@farmslot/protocol 0.21.0 → 0.26.0

package/dist/contracts/runs.d.ts

@@ -1,14 +1,18 @@
 import type { ArtifactRef, SelfReviewIssue } from '../recipes/step-io.js';
 import type { WorkerSignalChecklistEvent, WorkerSignalChecklistTiming } from '../transport/signal.js';
-import type { AgentContext, SafetyTier, ScriptedRunnerConfig } from './agents.js';
+import type { AgentContext, AgentContextTarget, RunnerSessionArchiveRef, SafetyTier, ScriptedRunnerConfig } from './agents.js';
 import type { FailureCategory, RunRecoveryProposalConfidence } from './chat.js';
 import type { TaskTemplateSelection, TemplateProvenance } from './evals.js';
 import type { EvidenceQualityReport, RecipeQualityArtifact } from './recipes.js';
+import type { ResourcePostureWaitPolicy, RunResourcePostureState } from './resource-posture.js';
+import type { ResourceType } from './resources.js';
 import type { RunImportProvenance } from './run-bundles.js';
+import type { RuntimeCapabilityProofRequirement } from './runtime-capabilities.js';
 import type { SlotHealth } from './slots.js';
 import type { ProfileFitSuggestion, ValidationPlanStep } from './validation-plan.js';
 export type RunStatus = 'created' | 'grading' | 'writing-task' | 'slot-finding' | 'preparing' | 'dispatching' | 'monitoring' | 'self-reviewing' | 'completing' | 'human-gating' | 'ci-watching' | 'paused' | 'done' | 'blocked' | 'failed' | 'cancelled';
 export declare const TERMINAL_RUN_STATUSES: readonly RunStatus[];
+export declare const ACTIVE_RUN_STATUSES: readonly RunStatus[];
 export declare function isTerminalRunStatus(status: RunStatus): boolean;
 /**
  * Runs eligible for activate-on-slot re-bind (ADR-024 §7 addendum): terminal
@@ -89,12 +93,17 @@ export interface ReviewGatePayload {
     qualityReport?: EvidenceQualityReport | null;
     workerLearnings?: string;
 }
+/** Review evidence retained independently of the decision to publish it. */
+export type RunReviewResult = Pick<ReviewGatePayload, 'recommendation' | 'reviewMd' | 'lineComments' | 'reviewSnapshot' | 'artifactManifest' | 'reviewInputArtifactPaths'>;
 export type PublicationTarget = 'draft' | 'ready';
 export type PublicationStatus = 'not_published' | 'pending_publish' | 'published_draft' | 'published_ready' | 'publish_failed';
 export interface ReviewDepthPolicy {
     minimumIndependentReviews: number;
     requireCrossRunner: boolean;
+    /** Independent review loops required beyond `minimumIndependentReviews`. */
     extraLoopsRequested: number;
+    /** V2 counts the first configured loop in the minimum, not again as an extra. */
+    countingVersion?: 2;
     requestedBy: 'dispatch' | 'human-gate' | 'agent-gate';
 }
 /**
@@ -119,7 +128,7 @@ export declare function reviewValidationDepthForLoop(_index: number, _total: num
 export type ReviewSessionIntent = 'resume' | 'reset';
 /** What actually happened when the reviewer generation launched. */
 export type ReviewSessionContinuity = 'fresh' | 'resumed' | 'fallback-fresh' | 'resume-unconfirmed';
-export type ReviewSessionFallbackReason = 'unsupported-runner' | 'slot-mismatch' | 'runner-mismatch' | 'missing-session' | 'session-unavailable';
+export type ReviewSessionFallbackReason = 'unsupported-runner' | 'slot-mismatch' | 'runner-mismatch' | 'model-mismatch' | 'missing-session' | 'session-unavailable';
 export interface ReviewSessionTrace {
     intent: ReviewSessionIntent;
     continuity: ReviewSessionContinuity;
@@ -259,6 +268,8 @@ export interface IndependentReviewAttempt {
     issues?: SelfReviewIssue[];
     validationDepth?: ReviewValidationDepth;
     usage?: RunnerSessionUsage;
+    /** Checklist marks and timings captured from this review round's role-scoped signal. */
+    checklistTiming?: WorkerSignalChecklistTiming;
     reviewSnapshot?: ReviewDiffSnapshot;
     fixDelta?: ReviewFixDeltaSnapshot;
     artifactPaths?: string[];
@@ -917,6 +928,11 @@ export interface RunMetrics {
     runner: string | null;
     runnerSessionId?: string | null;
     runnerSessionPath?: string | null;
+    /**
+     * Recycle snapshot of the primary runner transcript. Pointer only; the bytes
+     * live under `.runs/session-archives/`. Not eval evidence and not a farmrun payload.
