@staix/agent-hub 0.28.0 → 0.30.0

package/plugins/agent-hub/server.js

@@ -305,13 +305,13 @@ var init_compat = __esm(() => {
   COMPAT = {
     pi: {
       label: "Pi",
-      verified: ["1.4.0"],
+      verified: ["1.4.0", "1.5.0"],
       gate: "contract",
       probe: ["pi", "--version"],
       config: "pi.cmd",
       parse: (out) => plain(out.trim()),
-      trustNote: "The model-free extension load, RPC session identity and managed tool receipt path were checked on 1.4.0. Permissions remain host-owned; account-backed inference and another version's extension contract are unverified.",
-      receipt: "docs/verification/2026-10-26-pi-140-compat.md"
+      trustNote: "The model-free extension load, RPC session identity and managed tool receipt path were checked on 1.4.0 and 1.5.0. Permissions remain host-owned; account-backed inference and another version's extension contract are unverified.",
+      receipt: "docs/verification/2026-11-03-pi-150-compat.md"
     },
     "claude-implementer": {
       label: "Claude headless implementer",
@@ -361,23 +361,23 @@ var init_compat = __esm(() => {
     },
     agy: {
       label: "agy",
-      verified: ["1.4.2", "1.4.7"],
+      verified: ["1.4.2", "1.4.7", "1.4.12"],
       line: { min: "1.4.0", below: "1.5.0" },
       gate: "contract",
       probe: ["agy", "--version"],
       parse: (out) => plain(out.trim()),
-      trustNote: "Only 1.4.2 and 1.4.7 are T0-verified; the plugin MCP and hook contract of another version is unverified.",
-      receipt: "docs/verification/2026-10-26-agy-1.4.7.md"
+      trustNote: "Only 1.4.2, 1.4.7 and 1.4.12 are T0-verified; the plugin MCP and hook contract of another version is unverified.",
+      receipt: "docs/verification/2026-11-03-agy-1.4.12-launcher-nonce.md"
     },
     qwen: {
       label: "Qwen Code",
-      verified: ["0.25.0", "0.26.0", "0.26.1", "0.26.4"],
+      verified: ["0.25.0", "0.26.0", "0.26.1", "0.26.4", "0.26.5"],
       gate: "contract",
       probe: ["qwen", "--version"],
       config: "qwen_cmd",
       parse: (out) => plain(out.trim()),
-      trustNote: "Native ACP identity, mode ids and permission callbacks were re-checked without inference on 0.26.4; real model turns remain unverified. Another version may change those contracts.",
-      receipt: "docs/verification/2026-10-31-qwen-0264-acp.md"
+      trustNote: "Native ACP identity, mode ids and permission callbacks were re-checked without inference on 0.26.4 and 0.26.5; real model turns remain unverified. Another version may change those contracts.",
+      receipt: "docs/verification/2026-11-03-qwen-0265-acp.md"
     },
     "qwen-dual": {
       label: "Qwen Code dual-output TUI",
@@ -6258,6 +6258,28 @@ var init_path_policy = __esm(() => {
 
 // src/local/deny.ts
 import { basename as basename4, dirname as dirname8 } from "path";
+function gitRefRules(gitDirs, subDirs = []) {
+  const git = hfsFoldedName(".git");
+  const re = (s) => `(regex ${sbplString(s)})`;
+  const name = (n) => hfsFoldedName(n);
+  const plainSub = `(require-not ${re(`^.*/${git}/worktrees/[^/]+/modules(/|$)`)})`;
+  const plain = [
+    re(`^.*/${git}/${name("HEAD")}(\\.lock)?$`),
+    re(`^.*/${git}/${name("refs")}(/|$)`),
+    re(`^.*/${git}/${name("packed")}`),
+    `(require-all ${re(`^.*/${git}/${name("work")}`)} ${re(`^.*${name("trees")}(/|$)`)} ${plainSub})`
+  ];
+  const external = [...gitDirs, ...subDirs].flatMap((d) => {
+    const own = sbplString(d), direct = re(`^${sbplEscape(d)}/[^/]+$`);
+    return [
+      `(require-all ${direct} ${re(`^.*/${name("HEAD")}(\\.lock)?$`)})`,
+      `(require-all ${direct} ${re(`^.*/${name("packed")}`)})`,
+      `(require-all (subpath ${own}) ${re(refUnder(d, "refs"))})`,
+      `(require-all (subpath ${own}) ${re(refUnder(d, "worktrees"))} (require-not ${re(`^${sbplEscape(d)}/worktrees/[^/]+/modules(/|$)`)}))`
+    ];
+  });
+  return [...plain, ...external];
+}
 function hubWriteRegexes(root, gitDirs = [], moduleGit = [], worktreesRoot) {
   const git = hfsFoldedName(".git");
   const re = (s) => `(regex ${sbplString(s)})`;
@@ -6311,6 +6333,7 @@ function hubWriteRegexes(root, gitDirs = [], moduleGit = [], worktreesRoot) {
     `(require-all ${re(`^.*/${git}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     re(`^.*/${git}/${hfsFoldedName("hooks")}(/|$)`),
     `(require-all ${re(`^.*/${git}/.*$`)} ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
+    ...gitRefRules(gitDirs, allDirs),
     ...modules,
     ...siblings,
     ...external
@@ -6339,6 +6362,9 @@ function denyRegexes(root, extra = [], withNames = true) {
 var sbplEscape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), sbplString = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`, HFS_IGNORABLE_POINTS, HFS_IGNORABLE, hfsFoldedName = (name) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`, CONFIG_WORKTREE_NAME, MAX_ANCHOR_DEPTH = 80, hooksUnder = (parent) => {
   const depth = parent.split("/").filter(Boolean).length;
   return depth > MAX_ANCHOR_DEPTH ? `^.*/${hfsFoldedName("hooks")}(/|$)` : `^${"/[^/]+".repeat(depth)}/${hfsFoldedName("hooks")}(/|$)`;
+}, refDepth = (d) => d.split("/").filter(Boolean).length, refUnder = (d, name) => {
+  const depth = refDepth(d), cost = Buffer.byteLength(hfsFoldedName(name)) + depth * 6 + 8;
+  return cost > 1000 ? `^.*/${hfsFoldedName(name)}(/|$)` : `^${"/[^/]+".repeat(depth)}/${hfsFoldedName(name)}(/|$)`;
 };
 var init_deny = __esm(() => {
   init_platform();
@@ -7073,7 +7099,9 @@ ${preview(content)}`, "write", ctx.signal, file, undefined, String(a.path), a),
         try {
           ctx.onProcessExit?.(res.code);
         } catch {}
-        return `${res.output}
+        const refused = res.code !== 0 && /(?:\.git\/(?:refs|HEAD|packed-refs|worktrees)\b|cannot lock ref|index\.lock)[^\n]*(?:Operation not permitted|not permitted)/i.test(res.output);
+        return `${res.output}${refused ? `
+note: the sandbox does not let you move a branch, tag or HEAD, or stage inside a linked worktree (#1123). Leave your edits in the working tree and finish with hub_task_done. For implementation work the hub stages, commits and pushes them for you; for work that changes no files, or a private task, there is nothing for it to commit, so do not try to commit it yourself.` : ""}
 (exit ${res.code})`;
       }
       case "doc_read": {
@@ -7126,7 +7154,7 @@ var init_tools = __esm(() => {
     fn("write", "Create or overwrite a file inside the project. Needs the user's approval.", { path: str, content: str }, ["path", "content"]),
     fn("edit", "Replace one exact, unique occurrence of `old` with `new` in a file. Needs the user's approval.", { path: str, old: str, new: str }, ["path", "old", "new"]),
     fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Follows hub permission policy: proven bounded read-only commands may run automatically in ask-when-needed; other commands ask.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
-    fn("git", "Run git in the project. status, diff, log, show, ls-files, blame, rev-parse run freely; add, commit, restore, checkout, switch, stash, mv, rm, branch, merge, rebase, cherry-pick, revert, tag need approval; everything else (push, fetch, config, remote ...) is refused.", { args: { type: "array", items: str, minItems: 1 } }, ["args"]),
+    fn("git", "Run git in the project. status, diff, log, show, ls-files, blame, rev-parse run freely; add, commit, restore, checkout, switch, stash, mv, rm, branch, merge, rebase, cherry-pick, revert, tag need approval; everything else (push, fetch, config, remote ...) is refused. The sandbox does not let you move a branch, tag or HEAD anywhere (commit, branch, tag, stash, switch, merge, rebase and reset fail, submodules included), nor stage with add inside a linked worktree: edit files, and the hub commits and pushes them when you call hub_task_done.", { args: { type: "array", items: str, minItems: 1 } }, ["args"]),
     fn("hub_send", "Send a message to the other agents now, before your turn ends. Conclusions only. Your final answer is shared anyway; use this for something that cannot wait.", { text: str, to: { type: "array", items: str } }, ["text"])
