) return "target lacks conductor_recovery; open conductor manual-assignment intent cannot be preserved";
       if (allExternalInstanceIds().length && (!Array.isArray(msg.targetFeatures) || !["external_adapter_instances", "external_adapter_modules", "peer_instances"].every(feature => msg.targetFeatures.includes(feature)))) return "target lacks external_adapter_instances or its module/instance prerequisites";
       if (!(msg.op === "inspect" && recoveryPhase === "restored")) for (const id of allExternalInstanceIds()) if (!retainedExternalBinding(id, true)) return "external instance retained binding changed or unavailable";
@@ -7955,9 +8138,12 @@ export async function startDaemon(opts: DaemonOptions) {
     const c = sock.data;
     let refusalRecorded=false;
     const reply = (body: Record<string, unknown>) => {
+      const writeRequestId = typeof msg.requestId === "string" && msg.requestId.length <= 256 && !/[\p{Cc}\p{Cf}]/u.test(msg.requestId)
+        && toolWriteOperation(msg) !== undefined && body.requestId === msg.requestId ? msg.requestId : undefined;
+      let writeRefusal: string | undefined;
       const label=operationalRequestLabel(msg);
-      if (msg.t !== "hello" && c.externalOwner && !currentExternalTools(c)) body = { ok: false, error: "external instance launch or execution root changed" };
-      if (c.toolsOwner && !currentImplementerTools(c)) body = { ok: false, error: "Claude child generation or execution root changed", ...(label ? {authorityRefused:true,authorityScope:"operational"}: {}) };
+      if (msg.t !== "hello" && c.externalOwner && !currentExternalTools(c)) { writeRefusal = "external instance launch or execution root changed"; body = { ok: false, error: writeRefusal }; }
+      if (c.toolsOwner && !currentImplementerTools(c)) { writeRefusal = "Claude child generation or execution root changed"; body = { ok: false, error: writeRefusal, ...(label ? {authorityRefused:true,authorityScope:"operational"}: {}) }; }
       if(c.authed && c.role==="tools" && c.peer && body.ok===false && label) {
         if(body.authorityRefused===true) {
           if(!refusalRecorded)refusalRecorded=event({type:"agent_cli",peer:c.peer,command:label,refused:true});
@@ -7965,8 +8151,45 @@ export async function startDaemon(opts: DaemonOptions) {
           body={...body,error,refusalAudited:refusalRecorded};
         } else body={...body,authorityRefused:false};
       }
+      if (writeRequestId && body.requestId !== writeRequestId) {
+        const authority = { ...(body.authorityRefused === true || body.authorityRefused === false ? { authorityRefused: body.authorityRefused } : {}),
+          ...(typeof body.authorityScope === "string" ? { authorityScope: body.authorityScope } : {}), ...(typeof body.refusalAudited === "boolean" ? { refusalAudited: body.refusalAudited } : {}) };
+        body = { ...body, ...toolWriteUnknownReply(msg, writeRequestId, writeRefusal ?? "caller authority changed before the result could be returned"), ...authority };
+      }
       if (sock.readyState === WebSocket.OPEN) sock.send(JSON.stringify({ rid: msg.rid, ...body }));
     };
+    const runTaskRequest = (run: () => Promise<string>, extraCurrent: () => void = () => {}, formatError: (error: unknown) => Record<string, unknown> = error => ({ t: "task", ok: false, error: error instanceof Error ? error.message : "task write refused" })): void => {
+      const operation = toolWriteOperation(msg);
+      const payload = { t: "task", op: msg.op, args: msg.args ?? {} };
+      const actor = c.peer ?? USER, args = payload.args && typeof payload.args === "object" && !Array.isArray(payload.args) ? payload.args as Record<string, unknown> : {};
+      const knownPreEffectRefusal = operation !== undefined && (
+        readOnlyPeer(actor) && !READ_ONLY_HUB_TOOLS.has(operation)
+        || operation === "hub_task_propose" && (!may(actor, "propose") || (() => {
+          const owner = typeof args.owner === "string" ? args.owner.trim().toLowerCase() : "";
+          return !!owner && PEER_ID.test(owner) && ![actor, USER, HUB, "digest"].includes(owner) && !may(actor, "assign");
+        })())
+        || operation === "hub_review" && actor !== USER && (() => {