+     */
+    runnerSessionArchive?: RunnerSessionArchiveRef;
     /**
      * Operator-local provider subscription label that actually funded this run
      * (after any in-place failover). Label only — never an email, token, or home path.
@@ -1050,23 +1066,62 @@ export interface RunMonitorBudgetUsageState {
     integrityFailureReason?: string;
     /** True while advancing past a record larger than the bounded read window. */
     skippingOversizedRecord?: boolean;
+    /** Count of records skipped for exceeding the window (their usage is uncounted). */
+    skippedOversizedRecords?: number;
+    /**
+     * Last session-total reading for runners that restate totals rather than reporting
+     * per-record usage (codex). Zeros mean counting from the start of the transcript;
+     * absent means counting started at a byte offset, so the next reading only sets the
+     * reference.
+     */
+    lastCumulative?: {
+        input: number;
+        output: number;
+        cacheRead: number;
+        total: number;
+    };
+    /** Discard the next complete record: it is the previous writer's in-flight record. */
+    discardNextRecord?: boolean;
+    /** Filesystem identity of the counted transcript; path equality is not identity. */
+    fileId?: string;
     /**
-     * First successful sample for this monitor session (warm-handoff parent totals
-     * or cold-start initial point). Soft ceilings apply to (turns - baselineTurns).
+     * True once counting has been deliberately anchored at a byte offset (a warm-handoff
+     * pin). Providers report increments, so there is no total to subtract.
      */
     baselineCaptured?: boolean;
+    /** Legacy: parent totals the pre-increment guard subtracted. Migrated on restore. */
     baselineTurns?: number;
     baselineTotalTokens?: number;
 }
+/** Persisted form of the budget guard's delivery state machine. */
+export interface RunBudgetDeliveryState {
+    phase: 'ok' | 'breach-pending' | 'delivered' | 'abandoned' | 'unenforceable';
+    pendingMessage: string | null;
+    operatorMessage: string | null;
+    attempts: number;
+    firstHeldAt?: number;
+}
 export interface RunMonitorState {
     nudgeCount: number;
     lastPollAt: string;
     startedAt: string;
     lastPaneHash?: string;
+    /** ISO time of last structured runner progress; used to restore stuck clocks. */
+    lastStructuredProgressAt?: string;
     /** True after a one-shot usage-budget warning was emitted for this monitor session. */
     budgetWarned?: boolean;
     /** True after a budget nudge was confirmed delivered (may retry while false). */
     budgetNudgeSent?: boolean;
+    /**
+     * Delivery attempts made for the budget nudge. Retries stop at
+     * MAX_BUDGET_NUDGE_ATTEMPTS so an unconfirmable pane cannot accumulate copies
+     * of the warning in the runner composer.
