@staix/agent-hub 0.32.0 → 0.34.0

package/CHANGELOG.md

@@ -4,6 +4,39 @@ Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the
 
 ## Unreleased
 
+## 0.34.0
+
+- `ahub upgrade` no longer dead-ends on Orca panes that are orphaned but still connected after an Orca restart (#1246, PR #1249, task 760). The `terminal-orphaned` blocker names the peer, project and handle and the refresh key (`[r]` on the plan, `[s]` on an open operation). The interactive plan screen offers `[t] reattach N orphaned terminals`: after the person picks it, it runs `orca terminal switch` only for the panes the plan verified (same identity, still orphaned and connected, no project or machine recovery hold), bounds every Orca call and the confirmation poll by 5 s, and plans again. Nothing else is mutated; `--dry-run`, a pipe and `--yes` never switch a pane. A live Orca restart remains unverified.
+- `ahub setup` keeps dotfiles-managed and other symlinked installs on their stable path (#1245, PR #1250, task 759). Marketplace and Claude profile hook paths use a verified lexical PATH alias (at most eight links, accepted only when it resolves to the executing package) and the matching PATH Bun, instead of versioned `tools/ahub/<version>` or `Cellar/bun/<version>` paths. A stale managed profile hook is replaced in place and managed duplicates are dropped; unrelated settings are preserved. A refused marketplace replacement names every non-user plugin row, warns when a project row's path is `$HOME`, and names the person-owned remedy; non-user rows are never removed automatically. `ahub doctor` also inspects the existing default Claude home read-only and names the per-home setup command for a stale hook. Upgrade and doctor advice resolves the global CLI from PATH `ahub`, giving `bun add -g` only for a Bun-global install and generic advice without a path otherwise.
+- Quickstart: a section for dotfiles-managed installs (PR #1247): update with `dot ai family install ahub --version <version>`, then `ahub setup`; roll back with `dot ai rollback ahub`; keep one copy; and the 0.33.0-and-earlier workarounds for the marketplace refusal and the stale profile hook.
+- Compat receipt automation audit (#1248 T0, PR #1251, task 761): a data-only manifest (`scripts/compat-receipts/manifest.json`) classifies every leg of every current COMPAT receipt with its source quote, runner OS, exact acquisition recipe and `autoAdmit` policy eligibility, plus an audit report and an operations table. No COMPAT, harness, workflow, trust or verified version changes; the CI token route for CI-opened PRs stays the person's choice.
+
+- 0.34.0 N-1: published 0.33.0, the latest 0.33.x patch, with exact agent-mem 0.22.1 and control protocol 17 (descriptor floor 16). The release N-1 fixture and matrix pin it; the separate protocol-16 fixture stays 0.25.0.
+  - Wire and protocol: unchanged. No control message, room header, codec or MCP tool schema changed since 0.33.0. A published 0.33.0 broker relays codec presence, so upgraded members negotiate codecs through it; the broker test that asserted the codec-less 0.32.0 broker now asserts this.
+  - Files and format floors: hub.db remains schema 2, RoomStore remains schema 5, and the hub still exact-pins agent-mem 0.22.1, the same core as N-1; no memory layout or format floor changes.
+  - CLI: `ahub upgrade` adds the interactive `[t]` key and new blocker wording; `ahub setup` and `ahub doctor` change which paths they write and print. A 0.33.0 CLI keeps its own behavior against a 0.34.0 hub: no new flag, command or JSON field is required. Rollback: 0.33.0 setup matches its profile hook by exact command text, so after a rollback it does not recognize the hook 0.34.0 wrote and adds its own beside it (source reading, not a run); 0.34.0 setup later collapses both into one.
+  - Evidence ceiling: the N-1 fixture uses the unmodified published 0.33.0 package for control/plugin and isolated broker/member tests. These claims do not establish real-account inference, a live Orca restart, a real dotfiles install or two-machine operation; the release verification report records execution results separately.
+
+## 0.33.0
+
+- Exact-pin the first-party agent-mem core to 0.22.1 (PR #1243, task 754). It includes the upstream strict-host TOML serialization fix and adds no runtime dependency. Placement activation and writer renewal remain opt-in person commands; a pin upgrade does not activate a home or add the hub's missing fresh placement-attestation integration.
+- Correct inactive-placement CLI/dashboard guidance and memory documentation (PR #1244, task 755): the native person-only `amem migrate --sync-placement --dry-run` preview exists and requires every writer through `--writer-root`. The hub still does not supply fresh `placementAttestation` for active-placement sync (#1173); `ahub memory declined` remains the safe inspection step. No activation or API adoption is performed.
+- Rooms expose retained refusal counts, outbox depth/ages, last receipt age and closed link causes with recovery steps (#1204 T4, PR #1237, task 737). Store opening failures retry with bounded backoff, verified journal recovery wakes deferred inbound work, and selective three-member traffic raises no false sequence-gap notice. Codec support is signed current-session compatibility evidence; pending observations keep the original queue expiry and known unsupported feature sends refuse before effects. Plain chat and existing permission, privacy, replay and person-disposition fences remain unchanged. PR #1241 (task 753) documents the rolling-upgrade order and simplifies status projections without behavior changes.
+- Orca terminal recovery recognizes `terminal_exited`, `terminal_gone` and `no_connected_pty` alongside the existing stale-handle code, and preserves Orca's structured error code in failures (#1233, PR #1235, task 746). A missing terminal still follows the existing launcher ownership and reopen checks.
+- Record the single authorized Codex 0.167.0 reviewer tool-call attempt (Refs #888, task 751): startup isolation and the rendered marker precondition passed, but the harness readiness/readback leg did not produce a complete verdict result. No retry; 0.167.0 remains unverified (`docs/verification/2026-11-06-codex-0167-reviewer-tool-call.md`).
+- Verify exactly Qwen ACP 0.26.8 with model-free native macOS arm64 initialization, session, mode and published permission-handler receipts, plus Linux x86_64 evidence (#888, task 749). Qwen dual-output 0.26.8 stays unqualified: required queued-submit Q2 fails identically on the matched 0.26.1 control; its verified entry stays at 0.26.1. Real account/model behavior remains unverified.
+- Kimi Code 2.5.1 is an exact receipt-verified fresh-reviewer version (#888, task 748): the official macOS arm64 artifact passes the production preparation and native two-tool/Write controls in fixture-trust and verified/no-trust runs (`docs/verification/2026-11-06-kimi-251-reviewer-compat.md`). Runtime preparation remains required; real account, model and quota behavior remain unverified.
+- Claude Code 2.1.319 is a receipt-verified headless implementer version (#888, task 750): the model-free permission-transport and host shell-wrapper producers pass on it with 2.1.318 as the control (`docs/verification/2026-11-06-claude-implementer-2.1.319.md`).
+- Codex 0.167.0 passed the model-free reviewer isolation procedure (#888, task 747): all four legs passed with 0.166.0 as the control (`docs/verification/2026-11-06-codex-0167-reviewer-isolation.md`). This is model-free evidence only; the single authorized tool-call attempt above ended with an unknown outcome, so 0.167.0 stays unverified and any new attempt needs fresh person authorization. The person can explicitly trust that version, but every runtime proof still runs. Verified stays 0.146.0, 0.163.0, 0.164.0 and 0.166.0.
+
+- 0.33.0 N-1: published 0.32.0, the latest 0.32.x patch, pins agent-mem 0.21.0; this hub pins agent-mem 0.22.1. Control remains protocol 17 (descriptor floor 16). The release N-1 fixture and matrix retain published 0.32.0/core 0.21.0; the separate protocol-16 fixture stays 0.25.0.
+  - Room wire: 0.33.0 keeps `x-agent-hub-ephemeral: 1` and adds a separate `x-agent-hub-codecs: 1` upgrade header. A released 0.32.0 broker ignores the latter and retains ephemeral presence/liveness. A 0.32.0 member on a 0.33.0 broker receives its unchanged legacy ready/presence grammar, never codec advertisements or inventories. Plain v1 chat works in both directions.
+  - Rolling upgrade: a 0.33.0 person-inbox (`user@label`) or invocation send to a 0.32.0 member, or between upgraded hubs through a 0.32.0 broker, is refused before any effect with the upgrade step. Upgrade the broker, then every member to a codec-capable release, then reconnect. A merely pending observation waits under the original queue expiry; no timer grants support. Codec evidence grants no native, exposure, privacy or task authority.
+  - CLI/status: the 0.32.0 `ahub room status` command drops additive health, closed cause and generated action fields, including in its JSON output; its generic `ahub status --json` instead passes raw daemon fields through unchanged. A 0.33.0 room-status client accepts missing diagnostics from an older daemon as unknown. The sequence-gap operator notice is removed; the signed room-wide sequence and permanent replay floors are unchanged.
+  - Shared memory home: agent-mem 0.22.x's own N-1 statement keeps curated, capture, hook-spool, candidates, work-list and setup-receipt formats, `INDEX_VERSION` and the index file name unchanged from 0.21.0. Shared-v1, generation and v1/v2 shard sync are unchanged; inactive homes behave as before. Placement activation and writer renewal are opt-in person commands. If renewal history is present, the 0.21.0 closed journal reader refuses that history and placement publication before effects. The person coordinates shared-home operations separately after release; this preparation performs none of them.
+  - Local compatibility: hub.db remains schema 2 and RoomStore remains schema 5. The current core is 0.22.1 while N-1's is 0.21.0, with the shared-home limits above. The Orca recovery correction and exact compat additions change neither the control protocol nor native authorization; Codex reviewer 0.167.0 and Qwen dual-output 0.26.8 remain unqualified.
+  - Evidence ceiling: the N-1 fixture uses the unmodified published 0.32.0 package for control/plugin and isolated broker/member tests. These source/fixture claims do not establish real-account inference, live TLS/proxy behavior, installation or two-machine operation; the release verification report records execution results separately.
+
 ## 0.32.0
 