   ];
   DOC_READ_SCHEMA = fn("doc_read", "Read a PDF, DOCX or HWPX document inside the project as plain text, through the converters the project configured. Returns numbered lines, bounded; read again with offset for more. Read-only.", { path: str, offset: { type: "integer", minimum: 1 }, limit: { type: "integer", minimum: 1 } }, ["path"]);
@@ -7260,6 +7288,101 @@ var init_pi = __esm(() => {
     currentReply;
     sessionId = "";
     sessionFile = "";
+    observedTitle;
+    titleRevision = -1;
+    titleEpoch = 0;
+    nativeTitleEpoch;
+    get sessionTitle() {
+      return this.acceptingTools && this.verifiedOwner() ? this.observedTitle : undefined;
+    }
+    get titleSession() {
+      return this.nativeSession;
+    }
+    async setSessionTitle(title, onlyIfUnnamed, current) {
+      const invalid = (error, mayHaveApplied = false) => ({ ok: false, reason: "invalid", error, ...mayHaveApplied ? { mayHaveApplied: true } : {} });
+      if (typeof title !== "string" || !title.trim() || [...title].length > 80 || typeof onlyIfUnnamed !== "boolean")
+        return invalid("Session title must contain 1-80 normalized characters and use a conditional-write flag; correct the title request and try again.");
+      if (this.stopping || this.state === "offline")
+        return invalid("Pi session is offline or stopped; start or reconnect Pi and check ahub status before naming it.");
+      const session = this.sessionId, generation = this.budgetGeneration, owner = this.sessionGeneration, epoch = this.titleEpoch;
+      if (!owner || !this.verifiedOwner())
+        return invalid("Pi native session owner is unverified; reconnect the retained Pi session and check ahub status before naming it.");
+      if (!this.acceptingTools)
+        return invalid("Pi session is detached or running a personal turn; reconnect its current hub session and check ahub status before naming it.");
+      const valid = () => {
+        try {
+          return this.acceptingTools && this.verifiedOwner() && this.sessionGeneration === owner && this.sessionId === session && this.budgetGeneration === generation && this.titleEpoch === epoch && current?.() !== false;
+        } catch {
+          return false;
+        }
+      };
+      if (!valid())
+        return invalid("Pi session, turn or title admission changed before dispatch; check ahub status before retrying in the current public session.");
+      let dispatched = false;
+      try {
+        const result = await this.sendTui({ type: "set_session_title", title, onlyIfUnnamed, sessionId: session, generation, ...this.nativeTitleEpoch ? { titleEpoch: this.nativeTitleEpoch } : {} }, valid, () => {
+          dispatched = true;
+        });
+        if (!valid())
+          return invalid("Pi session, turn or title admission changed after dispatch; the title may have been applied; check ahub status before retrying.", true);
+        if (result?.ok === false && result.reason === "invalid") {
+          if (result.cause === "session")
+            return invalid("Pi native session changed before the title write; check ahub status and reconnect the current session before retrying.");
+          if (result.cause === "generation")
+            return invalid("Pi native turn changed before the title write; wait for the current turn and check ahub status before retrying.");
+          if (result.cause === "arguments")
+            return invalid("Pi rejected invalid title command arguments; use a 1-80 character normalized title and retry in the current session.");
+          if (result.cause === "native_unavailable")
+            return invalid("Pi native title API is unavailable; restart Pi with the supported hub extension and check ahub status before retrying.");
+          if (result.cause === "native_failed")
+            return invalid("Pi native title API failed without confirming the write; the title may have been applied; check ahub status before retrying.", true);
+          if (result.cause === "native_readback")
+            return invalid("Pi native title readback did not confirm the write; the title may have been applied; check ahub status before retrying.", true);
+        }
+        if (result?.sessionId !== session || typeof result.sessionName !== "string" || this.nativeTitleEpoch !== undefined && result.titleEpoch !== this.nativeTitleEpoch)
+          return invalid("Pi title acknowledgement did not confirm the current native slot; the title may have been applied; check ahub status before retrying.", true);
+        this.observeTitle(result.sessionName, result.titleRevision, result.titleEpoch);
+        if (result.ok === false && result.reason === "already_named")
+          return { ok: false, reason: "already_named", error: "This session already has a title; keep it or ask the person to rename it with ahub title." };
+        if (result.ok === true && result.sessionName === title)
+          return { ok: true };
+        return invalid("Pi native title write or readback was not confirmed; the title may have been applied; check ahub status before retrying.", true);
+      } catch (error) {
+        const timeout = error instanceof Error && error.message.includes("acknowledgement timed out");
+        if (dispatched)
+          return invalid(`Pi title ${timeout ? "acknowledgement timed out" : "bridge command failed after dispatch"}; the title may have been applied; check ahub status before retrying.`, true);
+        return invalid(`Pi title ${timeout ? "command expired" : "admission changed or bridge failed"} before dispatch; check ahub status before retrying in the current session.`);
+      }
+    }
+    observeTitle(value, revision, epoch) {
+      if (this.nativeTitleEpoch !== undefined && epoch !== this.nativeTitleEpoch)
+        return;
+      if (typeof revision === "number" && Number.isSafeInteger(revision) && revision >= 0) {
+        if (revision < this.titleRevision)
+          return;
+        this.titleRevision = revision;
+      }
+      if (value === undefined)
+        value = "";
+      if (typeof value !== "string")
+        return;
+      if (value)
+        this.noteActivity();
+      if (this.observedTitle !== value) {
+        this.observedTitle = value;
+        this.onDoing?.("title", value);
+      }
+    }
+    observeSnapshotTitle(snapshot, before, beforeEpoch) {
+      if (this.titleEpoch !== beforeEpoch || snapshot.titleEpoch !== undefined && snapshot.titleEpoch !== this.nativeTitleEpoch)
+        return false;
+      if (snapshot.titleRevision === undefined && this.titleRevision !== before)
+        return false;
+      if (typeof snapshot.titleRevision === "number" && snapshot.titleRevision < this.titleRevision)
+        return false;
+      this.observeTitle(snapshot.sessionName, snapshot.titleRevision, snapshot.titleEpoch ?? this.nativeTitleEpoch);
+      return true;
+    }
     executionBudgetTimer;
     executionAbort;
     budgetStops = new Map;
@@ -7378,12 +7501,15 @@ var init_pi = __esm(() => {
         throw new Error("Pi must settle before session capture");
       if (this.sessionFile && existsSync7(this.sessionFile))
         return this.recoveryMetadata();
+      const titleRevisionBefore = this.titleRevision, titleEpochBefore = this.titleEpoch;
       const snapshot = this.opts.mode === "headless" ? (await this.waitRpc("get_state", 15000)).data : await this.sendTui({ type: "get_session_state" });
       if (this.state !== "idle" || this.activeTools || snapshot?.sessionId !== this.sessionId || snapshot?.sessionFile !== this.sessionFile)
         throw new Error("Pi source session changed during capture");
+      if (!this.observeSnapshotTitle(snapshot, titleRevisionBefore, titleEpochBefore))
+        throw new Error("Pi source session title changed during capture; retry with a fresh native session snapshot");
       const empty = this.opts.mode === "headless" ? snapshot.messageCount === 0 && snapshot.pendingMessageCount === 0 && snapshot.isStreaming === false && snapshot.isCompacting !== true && !snapshot.sessionName : snapshot.empty === true && snapshot.idle === true;
