@anhlp/alp-runtime 0.0.1-beta.3 → 0.0.1-beta.4

package/src/runtime.ts

@@ -1,11 +1,15 @@
+import { createAssignmentResults } from './assignment-results.js';
 import { constants as fsConstants } from 'node:fs';
 import type { Session, Assignment, Waiter } from './session-state.js';
 import { errorData, plainObject, toolResult } from './tool-results.js';
 import { createLogger } from '@anhlp/alp-core/log';
 import { PROMPT_IMAGES, base64Bytes } from '@anhlp/alp-protocol';
 import { createBoardDomain } from './board-domain.js';
+import { ATTACHMENT_ROUTES, STAGED_PATH, attachmentPart, createAttachmentStager, runtimeAttachment, stagingExposure, type AttachmentReader, type AttachmentRoute } from './attachments.js';
+import type { RuntimeAttachment } from '@anhlp/alp-protocol/session';
 import { createWorktreeDomain } from './worktree-domain.js';
-import { type RuntimeTransport, type RuntimeOptions, type OpenOptions, type PromptContent, type PromptInput, type AlpRuntime, type SessionPreview, type RecoveryOutcome, type Pause, type PauseState, type RecallAnswer } from './contracts.js';
+import { type RuntimeTransport, type RuntimeOptions, type OpenOptions, type PromptContent, type PromptInput, type AlpRuntime, type SessionPreview, type RecoveryOutcome, type Pause, type PauseState, type RecallAnswer, type ScheduleHandler, type BranchRequest, type NativeBinding, type ConfigurePreview, type ConfigureResult, type ConversationErrorReason, ConversationError } from './contracts.js';
+import { claudeCut, codexForkEnd, codexForkRefusal, pendingChain, type ChainEntry } from './conversation.js';
 export type { RuntimeTransport, RuntimeOptions, OpenOptions, PromptContent, PromptInput, AlpRuntime, SessionPreview, RecoveryOutcome, Pause, PauseState, RecallAnswer } from './contracts.js';
 export { DEFAULT_TEAM } from './contracts.js';
 import { verdictLine, parseHandoff, type Handoff } from './handoff.js';
@@ -27,10 +31,11 @@ import { models, modes, thinkingOptionsFor, withinMode, writes } from './catalog
 import { runHook } from '@anhlp/alp-core/hook-run';
 import { hookMatches } from '@anhlp/alp-core/hooks';
 import { isTrusted, trustProject } from '@anhlp/alp-core/trust';
-import { listTeams } from '@anhlp/alp-core/teams';
+import { listTeams, teamOf } from '@anhlp/alp-core/teams';
+import { CONFIGURABLE, changesOf, effectiveOf, executablesOf, nativeModelOf, offered, type ConfigureChange, type ConfigureChanges, type EffectiveConfig } from './configure.js';
 import { anyModel, offers, profileModel, selectedProfile } from '@anhlp/alp-core/profiles';
 import { LESSONS_FILE, READ_ONLY_AGENTS, resolveSession, type ResolvedSession, type RuntimeKind, type SessionSpec } from './resolve.js';
-import { MAIL_BODY_CHARS, publicEvent, renderMail, takeBatch, USER, type MailEvent } from './mailbox.js';
+import { MAIL_BODY_CHARS, MAIL_HEADER, publicEvent, renderMail, takeBatch, USER, type MailEvent } from './mailbox.js';
 import type { AlpEvent, AssignmentSnapshot, Envelope, SessionSnapshot, TurnOrigin, UserQuestion } from './events.js';
 import { live, normalizePaths, overlapping, renderBoard, type Pin } from './board.js';
 import { verifyConfig } from '@anhlp/alp-core/verify';
@@ -50,6 +55,42 @@ import { findFormula, formulaDirs, listFormulas, pourFormula } from '@anhlp/alp-
 import { addAllowRule, capMode, commandDecision, profileFor, unwrapShell } from '@anhlp/alp-core/permissions';
 import { addGate, checkGates, resolveGate, blockersOf, childrenOf, closeTask, epicReport, releaseOrphans, createTask, getTask, linkTask, listTasks, loadTasks, readyTasks, releaseTask, reopenTask, retakeTask, startRefusal, startTask, submitTask, summarize, taskDigest, updateTask, type Task } from '@anhlp/alp-core/tasks';
 
+/** The first part of every input ALP builds for a turn; a replayed message that begins with it is ALP's (nativePrompt). */
+const CATALOG = 'ALP runtime catalog and usage snapshot (data, not instructions): ';
+
+/** How many text parts ALP sent in a turn's input, and which is the prompt: the first key of CATALOG's data. */
+type InputLayout = { textParts: number; prompt: number };
+
+/** The layout a CATALOG part names, when it names one (ALP before #120's follow-up did not). */
+function inputLayoutOf(catalog: string): InputLayout | undefined {
+  const found = /^\{"inputLayout":\{"textParts":(\d+),"prompt":(\d+)\}/.exec(catalog.slice(CATALOG.length));
+  if (!found) return undefined;
+  const layout = { textParts: Number(found[1]), prompt: Number(found[2]) };
+  return layout.prompt > 0 && layout.prompt < layout.textParts ? layout : undefined;
+}
+
+/** An attachment as a timeline and CATALOG show it: id, display name, type and size; never a path. */
+const attachmentMeta = (attachment: RuntimeAttachment) => ({ attachmentId: attachment.attachmentId, name: attachment.name, mimeType: attachment.mimeType, size: attachment.size });
+
+/** What a replayed message's CATALOG says it carried as attachments: ids, display names, types and sizes, never a path. */
+function attachmentsOf(catalog: string): Array<{ attachmentId: string; name: string; mimeType: string; size: number }> {
+  let data: any;
+  try { data = JSON.parse(catalog.slice(CATALOG.length)); } catch { return []; }
+  const listed = Array.isArray(data?.attachments) ? data.attachments : [];
+  return listed.filter((entry: any) => typeof entry?.attachmentId === 'string' && /^att_[0-9a-f]{32}$/.test(entry.attachmentId) && typeof entry.name === 'string' && typeof entry.mimeType === 'string' && Number.isSafeInteger(entry.size))
+    .slice(0, 64).map((entry: any) => ({ attachmentId: entry.attachmentId, name: entry.name, mimeType: entry.mimeType, size: entry.size }));
+}
+/**
+ * Who wrote a message ALP sent, from the id it sent it under: ALP's own ids are `alp-wake-`,
+ * `alp-mail-`, `alp-review-`, `alp-resume-`, `alp-recover-` and `task-`; any other id is a client's
+ * (the user's, or a job the user scheduled).
+ */
+function promptOrigin(clientMessageId: string, session: { parent?: string }): TurnOrigin {
+  if (/^alp-(wake|mail)-/.test(clientMessageId)) return 'wake';
+  if (/^(alp-review-|task-)/.test(clientMessageId)) return 'assignment';
+  if (/^alp-(resume|recover)-/.test(clientMessageId)) return session.parent ? 'assignment' : 'wake';
+  return 'user';
+}
 const MAX_WAKES = 8;
 /** How long the user may wait for main's first words before its tool results remind it. */
 const USER_REPLY_MS = 60_000;
@@ -119,8 +160,20 @@ const isolationOf = (args: { isolation?: string }) => args.isolation ?? 'shared'
 
 const log = createLogger({ component: 'runtime' });
 
+export type WorkspaceMutationReason = 'workspace_busy' | 'workspace_claimed' | 'workspace_leased' | 'workspace_assignment_result';
+export class WorkspaceMutationError extends Error {
+  readonly data: { reason: WorkspaceMutationReason };
+  constructor(reason: WorkspaceMutationReason, message: string) {
+    super(message);
+    this.name = 'WorkspaceMutationError';
+    this.data = { reason };
+  }
+}
+
 export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
   const sessions = new Map<string, Session>();
+  /** Queue slots preparing a scheduled prompt, before its native turn/start. */
+  const admittedPrompts = new Set<string>();
   /** What ALP writes for the user of a session, in their language (ALPD §54). */
   const wordsFor = (session: Session) => words(session.mapping.language);
 
@@ -142,6 +195,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
   const epoch = randomUUID();
   /** Finished assignments whose native threads alp_recall can question. */
   const recalls = createRecallBook(options.recallFile);
+  const assignmentResults = createAssignmentResults(options.assignmentResultFile);
   /** Running assignments, so the next alpd continues them (ALPD §31). */
   const inFlight = createLiveBook(options.liveFile);
   /** Those an earlier alpd left running; recover() takes them once their root is open again. */
@@ -165,12 +219,35 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
   const leases = new Map<string, { assignment: string; agent: string }>();
   const worktreeRoot = options.worktreeDir ?? path.join(os.tmpdir(), 'alp-worktrees');
   const copyRoot = options.copyDir ?? path.join(os.tmpdir(), 'alp-copies');
+  /** Non-image attachments (§12.6): staged copies when alpd gave a directory, read from alpd's reader once it binds one. */
+  const stager = options.attachmentStageDir ? createAttachmentStager(options.attachmentStageDir) : undefined;
+  let attachmentReader: AttachmentReader | undefined;
+  /** Sessions already warned that the staging directory is inside their workspace. */
+  const stagingWarned = new Set<string>();
+  if (stager) void stager.sweep();
   const sequences = new Map<string, number>();
 
+  let workspaceMutation = false;
+  let admitting = 0;
+  const refuseMutation = (reason: WorkspaceMutationReason, message: string): never => { throw new WorkspaceMutationError(reason, message); };
+  // Admission registers synchronously, before resolving configuration or creating copies.
+  async function admission<T>(run: () => Promise<T>): Promise<T> {
+    if (workspaceMutation) refuseMutation('workspace_busy', 'A workspace mutation is in progress; retry after it finishes');
+    admitting++;
+    try { return await run(); } finally { admitting--; }
+  }
   let closed = false;
   let queue = Promise.resolve();
 
   const emit = (sessionId: string, event: AlpEvent) => {
+    // The staging directory never reaches a timeline: a tool's command or output, or a reply, that names
+    // a staged copy shows it under STAGED_PATH (§12.6). Clients know attachments by id and name.
+    if (stager) {
+      const json = JSON.stringify(event);
+      const named = stager.spellings().map(root => JSON.stringify(root).slice(1, -1)).filter(root => json.includes(root));
+      // The directory itself, not a longer name that starts like it (`staged-old`, `staged.bak`); a period ending a sentence is not a name.
+      if (named.length) event = JSON.parse(named.reduce((text, root) => text.replace(new RegExp(`${root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9_-]|\\.[A-Za-z0-9_-])`, 'g'), STAGED_PATH), json));
+    }
     const seq = (sequences.get(sessionId) ?? 0) + 1;
     sequences.set(sessionId, seq);
     const envelope: Envelope = { sessionId, epoch, seq, ts: new Date().toISOString(), event };
@@ -192,6 +269,11 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     return session.runtime.takesImages ? session.runtime.takesImages() : session.runtimeKind === 'codex' || session.runtimeKind === 'claude';
   }
 
+  /** How the session's runtime can use attached files (the capability matrix of §12.6); none without alpd's reader and a staging directory. */
+  function attachmentRoutes(session: Session): readonly AttachmentRoute[] {
+    return stager && attachmentReader ? ATTACHMENT_ROUTES[session.runtimeKind] ?? [] : [];
+  }
+
   function snapshot(sessionId: string, session: Session): SessionSnapshot {
     return {
       id: sessionId,
@@ -212,6 +294,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       ...((session.parked?.reason ?? session.parkReason) ? { parked: session.parked?.reason ?? session.parkReason } : {}),
       ...(session.instructionsSha ? { instructionsSha: session.instructionsSha } : {}),
       ...(takesImages(session) ? { promptImages: true } : {}),
+      ...(attachmentRoutes(session).length ? { promptAttachments: [...attachmentRoutes(session)] } : {}),
       ...(session.usage ? { usage: session.usage } : {}),
       busy: !!(session.active || session.pending || session.parked || session.parkReason || session.children.size || session.assignments.size || hasActiveMail(session) || reviewing(session)),
     };
@@ -271,6 +354,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       return;
     }
     session.parkReason = undefined;
+    session.parkPause = undefined;
 
     // A requester is not done while its assignments run or mail awaits it.
     if (state === 'completed' && (session.assignments.size || hasActiveMail(session))) {
@@ -281,6 +365,33 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     session.settle?.(state, error);
   }
 
