@oar-sh/oar 0.9.1 → 0.9.3

package/server/copilot-worker/copilot-sdk-session-process.mjs

@@ -44,6 +44,8 @@
 //     its usage is captured and posted, and a user message delivered while it
 //     runs is steered into it (answered from its own prompt segment) rather
 //     than cross-published into the continuation's row.
+import { randomUUID } from 'crypto';
+
 import {
   USER_INPUT_UNSUPPORTED_ANSWER,
   classifyCopilotSessionError,
@@ -61,11 +63,27 @@ import { resolveCopilotProviderConfig } from './copilot-byok-provider.mjs';
 import {
   createBackgroundShellTracker,
   createReplayGate,
+  describeSettledAgent,
   describeSettledShell,
   isContinuationOpeningEvent,
+  settledAgentFromNotification,
 } from './copilot-continuation-signals.mjs';
-import { createCopilotEventNormalizer } from './copilot-sdk-event-normalizer.mjs';
+import { createCopilotEventNormalizer, formatToolActivityText } from './copilot-sdk-event-normalizer.mjs';
+import {
+  DEFAULT_MODEL_SWITCH_TIMEOUT_MS,
+  createCopilotModelSwitcher,
+  isModelSwitchUnconfirmedError,
+  normalizeRelayEffort,
+} from './copilot-model-switch.mjs';
 import { createCopilotQuestionBridge } from './copilot-question-bridge.mjs';
+import {
+  RELAY_ASK_USER_TOOL_DESCRIPTION,
+  RELAY_ASK_USER_TOOL_NAME,
+  RELAY_ASK_USER_TOOL_PARAMETERS,
+  formatAskUserToolResult,
+  isToolOverrideRejection,
+  parseAskUserToolArguments,
+} from './copilot-ask-user-tool.mjs';
 import {
   EXIT_PLAN_BOARD_POSTED_FEEDBACK,
   EXIT_PLAN_NO_BOARD_FEEDBACK,
@@ -80,6 +98,12 @@ import {
   withRelayContext,
 } from './copilot-prompt-context.mjs';
 import { EMPTY_TURN_COMPLETION_NOTE } from '../../shared/empty-turn-completion.mjs';
+import { buildModelSnapshotFields, extractModelDescriptors } from '../../shared/model-descriptors.mjs';
+import { buildRelayStopFailure } from '../../shared/relay-stop-failure.mjs';
+import { STEER_FOLDED_TEXT, STEER_STOPPED_TEXT } from '../../shared/steer-settle-markers.mjs';
+import { buildSteerSettleFailure } from '../../shared/steer-settle-failure.mjs';
+import { shouldEmitStreamUpdate } from '../../shared/stream-emit-gating.mjs';
+import { withSteerNote } from '../../shared/steer-note.mjs';
 
 // How long the runtime may sit with no session activity before the worker
 // closes it. The worker process itself stays up and reconnects lazily on the
@@ -123,6 +147,45 @@ const DEFAULT_CONTINUATION_RETRY_DELAY_MS = 500;
 const CONTINUATION_REGISTRATION_TIMEOUT_MS = 10_000;
 /** Cap on activity lines carried between turns, so a chatty runtime cannot grow them. */
 const MAX_PENDING_ACTIVITIES = 20;
+/**
+ * Backstop for the compaction hold: `session.compaction_start` without a
+ * matching `_complete` (a runtime that died mid-compaction and was resumed)
+ * must not hold steering forever. Sized far above any plausible compaction,
+ * like the Claude worker's `compactionStaleMs`.
+ */
+const DEFAULT_COMPACTION_STALE_MS = 10 * 60_000;
+/**
+ * Backoff between attempts to save a consumed steer's settle marker (~31 s in
+ * all); after the last one the row fails terminally instead. Same ladder as
+ * the Claude worker, because it protects the same invariant: a prompt the
+ * runtime already consumed is never re-run.
+ */
+const DEFAULT_SETTLE_RETRY_DELAYS_MS = Object.freeze([1_000, 2_000, 4_000, 8_000, 8_000, 8_000]);
+const DEFAULT_MAX_TERMINAL_SETTLE_ATTEMPTS = 5;
+/** Debounce for re-reading the runtime's queued lane after `pending_messages.modified`. */
+const DEFAULT_QUEUE_LANE_REFRESH_MS = 150;
+/**
+ * How long a Stop's acknowledgement is held back for the reply of the row it
+ * named when that row's early settle is still publishing (see interruptTurn).
+ * Bounded: an unresponsive relay must not hold the Stop itself.
+ */
+const STOPPED_ROW_PUBLISH_WAIT_MS = 5_000;
+/**
+ * Debounce for re-reading `rpc.tasks.list()` after `session.background_tasks_changed`
+ * (which carries no payload and fires ~20 times per shell call).
+ */
+const DEFAULT_TASK_REFRESH_MS = 250;
+/** Trailing throttle for enrichment-only card updates (a live tool call, tokens). */
+const DEFAULT_TASK_PUBLISH_THROTTLE_MS = 2_000;
+/**
+ * How long a pushed prompt the runtime had not started when the turn's idle
+ * arrived is kept unsettled, waiting for the runtime to open its run. The
+ * drain's idle can race a send that resolved a moment earlier; the runtime
+ * then starts the prompt right away (`immediate` when idle) and its
+ * `user.message` adopts the row as a turn of its own. Same value as the
+ * Claude worker's fold grace, for the same reason.
+ */
+const DEFAULT_ORPHAN_GRACE_MS = 2_000;
 
 /**
  * Appended to the partial answer when the RUNTIME interrupted the turn on its
@@ -136,15 +199,27 @@ export const RUNTIME_INTERRUPTED_NOTE =
 
 /**
  * Published to a steered queue row whose prompt the runtime accepted but never
- * opened work on before the interaction ended. The prompt is still queued
- * INSIDE the runtime, so it will be answered at the start of the next turn —
- * requeuing the row would run it twice. Mirrors the Claude worker's
- * handed-off-context note, which exists for the same reason.
+ * opened work on before the interaction ended normally. The prompt is still
+ * queued INSIDE the runtime, so it will be answered at the start of the next
+ * turn — requeuing the row would run it twice. With `mode: "immediate"` the
+ * runtime drains every pushed prompt before it idles, so this is a defensive
+ * fallback rather than a routine outcome.
  */
 export const STEERED_ROW_MERGED_NOTE =
   '_(This message was delivered while the previous turn was still running; the reply continues in '
   + 'the next turn.)_';
 
+/**
+ * The reply of a continuation row opened only so a background task's question
+ * had a row to hang its card off (see `ensureInteractiveTurn`). The runtime
+ * produced no root work for it, so nothing else would ever answer the row.
+ */
+export const BACKGROUND_QUESTION_NOTE =
+  'System note: a background task asked for input here; it carries on in the background.';
+
+/** The provider name in the at-most-once settle failure wording. */
+const SETTLE_AGENT_LABEL = 'Copilot';
+
 /**
  * The `trigger` reported to `POST /api/continuation-turn`, matching the value
  * the Claude worker sends so the relay's `CONTINUATION … trigger=` log line and
@@ -173,6 +248,39 @@ export const DEFAULT_INFINITE_SESSION_CONFIG = Object.freeze({
 /** `steerIntoActiveTurn` could not adopt the row; run it as a normal turn. */
 const NOT_STEERED = Symbol('not-steered');
 