       if (!empty || this.activityObserved || this.persistedOnce)
-        throw new Error("Pi session history is not persisted; refusing to recreate it");
+        throw new Error("Pi session history is not persisted; refusing to recreate it. Exchange one message or start a new session, then retry");
       this.emptyResumeVerified = true;
       const captured = this.recoveryMetadata();
       if (typeof captured.sessionId === "string" && !captured.sessionFile)
@@ -7570,6 +7696,10 @@ var init_pi = __esm(() => {
         await this.preflight();
       this.terminalOwnerObservation = undefined;
       this.stopping = false;
+      this.observedTitle = undefined;
+      this.titleRevision = -1;
+      this.nativeTitleEpoch = undefined;
+      this.onDoing?.("reset");
       this.rosterDetached = false;
       this.rosterUnownedRun = false;
       this.requestedStopReason = undefined;
@@ -7670,6 +7800,7 @@ var init_pi = __esm(() => {
         this.fail(new Error(`pi exited with ${signal ? `signal ${signal}` : `code ${code}`}`));
         this.reportExit(exit);
       });
+      const titleRevisionBefore = this.titleRevision, titleEpochBefore = this.titleEpoch;
       const state = await this.waitRpc("get_state", 15000);
       if (state.success !== true || typeof state.data?.sessionId !== "string" || typeof state.data?.sessionFile !== "string" || !state.data.sessionId || !state.data.sessionFile)
         throw new Error("Pi get_state did not prove session identity");
@@ -7690,6 +7821,7 @@ var init_pi = __esm(() => {
       this.persistedOnce = existsSync7(this.sessionFile);
       if (this.opts.sessionId && this.sessionId !== this.opts.sessionId || this.opts.sessionFile && this.sessionFile !== this.opts.sessionFile)
         throw new Error("Pi startup session identity mismatch");
+      this.observeSnapshotTitle(state.data, titleRevisionBefore, titleEpochBefore);
       this.started = true;
       this.setState("idle");
     }
@@ -7779,11 +7911,13 @@ var init_pi = __esm(() => {
       if (this.pendingPromptId)
         throw new Error("Pi prompt admission is still pending; wait before reverifying the retained terminal");
       const epoch = this.rosterEpoch, lifecycle = this.rosterLifecycleRevision, session = this.sessionId, file = this.sessionFile;
+      const titleRevisionBefore = this.titleRevision, titleEpochBefore = this.titleEpoch;
       const snapshot = await this.sendTui({ type: "get_session_state" });
       if (epoch !== this.rosterEpoch || this.stopping || !this.verifiedOwner() || this.activeTools || snapshot?.sessionId !== session || snapshot?.sessionFile !== file || typeof snapshot?.idle !== "boolean")
         throw new Error("Pi roster return could not verify the current native session");
       if (lifecycle !== this.rosterLifecycleRevision)
         throw new Error("Pi native activity changed during roster return; retry with a fresh session snapshot");
+      this.observeSnapshotTitle(snapshot, titleRevisionBefore, titleEpochBefore);
       this.rosterDetached = false;
       this.hubPromptId = undefined;
       this.hubPromptGeneration = undefined;
@@ -7934,12 +8068,14 @@ var init_pi = __esm(() => {
         attempted = true;
         if (deliveryId)
           this.activeDeliveryIds.add(deliveryId);
+        const message = [envs.some((env) => env.private || remoteEnvelope(env)) ? undefined : this.opts.titlePreface?.(), renderDigest(envs, true)].filter(Boolean).join(`
+`);
         if (this.opts.mode === "tui") {
-          const pending = this.sendTui({ type: "prompt", message: renderDigest(envs, true) });
+          const pending = this.sendTui({ type: "prompt", message });
           promptId = this.pendingPromptId;
           await pending;
         } else
-          await this.sendRpc({ type: "prompt", message: renderDigest(envs, true) });
+          await this.sendRpc({ type: "prompt", message });
         if (promptId !== undefined && promptId !== this.pendingPromptId)
           return;
         if (this.fencedPrompt && this.rosterDetached) {
@@ -8116,6 +8252,10 @@ var init_pi = __esm(() => {
           this.opts.log?.(`[${this.id}] Pi session identity mismatch`);
           return;
         }
+        this.titleRevision = -1;
+        this.titleEpoch++;
+        this.nativeTitleEpoch = typeof event.titleEpoch === "string" && event.titleEpoch ? event.titleEpoch : undefined;
+        this.observeTitle(event.sessionName, event.titleRevision, event.titleEpoch);
         this.rememberTerminalOwner();
         this.startOwnerMonitor();
         if (this.opts.mode === "tui") {
@@ -8123,7 +8263,13 @@ var init_pi = __esm(() => {
           this.setState("idle");
         }
       }
+      if ((event.type === "session_title" || event.type === "agent_start" && Object.hasOwn(event, "sessionName")) && event.sessionId === this.sessionId && this.verifiedOwner())
+        this.observeTitle(event.sessionName, event.titleRevision, event.titleEpoch);
       if (event.type === "session_shutdown") {
+        this.observedTitle = undefined;
+        this.titleRevision = -1;
+        this.nativeTitleEpoch = undefined;
+        this.onDoing?.("reset");
         const exit = this.exitMetadata("session_shutdown");
         this.shutdownExit ??= exit;
         this.stopping = true;
@@ -8263,9 +8409,19 @@ var init_pi = __esm(() => {
       }
     }
     nextTuiCommand(timeout) {
-      const next = this.tuiQueue.shift();
-      if (next)
-        return Promise.resolve(next);
+      let next = this.tuiQueue.shift();
+      while (next) {
+        const pending = this.tuiCommands.get(String(next.id));
+        if (pending && pending.current?.() !== false) {
+          pending.onDispatch?.();
+          return Promise.resolve(next);
+        }
+        if (pending) {
+          this.tuiCommands.delete(String(next.id));
+          pending.reject(new Error("Pi session title admission changed before dispatch"));
+        }
+        next = this.tuiQueue.shift();
+      }
       return new Promise((resolvePromise) => {
         const entry = { resolve: resolvePromise, timer: setTimeout(() => {
           const i = this.tuiWaiters.indexOf(entry);
@@ -8276,7 +8432,9 @@ var init_pi = __esm(() => {
         this.tuiWaiters.push(entry);
       });
     }
-    sendTui(command) {
+    sendTui(command, current, onDispatch) {
+      if (current?.() === false)
+        return Promise.reject(new Error("Pi session title admission changed before dispatch"));
       const id = `ahub-${++this.seq}`;
       const fenced = this.fencedPrompt && command.type === "prompt";
       if (fenced) {
@@ -8291,7 +8449,7 @@ var init_pi = __esm(() => {
           this.tuiQueue = this.tuiQueue.filter((queued) => queued.id !== id);
           reject(new Error(`Pi TUI ${String(command.type)} acknowledgement timed out`));
         }, 30000);
-        this.tuiCommands.set(id, { command: wire, resolve: (value) => {
+        this.tuiCommands.set(id, { command: wire, current, onDispatch, resolve: (value) => {
           clearTimeout(timer);
           resolvePromise(value);
         }, reject: (error) => {
@@ -8301,6 +8459,7 @@ var init_pi = __esm(() => {
         const waiter = this.tuiWaiters.shift();
         if (waiter) {
           clearTimeout(waiter.timer);
+          onDispatch?.();
           waiter.resolve(wire);
         } else
           this.tuiQueue.push(wire);
@@ -9958,6 +10117,464 @@ var init_test_integrity = __esm(() => {
 // src/hub/plan-conformance.ts
 var init_plan_conformance = () => {};
 
+// src/hub/control-write-trace.ts
+import { AsyncLocalStorage } from "async_hooks";
+function isObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function validTaskId(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function numericTaskId(value) {
+  return validTaskId(value) ? value : undefined;
+}
+function ownValue(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor && Object.hasOwn(descriptor, "value") ? descriptor.value : undefined;
+}
+function controlWriteMetadata(message) {
+  if (!isObject(message))
+    return;
+  try {
+    let kind;
+    let args;
