@staix/agent-hub 0.8.1 → 0.9.0

package/src/hub/board.ts

@@ -14,6 +14,8 @@ export interface TaskRefs {
 /** What an owner says it will change, before it starts (issue #31). Each list holds short free-text items. */
 export const PLAN_KEYS = ["paths", "symbols", "signatures", "insertion_points"] as const;
 export type TaskPlan = Partial<Record<(typeof PLAN_KEYS)[number], string[]>>;
+/** Task outcomes older than this are pruned: demotion (issue #36) reads one week, seven half-lives. */
+export const OUTCOMES_KEPT_MS = 7 * 24 * 3_600_000;
 
 export interface HistoryEntry {
   at: number;
@@ -32,6 +34,8 @@ export interface Task {
   refs: TaskRefs;
   /** Absent only on tasks built outside the board (tests); the board always returns one, `{}` when none was given. */
   plan?: TaskPlan;
+  /** Tasks that must be approved before this one is offered (issue #34); fixed when it is proposed. */
+  deps?: number[];
   signals: string[];
   /** consecutive changes_requested verdicts */
   rejections: number;
@@ -49,7 +53,7 @@ const MOVES: Record<TaskState, TaskState[]> = {
   approved: [],
 };
 
-const JSON_COLS = ["refs", "plan", "signals", "history"] as const;
+const JSON_COLS = ["refs", "plan", "deps", "signals", "history"] as const;
 
 /** Task board in `.agenthub/state/hub.db`. It outlives the hub process: `ahub kill` leaves the file. */
 export class Board {
@@ -67,18 +71,22 @@ export class Board {
       id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, detail TEXT NOT NULL DEFAULT '', class TEXT NOT NULL,
       owner TEXT, reviewer TEXT, state TEXT NOT NULL, refs TEXT NOT NULL DEFAULT '{}', signals TEXT NOT NULL DEFAULT '[]',
       rejections INTEGER NOT NULL DEFAULT 0, history TEXT NOT NULL DEFAULT '[]', created INTEGER NOT NULL, updated INTEGER NOT NULL)`);
-    // Boards from before issue #31 have no plan column.
-    if (!(this.db.query("PRAGMA table_info(tasks)").all() as { name: string }[]).some((c) => c.name === "plan")) {
-      this.db.run("ALTER TABLE tasks ADD COLUMN plan TEXT NOT NULL DEFAULT '{}'");
+    // Who did well or badly at which class, for demotion (issue #36). Only peers, classes and times: no task text.
+    this.db.run("CREATE TABLE IF NOT EXISTS outcomes (peer TEXT NOT NULL, class TEXT NOT NULL, ok INTEGER NOT NULL, at INTEGER NOT NULL)");
+    this.db.run("CREATE INDEX IF NOT EXISTS outcomes_class_at ON outcomes (class, at)");
+    // Boards from before issues #31 and #34 lack these columns; existing rows get the defaults.
+    const have = new Set((this.db.query("PRAGMA table_info(tasks)").all() as { name: string }[]).map((c) => c.name));
+    for (const [col, empty] of [["plan", "{}"], ["deps", "[]"]] as const) {
+      if (!have.has(col)) this.db.run(`ALTER TABLE tasks ADD COLUMN ${col} TEXT NOT NULL DEFAULT '${empty}'`);
     }
   }
 
-  propose(by: PeerId, t: { title: string; detail?: string; class: TaskClass; refs?: TaskRefs; plan?: TaskPlan; signals?: string[] }): Task {
+  propose(by: PeerId, t: { title: string; detail?: string; class: TaskClass; refs?: TaskRefs; plan?: TaskPlan; deps?: number[]; signals?: string[] }): Task {
     const now = Date.now();
     const history: HistoryEntry[] = [{ at: now, by, event: "proposed" }];
     const { lastInsertRowid } = this.db
-      .query("INSERT INTO tasks (title, detail, class, state, refs, plan, signals, history, created, updated) VALUES (?, ?, ?, 'proposed', ?, ?, ?, ?, ?, ?)")
-      .run(t.title, t.detail ?? "", t.class, JSON.stringify(t.refs ?? {}), JSON.stringify(t.plan ?? {}), JSON.stringify(t.signals ?? []), JSON.stringify(history), now, now);
+      .query("INSERT INTO tasks (title, detail, class, state, refs, plan, deps, signals, history, created, updated) VALUES (?, ?, ?, 'proposed', ?, ?, ?, ?, ?, ?, ?)")
+      .run(t.title, t.detail ?? "", t.class, JSON.stringify(t.refs ?? {}), JSON.stringify(t.plan ?? {}), JSON.stringify(t.deps ?? []), JSON.stringify(t.signals ?? []), JSON.stringify(history), now, now);
     const task = this.get(Number(lastInsertRowid))!;
     this.changed(task, history[0]!);
     return task;
@@ -118,6 +126,15 @@ export class Board {
     return updated;
   }
 