+          const id = taskWriteId(args.id);
+          if (id === undefined || id < 1) return false;
+          const task = board.get(id);
+          return !!task && task.reviewer !== actor;
+        })()
+      );
+      if (!operation || msg.requestId === undefined || knownPreEffectRefusal) {
+        void run().then(text => reply({ t: "task", ok: true, text }), error => reply(formatError(error)));
+        return;
+      }
+      const scope = toolWriteScope(c, operation);
+      void toolWriteRegistry.run({ id: msg.requestId, scope, bucket: actor, payload,
+        current: result => toolWriteCurrent(c, sock, operation, payload, scope, result) && (() => { try { extraCurrent(); return true; } catch { return false; } })(),
+      }, async () => {
+        try { return { t: "task", ok: true, text: await run() }; }
+        catch (error) {
+          if (error instanceof PreEffectToolRefusal || error instanceof OperationalAuthorityError) return formatError(error);
+          throw error;
+        }
+      }).then(result => reply(result), () => reply(toolWriteUnknownReply(payload, typeof msg.requestId === "string" ? msg.requestId : undefined)));
+    };
     if (!c.authed) {
       if (msg.t !== "hello" || msg.token !== token) return sock.close(4401, "bad token");
       if (typeof msg.peer === "string" && msg.peer.includes("@")) return sock.close(4403, "remote identities have no control connection");
@@ -8186,7 +8409,11 @@ export async function startDaemon(opts: DaemonOptions) {
         if(c.role!=="console" && msg.reason!==undefined && (typeof msg.reason!=="string" || !tasks.publicMetadataText(msg.reason)))return void reply({ok:false,error:"queue reason withheld by privacy policy"});
         if (msg.op === "list") {
           if (msg.peer !== undefined && (typeof msg.peer !== "string" || !PEER_ID.test(msg.peer) && !parseRemotePeerId(msg.peer))) return void reply({ ok: false, error: "invalid peer" });
-          return void reply({ ok: true, deliveries: bus.queueList(msg.peer).map((row) => queueView(row,false,c.role!=="console")) });
+          if (msg.all !== undefined && typeof msg.all !== "boolean") return void reply({ ok: false, error: "all is true or false" });
+          // #1096: a row an operator action already settled (a retry parent left `failed` for good, a discarded or completed row) is history, not open work: hidden unless `all`.
+          const everything = bus.queueList(msg.peer), settled = msg.all === true ? new Set<string>() : bus.settledIds();
+          const shown = everything.filter((row) => !settled.has(row.id));
+          return void reply({ ok: true, deliveries: shown.map((row) => queueView(row,false,c.role!=="console")), ...(shown.length < everything.length ? { hiddenSettled: everything.length - shown.length } : {}) });
         }
         if (msg.op === "discard") {
           // #713: the person's bulk clear of one peer's backlog. Without `confirmed` it only counts; with it, every queued (or needs_review) delivery of that peer is discarded
@@ -8194,10 +8421,18 @@ export async function startDaemon(opts: DaemonOptions) {
           // because only the named peer is read. Refused while recovery or shutdown holds queue mutations, like every queue resolution.
           if (typeof msg.peer !== "string" || !PEER_ID.test(msg.peer) && !parseRemotePeerId(msg.peer)) return void reply({ ok: false, error: "peer must be a peer id" });
           if (msg.peer.includes("@") && c.role !== "console") return void reply({ ok: false, error: "remote delivery disposition is person-only" });
-          const state = msg.state === undefined ? "queued" : msg.state;
-          if (state !== "queued" && state !== "needs_review") return void reply({ ok: false, error: "state is queued or needs_review" });
-          const rows = bus.queueList(msg.peer).filter((row) => row.state === state);
-          if (msg.confirmed !== true) return void reply({ ok: true, op: "discard", peer: msg.peer, state, count: rows.length, discarded: 0, refused: 0 });
+          // #1096: `states` (a list of queued, needs_review, failed) clears several kinds in one call, and a `failed` row counts only while no resolution settled it. The older single `state` keeps its meaning.