+  /**
+   * A native user message as ALP sent it: Codex keeps the clientUserMessageId ALP gave it as
+   * `clientId`, and the parts of the input startPrompt built (CATALOG first, then the task digest,
+   * an interrupted turn's words, the prompt, its images and mail). The message is the prompt part
+   * alone, and its origin comes from its id: ALP's own (mail, briefs, resumes) never title a root.
+   * A message ALP sent without an id (an older Codex) has no origin anyone can trust; one ALP did not
+   * build (a thread started outside ALP) is the user's.
+   */
+  function nativePrompt(item: any, session: Session): { text: string; clientMessageId?: string; origin?: TurnOrigin; attachments?: ReturnType<typeof attachmentsOf> } {
+    const parts: string[] = (item.content ?? []).filter((c: any) => c.type === 'text').map((c: any) => String(c.text ?? ''));
+    const clientMessageId = typeof item.clientId === 'string' && item.clientId ? item.clientId : undefined;
+    // Mail steered into a running turn is sent alone, without CATALOG.
+    if (!parts[0]?.startsWith(CATALOG)) return { text: parts.join('\n'), ...(clientMessageId ? { clientMessageId } : {}), origin: clientMessageId ? promptOrigin(clientMessageId, session) : parts[0]?.startsWith(MAIL_HEADER) ? 'wake' : 'user' };
+    const origin = clientMessageId ? promptOrigin(clientMessageId, session) : undefined;
+    const ids = { ...(clientMessageId ? { clientMessageId } : {}), ...(origin ? { origin } : {}) };
+    const layout = inputLayoutOf(parts[0]);
+    const attached = attachmentsOf(parts[0]);
+    // The prompt where CATALOG says it is. Every other part ALP sends has words, so a part missing
+    // is an empty prompt (an image alone) the runtime left out: its text is none, never a neighbour's.
+    if (layout) return { text: parts.length === layout.textParts ? parts[layout.prompt] ?? '' : '', ...ids, ...(attached.length ? { attachments: attached } : {}) };
+    // A message from before CATALOG named its layout: read by what its parts begin with.
+    const rest = parts.slice(1);
+    // Mail delivered with a prompt follows it; a mail wake's prompt is mail itself, after the task digest.
+    if (!clientMessageId?.startsWith('alp-wake-') && rest.length > 1 && rest.at(-1)!.startsWith(MAIL_HEADER)) rest.pop();
+    return { text: rest.at(-1) ?? '', ...ids };
+  }
+
   function nativeItem(
     sessionId: string,
     session: Session,
@@ -299,12 +410,9 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     }
 
     if (item.type === 'userMessage') {
-      const text = (item.content ?? [])
-        .filter((c: any) => c.type === 'text')
-        .map((c: any) => c.text)
-        .join('\n');
+      const { text, clientMessageId, origin, attachments } = nativePrompt(item, session);
       const images = (item.content ?? []).filter((c: any) => c.type === 'image' || c.type === 'localImage').length;
-      emit(sessionId, { type: 'item', item: { kind: 'user_message', id: item.id, text, ...(images ? { images } : {}) } });
+      emit(sessionId, { type: 'item', item: { kind: 'user_message', id: item.id, text, ...(clientMessageId ? { clientMessageId } : {}), ...(origin ? { origin } : {}), ...(images ? { images } : {}), ...(attachments ? { attachments } : {}) } });
       return;
     }
 
@@ -390,6 +498,11 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     params: any,
   ) {
     if (session.closed) return;
+    // What the runtime says it runs with; the run log keeps it beside the configured model (§12.9).
+    if (method === 'alp/nativeModel') {
+      if (typeof params?.model === 'string') runLog(rootOf(sessionId), { event: 'session.native_model', sessionId, agent: session.mapping.agent.name, configured: session.mapping.model, model: params.model.slice(0, 200) });
+      return;
+    }
 
     touch(sessionId, session);
 
@@ -468,7 +581,10 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
 
       // A usage limit pauses its runtime; an assignment it stopped is parked to continue later.
       if (state === 'failed' && LIMIT_ERRORS.includes(params.turn.error?.codexErrorInfo)) {
-        if (session.role !== 'supervisor') session.parkReason = `the ${label(session.runtimeKind)} usage limit was reached`;
+        if (session.role !== 'supervisor') {
+          session.parkReason = `the ${label(session.runtimeKind)} usage limit was reached`;
+          session.parkPause = { scope: paused.all ? 'all' : session.runtimeKind };
+        }
         void limitReached(session, params.turn.error);
       }
 
@@ -481,43 +597,63 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     }
   }
 
-  async function closeSession(sessionId: string) {
-    const session = sessions.get(sessionId);
-    if (!session || session.closed) return;
+  // Failure callbacks and an opening call's catch can both retire the same record.
+  // Keep the cleanup with that incarnation, even after its id has been reused.
+  const sessionClosures = new WeakMap<Session, Promise<void>>();
+  const openedSessions = new WeakSet<Session>();
+  const assignmentSessions = new WeakMap<Assignment, Session>();
+  function closeSession(sessionId: string, session = sessions.get(sessionId), notify = true): Promise<void> {
+    if (!session) return Promise.resolve();
+    const closing = sessionClosures.get(session);
+    if (closing) return closing;
+    if (session.closed) return Promise.resolve();
 
     session.closed = true;
-    cancelQuestions(sessionId);
-    approvalLedger.delete(sessionId);
-    releaseClaims(sessionId, session.mapping.agent.projectRoot);
-
-    await Promise.all(
-      [...session.children, ...(session.supervisor ? [session.supervisor] : [])].map(closeSession),
-    );
-
-    terminal(sessionId, session, 'canceled');
-    session.settle?.('canceled', 'Session closed');
-
-    await session.runtime.close();
-
-    // Copies of assignments that did not finish hold nothing to keep.
-    for (const assignment of session.assignments.values()) if (assignment.copy && !assignment.finished) await removeCopy(assignment.copy).catch(() => {});
-
-    for (const [assignmentId, { worktree }] of session.worktrees) {
-      await removeWorktree(worktree).catch(() => {});
-      runLog(rootOf(sessionId), { event: 'worktree.kept', assignmentId, branch: worktree.branch });
+    const current = sessions.get(sessionId) === session;
+    const opened = openedSessions.has(session);
+    const parent = session.parent ? sessions.get(session.parent) : undefined;
+    const descendants = current ? [...session.children, ...(session.supervisor ? [session.supervisor] : [])]
+      .map(id => [id, sessions.get(id)] as const).filter((entry): entry is readonly [string, Session] => !!entry[1]) : [];
+    if (current) {
+      cancelQuestions(sessionId);
+      approvalLedger.delete(sessionId);
+      releaseClaims(sessionId, session.mapping.agent.projectRoot);
+      // terminal also touches questions and parent bookkeeping by id. Do it before
+      // yielding, while this is still the record registered under that id.
+      terminal(sessionId, session, 'canceled');
+      session.settle?.('canceled', 'Session closed');
     }
-    session.worktrees.clear();
 
-    sessions.delete(sessionId);
+    const cleanup = (async () => {
+      await Promise.all(
+        descendants.map(([id, child]) => closeSession(id, child)),
+      );
+      await session.runtime.close();
+
+      // Copies of assignments that did not finish hold nothing to keep.
+      for (const assignment of session.assignments.values()) if (assignment.copy && !assignment.finished) await removeCopy(assignment.copy).catch(() => {});
 
-    if (session.parent) {
-      const parent = sessions.get(session.parent);
-      parent?.children.delete(sessionId);
-      if (parent?.supervisor === sessionId) parent.supervisor = undefined;
-    }
+      for (const [assignmentId, { worktree }] of session.worktrees) {
+        await removeWorktree(worktree).catch(() => {});
+        runLog(rootOf(sessionId), { event: 'worktree.kept', assignmentId, branch: worktree.branch });
+      }
+      session.worktrees.clear();
+
+      // Every id-based side effect belongs to this incarnation, including the
+      // parent's membership and the event that tells viewers it is no longer live.
+      if (sessions.get(sessionId) !== session) return;
+      sessions.delete(sessionId);
+      if (session.parent && parent && sessions.get(session.parent) === parent) {
+        parent.children.delete(sessionId);
+        if (parent.supervisor === sessionId) parent.supervisor = undefined;
+      }
 
-    // Kept: a session resumed in this runtime goes on from its last seq, so (epoch, seq) never repeats.
-    emit(sessionId, { type: 'session.closed' });
+      // An opening failure has no live incarnation to close. Its failure callback
+      // reports session.failed; an ordinary startup rejection is the open error.
+      if (notify && opened) emit(sessionId, { type: 'session.closed' });
+    })();
+    sessionClosures.set(session, cleanup);
+    return cleanup;
   }
 
   let runLogWrites = Promise.resolve();
@@ -1101,7 +1237,27 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
   const label = (kind: RuntimeKind) => kind === 'claude' ? 'Claude' : kind === 'acp' ? 'ACP agent' : kind === 'antigravity' ? 'Antigravity' : 'Codex';
   const pauseOf = (kind: RuntimeKind) => paused.all ?? paused.runtimes[kind];
   /** Whether a session may not start a turn by itself now: parked, or on a paused runtime. */
-  const held = (session: Session) => !!session.parked || !!pauseOf(session.runtimeKind);
+  const held = (session: Session) => !!session.parked || !!pauseOf(session.runtimeKind) || (session.lifecycleHolds ?? 0) > 0;
+  /** Whether mail may not wake a session now: it is held, or it is a new assignment whose brief has not started. */
+  const holdsWake = (session: Session) => held(session) || !!session.awaitingBrief;
+
+  /**
+   * Marks a session pending (its native process restarting) with a fresh `acknowledged` that resolves
+   * when the returned function clears it. Mail delivered meanwhile waits on that promise; with the old,
+   * already resolved one it would retry in a microtask loop and stall the process.
+   */
+  function beginPending(session: Session) {
+    let done!: () => void;
+    session.pending = true;
+    session.acknowledged = new Promise<void>(resolve => { done = resolve; });
+    let cleared = false;
+    return () => {
+      if (cleared) return;
+      cleared = true;
+      session.pending = false;
+      done();
+    };
+  }
   const describePause = (pause: Pause, kind?: RuntimeKind) =>
     `${kind ? label(kind) : 'ALP'} is paused (${pause.reason}${pause.by !== 'alpd' ? `, by ${pause.by}` : ''})${pause.resetsAt ? `; the limit resets ${pause.resetsAt}` : ''}`;
 
@@ -1220,7 +1376,10 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     if (now) {
       for (const [id, session] of sessions) {
         if (!session.parent || session.closed || !session.active || session.role === 'supervisor' || (scope !== 'all' && session.runtimeKind !== scope)) continue;
+        // A process restart already owns its continuation; this pause must not replace its cause.
+        if (session.parkReason && !session.parkPause) continue;
         session.parkReason = `paused by ${pause.by}`;
+        session.parkPause = { scope };
         void session.runtime.request('turn/interrupt', { threadId: session.threadId, turnId: session.active }).catch(() => {});
         runLog(rootOf(id), { event: 'assignment.parking', assignmentId: id, agent: session.mapping.agent.name, reason: session.parkReason });
       }
@@ -1232,22 +1391,30 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     else delete paused.runtimes[scope];
     savePauses();
     watchLimits();
+    const matches = (pause: Session['parkPause']) => pause && (scope === 'all' || pause.scope === scope);
+    const continuing = [...sessions.values()].some(session => !session.closed && !pauseOf(session.runtimeKind) && matches(session.parked?.pause));
     const free = RUNTIMES.filter(kind => !pauseOf(kind));
-    if (free.length) notice('info', say => say.resumed(scope === 'all' ? 'ALP' : label(scope), by, pauseState().parked.length > 0));
+    if (free.length) notice('info', say => say.resumed(scope === 'all' ? 'ALP' : label(scope), by, continuing));
     for (const [id, session] of sessions) {
-      if (session.closed || pauseOf(session.runtimeKind)) continue;
-      if (session.parked) continueParked(id, session);
-      else if (session.wakeHeld) { session.wakeHeld = false; deliver(id, session); }
+      if (session.closed || (scope !== 'all' && session.runtimeKind !== scope)) continue;
+      if (matches(session.parkPause)) session.parkPause!.resumed = true;
+      if (pauseOf(session.runtimeKind)) continue;
+      if (session.parked) {
+        if (matches(session.parked.pause)) continueParked(id, session);
+      } else if (session.wakeHeld) { session.wakeHeld = false; deliver(id, session); }
     }
   }
 
   /** An assignment whose turn a limit or a pause ended stays open, and its requester learns why. */
   function park(sessionId: string, session: Session) {
-    session.parked = { reason: session.parkReason!, since: Date.now() };
+    session.parked = { reason: session.parkReason!, since: Date.now(), ...(session.parkPause ? { pause: session.parkPause } : {}) };
+    const resumed = session.parkPause?.resumed;
+    session.parkPause = undefined;
     const then = session.parkThen;
     session.parkReason = undefined;
     session.parkThen = undefined;
     emit(sessionId, { type: 'session.updated', session: snapshot(sessionId, session) });
+    if (resumed) continueParked(sessionId, session);
     const parent = session.parent ? sessions.get(session.parent) : undefined;
     const assignment = parent?.assignments.get(sessionId);
     runLog(rootOf(sessionId), { event: 'assignment.parked', assignmentId: sessionId, agent: session.mapping.agent.name, reason: session.parked.reason });
@@ -1258,9 +1425,18 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     else post(session.parent!, { kind: 'stalled', from: assignment.agent, assignment: sessionId, body: `Parked: ${session.parked.reason}. ALP continues this assignment where it stopped when ${label(session.runtimeKind)} is resumed (${options.autoResume !== false && (pauseOf(session.runtimeKind)?.by ?? 'alpd') === 'alpd' ? `ALP resumes it as soon as ${label(session.runtimeKind)} says the limit lifted` : 'the user runs alp resume'}). Wait for it, start other work, or stop it with alp_cancel and give the rest to an agent on another runtime (pass model claude:… or codex:…); what it changed stays in your checkout or its worktree.` });
   }
 