+  recordOutcome(peer: PeerId, cls: TaskClass, ok: boolean, at = Date.now()): void {
+    this.db.query("INSERT INTO outcomes (peer, class, ok, at) VALUES (?, ?, ?, ?)").run(peer, cls, ok ? 1 : 0, at);
+    this.db.query("DELETE FROM outcomes WHERE at < ?").run(at - OUTCOMES_KEPT_MS); // nothing older is read
+  }
+
+  outcomes(cls: TaskClass, since: number): { peer: PeerId; ok: number; at: number }[] {
+    return this.db.query("SELECT peer, ok, at FROM outcomes WHERE class = ? AND at >= ?").all(cls, since) as { peer: PeerId; ok: number; at: number }[];
+  }
+
   close(): void {
     this.db.close();
   }

package/src/hub/budget.ts

@@ -37,8 +37,11 @@ export interface BudgetConfig {
   poll_min: number;
   checkpoint_timeout_s: number;
   kimi_tokens_5h: number;
+  /** A paused peer whose window resets within this many minutes keeps its work, urgent tasks aside; 0 always hands over (issue #36). */
+  wait_max_min: number;
 }
-export const DEFAULT_BUDGET: BudgetConfig = { gate: 0.9, stale_min: 30, poll_min: 10, checkpoint_timeout_s: 90, kimi_tokens_5h: 0 };
+// wait_max_min is off here, as approvals.notify is: a project config turns it on (30 unless it says otherwise).
+export const DEFAULT_BUDGET: BudgetConfig = { gate: 0.9, stale_min: 30, poll_min: 10, checkpoint_timeout_s: 90, kimi_tokens_5h: 0, wait_max_min: 0 };
 
 export interface BudgetHooks {
   pause(peer: PeerId): void;
@@ -52,8 +55,8 @@ export interface BudgetHooks {
   attached(peer: PeerId): boolean;
   /** Is anybody attached who could take work over? Without one a handoff would only strip the tasks of their owner. */
   canHandOff(peer: PeerId): boolean;
-  /** Move the peer's open work. */
-  handoff(peer: PeerId, context: string | undefined): Promise<Moved[]>;
+  /** Move the peer's open work; with `urgentOnly`, only tasks marked urgent (the peer waits for its reset). */
+  handoff(peer: PeerId, context: string | undefined, urgentOnly: boolean): Promise<Moved[]>;
   resumed(record: PauseRecord): void;
   /** Every reading as it arrives, with the time it was measured (telemetry, issue #40). */
   reading?(peer: PeerId, windows: UsageWindow[], hard: boolean, at: number): void;
@@ -61,6 +64,10 @@ export interface BudgetHooks {
 }
 
 const HYSTERESIS = 0.1;
+/** Mark a pause whose handoff was a wait, and one whose wait was undone, in its reason (issue #36). */
+const WAIT_NOTE = "; keeps its work:";
+const WAITED_NOTE = "; waited, then the reset moved to";
+const waitedNote = (min: number, max: number) => `${WAITED_NOTE} ${min} min, beyond wait_max_min ${max}`;
 const FALLBACK_WINDOW_MINS = 300;
 /** Peers the coordinator never pauses: the local worker has no quota. */
 const EXEMPT = new Set<PeerId>(["local", "user", "hub"]);
@@ -177,7 +184,17 @@ export class Budget {
     if (open) {
       // A later reading may finally carry the reset time the first one lacked.
       const known = Math.max(0, ...over.map((r) => r.resetsAt ?? 0));
-      if (known && known !== open.resetsAt) this.db.query("UPDATE budget_pauses SET resets_at = ? WHERE peer = ?").run(known, peer);
+      if (known && known !== open.resetsAt) {
+        // A wait was decided against the old reset (#36). If the new one is past wait_max_min (a week window crossed
+        // the gate meanwhile), the work has to move after all: unmarked, the next tick hands it over in full.
+        const waited = open.handedOff && open.reason.includes(WAIT_NOTE);
+        const waitMin = Math.ceil((known - this.now()) / 60_000);
+        if (waited && waitMin > this.cfg.wait_max_min) {
+          const reason = `${open.reason.slice(0, open.reason.indexOf(WAIT_NOTE))}${waitedNote(waitMin, this.cfg.wait_max_min)}`;
+          this.db.query("UPDATE budget_pauses SET resets_at = ?, handed_off = 0, reason = ? WHERE peer = ?").run(known, reason, peer);
+          this.hooks.notify(`budget: ${peer}'s reset moved to ${waitMin} min, beyond wait_max_min ${this.cfg.wait_max_min}: its work is handed over`);
+        } else this.db.query("UPDATE budget_pauses SET resets_at = ? WHERE peer = ?").run(known, peer);
+      }
       const newer = fresh.filter((r) => r.at > open.since);
       if (newer.length && fresh.every((r) => r.used < this.cfg.gate - HYSTERESIS)) this.resume(peer, "usage is back under the gate");
       return;
@@ -215,15 +232,34 @@ export class Budget {
 
   private async handOff(peer: PeerId, summary: string | undefined): Promise<void> {
     const context = summary ?? (await this.hooks.platformContext(peer).catch(() => undefined));
+    // Wait or hand off (issue #36): a handoff costs the next peer the whole context, so a short wait can be cheaper.
+    const resetsAt = this.record(peer)?.resetsAt;
+    const waitMin = resetsAt === undefined ? Infinity : Math.max(0, Math.ceil((resetsAt - this.now()) / 60_000));
+    const wait = this.cfg.wait_max_min > 0 && waitMin <= this.cfg.wait_max_min;
     let moved: Moved[];
     try {
-      moved = await this.hooks.handoff(peer, context);
+      moved = await this.hooks.handoff(peer, context, wait);
     } catch (e) {
       // Left unmarked on purpose: the next tick, or the next hub run, tries again. The peer stays paused either way.
       return this.hooks.notify(`budget: handing over ${peer}'s work failed, will retry: ${(e as Error).message}`);
     }
     if (this.closed) return;
-    this.db.query("UPDATE budget_pauses SET handed_off = 1, moved = ? WHERE peer = ?").run(JSON.stringify(moved), peer);
+    const record = this.record(peer);
+    // A wait that was undone hands over a second time: keep what moved the first time (urgent work) on the record too.
+    const all = JSON.stringify([...(record?.moved ?? []), ...moved]);
+    const nowMin = record ? Math.ceil((record.resetsAt - this.now()) / 60_000) : waitMin;
+    if (wait && nowMin > this.cfg.wait_max_min) {
+      // A reading moved the reset past the limit while the urgent work moved: no wait after all. Left unmarked, so the
+      // next tick hands over the rest.
+      this.db.query("UPDATE budget_pauses SET moved = ?, reason = reason || ? WHERE peer = ?").run(all, waitedNote(nowMin, this.cfg.wait_max_min), peer);
+      this.hooks.notify(`budget: ${peer}'s reset moved to ${nowMin} min, beyond wait_max_min ${this.cfg.wait_max_min}: its work is handed over`);
+    } else {
+      let why = "";
+      if (wait) why = `${WAIT_NOTE} resets in ${waitMin} min, within wait_max_min ${this.cfg.wait_max_min}`;
+      else if (this.cfg.wait_max_min > 0 && waitMin !== Infinity && !record?.reason.includes(WAITED_NOTE)) why = `; handed over: resets in ${waitMin} min, beyond wait_max_min ${this.cfg.wait_max_min}`;
+      this.db.query("UPDATE budget_pauses SET handed_off = 1, moved = ?, reason = reason || ? WHERE peer = ?").run(all, why, peer);
+      if (wait) this.hooks.notify(`budget: ${peer} keeps its work and waits ${waitMin} min for its reset (wait_max_min ${this.cfg.wait_max_min})${moved.length ? "; urgent work moves" : ""}`);
+    }
     if (moved.length) this.hooks.notify(`budget: moved from ${peer}: ${moved.map((m) => `#${m.id} ${m.role} -> ${m.to ?? "nobody"}`).join(", ")}`);
   }
 