+/**
+ * The attempt-fencing echo for a row's write bodies. Every publish that names
+ * a `messageId` also names the attempt it belongs to, so the relay can refuse
+ * writes from a superseded attempt (a requeued row re-delivered elsewhere).
+ * Omitted entirely when the row carries no attempt id (a pre-fencing relay).
+ */
+function attemptFields(message) {
+  return message?.attemptId ? { attemptId: message.attemptId } : {};
+}
+
+/** A 409 whose detail names `stale_attempt`: this attempt was superseded. */
+function isStaleAttemptError(error) {
+  if (Number(error?.status) !== 409) return false;
+  const detail = typeof error?.detail === 'string' ? error.detail : JSON.stringify(error?.detail || '');
+  return detail.includes('stale_attempt');
+}
+
+/**
+ * Whether publishing `action` makes its row worth keeping (`entry.showedWork`).
+ * A bookkeeping line only tracks background work the task card already shows,
+ * and so does a line carried in from between turns (a shell or agent the card
+ * showed finishing) — unless it reports a failure. The card lists running
+ * tasks only, so a failed agent's card vanishes exactly like a finished one's,
+ * and a `subagent.failed` between turns reaches no row: that line is the
+ * failure's only trace. It renders only through its row's response, so
+ * dropping the row would drop the failure with it.
+ */
+function showsWork(action) {
+  if (action.channel === 'init') return false;
+  if (action.carried) return action.reportsFailure === true;
+  return !action.bookkeeping;
+}
+
 export function createCopilotSdkSessionRunner({
   api,
   sdkSessionId,
@@ -194,15 +302,16 @@ export function createCopilotSdkSessionRunner({
   resolveProviderConfigImpl = resolveCopilotProviderConfig,
   // Threading seam for `MessageOptions.mode` ("enqueue" | "immediate").
   //
-  // A BYOK probe against runtime 1.0.82 ran a mid-turn send three ways —
-  // "enqueue", "immediate" and unset — and all three behaved IDENTICALLY: the
-  // send resolves in ~2ms with a message id, the prompt is queued
-  // (`pending_messages.modified`), the in-flight model call runs to completion
-  // untouched, and the prompt is picked up at the NEXT model-call boundary with
-  // its own `user.message`. Neither mode interrupts anything. "enqueue" is the
-  // documented default and preserves FIFO order, which is what the relay queue
-  // contract wants, so it is what this sends. See §5 of the plan doc.
-  resolveSendModeImpl = () => 'enqueue',
+  // "immediate", always (fake-provider probe against runtime 1.0.88,
+  // 2026-09-25). Mid-turn it is a real steer: injected at the next tool
+  // boundary as `user.message{delivery:"steering"}` (or, when the model is
+  // mid-stream, moved to the FRONT of the queue and run right after as
+  // `delivery:"queued"`). When the main loop is idle both modes start a run at
+  // once — except that an "enqueue" message sent while a background agent or
+  // an attached shell keeps `session.idle` deferred sits FROZEN until that
+  // work ends, while an "immediate" one runs immediately. So immediate is the
+  // only mode that never strands a message behind background work.
+  resolveSendModeImpl = () => 'immediate',
   // Interactive surfaces. Tests inject a fake bridge; nothing here reaches the
   // relay without one.
   createQuestionBridgeImpl = createCopilotQuestionBridge,
@@ -219,6 +328,10 @@ export function createCopilotSdkSessionRunner({
   // fails terminally instead of holding the queue row until the relay's own
   // delivery watchdog gives up.
   turnStallTimeoutMs = DEFAULT_TURN_STALL_TIMEOUT_MS,
+  // How long a `deferred: true` model switch may wait for its
+  // `session.model_change` drain before the explicit selection counts as
+  // unconfirmed and fails the row (`COPILOT_SDK_RELAY_MODEL_SWITCH_TIMEOUT_MS`).
+  modelSwitchTimeoutMs = DEFAULT_MODEL_SWITCH_TIMEOUT_MS,
   // How long live detached shells alone may keep the runtime up (0 = no
   // limit). Read through a getter, like the Claude worker's
   // `getBackgroundTaskTimeoutMs`, so a future settings push can move it without
@@ -229,13 +342,55 @@ export function createCopilotSdkSessionRunner({
   // How long a settled continuation waits for its row before giving up on it.
   // Must outlast the registration's own retries; a test shortens it.
   continuationRegistrationTimeoutMs = CONTINUATION_REGISTRATION_TIMEOUT_MS,
+  compactionStaleMs = DEFAULT_COMPACTION_STALE_MS,
+  settleRetryDelaysMs = DEFAULT_SETTLE_RETRY_DELAYS_MS,
+  maxTerminalSettleAttempts = DEFAULT_MAX_TERMINAL_SETTLE_ATTEMPTS,
+  queueLaneRefreshMs = DEFAULT_QUEUE_LANE_REFRESH_MS,
+  orphanGraceMs = DEFAULT_ORPHAN_GRACE_MS,
+  // Register the relay's own `ask_user` (with `multi_select`) over the
+  // runtime's built-in one. A runtime that refuses the override falls back
+  // to the built-in for the rest of this worker's life.
+  relayAskUserTool = true,
+  taskRefreshMs = DEFAULT_TASK_REFRESH_MS,
+  taskPublishThrottleMs = DEFAULT_TASK_PUBLISH_THROTTLE_MS,
+  // Called with `true`/`false` whenever the runner flips between accepting
+  // deliveries and holding them (see isDeliveryHeld). The worker wires it to
+  // the socket link: a hold withdraws the relay's readiness, and its end
+  // re-arms it at once so a held message steers into the resumed turn.
+  onDeliveryReadinessChange = () => {},
+  // False while the connected relay does not understand the `steering-held`
+  // hand-back (a worker updated on disk before the relay restarted): a held
+  // delivery is then pushed the legacy way instead of being handed back into
+  // a retry-and-backoff requeue.
+  canHandBackHeldDelivery = () => true,
+  // Called when the set of recallable (un-steerable) rows changes. The worker
+  // wires it to an immediate heartbeat: the client's Cancel appears from the
+  // heartbeat snapshot, and a 10 s wait would often outlast the window in
+  // which the runtime still holds the message (live check 2026-09-25).
+  onCancellableChange = () => {},
   dbg = () => {},
 } = {}) {
   let client = null;
   let session = null;
   let sdkPaths = null;
-  let appliedModel = '';
+  // The single owner of "what model/effort is the live session CONFIRMED to be
+  // on" (audit #9/#13): tracks the last confirmed pair, caches the per-session
+  // model catalog for effort validation, and observes `session.model_change`
+  // drains for deferred switches. `appliedModel()` is the runner-side read.
+  const modelSwitch = createCopilotModelSwitcher({ switchTimeoutMs: modelSwitchTimeoutMs, dbg });
+  const appliedModel = () => modelSwitch.current().model;
   let activeTurn = null;
+  // Turns that have SETTLED but whose relay publishes have not all landed yet.
+  // Ownership of a turn is split in two: `activeTurn` is runtime-EVENT
+  // ownership (which turn the session callback feeds), this set is QUEUE-ROW
+  // ownership (which rows the heartbeat must keep claiming and the crash guard
+  // must requeue). The split exists because the runtime does not wait for the
+  // relay: a fast follow-on continuation can open, run and terminate while the
+  // previous turn's `/api/response` is still in flight, and holding the event
+  // stream hostage to that POST is exactly how a whole continuation vanished
+  // (audit #5). A Set, not a slot: the follow-on turn's own publish can block
+  // too, so several turns can be publishing at once.
+  const publishingTurns = new Set();
   let lifecycleTimer = null;
   let lastActivityAt = Date.now();
   let lastTurnUsage = null;
@@ -247,15 +402,115 @@ export function createCopilotSdkSessionRunner({
   // The in-flight ingest POST, exposed only as a test seam. Never awaited by
   // the turn path — that is the entire point of it.
   let usagePostChain = Promise.resolve();
+  // The last catalog content this worker POSTed to `/api/models/snapshot`,
+  // as a serialized signature. Identity of CONTENT, not of session: an idle
+  // shutdown and resume onto the same catalog must not re-publish it.
+  let lastModelSnapshotSignature = '';
+  // The in-flight snapshot POST — a chain like `usagePostChain`, and equally a
+  // test seam only: the turn path never awaits a snapshot.
+  let modelSnapshotChain = Promise.resolve();
   let starting = null;
   let disposed = false;
   let detachRuntimeExit = () => {};
-  // Prompts this worker sent that the runtime accepted but had not started work
-  // on when the interaction ended. They stay in the runtime's pending queue and
-  // are picked up FIRST in the next interaction, ahead of that turn's own
-  // prompt — so the next turn's segments are shifted by this many, and without
-  // it the primary row would be answered with a leftover prompt's reply.
-  let carriedPrompts = 0;
+  // A compaction in progress (`session.compaction_start` seen, no `_complete`
+  // yet). Holds steering: a message pushed now would land inside the
+  // compaction's replay. `compactingSince` backs the stale cap.
+  let compactingSince = 0;
+  // The last readiness value reported to `onDeliveryReadinessChange`, so the
+  // link only hears about flips.
+  let lastReportedDeliveryReady = null;
+  // Rows whose prompt the runtime consumed and whose settle marker is being
+  // saved (id → { message, variant }). Reported by the heartbeat WITH a
+  // terminal error until the publish lands, so recovery can never re-run them
+  // (see publishSettleMarker).
+  const settlingMessages = new Map();
+  // Settle markers that could not be posted even terminally; the heartbeat
+  // hands them to the relay to fail (id → terminalError).
+  const settleFailedTerminals = new Map();
+  // Per-row chains of `/api/queue-consumed` POSTs, so a mark and a later
+  // un-mark for the same row reach the relay in order.
+  const consumedMarkChains = new Map();
+  // The runtime's queued lane as last read from `rpc.queue.pendingItems`:
+  // runtime message id → stable queue item id. What un-steer needs, and what
+  // decides which pushed rows the client may still cancel.
+  let queuedLane = new Map();
+  // The rest of the last queue snapshot: how many immediate messages wait in
+  // the runtime's steering lane (entries not yet folded into the running
+  // turn), and how many items the queued lane holds. The steering lane has no
+  // ids — only its newest entry can be removed (`queue.removeMostRecent`,
+  // LIFO across both lanes; probe 2026-09-25) — so these decide whether our
+  // newest steer is still recallable.
+  let waitingSteers = 0;
+  let queuedItemCount = 0;
+  // Guards for the LIFO recall (removeMostRecent takes the runtime's NEWEST
+  // waiting message, whoever sent it):
+  //  - `steerSendsInFlight`: steer sends whose `send()` has not resolved yet.
+  //    The runtime may already count such a message while this worker cannot
+  //    yet name it, so no "newest" recall is attempted while any is in flight.
+  //  - `steerSendSeq`: send order across every owned turn, so "our newest
+  //    unconsumed steer" is decided by when it was sent, not by which turn
+  //    object happens to hold it.
+  //  - `unsteerChain`: un-steers run one at a time (each re-reads the queue).
+  // Steer sends never wait on an un-steer; the recall check and its remove
+  // request run in the same tick, so no send can be issued between them.
+  //
+  // What else removeMostRecent can take (live probe, runtime 1.0.85,
+  // 2026-09-26): only user-facing sends. The runtime's own notifications
+  // (agent_idle / agent_completed / shell_completed) never show in either
+  // lane — with one pending and nothing of ours queued the remove answered
+  // `removed:false`, and the notification was still delivered after a remove
+  // that took our steer. A `source:"system"` send is hidden from pendingItems
+  // and skipped (the remove took the OLDER user steer; the system one still
+  // ran). An `agent-*`-sourced send is listed and removable, but the
+  // runtime's inter-agent prompts never passed through the main lanes. So the
+  // read-then-remove window cannot drop a runtime message; what it can still
+  // hit is a message another client of the session pushed in that window,
+  // which the two guards below detect:
+  //  - `recallWatches`: runtime id → { taken } for a recall in progress. A
+  //    root `user.message` naming it sets `taken` from the event callback
+  //    itself — the SDK dispatches a notification before it resolves a later
+  //    RPC answer, whereas `entry.consumed` is set on the dispatch chain and
+  //    can lag behind a slow publish.
+  //  - `recalledRuntimeIds`: runtime id → row id of every prompt pulled back
+  //    and cancelled. One must never run; if it does, the remove took
+  //    another message and the row was cancelled wrongly — logged loudly.
+  let steerSendsInFlight = 0;
+  let lastCancellableSignature = '';
+  let steerSendSeq = 0;
+  let unsteerChain = Promise.resolve();
+  const recallWatches = new Map();
+  const recalledRuntimeIds = new Map();
+  const MAX_RECALLED_RUNTIME_IDS = 200;
+  /** How long an un-steer may wait on the runtime before it gives up. */
+  const UNSTEER_TIMEOUT_MS = 5_000;
+  let queueLaneTimer = null;
+  let queueLaneRefreshChain = Promise.resolve();
+  // Whether the session's `rpc.queue` / `rpc.interruptMainTurn` / `rpc.tasks`
+  // are present. Probed per session (the runtime auto-updates under the relay
+  // and every one of these is @experimental); a missing surface degrades to
+  // the previous behaviour, never to an error.
+  let sessionRpc = { queue: false, interruptMainTurn: false, tasks: false };
+  // Set once a runtime refused the relay's `ask_user` override: every later
+  // session is built without it (the built-in + wording heuristic remain).
+  let askUserOverrideRejected = false;
+  // The runtime's background task registry as last read from
+  // `rpc.tasks.list()` (id → TaskInfo), and what the event stream adds per
+  // agent that the registry does not carry: the live tool call, a running
+  // token count, the model announced at spawn. Both feed the task panel
+  // cards; the registry alone decides liveness (the lifecycle pin).
+  let backgroundTasks = new Map();
+  const agentDetails = new Map();
+  let taskRefreshTimer = null;
+  let taskRefreshChain = Promise.resolve();
+  let lastTaskRefreshAt = 0;
+  let taskPublishTimer = null;
+  let lastPublishedTasksSignature = '';
+  // Cap expiry is bounded: a task whose cancel the runtime refuses (or that
+  // keeps failing) this many times is abandoned — dropped from the live set so
+  // it stops pinning the runtime — rather than held forever.
+  const taskCancelRefusals = new Map();
+  const abandonedTasks = new Set();
+  const MAX_TASK_CANCEL_REFUSALS = 3;
   // Blocking handlers currently waiting on a human (`ask_user`, an ask-mode
   // tool approval). The runtime emits NO events while blocked in one, and the
   // question timeout is 8 hours against a 120s stall ceiling — so without this
@@ -281,10 +536,11 @@ export function createCopilotSdkSessionRunner({
   // continuation opening, or by the grace expiring on a runtime that decided it
   // had nothing to say.
   let continuationDueSince = 0;
-  // Transcript lines produced between turns (a settled shell's notification).
-  // They belong to the turn they trigger, so they are carried into it rather
-  // than dropped — the same trade the Claude worker's `pendingActivities`
-  // makes.
+  // Transcript lines produced between turns (a settled shell's or background
+  // agent's notification), as `{ text, reportsFailure }`. They belong to the
+  // turn they trigger, so they are carried into it rather than dropped — the
+  // same trade the Claude worker's `pendingActivities` makes. A line that
+  // reports a failure keeps the row it lands on (see `showsWork`).
   let pendingActivities = [];
   // The relay mode of the last delivered turn. A self-initiated turn has no
   // delivery to read a mode off, and it is a continuation OF that turn's work,
@@ -292,18 +548,85 @@ export function createCopilotSdkSessionRunner({
   // plan-board gating behaving the same either side of a background wait.
   let lastRelayMode = 'agent';
 