-  function continueParked(sessionId: string, session: Session) {
+  function continueParked(sessionId: string, session: Session, expected = session.parked) {
     void enqueue(async () => {
-      if (session.closed || session.active || session.pending || !session.parked || pauseOf(session.runtimeKind)) return;
+      if (session.closed || session.active || session.pending || !session.parked || session.parked !== expected) return;
+      // This continuation owns only the captured park. A pause may have arrived while
+      // it waited in the queue; retain the actual blocker for a matching later resume.
+      if (pauseOf(session.runtimeKind)) {
+        session.parked.pause = { scope: paused.all ? 'all' : session.runtimeKind };
+        return;
+      }
+      // A lifecycle operation (a fork or rewind reading the conversation) holds the session: the work stays
+      // parked and continues when the last hold releases, as held mail does.
+      if (session.lifecycleHolds) { session.resumeHeld = session.parked; return; }
       const parked = session.parked;
       const { reason, prompt } = parked;
       session.parked = undefined;
@@ -1548,7 +1724,8 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     if (unknown.length) return toolResult(false, { error: `Unknown roles: ${unknown.join(', ')}. Roles are ${[...known].join(', ')}` });
     const file = path.join(library, 'skills', args.name, 'SKILL.md');
     const content = `---\nname: ${args.name}\ndescription: ${JSON.stringify(args.description.replace(/\s+/g, ' ').trim())}\n---\n\n${args.body.trim()}\n`;
-    const lessons: string[] = (args.lessons ?? []).map((lesson: string) => lesson.replace(/\s+/g, ' ').trim());
+    const normalizeLesson = (lesson: string) => lesson.replace(/\s+/g, ' ').trim().replace(/^(?:- )?\d{4}-\d\d-\d\d: /, '').trim();
+    const lessons: string[] = [...new Set<string>((args.lessons ?? []).map(normalizeLesson))];
     // A replay of a proposed draft returns its approval, before anything it changed is checked again.
     const draftKey = JSON.stringify(['skill', content, args.roles, lessons, !!args.replace]);
     const key = `skill:${args.requestId ?? draftKey}`;
@@ -1594,15 +1771,17 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       } catch (error) {
         return { approved: true, saved: false, error: errorData(error).message, next: 'Tell the user; nothing is retried automatically.' };
       }
-      // The lessons the skill replaces leave both files; a lesson matches only by its exact text.
+      // Compare exact rule text after normalizing whitespace and the optional recorded date.
       const removed = new Set<string>();
       for (const lessonFile of lessonFiles(session.mapping)) {
         const current = await readFile(lessonFile, 'utf8').catch(() => undefined);
         if (current === undefined) continue;
         const kept = current.split('\n').filter(line => {
           const match = /^- \d{4}-\d\d-\d\d: (.*)$/.exec(line);
-          if (!match || !lessons.includes(match[1].trim())) return true;
-          removed.add(match[1].trim());
+          if (!match) return true;
+          const lesson = normalizeLesson(line);
+          if (!lessons.includes(lesson)) return true;
+          removed.add(lesson);
           return false;
         });
         if (kept.length !== current.split('\n').length) await writeFile(lessonFile, kept.join('\n')).catch(() => {});
@@ -1630,6 +1809,52 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     return toolResult(true, { status: 'pending_approval', approvalId, file, next: 'Continue other work or end your turn. ALP sends the user\'s decision, and whether the skill was saved, by mail; do not resubmit this draft.' });
   }
 
+  let scheduleHandler: ScheduleHandler | undefined;
+
+  async function scheduleTool(sessionId: string, session: Session, args: unknown) {
+    if (session.parent || session.role === 'supervisor' || session.mapping.agent.name !== mainOf(session.mapping)) return toolResult(false, { error: 'Only the main root session schedules continuations' });
+    if (!scheduleHandler) return toolResult(false, { error: 'This host does not support scheduled continuations' });
+    if (!plainObject(args, ['action', 'dueAt', 'prompt', 'requestId', 'id', 'status']) || !['create', 'list', 'get', 'cancel'].includes(args.action)) return toolResult(false, { error: 'Unknown schedule action' });
+    const action = args.action as 'create' | 'list' | 'get' | 'cancel';
+    const fields = action === 'create' ? ['action', 'dueAt', 'prompt', 'requestId'] : action === 'list' ? ['action', 'status'] : ['action', 'id'];
+    if (Object.keys(args).some(key => !fields.includes(key))) return toolResult(false, { error: 'Unexpected schedule argument' });
+    const handler = scheduleHandler;
+    const projectRoot = session.mapping.agent.projectRoot;
+    const invoke = async (params: Record<string, unknown>) => {
+      try { return toolResult(true, await handler(action, { ...params, projectRoot })); }
+      catch (error) { return toolResult(false, { error: errorData(error).message }); }
+    };
+    if (action !== 'create') return invoke(action === 'list' ? { ...(args.status ? { status: args.status } : {}) } : { id: args.id });
+    if (!text(args.requestId, 200) || !text(args.prompt, 8000) || !text(args.dueAt, 80) ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?(Z|[+-]\d{2}:\d{2})$/.test(args.dueAt) || !Number.isFinite(Date.parse(args.dueAt))) return toolResult(false, { error: 'create needs requestId, prompt (1–8000 characters) and dueAt with an explicit UTC offset' });
+    const draftKey = JSON.stringify([args.dueAt, args.prompt]);
+    const key = `schedule:${args.requestId}`;
+    const approvals = approvalsOf(sessionId);
+    const previous = approvals.get(key);
+    if (previous) return previous.draftKey !== draftKey
+      ? toolResult(false, { error: 'requestId already names another schedule draft' })
+      : toolResult(true, previous.result ?? { status: 'pending_approval', approvalId: previous.approvalId });
+    const cancellation = approvalCancellation.get(session) ?? 0;
+    const approvalId = `q-${randomUUID()}`;
+    const record: { approvalId: string; draftKey: string; result?: Record<string, unknown> } = { approvalId, draftKey };
+    approvals.set(key, record);
+    const decision = confirm(sessionId, session,
+      `Tạo lịch tiếp tục một lần?\nProject: ${projectRoot}\nSession: ${sessionId}\nThời gian: ${args.dueAt} (${new Date(args.dueAt).toISOString()})\n\n${args.prompt}`, { id: approvalId });
+    void decision.then(async answer => {
+      const canceled = approvalCanceled(session, cancellation);
+      let result: Record<string, unknown>;
+      if (!answer.approved || canceled) result = { approved: false, created: false, outcome: canceled ? 'canceled' : answer.outcome, feedback: answer.feedback };
+      else {
+        try { result = { approved: true, created: true, ...await handler('create', { projectRoot, sessionId, dueAt: args.dueAt, prompt: args.prompt }) as object }; }
+        catch (error) { result = { approved: true, created: false, error: errorData(error).message }; }
+      }
+      record.result = { status: 'resolved', approvalId, ...result };
+      runLog(rootOf(sessionId), { event: 'schedule.approval', ...record.result });
+      if (!session.closed) post(sessionId, { kind: 'result', from: 'ALP', assignment: approvalId, body: `Schedule approval result: ${JSON.stringify(record.result)}` });
+    }).catch(error => { record.result = { status: 'resolved', approvalId, created: false, error: errorData(error).message }; });
+    return toolResult(true, { status: 'pending_approval', approvalId, next: 'Continue other work or end your turn. ALP sends the decision and creation result by mail; do not resubmit this draft.' });
+  }
+
   async function issueTool(sessionId: string, session: Session, args: unknown) {
     const cancellation = approvalCancellation.get(session) ?? 0;
     args = structuredClone(args);
@@ -1762,6 +1987,8 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     // with the next one, but never wake an idle requester on their own.
     // Once none runs, what is left must still reach it, or a finished requester would never end.
     const waking = !session.assignments.size || session.mail.some(event => !event.deliveredTurn && !event.passive && !(event.kind === 'note' && event.assignment !== sessionId));
+    // A held idle session (a lifecycle operation, a pause, parked work) keeps its mail for the release.
+    if (!session.active && waking && holdsWake(session)) { session.wakeHeld = true; return; }
     if (session.pending) {
       void session.acknowledged.then(() => deliver(sessionId, session));
     } else if (session.active) {
@@ -1788,7 +2015,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     try {
       await session.runtime.request('turn/steer', { threadId: session.threadId, expectedTurnId: turnId, clientUserMessageId: id, input: [{ type: 'text', text, text_elements: [] }] });
       steered = true;
-      emit(sessionId, { type: 'item', item: { kind: 'user_message', id: `user:${id}`, clientMessageId: id, text } });
+      emit(sessionId, { type: 'item', item: { kind: 'user_message', id: `user:${id}`, clientMessageId: id, text, origin: 'wake' } });
     } catch {}
     // If the turn ended meanwhile, receipt is uncertain: deliver again rather than lose mail.
     const received = steered && session.active === turnId;
@@ -1806,7 +2033,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
   /** Queued behind client operations, so a wake never races a user prompt or an interrupt. */
   function autoWake(sessionId: string, session: Session) {
     // Its runtime is paused or it is parked: the mail waits for resume.
-    if (held(session)) { session.wakeHeld = true; return; }
+    if (holdsWake(session)) { session.wakeHeld = true; return; }
     // A check-in authorizes delivery of older mail too: the capped first batch
     // may not reach the check-in itself. Keep that authorization through queuing.
     const checkIn = session.mail.find(event => !event.deliveredTurn && event.kind === 'checkin');
@@ -1818,6 +2045,8 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     };
     const work = queue.then(async () => {
       if (closed || session.closed) return release();
+      // A hold taken after this wake was queued (a rewind) keeps the mail for its release.
+      if (holdsWake(session)) { release(); session.wakeHeld = true; return; }
       // Whatever ran first decides: a running turn gets the mail by steering, an interrupt holds it.
       if (session.wakeBlocked || session.active || session.pending) {
         release();
@@ -1977,7 +2206,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
   }
 
   const { settleWorktree, worktreeTool, inCheckout, verifyIn, verificationResult, noteVerification, continuedBrief, verifyTool } = createWorktreeDomain({
-    options, leases, rootOf, lineage, runLog, runHooks, touchTask,
+    options, leases, rootOf, lineage, runLog, runHooks, touchTask, releaseResult: assignmentId => assignmentResults.remove(assignmentId),
   });
 
   /**
@@ -2006,20 +2235,37 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
   async function finishAssignment(parentId: string, parent: Session, assignment: Assignment, state: string, error?: unknown, quiet = false) {
     if (assignment.finished) return;
     assignment.finished = true;
+    const child = assignmentSessions.get(assignment);
     // alpd is stopping: the assignment stays in the live file and its task stays in progress, for the next alpd to continue.
     if (closed && inFlight.get(assignment.id)) {
       runLog(assignment.rootId, { event: 'assignment.interrupted', assignmentId: assignment.id, agent: assignment.agent, reason: 'alpd stopped' });
-      await closeSession(assignment.id);
+      if (child) await closeSession(assignment.id, child);
       if (assignment.lease && leases.get(assignment.lease)?.assignment === assignment.id) leases.delete(assignment.lease);
-      childContexts.delete(assignment.id);
-      parent.children.delete(assignment.id);
-      parent.assignments.delete(assignment.id);
+      if (!sessions.has(assignment.id) || sessions.get(assignment.id) === child) {
+        childContexts.delete(assignment.id);
+        parent.children.delete(assignment.id);
+      }
+      if (parent.assignments.get(assignment.id) === assignment) parent.assignments.delete(assignment.id);
+      return;
+    }
+    // Ownership must reach durable storage before recovery evidence can disappear.
+    const resultChild = child;
+    try {
+      if (assignment.worktree || writes(assignment.mode)) await assignmentResults.put({
+        assignmentId: assignment.id,
+        checkout: assignment.worktree?.checkout ?? assignment.writeCheckout ?? resultChild?.mapping.workdir ?? parent.mapping.workdir,
+        ...(assignment.worktree ? { worktree: assignment.worktree.path } : {}),
+      });
+    } catch (failure) {
+      // Keep both the assignment and its recovery evidence; never close away unrecorded ownership.
+      assignment.finished = false;
+      log.error('could not persist assignment result ownership', { assignmentId: assignment.id, error: failure });
+      post(parentId, { kind: 'note', from: assignment.agent, assignment: assignment.id, passive: true, body: `Assignment result ownership could not be saved: ${errorData(failure).message}. Restore the assignment result ledger before completing or removing this workspace.` });
       return;
     }
-    // Removed before anything else, so a crash while finishing never runs finished work again.
+    // A crash while finishing never runs finished work again.
     void inFlight.remove(assignment.id);
-    const child = sessions.get(assignment.id);
-    if (child && state === 'failed' && child.active) terminal(assignment.id, child, 'failed', error);
+    if (child && sessions.get(assignment.id) === child && state === 'failed' && child.active) terminal(assignment.id, child, 'failed', error);
     assignment.ask?.resolve(toolResult(false, { error: 'Assignment ended' }));
 
     // Interim commentary stays in the child timeline; the final message is the answer.
@@ -2033,7 +2279,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       ...(error ? { error: errorData(error).message } : {}),
     };
 
-    await closeSession(assignment.id);
+    if (child) await closeSession(assignment.id, child);
     // Its native thread stays on disk, so its requesters can ask it about its work later.
     // An ACP agent cannot fork a session to answer questions about it.
     if (child?.threadId && child.mapping.keepThread && child.runtimeKind !== 'acp') {
@@ -2079,9 +2325,11 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     });
     if (!parent.closed) emit(parentId, { type: 'assignment', assignment: assignmentSnapshot(assignment, state) });
 