@@ -256,6 +292,21 @@ export class Budget {
     this.hooks.notify(`budget: ${peer} resumed (${why})`);
   }
 
+  /**
+   * For routing (issue #36): per peer, the headroom of its most used fresh window and that window's reset. Headroom a
+   * week window bounds is not lost when the 5 h window resets, so the reset is the binding window's, the latest on a tie.
+   */
+  headroom(): Record<PeerId, { headroom: number; resetsAt?: number }> {
+    return Object.fromEntries([...this.readings.keys()].flatMap((peer) => {
+      const fresh = this.fresh(peer);
+      if (!fresh.length) return [];
+      const used = Math.max(...fresh.map((r) => r.used));
+      const binding = fresh.filter((r) => r.used === used);
+      const resetsAt = binding.some((r) => r.resetsAt === undefined) ? undefined : Math.max(...binding.map((r) => r.resetsAt!));
+      return [[peer, { headroom: 1 - used, ...(resetsAt !== undefined ? { resetsAt } : {}) }]];
+    }));
+  }
+
   status(): Record<PeerId, { windows: (Reading & { stale: boolean })[]; paused?: { reason: string; resetsAt: number; since: number } }> {
     const staleMs = this.cfg.stale_min * 60_000;
     const peers = new Set([...this.readings.keys(), ...this.records().map((r) => r.peer)]);

package/src/hub/bus.ts

@@ -1,4 +1,4 @@
-import { appendNote, DIGEST, HUB, keepNotes, MAX_HOP, newEnvelope, parseMarker, quoteNotes, replyAudience, type Envelope, type EnvelopeOpts, type PeerId, type PeerState, type Priority } from "./envelope.ts";
+import { appendNote, DIGEST, HUB, keepNotes, MAX_HOP, newEnvelope, noteLine, parseMarker, quoteNotes, replyAudience, type Envelope, type EnvelopeOpts, type PeerId, type PeerState, type Priority } from "./envelope.ts";
 import type { PeerAdapter } from "./peers.ts";
 import { DeliveryJournal, type JournalDelivery, type JournalDeliveryState } from "./delivery-journal.ts";
 
@@ -24,6 +24,11 @@ export interface BusOptions {
   /** Optional: rewrite a delivery before it goes out (M6 digest condensation). Must return its input on any failure. */
   condense?: (envs: Envelope[]) => Promise<Envelope[]>;
   journal?: DeliveryJournal;
+  /**
+   * Optional: may an agent send this envelope now (issue #38)? `parent` is the id of what it answers. A reason refuses
+   * it, and the sender hears it on its next delivery.
+   */
+  admit?: (env: Envelope, parent?: string) => string | undefined;
 }
 
 /** Serializable delivery state used by the controlled restart coordinator. Bodies stay in the private daemon file. */
@@ -133,11 +138,24 @@ export class Bus {
       // `digest` in the audience stands for the condensed delivery even when a steer, not the digest, is the parent.
       const condensed = !!last?.out.some((e) => e.from === DIGEST);
       const audienceOriginals = originals ?? (opts?.to?.includes(DIGEST) && condensed ? last?.originals : undefined);
-      this.publish(newEnvelope(peer.id, body, {
-        ...opts,
-        ...(opts?.to?.length ? { to: resolveTo(opts.to, audienceOriginals) } : {}),
-        priority: opts?.priority ?? capPriority(peer, priority, opts?.inReplyTo, originals),
-      }));
+      const to = opts?.to?.length ? resolveTo(opts.to, audienceOriginals) : undefined;
+      let env = newEnvelope(peer.id, body, { ...opts, ...(to ? { to } : {}), priority: opts?.priority ?? capPriority(peer, priority, opts?.inReplyTo, originals) });
+      // Limits count what is sent: the envelope as built (a reply goes to its parent's sender, `digest` is resolved,
+      // the priority is capped), never the raw `to`.
+      const parent = opts?.inReplyTo?.id;
+      let refused = this.opts.admit?.(env, parent);
+      // A turn answer has no caller to refuse: over its important budget it goes out as status, not at all.
+      if (refused && env.priority === "important" && !this.opts.admit?.({ ...env, priority: "status" }, parent)) {
+        // It went out, so the advice on how to send it does not apply.
+        this.note(peer.id, noteLine(HUB, "decision", `your [IMPORTANT] message went out as status: ${refused.replace(/[;:] (retry after \d+ s, or )?send it without \[IMPORTANT\]$/, "")}`));
+        env = { ...env, priority: "status" };
+        refused = undefined;
+      }
+      if (refused) {
+        this.note(peer.id, noteLine(HUB, "decision", `your message was not delivered: ${refused}`));
+        return refused;
+      }
+      this.publish(env);
     };
     peer.onFailed = (envs) => {
       // The adapter got the condensed list; what has to come back is what that list replaced.