+    const type = ownValue(message, "t"), operation = ownValue(message, "op");
+    if (type === "delivery_complete")
+      kind = "hub_delivery_done";
+    else if (type === "task" && typeof operation === "string") {
+      kind = Object.hasOwn(OPERATIONS, operation) ? OPERATIONS[operation] : undefined;
+      const rawArgs = ownValue(message, "args");
+      args = isObject(rawArgs) ? rawArgs : undefined;
+    }
+    if (!kind)
+      return;
+    const task = numericTaskId(args ? ownValue(args, "id") : undefined);
+    return task === undefined ? { kind } : { kind, task };
+  } catch {
+    return;
+  }
+}
+function isPhase(value) {
+  return CONTROL_WRITE_PHASES.includes(value);
+}
+function isThenable(value) {
+  try {
+    return !!value && (typeof value === "object" || typeof value === "function") && typeof value.then === "function";
+  } catch {
+    return false;
+  }
+}
+function controlWriteSpan(phase, fn) {
+  const request = currentTrace.getStore();
+  if (!request || request.settled || request.privacySuppressed || !isPhase(phase))
+    return fn();
+  const span = request.telemetry.beginSpan(request, phase);
+  let result;
+  try {
+    result = fn();
+  } catch (error) {
+    request.telemetry.finishSpan(span);
+    throw error;
+  }
+  if (!isThenable(result)) {
+    request.telemetry.finishSpan(span);
+    return result;
+  }
+  span.async = true;
+  request.telemetry.recordSyncPrefix(span);
+  return Promise.resolve(result).then((value) => {
+    request.telemetry.finishSpan(span);
+    return value;
+  }, (error) => {
+    request.telemetry.finishSpan(span);
+    throw error;
+  });
+}
+
+class ControlWriteTelemetry {
+  options;
+  nowFn;
+  maxActiveRequests;
+  maxActiveSpans;
+  maxRecentSpans;
+  rateLimitMs;
+  requests = new Map;
+  spans = new Map;
+  recent = [];
+  emitted = [];
+  lastEmit = new Map;
+  nextRequestId = 1;
+  nextSpanId = 1;
+  timer;
+  nextSampleAt;
+  lastNow = 0;
+  stopped = false;
+  completedRequests = 0;
+  expiredRequests = 0;
+  slowRequests = 0;
+  blockedLoopSamples = 0;
+  droppedActive = 0;
+  droppedSpans = 0;
+  droppedRecent = 0;
+  droppedLogs = 0;
+  droppedMetadata = 0;
+  clockFailures = 0;
+  constructor(options) {
+    this.options = options;
+    this.nowFn = options.now ?? (() => performance.now());
+    this.maxActiveRequests = options.maxActiveRequests ?? MAX_ACTIVE_REQUESTS;
+    this.maxActiveSpans = options.maxActiveSpans ?? MAX_ACTIVE_SPANS;
+    this.maxRecentSpans = options.maxRecentSpans ?? MAX_RECENT_SPANS;
+    this.rateLimitMs = options.rateLimitMs ?? RATE_LIMIT_MS;
+    if (![this.maxActiveRequests, this.maxActiveSpans, this.maxRecentSpans].every((value) => Number.isSafeInteger(value) && value > 0) || !Number.isSafeInteger(this.rateLimitMs) || this.rateLimitMs < 0 || this.rateLimitMs > RATE_LIMIT_MS || this.maxActiveRequests > MAX_ACTIVE_REQUESTS || this.maxActiveSpans > MAX_ACTIVE_SPANS || this.maxRecentSpans > MAX_RECENT_SPANS)
+      throw new Error("invalid control write trace bounds");
+  }
+  run(metadata, privacyCurrent, fn, inputPublic) {
+    if (this.stopped)
+      return fn();
+    const safeMetadata = this.safeMetadata(metadata);
+    if (!safeMetadata || typeof privacyCurrent !== "function") {
+      this.droppedMetadata++;
+      return fn();
+    }
+    const now = this.readNow();
+    this.expireRequests(now);
+    if (this.requests.size >= this.maxActiveRequests) {
+      this.droppedActive++;
+      return fn();
+    }
+    if (!this.privateNow(privacyCurrent))
+      return fn();
+    const inputVisible = !inputPublic || this.privateNow(inputPublic);
+    inputPublic = undefined;
+    if (!inputVisible)
+      return fn();
+    const request = {
+      telemetry: this,
+      metadata: safeMetadata,
+      privacyCurrent,
+      startedAt: now,
+      phases: new Map,
+      phaseOrder: [],
+      settled: false,
+      privacySuppressed: false,
+      logPrivacy: () => false
+    };
+    request.logPrivacy = () => !request.privacySuppressed && this.privateNow(request.privacyCurrent);
+    const id = this.nextRequestId++;
+    this.requests.set(id, request);
+    let result;
+    try {
+      result = currentTrace.run(request, fn);
+    } catch (error) {
+      this.finishRequest(id, request, "threw");
+      throw error;
+    }
+    if (!isThenable(result)) {
+      this.finishRequest(id, request, "returned");
+      return result;
+    }
+    return Promise.resolve(result).then((value) => {
+      this.finishRequest(id, request, "returned");
+      return value;
+    }, (error) => {
+      this.finishRequest(id, request, "threw");
+      throw error;
+    });
+  }
+  observe(phase, privacyCurrent, fn, inputPublic) {
+    if (this.stopped)
+      return fn();
+    const current = currentTrace.getStore();
+    if (current?.telemetry === this && !current.settled) {
+      if (current.privacySuppressed)
+        return fn();
+      const inputVisible = this.privateNow(privacyCurrent) && (!inputPublic || this.privateNow(inputPublic));
+      inputPublic = undefined;
+      if (!inputVisible)
+        current.privacySuppressed = true;
+      return controlWriteSpan(phase, fn);
+    }
+    return this.run({ kind: "background" }, privacyCurrent, () => controlWriteSpan(phase, fn), inputPublic);
+  }
+  start() {
+    if (this.stopped || this.timer)
+      return;
+    this.nextSampleAt = this.readNow() + CONTROL_WRITE_SAMPLE_MS;
+    this.timer = setInterval(() => this.sample(), CONTROL_WRITE_SAMPLE_MS);
+    this.timer.unref?.();
+  }
+  stop() {
+    this.stopped = true;
+    if (this.timer)
+      clearInterval(this.timer);
+    this.timer = undefined;
+    this.nextSampleAt = undefined;
+  }
+  sample() {
+    if (this.stopped)
+      return;
+    const now = this.readNow(), expected = this.nextSampleAt ?? now;
+    this.expireRequests(now);
+    this.nextSampleAt = now + CONTROL_WRITE_SAMPLE_MS;
+    const delayMs = Math.max(0, now - expected);
+    if (delayMs < CONTROL_WRITE_LOOP_DELAY_MS)
+      return;
+    this.blockedLoopSamples++;
+    const from = expected;
+    const observed = [];
+    for (const interval of this.recent) {
+      if (interval.async || interval.endedAt === undefined || interval.startedAt >= now || interval.endedAt < from)
+        continue;
+      observed.push({ kind: interval.kind, ...interval.task === undefined ? {} : { task: interval.task }, phase: interval.phase, durationMs: this.roundMs(interval.endedAt - interval.startedAt), privacyCurrent: interval.privacyCurrent });
+    }
+    for (const span of this.spans.values()) {
+      if (!span.async || span.startedAt >= now)
+        continue;
+      observed.push({
+        kind: span.request.metadata.kind,
+        ...span.request.metadata.task === undefined ? {} : { task: span.request.metadata.task },
+        phase: span.phase,
+        durationMs: this.roundMs(now - span.startedAt),
+        open: true,
+        privacyCurrent: span.request.logPrivacy
+      });
+    }
+    const unique = new Map;
+    for (const row of observed.sort((a, b) => b.durationMs - a.durationMs)) {
+      const key = `${row.kind}:${row.task ?? ""}:${row.phase}:${row.open === true}`;
+      if (!unique.has(key))
+        unique.set(key, row);
+    }
+    const selected = [...unique.values()].slice(0, MAX_LOOP_SPANS);
+    const spans = selected.map(({ kind, task, phase, durationMs, open }) => ({ kind, ...task === undefined ? {} : { task }, phase, durationMs, ...open ? { open: true } : {} }));
+    const guards = [...new Set(selected.map((row) => row.privacyCurrent))];
+    const attribution = selected.some((row) => row.open !== true) ? "sync_overlap_observed" : selected.length ? "open_async_wait" : "unknown";
+    this.emit("loop", {
+      type: "control_write_loop_delay",
+      delayMs: this.roundMs(delayMs),
+      attribution,
+      spans
+    }, () => guards.every((guard) => this.privateNow(guard)));
+  }
+  status() {
+    return {
+      active: this.requests.size,
+      activeSpans: this.spans.size,
+      completedRequests: this.completedRequests,
+      expiredRequests: this.expiredRequests,