-    childContexts.delete(assignment.id);
-    parent.children.delete(assignment.id);
-    parent.assignments.delete(assignment.id);
+    if (!sessions.has(assignment.id) || sessions.get(assignment.id) === child) {
+      childContexts.delete(assignment.id);
+      parent.children.delete(assignment.id);
+    }
+    if (parent.assignments.get(assignment.id) === assignment) parent.assignments.delete(assignment.id);
     if (roleOf(parent.mapping, assignment.agent) === 'peer') {
       const root = sessions.get(assignment.rootId);
       if (root) root.peerCount--;
@@ -2109,7 +2357,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     }
 
     if (
-      !['alp_delegate', 'alp_handoff', 'alp_wait', 'alp_cancel', 'alp_send', 'alp_ask', 'alp_merge', 'alp_discard', 'alp_recall', 'alp_verify', 'alp_pin', 'alp_board', 'alp_unpin', 'alp_lesson', 'alp_skill', 'alp_issue', 'alp_task'].includes(params.tool) ||
+      !['alp_delegate', 'alp_handoff', 'alp_wait', 'alp_cancel', 'alp_send', 'alp_ask', 'alp_merge', 'alp_discard', 'alp_recall', 'alp_verify', 'alp_pin', 'alp_board', 'alp_unpin', 'alp_lesson', 'alp_skill', 'alp_issue', 'alp_task', 'alp_schedule'].includes(params.tool) ||
       params.namespace != null ||
       typeof params.callId !== 'string'
     ) {
@@ -2130,6 +2378,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       params.tool === 'alp_lesson' ? lessonTool(sessionId, session, args)
       : params.tool === 'alp_skill' ? skillTool(sessionId, session, args)
       : params.tool === 'alp_issue' ? issueTool(sessionId, session, args)
+      : params.tool === 'alp_schedule' ? scheduleTool(sessionId, session, args)
       : params.tool === 'alp_task' ? taskToolCall(sessionId, session, args)
       : params.tool === 'alp_delegate' ? runDelegation(sessionId, session, params)
       : params.tool === 'alp_wait' ? waitTool(sessionId, session, args)
@@ -2365,10 +2614,19 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     });
   }
 
-  async function runDelegation(
+  async function runDelegation(sessionId: string, session: Session, params: any): Promise<unknown> {
+    if (workspaceMutation) refuseMutation('workspace_busy', 'A workspace mutation is in progress; retry after it finishes');
+    admitting++;
+    let released = false;
+    const release = () => { if (!released) { released = true; admitting--; } };
+    try { return await runDelegationAdmitted(sessionId, session, params, release); }
+    finally { release(); }
+  }
+  async function runDelegationAdmitted(
     sessionId: string,
     session: Session,
     params: any,
+    admitted: () => void,
   ): Promise<unknown> {
     const args = params.arguments;
 
@@ -2598,6 +2856,8 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       ...(task ? { taskId: task.id } : {}),
     });
     try {
+      // Persist ownership before native checkout creation or child execution. Recovery books may be lost.
+      if (writes(childMode)) await assignmentResults.put({ assignmentId: childId, checkout });
       if (task) {
         const started = await startTask(project, task.id, { agent: args.agent, assignment: childId, pid: process.pid, pidStartedAt: OWN_START, epoch }, session.mapping.agent.name);
         assignment.taskId = started.id;
@@ -2612,8 +2872,12 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
           if (continued) session.worktrees.set(args.continueFrom, continued);
           throw error;
         }
+        await assignmentResults.put({ assignmentId: childId, checkout: assignment.worktree.checkout, worktree: assignment.worktree.path });
         // The new branch holds the earlier change, so its worktree and branch can go.
-        if (continued) await removeWorktree(continued.worktree, { deleteBranch: true }).catch(() => {});
+        if (continued) {
+          await removeWorktree(continued.worktree, { deleteBranch: true });
+          await assignmentResults.remove(args.continueFrom);
+        }
         runLog(rootId, { event: 'worktree.created', assignmentId: childId, branch: assignment.worktree.branch, base: assignment.worktree.base, ...(continued ? { continuedFrom: args.continueFrom } : {}) });
       } else if (sharedWriter) {
         assignment.fingerprint = await checkoutFingerprint(checkout).catch(() => undefined);
@@ -2639,9 +2903,11 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
         thinking,
         mode: childMode,
       };
-      await openSession(childId, childSpec, 'skip', session.delegation);
+      await openSession(childId, childSpec, 'skip', session.delegation, assignment);
+      admitted();
 
-      const child = sessions.get(childId);
+      const child = assignmentSessions.get(assignment);
+      if (child && sessions.get(childId) !== child) throw new Error('Child session was replaced during open');
       if (child) void runHooks(childId, child, 'assignment.start', { assignment: childId, brief: clip(args.task, 2000) }, args.taskId);
 
       if (
@@ -2680,6 +2946,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
         addPin(childId, child, pins, { kind: 'claim', body: `Task ${task.id}: ${task.title}`, paths: task.paths, task: task.id });
       }
 
+      // Mail held for the brief goes with it: startPrompt takes what waits.
       await startPrompt(childId, {
         clientMessageId: `task-${childId}`,
         delivery: 'auto',
@@ -2694,6 +2961,10 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
           },
         ],
       }, 'assignment');
+      // Held until the brief's turn started: what came since steers it, or wakes the child if it ended.
+      // A brief that did not start leaves the hold; the child closes with its failed assignment.
+      child.awaitingBrief = false;
+      if (child.wakeHeld) { child.wakeHeld = false; deliver(childId, child); }
     } catch (error) {
       // A child that failed while starting may already have reported by mail; report once.
       session.mail = session.mail.filter(event => event.deliveredTurn || event.kind !== 'result' || event.assignment !== childId);
@@ -2743,7 +3014,10 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     });
   }
 
-  async function openSession(sessionId: string, spec: SessionSpec, history: 'replay' | 'skip', delegation = true): Promise<SessionSnapshot> {
+  async function openSession(sessionId: string, spec: SessionSpec, history: 'replay' | 'skip', delegation = true, assignment?: Assignment): Promise<SessionSnapshot> {
+    return admission(() => openSessionAdmitted(sessionId, spec, history, delegation, assignment));
+  }
+  async function openSessionAdmitted(sessionId: string, spec: SessionSpec, history: 'replay' | 'skip', delegation = true, assignment?: Assignment): Promise<SessionSnapshot> {
     if (sessions.has(sessionId)) {
       throw new Error(
         'Session is already open',
@@ -2819,6 +3093,8 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
         ? sessions.get(context.parent)?.mapping.agent.name
         : undefined,
       ...(context?.role ? { role: context.role } : {}),
+      // A new assignment's first turn is its brief; mail that comes sooner waits for it.
+      ...(context && !context.role && !context.recovered ? { awaitingBrief: true } : {}),
       journal: [],
       tasks: [],
 
@@ -2838,6 +3114,9 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       acknowledged: Promise.resolve(),
       worktrees: new Map(),
     };
+    if (assignment) assignmentSessions.set(assignment, session);
+    // Pending until its thread exists: mail posted meanwhile waits for it, as in a restart.
+    const finishPending = beginPending(session);
 
     sessions.set(
       sessionId,
@@ -2849,7 +3128,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     try {
       await runtime.initialize();
 
-      if (session.closed) {
+      if (session.closed || sessions.get(sessionId) !== session) {
         throw new Error(
           'Session closed during initialization',
         );
@@ -2876,6 +3155,10 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       const nativeConfig = await configOf(session);
       noteInstructions(sessionId, session, nativeConfig.developerInstructions);
 
+      // A Claude fork or rewind that has not had its first prompt yet is made from its base (§12.7).
+      const base = mapping.threadId ? spec.restore?.base : undefined;
+      if (base && runtimeKind !== 'claude') throw new Error(`A ${label(runtimeKind)} session has no base conversation; only Claude makes a fork on its first prompt`);
+      if (base) session.base = base;
       const result = mapping.threadId
         ? await runtime.request(
             'thread/resume',
@@ -2883,6 +3166,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
               ...nativeConfig,
               threadId:
                 mapping.threadId,
+              ...(base ? { base } : {}),
             },
           )
         : await runtime.request(
@@ -2897,15 +3181,16 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       session.threadId =
         result.thread.id;
 
-      if (session.closed) {
+      if (session.closed || sessions.get(sessionId) !== session) {
         throw new Error(
           'Session closed during thread creation',
         );
       }
 
-      session.pending = false;
       session.buffered = [];
+      finishPending();
 
+      openedSessions.add(session);
       emit(sessionId, {
         type: 'session.opened',
         session: snapshot(sessionId, session),
@@ -2941,12 +3226,11 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       return snapshot(sessionId, session);
     } catch (error) {
       log.error(`${session.mapping.agent.name} could not start its ${session.runtimeKind} session`, { code: 'ALP_PROVIDER_START_FAILED', sessionId, rootId: rootOf(sessionId), agent: session.mapping.agent.name, provider: session.runtimeKind, error });
-      session.closed = true;
-      sessions.delete(
-        sessionId,
-      );
-
-      await runtime.close();
+      // Share the retirement already started by a process failure, and never
+      // resolve the id to a replacement record when this open finishes late.
+      const cleanup = closeSession(sessionId, session, false);
+      finishPending();
+      await cleanup;
 
       throw error;
     }
@@ -2973,17 +3257,18 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     });
     transport.onFailure((error) => {
       // A transport ALP already replaced reports nothing.
-      if (session.closed || session.runtime !== transport) return;
+      if (session.closed || session.runtime !== transport || sessions.get(sessionId) !== session) return;
       if (revivable(session)) void revive(sessionId, session, error);
       else failSession(sessionId, session, error);
     });
   }
 
   function failSession(sessionId: string, session: Session, error: unknown) {
+    if (session.closed || sessions.get(sessionId) !== session) return;
     log.error(`${session.mapping.agent.name}'s ${session.runtimeKind} session failed`, { code: 'ALP_PROVIDER_FAILED', sessionId, rootId: rootOf(sessionId), agent: session.mapping.agent.name, provider: session.runtimeKind, error });
     terminal(sessionId, session, 'failed', error);
     session.settle?.('failed', error);
-    void closeSession(sessionId);
+    void closeSession(sessionId, session);
     emit(sessionId, { type: 'session.failed', error: errorData(error) });
   }
 
@@ -3045,38 +3330,468 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     const harness = label(session.runtimeKind);
     log.warn(`${harness} process of ${session.mapping.agent.name} stopped; restarting it`, { code: 'ALP_PROVIDER_RESTARTED', sessionId, rootId: rootOf(sessionId), agent: session.mapping.agent.name, provider: session.runtimeKind, error });
     runLog(rootOf(sessionId), { event: 'session.restarted', sessionId, agent: session.mapping.agent.name, error: errorData(error).message, restarts: session.restarts.length });
+    let interrupted: Session['parked'];
     if (session.active) {
       session.parkReason = `its ${harness} process stopped`;
+      session.parkPause = undefined;
       session.parkThen = `ALP is restarting the ${harness} process; this assignment continues by itself.`;
       terminal(sessionId, session, 'failed', error);
+      interrupted = session.parked;
     }
     const old = session.runtime;
     void old.close().catch(() => {});
+    let finishPending = () => {};
     try {
       const transport = createTransport(options, session.runtimeKind, session.mapping.workdir, nativeEnvironment(options, session.mapping.env), session.mapping.acp, session.mapping.antigravity);
       session.runtime = transport;
-      session.pending = true;
+      finishPending = beginPending(session);
       wire(sessionId, session, transport);
       await transport.initialize();
       const config = await configOf(session);
-      if (session.closed) return void transport.close().catch(() => {});
-      await transport.request('thread/resume', { ...config, threadId: session.threadId });
-      if (session.closed) return void transport.close().catch(() => {});
-      session.pending = false;
+      if (session.closed) { finishPending(); return void transport.close().catch(() => {}); }
+      await transport.request('thread/resume', { ...config, threadId: session.threadId, ...(session.base ? { base: session.base } : {}) });
+      if (session.closed) { finishPending(); return void transport.close().catch(() => {}); }
       session.buffered = [];
+      finishPending();
       runLog(rootOf(sessionId), { event: 'session.revived', sessionId, agent: session.mapping.agent.name });
-      if (session.parked && !pauseOf(session.runtimeKind)) {
+      if (session.parked && session.parked === interrupted) {
         session.parked.prompt = `ALP restarted your ${harness} process after it stopped in the middle of your turn. Continue where you left off: your earlier work in this session and its files are intact.${session.parent ? ' Finish with alp_handoff as before.' : ''}`;
         continueParked(sessionId, session);
       }
     } catch (failure) {
-      session.pending = false;
+      finishPending();
       session.parked = undefined;
       runLog(rootOf(sessionId), { event: 'session.revive_failed', sessionId, agent: session.mapping.agent.name, error: errorData(failure).message });
       failSession(sessionId, session, error);
     }
   }
 