 - Rooms gain advisory liveness and person-visible epoch changes (T3 of #1204, task 736). An ephemeral-capable broker enables 30-second presence refresh and unknown status after three missed periods; aging never changes sending authority. Graceful stop fences new work and attempts a signed offline snapshot within two seconds without overtaking an attempted FIFO head. Legacy brokers report liveness untracked with an upgrade step. Epoch-changing commands preview sealed outstanding delivery IDs, recheck the exact set and roster, and immediately hold old-epoch work as needs_review with the cause "epoch rotated". Bus-only work and person/terminal dispositions are preserved; T4 remains open.

package/README.md

@@ -5,7 +5,7 @@ Code, Codex, Kimi Code, Pi and a hub-owned local worker (plus Qwen Code, Jcode a
 Antigravity if you want them) share a message bus, a task board and a memory, each
 connected through its own native interface.
 
-Status: 0.32.0, control protocol 17 (accepts 16). Bun + TypeScript, one loopback daemon per
+Status: 0.34.0, control protocol 17 (accepts 16). Bun + TypeScript, one loopback daemon per
 project. Site: [agent-hub.staix.net](https://agent-hub.staix.net).
 
 ## Quick start
@@ -143,7 +143,7 @@ uses the home must run a version that understands the new layout.
   [#258](https://github.com/STAIxBWLB/agent-hub/issues/258)).
 
 Live checks that still need a real account or a person are listed in the
-[release verification report](docs/verification/2026-11-06-0.32.0.md) and the
+[release verification report](docs/verification/2026-11-07-0.34.0.md) and the
 [smoke checklist](docs/smoke.md).
 
 ## Documentation

package/docs/design/bus.md

@@ -119,7 +119,7 @@ persistence, which belong to T2. Existing layer caps remain authoritative.
 
 ### Room wire compatibility (#1204 T1)
 
-The link requests only the ephemeral feature with the WebSocket upgrade header
+Version 1 requests only the ephemeral feature with the WebSocket upgrade header
 `x-agent-hub-ephemeral: 1`. A supporting broker includes `ephemeral: true` in its
 ready response only to an opted-in client, preserving the exact legacy ready
 shape for older hubs. Each new connection starts with the feature disabled.
@@ -130,7 +130,7 @@ members under its old queue rules. Upgrade the broker for ephemeral retention.
 A supporting broker forwards ephemeral presence only to ready members that
 opted in. Older members do not see upgraded members' presence until they upgrade. Application
 chat frames keep the legacy shape. This is the one-bit compatibility bridge;
-full codec feature advertisement belongs to #1204 T4.
+current links keep this header unchanged and add the codec opt-in described below.
 
 Ephemeral replacement preserves a recipient's outstanding one-packet transport
 slot until its matching ACK or the original TTL/grace bound expires. Only the
@@ -231,3 +231,69 @@ ACK after durable local commit of either the receipt or the inbox entry.
 Deferred application admission may ACK its durable crypto inbox entry so it does
 not pin broker capacity; later admission commits and replays the same durable
 receipt path before retiring its local work.
+
+## Room codec visibility and sequence diagnostics (#1204 T4)
+
+The room-wide signed sequence counter and durable replay floors stay unchanged.
+A chat addresses one recipient, so another member can legitimately observe a
+numeric gap. The host no longer turns that number into an operator loss notice;
+three-member selective traffic therefore produces no false sequence-gap alarm.
+The low-level replay result remains available to transport tests and does not
+relax authentication, permanent sequence floors or exactly-once application admission.
+
+Codec support is compatibility evidence from fresh authenticated presence, never
+a permission or privacy grant. Every link retains the released
+`x-agent-hub-ephemeral: 1` upgrade header byte for byte and adds
+`x-agent-hub-codecs: 1` in the same WebSocket upgrade. Released brokers ignore
+the codec header and retain ephemeral presence and liveness. A supporting
+broker adds `codecFeatures: true` and the connection's `codecSession` token
+only to an opted-in client's ready response. Legacy ready and presence shapes
+remain unchanged.
+
+Upgraded links keep the existing signed presence payload byte shape and send a
+separate presence snapshot carrying a bounded, sorted `features` list. That
+snapshot has signed `ephemeral: true` and `codecFeatures: true` headers. The
+broker routes it only to clients that opted into codec support; legacy clients
+receive only their original presence grammar. Legacy and codec snapshots have
+separate coalescing groups so neither can replace the other's pending state.
+The signed feature snapshot echoes its connection's `codecSession`; it does not
+request a reply or renew peer-state observations. Ordinary presence does not
+revoke support for that same connection.
+
+Before ciphertext delivery, the broker gives codec-aware recipients a bounded
+`codec_peers` inventory scoped to the current roster digest. A row names an
+authenticated member's current connection token and whether it opted into codec
+advertisements; a null token means the observation is pending or disconnected.
+Replacement, disconnect and roster change invalidate prior connection evidence.
+Only a fresh signed advertisement echoing the current token establishes support;
+a delayed advertisement from another session cannot establish it. New current
+peer-session evidence also triggers a coalesced feature-only advertisement from
+this hub, independently of legacy replies and snapshot dedupe; missed bootstrap
+advertisements therefore do not require unrelated application traffic to recover.
+
+An early ordinary live-state observation from a codec-capable session waits as
+bounded metadata until that session supplies signed codec evidence. Releasing
+it preserves its original local receive time; the signed advertisement does not
+renew liveness. Empty or offline snapshots and known legacy sessions remain
+immediate. The receive-time annotation is host-only and is never accepted from
+the room wire.
+
+The advertised codecs are `chat_v1`, `person_inbox_v1` and `read_invocation_v1`.
+Plain chat and status retain their legacy shape. Person-inbox sends require
+`person_inbox_v1`; invocation kinds require `read_invocation_v1`. Compatibility
+has three states: pending, supported and unsupported. Pending observations defer
+the original Bus queue entry without application, sequence or socket effects;
+the original queue lifetime still bounds this wait. A signed advertisement wakes
+that member's queued feature-required sends as well as retained durable intents.
+The pending path rechecks observations after requeue so an advertisement arriving
+during asynchronous refusal cannot be lost. No timer or grace period grants support.
+The private low-level link API has no Bus queue: it returns a typed not-sent
+pending outcome and the caller retries after signed evidence; it never waits
+inside the serialized receive lane. Codec-aware publication puts signed codec
+evidence before its ordinary peer-state observation on the outbound FIFO.
+Only a known legacy transport, an authenticated legacy member, or a signed
+advertisement missing the required feature refuses with the upgrade-and-reconnect
+step. Support is rechecked across awaited admission and at actual publication.
+Live signed observations are scoped to the current connection and roster; saved,
+stale or replayed presence never grants codec support. Existing native, exposure,
+privacy and invocation authorization checks still decide whether a send is allowed.