+  /**
+   * The turn a human request belongs to, opened on demand when none is live.
+   *
+   * A card needs a `processing` row (`/api/relay-question` 409s otherwise),
+   * and a background agent can ask long after the turn that spawned it settled
+   * on `assistant.idle`. Nothing else opens a row for that question, so it
+   * gets a continuation of its own — the Claude worker opens one before an
+   * off-turn `AskUserQuestion` for the same reason. `humanOrigin`: unless root
+   * work joins it, it closes itself once its last card is done.
+   */
+  function ensureInteractiveTurn() {
+    if (activeTurn || !session || disposed) return activeTurn;
+    const turn = openContinuationTurn();
+    turn.humanOrigin = true;
+    return turn;
+  }
+
   async function whileAwaitingHuman(run) {
+    // Captured once: the card belongs to this turn's row even when another
+    // turn owns the event stream by the time it is created or answered.
+    const turn = ensureInteractiveTurn();
     pendingHumanRequests += 1;
+    if (turn) {
+      if (turn.humanRequests === 0) turn.humansIdle = new Promise((resolve) => { turn.resolveHumansIdle = resolve; });
+      turn.humanRequests += 1;
+      turn.askedHuman = true;
+    }
+    // An open card holds steering: the relay's readiness is withdrawn at once.
+    syncDeliveryReadiness();
     try {
-      return await run();
+      return await run(turn);
     } finally {
       pendingHumanRequests -= 1;
+      if (turn) {
+        turn.humanRequests -= 1;
+        if (turn.humanRequests === 0) {
+          turn.resolveHumansIdle();
+          // A row opened only for questions: no terminator is coming for it.
+          if (turn.humanOrigin && !turn.rootWork && !turn.settled) {
+            turn.result = { subtype: 'completed', text: BACKGROUND_QUESTION_NOTE };
+            turn.settle();
+          }
+        }
+      }
       // The clock restarts from the answer, not from before the wait.
       touch();
       activeTurn?.armStall?.();
+      // The answer re-arms the relay immediately, so a message queued while
+      // the card was open steers into the resumed turn within one round trip.
+      syncDeliveryReadiness();
     }
   }
 
+  /**
+   * Hold an interactive callback until its turn's queue row exists.
+   *
+   * A continuation becomes the active turn synchronously but gets its row
+   * asynchronously, and the runtime can block on `user_input.requested` (or an
+   * ask-mode approval) in that gap — the question bridge would then see no
+   * row and degrade to an unsupported answer / local rejection for a card
+   * that was milliseconds from having a real row id. Bounded by the
+   * registration timeout (the registration itself can hang on a dead relay);
+   * on expiry — or on a registration that gave up (`rowReady` → false) — the
+   * caller proceeds and degrades exactly as before. Delivered turns are
+   * registered from birth and skip straight through.
+   */
+  async function awaitInteractiveRow(turn) {
+    if (!turn || turn.registered || !turn.rowReady) return;
+    let timer = null;
+    await Promise.race([
+      turn.rowReady,
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, continuationRegistrationTimeoutMs);
+        timer.unref?.();
+      }),
+    ]);
+    clearTimeout(timer);
+  }
+
   // The relay question bridge serves `ask_user` and (in ask mode) tool
   // approvals. `getActiveMessage` must resolve to the row that is CURRENTLY
   // `processing`, because `/api/relay-question` 409s otherwise.
@@ -336,6 +659,32 @@ export function createCopilotSdkSessionRunner({
     lastActivityAt = Date.now();
   }
 
+  /**
+   * A turn's terminal event ends its runtime-event ownership IMMEDIATELY, while
+   * queue-row ownership persists until every publish has landed.
+   *
+   * Called from `settle`/`fail`, so it runs the instant the terminator is
+   * dispatched: from here on `routeEvent` sees no active turn and a genuinely
+   * new event can open the next continuation — it must not wait out a blocked
+   * `/api/response`. The row itself stays owned (heartbeat lease, crash-guard
+   * requeue) via `publishingTurns` until `releaseTurnOwnership`.
+   */
+  function beginPublishing(turn) {
+    publishingTurns.add(turn);
+    if (activeTurn === turn) activeTurn = null;
+  }
+
+  /**
+   * Every publish for the turn has landed (or terminally failed); nothing owns
+   * its rows any more. Guarded on identity: by the time a publish window
+   * closes, `activeTurn` may already belong to a NEWER turn, and clearing it
+   * unconditionally would strip that turn's heartbeat ownership mid-flight.
+   */
+  function releaseTurnOwnership(turn) {
+    publishingTurns.delete(turn);
+    if (activeTurn === turn) activeTurn = null;
+  }
+
   // ---------------------------------------------------------------- publish --
 
   async function postActivity(message, text, subagentRunId = null) {
@@ -346,6 +695,7 @@ export function createCopilotSdkSessionRunner({
       mode: message.relayMode || 'agent',
       text,
       ...(subagentRunId ? { subagentRunId } : {}),
+      ...attemptFields(message),
     }).catch(() => {});
   }
 