+  /**
+   * Why a root cannot have its native process restarted now, or undefined when it can: the seam that
+   * rebind (a rewind), a reload (G2: rebind(id, its own binding)) and a live model or team change (D)
+   * share. Its whole tree must be idle: an open root with no turn, opening or pending prompt, child,
+   * assignment, question to the user, unread or held mail, parked work, or review by its supervisor.
+   */
+  function restartRefusal(sessionId: string, session: Session | undefined): string | undefined {
+    if (!session || session.closed) return 'The session is not open';
+    if (session.parent || session.role === 'supervisor') return 'Only a root session can be restarted';
+    if (session.pending) return 'The session is still opening or restarting';
+    if (session.active) return 'A turn is running';
+    if (session.children.size || session.assignments.size) return 'Assignments are still running';
+    if ([...userQuestions.values()].some(pending => pending.question.rootId === sessionId)) return 'A question to the user waits for an answer';
+    // Mail a lifecycle hold keeps waits for its release, then reaches the session's new conversation.
+    if ((hasActiveMail(session) || session.wakeHeld) && !session.lifecycleHolds) return 'Mail waits for the session';
+    if (session.parked || session.parkReason) return 'The session is parked';
+    if (reviewing(session)) return 'The supervisor is reviewing the session';
+    return undefined;
+  }
+
+  /**
+   * Restarts a live session's native process on `binding` (ALPD §31, as revive does): the old process
+   * stops first, so no two processes ever hold the session's conversation, then a new one resumes
+   * `binding` and replaces it, keeping the session id, configuration and viewers. Throws, leaving the
+   * session without a process, when the new one cannot resume; the caller reopens or fails it. The
+   * caller checks restartRefusal and runs this in the operation queue. `verify`: a Claude conversation
+   * without a transcript (or base) is refused rather than left to Claude, which would refuse it at boot
+   * or start it empty; reopening the binding a session already ran on resumes it as revive does.
+   * `shape`: the configuration the new process runs with, when not the session's own (a live configure,
+   * §12.9); the session itself keeps its own until its caller sees the restart through. No `binding`:
+   * a new conversation starts (a root reconfigured before its first turn has none to keep). Answers
+   * what the runtime answered (Codex: the model and effort it resumed the thread with).
+   */
+  async function restartNative(sessionId: string, session: Session, binding: NativeBinding | undefined, verify = true, shape?: Pick<Session, 'mapping' | 'graph' | 'spec'>) {
+    const old = session.runtime;
+    const finishPending = beginPending(session);
+    await old.close().catch(() => {});
+    const transport = createTransport(options, session.runtimeKind, session.mapping.workdir, nativeEnvironment(options, session.mapping.env), session.mapping.acp, session.mapping.antigravity);
+    // Not wired before it resumes: a failure now fails this restart, not the session.
+    let failure: unknown;
+    transport.onFailure(error => { failure ??= error; });
+    session.runtime = transport;
+    let result: any;
+    try {
+      await transport.initialize();
+      const config = await configOf(shape ? { ...session, ...shape } : session);
+      noteInstructions(sessionId, session, config.developerInstructions);
+      if (session.closed) throw new Error('Session closed during restart');
+      result = binding
+        ? await transport.request('thread/resume', {
+          ...config, threadId: binding.threadId,
+          ...(binding.base ? { base: binding.base } : verify && session.runtimeKind === 'claude' ? { requireHistory: true } : {}),
+        })
+        : await transport.request('thread/start', { ...config, ephemeral: !(shape ?? session).mapping.persist && !(shape ?? session).mapping.keepThread });
+      if (failure) throw failure;
+      if (session.closed) throw new Error('Session closed during restart');
+      if (binding && result?.thread?.id !== undefined && result.thread.id !== binding.threadId) throw new Error(`${label(session.runtimeKind)} resumed ${result.thread.id} instead of ${binding.threadId}`);
+      if (!binding && typeof result?.thread?.id !== 'string') throw new Error(`${label(session.runtimeKind)} started no conversation`);
+    } catch (error) {
+      await transport.close().catch(() => {});
+      // Not pending any more: mail that waited runs again in the operation queue, after this restart's
+      // caller (which reopens or fails the session) is through.
+      finishPending();
+      throw error;
+    }
+    session.threadId = binding ? binding.threadId : result.thread.id;
+    if (binding?.base) session.base = binding.base;
+    else delete session.base;
+    session.buffered = [];
+    wire(sessionId, session, transport);
+    finishPending();
+    return result;
+  }
+
+  /** rebind(): moves an idle root to another native conversation, or reopens its own; see AlpRuntime.rebind. */
+  async function rebindSession(sessionId: string, binding: NativeBinding) {
+    const session = sessions.get(sessionId);
+    const refusal = restartRefusal(sessionId, session);
+    if (refusal) throw new ConversationError('session_busy', refusal);
+    if (!plainObject(binding, ['threadId', 'base']) || typeof binding.threadId !== 'string' || !binding.threadId ||
+      (binding.base !== undefined && (!plainObject(binding.base, ['threadId', 'at']) || typeof binding.base.threadId !== 'string' || !binding.base.threadId || (binding.base.at !== undefined && typeof binding.base.at !== 'string')))) {
+      throw new Error('A binding needs a threadId, and a base only with a threadId and an optional at');
+    }
+    if (binding.base && session!.runtimeKind !== 'claude') throw new ConversationError('runtime_unsupported', `A ${label(session!.runtimeKind)} session has no base conversation`);
+    const live = session!;
+    const previous: NativeBinding = { threadId: live.threadId, ...(live.base ? { base: live.base } : {}) };
+    try {
+      await restartNative(sessionId, live, binding);
+    } catch (error) {
+      runLog(rootOf(sessionId), { event: 'session.rebind_failed', sessionId, agent: live.mapping.agent.name, threadId: binding.threadId, error: errorData(error).message });
+      try {
+        if (live.closed) throw error;
+        await restartNative(sessionId, live, previous, false);
+      } catch (reopen) {
+        // Neither conversation opens: the session fails as a provider failure does.
+        live.pending = false;
+        if (!live.closed) failSession(sessionId, live, reopen);
+      }
+      if (error instanceof ConversationError) throw error;
+      throw new ConversationError('native_refused', `The conversation could not be opened: ${errorData(error).message}`, { outcomeUnknown: !!(error as { outcomeUnknown?: boolean })?.outcomeUnknown });
+    }
+    runLog(rootOf(sessionId), { event: 'session.rebound', sessionId, agent: live.mapping.agent.name, from: previous.threadId, threadId: binding.threadId });
+    const updated = snapshot(sessionId, live);
+    emit(sessionId, { type: 'session.updated', session: updated });
+    return updated;
+  }
+
+  /** reload(): restarts an idle root's native process on its own conversation; see AlpRuntime.reload. */
+  async function reloadSession(sessionId: string) {
+    const session = sessions.get(sessionId);
+    const refusal = restartRefusal(sessionId, session);
+    if (refusal) throw new ConversationError('session_busy', refusal);
+    const live = session!;
+    if (!live.threadId) throw new ConversationError('runtime_unsupported', 'This session keeps no native conversation to reload');
+    const binding: NativeBinding = { threadId: live.threadId, ...(live.base ? { base: live.base } : {}) };
+    try {
+      await restartNative(sessionId, live, binding);
+    } catch (error) {
+      runLog(rootOf(sessionId), { event: 'session.reload_failed', sessionId, agent: live.mapping.agent.name, threadId: binding.threadId, error: errorData(error).message });
+      // No process holds the conversation now, and none is started without it: the session closes,
+      // its record keeps the binding, and the next open resumes it.
+      if (!live.closed) await closeSession(sessionId).catch(() => {});
+      // Known either way: the session is closed now and its conversation was only read, never changed.
+      throw new ConversationError('native_refused', `The agent could not be restarted on its conversation: ${errorData(error).message}`);
+    }
+    runLog(rootOf(sessionId), { event: 'session.reloaded', sessionId, agent: live.mapping.agent.name, threadId: binding.threadId });
+    const updated = snapshot(sessionId, live);
+    emit(sessionId, { type: 'session.updated', session: updated });
+    return updated;
+  }
+
+  // ------------------------------------------------------------------ live configure (§12.9)
+
+  type ConfigureShape = Pick<Session, 'mapping' | 'graph' | 'spec'>;
+  type ConfigurePlan = {
+    shape: ConfigureShape;
+    current: EffectiveConfig;
+    proposed: EffectiveConfig;
+    changes: ConfigureChange[];
+    refusal?: { reason: ConversationErrorReason; message: string };
+  };
+
+  /** The effective configuration a root runs with, or would with `shape` (§12.9). */
+  async function effectiveConfig(session: Session, shape?: ConfigureShape) {
+    const view = shape ? { ...session, ...shape } : session;
+    const config = await configOf(view);
+    const name = view.mapping.agent.name;
+    return effectiveOf(session.runtimeKind, view.mapping, {
+      delegates: Object.hasOwn(view.graph, name) ? view.graph[name] : [],
+      tools: ((config.dynamicTools ?? []) as Array<{ name?: unknown }>).map(tool => tool.name).filter((tool): tool is string => typeof tool === 'string'),
+      supervisor: supervises(view),
+      instructionsSha: createHash('sha256').update(config.developerInstructions).digest('hex').slice(0, 12),
+    });
+  }
+
+  /**
+   * What a change of model, thinking, team or mode would make of a live root: the configuration resolved
+   * as session.create resolves one (same runtime, agent and conversation), or why it is refused. Reads only.
+   */
+  async function planConfigure(session: Session, changes: ConfigureChanges): Promise<ConfigurePlan> {
+    const current = await effectiveConfig(session);
+    const same: ConfigurePlan = { shape: { mapping: session.mapping, graph: session.graph, spec: session.spec }, current, proposed: current, changes: [] };
+    const refuse = (reason: ConversationErrorReason, message: string): ConfigurePlan => ({ ...same, refusal: { reason, message } });
+    if (session.parent || session.role === 'supervisor') return refuse('not_root', 'Only a root session is reconfigured; an assignment keeps the team and model it started with');
+    if (!CONFIGURABLE.has(session.runtimeKind)) return refuse('runtime_unsupported', `alpd cannot change a running ${label(session.runtimeKind)} session's model or team; start a new session`);
+    for (const key of ['model', 'thinking', 'team', 'mode'] as const) {
+      const value = changes[key];
+      if (value !== undefined && (typeof value !== 'string' || !value.trim() || value.length > 200)) return refuse('invalid_params', `${key} must be a nonempty name of at most 200 characters`);
+    }
+    const runtimeKind = session.runtimeKind;
+    let model = session.mapping.model;
+    if (changes.model !== undefined) {
+      const named = nativeModelOf(runtimeKind, changes.model.trim());
+      if ('runtime' in named) return refuse('runtime_mismatch', `A session keeps its runtime (${label(runtimeKind)}); to work with ${named.runtime}, start a new session with that model`);
+      if (!offered(runtimeKind, named.model, session.mapping)) return refuse('invalid_params', `The daemon host does not offer ${runtimeKind}:${named.model}; choose one of its models`);
+      model = named.model;
+    }
+    const projectRoot = session.mapping.agent.projectRoot;
+    let team = session.mapping.workflow.mode;
+    if (changes.team !== undefined) {
+      const wanted = teamOf(changes.team.trim());
+      const teams = await listTeams(projectRoot, { library: options.libraryDir, templates: options.templates });
+      if (!teams.some(row => row.id === wanted && !row.error)) return refuse('team_not_found', `The daemon host defines no team '${changes.team.trim()}' for this project`);
+      team = wanted;
+    }
+    const teamChanged = team !== session.mapping.workflow.mode;
+    const mode = changes.mode ?? session.mapping.mode;
+    if (!modes.some(candidate => candidate.id === mode)) return refuse('invalid_params', `Unsupported mode '${mode}'`);
+    // The effort asked for; else the session's own while the model takes it; else the model's default.
+    const takes = (effort: string) => { const efforts = thinkingOptionsFor(runtimeKind as 'codex' | 'claude', model); return !efforts.length || efforts.some(option => option.id === effort); };
+    const thinking = changes.thinking ?? (takes(session.mapping.thinking) ? session.mapping.thinking : undefined);
+    const { restore: _restore, thinking: _thinking, ...kept } = session.spec;
+    const spec: SessionSpec = { ...kept, mode, ...(teamChanged ? { workflow: team } : {}), ...(thinking !== undefined ? { thinking } : {}) };
+    let mapping: ResolvedSession;
+    try {
+      mapping = await resolveSession({
+        ...spec,
+        restore: { agent: session.mapping.agent.name, threadId: session.threadId || 'unstarted', runtime: runtimeKind, model, ...(teamChanged ? {} : { workflow: session.mapping.workflow }) },
+      }, { templates: options.templates, library: options.libraryDir, language: options.language, initialize: false });
+    } catch (error) {
+      const message = errorData(error).message;
+      return refuse(/^Team '[^']*' not found/.test(message) ? 'team_not_found' : /different runtime/.test(message) ? 'runtime_mismatch' : /different ALP agent/.test(message) ? 'agent_mismatch' : 'invalid_params', message);
+    }
+    const graph = teamChanged ? (mapping.team ? mapping.team.delegation : await resolveDelegation(projectRoot)) : session.graph;
+    const shape: ConfigureShape = { mapping, graph, spec };
+    const proposed = await effectiveConfig(session, shape);
+    const plan: ConfigurePlan = { shape, current, proposed, changes: changesOf(current, proposed) };
+    const refused = (reason: ConversationErrorReason, message: string): ConfigurePlan => ({ ...plan, refusal: { reason, message } });
+    if (mapping.runtimeKind !== runtimeKind) return refused('runtime_mismatch', `A session keeps its runtime (${label(runtimeKind)}); start a new session for another runtime`);
+    if (mapping.agent.name !== session.mapping.agent.name) return refused('agent_mismatch', 'A session keeps its agent; start a new session for another agent');
+    const agent = session.mapping.agent.name;
+    if (teamChanged && agent === mainOf(session.mapping) && agent !== mainOf(mapping)) return refused('agent_mismatch', `Team ${mapping.team?.label ?? team}'s main agent is ${mainOf(mapping)}, not ${agent}; start a new session with that team`);
+    // Never more permissions: the mode asked for stays within the profile and READ_ONLY_AGENTS, and a
+    // team or effort change never raises the mode the session runs with.