+          const KINDS = ["queued", "needs_review", "failed"] as const;
+          if (msg.states !== undefined && msg.state !== undefined) return void reply({ ok: false, error: "give state or states, not both" });
+          if (msg.states !== undefined && (!Array.isArray(msg.states) || !msg.states.length || msg.states.some((entry: unknown) => !(KINDS as readonly unknown[]).includes(entry)) || new Set(msg.states).size !== msg.states.length)) return void reply({ ok: false, error: `states is a list of ${KINDS.join(", ")}` });
+          if (msg.states === undefined && msg.state !== undefined && msg.state !== "queued" && msg.state !== "needs_review") return void reply({ ok: false, error: "state is queued or needs_review" });
+          const wanted: readonly string[] = msg.states ?? [msg.state === undefined ? "queued" : msg.state];
+          const settledRows = wanted.includes("failed") ? bus.settledIds() : new Set<string>();
+          const rows = bus.queueList(msg.peer).filter((row) => wanted.includes(row.state) && !(row.state === "failed" && settledRows.has(row.id)));
+          const byState = Object.fromEntries(wanted.map((kind) => [kind, rows.filter((row) => row.state === kind).length]));
+          const state = wanted.length === 1 ? wanted[0]! : wanted.join("+");
+          const many = msg.states !== undefined ? { states: wanted, byState } : {};
+          if (msg.confirmed !== true) return void reply({ ok: true, op: "discard", peer: msg.peer, state, ...many, count: rows.length, discarded: 0, refused: 0 });
           if (typeof msg.reason !== "string" || !msg.reason.trim() || msg.reason.length > 2000) return void reply({ ok: false, error: "discard needs a reason" });
           if (recoveryActive() || stopping) return void reply({ ok: false, error: "recovery or shutdown is holding queue mutations" });
           let discarded = 0; const refused: Record<string, number> = {};
@@ -8206,7 +8441,7 @@ export async function startDaemon(opts: DaemonOptions) {
             // discarding it, so the 12th discard is not refused as stale because of the 11 before it. A row that is gone or changed state meanwhile is counted as refused.
             const current = bus.queueShow(row.id) ?? bus.queueList(msg.peer).find((r) => r.id === row.id);
             try {
-              if (!current || current.state !== state) throw new Error("unknown delivery");
+              if (!current || current.state !== row.state) throw new Error("unknown delivery");
               bus.resolveDelivery(row.id, current.revision, "discard", msg.reason.trim());
               if (row.peer.includes("@")) roomChat.disposition(row.peer, row.id, "discard");
               discarded++;
@@ -8214,7 +8449,7 @@ export async function startDaemon(opts: DaemonOptions) {
             catch (error) { const why = resolutionRefusal(error).split(":")[0]!; refused[why] = (refused[why] ?? 0) + 1; }
           }
           writeStatus();
-          return void reply({ ok: true, op: "discard", peer: msg.peer, state, count: rows.length, discarded, refused: rows.length - discarded, ...(rows.length - discarded ? { refusedBy: refused } : {}) });
+          return void reply({ ok: true, op: "discard", peer: msg.peer, state, ...many, count: rows.length, discarded, refused: rows.length - discarded, ...(rows.length - discarded ? { refusedBy: refused } : {}) });
         }
         if (typeof msg.id !== "string" || !msg.id || msg.id.length > 256) return void reply({ ok: false, error: "invalid delivery ID" });
         if (msg.op === "show") {
@@ -8248,6 +8483,7 @@ export async function startDaemon(opts: DaemonOptions) {
         return void reply({ ok: true });
       }
       case "inbox": {
+        if (stopping || recoveryActive()) return void reply({ ok: false, error: "the hub is not serving inbox reads now (recovery or shutdown); run ahub status, then call hub_inbox again after it recovers" });
         if (c.toolsOwner) {
           const peer = c.peer!, current = captureImplementerTools(c), launch = currentImplementerTools(c);
           try {
@@ -8255,9 +8491,9 @@ export async function startDaemon(opts: DaemonOptions) {
             const pending = bus.pendingEnvelopes(peer);
             if (!current() || pending.some(env => { const task = env.refs?.task === undefined ? undefined : board.get(Number(env.refs.task)); return env.private || contextPii(peer) || !!task && tasks.isPii(task); })) return void reply({ ok: false, error: "private inbox delivery refused" });
             if (!launch || pending.some(env => (env.refs?.task === undefined ? implementerChatTask(peer) : Number(env.refs.task)) !== launch.task)) return void reply({ ok: false, error: "inbox delivery belongs to another task session" });
-            const envs = bus.pull(peer);
+            const envs = bus.pull(peer, { allowNeedsReviewHold: true });
             if (!envs) return void reply({ ok: false, error: queueHold(peer) ?? "delivery held" });
-            return void reply({ ok: true, envs, waiting: bus.queued(peer), waitingImportant: bus.queuedImportant(peer) });
+            return void reply({ ok: true, envs, held: inboxHeldMetadata(peer), waiting: bus.queued(peer), waitingImportant: bus.queuedImportant(peer) });
           } catch { return void reply({ ok: false, error: "delivery journal unavailable" }); }
         }
         // The attached session can explicitly claim queued work even during a native turn (#493).