+     */
+    budgetNudgeAttempts?: number;
+    /** Epoch ms of the first mid-turn deferral of a pending budget warning. */
+    budgetFirstDeferredAt?: number;
+    /** The budget guard's delivery state. Supersedes the flags below. */
+    budgetDelivery?: RunBudgetDeliveryState;
     /** Append-only transcript sample cache for the soft budget guard. */
     budgetUsage?: RunMonitorBudgetUsageState;
 }
@@ -1162,8 +1217,415 @@ export declare function normalizeRunTags(values: readonly string[] | undefined |
  */
 export declare const DOMAIN_NAME_RE: RegExp;
 export declare function isValidDomainName(value: string): boolean;
+export type MachinePauseMode = 'orchestration' | 'release';
+/** Durable checkpoints used to resume an interrupted park/restore operation. */
+export type MachineParkPhase = 'intent-persisted' | 'orchestration-pausing' | 'orchestration-paused' | 'runner-stopping' | 'runner-stopped' | 'resources-stopping' | 'parked' | 'resources-restoring' | 'runner-reloading' | 'orchestration-resuming' | 'restored' | 'cancelling' | 'partial' | 'failed' | 'cancelled';
+export type MachineParkResourcePhase = 'observed-running' | 'stopping' | 'stopped'
+/** Left running on purpose because the catalog says releasing never stops it, and verified still running at settle. */
+ | 'retained' | 'restoring' | 'restored' | 'failed';
+export type MachineParkCapabilityLeaseState = 'held' | 'releasing' | 'released' | 'reacquiring' | 'reacquired' | 'failed';
+export interface MachineParkCapabilityLease {
+    leaseId: string;
+    /** Lease created when restore reacquires this capability; differs from the released lease id. */
+    restoredLeaseId?: string;
+    capabilityId: string;
+    state: MachineParkCapabilityLeaseState;
+    parameters: Record<string, unknown>;
+    proofRequirement: RuntimeCapabilityProofRequirement;
+    ownerFamilyId?: string;
+    /** Optional provider-resource association; leases remain first-class manifest entries. */
+    resourceId?: string;
+    error?: string;
+}
+/** Parking's factual disposition for one manifest resource. */
+export type MachineParkResourceReleaseEffect = 'stop' | 'retain';
+/** One resource that was observed running when release-pause intent was captured. */
+export interface MachineParkResource {
+    resourceId: string;
+    label: string;
+    type: ResourceType;
+    observedStatus: 'running';
+    phase: MachineParkResourcePhase;
+    /**
+     * What parking does to this resource, resolved from the project catalog's
+     * affected-resource metadata. `stop` shuts it down and restore boots it back;
+     * `retain` leaves it running and restore only verifies it never stopped.
+     * Absent on records journalled before the metadata existed; read it as `stop`.
+     */
+    releaseEffect?: MachineParkResourceReleaseEffect;
+    capabilityLeaseIds: string[];
+    stoppedAt?: string;
+    restoredAt?: string;
+    error?: string;
+}
+/** What restore did to one resource, emitted by the code path that did it. */
+export type MachineParkRestoreAction = 'verified' | 'booted' | 'stopped' | 'skipped';
+/**
+ * One lifecycle effect a restore performed, recorded as fact rather than
+ * inferred from the absence of an error. A successful boot leaves no error
+ * behind, so "no boot error" can never prove no boot happened; this can.
+ */
+export interface MachineParkRestoreEffect {
+    resourceId: string;
+    action: MachineParkRestoreAction;
+    /** Gateway clock, when the effect was performed or observed. */
+    at: string;
+    /** False when the action failed, or when it happened and should not have. */
+    ok: boolean;
+    reason?: string;
+}
+export interface MachineParkResourceManifest {
+    capturedAt: string;
+    resources: MachineParkResource[];
+    capabilityLeases: MachineParkCapabilityLease[];
+}
+/** Exact persisted runner identity required to restore a released worker. */
+export interface MachinePauseRecoveryHandle {
+    version: 1;
+    runnerId: string;
+    contextId: string;
+    sessionId: string;
+    sessionPath: string;
+    target: AgentContextTarget & {
+        paneId: string;
+    };
+    model: string | null;
+    effort?: string | null;
+    safetyTier?: SafetyTier;
+    runtimeDir?: string;
+    taskDir?: string;
+    capturedAt: string;
+}
+export interface MachineParkError {
+    phase: MachineParkPhase;
+    action: string;
+    code: string;
+    message: string;
+    occurredAt: string;
+    retryable: boolean;
+    resourceId?: string;
+}
+export type MachineParkResidualState = 'running' | 'stopped' | 'unknown';
+export interface MachineParkResiduals {
+    runner: MachineParkResidualState;
+    resources: Array<{
+        resourceId: string;
+        state: MachineParkResidualState;
+        detail?: string;
+    }>;
+}
+export interface MachineParkCurrentStep {
+    index: number;
+    name: string;
+    status: RunStepStatus;
+}
+/**
+ * What a release-mode park does with the run's slot.
+ *
+ * `retained` keeps the slot bound to the parked run (machine-wide pause of a
+ * monitoring or CI-watching run). `freed` releases slot ownership so dispatch
+ * can select it while the run stays parked at its operator wait — the park
+ * record, not the slot row, is then the authority for the run's slot binding.
+ * Absent on records written before slot freeing existed; treat as `retained`.