+    if (changes.mode !== undefined && mapping.mode !== changes.mode) return refused('permission_escalation', READ_ONLY_AGENTS.includes(agent) ? 'Advisors and the supervisor must remain read-only' : `Permission profile ${mapping.permissions?.name ?? ''} allows at most ${mapping.permissions?.base ?? mapping.mode}`.replace('profile  allows', 'profile allows'));
+    if (changes.mode === undefined && !withinMode(mapping.mode, session.mapping.mode)) return refused('permission_escalation', `The change would run the session in ${mapping.mode}, beyond its ${session.mapping.mode}`);
+    if (runtimeKind === 'antigravity' && mapping.mode !== session.mapping.mode) return refused('runtime_unsupported', 'Antigravity sessions keep their mode');
+    const before = executablesOf(session.mapping);
+    const added = [...executablesOf(mapping)].filter(entry => !before.has(entry));
+    if (added.length) return refused('permission_escalation', `The change would give the session commands it did not run (${added.map(entry => entry.split(':').slice(0, 2).join(' ')).join(', ')}); start a new session for it`);
+    if (proposed.delegates.length && !session.delegation) return refused('invalid_params', 'This session\'s client cannot show assignments, so it cannot take a team that delegates');
+    return plan;
+  }
+
+  /**
+   * Whether the root's native runtime holds a conversation for it (Codex: a turn of its thread; Claude: a
+   * transcript entry). Codex's answer for a thread before its first message ("not materialized yet", "no
+   * rollout found") means none; any other failure to say is refused, never taken as none, so a held
+   * conversation is never left for an empty one.
+   */
+  async function nativeHistory(session: Session) {
+    if (!session.threadId) return false;
+    if (session.base) return true;
+    const unknown = (error: unknown) => new ConversationError('native_refused', `${label(session.runtimeKind)} could not say whether it holds this session's conversation: ${errorData(error).message}`);
+    if (session.runtimeKind === 'codex') {
+      try {
+        const page = await session.runtime.request('thread/turns/list', { threadId: session.threadId, limit: 1, sortDirection: 'desc' });
+        return Array.isArray(page?.data) && page.data.length > 0;
+      } catch (error) {
+        if (/not materialized|no rollout found/i.test(errorData(error).message)) return false;
+        throw unknown(error);
+      }
+    }
+    if (session.runtimeKind === 'claude') {
+      try {
+        const chain = await session.runtime.request('thread/chain', { threadId: session.threadId, cwd: session.mapping.workdir });
+        return Array.isArray(chain?.entries) && chain.entries.length > 0;
+      } catch (error) { throw unknown(error); }
+    }
+    return true;
+  }
+
+  /** previewConfigure(): see AlpRuntime.previewConfigure. */
+  async function previewConfigureSession(sessionId: string, changes: ConfigureChanges): Promise<ConfigurePreview> {
+    const session = sessions.get(sessionId);
+    if (!session || session.closed) throw new ConversationError('session_busy', 'The session is not open');
+    const plan = await planConfigure(session, changes ?? {});
+    const busy = plan.changes.length ? restartRefusal(sessionId, session) : undefined;
+    const teams = (await listTeams(session.mapping.agent.projectRoot, { library: options.libraryDir, templates: options.templates }))
+      .filter(team => !team.error)
+      .map(team => ({ id: team.id, label: team.label ?? team.id, ...(team.description ? { description: team.description } : {}) }));
+    return {
+      current: plan.current, proposed: plan.proposed, changes: plan.changes,
+      restart: plan.changes.some(change => change !== 'mode'),
+      allowed: !plan.refusal && !busy,
+      ...(plan.refusal ? { reason: plan.refusal.reason as ConfigurePreview['reason'], message: plan.refusal.message } : busy ? { reason: 'session_busy' as const, message: busy } : {}),
+      teams,
+    };
+  }
+
+  /** reconfigure(): see AlpRuntime.reconfigure. */
+  async function reconfigureSession(sessionId: string, changes: ConfigureChanges, { fresh = false, onApplied }: { fresh?: boolean; onApplied?: (result: ConfigureResult) => Promise<void> } = {}): Promise<ConfigureResult> {
+    // Native apply has already succeeded when this runs. A host persistence failure must not enter
+    // the native-refusal rollback path, nor claim that nothing happened.
+    async function persist(result: ConfigureResult) {
+      try { await onApplied?.(result); }
+      catch (error) { throw new ConversationError('native_refused', `The runtime took the configuration but the host could not record it: ${errorData(error).message}`, { outcomeUnknown: true }); }
+    }
+    const session = sessions.get(sessionId);
+    const busy = restartRefusal(sessionId, session);
+    if (busy) throw new ConversationError(session && (session.parent || session.role === 'supervisor') ? 'not_root' : 'session_busy', busy);
+    const live = session!;
+    const plan = await planConfigure(live, changes ?? {});
+    if (plan.refusal) throw new ConversationError(plan.refusal.reason, plan.refusal.message);
+    // alpd's timeline says the root has no turn yet; the runtime must agree before a new conversation
+    // replaces its own (a conversation it holds is resumed, never left behind).
+    const starts = fresh && !(plan.changes.length && await nativeHistory(live));
+    // Its files were read meanwhile: the tree must still be idle.
+    const after = restartRefusal(sessionId, live);
+    if (after) throw new ConversationError('session_busy', after);
+    if (!plan.changes.length) return { session: snapshot(sessionId, live), effective: plan.current, status: 'unchanged', restarted: false };
+    const agent = live.mapping.agent.name;
+    if (plan.changes.every(change => change === 'mode')) {
+      // Permissions alone change as session.configure { mode } changes them, without a restart.
+      await configureSession(sessionId, { mode: plan.shape.mapping.mode }, updated => persist({ session: updated, effective: { ...plan.proposed, instructionsSha: plan.current.instructionsSha }, status: 'applied', restarted: false }));
+      runLog(rootOf(sessionId), { event: 'session.configured', sessionId, agent, changes: plan.changes, mode: plan.shape.mapping.mode });
+      return { session: snapshot(sessionId, live), effective: { ...plan.proposed, instructionsSha: plan.current.instructionsSha }, status: 'applied', restarted: false };
+    }
+    if (!starts && !live.threadId) throw new ConversationError('runtime_unsupported', 'This session keeps no native conversation to continue');
+    const binding: NativeBinding | undefined = starts ? undefined : { threadId: live.threadId, ...(live.base ? { base: live.base } : {}) };
+    const from = { model: live.mapping.model, thinking: live.mapping.thinking, team: live.mapping.workflow.mode, mode: live.mapping.mode };
+    const to = { model: plan.shape.mapping.model, thinking: plan.shape.mapping.thinking, team: plan.shape.mapping.workflow.mode, mode: plan.shape.mapping.mode };
+    let native: any;
+    try {
+      native = await restartNative(sessionId, live, binding, true, plan.shape);
+      // The runtime's own word on what it took: Codex answers the model it resumed (or started) the thread with.
+      if (live.runtimeKind === 'codex' && native?.model !== to.model) throw new ConversationError('native_refused', typeof native?.model === 'string' ? `Codex continued the conversation with ${native.model}, not ${to.model}` : `Codex did not say which model it continued the conversation with, so ${to.model} is not taken`);
+    } catch (error) {
+      runLog(rootOf(sessionId), { event: 'session.configure_failed', sessionId, agent, from, to, error: errorData(error).message });
+      // The session keeps its configuration: a process with it restarts on the same conversation.
+      try {
+        if (live.closed) throw error;
+        await restartNative(sessionId, live, binding, false);
+      } catch (reopen) {
+        // Neither starts: the session fails as a provider failure does; its record keeps the old configuration.
+        live.pending = false;
+        if (!live.closed) failSession(sessionId, live, reopen);
+      }
+      if (error instanceof ConversationError) throw error;
+      throw new ConversationError('native_refused', `The runtime did not take the new configuration; the session keeps its own: ${errorData(error).message}`);
+    }
+    live.mapping = plan.shape.mapping;
+    live.graph = plan.shape.graph;
+    live.spec = plan.shape.spec;
+    // Only Codex answers what it resumed with (its effort applies from the next turn/start); Claude's answer is ALP's own echo.
+    const answered = live.runtimeKind === 'codex' ? { ...(typeof native?.model === 'string' ? { model: native.model } : {}), ...(typeof native?.reasoningEffort === 'string' ? { reasoningEffort: native.reasoningEffort } : {}) } : undefined;
+    runLog(rootOf(sessionId), { event: 'session.configured', sessionId, agent, changes: plan.changes, from, to, threadId: live.threadId, ...(answered ? { native: answered } : {}) });
+    if (plan.changes.includes('team')) {
+      // The old team's supervisor ends at this boundary (it reviews nothing: restartRefusal saw to it);
+      // the new team's, if it has one, starts beside the root as at open.
+      const old = live.supervisor;
+      if (old) { live.supervisor = undefined; await closeSession(old).catch(() => {}); }
+      if (supervises(live)) void enqueue(() => openSupervisor(sessionId));
+    }
+    const updated = snapshot(sessionId, live);
+    const result: ConfigureResult = {
+      session: updated, effective: { ...plan.proposed, ...(live.instructionsSha ? { instructionsSha: live.instructionsSha } : {}) }, status: 'applied', restarted: true,
+      ...(answered ? { native: answered } : {}),
+    };
+    await persist(result);
+    emit(sessionId, { type: 'session.updated', session: updated });
+    return result;
+  }
+
+  /** branch(): makes the native conversation a fork or rewind continues; see AlpRuntime.branch. */
+  async function branchConversation(request: BranchRequest): Promise<NativeBinding> {
+    if (closed) throw new Error('Runtime is closed');
+    if (request.runtime !== 'codex' && request.runtime !== 'claude') throw new ConversationError('runtime_unsupported', `${label(request.runtime)} sessions cannot be forked or rewound`);
+    if (!Array.isArray(request.turns) || !request.turns.every(turn => typeof turn === 'string')) throw new Error('branch needs the source turns in order');
+    if (typeof request.source?.threadId !== 'string' || !request.source.threadId) throw new Error('branch needs the source thread');
+    if (typeof request.model !== 'string' || !request.model || !modes.some(candidate => candidate.id === request.mode)) throw new Error('branch needs the model and mode the branch keeps');
+    return request.runtime === 'codex' ? branchCodex(request) : branchClaude(request);
+  }
+
+  /**
+   * A Codex fork, persisted at once (thread/fork), in a short-lived app-server like recall's. The fork
+   * keeps the request's model and settings (Codex otherwise forks with its defaults) and is verified to
+   * end at the expected turn; one that does not is deleted. The source thread is never changed.
+   */
+  async function branchCodex(request: BranchRequest): Promise<NativeBinding> {
+    const end = codexForkEnd(request);
+    const cwd = request.targetCwd ?? request.cwd;
+    const mode = request.mode;
+    const transport = createTransport(options, 'codex', cwd, nativeEnvironment(options));
+    try {
+      try { await transport.initialize(); }
+      catch (error) { throw new ConversationError('native_refused', `Codex did not start: ${errorData(error).message}`); }
+      let forked: any;
+      try {
+        forked = await transport.request('thread/fork', {
+          threadId: request.source.threadId, ...end.params, ephemeral: false, excludeTurns: true, cwd,
+          model: request.model.replace(/^codex:/, ''),
+          sandbox: mode === 'full-access' ? 'danger-full-access' : nativeMode({ mode, copy: false }),
+          approvalPolicy: codexApproval({ mode, permissions: null }),
+        });
+      } catch (error) { throw codexForkRefusal(error); }
+      const id = forked?.thread?.id;
+      // Forked, but under an id ALP cannot read: it may exist, and nothing can be said of it.
+      if (typeof id !== 'string' || !id) throw new ConversationError('native_refused', 'Codex answered the fork without a thread id', { outcomeUnknown: true });
+      let problem: string | undefined;
+      try {
+        if (forked.thread.forkedFromId != null && forked.thread.forkedFromId !== request.source.threadId) problem = `it was forked from ${forked.thread.forkedFromId}`;
+        else {
+          const page = await transport.request('thread/turns/list', { threadId: id, limit: 1, sortDirection: 'desc' });
+          const last = page?.data?.[0];
+          if (last?.id !== end.last) problem = `it ends at ${last?.id ?? 'no turn'}, not ${end.last}`;
+          else if (last.status === 'inProgress') problem = `its last turn ${last.id} is still running`;
+        }
+      } catch (error) { problem = `it could not be read: ${errorData(error).message}`; }
+      if (!problem) return { threadId: id };
+      const deleted = await transport.request('thread/delete', { threadId: id }).then(() => true, () => false);
+      throw new ConversationError('native_refused', `The Codex fork ${id} could not be verified (${problem}); ${deleted ? 'it was deleted' : 'deleting it failed'}`, { outcomeUnknown: !deleted });
+    } finally {
+      await transport.close().catch(() => {});
+    }
+  }
+
+  /**
+   * A Claude branch, without touching Claude: the cut is validated against the transcript and returned
+   * as a binding whose first prompt makes the fork (resume + forkSession at `at`, under the new id).
+   * A source that is itself still a pending fork stands for its base cut at its own `at`.
+   */
+  async function branchClaude(request: BranchRequest): Promise<NativeBinding> {
+    const transport = createTransport(options, 'claude', request.cwd, nativeEnvironment(options));
+    try {
+      const read = async (threadId: string): Promise<ChainEntry[]> => {
+        const answer = await transport.request('thread/chain', { threadId, cwd: request.cwd });
+        if (!Array.isArray(answer?.entries)) throw new Error('Claude answered no transcript');
+        return answer.entries;
+      };
+      await transport.initialize();
+      let source = request.source.threadId;
+      let chain = await read(source);
+      if (!chain.length && request.source.base) {
+        source = request.source.base.threadId;
+        chain = pendingChain(request.source.base, await read(source));
+      }
+      return { threadId: randomUUID(), base: { threadId: source, at: claudeCut(chain, request) } };
+    } catch (error) {
+      if (error instanceof ConversationError) throw error;
+      throw new ConversationError('native_refused', `The Claude transcript could not be read: ${errorData(error).message}`);
+    } finally {
+      await transport.close().catch(() => {});
+    }
+  }
+
   /** Why recovered sessions were reopened, for what they are told. */
   const restartCause = () => options.previousExit?.kind === 'crash' ? 'alpd stopped unexpectedly' : 'alpd restarted';
 