package/docs/dogfood.md

@@ -25,6 +25,7 @@ agent-hub is developed with agent-hub. This page lists every feature, whether it
 | Presence publication cost (#1204, #740) | source and isolated broker coverage; installed rooms remain off here | unchanged 1,000-flip AC1 test under its 20 s guard; transient pause/resume journal-write count, explicit manual-pause persistence, requestReply and exposure fences; hosted macOS is the acceptance gate |
 | Room automatic resend and late settlement (#1204 T2) | off here; source and isolated in-process broker coverage after validation; release and person enrollment/exposure required; live two-machine behavior remains unverified | AC2-AC4: receiver offline for 15 minutes then each application admitted once; pre-enqueue refusal retries without uncertainty; ACK deadline resends within the original TTL; signed late receipt settles once; local receipt commit survives restart before broker storage; no person-disposition override or native/task-read evidence |
 | Room liveness and epoch-change preview (#1204 T3, #736) | source and isolated fixtures, validation pending; rooms remain off here and installed/two-machine behavior is unverified | `rooms-liveness-link-736.test.ts`: signed offline within five seconds, idle crossed-request convergence and no reply loop, synchronous stop fence/FIFO preservation; `rooms-presence-aging-736.test.ts`: three local periods to advisory unknown without changing outbound admissibility, legacy untracked behavior, restart and clock rollback; `rooms-rotation-736.test.ts`: sorted ids-only preview, changed id-set/digest refusal, sealed hold versus Bus-only queue, unchanged person/terminal disposition; `rooms-liveness-status-736.test.ts`: native state preserved, broker upgrade guidance and named epoch-rotated cause; defaults 30 s refresh, 90 s aging, 2 s stop bound; exact-head gate and live proof remain separate |
+| Room health and codec compatibility (#1204 T4, #737) | source and isolated fixtures; installed rooms remain off here | metadata-only refused counts, outbox depth/ages, closed causes, store-open retry/stop and clock rollback; Bus recovery edge wakes receive-only admission; selective three-member traffic emits no false gap; broker opt-in preserves released-broker ephemeral/liveness and legacy presence; immediate-online and forced-refresh feature sends defer pending observations under the original TTL, known unsupported codecs refuse before wire effects; dgx02 and hosted evidence recorded in the PR, native/account and two-machine receipts remain unverified |
 | Worktree shelf (#1057): `ahub worktrees`, `tidy`, `tidy --confirm <fingerprint>`, the Agents panel section, Park/Pin, the explicit PR refresh and the inbox alert | fixture-only until a person uses it, and only after release and upgrade: this repository keeps every task in `.worktrees/<name>`, so it is the first real use, but nothing here has run `tidy --confirm` yet, and `worktrees.quiet_days` stays 7 until the owner has used it for a week | `ahub worktrees` live and settled counts over a week, and how many settled rows a person then Pins (a Pin means a rule was wrong); `tidy` preview refusals by reason (`task not approved or cancelled`, `unpushed commits`, `branch changed since preview`); after a confirm, `git worktree list` against the preview; test/worktree-shelf.test.ts, test/worktree-tidy.test.ts and test/worktree-panel.test.ts (a PII row stays live and redacted, a branch switch refuses, no GitHub call on a read, the daemon removes nothing) |
 | Message bus, digests, priorities | on | `ahub report`: messages, digests, overflow, undeliverable; delivery latency from events |
 | Control-send recipient normalization (#963) | active after release and hub upgrade; this PR does not change the running hub | string recipients reach only the named peer, invalid shapes publish nothing, omitted/empty arrays preserve broadcast; real native recipient behavior remains unverified |
@@ -54,7 +55,7 @@ agent-hub is developed with agent-hub. This page lists every feature, whether it
 | Floor policy (#999 T3, `action_policy.floor`) | source and test after merge and release; off here (a person turns it on in the untracked `config.local.json`), and the running hub takes it after upgrade | `test/action-floor.test.ts` (every allowed, asked and opaque case, status guard rows) and `test/daemon-action-floor.test.ts` (the Pi permit path through the real daemon: allowed calls run with no prompt, force and default-branch pushes, tags, `gh release`, `--admin` and other repositories ask); T4's live receipt records it under Orca. `2>/dev/null`-style redirects to `/dev/null` and `/dev/tty` no longer classify as destroy (#725, #1193; `/dev/stdout`, `/dev/stderr` and `/dev/fd/<n>` stay destroys because on Linux they reopen and truncate the file fd 1 or 2 already points at): active after release and plugin upgrade, unverified in a live agent-research session; the metric is the count of `always-ask: destroy` prompts on commands that only redirect to `/dev/null` or `/dev/tty`, which should reach zero, and `test/action-class.test.ts` (the `#725 device redirect` rows, including the four aliases, `/dev/fd/3` and lookalikes) |
 | Confirmation-point inventory (#999 T0) | source and test coverage; `ahub autonomy status` reads the inventory after this feature is released, with no default prompt change from the data alone | `test/confirmation-matrix.test.ts`: every adapter-catalog kind has a tool-approval and a classed-action row per environment, kinds facts equal the definitions, cited source lines exist; the `unknown` rows are the list T4's live receipt must close |
 | Project autonomy preset (#999 T1) | off on this repository until released and explicitly enabled by the person; project scope only | focused person-only, retained-consent, metadata-independent off and authenticated/fallback preset undo tests; the preset writes `action_policy.floor` (#999 T3) and off removes it; status leads with a peer table separating current modes from desired defaults, groups identical floor verdicts and unknowns once with peer lists (#1137), and reads each floor class from the host verdict (`floorEnforcement`), naming the unverified guard where the hub does not see the call first; the Orca zero-prompt native task remains T4 |
-| Machine autonomy and used Claude homes (#999 T2) | off until released and explicitly opted in by the person; no real home is changed by fixture tests | trusted-default/unsafe-default startup consent, all-project preview/apply, init inheritance with unchanged absent-file ask defaults, and isolated per-home plugin/hook setup/status tests; #1069 covers preserving project/local plugin rows while configuring only user scope, plus recording `start.agents` after a failed home step; metric: applied/refused registered targets and missing/unknown discovered-home states; native Orca receipt remains T4 |
+| Machine autonomy and used Claude homes (#999 T2) | off until released and explicitly opted in by the person; no real home is changed by fixture tests | trusted-default/unsafe-default startup consent, all-project preview/apply, init inheritance with unchanged absent-file ask defaults, and isolated per-home plugin/hook setup/status tests; #1069 covers preserving project/local plugin rows while configuring only user scope, plus recording `start.agents` after a failed home step; metric: applied/refused registered targets and missing/unknown discovered-home states; #1245 fixtures cover a verified current alias surviving A-to-B upgrades without marketplace removal, exactly one managed hook, actionable non-user-row refusals, stale-hook doctor warnings in an unselected default home, and PATH-selected global CLI update advice with a pure handoff doctor pointer; real-home setup remains unverified for that change; native Orca receipt remains T4 |
 | Read-time memory code neighbours (#684 phase 4) | off until released; dashboard toggle is opt-in | derived call edges with current SHA; attached fail/decision brief coverage; explicit unknown/truncated results; unchanged authoritative memory log bytes |
 | Canonical memory symbol anchors (#684 phase 3) | off until released; optional `doctor --stale-anchors` report only | actual-symbol completion anchors versus plan guesses; symbol-related earlier notes at memory hop two; stale/unknown/truncated report counts; zero note mutations during inspection |
 | Symbol preparation and historical recall (#684 phase 3 follow-ups) | off until release | exists calls per no-reviewer completion; raw-signature fail recall; indexed-definition/unknown labels; unchanged note/candidate bytes and neutral cleanup failures |
@@ -216,6 +217,7 @@ agent-hub is developed with agent-hub. This page lists every feature, whether it
 | Plain corpus evidence in ask and task briefs (#510b) | off here until a person configures plain `corpus.paths`; vaults remain refused; no corpus body is written to amem | `note:<path>#heading` ids in ask evidence or public task briefs; PII/deny and stale-context refusal regressions |
 | acon inbox snapshot speed and bound (#727, #1196) | on after release and `ahub setup`: the acon plugin asks every running project at once (not one after another), shares one computation among concurrent polls, serves a result younger than 1 s as it is and one up to 10 s old at once while one refresh runs, drops the cache on any action, waits at most 2 s for a project and keeps that project's last rows meanwhile, and returns at most 50 items (decisions first, then reviews, results, candidates, alerts) with a `more` count. Measured on the owner's Mac before the change: 2.5 s for 434 B in the console, 0.84 s median when run alone here, against a 2 s `pollMs`. Unverified: the owner's live console p95 after the change | the inbox `snapshot` wall time seen from the acon console on the owner's Mac (target p95 under 1 s), `test/acon-inbox-727.test.ts` (parallel asking, one computation for 20 callers, cache and background refresh, invalidation by an action, the 50-item bound and `more`, the project budget and a p95 over a five-project fleet), and the uncached median over this machine's real registry (0.84 s before, 0.37 s after) |
 | Global CLI and plugin step after `ahub upgrade` (#718, #1179) | on after release: a completed or scheduled upgrade ends with `bun add -g @staix/agent-hub@<version>` and `ahub setup` when the global CLI or the shared Claude plugin is older than the daemon it installed (a handed-over upgrade speaks for the older CLI that started it), and says nothing when both are current or the plugin cannot be read; `release-prepare` writes the same step into every new `Upgrading to <v>` note and `release-tag` refuses a release without it. Unverified: a live handed-over upgrade on the owner's Mac, where the old CLI starts the new coordinator through `bun x` | the upgrade's own output on the owner's Mac after the next release, whether `ahub doctor` still warns afterwards (it should not once the person followed the step), `test/runtime-version-warning.test.ts`, `test/upgrade-interactive.test.ts`, `test/upgrade-cli.test.ts` (a real hub with a fake `claude` and `npm`), `test/release-prepare.test.ts` and `test/release-tag.test.ts` |
+| Confirmed reattach of orphaned-but-connected Orca terminals in `ahub upgrade` (#1246) | on after release: the interactive plan screen offers `[t]` when the plan verified a pane as orphaned and connected, switches exactly those handles with `orca terminal switch`, polls each for at most 5 s and plans again; the blocker names the peer, project, handle and `[r] refresh`. Unverified: a live Orca restart on the owner's Mac (fixtures use a fake Orca) | count `[t]` uses against hand-typed `orca terminal switch` calls after an Orca restart (the latter should reach zero), and how often a pane is still orphaned at the 5 s bound (raise the bound if it is common); `test/terminal-recovery.test.ts`, `test/upgrade-interactive.test.ts` |
 | Hard-coded values inventory ratchet (#719, #1180) | on now: `scripts/check.sh` runs `bun scripts/inventory-hardcoded-values.ts --check`, so a new constant must be classified in `scripts/inventory-hardcoded-values.classifications.json` before it merges, and the 1222 keys still unclassified sit in `scripts/inventory-hardcoded-values.baseline.json`, which only shrinks. This does not close #1180: those 1222 are classified later in reviewed batches (`docs/verification/2026-11-05-hardcoded-values-ratchet.md`) | the unknown-key count (the baseline's length) falling to 0 over the follow-up batches and `check: OK` staying green with no key added to the baseline, `test/inventory-hardcoded-values.test.ts` |
 
