@staix/agent-hub 0.4.0 → 0.6.0

package/src/hub/lifecycle.ts

@@ -7,6 +7,7 @@ import { ControlClient, PROTOCOL, readControl } from "./control-client.ts";
 import { startDaemon } from "./daemon.ts";
 import { Registry, type Project } from "./registry.ts";
 import { CODEX_APP, CODEX_PROXY, CONTROL, SWITCHYARD } from "./ports.ts";
+import { assertLifecycleAvailable, recoveryLock } from "./recovery-store.ts";
 
 export type ProjectInspection = {
   state: "running" | "stopped" | "stopping" | "unavailable" | "incompatible" | "missing" | "starting";
@@ -85,6 +86,7 @@ async function available(base: number): Promise<boolean> {
 
 /** Called only in the detached daemon process. A competing starter exits without touching state. */
 export async function runProjectDaemon(project: Project, unattended = false): Promise<void> {
+  assertLifecycleAvailable();
   const registry = new Registry();
   const instanceId = randomUUID();
   let claimed = false;
@@ -122,6 +124,7 @@ export async function runProjectDaemon(project: Project, unattended = false): Pr
 }
 
 export async function startProject(project: Project, options: { unattended?: boolean; env?: NodeJS.ProcessEnv } = {}): Promise<any> {
+  assertLifecycleAvailable();
   const registry = new Registry();
   try {
     const current = registry.get(project.id);
@@ -138,10 +141,14 @@ export async function startProject(project: Project, options: { unattended?: boo
       renameSync(temporary, marker);
       const log = openSync(join(project.stateDir, "hub.log"), "a");
       try {
+        const launchEnv = { ...(options.env ?? process.env) };
+        // Native sessions can outlive the operation which launched them. An expired
+        // operation ID must not make a later ordinary startup load a retired snapshot.
+        if (launchEnv.AGENTHUB_RECOVERY_OPERATION !== recoveryLock()) delete launchEnv.AGENTHUB_RECOVERY_OPERATION;
         const child = spawn(process.execPath, [join(import.meta.dir, "../cli/main.ts"), "--project", project.root, "daemon",
           ...(options.unattended ? ["--unattended"] : [])], {
           cwd: project.root, detached: true, stdio: ["ignore", log, log],
-          env: { ...(options.env ?? process.env), AGENTHUB_STATE_DIR: project.stateDir, AGENTHUB_PROJECT_DIR: project.root,
+          env: { ...launchEnv, AGENTHUB_STATE_DIR: project.stateDir, AGENTHUB_PROJECT_DIR: project.root,
             AGENTHUB_UNATTENDED: options.unattended ? "1" : "0" },
         });
         child.on("error", () => {}); // bounded readiness below reports failure with the project's log path
@@ -160,6 +167,7 @@ export async function startProject(project: Project, options: { unattended?: boo
 }
 
 export async function stopProject(project: Project, expectedInstance?: string): Promise<void> {
+  assertLifecycleAvailable();
   const inspection = await inspectProject(project);
   if (inspection.state === "stopped") return;
   if (inspection.state !== "running" && inspection.state !== "stopping") throw new Error(inspection.error ?? "hub ownership is not verified; not stopping it");

package/src/hub/manager.ts

@@ -21,6 +21,7 @@ type ManagerHandle = { stop(): Promise<void>; stopped: Promise<void> };
 type Manifest = { port: number; protocol: number; instanceId: string; pid: number };
 const active = new Map<string, { handle: ManagerHandle; issue(): string }>();
 const CONTROL_TIMEOUT = 3000;
+const SUPPORTED_MANAGER_PROTOCOLS = new Set([8, PROTOCOL]);
 const safeError = (error: unknown) => error instanceof Error ? error.message.slice(0, 300) : "operation failed";
 
 function files(home: string) {
@@ -175,7 +176,7 @@ export async function startManager(options: ManagerOptions = {}): Promise<Manage
 async function managerRequest(home: string, path: "/open" | "/stop"): Promise<{ status: Manifest; body: any }> {
   const status = readManifest(home);
   if (!status) throw new Error("manager manifest is unavailable");
-  if (status.protocol !== PROTOCOL) throw new Error("manager protocol is incompatible; use its matching CLI to stop it");
+  if (!SUPPORTED_MANAGER_PROTOCOLS.has(status.protocol)) throw new Error("manager protocol is incompatible; use its matching CLI to stop it");
   const token = readFileSync(files(home).token, "utf8").trim();
   if (!token) throw new Error("manager token is unavailable");
   const response = await fetch(`http://127.0.0.1:${status.port}${path}`, {
@@ -215,6 +216,19 @@ export async function openManager(options: ManagerOptions = {}): Promise<string>
   throw new Error(`manager readiness not confirmed: ${safeError(error)}; see ${join(f.dir, "manager.log")}`);
 }
 