package/src/hub/conflicts.ts

@@ -0,0 +1,63 @@
+import { Database } from "bun:sqlite";
+import { existsSync } from "node:fs";
+import type { Task } from "./board.ts";
+import { samePlace } from "./tasks.ts";
+
+/** A file an owner's open task changed, as the turn snapshots saw it (issue #32). */
+export interface Touch {
+  task: number;
+  peer: string;
+  path: string;
+  at: number;
+}
+
+/**
+ * The files `peer` just changed that another owner's open task changed before it, grouped by that task. Pure: the
+ * daemon passes the turn's files, the recorded touches and the open tasks, PII ones already left out. A file only one
+ * agent touched is never a conflict, even when the task it was touched for has changed hands since.
+ */
+export function conflictsOf(peer: string, changed: string[], touches: Touch[], open: Task[]): { task: Task; paths: string[] }[] {
+  const tasks = new Map(open.map((t) => [t.id, t]));
+  const mine = new Set(changed);
+  const hits = new Map<number, Set<string>>();
+  for (const t of touches) {
+    const task = tasks.get(t.task);
+    if (!task || task.owner === peer || t.peer === peer || !mine.has(t.path)) continue;
+    if (!hits.has(t.task)) hits.set(t.task, new Set());
+    hits.get(t.task)!.add(t.path);
+  }
+  return [...hits].map(([id, paths]) => ({ task: tasks.get(id)!, paths: [...paths].sort() }));
+}
+
+/**
+ * For `ahub check-path`, the Claude Code PreToolUse hook (issue #32): other owners' open tasks that claim a file (refs or
+ * plan paths) or changed it in a turn. Reads hub.db only, so it works whether or not the hub runs. PII tasks are left
+ * out: the hook's text reaches a cloud model. `project` is the file relative to the project root, `repo` relative to
+ * the repository's top level (where turn snapshots record paths).
+ */
+export function pathWarnings(dbFile: string, peer: string, file: { project: string; repo?: string }): string[] {
+  if (!existsSync(dbFile)) return [];
+  const db = new Database(dbFile, { readonly: true });
+  try {
+    const rows = db.query("SELECT * FROM tasks WHERE owner IS NOT NULL AND owner != ? AND state IN ('proposed', 'in_progress', 'changes_requested') ORDER BY id").all(peer) as Record<string, string | number | null>[];
+    let touches: Touch[] = [];
+    try {
+      if (file.repo) touches = db.query("SELECT * FROM touches WHERE path = ? AND peer != ?").all(file.repo, peer) as Touch[];
+    } catch {
+      // a hub without snapshots never made the table
+    }
+    return rows.flatMap((r) => {
+      if ((JSON.parse(String(r.signals ?? "[]")) as string[]).includes("pii")) return [];
+      const refs = JSON.parse(String(r.refs ?? "{}")) as { paths?: string[] };
+      const plan = JSON.parse(String(r.plan ?? "{}")) as { paths?: string[] };
+      const claims = [...(refs.paths ?? []), ...(plan.paths ?? [])].some((p) => samePlace(p, file.project));
+      const changed = touches.some((t) => t.task === r.id);
+      if (!claims && !changed) return [];
+      const how = [changed ? "changed it" : "", claims ? "claims it" : ""].filter(Boolean).join(" and ");
+      // The title is another agent's text: quoted as a JSON string, so a line break in it cannot start a line of its own.
+      return [`task #${r.id} ${JSON.stringify(String(r.title).slice(0, 100))} (owner ${r.owner}, ${r.state}) ${how}`];
+    });
+  } finally {
+    db.close();
+  }
+}

package/src/hub/daemon.ts

@@ -36,11 +36,13 @@ import { Bus } from "./bus.ts";
 import { DeliveryJournal } from "./delivery-journal.ts";
 import { startDashboard } from "./ui.ts";
 import { PROTOCOL, stateDirFor } from "./control-client.ts";
-import { newEnvelope, parseMarker, replyParent, sanitize, USER, type Envelope, type PeerId } from "./envelope.ts";
+import { newEnvelope, parseMarker, replyParent, sanitize, USER, type Envelope, type PeerId, type Priority } from "./envelope.ts";
 import { BasePeer, DEFAULT_WATCHDOG_MS, type PeerAdapter } from "./peers.ts";
 import { MemoryClient, workerUrl } from "../memory/client.ts";
 import { VERSION } from "../version.ts";
 import { projectChain, recallFor } from "../memory/recall.ts";
+import { conflictsOf } from "./conflicts.ts";
+import { DEFAULT_LIMITS, Limiter, PROJECT_LIMITS, type LimitsConfig } from "./limits.ts";
 import { changedPaths, repoOf, snapshot, Turns } from "./snapshots.ts";
 import { archiveRestartSnapshot, readRestartSnapshot, removeRestartSnapshot, restartPath, writeRestartSnapshot, type RecoveryPhase, type RestartPeerSnapshot, type RestartSnapshot } from "./restart.ts";
 