@@ -367,6 +717,7 @@ export function createCopilotSdkSessionRunner({
         text: payload.text,
         done: payload.done === true,
         ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+        ...attemptFields(message),
       }).catch(() => {});
       return;
     }
@@ -379,6 +730,7 @@ export function createCopilotSdkSessionRunner({
         text: payload.text,
         done: payload.done === true,
         ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+        ...attemptFields(message),
       }).catch(() => {});
       return;
     }
@@ -397,6 +749,7 @@ export function createCopilotSdkSessionRunner({
         ...(payload.parentSubagentId ? { parentSubagentId: payload.parentSubagentId } : {}),
         ...(payload.displayName ? { displayName: payload.displayName } : {}),
         status: payload.status,
+        ...attemptFields(message),
       }).catch(() => {});
     }
   }
@@ -427,19 +780,89 @@ export function createCopilotSdkSessionRunner({
   }
 
   /**
-   * Publish an action, or hold it if the turn has no queue row yet.
+   * Publish an action onto the row that owns the runtime's current run, or
+   * hold it if the turn has no queue row yet.
    *
    * The single gate every producer goes through. A continuation's row is
    * created asynchronously, and a POST carrying `messageId: null` is not merely
    * useless — the relay's activity/stream routes key on it, so it would be
    * attributed to nothing at all.
+   *
+   * One turn can answer several rows in sequence (the primary, then a message
+   * pushed mid-turn that the runtime ran as its own `delivery:"queued"` run).
+   * Root-level traffic — stream, thoughts, activity, subagent lanes — goes to
+   * whichever row owns the run in progress (`turn.currentOwner`); the stream
+   * text is re-cut to that row's own segments so a second run's prose never
+   * appears under the first row.
    */
   async function emitAction(turn, action) {
     if (!turn.registered) {
       turn.bufferedActions.push(action);
       return;
     }
-    await dispatchAction(turn.message, action, turn.state);
+    await dispatchOwned(turn, action);
+  }
+
+  async function dispatchOwned(turn, action) {
+    const owner = turn.currentOwner || turn.primaryEntry;
+    if (!owner || owner.settled) {
+      // Nothing left to publish into (every row this turn owned has settled);
+      // the text still lands in the runtime's own transcript.
+      return;
+    }
+    if (showsWork(action)) owner.showedWork = true;
+    if (action.channel === 'stream' && !action.payload?.subagentRunId) {
+      // Re-cut to the owner's own segments, and gated against what THAT row
+      // last received (the normalizer gated against the whole interaction).
+      const text = textFor(turn, owner);
+      if (!shouldEmitStreamUpdate(text, owner.state.lastStreamedText)) return;
+      await dispatchAction(owner.message, { channel: 'stream', payload: { ...action.payload, text } }, owner.state);
+      return;
+    }
+    await dispatchAction(owner.message, action, owner.state);
+  }
+
+  /**
+   * Which row a normalizer segment's text belongs to. A segment nobody
+   * claimed (text produced before any prompt boundary — the answer to a
+   * prompt carried over from a previous interaction, or a turn the runtime
+   * answered without echoing a `user.message` at all) belongs to the next
+   * claimed segment's row, failing that to the turn's own row.
+   */
+  function segmentOwner(turn, index) {
+    const owners = turn.segmentOwners;
+    if (owners[index]) return owners[index];
+    for (let j = index + 1; j < owners.length; j += 1) {
+      if (owners[j]) return owners[j];
+    }
+    return turn.primaryEntry;
+  }
+
+  function textFor(turn, entry, segmentTexts = null) {
+    const count = Math.max(turn.normalizer.promptCount(), turn.segmentOwners.length);
+    const parts = [];
+    for (let index = 0; index < count; index += 1) {
+      if (segmentOwner(turn, index) !== entry) continue;
+      const text = String(segmentTexts?.[index] ?? turn.normalizer.segmentText(index) ?? '');
+      if (text.trim()) parts.push(text);
+    }
+    return parts.join('\n\n');
+  }
+
+  /**
+   * The final reply text for `entry`: its segments, with the task-completion
+   * summary taking precedence on the last one (the normalizer's
+   * `result.segmentTexts` already applies that rule; before this the runner
+   * read `segmentText` directly and lost the summary — the "Cha…" fragment
+   * case of 2026-09-12). A turn that opened no segment at all falls back to
+   * the whole composed text for its own row, which is strictly better than
+   * publishing nothing.
+   */
+  function finalTextFor(turn, entry, result) {
+    const segmentTexts = Array.isArray(result?.segmentTexts) ? result.segmentTexts : null;
+    const text = textFor(turn, entry, segmentTexts).trim();
+    if (text || entry !== turn.primaryEntry) return text;
+    return String(result?.text || entry.state.lastStreamedText || '').trim();
   }
 
   async function publishFinalStream(message, text) {
@@ -449,21 +872,58 @@ export function createCopilotSdkSessionRunner({
       mode: message.relayMode || 'agent',
       text: String(text || ''),
       done: true,
+      ...attemptFields(message),
     }).catch(() => {});
   }
 
-  async function publishResponse(message, { text, model, terminalError = null, modelOrigin }) {
-    await api('POST', '/api/response', {
-      messageId: message.id,
-      conversationId: message.conversationId,
-      text: String(text || ''),
-      model: model || null,
-      modelOrigin: modelOrigin
-        || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
-      ...(terminalError ? { terminalError } : {}),
-    }).catch(async () => {
-      await api('POST', '/api/requeue', { messageId: message.id }).catch(() => {});
-    });
+  /**
+   * Publish a row's outcome. Returns 'published' | 'stale' | 'failed' |
+   * 'requeued' so the settle paths can tell a landed marker from a lost one.
+   *
+   * `kind` ('folded' | 'stopped') stamps the settle stubs of a steered row the
+   * runtime consumed without answering on its own row; `consumedSteerIds`
+   * names the steers folded into the turn this response finishes, so the
+   * relay marks them consumed in the same fenced write. A response carrying a
+   * kind is never requeued on failure (the prompt was consumed — re-running it
+   * is the one thing that must not happen); `requeueOnFailure: false` opts an
+   * ordinary response out of the requeue too.
+   */
+  async function publishResponse(message, {
+    text, model, terminalError = null, modelOrigin, kind = null, consumedSteerIds = null,
+    requeueOnFailure = true,
+  }) {
+    const consumed = Array.isArray(consumedSteerIds)
+      ? consumedSteerIds
+        .map((entry) => ({ id: String(entry?.id || '').trim(), attemptId: entry?.attemptId || null }))
+        .filter((entry) => entry.id)
+      : [];
+    try {
+      await api('POST', '/api/response', {
+        messageId: message.id,
+        conversationId: message.conversationId,
+        text: String(text || ''),
+        model: model || null,
+        modelOrigin: modelOrigin
+          || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
+        ...(terminalError ? { terminalError } : {}),
+        ...(kind ? { kind } : {}),
+        ...(consumed.length ? { consumedSteerIds: consumed } : {}),
+        ...attemptFields(message),
+      });
+      return 'published';
+    } catch (error) {
+      // A stale_attempt 409 means the row already moved on to another attempt
+      // (requeued and re-delivered); the requeue would 409 the same way, and
+      // the newer attempt owes the row its answer — drop this one.
+      if (isStaleAttemptError(error)) {
+        dbg('response refused as stale_attempt; dropping', message.id);
+        return 'stale';
+      }
+      if (kind || !requeueOnFailure) return 'failed';
+      const requeued = await api('POST', '/api/requeue', { messageId: message.id, ...attemptFields(message) })
+        .then(() => true, () => false);
+      return requeued ? 'requeued' : 'failed';
+    }
   }
 
   function terminalErrorRecord(message, classified) {
@@ -477,6 +937,117 @@ export function createCopilotSdkSessionRunner({
     };
   }
 