+ */
+export type MachineParkSlotDisposition = 'retained' | 'freed';
+/**
+ * Machine-pause eligibility codes that clients and the Gateway share. Every
+ * other code stays private to the Gateway verdict; these are the gate-park
+ * contract added by the free-slot-at-an-operator-wait decision.
+ */
+export declare const MachineParkEligibilityCodes: {
+    /** A gate-held publication run may be released and its slot freed. */
+    readonly eligibleGateRelease: "ELIGIBLE_GATE_RELEASE_PAUSE";
+    /** The run's runner declares no graceful stop plus persisted session reload. */
+    readonly runnerReloadUnsupported: "RUNNER_RELOAD_UNSUPPORTED";
+    /** A gate-held run can only be parked in release mode; orchestration-only would strand its gate. */
+    readonly gateParkRequiresRelease: "GATE_PARK_REQUIRES_RELEASE";
+    /**
+     * The record freed its slot, so the operation asked for cannot act on the
+     * run until a restore has put it back. Not a refusal of restore itself:
+     * `machine.pause.restore` and gate resolution both drive that restore.
+     */
+    readonly freedSlotRestoreRequired: "FREED_SLOT_RESTORE_REQUIRED";
+    /**
+     * Restore refused: the original slot is no longer free AND no other slot on
+     * the machine could take the run instead. The record stays parked and its
+     * decision stays pending, so the run can be restored later or cancelled.
+     *
+     * Kept as the refusal for the case where re-homing was not even attempted —
+     * the runner cannot carry its session across working directories, or the
+     * record has no preserved workspace to re-home. When a re-home WAS attempted
+     * and every candidate failed a proof, `RESTORE_NO_REHOME_TARGET` says so.
+     */
+    readonly restoreSlotTaken: "RESTORE_SLOT_TAKEN";
+    /**
+     * The original slot was taken, so the restore will put the run into a
+     * DIFFERENT free slot on the same machine. An eligible verdict, not a
+     * refusal: the Gateway picked the target through the same dispatch scoring
+     * that picks a slot for a new run, and the preview names it so the operator
+     * sees where the run is going before answering the gate.
+     */
+    readonly restoreRehomed: "ELIGIBLE_FREED_SLOT_REHOME";
+    /**
+     * Re-home refused: the run's runner scopes its persisted session by working
+     * directory, so the session recorded under the original slot's workspace
+     * could not be resumed from another slot's. Fails closed — a reload that
+     * silently started a FRESH conversation would lose the run's whole context
+     * while reporting a successful restore.
+     */
+    readonly restoreRehomeSessionNotPortable: "RESTORE_REHOME_SESSION_NOT_PORTABLE";
+    /**
+     * Re-home refused: the original slot is taken and no other slot on the
+     * machine passed every read-only eligibility proof. Distinct from
+     * `RESTORE_SLOT_TAKEN`: a re-home WAS attempted, so the operator knows the
+     * machine has no home for this run rather than that the feature declined to
+     * look.
+     */
+    readonly restoreNoRehomeTarget: "RESTORE_NO_REHOME_TARGET";
+    /**
+     * Restore refused: the preserved branch cannot be checked back out — the
+     * successor left uncommitted work in the tree, or the branch no longer sits
+     * at the tip the park detached from.
+     */
+    readonly restoreWorkspaceUnavailable: "RESTORE_WORKSPACE_UNAVAILABLE";
+    /**
+     * Restore refused: the persisted runner session could not be reloaded with a
+     * structured acknowledgement, so nothing may claim the worker is back.
+     */
+    readonly restoreRunnerReloadFailed: "RESTORE_RUNNER_RELOAD_FAILED";
+    /**
+     * The restore had to re-present the gate because its engine loop had exited,
+     * so the decision the operator answered is no longer the live one.
+     */
+    readonly restoreGateReplayed: "RESTORE_GATE_REPLAYED";
+    /**
+     * Freeing the slot would expose the run's workspace to the next occupant's
+     * prepare, and its branch tip could not be preserved first.