 ## Decisions

package/docs/memory.md

@@ -271,8 +271,14 @@ An unchanged failure emits one safe log line per episode. A complete bounded pol
 
 `ahub memory declined [--json]` is a person-only, read-only inspection. It reports physical outbound row IDs and safe policy categories, never title, body, path nodes or literal private patterns. Reads defer promotions and recheck the profile binding. Forgotten originals still matter: `forget` changes materialized visibility but leaves the source row in append-only history. Do not use it as a promise to clear a sync refusal.
 
-The exact-pinned agent-mem 0.21.0 supplies bounded `inspectSyncPolicy` inspection for shared-v1 and generation profiles. A complete result lists the declined IDs and safe rule categories for the inspected physical outbound history, including originals hidden by a later forget. An unavailable, stale or bounded-out inspection remains explicitly incomplete; it never proves that no declined rows exist. The hub uses the public SDK rather than private helpers, snapshots of full history or its own portable log reader.
+The exact-pinned agent-mem 0.22.1 supplies bounded `inspectSyncPolicy` inspection for shared-v1 and generation profiles. A complete result lists the declined IDs and safe rule categories for the inspected physical outbound history, including originals hidden by a later forget. An unavailable, stale or bounded-out inspection remains explicitly incomplete; it never proves that no declined rows exist. The hub uses the public SDK rather than private helpers, snapshots of full history or its own portable log reader.
 
-The package also owns per-row local placement. The hub adopts only the projection of a successful trusted SDK placement result: `ok` with its verified withheld/exported counts. This is tested through an injected SDK-result seam, not an activated store. Agent-mem 0.21.0 requires a fresh `placementAttestation` for each v3 sync; the default hub does not supply one, so its active-v3 sync remains unsupported until legitimate host-attestation integration is added. The hub never fabricates that proof. Count projection does not delete or rewrite notes, change policy or promote a declined row; transport failures remain failures.
+The package also owns per-row local placement. The hub adopts only the projection of a successful trusted SDK placement result: `ok` with its verified withheld/exported counts. This is tested through an injected SDK-result seam, not an activated store. Agent-mem 0.22.1 requires a fresh `placementAttestation` for each v3 sync; the default hub does not supply one, so its active-v3 sync remains unsupported until legitimate host-attestation integration is added. Activation alone does not enable this hub's automatic sync, and the hub never fabricates that proof. Count projection does not delete or rewrite notes, change policy or promote a declined row; transport failures remain failures.
 
-Legacy stores without active per-row placement still refuse a sync containing declined rows. Agent-mem 0.21.0 provides no activation command; the hub neither invents one nor supplies a local fallback or fabricated activation proof. The missing core activation path is tracked by [agent-mem#281](https://github.com/STAIxBWLB/agent-mem/issues/281). Complete bounded diagnostics address #1173 AC4; The AC5 result projection is ready, while default-host active-v3 sync still requires supported activation and fresh-attestation integration. #1173 remains open until #281 ships and the hub adopts its supported path. Source adoption and isolated fixtures do not establish activation, deployed behavior or a successful sync of the person's memory home.
+Legacy stores without active per-row placement still refuse a sync containing declined rows. The native amem CLI has person-only activation from 0.22.0 ([activation documentation](https://github.com/STAIxBWLB/agent-mem/blob/v0.22.1/README.md#initial-sync-placement-activation)). A person using the 0.22.1 CLI can preview it with every local writer installation declared, including the CLI and hub library installs:
+
+```sh
+amem migrate --sync-placement --dry-run --writer-root '<cli-install-root>' --writer-root '<host-amem-install-root>' --json
+```
+
+Declare any other local writers too, and review the package's layout and version prerequisites before a separately authorized apply. The preview writes nothing; activation does not migrate layouts, change privacy policy or automatically raise a format floor. This hub neither invokes activation nor supplies a local fallback or fabricated attestation. Complete bounded diagnostics address #1173 AC4; AC5 has result projection only. #1173 remains open for legitimate fresh host-attestation integration. Source adoption and isolated fixtures do not establish activation, deployed behavior or a successful sync of the person's memory home.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.31.0 and control protocols 16 through 17. Live verification
+This guide describes ahub 0.34.0 and control protocols 16 through 17. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Agent-operated live verification
@@ -1824,7 +1824,7 @@ ahub memory forget 1a2b3c4d              # a person's; also promote, demote, sup
 
 `"memory": { "native": false }` in `.agenthub/config.json` turns it off for a project.
 
-The exact-pinned `@staix/agent-mem` 0.20.1 resolves `AMEM_HOME`, then `$AGENTHUB_HOME/memory`, then `~/.agenthub/memory`. An absent `M/profile.json` selects shared v1; an explicit generation selects `M/generations/G` with the package's readonly legacy bridge. All daemon memory consumers and the hub memory/goal CLI use that selected profile. Invalid metadata or a missing selected generation makes native memory unavailable while the bus and board continue; there is no fallback to legacy writes. Inspect the daemon's memory binding/availability before interpreting missing memory as an empty store.
+The exact-pinned `@staix/agent-mem` 0.22.1 resolves `AMEM_HOME`, then `$AGENTHUB_HOME/memory`, then `~/.agenthub/memory`. An absent `M/profile.json` selects shared v1; an explicit generation selects `M/generations/G` with the package's readonly legacy bridge. All daemon memory consumers and the hub memory/goal CLI use that selected profile. Invalid metadata or a missing selected generation makes native memory unavailable while the bus and board continue; there is no fallback to legacy writes. Inspect the daemon's memory binding/availability before interpreting missing memory as an empty store.
 
 The daemon checks its selector at hub operation entry and before candidate/counter writes. It does not hot-switch handles or provide an atomic fence against selection changes during an in-flight core call. Quiesce consumers and close their handles before migration or selection changes; reopen through the supported session-preserving lifecycle afterward. Candidate/counter storage remains `M/candidates.db`, independent of `G`; since agent-mem 0.7.0 `amem review` also lists and accepts candidates on a selected generation. Every running hub using this home needs an authenticated receipt: a matching ready binding, or a generation-capable unbound receipt (`disabled` when native memory is off, `unavailable` when opening failed) proving it holds no memory handle. An unbound daemon and zero running hubs are quiesced for memory; a stale bound handle, unreadable registry or unknown runtime is not ready. Existing JSON memory/goal results remain unchanged; the additive binding receipt belongs to daemon status, profile-check and the decay object. This source integration does not authorize installing a new runtime, migrating real memory, restarting sessions or claiming real-machine sync/capture receipts. Migration/deactivation and their limits belong to [agent-mem](https://github.com/STAIxBWLB/agent-mem); see [the hub profile contract](memory.md#selected-memory-profile).
 
@@ -2317,16 +2317,53 @@ A newly initialized `ahub init` project inherits a trusted machine opt-in and sa
 
 `ahub setup` selects the explicit `CLAUDE_CONFIG_DIR`, otherwise an existing default Claude home (or the not-yet-created default when no other home is selected), plus distinct homes proven in use by live registered Claude launcher records. It does not scan arbitrary profile directories. Each native plugin command receives that home's environment. One confirmation covers plugin setup and a project-neutral PreToolUse hook while preserving unrelated hooks and statusLine settings. The profile fallback requires the inherited hub state and peer identity and does nothing for a managed launch that already has its session hook, preventing duplicate delivery. Installing a hook proves configuration, not live enforcement.
 