+  // ------------------------------------------------- at-most-once settling --
+
+  /**
+   * Claim a consumed row as settling — synchronously, BEFORE anything stops
+   * reporting it as live, so no heartbeat can see it unowned. `variant` picks
+   * the terminal wording should its settle never land.
+   */
+  function claimSettling(message, variant = 'folded') {
+    const id = String(message?.id || '').trim();
+    if (id && !settlingMessages.has(id)) settlingMessages.set(id, { message, variant });
+  }
+
+  /** Release a settled row — unless it was handed to the relay to fail. */
+  function releaseSettling(id) {
+    const key = String(id || '').trim();
+    if (!settleFailedTerminals.has(key)) settlingMessages.delete(key);
+  }
+
+  /**
+   * Mark rows whose prompt the runtime has folded into a running turn as
+   * consumed on the relay (the moment `user.message{delivery:"steering"}`
+   * confirms it). Best-effort: the worker's own settle still owns these rows
+   * while it lives; the mark only protects them when it does not — a crash
+   * before the settle marker lands must fail the row, never re-run it.
+   */
+  function markConsumed(conversationId, entries = [], { consumed = true } = {}) {
+    const rows = entries
+      .map((entry) => ({ id: String(entry?.id || '').trim(), attemptId: entry?.attemptId || null }))
+      .filter((entry) => entry.id);
+    if (!rows.length) return Promise.resolve();
+    const previous = Promise.allSettled(rows.map((row) => consumedMarkChains.get(row.id)).filter(Boolean));
+    const post = previous.then(() => api('POST', '/api/queue-consumed', {
+      conversationId: String(conversationId || sdkSessionId || ''),
+      entries: rows,
+      ...(consumed ? {} : { consumed: false }),
+    })).catch((error) => {
+      dbg('consumed mark failed', rows.map((entry) => entry.id).join(','), error?.message || String(error));
+    });
+    for (const row of rows) consumedMarkChains.set(row.id, post);
+    post.then(() => {
+      for (const row of rows) if (consumedMarkChains.get(row.id) === post) consumedMarkChains.delete(row.id);
+    });
+    return post;
+  }
+
+  /** Heartbeat payload: rows whose terminal failure the relay must post. */
+  function getSettleFailed() {
+    return [...settleFailedTerminals.entries()].map(([id, terminalError]) => ({
+      id,
+      attemptId: settlingMessages.get(id)?.message?.attemptId || null,
+      terminalError,
+    }));
+  }
+
+  function acknowledgeSettleFailed(ids = []) {
+    for (const id of ids) {
+      const key = String(id || '').trim();
+      if (!settleFailedTerminals.delete(key)) continue;
+      settlingMessages.delete(key);
+    }
+  }
+
+  const sleep = (ms) => new Promise((resolve) => { const t = setTimeout(resolve, ms); t.unref?.(); });
+
+  /**
+   * Save the settle marker of a steered message the runtime already consumed
+   * — at most once. The row stays in `settlingMessages`, and so in every
+   * heartbeat, until the relay commits the marker. A marker that cannot be
+   * saved within the retry budget ends as a terminal failure — never a
+   * requeue — and if even that cannot be posted, the heartbeat hands the row
+   * to the relay to fail. Ported from the Claude worker; same guarantees.
+   */
+  async function publishSettleMarker(message, { text, model, kind, variant = 'folded' }) {
+    const id = String(message?.id || '').trim();
+    if (!id) return;
+    claimSettling(message, variant);
+    try {
+      for (let attempt = 0; ; attempt += 1) {
+        const outcome = await publishResponse(message, { text, model, kind });
+        if (outcome !== 'failed') return;
+        if (attempt >= settleRetryDelaysMs.length) break;
+        await sleep(settleRetryDelaysMs[attempt]);
+      }
+      dbg('settle marker could not be saved; failing the row terminally', id);
+      const terminalError = buildSteerSettleFailure(message, { variant, agentLabel: SETTLE_AGENT_LABEL });
+      const retryMs = Math.max(100, Number(settleRetryDelaysMs.at(-1)) || 0);
+      for (let attempt = 0; attempt < Math.max(1, maxTerminalSettleAttempts); attempt += 1) {
+        if (attempt) await sleep(retryMs);
+        const outcome = await publishResponse(message, {
+          text: terminalError.message,
+          model,
+          terminalError,
+          requeueOnFailure: false,
+        });
+        if (outcome !== 'failed') return;
+        // Second channel: the requeue route fails a row outright when handed
+        // a terminal error.
+        const failedViaRequeue = await api('POST', '/api/requeue', {
+          messageId: id,
+          terminalError,
+          ...attemptFields(message),
+        }).then(() => true, (error) => isStaleAttemptError(error));
+        if (failedViaRequeue) return;
+      }
+      dbg('terminal settle could not be posted; handing it to the heartbeat', id);
+      settleFailedTerminals.set(id, terminalError);
+    } finally {
+      releaseSettling(id);
+    }
+  }
+
   /**
    * Per-turn usage capture, recorded on the runner.
    *
@@ -491,7 +1062,7 @@ export function createCopilotSdkSessionRunner({
       conversationId: message.conversationId,
       sdkSessionId,
       messageId: message.id,
-      model: result?.model || appliedModel || defaultModel || '',
+      model: result?.model || appliedModel() || defaultModel || '',
       usage,
       contextUsage,
       capturedAt: new Date().toISOString(),
@@ -546,6 +1117,60 @@ export function createCopilotSdkSessionRunner({
       .catch((error) => { dbg('usage ingest failed', error?.message || String(error)); });
   }
 
+  /**
+   * Publish the session's model catalog to `/api/models/snapshot` (Phase 5A:
+   * with the extension retired, worker snapshots and the server-side discovery
+   * service are what keep the relay's catalog populated).
+   *
+   * Fire-and-forget on a chain, exactly like `postTurnUsage`: a catalog is
+   * never worth a millisecond of a turn, and the failure mode is "the relay
+   * keeps its previous catalog" — swallowed after a debug line. The entries
+   * come from the switcher's cached per-session `rpc.model.list()`, so the
+   * common case adds zero RPCs; an unchanged catalog is deduped by content
+   * signature rather than re-POSTed on every resume.
+   *
+   * BYOK sessions never publish: their list is the OpenAI-compatible
+   * endpoint's per-key lineup, not the Copilot catalog, and a snapshot from
+   * one would overwrite the relay-wide picker with it.
+   */
+  function publishModelSnapshot(reason) {
+    if (byokProvider || !session) return;
+    const target = session;
+    modelSnapshotChain = modelSnapshotChain
+      .then(async () => {
+        const entries = await modelSwitch.catalogEntries(target);
+        const descriptors = extractModelDescriptors(entries);
+        // An empty list is the runtime refusing to answer, not an empty
+        // catalog — publishing it would only blank the pickers' metadata.
+        if (!descriptors.length) return;
+        // The shared builder decides every per-model metadata field (vendor,
+        // picker category, real context window, the runtime's own effort
+        // list, ...) so this raw-CAPI list and the discovery service's typed
+        // list publish identical metadata for the same model.
+        const { models, contextLimitsByModel, modelMetadataByModel } = buildModelSnapshotFields(descriptors);
+        const currentModel = appliedModel() || defaultModel || null;
+        const payload = {
+          // Same field set the extension and the standalone relay publish;
+          // the route reads exactly these seven keys and nothing else.
+          source: `copilot-sdk-worker:${reason}`,
+          models,
+          contextLimitsByModel,
+          modelMetadataByModel,
+          currentModel,
+          defaultModel: currentModel || models[0] || null,
+          error: null,
+        };
+        const signature = JSON.stringify([models, contextLimitsByModel, modelMetadataByModel, currentModel]);
+        if (signature === lastModelSnapshotSignature) return;
+        await api('POST', '/api/models/snapshot', payload);
+        // Recorded only after the POST lands, so a transient relay failure
+        // retries on the next trigger instead of being deduped away.
+        lastModelSnapshotSignature = signature;
+        dbg('model snapshot published', reason, `models=${models.length}`, `current=${currentModel || 'unknown'}`);
+      })
+      .catch((error) => { dbg('model snapshot publish failed', reason, error?.message || String(error)); });
+  }
+
   // ---------------------------------------------------------------- session --
 