@@ -67,6 +69,8 @@ export interface HubConfig {
   checks: { timeout_s: number; [cls: string]: string | number };
   /** A git tree at each turn boundary for `ahub turns` and `ahub undo`, the last `keep` per peer (issue #33). */
   snapshots: { enabled: boolean; keep: number };
+  /** Per-sender rate limits and repeat suppression for what agents send (issue #38). */
+  limits: LimitsConfig;
   /** Machine-local fields a config file set but git could not vouch for, and why (issue #17). */
   ignored?: string[];
 }
@@ -91,6 +95,7 @@ export const DEFAULT_CONFIG: HubConfig = {
   checks: { timeout_s: 600 },
   // Off here like approvals.notify, so tests (whose cwd is this repository) write no objects; a project's config turns it on.
   snapshots: { enabled: false, keep: 20 },
+  limits: DEFAULT_LIMITS,
 };
 
 export { stateDirFor };
@@ -101,7 +106,7 @@ const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
 /** The shared project config, then the machine's own file, which overrides it block by block (issue #17). */
 const CONFIG_FILES = ["config.json", "config.local.json"] as const;
-const CONFIG_BLOCKS = ["memory", "roles", "budget", "inference", "omniroute", "local", "pi", "approvals", "tasks", "checks", "snapshots", "mlx"];
+const CONFIG_BLOCKS = ["memory", "roles", "budget", "inference", "omniroute", "local", "pi", "approvals", "tasks", "checks", "snapshots", "limits", "mlx"];
 
 export function loadConfig(cwd: string): HubConfig {
   const ignored: string[] = [];
@@ -133,7 +138,7 @@ export function loadConfig(cwd: string): HubConfig {
     ...file,
     memory: { ...DEFAULT_CONFIG.memory, ...file.memory },
     roles: { ...DEFAULT_CONFIG.roles, ...file.roles },
-    budget: { ...DEFAULT_CONFIG.budget, ...file.budget },
+    budget: { ...DEFAULT_CONFIG.budget, wait_max_min: 30, ...file.budget }, // on with any project config (issue #36)
     inference: { ...DEFAULT_CONFIG.inference, ...file.inference },
     omniroute: { ...DEFAULT_CONFIG.omniroute, ...file.omniroute },
     local: { ...DEFAULT_CONFIG.local, ...file.local },
@@ -145,6 +150,7 @@ export function loadConfig(cwd: string): HubConfig {
     tasks: { ...DEFAULT_CONFIG.tasks, ...file.tasks },
     checks: { ...DEFAULT_CONFIG.checks, ...file.checks },
     snapshots: { ...DEFAULT_CONFIG.snapshots, enabled: true, ...file.snapshots },
+    limits: { ...PROJECT_LIMITS, ...file.limits }, // on with any project config (issue #38)
     mlx,
     ...(ignored.length ? { ignored } : {}),
   };
@@ -277,7 +283,24 @@ export async function startDaemon(opts: DaemonOptions) {
   // The hub's own model calls (digest condensation, task triage) are wired below, once the gateway client exists.
   let inference: Inference | undefined;
   const journal = new DeliveryJournal({ file: join(opts.stateDir, "hub.db"), projectRoot: opts.cwd, projectId, instanceId, operationId: recoveryOperation });
-  const bus = new Bus({ journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs) });
+  // Agents only: the console user and the hub itself are never limited (issue #38).
+  // A typo such as "12/min" would read as 0, which turns a limit off without a word: the project default instead.
+  for (const k of Object.keys(config.limits)) if (!(k in PROJECT_LIMITS)) log(`limits.${k} is not a known limit; ignored`);
+  const limits = Object.fromEntries(Object.entries(PROJECT_LIMITS).map(([k, fallback]) => {
+    const v = config.limits[k as keyof LimitsConfig];
+    if (typeof v === "number" && Number.isFinite(v) && v >= 0) return [k, v];
+    log(`limits.${k}: ${JSON.stringify(v)} is not a number of 0 or more; using ${fallback}`);
+    return [k, fallback];
+  })) as unknown as LimitsConfig;
+  const limiter = new Limiter(limits);
+  const admit = (env: Envelope, parent?: string): string | undefined => {
+    // [FYI] is recorded and costs nobody a turn: nothing to limit.
+    if (env.from === USER || env.from === HUB || env.from === DIGEST || env.priority === "fyi") return undefined;
+    const refused = limiter.admit(env.from, env.to, env.priority, env.body, parent);
+    if (refused) log(`limits: ${env.from}: ${refused}`);
+    return refused;
+  };
+  const bus = new Bus({ journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs), admit });
   startupCleanup.push(() => bus.closeJournal());
   const manualPaused = new Set<PeerId>(bus.manualPausedPeers()); // recovery never lifts an operator's pause
   let recoveryOperationId: string | undefined;
@@ -386,6 +409,7 @@ export async function startDaemon(opts: DaemonOptions) {
       }
     },
     triage: { classify: (title, detail) => inference?.triage(title, detail) ?? Promise.resolve(undefined), onCampus: () => onCampus() },
+    quota: (): ReturnType<Budget["headroom"]> => budget.headroom(), // budget is built below; this runs at assignment time
   });
   board.onChange = (t, h) => event({ type: "task", id: t.id, event: h.event, by: h.by, state: t.state, owner: t.owner, reviewer: t.reviewer, class: t.class, pii: tasks.isPii(t) });
   // ---- budget relay -------------------------------------------------------------------------------------------
@@ -423,9 +447,9 @@ export async function startDaemon(opts: DaemonOptions) {
     attached: (peer) => bus.peers.has(peer),
     // Somebody other than the paused peer has to be there, or the handoff would only leave its tasks without an owner.
     canHandOff: (peer) => [...bus.peers.keys()].some((id) => id !== peer && ["idle", "busy"].includes(bus.stateOf(id))),
-    handoff: (peer, context) => tasks.reassignForPause(peer, context),
     // A reading that arrived through a file carries the file's time; a stale one must not look fresh in the export.
     reading: (peer, windows, hard, at) => event({ type: "quota", peer, windows: windows.map((w) => ({ id: w.id, used: w.used, ...(w.resetsAt ? { resetsAt: w.resetsAt } : {}) })), hard, ...(Math.abs(Date.now() - at) > 1000 ? { measuredAt: new Date(at).toISOString() } : {}) }),
+    handoff: (peer, context, urgentOnly) => tasks.reassignForPause(peer, context, urgentOnly),
     resumed: (record) => {
       if (record.peer === "kimi") kimiTokens.length = 0; // a new window: the old counts would pause it again at once
       const moved = record.moved.length ? `While you were paused these moved: ${record.moved.map((m) => `${m.title} (${m.role} -> ${m.to ?? "nobody"})`).join("; ")}. They stay where they are; ask the user if you should take one back.` : "Nothing was moved while you were paused.";
@@ -519,7 +543,19 @@ export async function startDaemon(opts: DaemonOptions) {
   const toolEnv = (peer: PeerId) => ({ AGENTHUB_MODE: "tools", AGENTHUB_PEER_ID: peer, AGENTHUB_STATE_DIR: opts.stateDir, AGENTHUB_PROJECT_DIR: opts.cwd });
 