@@ -8265,7 +8501,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const peer = c.peer ? bus.peers.get(c.peer) : undefined;
         if (c.role !== "peer" || !isWsPeer(peer) || !peer.owns(sock)) return void reply({ ok: false, error: "not attached to the hub yet; retry hub_inbox in a moment" });
         try {
-          const envs = bus.pull(peer.id);
+          const envs = bus.pull(peer.id, { allowNeedsReviewHold: true });
           if (!envs) return void reply({ ok: false, error: queueHold(peer.id) ?? (bus.isRecoveryHeld ? "recovery is holding deliveries" : pauseReason(peer.id)) });
           peer.lastInboxAt = Date.now();
           let polling: ReturnType<InboxPolling["read"]>;
@@ -8276,7 +8512,7 @@ export async function startDaemon(opts: DaemonOptions) {
           } catch { polling = undefined; } // The pull already completed: advice must never discard its envelopes.
           writeStatus();
           if (envs.length) log(`${peer.id} read ${envs.length} queued message(s) through hub_inbox`);
-          return void reply({ ok: true, envs, waiting: bus.queued(peer.id), waitingImportant: bus.queuedImportant(peer.id), ...(polling ? { pollingAdvice: { count: polling.count, minutes: polling.minutes } } : {}) });
+          return void reply({ ok: true, envs, held: inboxHeldMetadata(peer.id), waiting: bus.queued(peer.id), waitingImportant: bus.queuedImportant(peer.id), ...(polling ? { pollingAdvice: { count: polling.count, minutes: polling.minutes } } : {}) });
         } catch { return void reply({ ok: false, error: "delivery journal unavailable" }); }
       }
       case "delivery_complete": {
@@ -8959,8 +9195,18 @@ export async function startDaemon(opts: DaemonOptions) {
         }
         return void reply({ ok: false, error: "unknown room operation" });
       }
-      case "status":
-        return void reply({ t: "status", status: status(c.role === "console", false, true) });
+      case "status": {
+        const current = status(c.role === "console", false, true);
+        if ((c.role === "console" || c.role === "tools") && msg.specs === true) {
+          const summary = projectSpecs.status();
+          if (summary) {
+            const missingBlockHint = !specsMissingBlockHintShown && projectSpecs.missingBlock() === true;
+            if (missingBlockHint) specsMissingBlockHintShown = true;
+            return void reply({ t: "status", status: { ...current, specs: { ...summary, ...(missingBlockHint ? { missingBlockHint: true } : {}) } } });
+          }
+        }
+        return void reply({ t: "status", status: current });
+      }
       case "cli_audit_ack": {
         if (c.role !== "console") return void reply({ ok: false, error: "cli_audit_ack is a console command" });
         if (typeof msg.auditId !== "string" || !/^[a-f0-9-]{36}$/.test(msg.auditId)) return void reply({ ok: false, error: "invalid audit id" });
@@ -9036,8 +9282,11 @@ export async function startDaemon(opts: DaemonOptions) {
       case "native_tui_launch": {
         if (c.role !== "console") return void reply({ ok: false, error: "native TUI launch is console only" });
         const peer = String(msg.peer), owner = bus.peers.get(peer);
-        if (stopping || recoveryActive() || !membershipAllowed(peer) || rosterChanging === peer || requestedPeerStops.has(peer) ||
-          peer !== definitionOf(peer)?.kind || !isJcodePeer(owner) || !jcodeMcpReady(opts.cwd, opts.stateDir, SERVER_JS)) return void reply({ ok: false, error: "owned native TUI launch is unavailable" });
+        // #1085: every refusal names its cause class, in the reply and as one hub.log line. The class is a closed word: never a session id, launch id, socket or path.