+Setup preserves a stable package alias from the `ahub` executable on PATH only
+when its bounded symlink chain (at most eight leaf links) ends at this running
+package's `src/cli/main.js`. A versioned install can therefore keep its `current`
+parent alias in marketplace and profile-hook paths across upgrades. Another copy
+on PATH, a missing target or an unproven alias uses the resolved running package
+instead. The hook uses the PATH spelling of `bun` only when it resolves to the
+same runtime as this process; otherwise it keeps the observed runtime path.
+
+The generated single-command profile-hook shape identifies managed entries,
+including entries from an older install whose script is now missing. Setup
+replaces the first managed entry in place and removes duplicate managed entries,
+preserving that entry's matcher/timeout metadata, unrelated hook commands and
+statusLine.
+Doctor reports missing managed script or runtime paths in every home it inspects.
+Its read-only inventory also includes an existing default Claude home even when
+`CLAUDE_CONFIG_DIR` selected another home for setup; that inspection neither
+selects the default home for writes nor repairs it automatically. Run setup for
+the intended home to refresh its managed hook.
+
 Setup manages only the user-scope `agent-hub@agent-hub` plugin row (`claude
 plugin install|uninstall ... --scope user`). A project- or local-scope row of that
 plugin is kept and named in a notice (`... plugin row preserved ...; setup never
 removes non-user scopes`). While such a row exists, setup is blocked rather than
 removing an agent-hub marketplace that points at another source (#1073). The
-semver check on installed plugin versions applies only to agent-hub rows, so
+refusal names every blocking row's scope, projectPath, version and installPath.
+Hub-launched Claude sessions load their plugin from the hub's release runtime,
+not those plugin-cache rows; standalone sessions may still use them. Back up the
+selected home's `plugins/installed_plugins.json`, review every listed row, and
+manually remove only rows confirmed stale and unused while preserving all other
+rows; then rerun `ahub setup`. For a project row whose projectPath is `$HOME`, do
+not run `claude plugin uninstall --scope project` from `$HOME`: its project
+settings path is also the default home's `~/.claude/settings.json`. Setup leaves
+these non-user rows unchanged on refusal. The semver check on installed plugin versions applies only to agent-hub rows, so
 another plugin recorded with a git SHA no longer fails the inventory (#1074). When
 a Claude home step fails, setup still records the `start.agents` answer before it
 reports the failure.
 
+Updating a project's daemon does not update the global CLI or shared plugin.
+When a global CLI update is needed, upgrade and doctor guidance resolves the
+`ahub` package on PATH independently of the executing staged daemon or `bun x`
+coordinator. Outside a proven Bun-global prefix it names that installation path:
+update it using the method that installed it, then run `ahub setup`. A Bun-global
+command is suggested only for a PATH-selected package verified inside that prefix.
+An unknown PATH installation gets generic update advice without an inferred path.
+Handoff wire-version refusals keep fixed guidance to update the older hub and the
+global CLI the way it was installed; `ahub doctor` names the exact step.
+
 `ahub autonomy status [--json]` includes the machine default and each discovered Claude home's plugin/hook state. Missing, unsafe, stale, unavailable or incomplete evidence is explicit; a missing selected home is reported without starting a native inventory command that could create it. The native Orca zero-prompt receipt remains T4.
 
 
@@ -3495,6 +3532,25 @@ Agent CLIs update themselves often, and a hub release cannot follow every one. O
   - **Maintenance loop (#843):** the daily upstream watch is the trigger; `ahub doctor` is the local drift notice for versions installed on a machine, and the hub itself tells the planner (below). The planner files one receipt task per (id, version): the implementer repeats the procedure in the entry's last `docs/verification/` receipt, writes a new one, and adds the version to `verified` in that same PR; the next release ships the bump. A person's `ahub agents trust` stays the stopgap that keeps a machine running meanwhile, and the person may revoke it once the bump lands.
   - **Local drift notice (#843 AC3):** at hub start and once a day the daemon reads each gated CLI's installed version with the probe `ahub agents` uses (no network, no install). For every installed CLI on a version that is not `verified` (in-line, trusted or refused) the effective planner gets one notice per (id, version): the id, the version, the state and the last receipt path, nothing the CLI printed. A CLI that is not installed, or whose version cannot be read, is not drift. The marker is kept per (id, version, planner) in `hub.db` (`agent_drift_notices`), so a restart repeats nothing, a planner whose notice could not be queued (or who joins later) is retried alone without telling the others again, and a new version is a new notice; with no rostered planner nothing is recorded. `ahub status` shows one `agent CLI drift` attention line per drifted id until the installed version is verified.
 
+### Receipt automation audit (#1248 T0)
+
+The data-only [manifest](../scripts/compat-receipts/manifest.json) and [per-leg audit](verification/2026-11-07-compat-receipt-audit-1248.md) classify all current COMPAT receipts. Every leg carries a source section and exact excerpt. `autoAdmit` is policy eligibility after every required check and artifact binding passes, not a runnable harness or a version admission. Native Mac arm64 requirements remain; Linux fixture/source-check feasibility does not replace native platform evidence. Changed security-source regions require human review rather than an automatic diff-only pass.
+
+| COMPAT id | CI repeat and other required scope | Install method | autoAdmit |
+| --- | --- | --- | --- |
+| `pi` | Linux host permission/version fixtures; Mac RPC extension, SDK and tool receipts; Mac arm64 native | npm exact | `true` |
+| `claude-implementer` | Mac Write/Bash/rewrite transport and wrapper controls, synthetic provider; Mac arm64 native | npm exact; native-installer receipt boundary | `true` |
+| `codex-review` | Linux source comparison; Mac production metadata and native sandbox controls; Person-authorized model-backed tool call | npm exact | `false` |
+| `kimi-review` | Linux source comparison; Mac private config/broker/native allowlist controls; Mac arm64 native | GitHub asset + SHA-256 | `true` |
+| `jcode` | Linux source comparison; Mac serve/ACP/MCP and fixed-stream steering; Mac arm64 native | GitHub asset + SHA256SUMS | `true` |
+| `agy` | Mac CLI, synthetic MCP/hooks and Seatbelt controls; Interactive TUI/launcher nonce; no public install source | Unavailable | `false` |
+| `qwen` | Mac ACP/permission and install replay; recorded Linux run is additional; Mac arm64 repetition required | npm exact | `true` |
+| `qwen-dual` | Version/file-source checks are partial only; Real gateway model and PTY; OS not recorded | npm exact; historical artifact gap | `false` |
+
+Optional model/TUI behavior explicitly left unverified by a model-free receipt is not a new admission leg. `codex-review` requires its separately authorized model-backed tool-call proof. `agy` has no public install source. `qwen-dual` requires real-model and TUI work and its current receipt does not name the OS. The manifest records acquisition metadata separately from historical native-binary evidence; no CLI installation or COMPAT change is made by this audit.
+
+For CI-opened PRs, the person still chooses between explicit `check.yml` dispatch with GITHUB_TOKEN and a GitHub App installation token. Dispatch avoids an additional App secret but needs Actions write permission in the publisher and exact-head evidence; it does not run the separate PR-only closing-refs/routing-receipt workflows. An App token lets normal PR events start checks, with person-owned scoped credentials confined to the publisher. Neither route is enabled here. Current [GitHub documentation](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow) also describes approval-required PR runs for GITHUB_TOKEN automation; that is not unattended CI. See the audit for permissions, queue and gate trade-offs.
+
 ## Upgrade and crash recovery
 
 ### Side by side project versions (#1039)
@@ -3569,7 +3625,7 @@ or the plugin is older than the daemon it installed (#1179). It prints nothing w
 | Runtime | Control protocol window | Legacy status field |
 | --- | --- | --- |
 | 0.12.20 through 0.25.0 | 16 only | `protocol: 16` |
-| 0.26.0 through 0.32.0 | 16 through 17 | `protocol: 16`, `protocolMin: 16`, `protocolMax: 17` |
+| 0.26.0 through 0.34.0 | 16 through 17 | `protocol: 16`, `protocolMin: 16`, `protocolMax: 17` |
 
 New clients choose the highest common protocol. The protocol window remains 16
 through 17, so the published protocol-16 client and channel plugin remain usable; unrelated feature
@@ -3577,7 +3633,13 @@ capabilities still require their own labels. A disjoint window refuses with 4426
 The compatibility-floor `protocol` field remains readable by old clients.
 