+     */
+    readonly workspaceNotPreservable: "WORKSPACE_NOT_PRESERVABLE";
+    /** A gate park is in flight for this run; its gate cannot be resolved yet. */
+    readonly gateParkInFlight: "GATE_PARK_IN_FLIGHT";
+    /**
+     * The runner liveness probe exceeded its fixed budget before it could say
+     * whether the worker is alive. Distinct from `RUNNER_RELOAD_UNSUPPORTED` and
+     * from the gateway's generic recovery-handle refusal: nothing was decided
+     * about this runner's capability, so the operator's own retry is the answer.
+     * `details.probeBudgetMs` carries the budget that elapsed.
+     */
+    readonly runnerLivenessProbeTimeout: "RUNNER_LIVENESS_PROBE_TIMEOUT";
+    /**
+     * The machine-pause preview digest moved between preview and execute, so the
+     * batch the operator reviewed is no longer the batch that would run. A race,
+     * not a verdict about the run: previewing again resolves it.
+     */
+    readonly machinePausePreviewStale: "MACHINE_PAUSE_PREVIEW_STALE";
+};
+export type MachineParkEligibilityCode = (typeof MachineParkEligibilityCodes)[keyof typeof MachineParkEligibilityCodes];
+/**
+ * Structured facts behind an eligibility verdict, for the codes that have one.
+ *
+ * The reason string is prose for an operator; anything a client or a validation
+ * harness has to BRANCH on belongs here instead, so nobody has to parse the
+ * sentence back apart to recover a number the gateway already knew.
+ */
+export interface MachinePauseEligibilityDetails {
+    /** Budget the runner liveness probe exhausted (`RUNNER_LIVENESS_PROBE_TIMEOUT`). */
+    probeBudgetMs?: number;
+}
+/**
+ * The git identity a freeing park took out of the slot's working tree.
+ *
+ * A linked worktree keeps the parked run's branch checked out, and the next
+ * occupant's prepare resets the checked-out branch to its base ref — which
+ * would move the parked branch and discard its commits. The park detaches HEAD
+ * first and records what it detached from, so the branch ref survives at
+ * `headSha` and restore can check it out again.
+ */
+export interface MachineParkWorkspace {
+    branch: string;
+    headSha: string;
+    /**
+     * When the detach actually landed, not when it was planned. Absent means the
+     * branch is still checked out in the slot, so the park had no workspace
+     * effect yet. Same fact-versus-intent split as `slotFreedAt`.
+     */
+    detachedAt?: string;
+}
+/**
+ * A restore that put the run back into a DIFFERENT slot than the park freed.
+ *
+ * Written write-ahead, before the slot claim, for the same reason every other
+ * park transition is: the re-home is two writes — the record's slot binding and
+ * the slot row's owner — and a crash between them must leave the repair path a
+ * marker saying which slot this record is now homed to. `repairRestoreSlotIntent`
+ * reads `toSlotId`, never the journalled snapshot's `slotId`.
+ *
+ * `fromSlotId` is the slot the park freed, and it stays meaningful after the
+ * re-home: the preserved workspace's detached HEAD is still sitting THERE, so
+ * dispatch's detached-HEAD exemption keys on it rather than on the record's
+ * current slot.
+ */
+export interface MachineParkRehome {
+    /** The slot the park freed, whose successor made a same-slot restore impossible. */
+    fromSlotId: string;
+    /** The slot the restore re-bound the run into instead. */
+    toSlotId: string;
+    at: string;
+    /** Why the original could not take the run back — the availability refusal, verbatim. */
+    reason: string;
+}
+/**
+ * The stages a freed-slot restore owes, in the order it owes them.
+ *
+ * Tracked as its own sequence rather than inferred from what the record happens
+ * to look like. Occupancy, the detached branch, the lease states, and the
+ * runner proof each record ONE stage's outcome, so reading them as a whole is a
+ * guess: a restore that re-bound the slot and then died before re-creating the
+ * pane looks, to an occupancy reader, exactly like a restore that never had to
+ * touch the slot at all — and the retry then takes the ordinary path and fails
+ * on a recovery handle nothing re-hosted.
+ */
+export declare const MACHINE_PARK_RESTORE_STAGES: readonly ["rebind", "reattach", "reacquire", "reload"];
+export type MachineParkRestoreStage = (typeof MACHINE_PARK_RESTORE_STAGES)[number];
+/**
+ * How far the current restore attempt got, written around each stage.