+      slowRequests: this.slowRequests,
+      blockedLoopSamples: this.blockedLoopSamples,
+      recentSpans: this.recent.length,
+      droppedActive: this.droppedActive,
+      droppedSpans: this.droppedSpans,
+      droppedRecent: this.droppedRecent,
+      droppedLogs: this.droppedLogs,
+      droppedMetadata: this.droppedMetadata,
+      clockFailures: this.clockFailures
+    };
+  }
+  beginSpan(request, phase) {
+    const span = { request, phase, startedAt: this.readNow(), async: false, finished: false, prefixRecorded: false };
+    if (this.spans.size >= this.maxActiveSpans) {
+      this.droppedSpans++;
+      return span;
+    }
+    span.id = this.nextSpanId++;
+    this.spans.set(span.id, span);
+    return span;
+  }
+  finishSpan(span) {
+    if (span.finished)
+      return;
+    span.finished = true;
+    if (span.request.settled)
+      return;
+    const endedAt = this.readNow();
+    if (span.id !== undefined && this.spans.get(span.id) === span)
+      this.spans.delete(span.id);
+    const durationMs = Math.max(0, endedAt - span.startedAt);
+    const request = span.request;
+    const prior = request.phases.get(span.phase) ?? 0;
+    if (!request.phaseOrder.includes(span.phase))
+      request.phaseOrder.push(span.phase);
+    request.phases.set(span.phase, prior + durationMs);
+    if (!span.async && !span.prefixRecorded)
+      this.rememberSyncInterval(span, endedAt);
+  }
+  recordSyncPrefix(span) {
+    if (span.finished || span.prefixRecorded || span.request.settled)
+      return;
+    const endedAt = this.readNow();
+    if (endedAt - span.startedAt < MIN_SYNC_PREFIX_MS)
+      return;
+    span.prefixRecorded = true;
+    this.rememberSyncInterval(span, endedAt);
+  }
+  rememberSyncInterval(span, endedAt) {
+    const request = span.request;
+    this.recent.push({ kind: request.metadata.kind, ...request.metadata.task === undefined ? {} : { task: request.metadata.task }, phase: span.phase, startedAt: span.startedAt, endedAt, async: false, privacyCurrent: request.logPrivacy });
+    while (this.recent.length > this.maxRecentSpans) {
+      this.recent.shift();
+      this.droppedRecent++;
+    }
+  }
+  finishRequest(id, request, outcome) {
+    if (!this.requests.delete(id))
+      return;
+    request.settled = true;
+    for (const [spanId, span] of this.spans)
+      if (span.request === request)
+        this.spans.delete(spanId);
+    this.completedRequests++;
+    const durationMs = this.roundMs(this.readNow() - request.startedAt);
+    if (durationMs < CONTROL_WRITE_SLOW_MS)
+      return;
+    this.slowRequests++;
+    const phases = request.phaseOrder.map((phase) => ({ phase, durationMs: this.roundMs(request.phases.get(phase) ?? 0) }));
+    this.emit("slow", {
+      type: "control_write_slow",
+      kind: request.metadata.kind,
+      ...request.metadata.task === undefined ? {} : { task: request.metadata.task },
+      durationMs,
+      outcome,
+      phases: phases.slice(0, MAX_LOOP_SPANS),
+      ...phases.length > MAX_LOOP_SPANS ? { truncated: true } : {}
+    }, request.logPrivacy);
+  }
+  expireRequests(now) {
+    for (const [id, request] of this.requests) {
+      if (now - request.startedAt < CONTROL_WRITE_REQUEST_MAX_AGE_MS)
+        continue;
+      request.settled = true;
+      request.privacySuppressed = true;
+      this.requests.delete(id);
+      this.expiredRequests++;
+    }
+    for (const [id, span] of this.spans)
+      if (span.request.settled)
+        this.spans.delete(id);
+  }
+  emit(key, value, privacyCurrent) {
+    if (this.stopped || !this.privateNow(privacyCurrent))
+      return;
+    const now = this.readNow(), last = this.lastEmit.get(key);
+    if (last !== undefined && now - last < this.rateLimitMs) {
+      this.droppedLogs++;
+      return;
+    }
+    while (this.emitted.length && now - this.emitted[0] >= 60000)
+      this.emitted.shift();
+    if (this.emitted.length >= MAX_EMITS_PER_MINUTE) {
+      this.droppedLogs++;
+      return;
+    }
+    let line;
+    try {
+      line = JSON.stringify(value);
+    } catch {
+      this.droppedLogs++;
+      return;
+    }
+    if (Buffer.byteLength(line) > CONTROL_WRITE_MAX_LINE_BYTES) {
+      const minimal = value.type === "control_write_loop_delay" ? { type: "control_write_loop_delay", delayMs: typeof value.delayMs === "number" ? value.delayMs : 0, attribution: "unknown", spans: [], truncated: true } : { type: "control_write_slow", kind: value.kind, ...value.task === undefined ? {} : { task: value.task }, durationMs: value.durationMs, outcome: value.outcome, phases: [], truncated: true };
+      line = JSON.stringify(minimal);
+      if (Buffer.byteLength(line) > CONTROL_WRITE_MAX_LINE_BYTES) {
+        this.droppedLogs++;
+        return;
+      }
+    }
+    this.lastEmit.set(key, now);
+    this.emitted.push(now);
+    try {
+      this.options.emit(line);
+    } catch {
+      this.droppedLogs++;
+    }
+  }
+  privateNow(guard) {
+    try {
+      return guard() === true;
+    } catch {
+      return false;
+    }
+  }
+  safeMetadata(metadata) {
+    if (!isObject(metadata))
+      return;
+    try {
+      const kind = ownValue(metadata, "kind"), task = ownValue(metadata, "task");
+      if (typeof kind !== "string" || !CONTROL_WRITE_KINDS.includes(kind) || task !== undefined && !validTaskId(task))
+        return;
+      return { kind, ...task === undefined ? {} : { task } };
+    } catch {
+      return;
+    }
+  }
+  readNow() {
+    let value;
+    try {
+      value = this.nowFn();
+    } catch {
+      this.clockFailures++;
+      return this.lastNow;
+    }
+    if (!Number.isFinite(value) || value < this.lastNow) {
+      this.clockFailures++;
+      return this.lastNow;
+    }
+    this.lastNow = value;
+    return value;
+  }
+  roundMs(value) {
+    const bounded = Number.isFinite(value) ? Math.min(CONTROL_WRITE_MAX_DURATION_MS, Math.max(0, value)) : CONTROL_WRITE_MAX_DURATION_MS;
+    return Math.round(bounded * 10) / 10;
+  }
+}
+var CONTROL_WRITE_KINDS, CONTROL_WRITE_PHASES, CONTROL_WRITE_SLOW_MS = 1000, CONTROL_WRITE_LOOP_DELAY_MS = 250, CONTROL_WRITE_SAMPLE_MS = 100, CONTROL_WRITE_MAX_LINE_BYTES = 2048, CONTROL_WRITE_MAX_DURATION_MS = 86400000, CONTROL_WRITE_REQUEST_MAX_AGE_MS, MAX_ACTIVE_REQUESTS = 128, MAX_ACTIVE_SPANS = 256, MAX_RECENT_SPANS = 512, MAX_LOOP_SPANS = 8, MIN_SYNC_PREFIX_MS = 10, MAX_EMITS_PER_MINUTE = 60, RATE_LIMIT_MS = 1000, currentTrace, OPERATIONS;
+var init_control_write_trace = __esm(() => {
+  CONTROL_WRITE_KINDS = [
+    "hub_task_propose",
+    "hub_review",
+    "hub_task_accept",
+    "hub_task_done",
+    "hub_task_decline",
+    "hub_task_cancel",
+    "hub_task_assign",
+    "task_assign",
+    "task_assign_checked",
+    "task_unassign",
+    "hub_delivery_done",
+    "background"
+  ];
+  CONTROL_WRITE_PHASES = [
+    "client-send",
+    "client-wait",
+    "daemon-dispatch",
+    "daemon-reply",
+    "board-write",
+    "queue-hook",
+    "status-hook",
+    "memory",
+    "external",
+    "snapshot"
+  ];
+  CONTROL_WRITE_REQUEST_MAX_AGE_MS = 5 * 60000;
+  currentTrace = new AsyncLocalStorage;
+  OPERATIONS = {
+    hub_task_propose: "hub_task_propose",
+    hub_review: "hub_review",
+    hub_task_accept: "hub_task_accept",
+    hub_task_done: "hub_task_done",
+    hub_task_decline: "hub_task_decline",
+    hub_task_cancel: "hub_task_cancel",
+    hub_task_assign: "hub_task_assign",
+    task_assign: "task_assign",
+    task_assign_checked: "task_assign_checked",
+    task_unassign: "task_unassign"
+  };
+});
+
 // src/hub/review-findings.ts
 var MAX_BYTES2;
 var init_review_findings = __esm(() => {
@@ -10003,6 +10620,7 @@ var SDLC_STAGES, PLAYBOOK_STAGES, BASES, STAGE_GATES, GATES;
 var init_sdlc = __esm(() => {
   init_test_integrity();
   init_plan_conformance();
+  init_control_write_trace();
   init_review_findings();
   init_sdlc_metrics();
   init_eval_gate();
@@ -11188,10 +11806,10 @@ var init_shard_bridge = __esm(() => {
 });
 
 // node_modules/@staix/agent-mem/src/memory/cli-attribution.ts
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var scope;
 var init_cli_attribution = __esm(() => {