 Release N-1 is counted in minor versions, separately from this protocol window
-(#1164, family contract entelecheia/ai-workspace#70). For 0.32.x, N-1 is 0.31.0,
+(#1164, family contract entelecheia/ai-workspace#70). For 0.34.x, N-1 is 0.33.0,
+the latest published patch of 0.33.x (exact `@staix/agent-mem` 0.22.1, control
+protocol 17 with descriptor floor 16). Every patch on 0.34.x keeps that release
+baseline. For 0.33.x, N-1 is 0.32.0,
+the latest published patch of 0.32.x (exact `@staix/agent-mem` 0.21.0, control
+protocol 17 with descriptor floor 16). Every patch on 0.33.x keeps that release
+baseline. For 0.32.x, N-1 is 0.31.0,
 the latest published patch of 0.31.x (exact `@staix/agent-mem` 0.21.0, control
 protocol 17 with descriptor floor 16). Every patch on 0.32.x keeps that release
 baseline. A change that cannot retain it needs a new minor release. The 0.31.x
@@ -3938,7 +4000,7 @@ owner's row. A running hub without `terminal_owner` support leaves the new launc
 unrecorded and prints an upgrade remedy. The plan names an attached native TUI
 without a live launcher or exact Orca session proof as `attached, launcher
 unrecorded`: end it in its terminal or use its native resume flow in an Orca
-terminal, then refresh the plan. Plain Claude's same-protocol reconnect-only
+terminal, then press `[r]` refresh. Plain Claude's same-protocol reconnect-only
 session still reconnects by itself without a terminal restart.
 
 Background Orca identity reads are limited to 30 seconds and 1 MiB of output.
@@ -3949,10 +4011,22 @@ its foreground TTY behavior. Unknown terminal evidence is shown as unverified
 ownership, with end or native resume guidance.
 
 An Orca pane that is orphaned but still connected needs reattachment, not turn
-cancellation: run `orca terminal switch --terminal <handle>` yourself, then refresh.
-The coordinator never switches panes. Such a pane is not evidence that its native
-process ended and never authorizes a duplicate restore. Disconnected terminals
-keep their existing guidance.
+cancellation (#1246). The blocker names the peer, the project and the handle, and its
+next action is `orca terminal switch --terminal <handle>`, then refresh in
+`ahub upgrade` (`[r]` on the plan, `[s]` on an open operation) or rerun it. The plan records each such pane whose identity it
+verified (peer, handle, incarnation, worktree and root) as `orphanedTerminals`, part
+of the plan fingerprint, and the interactive plan screen then offers `[t] reattach N
+orphaned terminals`. Choosing it reads each recorded pane again, requires the same
+identity, still orphaned and connected, and no recovery hold on this project (or the
+machine), runs `orca terminal switch --terminal <handle>` once for that handle, and polls
+`orca terminal show` for at most 5 s until `orphaned` is false (Orca can report `true`
+for a moment after the switch). Each Orca call is itself bounded by that time, so a hung
+`show` cannot hold the screen past it. Then the plan is made again. Nothing else is mutated:
+no session, launch record, terminal or hub changes. A pane whose identity changed, that
+disconnected, or that is still orphaned at the bound stays a blocker with the same next
+action, and `[t]` is offered again. `--dry-run`, a pipe and `--yes` never switch a pane.
+Such a pane is not evidence that its native process ended and never authorizes a
+duplicate restore. Disconnected terminals keep their existing guidance.
 
 The ledger retains historical and invalid rows; it does not prune them on launch.
 Only this project, current daemon instance and peer can supply ownership evidence,
@@ -4876,7 +4950,7 @@ selected roster and existing capabilities; the TUI is always a person's start.
 - If the hub cannot read the event file the peer is `detached`, shown as offline with a notice, never idle: Qwen itself keeps working, and the hub reattaches when the file is readable again.
 - Restart: if the hub restarts while your Qwen keeps running, it reads on from its saved offset (no event twice, no launch). If Qwen is gone, `ahub qwen --mode tui` starts `qwen -r <session id>` on the same two files; the earlier submits are not replayed and the recorded answers are not shared again. Recovery never restores this terminal as a headless worker, and `ahub stop qwen` refuses: end Qwen in its own terminal.
 
-Receipt-verified native ACP identities are qwen-code 0.25.0 and 0.26.0 ([dated receipt](verification/2026-10-22-kimi-qwen-compat.md)), 0.26.1 ([0.26.1 receipt](verification/2026-10-26-qwen-0261-acp.md)) 0.26.4 ([0.26.4 ACP receipt](verification/2026-10-31-qwen-0264-acp.md)) and 0.26.5 ([0.26.5 ACP receipt](verification/2026-11-03-qwen-0265-acp.md)). The separate [0.26.4](verification/2026-10-31-qwen-0264-dual-output.md) and [0.26.5](verification/2026-11-03-qwen-0265-dual-output.md) dual-output attempts did not establish their queued-turn criterion, so `qwen-dual` stays at 0.26.1. A CLI version label alone
+Receipt-verified native ACP identities are qwen-code 0.25.0 and 0.26.0 ([dated receipt](verification/2026-10-22-kimi-qwen-compat.md)), 0.26.1 ([0.26.1 receipt](verification/2026-10-26-qwen-0261-acp.md)), 0.26.4 ([0.26.4 ACP receipt](verification/2026-10-31-qwen-0264-acp.md)), 0.26.5 ([0.26.5 ACP receipt](verification/2026-11-03-qwen-0265-acp.md)) and 0.26.8 ([0.26.8 ACP receipt](verification/2026-11-06-qwen-0268-acp.md)). The separate [0.26.4](verification/2026-10-31-qwen-0264-dual-output.md), [0.26.5](verification/2026-11-03-qwen-0265-dual-output.md), and [0.26.8](verification/2026-11-06-qwen-0268-dual-output.md) dual-output attempts did not establish their queued-turn criterion, so `qwen-dual` stays at 0.26.1. A CLI version label alone
 is insufficient: startup verifies its native identity/version and advertised mode
 ids before any prompt. The earlier local installation reported CLI 0.25.0 while
 its package/ACP source said 0.24.1; that was not a ready identity. The 0.26.0 receipt
@@ -5558,7 +5632,7 @@ Default-branch capture runs only at daemon startup when a Claude implementer is
 
 Project Git retains the core policy that clears credential.helper and core.askpass; an HTTPS push needing those helpers may fail, rather than importing credentials or relaxing that policy. Task branch/config proof reads are bounded synchronous reads (1.5 seconds per reader); slow or unknown evidence asks. The existing sandbox profile discovery is also synchronous; moving it to an asynchronous inventory proof with a shared deadline remains a follow-up. The nonce is visible in a permission response, so it proves a bounded grant rather than native-dispatch provenance.
 
-The [native permission receipt](verification/2026-10-23-headless-claude-permissions.md) covers Claude Code 2.1.309, and the [2.1.310 receipt](verification/2026-10-26-claude-implementer-2.1.310.md) repeats it on 2.1.310 (with 2.1.309 as a control), and the [2.1.314 receipt](verification/2026-10-31-claude-implementer-2.1.314.md) repeats it and the host-wrapper procedure on 2.1.314 (with 2.1.310 as a control), and the [2.1.316 receipt](verification/2026-10-31-claude-implementer-2.1.316.md) repeats both on 2.1.316 (with 2.1.314 as a control), and the [2.1.318 receipt](verification/2026-11-05-claude-implementer-2.1.318.md) repeats both on 2.1.318 (with 2.1.316 as a control), each with a deterministic loopback fixture and no real account/model call. It is not sandbox proof or a runtime receipt gate. The real account/model/person interaction remains a separate live leg.
+The [native permission receipt](verification/2026-10-23-headless-claude-permissions.md) covers Claude Code 2.1.309, and the [2.1.310 receipt](verification/2026-10-26-claude-implementer-2.1.310.md) repeats it on 2.1.310 (with 2.1.309 as a control), and the [2.1.314 receipt](verification/2026-10-31-claude-implementer-2.1.314.md) repeats it and the host-wrapper procedure on 2.1.314 (with 2.1.310 as a control), and the [2.1.316 receipt](verification/2026-10-31-claude-implementer-2.1.316.md) repeats both on 2.1.316 (with 2.1.314 as a control), and the [2.1.318 receipt](verification/2026-11-05-claude-implementer-2.1.318.md) repeats both on 2.1.318 (with 2.1.316 as a control), and the [2.1.319 receipt](verification/2026-11-06-claude-implementer-2.1.319.md) repeats both on 2.1.319 (with 2.1.318 as a control), each with a deterministic loopback fixture and no real account/model call. It is not sandbox proof or a runtime receipt gate. The real account/model/person interaction remains a separate live leg.
 