+/** Refresh an explicitly supported protocol-8 manager onto the current CLI after upgrade. */
+export async function refreshManager(options: ManagerOptions = {}): Promise<string> {
+  const home = options.home ?? hubHome();
+  const manifest = readManifest(home);
+  if (manifest && manifest.protocol === 8) {
+    await managerRequest(home, "/stop");
+    const deadline = Date.now() + CONTROL_TIMEOUT;
+    while (Date.now() < deadline && readManifest(home)) await Bun.sleep(25);
+    if (readManifest(home)) throw new Error("legacy manager shutdown is still pending; refresh was not confirmed");
+  }
+  return openManager(options);
+}
+
 export async function stopManager(options: ManagerOptions = {}): Promise<void> {
   const home = options.home ?? hubHome();
   const local = active.get(home);

package/src/hub/peers.ts

@@ -15,6 +15,8 @@ export interface PeerAdapter {
   onState?: (state: PeerState) => void;
   /** Set by the bus. A delivery that had resolved turned out not to reach the agent: put it back. */
   onFailed?: (envs: Envelope[]) => void;
+  /** Safe restart metadata only: ids and launch parameters, never prompt/message text. */
+  recoveryMetadata?(): Record<string, unknown>;
 }
 
 export const DEFAULT_WATCHDOG_MS = 300_000;

package/src/hub/recovery-store.ts

@@ -0,0 +1,89 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { Database } from "bun:sqlite";
+import { hubHome } from "./project.ts";
+
+export const operationIdPattern = /^[a-f0-9-]{36}$/;
+export function operationPath(id: string, home = hubHome()): string {
+  if (!operationIdPattern.test(id)) throw new Error("invalid recovery operation ID");
+  return join(home, "recovery", `${id}.json`);
+}
+
+/** Private state only. Never put tokens or transcript/message bodies in an operation receipt. */
+export function atomicPrivateJSON(file: string, value: unknown): void {
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    chmodSync(temporary, 0o600);
+    renameSync(temporary, file);
+  } finally { rmSync(temporary, { force: true }); }
+}
+
+export function readOperation<T>(id: string, home = hubHome()): T {
+  return JSON.parse(readFileSync(operationPath(id, home), "utf8")) as T;
+}
+
+export function writeOperation(id: string, value: unknown, home = hubHome()): void {
+  mkdirSync(join(home, "recovery"), { recursive: true, mode: 0o700 });
+  atomicPrivateJSON(operationPath(id, home), value);
+}
+
+export function recoveryLock(home = hubHome()): string | undefined {
+  const file = join(home, "recovery.lock");
+  try {
+    const data = JSON.parse(readFileSync(file, "utf8"));
+    if (!operationIdPattern.test(data.operationId)) throw new Error("invalid recovery lock");
+    return data.operationId;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw new Error("recovery lock is unreadable; inspect it before changing runtimes", { cause: error });
+  }
+}
+
+export function acquireRecoveryLock(id: string, home = hubHome()): void {
+  operationPath(id, home);
+  mkdirSync(home, { recursive: true, mode: 0o700 });
+  const existing = recoveryLock(home);
+  if (existing === id) return;
+  try { writeFileSync(join(home, "recovery.lock"), JSON.stringify({ operationId: id }), { mode: 0o600, flag: "wx" }); }
+  catch { throw new Error(`another recovery operation owns this machine: ${recoveryLock(home) ?? "unknown"}`); }
+}
+
+export function releaseRecoveryLock(id: string, home = hubHome()): void {
+  if (recoveryLock(home) !== id) throw new Error("recovery lock ownership changed");
+  rmSync(join(home, "recovery.lock"));
+}
+
+/** Used by CLI and manager lifecycle paths. A detached operation carries its own ID. */
+export function assertLifecycleAvailable(): void {
+  const owner = recoveryLock();
+  if (owner && process.env.AGENTHUB_RECOVERY_OPERATION !== owner) {
+    throw new Error(`recovery operation ${owner} is active; use ahub recovery status|resume ${owner}`);
+  }
+}
+
+/** An exclusive runner claim. Never steal a live or uncertain owner on resume. */
+export function claimRunner(id: string, home = hubHome()): () => void {
+  const path = `${operationPath(id, home)}.runner.db`;
+  const db = new Database(path, { create: true });
+  chmodSync(path, 0o600);
+  const nonce = randomUUID();
+  try {
+    db.run("PRAGMA busy_timeout = 3000");
+    db.run("CREATE TABLE IF NOT EXISTS runner (slot INTEGER PRIMARY KEY, pid INTEGER NOT NULL, nonce TEXT NOT NULL)");
+    db.transaction(() => {
+      const row = db.query("SELECT pid FROM runner WHERE slot = 1").get() as { pid: number } | null;
+      if (row) {
+        if (!Number.isSafeInteger(row.pid) || row.pid < 1) throw new Error("invalid recovery runner ownership");
+        try { process.kill(row.pid, 0); throw new Error(`recovery runner ${row.pid} is still alive`); }
+        catch (error) { if ((error as NodeJS.ErrnoException).code !== "ESRCH") throw error; }
+      }
+      db.query("INSERT OR REPLACE INTO runner (slot, pid, nonce) VALUES (1, ?, ?)").run(process.pid, nonce);
+    }).immediate();
+  } catch (error) { db.close(); throw error; }
+  return () => {
+    db.query("DELETE FROM runner WHERE slot = 1 AND nonce = ?").run(nonce);
+    db.close();
+  };
+}