-  scope = new AsyncLocalStorage;
+  scope = new AsyncLocalStorage2;
 });
 
 // node_modules/@staix/agent-mem/src/memory/private-spans.ts
@@ -11789,7 +12407,7 @@ var init_hook_contract = __esm(() => {
 });
 
 // node_modules/@staix/agent-mem/src/hook-spool.ts
-var RECORD_BYTES, MAX_BYTES6, DRAIN_BYTES, CAPACITY_BYTES, RETIRE_AFTER_MS;
+var RECORD_BYTES, MAX_BYTES6, HOOK_REPLAY_MAX_BYTES, CAPACITY_BYTES, RETIRE_AFTER_MS;
 var init_hook_spool = __esm(() => {
   init_formats();
   init_capture_input();
@@ -11804,7 +12422,7 @@ var init_hook_spool = __esm(() => {
   init_hook_contract();
   RECORD_BYTES = HOOK_INPUT_BYTES + 8192;
   MAX_BYTES6 = 2 * 1024 * 1024;
-  DRAIN_BYTES = 256 * 1024;
+  HOOK_REPLAY_MAX_BYTES = 256 * 1024;
   CAPACITY_BYTES = 256 * 1024;
   RETIRE_AFTER_MS = 7 * 24 * 3600000;
 });
@@ -11851,6 +12469,7 @@ var init_hook_jcode = __esm(() => {
 });
 
 // node_modules/@staix/agent-mem/src/hooks.ts
+var hookStartedAt;
 var init_hooks = __esm(() => {
   init_hook_project();
   init_hook_native();
@@ -11866,6 +12485,7 @@ var init_hooks = __esm(() => {
   init_config();
   init_hook_contract();
   init_hook_contract();
+  hookStartedAt = performance.now();
 });
 
 // node_modules/@staix/agent-mem/src/ingest.ts
@@ -12013,7 +12633,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@staix/agent-hub",
-    version: "0.28.0",
+    version: "0.30.0",
     description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
     license: "MIT",
     type: "module",
@@ -12030,7 +12650,7 @@ var init_package = __esm(() => {
       bun: ">=1.4.2"
     },
     dependencies: {
-      "@staix/agent-mem": "0.19.0"
+      "@staix/agent-mem": "0.20.1"
     },
     devDependencies: {
       "@modelcontextprotocol/sdk": "^1.27.1",
@@ -12100,6 +12720,7 @@ var init_board = __esm(() => {
   init_task_code_symbols();
   init_plan_conformance();
   init_db_schema();
+  init_control_write_trace();
   init_planning();
   init_envelope();
   init_review_findings();
@@ -12256,7 +12877,7 @@ function profileTaskTools(profile = "dev", stages, criteria = false) {
     if (customProfile && tool.name === "hub_task_propose")
       properties.class = { type: "string", enum: [...new Set([...Object.keys(data.classes), ...PROFILE_CLASS_NAMES.filter((v) => projectProfile("dev").classes[v])])] };
     if (customProfile && properties.plan && tool.name !== "hub_task_accept" && tool.name !== "hub_experiment_record")
-      properties.plan = { ...plan, properties: { ...Object.fromEntries(data.plan_keys.map((key) => [key, plan.properties[key] ?? list(key === "sections" ? "document heading anchors, such as report.md#methods" : key === "sources" ? "citation ids, DOI or source URL ids" : "short claim ids to verify")])) } };
+      properties.plan = { ...plan, properties: { ...Object.fromEntries(data.plan_keys.map((key) => [key, plan.properties[key] ?? list(key === "sections" ? "document heading anchors, such as report.md#methods" : key === "sources" ? "registered src:<16 hex> source ids; list available ids with ahub source list" : "short claim ids to verify")])) } };
     if (customProfile && tool.name === "hub_task_done" && data.name !== "dev") {
       const summaryProp = properties.summary;
       properties.summary = {
@@ -12266,7 +12887,7 @@ function profileTaskTools(profile = "dev", stages, criteria = false) {
     }
     if (customProfile && tool.name === "hub_backlog_split") {
       const parts = properties.parts;
-      const selectedPlan = { ...plan, properties: { ...Object.fromEntries(data.plan_keys.map((key) => [key, plan.properties[key] ?? list(key === "sections" ? "document heading anchors, such as report.md#methods" : key === "sources" ? "citation ids, DOI or source URL ids" : "short claim ids to verify")])) } };
+      const selectedPlan = { ...plan, properties: { ...Object.fromEntries(data.plan_keys.map((key) => [key, plan.properties[key] ?? list(key === "sections" ? "document heading anchors, such as report.md#methods" : key === "sources" ? "registered src:<16 hex> source ids; list available ids with ahub source list" : "short claim ids to verify")])) } };
       properties.parts = { ...parts, items: { ...parts.items, properties: { ...parts.items.properties, plan: selectedPlan } } };
     }
     if (criteria && properties.plan && tool.name !== "hub_experiment_record") {
@@ -12294,7 +12915,7 @@ var IMPLEMENTER_HUB_TOOL_NAMES, IMPLEMENTER_PERMISSION_TOOL, ACTIONABLE_MESSAGE_
   name,
   description,
   inputSchema: { type: "object", properties: name === "hub_review" || name === "hub_task_propose" ? { ...properties, request_id: toolWriteRequestId } : properties, required, additionalProperties: false }
-}), STUDY_TOOLS, HANDOFF_TOOLS, BOUNDED_TASK_TOOLS, CAPABILITY_TOOLS, TASK_TOOLS, PLANNER_REVIEW_TOOLS, TASK_TOOL_NAMES, CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, READ_ONLY_PROJECT_TOOLS, ROLE_TEXT, DEFAULT_ROLES;
+}), STUDY_TOOLS, HANDOFF_TOOLS, BOUNDED_TASK_TOOLS, CAPABILITY_TOOLS, TASK_TOOLS, PLANNER_REVIEW_TOOLS, SESSION_TITLE_TOOL, TASK_TOOL_NAMES, CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, READ_ONLY_PROJECT_TOOLS, ROLE_TEXT, DEFAULT_ROLES;
 var init_hub_tools = __esm(() => {
   init_test_integrity();
   init_sdlc();
@@ -12357,7 +12978,7 @@ var init_hub_tools = __esm(() => {
     },
     additionalProperties: false
   };
-  acceptPlan = { ...plan, properties: { ...plan.properties, sections: list("document heading anchors, such as report.md#methods"), sources: list("citation ids, DOI or source URL ids"), claims: list("short claim ids to verify") } };
+  acceptPlan = { ...plan, properties: { ...plan.properties, sections: list("document heading anchors, such as report.md#methods"), sources: list("registered src:<16 hex> source ids; list available ids with ahub source list"), claims: list("short claim ids to verify") } };
   STUDY_TOOLS = new Set(["hub_study_draft", "hub_study_revise", "hub_study_show", "hub_experiment_show", "hub_experiment_record", "hub_study_handoff"]);
   HANDOFF_TOOLS = new Set(["hub_task_handoff", "hub_task_handoffs"]);
   BOUNDED_TASK_TOOLS = new Set(["hub_task_spec", "hub_check_start", "hub_check_result", "hub_check_cancel"]);
@@ -12392,7 +13013,7 @@ var init_hub_tools = __esm(() => {
     tool2("hub_task_accept", "Take a task that was assigned to you, with your plan for it. Set refs.repo for work in another repository; acceptance may correct only that repository metadata.", { id: id2, plan: acceptPlan, refs: { ...refs, properties: { repo: refs.properties.repo } } }, ["id"]),
     tool2("hub_task_cancel", "Cancel proposed/backlog work you proposed as its configured planner, including work an owner accepted and then declined while it has no execution, branch, commit or PR evidence; work with any such evidence is person-only. Keeps history and does not stop a native turn or delete files.", { id: id2, reason: str2, superseded_by: str2, revision: { type: "integer", minimum: 0 } }, ["id", "reason"]),
     tool2("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer. A plain decline is a lasting refusal: you are never offered this task again. Pass capacity: true when you only have no room right now: you are skipped for this move only, and a later reroute or planner pull may offer it to you again.", { id: id2, reason: str2, capacity: { type: "boolean" } }, ["id"]),
-    tool2("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs; no duplicate hub_send chat is needed. If a covering spec is unchanged, update it or provide spec_ack with a public reason for each unchanged spec. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id: id2, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs, deliverables: deliverablesSchema, spec_ack: specAck }, ["id", "summary"]),
+    tool2("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs; no duplicate hub_send chat is needed. When re-filing work after review, set refs.commit to the new full SHA; summary text does not change the review head. If a covering spec is unchanged, update it or provide spec_ack with a public reason for each unchanged spec. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id: id2, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs, deliverables: deliverablesSchema, spec_ack: specAck }, ["id", "summary"]),