@@ -3136,8 +3851,9 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
         assignment.taskId = entry.taskId;
         touchTask(entry.rootId, entry.taskId);
       }
-      await openSession(id, { ...spec, restore: { agent: entry.agent, threadId: entry.threadId, runtime: entry.runtime, model: entry.model, workflow: parent.mapping.workflow } }, 'skip', entry.delegation);
-      const child = sessions.get(id)!;
+      await openSession(id, { ...spec, restore: { agent: entry.agent, threadId: entry.threadId, runtime: entry.runtime, model: entry.model, workflow: parent.mapping.workflow } }, 'skip', entry.delegation, assignment);
+      const child = assignmentSessions.get(assignment)!;
+      if (sessions.get(id) !== child) throw new Error('Child session was replaced during recovery');
       child.settle = (state, error) => void finishAssignment(entry.parentId, parent, assignment, state, error);
       if (entry.brief) child.brief = entry.brief;
       if (assignment.taskId && writes(entry.mode)) {
@@ -3158,6 +3874,11 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
 
   /** An assignment an earlier alpd left running that cannot continue: its task goes back to open, its work stays on its branch. */
   async function abandonEntry(entry: LiveEntry, reason: string) {
+    if (entry.worktree || writes(entry.mode)) await assignmentResults.put({
+      assignmentId: entry.assignmentId,
+      checkout: entry.worktree?.checkout ?? entry.lease ?? entry.spec.writeRoot ?? entry.spec.workdir ?? entry.project,
+      ...(entry.worktree ? { worktree: entry.worktree.path } : {}),
+    });
     await inFlight.remove(entry.assignmentId);
     const parent = sessions.get(entry.parentId);
     let task: Record<string, unknown> | undefined;
@@ -3204,7 +3925,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       : '';
     const proceed = (sessionId: string, session: Session, text: string) => {
       if (options.recoveryResume === false || pauseOf(session.runtimeKind)) {
-        session.parked = { reason: cause, since: Date.now(), prompt: text };
+        session.parked = { reason: cause, since: Date.now(), prompt: text, ...(options.recoveryResume !== false ? { pause: { scope: paused.all ? 'all' as const : session.runtimeKind } } : {}) };
         emit(sessionId, { type: 'session.updated', session: snapshot(sessionId, session) });
         runLog(rootId, { event: 'assignment.parked', assignmentId: sessionId, agent: session.mapping.agent.name, reason: cause });
         const outcome = outcomes.find(entry => entry.assignmentId === sessionId);
@@ -3223,16 +3944,24 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     if (parkedRoot) {
       root.parked = { reason: parkedRoot, since: Date.now() };
       emit(rootId, { type: 'session.updated', session: snapshot(rootId, root) });
-      if (options.autoResume !== false && options.recoveryResume !== false && !pauseOf(root.runtimeKind)) continueParked(rootId, root);
+      // Legacy persisted reasons carry no pause provenance. Only an explicit session prompt
+      // can release them, including old quota/process parks; never infer scope from text or flags.
     } else if (continueRoot) proceed(rootId, root, `ALP: ${cause} during your turn, and reopened this session. Continue the user's request where you stopped.${listed(resumed.get(rootId))}`);
     else for (const assignment of resumed.get(rootId) ?? []) post(rootId, { kind: 'note', from: assignment.agent, assignment: assignment.id, passive: true, body: `${cause}; ALP reopened this assignment and it continues. It reports when done.` });
     const failed = outcomes.filter(outcome => outcome.outcome === 'failed');
-    if (entries.length || continueRoot) {
-      const parked = outcomes.some(outcome => outcome.outcome === 'parked') || (continueRoot && !!root.parked);
+    if (entries.length || continueRoot || parkedRoot) {
+      const parked = outcomes.flatMap(outcome => {
+        const park = outcome.outcome === 'parked' ? sessions.get(outcome.assignmentId)?.parked : undefined;
+        return park ? [park] : [];
+      });
+      if ((continueRoot || parkedRoot) && root.parked) parked.push(root.parked);
+      const next = parked.some(park => !park.pause)
+        ? 'send an explicit prompt to each parked session to continue it: alp send <session> --prompt <text>'
+        : 'run alp resume to continue them';
       notice(failed.length ? 'warning' : 'info',
         `ALP: ${cause}${options.previousExit?.at ? ` (around ${options.previousExit.at})` : ''}. ` +
-        `${entries.length - failed.length} of ${entries.length} running assignments reopened${continueRoot ? ', and this session' : ''}` +
-        `${parked ? '; they wait parked: run alp resume to continue them' : ''}.` +
+        `${entries.length - failed.length} of ${entries.length} running assignments reopened${continueRoot || parkedRoot ? ', and this session' : ''}` +
+        `${parked.length ? `; they wait parked: ${next}` : ''}.` +
         `${failed.length ? ` Could not continue: ${failed.map(outcome => `${outcome.agent} ${outcome.assignmentId} (${outcome.error})`).join('; ')}; their tasks went back to open.` : ''}`,
         root.mapping.agent.projectRoot);
     }
@@ -3254,7 +3983,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     return session;
   }
 
-  async function configureSession(sessionId: string, changes: { mode?: string }) {
+  async function configureSession(sessionId: string, changes: { mode?: string }, beforeUpdated?: (session: SessionSnapshot) => Promise<void>) {
     const session = openOf(sessionId);
     if (session.active || session.pending || session.children.size) throw new Error('Wait for the current turn and child sessions to finish before changing permissions');
     const mode = changes.mode ?? session.mapping.mode;
@@ -3270,6 +3999,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     session.mapping.mode = mode;
     session.spec = { ...session.spec, mode };
     const updated = snapshot(sessionId, session);
+    if (beforeUpdated) await beforeUpdated(updated);
     emit(sessionId, { type: 'session.updated', session: updated });
     return updated;
   }
@@ -3286,6 +4016,8 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     session.userStopped = true;
     session.parked = undefined;
     session.parkReason = undefined;
+    session.parkPause = undefined;
+    session.resumeHeld = undefined;
     emit(sessionId, { type: 'session.updated', session: snapshot(sessionId, session) });
     approvalCancellation.set(session, (approvalCancellation.get(session) ?? 0) + 1);
     cancelQuestions(sessionId);
@@ -3304,7 +4036,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
 
     await Promise.all(
       [...session.children].map(
-        closeSession,
+        id => closeSession(id),
       ),
     );
 
@@ -3323,6 +4055,26 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
     }
   }
 
+  // Shared by ordinary prompts and the scheduler's queue-scoped sender.
+  async function promptSession(sessionId: string, input: PromptInput): Promise<void> {
+    const session = sessions.get(sessionId);
+    const parked = session?.parked;
+    try {
+      const prompt = session?.active && session.resumedTurn === session.active && input.delivery === 'auto'
+        ? { ...input, delivery: 'steer' as const } : input;
+      await startPrompt(sessionId, prompt, 'user');
+      if (session && parked && session.parked === parked) {
+        session.parked = undefined;
+        emit(sessionId, { type: 'session.updated', session: snapshot(sessionId, session) });
+      }
+    } catch (error) {
+      const session = sessions.get(sessionId);
+      if (session?.seen.has(input.clientMessageId)) return;
+      session?.seen.add(input.clientMessageId);
+      emit(sessionId, { type: 'prompt.failed', clientMessageId: input.clientMessageId, error: errorData(error) });
+    }
+  }
+
   /** Starts a turn or steers the running one; throws when the prompt was not delivered. */
   async function startPrompt(sessionId: string, prompt: PromptInput, origin: TurnOrigin, wake?: MailEvent[]) {
     const session = openOf(sessionId);
@@ -3335,8 +4087,8 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       return;
     }
 
-    if (prompt.content.some(content => content.type !== 'text' && content.type !== 'image')) {
-      throw new Error('Only text and image prompts are supported');
+    if (prompt.content.some(content => content.type !== 'text' && content.type !== 'image' && content.type !== 'attachment')) {
+      throw new Error('Only text, image and attachment prompts are supported');
     }
     // Inline images only, never a path or URL: the native input gets a data URL ALP builds itself.
     const images = prompt.content.filter(content => content.type === 'image') as Array<{ type: 'image'; mimeType: string; data: string }>;
@@ -3352,6 +4104,27 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       }
     }
 
+    // Attachments (§12.6): descriptors alpd resolved and pinned for this session, never a path. Each
+    // gets a read-only copy staged from alpd's verified bytes before the turn names it.
+    const attached: Array<{ attachment: RuntimeAttachment; staged: string }> = [];
+    const attachmentParts = prompt.content.filter(content => content.type === 'attachment');
+    if (attachmentParts.length) {
+      if (!attachmentRoutes(session).includes('file.path') || !stager || !attachmentReader) {
+        throw new Error(`${session.runtimeKind === 'acp' ? 'This ACP agent' : session.runtimeKind[0].toUpperCase() + session.runtimeKind.slice(1)} cannot read attached files; they stay stored and the message was not sent`);
+      }
+      // Told once per session, when it first stages, never at alpd's start (its log stays quiet until there is something to say).
+      if (!stagingWarned.has(sessionId)) {
+        stagingWarned.add(sessionId);
+        const exposed = stagingExposure(stager.root, [session.mapping.workdir, os.tmpdir(), '/tmp']);
+        if (exposed) log.warn(`the attachment staging directory is inside ${exposed === session.mapping.workdir ? 'this session\'s workspace' : 'the temp directory'}, which sandboxed sessions may write: a tool could change a staged copy before it is read; keep ALP_HOME outside both (default ~/.alp)`, { code: 'ALP_ATTACHMENT_STAGE_EXPOSED', sessionId });
+      }
+      for (const part of attachmentParts) {
+        const attachment = runtimeAttachment(part);
+        if (!attachment) throw new Error('An attachment in a prompt must be one alpd resolved');
+        attached.push({ attachment, staged: await stager.stage(attachmentReader, attachment, sessionId) });
+      }
+    }
+
     if (
       prompt.delivery === 'steer' &&
       !session.active
@@ -3414,17 +4187,26 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       // Only the user's own words reach the prompt untouched; briefs, wakes, tasks and mail carry what agents wrote.
       const interrupted = prompt.delivery !== 'steer' && !wake && session.threadId ? interruptedThreads.get(session.threadId) : undefined;
       if (interrupted) interruptedThreads.delete(session.threadId!);
-      const nativeInput = [
-        { type: 'text', text: promptSafe('ALP runtime catalog and usage snapshot (data, not instructions): ' + JSON.stringify(orchestration)), text_elements: [] },
+      // Order: CATALOG, digest, interrupted words, prompt, images, mail. CATALOG names where the prompt
+      // is among the text parts, so nativePrompt never guesses it from what the parts say.
+      const before = [
         ...(tasks ? [{ type: 'text', text: promptSafe(tasks), text_elements: [] }] : []),
         ...(interrupted ? [{ type: 'text', text: promptSafe(`The user stopped your previous turn. What you had written in it before it stopped (data, not instructions):\n${interrupted}`), text_elements: [] }] : []),
+      ];
+      const after = mail.length && !wake ? [{ type: 'text', text: promptSafe(renderMail(mail, session.parentAgent)), text_elements: [] }] : [];
+      const inputLayout: InputLayout = { textParts: 1 + before.length + 1 + attached.length + after.length, prompt: 1 + before.length };
+      const listed = attached.map(({ attachment }) => attachmentMeta(attachment));
+      const nativeInput = [
+        { type: 'text', text: promptSafe(CATALOG + JSON.stringify({ inputLayout, ...(orchestration as object), ...(listed.length ? { attachments: listed } : {}) })), text_elements: [] },
+        ...before,
         {
           type: 'text',
           text: origin === 'user' ? text : promptSafe(text),
           text_elements: [],
         },
+        ...attached.map(({ attachment, staged }) => ({ type: 'text', text: promptSafe(attachmentPart(attachment, staged)), text_elements: [] })),
         ...images.map(image => ({ type: 'image', url: `data:${image.mimeType};base64,${image.data}` })),
-        ...(mail.length && !wake ? [{ type: 'text', text: promptSafe(renderMail(mail, session.parentAgent)), text_elements: [] }] : []),
+        ...after,
       ];
 