 A headless Claude reviewer is run by the hub instead (task 223): declare
 `"claude-review": { "kind": "claude", "roles": ["reviewer"], "start_mode": "headless" }`
@@ -5596,9 +5670,9 @@ A reviewer has a review scope (#852): `full` (reads the code, runs the affected
 
 Start them with `ahub claude --as claude-review`, `ahub codex --as codex-review` and `ahub kimi --as kimi-review`; stop with `ahub stop <id>`. For the Claude and Codex reviewers the command asks the running hub to start the reviewer and returns: nothing runs in that terminal, it takes no launch arguments, and `--print-command` or `--dry-run` prints a hub-start note instead of a launch (#720). Fresh Claude and Codex variants share the project checkout; the Kimi variant runs in a clean temporary working directory and reviews only the screened brief and host facts. All fresh variants refuse a custom worktree or permission mode. Codex and Kimi require `review_mode: "fresh"`; without it, an existing headless instance with the reviewer role keeps its native app-server/ACP behavior, worktree and permission options and does not join this pool. Claude retains its task 223 automatic headless-reviewer declaration. The agy reviewer slot remains automatically unavailable (`agy is an implementer peer (#485)`). A failed or unsupported fresh start never downgrades to a native continuing session. Ordinary implementer instances retain their own adapters. The default logical pool order is Claude, Codex, Kimi. Only configured kinds with at least one declared reviewer count as slots, including declared ones that are offline, paused, quota-limited or failing, so availability never renumbers them; configured kinds with no declaration are listed after the walk as `no declared reviewer`. `review.rerotate` defaults to false. Pool selection starts at PR number modulo the number of declared kind slots, or task id when there is no PR, then skips the implementer's family and unavailable candidates. Delta review prefers the preceding eligible independent family in a fresh child. A preceding same-family fallback does not outrank a newly available independent family. `ahub route explain` shows the same pure walk.
 
-Codex requires a verified `codex-cli` (0.146.0, 0.163.0, 0.164.0 or 0.166.0) or one the person trusts on this machine, and a passing bounded runtime receipt before its model child starts. 0.146.0 and 0.163.0 passed the [2026-10-22 model-free production admission](verification/2026-10-22-codex-reviewer-isolation.md) and 0.164.0 the [2026-10-24 one](verification/2026-10-24-codex-0164-reviewer-isolation.md); 0.166.0 passed the [2026-10-31 model-free procedure](verification/2026-10-31-codex-0166-reviewer-isolation.md). Its [first authorized model review](verification/2026-10-31-codex-0166-reviewer-tool-call.md) missed a marker hidden by the fixture's accepted plan, so that admission was reverted. After a committed model-free envelope regression and a fixture correction, the separately authorized [2026-11-02 single model review](verification/2026-11-02-codex-0166-reviewer-tool-call.md) persisted one approved verdict with the required marker and exact head; 0.166.0 is now verified. A refusal names the installed and verified versions. Either set `codex_bin` to a verified executable, or run `ahub agents trust codex-review <version>`: trust lifts only the version pin, and every proof below still runs before each child (#691). Each launch approves exactly `hub_review` and `hub_task_show` per tool (`approval_mode = "approve"`), never through a server-wide default: without it Codex 0.164.0 listed the tools but refused the call, so reviews ended with no verdict (#783). A model-free receipt proves the inventory, not that a verdict reaches the hub; a [model-backed 0.164.0 run](verification/2026-10-25-codex-0164-reviewer-tool-call.md) recorded one verdict through that path. The producer checks native binary/config stability, configured MCP inventory with only the two hub tools, effective Apps/plugins/hooks disablement, an explicit empty legacy `notify` command and a named filesystem profile. Apps needs separate feature readback because configured inventory omits runtime connectors. Web search is requested disabled; its effective turn mode is not read back and managed requirements can select Cached (see the verification ceiling). Each launch proves public-read, exact/glob/symlink private-denial, standard host credential denial and write-denial in temporary fixtures. Standard credential and configured tool-home/XDG subtrees are denied independently of project `local.deny`. Its sandboxed shell is filesystem read-only with private paths denied and network configured disabled; it is not Claude's Read/Grep/Glob-only tool whitelist. No credential home is copied.
+Codex requires a verified `codex-cli` (0.146.0, 0.163.0, 0.164.0 or 0.166.0) or one the person trusts on this machine, and a passing bounded runtime receipt before its model child starts. 0.146.0 and 0.163.0 passed the [2026-10-22 model-free production admission](verification/2026-10-22-codex-reviewer-isolation.md) and 0.164.0 the [2026-10-24 one](verification/2026-10-24-codex-0164-reviewer-isolation.md); 0.166.0 passed the [2026-10-31 model-free procedure](verification/2026-10-31-codex-0166-reviewer-isolation.md). Its [first authorized model review](verification/2026-10-31-codex-0166-reviewer-tool-call.md) missed a marker hidden by the fixture's accepted plan, so that admission was reverted. After a committed model-free envelope regression and a fixture correction, the separately authorized [2026-11-02 single model review](verification/2026-11-02-codex-0166-reviewer-tool-call.md) persisted one approved verdict with the required marker and exact head; 0.166.0 is now verified. 0.167.0 passed the [2026-11-06 model-free procedure](verification/2026-11-06-codex-0167-reviewer-isolation.md) with 0.166.0 as control. The separately authorized [single model-backed attempt](verification/2026-11-06-codex-0167-reviewer-tool-call.md) failed a harness readiness/readback check after startup and marker preconditions; a complete persisted verdict/head/marker result was not recorded, so the model/tool outcome is unknown and 0.167.0 remains unverified. No retry was made. It joins the verified set only after a separately authorized model-backed tool-call run succeeds; until then it is refused unless the person runs `ahub agents trust codex-review 0.167.0`, and every runtime proof still runs. A refusal names the installed and verified versions. Either set `codex_bin` to a verified executable, or run `ahub agents trust codex-review <version>`: trust lifts only the version pin, and every proof below still runs before each child (#691). Each launch approves exactly `hub_review` and `hub_task_show` per tool (`approval_mode = "approve"`), never through a server-wide default: without it Codex 0.164.0 listed the tools but refused the call, so reviews ended with no verdict (#783). A model-free receipt proves the inventory, not that a verdict reaches the hub; a [model-backed 0.164.0 run](verification/2026-10-25-codex-0164-reviewer-tool-call.md) recorded one verdict through that path. The producer checks native binary/config stability, configured MCP inventory with only the two hub tools, effective Apps/plugins/hooks disablement, an explicit empty legacy `notify` command and a named filesystem profile. Apps needs separate feature readback because configured inventory omits runtime connectors. Web search is requested disabled; its effective turn mode is not read back and managed requirements can select Cached (see the verification ceiling). Each launch proves public-read, exact/glob/symlink private-denial, standard host credential denial and write-denial in temporary fixtures. Standard credential and configured tool-home/XDG subtrees are denied independently of project `local.deny`. Its sandboxed shell is filesystem read-only with private paths denied and network configured disabled; it is not Claude's Read/Grep/Glob-only tool whitelist. No credential home is copied.
 
-Kimi requires a compat-admitted Kimi Code on the hub's PATH (receipt-verified 2.2.0, 2.3.0, 2.3.1, 2.3.2 and 2.4.1), signed in through its managed OAuth provider, and a passing runtime preparation before each child; an unverified/untrusted version or a failed preparation is unavailable with its reason. The [2.3.0](verification/2026-10-22-kimi-qwen-compat.md), [2.3.1](verification/2026-10-25-kimi-231-reviewer-compat.md), [2.3.2](verification/2026-10-26-kimi-232-reviewer-compat.md) and [2.4.1](verification/2026-10-31-kimi-241-reviewer-compat.md) receipts are model-free and do not verify real login/provider readiness. Each review runs a new `kimi -p` child without Seatbelt, in a private `KIMI_CODE_HOME` with managed-provider-only config, a clean temporary working directory and an empty skills directory. Its agent may call only `hub_review` and `hub_task_show`, through a task-bound loopback MCP session that never carries the hub's control token, and has no native read, file or shell tool: it reviews the screened brief and host facts only. Its `credentials/`, `oauth/` and `device_id` link to the person's native Kimi files, so it shares the native login, refresh lock and the Kimi account's budget; no token is copied. A stop revokes its verdict authority first, then waits briefly while an OAuth refresh holds the lock; a forced stop mid-refresh may require a native re-login. The Kimi backend records no measured token counts here, so its usage stays unknown; the 2.3.0 receipt makes no usage claim. This is a native tool-authority boundary, not filesystem or network isolation.
+Kimi requires a compat-admitted Kimi Code on the hub's PATH (receipt-verified 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.1 and 2.5.1), signed in through its managed OAuth provider, and a passing runtime preparation before each child; an unverified/untrusted version or a failed preparation is unavailable with its reason. The [2.3.0](verification/2026-10-22-kimi-qwen-compat.md), [2.3.1](verification/2026-10-25-kimi-231-reviewer-compat.md), [2.3.2](verification/2026-10-26-kimi-232-reviewer-compat.md), [2.4.1](verification/2026-10-31-kimi-241-reviewer-compat.md) and [2.5.1](verification/2026-11-06-kimi-251-reviewer-compat.md) receipts are model-free and do not verify real login/provider readiness. Each review runs a new `kimi -p` child without Seatbelt, in a private `KIMI_CODE_HOME` with managed-provider-only config, a clean temporary working directory and an empty skills directory. Its agent may call only `hub_review` and `hub_task_show`, through a task-bound loopback MCP session that never carries the hub's control token, and has no native read, file or shell tool: it reviews the screened brief and host facts only. Its `credentials/`, `oauth/` and `device_id` link to the person's native Kimi files, so it shares the native login, refresh lock and the Kimi account's budget; no token is copied. A stop revokes its verdict authority first, then waits briefly while an OAuth refresh holds the lock; a forced stop mid-refresh may require a native re-login. The Kimi backend records no measured token counts here, so its usage stays unknown; the 2.3.0 receipt makes no usage claim. This is a native tool-authority boundary, not filesystem or network isolation.
 