     tool2("hub_sdlc_record", "Record artifact ids or claimed local checks on your task. This grants no authority or external-check evidence. Only its owner/reviewer or the person may record; only its reviewer/person may name a reviewed head or phase checklist. Phase evidence refs are content hashes, not external verification.", { id: id2, receipt: { type: "object", properties: { deliverables: deliverablesSchema, stage: { type: "string", enum: ["spec", "plan", "implement", "review", "verify", "merge", "release"] }, repo: str2, issue: id2, pr: id2, localHead: str2, localResult: { type: "string", enum: ["passed", "failed", "unknown"] }, reviewedHead: str2, phase: { type: "object", properties: { id: str2, head: str2, tasks: { type: "array", maxItems: 64, items: { type: "object", properties: { id: id2, after: { type: "array", maxItems: 16, items: id2 } }, required: ["id", "after"], additionalProperties: false } }, criteria: { type: "array", maxItems: 32, items: { type: "object", properties: { id: str2, required: { type: "boolean" }, result: { type: "string", enum: ["verified", "failed", "unverified"] }, refs: { type: "array", maxItems: 8, items: str2 } }, required: ["id", "required", "result", "refs"], additionalProperties: false } } }, required: ["id", "tasks", "criteria"], additionalProperties: false } }, additionalProperties: false } }, ["id", "receipt"]),
     tool2("hub_task_list", "The task board, newest updated first, 50 compact rows (id, state, owner, reviewer, title) per call. The reply is {tasks, total, next?}: pass next as cursor for the following page. Use ids for full rows of specific tasks, or detail: true for full rows of a page. PII tasks show as [pii].", { state: { type: "string", enum: ["proposed", "in_progress", "in_review", "approved", "changes_requested", "cancelled"] }, ready: { type: "boolean", description: "only proposed tasks with nothing left to wait for" }, limit: { type: "integer", minimum: 1, maximum: 200, description: "rows per page, default 50" }, cursor: { type: "string", description: "the next value from the previous reply, unchanged" }, ids: { type: "array", minItems: 1, maxItems: 200, items: { type: "integer", minimum: 1 }, description: "full rows for exactly these task numbers; no paging" }, detail: { type: "boolean", description: "full rows instead of compact rows" } }),
     tool2("hub_specs", "Read the project's design-spec checks or find specs covering repository-relative paths. Read-only; at most 20 result items are returned. Does not reveal private task data.", { action: { type: "string", enum: ["check", "covers"] }, paths: { type: "array", maxItems: 32, items: { type: "string", minLength: 1, maxLength: 2000 } } }, ["action"]),
@@ -12426,10 +13047,11 @@ var init_hub_tools = __esm(() => {
     tool2("hub_plan_review", "Record a planner review against the task planning revision and host-read issue edit time. Configured planner or person only; never accepts caller issue timestamps.", { id: id2, revision: { type: "integer", minimum: 0 }, reason: { ...str2, maxLength: 1000 }, ...costPlanProperties }, ["id", "revision", "reason"]),
     tool2("hub_sdlc_costs", "Read bounded review and CI cost metrics for linked merged PRs. Planner/person only; metadata only, no board writes.", { repo: str2 }),
     tool2("hub_sdlc_metrics", "Read SDLC metrics from board history: time from acceptance to plan, first review and merge, first-pass approval and rework rounds, first-pass CI and same-head reruns, stale-head re-reviews, stalls, and the control band tiers when sdlc.toml sets [bands]. Planner/person only; read-only, no model and no GitHub issue.", { since: str2 }),
-    tool2("hub_backlog_return_untouched", "Return accepted but untouched work to the backlog with its history and planning retained. Refuses execution/branch/commit evidence; planner or person only.", { id: id2, revision: { type: "integer", minimum: 0 }, reason: { ...str2, maxLength: 1000 } }, ["id", "revision", "reason"])
+    tool2("hub_backlog_return_untouched", "Return accepted but untouched work to the backlog with its history and planning retained. Optional fields.reserved changes the reservation atomically before capacity is released; null clears it. Refuses execution/branch/commit evidence; planner or person only, and a person's reservation requires the person.", { id: id2, revision: { type: "integer", minimum: 0 }, reason: { ...str2, maxLength: 1000 }, fields: { type: "object", properties: { reserved: { type: ["string", "null"], minLength: 1, maxLength: 32 } }, additionalProperties: false } }, ["id", "revision", "reason"])
   ];
   TASK_TOOLS.push(...PLANNER_REVIEW_TOOLS);
-  TASK_TOOL_NAMES = new Set(TASK_TOOLS.map((t) => t.name));
+  SESSION_TITLE_TOOL = tool2("hub_set_title", "Name your own session once the task is clear. Only an unnamed session accepts the first agent name; the person may replace it. Private contexts refuse the write. No task, branch or instance is renamed.", { title: { type: "string", description: "1-80 characters after doingText normalization (one line, controls removed, surrounding whitespace trimmed)" } }, ["title"]);
+  TASK_TOOL_NAMES = new Set([...TASK_TOOLS.map((t) => t.name), SESSION_TITLE_TOOL.name]);
   CONDUCTOR_TOOLS = [
     tool2("hub_status", "Inspect public team state, holds, quota windows, task counts and pending approval peer/tool/age. Only the configured conductor may use this tool.", {}),
     tool2("hub_task_show", "Read a task's public view and history, its done summary and check result included. PII tasks remain stubs. Only the conductor, the configured planner and the task's current owner and reviewer may use this tool.", { id: id2 }, ["id"]),
@@ -12540,6 +13162,32 @@ var init_local_worker = __esm(() => {
     deliveryOnly = true;
     hubOwned = true;
     history = [];
+    title = "";
+    get sessionTitle() {
+      return this.title;
+    }
+    get titleSession() {
+      return this.sessionId;
+    }
+    async setSessionTitle(title, onlyIfUnnamed, current) {
+      if (typeof title !== "string" || !title.trim() || [...title].length > 80 || typeof onlyIfUnnamed !== "boolean")
+        return { ok: false, reason: "invalid", error: "Session title must contain 1-80 normalized characters and use a conditional-write flag; correct the title request and try again." };
+      if (this.state === "offline")
+        return { ok: false, reason: "invalid", error: "Local worker session is offline; start the peer and check ahub status before naming it." };
+      let admitted = false;
+      try {
+        admitted = current?.() !== false;
+      } catch {}
+      if (!admitted)
+        return { ok: false, reason: "invalid", error: "Session title admission changed before the write; check ahub status and retry only in the current public session." };
+      if (onlyIfUnnamed && this.title)
+        return { ok: false, reason: "already_named", error: "This session already has a title; keep it or ask the person to rename it with ahub title." };
+      this.title = title;
+      try {
+        this.onDoing?.("title", title);
+      } catch {}
+      return { ok: true };
+    }
     sessionId = `agent-hub-local-${randomUUID7()}`;
     routes;
     warnedLegacyRoutes = new Set;
@@ -12570,7 +13218,7 @@ var init_local_worker = __esm(() => {
             throw new Error("route belongs to an ended turn");
           if (signal.aborted)
             throw new Error("turn cancelled before model request");
-          const tools = judge ? undefined : [...this.toolSchemas(), ...this.opts.taskTool ? [...profileTaskTools(this.opts.profile, this.opts.sdlcStages, this.opts.sdlcCriteria).filter((tool) => tool.name !== "hub_delivery_retry"), ...CONDUCTOR_TOOLS].map(asFunction) : []];
+          const tools = judge ? undefined : [...this.toolSchemas(), ...this.opts.taskTool ? [...profileTaskTools(this.opts.profile, this.opts.sdlcStages, this.opts.sdlcCriteria).filter((tool) => tool.name !== "hub_delivery_retry"), ...CONDUCTOR_TOOLS].concat(SESSION_TITLE_TOOL).map(asFunction) : []];