package/src/hub/restart.ts

@@ -0,0 +1,97 @@
+import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import type { BusSnapshot } from "./bus.ts";
+import type { PeerId, PeerState } from "./envelope.ts";
+import { MAX_HOP } from "./envelope.ts";
+
+export const RESTART_SCHEMA_VERSION = 1;
+
+export type RecoveryPhase = "preparing" | "prepared" | "restored" | "released";
+
+export interface RestartPeerSnapshot {
+  id: PeerId;
+  state: PeerState;
+  queueIds: string[];
+  launch?: Record<string, unknown>;
+  /** Safe native correlation metadata. Never include prompt/message text here. */
+  threadId?: string;
+  sessionId?: string;
+}
+
+export interface RestartSnapshot {
+  schemaVersion: 1;
+  projectRoot: string;
+  projectId: string;
+  sourceInstanceId: string;
+  operationId: string;
+  committedAt: number;
+  bus: BusSnapshot;
+  manualPaused: PeerId[];
+  peers: RestartPeerSnapshot[];
+  integrity?: {
+    queues: Record<string, string[]>;
+    manualPaused: PeerId[];
+    boardDigest: string;
+    budgetDigest: string;
+  };
+}
+
+export interface RestartReadExpectation {
+  projectRoot: string;
+  projectId: string;
+  operationId?: string;
+}
+
+export function restartPath(stateDir: string): string {
+  return join(stateDir, "restart.json");
+}
+
+export function releasedRestartPath(stateDir: string, operationId: string): string {
+  const safe = createHash("sha256").update(operationId).digest("hex");
+  return join(stateDir, `restart.released.${safe}.json`);
+}
+
+/** Read only a matching controlled-restart snapshot. Unknown or malformed state is ignored and must block recovery upstream. */
+export function readRestartSnapshot(stateDir: string, expected: RestartReadExpectation): RestartSnapshot | undefined {
+  let parsed: unknown;
+  try { parsed = JSON.parse(readFileSync(restartPath(stateDir), "utf8")); } catch { return undefined; }
+  if (!parsed || typeof parsed !== "object") return undefined;
+  const s = parsed as Partial<RestartSnapshot>;
+  if (s.schemaVersion !== RESTART_SCHEMA_VERSION || s.projectRoot !== expected.projectRoot || s.projectId !== expected.projectId || typeof s.operationId !== "string" || !s.operationId || typeof s.sourceInstanceId !== "string" || !s.sourceInstanceId || !s.bus) return undefined;
+  if (expected.operationId !== undefined && s.operationId !== expected.operationId) return undefined;
+  const peerId = (value: unknown): value is string => typeof value === "string" && /^(?:hub|user|[a-z][a-z0-9-]{0,31})$/.test(value);
+  const isEnvelope = (value: unknown, seen = false): boolean => {
+    if (!value || typeof value !== "object") return false;
+    const e = value as Record<string, unknown>;
+    return typeof e.id === "string" && e.id.length > 0 && e.id.length <= 256 && typeof e.trace === "string" && e.trace.length > 0 && e.trace.length <= 256 && peerId(e.from) && typeof e.body === "string" && Number.isSafeInteger(e.hop) && (e.hop as number) >= 0 && (seen || (e.hop as number) <= MAX_HOP) && Number.isFinite(e.ts) && ["chat", "task", "review", "status", "budget", "presence"].includes(e.kind as string) && ["important", "status", "fyi"].includes(e.priority as string) && (e.to === undefined || (Array.isArray(e.to) && e.to.every(peerId)));
+  };
+  const bus = s.bus as Partial<BusSnapshot>;