+ *
+ * `attempting` is written BEFORE the stage runs and `completed` only after it
+ * lands, so a crash anywhere inside a stage is visible as an unfinished stage
+ * rather than as an absence. The write-ahead journal is kept until every stage
+ * is in `completed`.
+ */
+export interface MachineParkRestoreProgress {
+    /** The restore operation these stages belong to; a newer one starts over. */
+    operationId: string;
+    /** The stage currently being attempted, if any. Cleared when it completes. */
+    attempting?: MachineParkRestoreStage;
+    /** Stages proven complete, in the order they landed. */
+    completed: MachineParkRestoreStage[];
+    updatedAt: string;
+}
+/** Whether every stage a freed-slot restore owes has landed. */
+export declare function machineParkRestoreComplete(progress: MachineParkRestoreProgress | undefined): boolean;
+/**
+ * Why the last restore attempt refused, kept on the record so a reconnecting
+ * client sees the reason without replaying the RPC that produced it.
+ *
+ * A refusal is not a failure of the park: the record stays `parked`, its
+ * decision stays pending, and the run can be restored again later or
+ * cancelled. Cleared the moment a restore gets past the refusal.
+ */
+export interface MachineParkRestoreRefusal {
+    /** A `MachineParkEligibilityCode`; carried as a string like every verdict code. */
+    code: string;
+    reason: string;
+    at: string;
+}
+/** Write-ahead per-run record; persisted on Run before any release side effect. */
+export interface MachineParkRecord {
+    version: 1;
+    operationId: string;
+    previewId: string;
+    runId: string;
+    generation: number;
+    restoredGeneration?: number;
+    machine: string;
+    slotId: string;
+    mode: MachinePauseMode;
+    phase: MachineParkPhase;
+    prePauseStatus: RunStatus;
+    prePauseCurrentStep: MachineParkCurrentStep | null;
+    resourceManifest: MachineParkResourceManifest;
+    recoveryHandle: MachinePauseRecoveryHandle | null;
+    /** Slot intent decided at preview; absent means `retained`. */
+    slotDisposition?: MachineParkSlotDisposition;
+    /**
+     * The workspace a freeing park detached, so the next occupant's prepare
+     * cannot reset the parked run's branch. Written before slot ownership is
+     * released; `restore` checks the branch back out at this exact tip.
+     */
+    preservedWorkspace?: MachineParkWorkspace;
+    /**
+     * When slot ownership was actually released, not merely intended. Set only
+     * after the park stopped the runner and every manifest resource, so a partial
+     * park never advertises a freed slot.
+     *
+     * Kept for the whole restore and cleared only when every restore stage has
+     * landed, so it stays the marker of "this record owes a freed-slot restore".
+     * OCCUPANCY is `slotReboundAt`, which lands earlier: the two are deliberately
+     * separate, because a restore that re-bound the slot and then failed still
+     * owes the rest of its stages.
+     */
+    slotFreedAt?: string;
+    /**
+     * When a restore re-bound the freed slot to this run, not merely intended
+     * to. Written in the same write-ahead window that clears `slotFreedAt`, so a
+     * crash between the slot claim and the record write is repairable. Survives
+     * the restore as the note that this record's slot came back.
+     */
+    slotReboundAt?: string;
+    /**
+     * Set when a restore re-bound a DIFFERENT slot than the park freed, because
+     * the original had been taken. `slotId` above already names the new slot —
+     * this is the note that says it moved, and from where.
+     */
+    rehome?: MachineParkRehome;
+    /**
+     * How far the current restore attempt got. Absent until a freed-slot restore
+     * starts, and the authority for what a retry still owes — never inferred from
+     * whether the run currently occupies its slot.
+     */
+    restoreProgress?: MachineParkRestoreProgress;
+    /**
+     * Why the last restore attempt refused, when it refused without changing
+     * anything. Absent once a restore gets past the refusal.
+     */
+    restoreRefusal?: MachineParkRestoreRefusal;
+    /** Restore intent classification persisted before any selected batch member mutates. */
+    restoreDisposition?: 'zero-effect' | 'effectful';
+    /**
+     * What the last restore attempt actually did to each manifest resource, in
+     * the order it did it. Reset at the start of each attempt. Absent on records
+     * written before restore recorded its effects.
+     */
+    restoreEffects?: MachineParkRestoreEffect[];
+    /** Exact runner-native acknowledgement captured before orchestration resumes. */
+    recoveryProof?: {
+        sessionId: string;
+        live: true;
+        acknowledgement: {
+            /**
+             * How the worker was proven back.