   /** One entry point for the task tools, whoever calls them: MCP clients, the local worker, the console. */
-  async function taskOp(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
+  // A task op can write the board across awaits (triage, briefs, the dependents an approval releases): a recovery
+  // commit waits for those in flight, or its integrity digest misses their later writes. Completion checks outlive
+  // their op, so recoveryReady() also waits for `tasks.checksPending()`: a check the commit's stop kills would write.
+  let taskOpsInFlight = 0;
+  const taskOp = async (...args: Parameters<typeof taskOpBody>): Promise<string> => {
+    taskOpsInFlight++;
+    try {
+      return await taskOpBody(...args);
+    } finally {
+      taskOpsInFlight--;
+    }
+  };
+  async function taskOpBody(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
     // Inside a PII turn the worker's words may carry the PII whatever they are attached to: a note would go to
     // claude-mem (a cloud observer) and a new task could be routed to a cloud peer without matching any pattern.
     if (piiTurn && (op === "hub_remember" || op === "hub_task_propose")) throw new Error(`${op} is not available while working on a PII task: its text must not leave this machine`);
@@ -563,7 +599,7 @@ export async function startDaemon(opts: DaemonOptions) {
         return "checkpoint received; you will be paused now and resumed when your window resets";
       }
       case "hub_task_list":
-        return JSON.stringify(board.list(a.state).map((t) => (onPrem ? t : tasks.publicView(t))).map(({ history: _h, ...t }) => t));
+        return JSON.stringify(board.list(a.ready === true ? "proposed" : a.state).filter((t) => a.ready !== true || !tasks.waitsFor(t).length).map((t) => (onPrem ? t : tasks.publicView(t))).map(({ history: _h, ...t }) => t));
     }
     if (by !== USER) throw new Error(`${op} is a console command`);
     switch (op) {
@@ -614,9 +650,9 @@ export async function startDaemon(opts: DaemonOptions) {
     const r = budget.record(id); // one read per peer: status.json is rewritten on every bus event
     return r ? { paused: `budget: ${r.reason}, resets ${new Date(r.resetsAt).toLocaleTimeString()}` } : manualPaused.has(id) && bus.stateOf(id) === "offline" ? { paused: "manual" } : {};
   };
-  let releasing = false; // gone-owner release (#6): one run at a time, and a recovery commit waits for it
+  let releasing = false; // gone-owner release (#6) and the ready sweep (#34): one run at a time, and a recovery commit waits for it
   const recoveryReady = () => {
-    if (!recoveryActive() || releasing || (piReceipts?.inFlight ?? 0) !== 0 || permissions.size !== 0 || starting.size !== 0 || !budget.recoverySettled || [...bus.peers.values()].some((peer) => peer.state === "busy" || (peer instanceof PiPeer && !peer.recoveryReady))) return false;
+    if (!recoveryActive() || releasing || taskOpsInFlight !== 0 || tasks.checksPending() !== 0 || (piReceipts?.inFlight ?? 0) !== 0 || permissions.size !== 0 || starting.size !== 0 || !budget.recoverySettled || [...bus.peers.values()].some((peer) => peer.state === "busy" || (peer instanceof PiPeer && !peer.recoveryReady))) return false;
     if (!recoveryPeerSnapshot) return true;
     const current = recoveryPeers();
     return recoveryPeerSnapshot.every((saved) => {
@@ -673,21 +709,30 @@ export async function startDaemon(opts: DaemonOptions) {
     return [id, row];
   }));
   const digest = (value: unknown) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
-  // `prePlan`: the board as a hub from before the plan column (#31, 0.8.0) digested it. An empty plan is left out, so an
-  // upgrade from such a hub still verifies the board it was handed; a real plan never matches that shape.
-  const integrity = (prePlan = false) => {
+  // Task columns added since a source may have recorded its digest, newest first, with their empty values. A hub from
+  // before them digested its rows without them (0.8.x: no deps, #34; 0.7.x: no plan either, #31). `older` leaves out
+  // the newest `older` of them while they are empty, so an upgrade from such a hub verifies the board it was handed; a
+  // filled one stays in the row and never matches.
+  const ADDED_COLUMNS = [["deps", "[]"], ["plan", "{}"]] as const;
+  const integrity = (older = 0) => {
     const queues = Object.fromEntries(Object.keys(bus.snapshot().queues).sort().map((id) => [id, bus.queueIds(id)]));
-    const tasks = board.list().sort((a, b) => a.id - b.id);
-    const boardState = prePlan ? tasks.map(({ plan, ...t }) => (plan && Object.keys(plan).length ? { ...t, plan } : t)) : tasks;
+    const boardState = board.list().sort((a, b) => a.id - b.id).map((t) => {
+      const row: Record<string, unknown> = { ...t };
+      for (const [col, empty] of ADDED_COLUMNS.slice(0, older)) if (JSON.stringify(row[col]) === empty) delete row[col];
+      return row;
+    });
     const budgetState = budget.persistedPauseDigestRows().sort((a, b) => a.peer.localeCompare(b.peer));
     return { queues, manualPaused: [...manualPaused].sort(), boardDigest: digest(boardState), budgetDigest: digest(budgetState) };
   };
-  /** The integrity in the shape `expected` was recorded in: the current one unless only the pre-plan shape matches. */
+  /** The integrity in the shape `expected` was recorded in: the current one unless only an older shape matches. */
   const integrityAs = (expected: unknown) => {
     const now = integrity();
     if (!expected || JSON.stringify(expected) === JSON.stringify(now)) return now;
-    const old = integrity(true);
-    return JSON.stringify(expected) === JSON.stringify(old) ? old : now;
+    for (let older = 1; older <= ADDED_COLUMNS.length; older++) {
+      const then = integrity(older);
+      if (JSON.stringify(expected) === JSON.stringify(then)) return then;
+    }
+    return now;
   };
   const status = () => ({
     projectId,
@@ -726,10 +771,11 @@ export async function startDaemon(opts: DaemonOptions) {
   const hubStartedAt = Date.now();
   const releaseGoneOwners = async () => {
     const limit = config.tasks.release_after_min;
-    if (!(limit > 0) || releasing || stopping || recoveryActive()) return;
+    if (releasing || stopping || recoveryActive()) return;
     releasing = true;
     try {
-      await releaseOwners(limit);
+      await tasks.releaseReady(); // #34: dependents a stop cut off between an approval and their assignment
+      if (limit > 0) await releaseOwners(limit);
     } finally {
       releasing = false;
     }
@@ -749,6 +795,44 @@ export async function startDaemon(opts: DaemonOptions) {
   releaseTimer.unref?.();
   intervals.push(releaseTimer);
 