 A dangling or unreadable standard/configured credential root makes the Codex reviewer unavailable with only its path class in the reason (for example `~/.docker` or `$DOCKER_CONFIG`, never an expanded path or contents); repair the root and start the reviewer again.
 
@@ -5696,7 +5770,7 @@ Native launcher connections retry transport timeouts/unclean closes with bounded
 
 ## amem runtime (agent-mem#13 P4)
 
-The hub exact-pins @staix/agent-mem 0.21.0 for recall, curated evidence and local deterministic capture. No runtime call reaches a claude-mem worker; `memory.worker_url` is ignored. The person's `ahub memory import claude-mem` remains explicit and off by default. Existing profile, alias, PII and private-turn fences still apply. `ask --remember` and context checkpoints propose machine-local candidates, never automatic curated evidence. See [memory integration](memory.md#in-process-recall-and-capture-agent-mem13-p4) for changed behavior and bounded-view ceilings.
+The hub exact-pins @staix/agent-mem 0.22.1 for recall, curated evidence and local deterministic capture. No runtime call reaches a claude-mem worker; `memory.worker_url` is ignored. The person's `ahub memory import claude-mem` remains explicit and off by default. Existing profile, alias, PII and private-turn fences still apply. `ask --remember` and context checkpoints propose machine-local candidates, never automatic curated evidence. See [memory integration](memory.md#in-process-recall-and-capture-agent-mem13-p4) for changed behavior and bounded-view ceilings.
 
 ## Person-run backlog legs (#1176)
 
@@ -5992,7 +6066,7 @@ With a legacy broker, status says `liveness not tracked (broker without ephemera
 Upgrade the broker to enable periodic refresh and aging. Legacy connections keep
 identical-snapshot dedupe and ordinary state-change publication, with no
 periodic refresh or freshness expiry. Older clients may ignore the new advisory
-status fields. Full capability advertisement remains #1204 T4.
+status fields. Codec negotiation is described under Room health diagnostics below.
 
 A graceful room stop immediately fences new publications and attempts one signed
 offline snapshot behind an already attempted FIFO frame, bounded to two seconds
@@ -6331,12 +6405,42 @@ Corrupt or unreadable provenance stays unknown and held. The status next step di
 
 A ready memory profile does not prove a successful sync. Read the separate automatic-sync result and timestamp in `ahub status` or Memory. It resets to not run after daemon restart; it is not a machine-global record of manual CLI attempts. Missing remote configuration is the neutral `not-configured` state; an interrupted/stopped attempt is neutral `stopped`. Both keep their safe next step and produce no failure log under `quietSyncError`.
 
-For policy-declined rows, a person runs `ahub memory declined --json` to inspect IDs and safe rule categories, never note text. The pinned agent-mem 0.21.0 public `inspectSyncPolicy` API bounds physical outbound inspection for shared-v1 and generation profiles. A complete result supplies the declined IDs and rules; `complete:false` means the scan is unavailable, stale or over its diagnostic bound, not zero declined rows. The command stays read-only and rechecks its profile binding. No migration or policy edit is performed automatically.
+For policy-declined rows, a person runs `ahub memory declined --json` to inspect IDs and safe rule categories, never note text. The pinned agent-mem 0.22.1 public `inspectSyncPolicy` API bounds physical outbound inspection for shared-v1 and generation profiles. A complete result supplies the declined IDs and rules; `complete:false` means the scan is unavailable, stale or over its diagnostic bound, not zero declined rows. The command stays read-only and rechecks its profile binding. No migration or policy edit is performed automatically.
 
-The hub projects verified withheld/exported counts when a trusted SDK sync returns a successful placement result. That projection is covered by an injected-result fixture, not an activated-store sync. Agent-mem 0.21.0 requires a fresh `placementAttestation` even for an already active v3 store; the default hub supplies no such integration and therefore cannot perform that sync yet. No attestation is fabricated. A nonzero withheld count in a successful result is not a transport failure and does not mean those rows were deleted, rewritten or published. Inspect the IDs and rules before deliberately changing any source or approved policy; a forget operation does not remove its original text from physical history.
+The hub projects verified withheld/exported counts when a trusted SDK sync returns a successful placement result. That projection is covered by an injected-result fixture, not an activated-store sync. Agent-mem 0.22.1 requires a fresh `placementAttestation` even for an already active v3 store; the default hub supplies no such integration and therefore cannot perform that sync yet. Activation alone does not enable the hub's automatic sync, and no attestation is fabricated. A nonzero withheld count in a successful result is not a transport failure and does not mean those rows were deleted, rewritten or published. Inspect the IDs and rules before deliberately changing any source or approved policy; a forget operation does not remove its original text from physical history.
 
-A legacy store without active per-row placement still blocks a sync containing declined rows. Status says: `machine sync blocked: N declined rows; per-row placement is not active on this store (agent-mem has no activation command yet, agent-mem#281). Inspect with ahub memory declined.` Here `N` is the known declined count. Agent-mem 0.21.0 has no activation command, so there is no migration or activation step to run in this release. The hub does not replace the core placement protocol or fabricate its activation proof. [Agent-mem#281](https://github.com/STAIxBWLB/agent-mem/issues/281) owns the missing supported activation path.
+A legacy store without active per-row placement still blocks a sync containing declined rows. Status names inactive placement and the person-only `amem migrate --sync-placement --dry-run` preview, which requires every local writer installation through repeatable `--writer-root` flags. It also names the missing host `placementAttestation` and keeps `ahub memory declined` as the safe inspection step. The native CLI supports activation from 0.22.0; the pinned core is 0.22.1. See the [activation preview and prerequisites](memory.md#automatic-sync-health-1173) before any separately authorized apply. Preview writes nothing, and activation does not migrate layouts, change policy or automatically raise a format floor. The hub does not invoke it or fabricate its proof.
 
-The bounded diagnostic addresses #1173 AC4; AC5 has result projection only; supported activation and fresh host-attestation integration remain necessary for default-host v3 sync. #1173 remains open until #281 ships and its supported path is adopted here.
+The bounded diagnostic addresses #1173 AC4; AC5 has result projection only. The core activation command is available, while legitimate fresh host-attestation integration remains necessary for default-host v3 sync. #1173 remains open for that integration.
 
 For a transport or unknown failure, run `ahub memory sync` as a person to see the local diagnostic. Logs keep only the cause class and known declined count, once per unchanged failure episode. Complete declined-ID sets can distinguish a changed failure without placing IDs or bodies in the log; incomplete inspection keeps the set unknown. Existing write-time screening and profile/privacy fences remain. SDK adoption and isolated fixtures do not prove live rollout or a successful sync of the person's memory home.
+
+### Room health diagnostics (#1204 T4)
+
+`ahub room status [name]` prints retained refused-frame counts by reason, room
+outbox depth, oldest age, last signed receipt age and the link cause with a next
+step. `--json` contains the same allowlisted metadata. Unknown age is not zero;
+legacy generic outbox rows have no creation timestamp. Refusal counts cover only
+retained diagnostics, not lifetime failures. No message body, key, broker URL or
+raw exception appears in these projections.
+
+`ahub status` names `rooms: unavailable (<code>)` if room storage cannot open.
+Open retries back off from 1 s to at most 30 s and stop on shutdown. For
+`clock_rollback`, correct the system clock to at least the last recorded room
+time; do not edit stored replay or clock records. A receive-only hub retries
+blocked admission when a successful journal checkpoint clears its storage error.
+Status reads and idle ticks do not poll blocked plaintext.
+
+Codec negotiation keeps `x-agent-hub-ephemeral: 1` and adds
+`x-agent-hub-codecs: 1` on the same WebSocket upgrade. A released broker ignores
+the latter and retains its ephemeral/liveness behavior. A peer with a pending
+codec observation waits under the original queue expiry; it does not receive a
+false upgrade refusal. Known legacy or unsupported peers name the upgrade step.
+Ordinary presence refreshes preserve same-connection signed codec evidence.
+During a rolling upgrade, person-inbox (`user@label`) and invocation sends to a
+released 0.31/0.32 member, or between upgraded hubs on a released broker, are
+refused before any effect with an upgrade step; plain chat keeps working.
+Upgrade the broker, then every room member to a codec-capable release, then reconnect.
+`ahub status` distinguishes local room storage opening from a failed broker
+connection; direct `ahub room status` failures expose only closed cause/action
+metadata. A healthy online link needs no broker repair advice.