+             *
+             * `structured` — the restore relaunched the session and the runner
+             * acknowledged the continuation prompt: a turn was delivered and started.
+             *
+             * `adopted` — the worker was ALREADY running this run's persisted session
+             * when the restore reached it, so nothing was relaunched and no turn was
+             * delivered. The evidence is the structured live-binding check, not a
+             * prompt acknowledgement, and the two must be distinguishable: a consumer
+             * with only `source` to go on cannot tell a delivered turn from an
+             * inherited one.
+             */
+            kind: 'structured' | 'adopted';
+            source: string;
+            reason: string;
+            /** Present only for `structured`; an adopted worker started no turn. */
+            turnToken?: string;
+        };
+        acceptedAt: string;
+    };
+    errors: MachineParkError[];
+    residuals: MachineParkResiduals;
+    createdAt: string;
+    updatedAt: string;
+    parkedAt?: string;
+    restoredAt?: string;
+    cancelledAt?: string;
+}
 export interface Run {
     id: string;
+    prWork?: import('./pr-monitoring.js').PRWorkReference;
+    prPublications?: import('./pr-monitoring.js').PRPublicationRecord[];
     familyId: string;
     parentRunId?: string | null;
     familyRootTicketOrPr?: string;
@@ -1195,6 +1657,11 @@ export interface Run {
     domain?: string;
     /** Named prepare profile requested for this run (ADR-037). */
     prepareProfile?: string;
+    /**
+     * Dispatch-time resource posture preset (ADR-054). Presets the gate choice for
+     * every durable operator wait of this run; an explicit gate choice still wins.
+     */
+    waitPolicy?: ResourcePostureWaitPolicy;
     /**
      * Branch-update strategy for `update-branch` runs (rebase | merge |
      * project-default). Ignored for other flows. Rendered into the worker task
@@ -1210,6 +1677,15 @@ export interface Run {
     branch: string | null;
     /** Completion side-effect policy; artifact-only suppresses publication/PR mutation paths. */
     completionPolicy?: RunCompletionPolicy;
+    /** Principal-stamped one-dispatch pressure override requested for this run.
+     * Bound to one machine + pressure generation; dispatch execution recomputes
+     * the admission decision and rejects the override when the generation moved. */
+    pressureOverride?: import('./pressure-admission.js').PressureOverrideAudit;
+    /** Preview identity of the admitted pressure decision this run was created
+     * against (client-rendered preview, or FIND_SLOT's selected decision for
+     * automatic runs). Execution rejects with PRESSURE_PREVIEW_STALE when it no
+     * longer matches freshly recomputed evidence. */
+    pressureAdmissionRef?: import('./pressure-admission.js').PressureAdmissionReference;
     /** Requested/resolved base ref for artifact-only comparison replay runs. */
     startRef?: RunStartRefProvenance | null;
     /** Gateway-captured template provenance for the rendered worker task. */
@@ -1229,6 +1705,7 @@ export interface Run {
     mergedAt?: string | null;
     steps: RunStep[];
     decisions: RunDecision[];
+    reviewResult?: RunReviewResult;
     metrics: RunMetrics;
     createdAt: string;
     /** Timestamp when the supervised run lifecycle started. */
@@ -1303,6 +1780,10 @@ export interface Run {
     analyticsEmittedAt?: string;
     /** Present when this run record was imported from a portable bundle (ADR-039). */
     importProvenance?: RunImportProvenance;
+    /** Durable machine-scoped pause/release/restore state. */
+    park?: MachineParkRecord | null;
+    /** Gateway-owned effective resource posture and last transition (ADR-054). */
+    resourcePosture?: RunResourcePostureState;
     /** Imported reference-only runs must not be re-dispatched or activated on slot. */
     readOnly?: boolean;
     /** Slot HEAD SHA captured at dispatch (after prepare) — base for per-run iteration diff. */
@@ -1317,9 +1798,9 @@ export interface RunEngineState {
      * `nudgeReuse` is set when the operator picks "Nudge worker" in the dispatch wizard or the
      * branch-affinity decision card; FIND_SLOT honors it to bind the busy slot, and DISPATCH
      * routes through `nudgeDispatch` (skip PREPARE, send-keys to existing tmux session) instead
-     * of `dispatchExecute` (kill + relaunch). `freshReuse` is the "Kill & dispatch fresh"
-     * sibling — FIND_SLOT hard-kills the prior worker BEFORE PREPARE so git reset / checkout /
-     * dependency install don't race a still-writing worker in the same worktree.