           const result = await this.opts.omni.chat({ model, messages, ...tools ? { tools } : {}, ...judge ? { max_tokens: maxTokens ?? 2048 } : {} }, { signal, ...pii ? { onCampusOnly: true } : {} });
           this.recordUsage(result, model, task);
           if (generation !== this.turn)
@@ -12623,7 +13271,8 @@ var init_local_worker = __esm(() => {
       this.setState("busy");
       if (deliveryId)
         this.delivery({ id: deliveryId, state: "accepted" });
-      const msgs = [{ role: "user", content: renderDigest(envs, true) }];
+      const msgs = [{ role: "user", content: [envs.some((env) => env.private || remoteEnvelope(env)) ? undefined : this.opts.titlePreface?.(), renderDigest(envs, true)].filter(Boolean).join(`
+`) }];
       const progress = { sideEffects: 0, last: "" };
       const requestedPolicy = this.opts.turnPolicy?.(envs);
       const policy = envs.some((env) => env.private) ? { ...requestedPolicy, pii: true } : requestedPolicy;
@@ -12760,7 +13409,7 @@ var init_local_worker = __esm(() => {
               this.abort?.abort();
               throw new ApprovalWaitStop(this.approvalStopReason);
             }
-            if (!remoteTurn)
+            if (!remoteTurn && name !== "hub_set_title")
               this.observeTool(call, output, policy, `${this.sessionId}.${turn}.${step}`);
             if (name !== "hub_send" && name !== "doc_read" && name !== "web_fetch" && !TASK_TOOL_NAMES.has(name) && !CONDUCTOR_TOOL_NAMES.has(name))
               capture?.observe({ tool: call.function.name, args: call.function.arguments, output, id: call.id, sourceId: `${this.sessionId}.${turn}.${step}.${captureInvocation++}`, paths: touchedPaths(call.function.name, safeParse(call.function.arguments)) });
@@ -12895,7 +13544,7 @@ var init_local_worker = __esm(() => {
       }
       const fixedModel = policy?.fixedModel ?? this.opts.fixedModel;
       const task = policy?.task === undefined ? undefined : Number(policy.task);
-      const tools = [...this.toolSchemas(), ...this.opts.taskTool ? [...profileTaskTools(this.opts.profile, this.opts.sdlcStages, this.opts.sdlcCriteria).filter((tool) => tool.name !== "hub_delivery_retry"), ...CONDUCTOR_TOOLS].map(asFunction) : []];
+      const tools = [...this.toolSchemas(), ...this.opts.taskTool ? [...profileTaskTools(this.opts.profile, this.opts.sdlcStages, this.opts.sdlcCriteria).filter((tool) => tool.name !== "hub_delivery_retry"), ...CONDUCTOR_TOOLS].concat(SESSION_TITLE_TOOL).map(asFunction) : []];
       const signal = this.abort.signal;
       const messages = [{ role: "system", content: system(this.opts.cwd, this.opts.preamble) }, ...this.history, ...turnMsgs];
       const routed = await this.hubCall(route, messages, policy, signal);
@@ -15422,6 +16071,8 @@ var init_builtin_metadata = __esm(() => {
       projection: { roleRank: 4, startRank: 0, helpRank: 6, plannerEligible: false },
       api: 1,
       kind: "pi",
+      title: "hub",
+      titlePersistence: "native",
       enabledSwitchStartOnly: true,
       displayName: "Pi",
       family: "pi",
@@ -15446,6 +16097,7 @@ var init_builtin_metadata = __esm(() => {
       projection: { roleRank: 3, helpRank: 7, plannerEligible: false },
       api: 1,
       kind: "local",
+      title: "hub",
       displayName: "Local worker",
       family: "local",
       transport: "hub-native",
@@ -16053,6 +16705,8 @@ function assertNativeCapabilityScope(definition) {
     return;
   const declared = (block, key) => block !== undefined && (key in block);
   const restricted = [
+    ["title", definition.title !== undefined],
+    ["titlePersistence", definition.titlePersistence !== undefined],
     ["start.acpCommand", declared(definition.start, "acpCommand")],
     ["attach.admission", declared(definition.attach, "admission")],
     ["budget.resetSoftTokensOnResume", declared(definition.budget, "resetSoftTokensOnResume")],
@@ -23337,6 +23991,12 @@ function negotiateProtocol(local, remote) {
 }
 
 // src/hub/control-client.ts
+init_control_write_trace();
+var clientWriteTelemetry = new ControlWriteTelemetry({ emit: (line) => {
+  if (process.env.AHUB_CONTROL_WRITE_TIMING === "1")
+    console.error(`[agent-hub] ${line}`);
+} });
+var publicClientTiming = () => true;
 function stateDirFor(cwd) {
   return projectContext(cwd).stateDir;
 }
@@ -23502,6 +24162,14 @@ class ControlClient {
     return catalog;
   }
   request(msg, timeoutMs = 30000, signal) {
+    if (process.env.AHUB_CONTROL_WRITE_TIMING !== "1")
+      return this.requestBody(msg, timeoutMs, signal);
+    const metadata = controlWriteMetadata(msg);
+    if (!metadata)
+      return this.requestBody(msg, timeoutMs, signal);
+    return clientWriteTelemetry.run({ kind: metadata.kind }, publicClientTiming, () => controlWriteSpan("client-wait", () => this.requestBody(msg, timeoutMs, signal)));
+  }
+  requestBody(msg, timeoutMs, signal) {
     if (this.ws.readyState !== WebSocket.OPEN || this.closing && msg.t !== "request_cancel")
       return Promise.resolve({ ok: false, error: "hub connection is not open" });
     const invocation = msg.t === "task" && msg.op === "hub_invoke";
@@ -23561,7 +24229,7 @@ class ControlClient {
       }
       timer = timeoutMs ? setTimeout(() => abandon(`no answer from the hub within ${Math.round(timeoutMs / 1000)} s`), timeoutMs) : undefined;
       try {
-        this.ws.send(JSON.stringify({ ...wire, rid }));
+        controlWriteSpan("client-send", () => this.ws.send(JSON.stringify({ ...wire, rid })));
       } catch {
         abandon("hub request could not be sent");
       }
@@ -23619,6 +24287,8 @@ init_plan_conformance();
 // src/hub/sdlc-release.ts
 init_child_process();
 init_git();
+import { fileURLToPath } from "url";
+var CHECKER_PATH = fileURLToPath(new URL("../../scripts/check-docs.mjs", import.meta.url));
 
 // src/hub/tasks.ts
 init_spec_read();
@@ -24235,7 +24905,7 @@ function slugify(input) {
   return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
 }
 var captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};
-function isObject(data) {
+function isObject2(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }
 var allowsEval = /* @__PURE__ */ cached(() => {
@@ -24254,7 +24924,7 @@ var allowsEval = /* @__PURE__ */ cached(() => {
   }
 });
 function isPlainObject(o) {
-  if (isObject(o) === false)
+  if (isObject2(o) === false)
     return false;
   const ctor = o.constructor;
   if (ctor === undefined)
@@ -24262,7 +24932,7 @@ function isPlainObject(o) {
   if (typeof ctor !== "function")
     return true;
   const prot = ctor.prototype;
-  if (isObject(prot) === false)
+  if (isObject2(prot) === false)
     return false;
   if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) {
     return false;
@@ -26203,7 +26873,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     }
     return propValues;
   });
-  const isObject2 = isObject;
+  const isObject = isObject2;
   const catchall = def.catchall;
   let value;
   const memo = globalConfig.memoizer;
@@ -26211,7 +26881,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input = payload.value;
-    if (!isObject2(input)) {
+    if (!isObject(input)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -26347,7 +27017,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
     return doc.compile();
   };
   let fastpass;
-  const isObject2 = isObject;
+  const isObject = isObject2;
   const jit = !globalConfig.jitless;
   const allowsEval2 = allowsEval;
   const fastEnabled = jit && allowsEval2.value;
@@ -26356,7 +27026,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input = payload.value;
-    if (!isObject2(input)) {
+    if (!isObject(input)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -26494,7 +27164,7 @@ var $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnio
   const disc = cached(() => discriminatorMap(def));
   inst._zod.parse = (payload, ctx) => {
     const input = payload.value;
-    if (!isObject(input)) {
+    if (!isObject2(input)) {
       payload.issues.push({
         code: "invalid_type",
         expected: "object",