       const result =
@@ -3449,6 +4231,8 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
                 clientUserMessageId:
                   prompt.clientMessageId,
                 input: nativeInput,
+                // Codex keeps a turn's model and effort for later turns too; ALP names both on every turn (§12.9).
+                ...(session.runtimeKind === 'codex' ? { model: session.mapping.model } : {}),
                 effort:
                   session.mapping.thinking,
                 approvalPolicy: codexApproval(session.mapping),
@@ -3484,7 +4268,9 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
           id: `user:${prompt.clientMessageId}`,
           clientMessageId: prompt.clientMessageId,
           text,
+          origin,
           ...(images.length ? { images: images.length } : {}),
+          ...(listed.length ? { attachments: listed } : {}),
         },
       });
       if (origin === 'user' && !session.parent) session.userWaiting ??= Date.now();
@@ -3533,6 +4319,83 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
   if (options.recallFile) void forgetExpired();
 
   return {
+    registerWorkspace: directory => enqueue(async () => {
+      try { await assignmentResults.register(await realpath(directory)); }
+      catch (error) { refuseMutation('workspace_assignment_result', error instanceof Error ? error.message : 'Cannot register workspace result ownership'); }
+    }),
+    withWorkspaceMutation: <T>(directory: string, run: () => Promise<T>): Promise<T> => {
+      // Reserve before enqueue/await: in-flight admission causes refusal, future admission cannot start.
+      if (workspaceMutation || admitting) return Promise.reject(new WorkspaceMutationError('workspace_busy', 'A session or assignment is opening; retry after it finishes'));
+      workspaceMutation = true;
+      return enqueue(async () => {
+          const target = await realpath(directory).catch(() => refuseMutation('workspace_busy', `Cannot resolve workspace ${directory}; inspect its directory before removing it`));
+          let resultLedger: Awaited<ReturnType<typeof assignmentResults.inspect>>;
+          try { resultLedger = await assignmentResults.inspect(); }
+          catch (error) { refuseMutation('workspace_assignment_result', error instanceof Error ? error.message : 'Cannot inspect permanent assignment results'); }
+          if (!resultLedger!.workspaces.includes(target)) refuseMutation('workspace_assignment_result', 'Workspace predates authoritative assignment tracking; an audited migration is required before removal');
+          const canonical = (value: string): string => {
+            try { return realpathSync(value); }
+            catch (error) {
+              if ((error as NodeJS.ErrnoException).code !== 'ENOENT') refuseMutation('workspace_assignment_result', `Cannot resolve assignment path ${value}; inspect it before removing the workspace`);
+              const parent = path.dirname(value);
+              if (parent === value) throw error;
+              return path.join(canonical(parent), path.basename(value));
+            }
+          };
+          const overlaps = (value: string | undefined) => {
+            if (value === undefined) return false;
+            if (typeof value !== 'string' || !value) refuseMutation('workspace_assignment_result', 'Invalid assignment path; repair runtime persistence before removing the workspace');
+            if (!path.isAbsolute(value)) refuseMutation('workspace_assignment_result', 'Assignment path is not absolute; inspect runtime persistence before removing the workspace');
+            const owner = canonical(value);
+            const contains = (parent: string, child: string) => {
+              const relative = path.relative(parent, child);
+              return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+            };
+            return contains(target, owner) || contains(owner, target);
+          };
+          for (const entry of resultLedger!.results) if (overlaps(entry.checkout) || overlaps(entry.worktree)) refuseMutation('workspace_assignment_result', `Resolve permanent assignment result ${entry.assignmentId} before removing ${directory}`);
+          for (const [project, pins] of loadedBoards) for (const pin of pins) {
+            if (pin.kind === 'claim' && live(pin) && pin.paths?.some(value => overlaps(path.resolve(project, value)))) refuseMutation('workspace_claimed', `Release claim ${pin.id} before removing ${directory}`);
+          }
+          for (const [checkout, holder] of leases) if (overlaps(checkout)) refuseMutation('workspace_leased', `Assignment ${holder.assignment} holds a write lease in ${directory}`);
+          for (const [id, session] of sessions) {
+            for (const assignment of session.assignments.values()) {
+              if (overlaps(assignment.worktree?.path) || overlaps(assignment.worktree?.checkout) || overlaps(assignment.copy?.path) || overlaps(assignment.copy?.checkout) || overlaps(assignment.writeCheckout) || overlaps(assignment.lease)) refuseMutation('workspace_assignment_result', `Resolve assignment ${assignment.id} before removing ${directory}`);
+            }
+            for (const [assignmentId, pending] of session.worktrees) if (overlaps(pending.worktree.path) || overlaps(pending.worktree.checkout) || overlaps(pending.worktree.workdir)) refuseMutation('workspace_assignment_result', `Merge or preserve assignment ${assignmentId} before removing ${directory}`);
+            if (!session.closed && (overlaps(session.mapping.workdir) || overlaps(session.spec.writeRoot))) refuseMutation('workspace_busy', `Close session ${id} before removing ${directory}`);
+          }
+          const checkLive = (entry: LiveEntry) => {
+            if (overlaps(entry.spec.workdir ?? entry.project) || overlaps(entry.spec.writeRoot) || overlaps(entry.copyOf) || overlaps(entry.lease) || overlaps(entry.worktree?.path) || overlaps(entry.worktree?.checkout) || overlaps(entry.worktree?.workdir)) refuseMutation('workspace_assignment_result', `Resolve recoverable assignment ${entry.assignmentId} before removing ${directory}`);
+          };
+          for (const entry of inFlight.all()) checkLive(entry);
+          for (const entry of inherited) checkLive(entry);
+          // Read disk strictly: the normal books intentionally tolerate damaged records.
+          for (const [file, kind] of [[options.liveFile, 'live'], [options.recallFile, 'recall']] as const) {
+            if (!file) continue;
+            let entries: unknown;
+            try { entries = JSON.parse(await readFile(file, 'utf8')); }
+            catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue; throw new WorkspaceMutationError('workspace_assignment_result', `Cannot inspect ${file}; repair assignment persistence before removing the workspace`); }
+            if (!Array.isArray(entries)) refuseMutation('workspace_assignment_result', `Invalid assignment book ${file}`);
+            for (const entry of entries as any[]) {
+              if (!entry || typeof entry.assignmentId !== 'string' || (kind === 'live' ? !entry.spec || typeof entry.spec !== 'object' || Array.isArray(entry.spec) || typeof entry.project !== 'string' : typeof entry.cwd !== 'string')) refuseMutation('workspace_assignment_result', `Invalid assignment record in ${file}`);
+              if (entry.worktree !== undefined && (!entry.worktree || !['path', 'checkout', 'workdir'].every(key => typeof entry.worktree[key] === 'string'))) refuseMutation('workspace_assignment_result', `Invalid worktree result in ${file}`);
+              if (entry.shared !== undefined && (!entry.shared || typeof entry.shared !== 'object' || Array.isArray(entry.shared))) refuseMutation('workspace_assignment_result', `Invalid shared result in ${file}`);
+              if (kind === 'live') checkLive(entry);
+              else if (overlaps(entry.cwd) || overlaps(entry.shared?.writeRoot)) refuseMutation('workspace_assignment_result', `Preserve retained assignment ${entry.assignmentId} before removing ${directory}`);
+            }
+          }
+          for (const entry of await recalls.all()) if (overlaps(entry.cwd) || overlaps(entry.shared?.writeRoot)) refuseMutation('workspace_assignment_result', `Preserve retained assignment ${entry.assignmentId} before removing ${directory}`);
+          return await run();
+      }).finally(() => { workspaceMutation = false; });
+    },
+    bindSchedules(handler: ScheduleHandler | undefined) { scheduleHandler = handler; },
+    bindAttachments(reader: AttachmentReader | undefined) { attachmentReader = reader; },
+    takesAttachments(sessionId: string) {
+      const session = sessions.get(sessionId);
+      return !!session && !session.closed && attachmentRoutes(session).includes('file.path');
+    },
+    async dropAttachment(attachmentId: string) { await stager?.drop(attachmentId); },
     onEvent(listener) {
       listeners.add(listener);
       return () => {
@@ -3548,28 +4411,91 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
       return opened;
     }),
 
-    prompt: (sessionId, input) => enqueue(async () => {
-      const session = sessions.get(sessionId);
-      const parked = session?.parked;
-      try {
-        const prompt = session?.active && session.resumedTurn === session.active && input.delivery === 'auto'
-          ? { ...input, delivery: 'steer' as const } : input;
-        await startPrompt(sessionId, prompt, 'user');
-        if (session && parked && session.parked === parked) {
-          session.parked = undefined;
-          emit(sessionId, { type: 'session.updated', session: snapshot(sessionId, session) });
+    prompt: (sessionId, input) => enqueue(() => promptSession(sessionId, input)),
+
+    withIdlePrompt: (sessionId, run) => new Promise((resolve, reject) => {
+      void enqueue(async () => {
+        const session = openOf(sessionId);
+        if (session.active || session.pending || session.lifecycleHolds || session.mail.some(event => event.deliveredTurn === STARTING)) { resolve({ busy: true }); return; }
+        // Expose the reservation to lifecycle operations before any durable write can yield.
+        admittedPrompts.add(sessionId);
+        // Keep newly arriving mail unreserved until this admitted prompt has finished preparation.
+        session.lifecycleHolds = (session.lifecycleHolds ?? 0) + 1;
+        let valid = true;
+        let used = false;
+        let sending: Promise<void> | undefined;
+        try {
+          const value = await run(input => {
+            if (!valid || used) return Promise.reject(new Error('The admitted prompt sender is no longer available'));
+            used = true;
+            sending = promptSession(sessionId, input);
+            return sending;
+          });
+          resolve({ busy: false, value });
+        } catch (error) {
+          reject(error);
+        } finally {
+          valid = false;
+          // A timeout of the caller cannot release the queue while its native start is outstanding.
+          try { await sending; }
+          finally {
+            admittedPrompts.delete(sessionId);
+            session.lifecycleHolds = Math.max(0, (session.lifecycleHolds ?? 1) - 1);
+            if (!session.lifecycleHolds && !session.closed && session.wakeHeld) {
+              session.wakeHeld = false;
+              deliver(sessionId, session);
+            }
+          }
         }
-      } catch (error) {
-        const session = sessions.get(sessionId);
-        if (session?.seen.has(input.clientMessageId)) return;
-        session?.seen.add(input.clientMessageId);
-        emit(sessionId, { type: 'prompt.failed', clientMessageId: input.clientMessageId, error: errorData(error) });
-      }
+      }).catch(reject);
     }),
 
     interrupt: sessionId => enqueue(() => interruptSession(sessionId)),
+    interruptTurn: (sessionId, turnId) => enqueue(async () => {
+      // Compare in the same admission slot as the cancellation, before any side effect or await.
+      if (sessions.get(sessionId)?.active !== turnId) return false;
+      await interruptSession(sessionId);
+      return true;
+    }),
 
-    configure: (sessionId, changes) => enqueue(() => configureSession(sessionId, changes)),
+    configure: (sessionId, changes, options) => enqueue(() => configureSession(sessionId, changes, options?.onApplied)),
+
+    branch: request => branchConversation(request),
+
+    rebind: (sessionId, binding) => enqueue(() => rebindSession(sessionId, binding)),
+
+    reload: sessionId => enqueue(() => reloadSession(sessionId)),
+
+    previewConfigure: (sessionId, changes) => previewConfigureSession(sessionId, changes),
+
+    reconfigure: (sessionId, changes, options) => enqueue(() => reconfigureSession(sessionId, changes, options)),
+
+    starting: sessionId => {
+      const session = sessions.get(sessionId);
+      return !!session && !session.closed && (admittedPrompts.has(sessionId) || !!session.pending || session.mail.some(event => event.deliveredTurn === STARTING));
+    },
+
+    hold: sessionId => {
+      const session = sessions.get(sessionId);
+      if (!session || session.closed) return undefined;
+      session.lifecycleHolds = (session.lifecycleHolds ?? 0) + 1;
+      let released = false;
+      return () => {
+        if (released) return;
+        released = true;
+        session.lifecycleHolds = Math.max(0, (session.lifecycleHolds ?? 1) - 1);
+        if (session.lifecycleHolds || session.closed) return;
+        // Parked work a resume reached during the hold continues now; paused again, it waits for that resume.
+        if (session.resumeHeld) {
+          const expected = session.resumeHeld;
+          session.resumeHeld = undefined;
+          if (session.parked === expected) return continueParked(sessionId, session, expected);
+        }
+        if (session.parked || pauseOf(session.runtimeKind) || !session.wakeHeld) return;
+        session.wakeHeld = false;
+        deliver(sessionId, session);
+      };
+    },
 
     close: sessionId => enqueue(async () => {
       openOf(sessionId);
@@ -3742,7 +4668,7 @@ export function createAlpRuntime(options: RuntimeOptions = {}): AlpRuntime {
 
       await Promise.all(
         [...sessions.keys()].map(
-          closeSession,
+          id => closeSession(id),
         ),
       );