+  if (bus.schemaVersion !== 1 || !bus.queues || typeof bus.queues !== "object" || !bus.prefaces || typeof bus.prefaces !== "object" || !Array.isArray(bus.seen) || !bus.attempts || typeof bus.attempts !== "object" || !Array.isArray(bus.withdrawn)) return undefined;
+  if (!Object.keys(bus.queues).every(peerId) || !Object.keys(bus.prefaces).every(peerId) || !Object.values(bus.queues).every((queue) => Array.isArray(queue) && queue.every((e) => isEnvelope(e))) || !Object.values(bus.prefaces).every((e) => isEnvelope(e)) || !bus.seen.every((e) => isEnvelope(e, true)) || !bus.withdrawn.every((id) => typeof id === "string" && id.length > 0) || !Object.values(bus.attempts).every((n) => Number.isSafeInteger(n) && n > 0)) return undefined;
+  if (!Array.isArray(s.manualPaused) || !s.manualPaused.every((id) => typeof id === "string") || !Array.isArray(s.peers) || !s.peers.every((peer) => peer && typeof peer === "object" && typeof peer.id === "string" && ["idle", "busy", "paused", "offline"].includes(peer.state as string) && Array.isArray(peer.queueIds) && peer.queueIds.every((id) => typeof id === "string"))) return undefined;
+  if (s.integrity !== undefined && (!s.integrity || typeof s.integrity !== "object" || typeof s.integrity.boardDigest !== "string" || typeof s.integrity.budgetDigest !== "string" || !Array.isArray(s.integrity.manualPaused) || !s.integrity.manualPaused.every((id) => typeof id === "string") || !s.integrity.queues || typeof s.integrity.queues !== "object" || !Object.values(s.integrity.queues).every((ids) => Array.isArray(ids) && ids.every((id) => typeof id === "string")))) return undefined;
+  return s as RestartSnapshot;
+}
+
+/** Atomic, owner-readable recovery state. The file never carries delivery bodies outside this 0600 path. */
+export function writeRestartSnapshot(stateDir: string, snapshot: RestartSnapshot): void {
+  mkdirSync(stateDir, { recursive: true });
+  const file = restartPath(stateDir);
+  const tmp = `${file}.${snapshot.sourceInstanceId}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(snapshot)}\n`, { mode: 0o600 });
+  chmodSync(tmp, 0o600);
+  renameSync(tmp, file);
+  chmodSync(file, 0o600);
+}
+
+export function removeRestartSnapshot(stateDir: string): void {
+  try { unlinkSync(restartPath(stateDir)); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+}
+
+/** Preserve an uncertain release outcome for manual reconciliation without making it authoritative on startup. */
+export function archiveRestartSnapshot(stateDir: string, operationId: string): void {
+  renameSync(restartPath(stateDir), releasedRestartPath(stateDir, operationId));
+  chmodSync(releasedRestartPath(stateDir, operationId), 0o600);
+}

package/src/hub/routing.ts

@@ -15,6 +15,8 @@ export interface ClassPolicy {
   escalate_to?: PeerId[];
   /** false: `local` is never owner or reviewer for this class */
   local_allowed?: boolean;
+  /** Pi backend for Pi-owned work. */
+  pi_backend?: "dgx" | "mlx";
 }
 
 export interface Routing {
@@ -24,10 +26,12 @@ export interface Routing {
   classes: Partial<Record<TaskClass, ClassPolicy>>;
   signals: { pii_patterns: string[]; long_context_tokens: number };
   constraints: { pii: "local_only" | "off"; long_context: "skip_local" | "off"; budget_paused: "skip_peer" | "off" };
+  pi: { dgx_max_context_tokens: number; mlx_max_context_tokens: number };
 }
 
 const TEMPLATE = join(import.meta.dir, "..", "..", "templates", "routing.toml");
 export const LOCAL: PeerId = "local";
+export const PI: PeerId = "pi";
 