   function routeEvent(event) {
@@ -558,8 +1183,34 @@ export function createCopilotSdkSessionRunner({
       return;
     }
     touch();
+    observeRecalls(event);
     observeBackgroundShells(event);
+    observeBackgroundAgents(event);
+    observeCompaction(event);
+    observeQueueLane(event);
+    // A background subagent's spawn emits a SESSION-level
+    // `session.model_change{source:"agent"}` for the subagent's own model
+    // (live-probed on 1.0.88). It is not the main thread's model: feeding it
+    // to the switcher would confirm a pending switch with the wrong model and
+    // move the catalog's currentModel.
+    const agentModelChange = event?.type === 'session.model_change'
+      && String(event?.data?.source || '').trim().toLowerCase() === 'agent';
+    if (!agentModelChange) {
+      // Keeps the confirmed-model tracking truthful for switches this worker
+      // did not ask for, and resolves the bounded wait on a deferred switch's
+      // drain. Behind the replay gate on purpose: a historical
+      // `session.model_change` must not confirm a pending switch.
+      modelSwitch.observeEvent(event);
+      // A LIVE model change moves the catalog's currentModel; replays cannot
+      // get here (the gate above), so this cannot re-publish days-old state.
+      if (event?.type === 'session.model_change') publishModelSnapshot('model-change');
+    }
     let turn = activeTurn;
+    if (!turn) {
+      // A prompt this worker pushed whose run the runtime opened after its
+      // turn had already settled is that row's own turn, not a continuation.
+      turn = adoptOrphanedRun(event);
+    }
     if (!turn) {
       // The runtime started work with no row open. Anything that is not the
       // START of work (terminators, connection bookkeeping) stays a no-op:
@@ -568,13 +1219,13 @@ export function createCopilotSdkSessionRunner({
       if (!isContinuationOpeningEvent(event)) return;
       turn = openContinuationTurn();
     }
-    // `activeTurn` is deliberately still set (and still settled) while a turn
-    // publishes its response, so a continuation cannot open inside that window
-    // and clobber the row being written. Events landing there are dropped by
-    // `handleTurnEvent`'s settled guard — and cost nothing, because the opener
-    // allowlist spans the whole of a turn: the next `assistant.message` or
-    // `tool.execution_start` opens the continuation once the row is closed,
-    // with the normalizer still capturing the reply text.
+    // The owner is captured HERE, synchronously, but settlement happens later
+    // on the dispatch chain — so an event can be captured to a turn that is
+    // settled by the time its link runs. `handleTurnEvent`'s settled guard
+    // re-routes such an event (in arrival order, on the same chain) to
+    // whatever now owns the stream, opening a continuation if the event is an
+    // opener. A settled turn that is still publishing holds only its QUEUE
+    // rows (`publishingTurns`); it never holds the event stream.
     dispatchChain = dispatchChain
       .then(() => handleTurnEvent(turn, event))
       .catch((error) => { dbg('event dispatch failed', error?.message || String(error)); });
@@ -587,6 +1238,407 @@ export function createCopilotSdkSessionRunner({
    * delivered turn (that is where the model calls `bash`) and SETTLE outside
    * one, which is the whole asymmetry this fix exists for.
    */
+  /**
+   * Mirror the live detached-shell set into the relay's background-tasks
+   * panel (REPLACE semantics, the same route the Claude worker publishes on),
+   * so a runaway `npm test` in a detached shell is visible as a card instead
+   * of only as tool rows. `stoppable: false` because the runtime exposes no
+   * host-side shell stop (`stop_bash` is a tool the MODEL calls) — see
+   * backgroundWorkHoldsRuntime. Advisory: a failed post never disturbs events.
+   */
+  function publishBackgroundShellTasks() {
+    publishBackgroundTasks({ immediate: true });
+  }
+
+  /** The panel rows for the shell tracker's set — the path without `rpc.tasks`. */
+  function shellTrackerCards() {
+    return backgroundShells.live().map((shell) => ({
+      taskId: shell.shellId,
+      taskType: 'local_bash',
+      description: shell.description || 'Detached shell',
+      startedAt: shell.startedAt || null,
+      stoppable: false,
+    }));
+  }
+
+  /**
+   * The panel rows for the runtime's task registry: background agents and
+   * shells still running, each with what the events added. `stoppable` is
+   * true because `rpc.tasks.cancel` is present whenever this path is taken.
+   */
+  function registryCards() {
+    const cards = [];
+    for (const task of backgroundTasks.values()) {
+      if (task.status !== 'running') continue;
+      const startedAt = Date.parse(String(task.startedAt || '')) || null;
+      if (task.type === 'shell') {
+        cards.push({
+          taskId: task.id,
+          taskType: 'local_bash',
+          description: task.description || task.command || 'Background shell',
+          startedAt,
+          stoppable: true,
+          ...(task.progressSummary ? { summary: task.progressSummary } : {}),
+        });
+        continue;
+      }
+      if (task.type !== 'agent') continue;
+      const detail = agentDetails.get(task.id) || {};
+      const model = task.resolvedModel || task.model || detail.model || '';
+      const inherited = !model;
+      cards.push({
+        taskId: task.id,
+        taskType: 'local_agent',
+        description: task.description || task.displayName || detail.displayName || 'Background agent',
+        startedAt: startedAt || detail.startedAt || null,
+        stoppable: true,
+        subagentType: task.agentType || detail.agentType || null,
+        model: model || appliedModel() || defaultModel || null,
+        modelInherited: inherited,
+        ...(detail.lastToolCall ? { lastToolCall: detail.lastToolCall } : {}),
+        ...(Number.isFinite(detail.totalTokens) && detail.totalTokens > 0 ? { totalTokens: detail.totalTokens } : {}),
+        ...(task.progressSummary ? { summary: task.progressSummary } : {}),
+      });
+    }
+    return cards;
+  }
+
+  /**
+   * Mirror the live background work into the relay's task panel (REPLACE
+   * semantics, the same route the Claude worker publishes on). Set changes
+   * publish at once; enrichment-only changes (a tool call, tokens) ride a
+   * trailing throttle. Advisory: a failed post never disturbs events.
+   */
+  function publishBackgroundTasks({ immediate = false } = {}) {
+    const run = () => {
+      if (taskPublishTimer) {
+        clearTimeout(taskPublishTimer);
+        taskPublishTimer = null;
+      }
+      const tasks = sessionRpc.tasks ? registryCards() : shellTrackerCards();
+      const signature = JSON.stringify(tasks);
+      if (signature === lastPublishedTasksSignature) return;
+      lastPublishedTasksSignature = signature;
+      api('POST', '/api/background-tasks', { conversationId: sdkSessionId, tasks })
+        .catch((error) => dbg('background task publish failed', error?.message || String(error)));
+    };
+    if (immediate || !(taskPublishThrottleMs > 0)) {
+      run();
+      return;
+    }
+    if (taskPublishTimer) return;
+    taskPublishTimer = setTimeout(run, taskPublishThrottleMs);
+    taskPublishTimer.unref?.();
+  }
+
+  // ------------------------------------------------------- background tasks --
+
+  /**
+   * What the event stream knows about background agents that the registry
+   * does not: spawn details, the live tool call, a running token count, and
+   * the completion heralds. `session.background_tasks_changed` itself is
+   * empty and only says "re-read the registry".
+   */
+  function observeBackgroundAgents(event) {
+    const type = String(event?.type || '');
+    const data = event?.data && typeof event.data === 'object' ? event.data : {};
+    const agentId = String(event?.agentId || '').trim();
+    if (type === 'session.background_tasks_changed') {
+      scheduleTaskRefresh();
+      return;
+    }
+    if (type === 'subagent.started' && String(data.executionMode || '').trim().toLowerCase() === 'background' && agentId) {
+      // Kept for the life of the session (a finished agent's late events must
+      // still be recognised as background), bounded so a long session cannot
+      // grow it forever.
+      while (agentDetails.size >= 500) agentDetails.delete(agentDetails.keys().next().value);
+      agentDetails.set(agentId, {
+        displayName: String(data.agentDisplayName || data.agentName || '').trim(),
+        agentType: String(data.agentType || '').trim(),
+        model: String(data.model || '').trim(),
+        lastToolCall: '',
+        totalTokens: 0,
+        startedAt: Date.now(),
+      });
+      scheduleTaskRefresh();
+      return;
+    }
+    const settledAgent = settledAgentFromNotification(event);
+    if (settledAgent) {
+      dbg('background agent settled', settledAgent.agentId, settledAgent.status);
+      // The runtime is about to re-invoke the model off the back of this
+      // (`read_agent` + a reply): pin the runtime for the continuation, and
+      // carry a line into the turn it triggers when no turn is open to take
+      // it. Same shape as a settled shell's herald.
+      continuationDueSince = Date.now();
+      const note = describeSettledAgent(settledAgent);
+      if (note && !activeTurn && pendingActivities.length < MAX_PENDING_ACTIVITIES) {
+        pendingActivities.push({ text: note, reportsFailure: settledAgent.status === 'failed' });
+      }
+      scheduleTaskRefresh();
+      return;
+    }
+    if (agentId && agentDetails.has(agentId)) {
+      const detail = agentDetails.get(agentId);
+      if (type === 'tool.execution_start') {
+        detail.lastToolCall = formatToolActivityText(data.toolName, data.arguments);
+        publishBackgroundTasks();
+      } else if (type === 'assistant.usage') {
+        const used = (Number(data.inputTokens) || 0) + (Number(data.outputTokens) || 0);
+        if (used > 0) {
+          detail.totalTokens += used;
+          publishBackgroundTasks();
+        }
+      } else if (type === 'subagent.completed' || type === 'subagent.failed') {
+        const total = Number(data.totalTokens);
+        if (Number.isFinite(total) && total > 0) detail.totalTokens = total;
+        scheduleTaskRefresh();
+      }
+    }
+  }
+
+  function scheduleTaskRefresh() {
+    if (!sessionRpc.tasks || taskRefreshTimer) return;
+    taskRefreshTimer = setTimeout(() => {
+      taskRefreshTimer = null;
+      taskRefreshChain = taskRefreshChain.then(() => refreshBackgroundTasks()).catch(() => {});
+    }, taskRefreshMs);
+    taskRefreshTimer.unref?.();
+  }
+
+  /**
+   * Re-read the runtime's task registry. Running agents and shells become
+   * cards (with a progress line when the runtime has one); finished entries
+   * are removed from the runtime's tracking so the registry cannot grow for
+   * the life of the session. A refresh that fails leaves the last read in
+   * place — a stale card beats a vanished one.
+   */
+  async function refreshBackgroundTasks() {
+    const target = session;
+    if (!target || !sessionRpc.tasks) return;
+    lastTaskRefreshAt = Date.now();
+    let listed;
+    try {
+      listed = await target.rpc.tasks.list();
+    } catch (error) {
+      dbg('tasks.list failed', error?.message || String(error));
+      return;
+    }
+    if (session !== target) return;
+    const next = new Map();
+    for (const task of Array.isArray(listed?.tasks) ? listed.tasks : []) {
+      const id = String(task?.id || '').trim();
+      if (!id || abandonedTasks.has(id)) continue;
+      const status = String(task?.status || '').trim().toLowerCase();
+      // Only running tasks are live. 'idle' (a multi-turn agent waiting for
+      // messages) holds nothing and shows nowhere until it is messaged
+      // (roadmap: tasks.sendMessage); finished entries are left to the
+      // runtime's own tracking — removing them here could race the root
+      // agent's `read_agent` follow-up that the completion notification
+      // triggers.
+      if (status === 'running') {
+        next.set(id, { ...task, id, status, progressSummary: backgroundTasks.get(id)?.progressSummary || '' });
+      }
+    }
+    // Progress lines for the live set: the agent's latest intent / last
+    // activity, a shell's last output line. One RPC per live task per refresh
+    // (refreshes are debounced), best effort.
+    if (typeof target.rpc.tasks.getProgress === 'function') {
+      for (const task of next.values()) {
+        try {
+          const progress = (await target.rpc.tasks.getProgress({ id: task.id }))?.progress || null;
+          task.progressSummary = summarizeTaskProgress(progress);
+        } catch { /* a card without a progress line */ }
+      }
+    }
+    if (session !== target) return;
+    const setChanged = next.size !== backgroundTasks.size
+      || [...next.keys()].some((id) => !backgroundTasks.has(id));
+    backgroundTasks = next;
+    publishBackgroundTasks({ immediate: setChanged });
+    // The lifecycle poll (every `lifecyclePollMs`) picks the new set up; a
+    // re-evaluation here would re-schedule a refresh and spin.
+  }
+
+  function summarizeTaskProgress(progress) {
+    if (!progress || typeof progress !== 'object') return '';
+    if (progress.type === 'agent') {
+      const intent = String(progress.latestIntent || '').trim();
+      if (intent) return intent.slice(0, 300);
+      const lines = Array.isArray(progress.recentActivity) ? progress.recentActivity : [];
+      const last = lines.length ? String(lines[lines.length - 1]?.message || '').trim() : '';
+      return last.slice(0, 300);
+    }
+    if (progress.type === 'shell') {
+      const output = String(progress.recentOutput || '').trim();
+      if (!output || output === '(no output yet)') return '';
+      const lines = output.split('\n').map((line) => line.trim()).filter(Boolean);
+      return (lines[lines.length - 1] || '').slice(0, 300);
+    }
+    return '';
+  }
+
+  /** The live tasks from the registry (running agents + shells). */
+  function runningBackgroundTasks() {
+    return [...backgroundTasks.values()].filter((task) => task.status === 'running');
+  }
+
+  /**
+   * Stop one background task (the panel's per-card Stop, or a subagent lane's
+   * Stop for a background agent). Returns whether the runtime cancelled it.
+   */
+  async function stopBackgroundTask(taskId) {
+    const id = String(taskId || '').trim();
+    if (!id || !session || !sessionRpc.tasks) return false;
+    try {
+      const outcome = await session.rpc.tasks.cancel({ id });
+      const cancelled = outcome?.cancelled === true;
+      dbg(cancelled ? 'background task cancelled' : 'background task cancel refused', id);
+      if (cancelled) scheduleTaskRefresh();
+      return cancelled;
+    } catch (error) {
+      dbg('tasks.cancel failed', id, error?.message || String(error));
+      return false;
+    }
+  }
+
+
+
+  /**
+   * The compaction hold. A message pushed while the runtime is compacting
+   * would be injected into the compaction's replay, so steering is held from
+   * `session.compaction_start` to `_complete` (the runtime queues messages
+   * sent during a compaction itself, but holding them relay-side keeps the
+   * bubble cancellable and the composer truthful — the Claude rule).
+   */
+  function observeCompaction(event) {
+    const type = String(event?.type || '');
+    if (event?.agentId) return;
+    if (type === 'session.compaction_start') {
+      compactingSince = Date.now();
+      syncDeliveryReadiness();
+    } else if (type === 'session.compaction_complete') {
+      compactingSince = 0;
+      syncDeliveryReadiness();
+    }
+  }
+
+  function isCompacting() {
+    if (!compactingSince) return false;
+    if (Date.now() - compactingSince < compactionStaleMs) return true;
+    dbg('compaction hold went stale; releasing it');
+    compactingSince = 0;
+    return false;
+  }
+
+  /**
+   * Keep `queuedLane` current. `pending_messages.modified` carries no payload
+   * (it only says "the queue changed"), so it schedules a debounced
+   * `rpc.queue.pendingItems()` read. What matters here is which pushed rows
+   * are still in the QUEUED lane: those the runtime has not consumed and the
+   * client may still cancel (`cancellableIds` on the steering snapshot).
+   */
+  function observeQueueLane(event) {
+    if (String(event?.type || '') !== 'pending_messages.modified') return;
+    scheduleQueueLaneRefresh();
+  }
+
+  /** Un-steer's synchronous view of the runtime taking a prompt (see `recallWatches`). */
+  function observeRecalls(event) {
+    if (String(event?.type || '') !== 'user.message' || event?.agentId) return;
+    const runtimeId = String(event?.data?.messageId || '').trim();
+    if (!runtimeId) return;
+    const watch = recallWatches.get(runtimeId);
+    if (watch) watch.taken = true;
+    const recalledRow = recalledRuntimeIds.get(runtimeId);
+    if (recalledRow) {
+      dbg('UN-STEER MISMATCH: a prompt recalled and cancelled is running after all; the remove took another message',
+        recalledRow, runtimeId);
+    }
+  }
+
+  function scheduleQueueLaneRefresh() {
+    if (!sessionRpc.queue || queueLaneTimer) return;
+    queueLaneTimer = setTimeout(() => {
+      queueLaneTimer = null;
+      queueLaneRefreshChain = queueLaneRefreshChain.then(() => refreshQueueLane()).catch(() => {});
+    }, queueLaneRefreshMs);
+    queueLaneTimer.unref?.();
+  }
+
+  async function refreshQueueLane() {
+    const target = session;
+    if (!target || !sessionRpc.queue) return;
+    try {
+      const snapshot = await target.rpc.queue.pendingItems();
+      const next = new Map();
+      for (const item of Array.isArray(snapshot?.items) ? snapshot.items : []) {
+        const runtimeId = String(item?.messageId || '').trim();
+        const itemId = String(item?.id || '').trim();
+        if (runtimeId && itemId) next.set(runtimeId, itemId);
+      }
+      if (session !== target) return;
+      queuedLane = next;
+      queuedItemCount = Array.isArray(snapshot?.items) ? snapshot.items.length : 0;
+      const steering = Array.isArray(snapshot?.steeringMessages) ? snapshot.steeringMessages.length : 0;
+      const inFlight = Number(snapshot?.inFlightSteeringCount) || 0;
+      waitingSteers = Math.max(0, steering - inFlight);
+    } catch (error) {
+      dbg('queue.pendingItems failed', error?.message || String(error));
+    }
+    noteCancellableChange();
+  }
+
+  /** Tell the worker when the recallable set changed (see onCancellableChange). */
+  function noteCancellableChange() {
+    const signature = cancellableIds().join(',');
+    if (signature === lastCancellableSignature) return;
+    lastCancellableSignature = signature;
+    try {
+      onCancellableChange();
+    } catch (error) {
+      dbg('cancellable listener failed', error?.message || String(error));
+    }
+  }
+
+  /** Our pushed steers the runtime has not started on yet, in send order. */
+  function unconsumedSteers() {
+    const list = [];
+    for (const entry of ownedEntries()) {
+      if (entry.role === 'steer' && !entry.consumed && !entry.settled && entry.runtimeId) list.push(entry);
+    }
+    return list.sort((a, b) => (a.sendSeq || 0) - (b.sendSeq || 0));
+  }
+
+  /**
+   * How `entry` can still be pulled back out of the runtime, or null: by its
+   * stable id when it sits in the queued lane, or with removeMostRecent when
+   * it is the runtime's newest waiting message (our newest unconsumed steer,
+   * at least one steer waiting, nothing in the queued lane that a LIFO remove
+   * would take instead).
+   */
+  function recallMethodFor(entry) {
+    if (!entry || entry.role !== 'steer' || entry.consumed || entry.settled || !entry.runtimeId) return null;
+    const itemId = queuedLane.get(entry.runtimeId);
+    if (itemId) return { kind: 'queued', itemId };
+    if (typeof session?.rpc?.queue?.removeMostRecent !== 'function') return null;
+    if (steerSendsInFlight > 0 || queuedItemCount > 0 || waitingSteers < 1) return null;
+    const pending = unconsumedSteers();
+    return pending.length && pending[pending.length - 1] === entry ? { kind: 'newest' } : null;
+  }
+
+  /** Probe the experimental RPC surfaces once per session. */
+  function probeSessionRpc(target) {
+    sessionRpc = {
+      queue: typeof target?.rpc?.queue?.pendingItems === 'function'
+        && typeof target?.rpc?.queue?.removeAt === 'function',
+      interruptMainTurn: typeof target?.rpc?.interruptMainTurn === 'function',
+      tasks: typeof target?.rpc?.tasks?.list === 'function'
+        && typeof target?.rpc?.tasks?.cancel === 'function',
+    };
+    dbg(`copilot session rpc surfaces: queue=${sessionRpc.queue} interruptMainTurn=${sessionRpc.interruptMainTurn} tasks=${sessionRpc.tasks}`);
+  }
+
   function observeBackgroundShells(event) {
     let changed;
     try {
@@ -595,6 +1647,7 @@ export function createCopilotSdkSessionRunner({
       dbg('background shell tracking failed', String(event?.type || ''), error?.message || String(error));
       return;
     }
+    if (changed.opened.length || changed.settled.length) publishBackgroundShellTasks();
     for (const shell of changed.opened) {
       dbg('detached shell started', shell.shellId, shell.description || '(no description)');
     }
@@ -602,9 +1655,12 @@ export function createCopilotSdkSessionRunner({
       dbg('detached shell settled', shell.shellId);
       const note = describeSettledShell(shell);
       // Only carried when there is no turn to publish into: inside a turn the
-      // normalizer already narrates the `read_bash` that reads the output.
+      // normalizer already narrates the `read_bash` that reads the output. A
+      // settled turn mid-publish does NOT count as a turn here — its row is
+      // closed to new lines, so the note belongs to the continuation this
+      // notification is about to trigger.
       if (note && !activeTurn && pendingActivities.length < MAX_PENDING_ACTIVITIES) {
-        pendingActivities.push(note);
+        pendingActivities.push({ text: note, reportsFailure: false });
       }
     }
     // Only the runtime's own `system.notification` heralds a continuation. A
@@ -617,9 +1673,39 @@ export function createCopilotSdkSessionRunner({
     if (changed.heralded) continuationDueSince = Date.now();
   }
 