+  // Early conflict detection (issue #32): the files a turn changed, against what other owners' open tasks changed
+  // before it. Warns both owners once per file and task; never blocks a write.
+  const conflictSeen = new Set<string>();
+  const detectConflicts = (peer: PeerId, turnId: string, since: number, changed: string[]) => {
+    const open = board.list().filter((t) => t.owner && ["proposed", "in_progress", "changes_requested"].includes(t.state));
+    const mine = open.filter((t) => t.owner === peer && t.state === "in_progress");
+    if (mine.some((t) => tasks.isPii(t))) return; // a PII turn's files are nobody else's business
+    const visible = open.filter((t) => !tasks.isPii(t));
+    const found = conflictsOf(peer, changed, turnLog!.touchesFor(visible.map((t) => t.id)), visible);
+    // A turn's diff holds whatever changed while it ran. Only what no overlapping turn of another peer changed is
+    // recorded as this peer's; while such a turn's changes are unknown (still running, say), nothing is (review of #49).
+    const record = turnLog!.get(turnId);
+    const overlap = record ? turnLog!.overlapping(record, Math.max(1, Number(config.snapshots.keep) || 20)) : { paths: [], unknown: [] };
+    if (!overlap.unknown.length) {
+      const theirs = new Set(overlap.paths);
+      const own = changed.filter((p) => !theirs.has(p));
+      for (const t of mine) turnLog!.touch(t.id, peer, own);
+    }
+    if (!found.length) return;
+    const others = turnLog!.busySince(peer, since);
+    const concurrent = others.length ? ` Concurrent: ${others.join(", ")} also worked during that turn, so some of these changes may be theirs.` : "";
+    const ours = mine.length ? ` (task ${mine.map((t) => `#${t.id}`).join(", ")})` : "";
+    for (const { task, paths: all } of found) {
+      const paths = all.filter((p) => !conflictSeen.has(`${peer}\0${task.id}\0${p}`));
+      if (!paths.length) continue;
+      for (const p of paths) conflictSeen.add(`${peer}\0${task.id}\0${p}`);
+      const owner = task.owner!;
+      // As with overlaps (#31): a file name that matches a PII pattern is never named to peers, the log or telemetry.
+      const named = paths.filter(tasks.nameable);
+      const hidden = paths.length - named.length;
+      const files = [...named, ...(hidden ? [`${hidden} file(s) whose names are withheld (they match a PII pattern)`] : [])].join(", ");
+      notify(`conflict: ${peer}${ours} changed ${files}, which #${task.id} (owner ${owner}) changed before${others.length ? ` (concurrent: ${others.join(", ")})` : ""}`);
+      event({ type: "conflict", peer, ...(mine[0] ? { task: mine[0].id } : {}), other: task.id, owner, paths: named, concurrent: others.length > 0 });
+      bus.publish(newEnvelope(HUB, `Your last turn${ours} changed ${files}, which ${owner}'s open task (${tasks.publicTitle(task)}) changed before it. Check that you did not overwrite that work, and settle it with ${owner} via hub_send.${concurrent}`, { to: [peer], kind: "task", ...(mine[0] ? { refs: { task: String(mine[0].id) } } : {}) }));
+      if (owner !== USER && owner !== HUB) bus.publish(newEnvelope(HUB, `${peer}'s last turn${ours} changed ${files}, which your open task #${task.id} changed before it. Check that your work there is intact.${concurrent}`, { to: [owner], kind: "task", refs: { task: String(task.id) } }));
+    }
+  };
+
   bus.tap((e) => {
     e = redact(e);
     uiEvents.push({ seq: ++uiSequence, event: e });
@@ -770,6 +854,7 @@ export async function startDaemon(opts: DaemonOptions) {
         event({ type: "turn_start", peer: e.peer, turn: id });
       } else if (!busy && open) {
         turns.delete(e.peer);
+        let afterTurn: (() => void) | undefined;
         let files: number | undefined;
         let snapshotMs = open.snapshotMs;
         if (turnLog && (open.private || holdsPii(e.peer))) {
@@ -780,8 +865,11 @@ export async function startDaemon(opts: DaemonOptions) {
           if (open.tree && end.tree) files = changed.length; // unknown, not zero, when a snapshot failed
           snapshotMs = (snapshotMs ?? 0) + end.ms;
           try { turnLog.end(open.id, end.tree, changed, Math.max(1, Number(config.snapshots.keep) || 20)); } catch (error) { log(`turn record ${open.id}: ${(error as Error).message}`); }
+          // After the turn_end event: a notice delivered at once starts the peer's next turn, which must come after it.
+          if (changed.length) afterTurn = () => detectConflicts(e.peer, open.id, open.start, changed);