 /** `.agenthub/routing.toml`, or the shipped default when the project has none. Throws on a file that does not parse or lacks a fixed model. */
 export function loadRouting(cwd: string): Routing {
@@ -41,13 +45,20 @@ export function loadRouting(cwd: string): Routing {
   if (!raw.local?.fixed_model) throw new Error("routing.toml: [local] fixed_model is required (the path that works without Switchyard)");
   const signals = { pii_patterns: [], long_context_tokens: 120_000, ...raw.signals };
   for (const p of signals.pii_patterns) new RegExp(p); // a bad pattern fails here, at load, not in the middle of an assignment
+  const classes = raw.classes ?? {};
+  for (const [name, policy] of Object.entries(classes)) {
+    if (policy?.pi_backend !== undefined && policy.pi_backend !== "dgx" && policy.pi_backend !== "mlx") throw new Error(`routing.toml: [classes.${name}] pi_backend must be "dgx" or "mlx"`);
+  }
+  const pi = { dgx_max_context_tokens: 262_144, mlx_max_context_tokens: 16_000, ...(raw as any).pi };
+  if (!(Number.isSafeInteger(pi.dgx_max_context_tokens) && pi.dgx_max_context_tokens > 0) || !(Number.isSafeInteger(pi.mlx_max_context_tokens) && pi.mlx_max_context_tokens > 0)) throw new Error("routing.toml: [pi] context limits must be positive integers");
   return {
     local: raw.local,
     targets: raw.targets ?? {},
     routes: raw.routes ?? {},
-    classes: raw.classes ?? {},
+    classes,
     signals,
     constraints: { pii: "local_only", long_context: "skip_local", budget_paused: "skip_peer", ...raw.constraints },
+    pi,
   };
 }
 
@@ -102,6 +113,7 @@ export interface Assignment {
   /** what `local` should ask for on this task: a Switchyard route id and the model to fall back to */
   route?: string;
   fixedModel?: string;
+  piBackend?: "dgx" | "mlx";
   trace: string[];
 }
 
@@ -126,6 +138,12 @@ export function assign(
     if (states[peer] === "paused" && routing.constraints.budget_paused === "skip_peer") return "paused";
     if (pii && peer !== LOCAL) return "pii: on-prem peers only";
     if (peer === LOCAL && policy?.local_allowed === false) return "local_allowed = false for this class";
+    if (peer === PI && policy?.local_allowed === false) return "local_allowed = false also excludes pi for this class";
+    if (peer === PI && task.signals.includes("long_context")) {
+      const backend = policy?.pi_backend ?? "dgx";
+      const limit = backend === "mlx" ? routing.pi.mlx_max_context_tokens : routing.pi.dgx_max_context_tokens;
+      if (routing.signals.long_context_tokens > limit) return `pi ${backend} capability limit ${limit} tokens`;
+    }
     if (peer === LOCAL && role === "owner" && task.signals.includes("long_context") && routing.constraints.long_context === "skip_local") return "long_context: skip local";
     return undefined;
   };
@@ -137,7 +155,9 @@ export function assign(
       trace.push(`  ${role} candidate ${peer}: ${why ? `skipped, ${why}` : states[peer]}`);
       if (!why) ok.push(peer);
     }
-    return ok.find((p) => states[p] === "idle") ?? ok[0]; // idle before busy, otherwise preference order
+    const localTier = ok.filter((p) => p === LOCAL || p === PI);
+    if (localTier.length) return localTier.find((p) => states[p] === "idle") ?? localTier[0]; // local/Pi stays ahead of an idle cloud peer
+    return ok.find((p) => states[p] === "idle") ?? ok[0];
   };
 