+  /**
+   * A live event was captured to a turn that settled before its chain link
+   * ran. It is NOT history — it belongs to whatever the runtime is doing now:
+   * an already-open successor turn, or a continuation this very event should
+   * open. Runs on the dispatch chain, so re-routed events keep arrival order
+   * relative to everything captured after them.
+   */
+  async function redispatchSettledEvent(event) {
+    let turn = activeTurn;
+    // A settled `activeTurn` cannot happen — `settle`/`fail` release the slot
+    // — but it is guarded anyway: re-routing INTO a settled turn would recurse
+    // through this function forever, so it is treated as "no owner".
+    if (!turn || turn.settled) {
+      // Same rules as `routeEvent`: a pushed prompt's late run is its own
+      // turn; otherwise only the start of work opens a row.
+      turn = adoptOrphanedRun(event);
+      if (!turn) {
+        if (!isContinuationOpeningEvent(event)) return;
+        turn = openContinuationTurn();
+      }
+    }
+    await handleTurnEvent(turn, event);
+  }
+
   async function handleTurnEvent(turn, event) {
-    if (turn.settled) return;
+    if (turn.settled) {
+      await redispatchSettledEvent(event);
+      return;
+    }
     turn.armStall?.();
+    // Root work ends on the runtime's own terminator, so a question-only
+    // continuation it joins no longer closes itself (whileAwaitingHuman).
+    if (isContinuationOpeningEvent(event)) turn.rootWork = true;
     let actions = [];
     try {
       actions = turn.normalizer.normalize(event);
@@ -627,6 +1713,12 @@ export function createCopilotSdkSessionRunner({
       dbg('normalize failed', String(event?.type || ''), error?.message || String(error));
       return;
     }
+    // The prompt boundary: the runtime has started work on a prompt. Decides
+    // which row owns the segment the normalizer just opened, and settles the
+    // previous run's row when this one is a new run (see noteUserMessage).
+    if (String(event?.type || '') === 'user.message' && !event?.agentId) {
+      await noteUserMessage(turn, event);
+    }
     for (const action of actions) {
       if (action.channel === 'result') {
         turn.result = action.payload;
@@ -646,25 +1738,110 @@ export function createCopilotSdkSessionRunner({
     while (turn.bufferedActions.length) {
       const batch = turn.bufferedActions.splice(0);
       for (const action of batch) {
-        await dispatchAction(turn.message, action, turn.state).catch(() => {});
+        await dispatchOwned(turn, action).catch(() => {});
       }
     }
   }
 