+        const refuseTui = (code: string, error: string, resumed?: boolean) => { log(`native_tui_launch jcode refused: ${code}${resumed ? " (resumed session)" : ""}`); return void reply({ ok: false, code, ...(resumed ? { resumed: true } : {}), error }); };
+        if (stopping || recoveryActive() || !membershipAllowed(peer) || rosterChanging === peer || requestedPeerStops.has(peer)) return refuseTui("hub_busy", "owned native TUI launch is unavailable");
+        if (peer !== definitionOf(peer)?.kind || !isJcodePeer(owner)) return refuseTui("not_running", "owned native TUI launch is unavailable");
+        if (!jcodeMcpReady(opts.cwd, opts.stateDir, SERVER_JS)) return refuseTui("mcp_stale", "owned native TUI launch is unavailable");
         try {
           if (msg.binding !== undefined && (!msg.binding || typeof msg.binding.launchId !== "string" || typeof msg.binding.sessionId !== "string")) throw new Error("invalid binding");
           const options = msg.args ?? {};
@@ -9045,7 +9294,8 @@ export async function startDaemon(opts: DaemonOptions) {
           return void reply({ ok: true, ...owner.tuiLaunch(msg.binding, options) });
         } catch (error) {
           if (error instanceof JcodeOptionMismatch) return void reply({ ok: false, option: error.option, error: `owned Jcode launch differs from its running session in ${error.option}; start without it or stop jcode first` });
-          return void reply({ ok: false, error: "owned Jcode launch or saved session could not be verified; details withheld" });
+          if (error instanceof JcodeTuiRefusal) return refuseTui(error.code, "owned Jcode launch or saved session could not be verified; details withheld", owner.resumedSession);
+          return refuseTui("bad_request", "owned Jcode launch or saved session could not be verified; details withheld");
         }
       }
       case "peer_start":
@@ -9060,7 +9310,7 @@ export async function startDaemon(opts: DaemonOptions) {
         return;
       case "start":
         if (c.role !== "console") return void reply({ t: "started", ok: false, error: "start is a console command; use hub_peer_start with the conductor role" });
-        if (recoveryActive() && !(recoveryPhase === "restored" && msg.operationId === recoveryOperationId)) return void reply({ t: "started", ok: false, error: "recovery is holding mutations" });
+        if (recoveryActive() && !(recoveryPhase === "restored" && msg.operationId === recoveryOperationId)) return void reply({ t: "started", ok: false, error: startHeldByRecovery(msg.peer) });
         if (recoveryActive() && !recoveryPeerAllowed(String(msg.peer))) return void reply({ t: "started", ok: false, error: "peer is not part of the recovery roster" });
         startPeer(String(msg.peer), msg.args ?? {}, msg.args?.replaceSession === true ? piReplacementAuthority : undefined)
           .catch((e: Error) => ({ ok: false, error: e.message }))
@@ -9093,10 +9343,8 @@ export async function startDaemon(opts: DaemonOptions) {
           // #933: a console task op the conductor may run: admitted (role recheck and one audit row) before Tasks sees it; Tasks asks `operational` again.
           let current: () => void;
           try { current = admitOperational(sock, CONDUCTOR_TASK_OPS[String(msg.op)]!); } catch (error) { return void reply({ t: "task", ...operationalFailure(error) }); }
-          void operationalContext.run({ actor: c.peer, current }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})).then(
-            (text) => reply({ t: "task", ok: true, text }),
-            (e: Error) => reply({ t: "task", ...operationalFailure(e) }),
-          );
+          runTaskRequest(() => operationalContext.run({ actor: c.peer!, current }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})), current,
+            error => ({ t: "task", ...operationalFailure(error) }));
           return;
         }
         let invocation: AbortController | undefined;
@@ -9109,14 +9357,14 @@ export async function startDaemon(opts: DaemonOptions) {
           invocation = new AbortController(); c.invocationRequests.set(msg.rid, invocation);
         }
         const run = async () => c.externalOwner ? childToolAuthority.run({ by: c.peer!, current: () => currentExternalTools(c, true) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : c.toolsOwner ? childToolAuthority.run({ by: c.peer!, current: captureImplementerTools(c) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : taskOp(c.peer ?? USER, String(msg.op), msg.args ?? {});
-        (invocation ? invocationRequestSignal.run({ signal: invocation.signal, current: () => {
+        const execute = () => (invocation ? invocationRequestSignal.run({ signal: invocation.signal, current: () => {
           const live = !c.closed && sock.readyState === WebSocket.OPEN && c.invocationRequests?.get(msg.rid) === invocation;
           if (!live) invocation?.abort();
           return live;
-        } }, run) : run()).then(
-          (text) => reply({ t: "task", ok: true, text }),
-          (e: Error) => reply({ t: "task", ok: false, error: e.message }),
-        ).finally(() => { if (invocation && c.invocationRequests?.get(msg.rid) === invocation) c.invocationRequests.delete(msg.rid); });
+        } }, run) : run());
+        if (invocation) void execute().then(text => reply({ t: "task", ok: true, text }), (error: Error) => reply({ t: "task", ok: false, error: error.message }))
+          .finally(() => { if (c.invocationRequests?.get(msg.rid) === invocation) c.invocationRequests.delete(msg.rid); });
+        else runTaskRequest(execute);
         return;
       case "pause":
       case "resume": {