   // Never the task's current owner by default: a decline or an escalation has to reach the next peer in the list.
@@ -155,6 +175,8 @@ export function assign(
   }
   const route = policy?.route ?? routing.local.route;
   const fixedModel = policy?.fixed_model ?? routing.local.fixed_model;
+  const piBackend = policy?.pi_backend;
   if (owner === LOCAL) trace.push(`route: ${route ?? "(none)"}, fixed_model ${fixedModel}`);
-  return { ...(owner ? { owner } : {}), ...(pii ? { reviewer: "user" } : reviewer ? { reviewer } : {}), ...(route ? { route } : {}), fixedModel, trace };
+  if (owner === PI) trace.push(`pi decision: backend ${piBackend ?? "dgx"}${task.signals.includes("long_context") ? `, context limit ${piBackend === "mlx" ? routing.pi.mlx_max_context_tokens : routing.pi.dgx_max_context_tokens}` : ""}`);
+  return { ...(owner ? { owner } : {}), ...(pii ? { reviewer: "user" } : reviewer ? { reviewer } : {}), ...(route ? { route } : {}), fixedModel, ...(piBackend ? { piBackend } : {}), trace };
 }

package/src/hub/tasks.ts

@@ -3,7 +3,7 @@ import type { MemoryClient } from "../memory/client.ts";
 import { CLASSES, type Board, type Task, type TaskClass, type TaskRefs } from "./board.ts";
 import type { Bus } from "./bus.ts";
 import { HUB, newEnvelope, USER, type Envelope, type PeerId, type PeerState } from "./envelope.ts";
-import { assign, detectSignals, LOCAL, type Assignment, type Routing } from "./routing.ts";
+import { assign, detectSignals, LOCAL, PI, type Assignment, type Routing } from "./routing.ts";
 
 export interface TasksDeps {
   board: Board;
@@ -119,7 +119,7 @@ export class Tasks {
     const pii = this.isPii(task);
     const brief = pii ? undefined : await this.d.briefs?.forTask(task.owner!, task).catch(() => undefined);
     const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${h.note ?? ""}`);
-    const facts = [`class ${task.class}`, task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", a.reviewer ? `reviewer ${a.reviewer}` : "no reviewer"].filter(Boolean).join("; ");
+    const facts = [`class ${task.class}`, a.owner === PI ? `backend pi/${a.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", a.reviewer ? `reviewer ${a.reviewer}` : "no reviewer"].filter(Boolean).join("; ");
     const body = [
       `Task #${task.id} [${task.class}] ${task.title}`,
       task.detail,
@@ -216,7 +216,7 @@ export class Tasks {
     const list = this.d.routing().classes[task.class]?.escalate_to ?? [];
     if (task.state === "changes_requested") task = this.d.board.update(task.id, HUB, "reopened", { state: "in_progress" });
     const from = task.owner;
-    const next = await this.assignOwner(task, by, { candidates: list, event: "escalated", note: `${why}; from ${from ?? "none"}` });
+    const next = await this.assignOwner(task, by, { candidates: list, event: "escalated", note: `${why}; from ${from ?? "none"}`, context: why });
     if (next.owner && next.owner !== from) {
       this.d.notify(`task ${this.publicTitle(next)} escalated from ${from} to ${next.owner} (${why})`);
       this.note(next, by, "decision", `Task #${next.id} escalated from ${from} to ${next.owner}: ${why}`);
@@ -239,7 +239,8 @@ export class Tasks {
     const routing = this.d.routing();
     for (const task of this.d.board.list()) {
       if (task.owner === peer && OPEN.includes(task.state)) {
-        const candidates = [LOCAL, ...(routing.classes[task.class]?.peers ?? []).filter((p) => p !== LOCAL)];
+        const pii = this.isPii(task);
+        const candidates = [pii ? LOCAL : PI, pii ? undefined : LOCAL, ...(routing.classes[task.class]?.peers ?? []).filter((p) => p !== LOCAL && p !== PI)].filter((p): p is PeerId => !!p);
         const back = task.state === "in_progress" ? this.d.board.update(task.id, HUB, "released", { state: "proposed" }, `budget pause of ${peer}`) : task;
         const next = await this.assignOwner(back, HUB, { candidates, exclude: [peer], event: "reassigned", note: `budget pause of ${peer}`, clearOnFail: true, ...(context ? { context } : {}) });
         moved.push({ id: task.id, title: this.publicTitle(task), to: next.owner, role: "owner" });