         }
         event({ type: "turn_end", peer: e.peer, turn: open.id, ms: Date.now() - open.start, ...(open.tokens ? { tokens: open.tokens } : {}), ...(files !== undefined ? { files, snapshotMs } : {}) });
+        try { afterTurn?.(); } catch (error) { log(`conflict check after ${open.id}: ${(error as Error).message}`); }
       }
       if (e.state === "offline") offlineSince.set(e.peer, offlineSince.get(e.peer) ?? Date.now());
       else offlineSince.delete(e.peer);
@@ -998,7 +1086,8 @@ export async function startDaemon(opts: DaemonOptions) {
         permit: (title) => onPermission({ peer: "pi", title, options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }).then((picked) => picked === "allow" && pi.acceptingTools && bus.peers.get("pi") === pi),
         send: (text, to) => {
           if (to?.some((id) => !bus.peers.has(id) && id !== USER)) return "error: unknown peer";
-          pi.onMessage?.(text, { inReplyTo: piReply, ...(to?.length ? { to } : {}) }); return "sent";
+          const refused = pi.onMessage?.(text, { inReplyTo: piReply, ...(to?.length ? { to } : {}) });
+          return typeof refused === "string" ? `not sent: ${refused}` : "sent";
         },
       };
       const routing = currentRouting(opts.cwd, log);
@@ -1270,7 +1359,7 @@ export async function startDaemon(opts: DaemonOptions) {
       return { t: "recovery", ok: true, aborted: true, recovery: recoveryView() };
     }
     if (msg.op === "commit") {
-      if ((recoveryPhase !== "prepared" && recoveryPhase !== "preparing") || !recoveryReady()) return recoveryError("recovery is not ready; inspect until peers are idle and approvals are complete");
+      if ((recoveryPhase !== "prepared" && recoveryPhase !== "preparing") || !recoveryReady()) return recoveryError("recovery is not ready; inspect until peers are idle, approvals are complete and completion checks have finished");
       recoveryPhase = "prepared";
       recoveryPeerSnapshot ??= Object.values(recoveryPeers());
       const currentPeers = recoveryPeers();
@@ -1395,11 +1484,15 @@ export async function startDaemon(opts: DaemonOptions) {
         // A human at the console should not wait out the batch window; agents default to status.
         const { priority, body } = parseMarker(String(msg.body ?? ""), c.peer ? "status" : "important");
         if (!body) return void reply({ t: "sent", ok: false, error: "empty body" });
-        const to: PeerId[] | undefined = Array.isArray(msg.to) && msg.to.length ? msg.to.map(String) : undefined;
+        const to: PeerId[] | undefined = Array.isArray(msg.to) && msg.to.length ? [...new Set<string>(msg.to.map(String))] : undefined;
         const unknown = to?.filter((id) => !bus.knownPeers().includes(id)) ?? [];
         if (unknown.length) return void reply({ t: "sent", ok: false, error: `unknown peer: ${unknown.join(", ")}` });
         const inReplyTo = msg.reply_to ? bus.get(String(msg.reply_to)) : undefined;
-        const targets = bus.publish(newEnvelope(c.peer ?? USER, body, { priority, ...(to ? { to } : {}), ...(inReplyTo ? { inReplyTo } : {}) }));
+        // Built first: limits count the audience it really has (a reply goes to the parent's sender).
+        const env = newEnvelope(c.peer ?? USER, body, { priority, ...(to ? { to } : {}), ...(inReplyTo ? { inReplyTo } : {}) });
+        const refused = c.peer ? admit(env, inReplyTo?.id) : undefined;
+        if (refused) return void reply({ t: "sent", ok: false, error: refused });
+        const targets = bus.publish(env);
         if (c.peer && inReplyTo) bus.completeReply(c.peer, inReplyTo.id);
         return void reply({ t: "sent", ok: true, targets, recorded: priority === "fyi" });
       }

package/src/hub/events.ts

@@ -16,6 +16,7 @@ export type HubEvent =
   | { type: "tokens"; peer: string; n: number }
   | { type: "task"; id: number; event: string; by: string; state: string; owner: string | null; reviewer: string | null; class: string; pii: boolean }
   | { type: "overlap"; task: number; owner: string; others: { task: number; owner: string; paths: string[]; symbols?: string[] }[] }
+  | { type: "conflict"; peer: string; task?: number; other: number; owner: string; paths: string[]; concurrent: boolean }
   | { type: "quota"; peer: string; windows: { id: string; used: number; resetsAt?: number }[]; hard: boolean; measuredAt?: string };
 
 export type StampedEvent = HubEvent & { v: number; at: string };