+     * of `dispatchExecute` (kill + relaunch). `freshReuse` replaces either that busy
+     * branch-affinity worker or an unowned warm runner. FIND_SLOT hard-kills it BEFORE PREPARE
+     * so git reset / checkout / dependency install don't race a still-writing worker.
      * `warmSessionReuse` is set on CI-watch chained follow-ups (pr-complete / update-branch)
      * when the parent kept its worker warm through finalize; DISPATCH tries handoff into that
      * session and falls back to fresh `dispatchExecute` when the process is dead or not nudgeable. */
@@ -1345,6 +1826,8 @@ export interface RunEngineState {
     };
     /** Monotonic replay generation counter; startRun bails if the run has been superseded. */
     generation?: number;
+    /** Operator `run.forceComplete` on a failed run. Replay must not treat this as ordinary done. */
+    operatorForceCompleted?: true;
     /** Multi-surface validation matrix suggested at dispatch (farmslot profile-fit). */
     validationPlan?: ValidationPlanStep[];
     profileFitSuggestion?: ProfileFitSuggestion;
@@ -1421,6 +1904,8 @@ export interface RunCiWatchState {
     lastProgressReason?: string;
     /** Last watched-check status fingerprint used to detect progress. */
     lastCheckFingerprint?: string;
+    /** Last observed actionable feedback, retained so restart does not invent progress. */
+    lastActionableFingerprint?: string;
     /** Last observed local PR head SHA used to detect new commits. */
     lastHeadSha?: string | null;
     /** Consecutive-failure counter; resets on success. Gates consecutive fallback (MAX_INLINE_CI_FIX_ATTEMPTS). */
@@ -1628,15 +2113,19 @@ export declare const DEFAULT_TASK_DIR = ".task";
  * Changing this value alters defaults across the dispatch wizard and gateway
  * dispatch path — verify all `DEFAULT_CLAUDE_MODEL` callers when touching it. */
 export declare const DEFAULT_CLAUDE_MODEL = "opus";
-/** Default Codex model used when no slot/task/project/user override is set.
- * GPT-5.6 family uses tiered slugs (sol/terra/luna); Sol is the flagship. */
-export declare const DEFAULT_CODEX_MODEL = "gpt-5.6-sol";
+/** Default Codex model used when no slot/task/project/user override is set. */
+export declare const DEFAULT_CODEX_MODEL = "gpt-6-astra";
+/** Reasoning efforts exposed by the Codex CLI, including Astra's max and ultra. */
+export declare const CODEX_REASONING_EFFORTS: readonly ["low", "medium", "high", "xhigh", "max", "ultra"];
+export type CodexReasoningEffort = (typeof CODEX_REASONING_EFFORTS)[number];
+/** Model capabilities from the Codex CLI catalog. Unknown models keep the legacy levels. */
+export declare function codexReasoningEfforts(model?: string | null): readonly CodexReasoningEffort[];
 /** Default Codex reasoning effort when dispatch/launch omits effort. */
-export declare const DEFAULT_CODEX_EFFORT = "xhigh";
+export declare const DEFAULT_CODEX_EFFORT = "high";
 /** Default Cursor Agent model used when no slot/task/project/user override is set. */
 export declare const DEFAULT_CURSOR_MODEL = "cursor-grok-4.6-high-fast";
 /** Default Grok model used when no slot/task/project/user override is set. */
-export declare const DEFAULT_GROK_MODEL = "grok-4.5";
+export declare const DEFAULT_GROK_MODEL = "grok-4.6";
 /** Default Grok reasoning effort when dispatch/launch omits effort. */
 export declare const DEFAULT_GROK_EFFORT = "xhigh";
 export type DecisionType = 'collision_check' | 'plan_confirmation' | 'retrospective' | 'review_posting' | 'blocked_alert' | 'review_comments' | 'improvement' | 'recipe_strategy' | `engine_${string}` | `monitor_${string}` | `ci_${string}`;