-  function buildSessionConfig(model, relayMode) {
-    // Built once per session, not per request. Reads the mode off the LIVE turn
-    // rather than closing over the one the session was built with, because one
-    // session serves every turn and the user can switch modes between them.
-    const decidePermission = createCopilotPermissionHandler({
-      // Only the ask-mode branch actually blocks on a human; wrapping it keeps
-      // the stall watchdog off a turn where someone is deciding.
-      bridge: {
-        askToolApproval: (permissionRequest, options) => whileAwaitingHuman(
-          () => questionBridge.askToolApproval(permissionRequest, options),
-        ),
+  /**
+   * The relay's `ask_user` tool: same name and fields as the runtime's
+   * built-in, plus `multi_select`. The handler runs under exactly the same
+   * human-gating as the built-in path (`onUserInputRequest`): the stall
+   * watchdog is held, steering is held (a question card is open), and a card
+   * raised the moment a continuation opens waits for its row. It never
+   * throws: a failed card answers in-band so the model can carry on.
+   */
+  function buildRelayAskUserTool() {
+    return {
+      name: RELAY_ASK_USER_TOOL_NAME,
+      description: RELAY_ASK_USER_TOOL_DESCRIPTION,
+      parameters: RELAY_ASK_USER_TOOL_PARAMETERS,
+      overridesBuiltInTool: true,
+      // The built-in asks no permission either: asking a question is not an action.
+      skipPermission: true,
+      defer: 'never',
+      handler: async (args, invocation) => {
+        const { question, choices, multiSelect } = parseAskUserToolArguments(args);
+        try {
+          const result = await whileAwaitingHuman(async (turn) => {
+            await awaitInteractiveRow(turn);
+            // Cancelled by either side: the turn (Stop, teardown) or the
+            // runtime itself (a subagent cancelled via tasks.cancel, a
+            // disconnect) — a card nobody will read must not hold steering.
+            const signal = combineSignals(turn?.abortController?.signal, invocation?.signal);
+            return questionBridge.askUserInput(
+              { question, choices, allowFreeform: true, multiSelect, source: 'relay-ask-user-tool' },
+              { signal, message: turn?.message },
+            );
+          });
+          return formatAskUserToolResult({
+            answer: result?.answer,
+            wasFreeform: result?.wasFreeform !== false,
+            timedOut: result?.timedOut === true,
+          });
+        } catch (error) {
+          dbg('relay ask_user failed', error?.message || String(error));
+          return USER_INPUT_UNSUPPORTED_ANSWER;
+        }
       },
-      getRelayMode: () => activeTurn?.message?.relayMode || relayMode,
-      // An aborted turn must not leave the human staring at a card whose answer
+    };
+  }
+
+  /** One signal that aborts when any of the given ones does (nulls ignored). */
+  function combineSignals(...signals) {
+    const live = signals.filter((signal) => signal && typeof signal.aborted === 'boolean');
+    if (live.length <= 1) return live[0] || null;
+    if (typeof AbortSignal.any === 'function') return AbortSignal.any(live);
+    const controller = new AbortController();
+    for (const signal of live) {
+      if (signal.aborted) { controller.abort(); break; }
+      signal.addEventListener('abort', () => controller.abort(), { once: true });
+    }
+    return controller.signal;
+  }
+
+  /**
+   * Open a session, retrying once without the relay's `ask_user` when the
+   * runtime refuses the override (an older runtime). The refusal is
+   * remembered until the runtime is stopped — the next runtime (possibly
+   * auto-updated under the relay) gets another try.
+   */
+  async function openSession(open, config) {
+    try {
+      return await open(config);
+    } catch (error) {
+      if (!config?.tools?.length || !isToolOverrideRejection(error) || isSessionNotFoundError(error)) throw error;
+      dbg('the runtime refused the relay ask_user override; using its built-in ask_user', error?.message || String(error));
+      askUserOverrideRejected = true;
+      const { tools: _tools, ...withoutTools } = config;
+      return open(withoutTools);
+    }
+  }
+
+  function buildSessionConfig(model, reasoningEffort = null) {
+    // Built once per session, not per request. Reads the mode off the LIVE turn
+    // rather than closing over the one the session was built with, because one
+    // session serves every turn and the user can switch modes between them.
+    // With no turn live (a background agent's request) it is the mode of the
+    // last delivered turn, as for a continuation.
+    const decidePermission = createCopilotPermissionHandler({
+      // Only the ask-mode branch actually blocks on a human; wrapping it keeps
+      // the stall watchdog off a turn where someone is deciding, and only
+      // there can an approval open a row of its own.
+      bridge: {
+        askToolApproval: (permissionRequest, options) => whileAwaitingHuman(async (turn) => {
+          // An ask-mode approval raised the moment a continuation opens must
+          // wait for the row its card will hang off — see `awaitInteractiveRow`.
+          await awaitInteractiveRow(turn);
+          return questionBridge.askToolApproval(permissionRequest, {
+            ...options,
+            signal: turn?.abortController?.signal || options?.signal || null,
+            message: turn?.message,
+          });
+        }),
+      },
+      getRelayMode: () => activeTurn?.message?.relayMode || lastRelayMode,
+      // An aborted turn must not leave the human staring at a card whose answer
       // nothing will read; the bridge times the card out instead.
       getSignal: () => activeTurn?.abortController?.signal || null,
       dbg,
@@ -676,9 +1853,10 @@ export function createCopilotSdkSessionRunner({
     // hosted (`github`) session, which is the common case.
     //
     // The resolved block is remembered: its token ceilings describe THIS model,
-    // and `session.setModel()` cannot update them (see `applyModel`).
+    // and no model-switch RPC can update them (see `applySelection`).
     const provider = resolveProviderConfigImpl({ env, model: model || defaultModel, dbg });
     byokProvider = provider;
+    const effort = normalizeRelayEffort(reasoningEffort);
     return {
       // The relay session id IS the SDK session id, so the runtime's own state
       // under ~/.copilot/session-state/<id> is addressable by conversation and
@@ -686,6 +1864,13 @@ export function createCopilotSdkSessionRunner({
       sessionId: sdkSessionId,
       ...(model ? { model } : {}),
       ...(provider ? { provider } : {}),
+      // BYOK only: the rebuilt config is the switch mechanism for these
+      // sessions, so the effort must ride in it or a dispose+resume model
+      // switch silently drops it. Hosted sessions apply effort through the
+      // validated RPC path instead (`SessionConfigBase.reasoningEffort` is
+      // only valid for models that support it, which cannot be checked before
+      // the session exists).
+      ...(provider && effort ? { reasoningEffort: effort } : {}),
       // Not a default: without this the SDK emits no deltas at all and the
       // transcript only updates when the whole message lands.
       streaming: true,
@@ -694,6 +1879,10 @@ export function createCopilotSdkSessionRunner({
       // The runtime's own defaults, pinned. See DEFAULT_INFINITE_SESSION_CONFIG.
       ...(infiniteSessionConfig ? { infiniteSessions: { ...infiniteSessionConfig } } : {}),
       onEvent: routeEvent,
+      // The relay's `ask_user` (see copilot-ask-user-tool.mjs): the built-in's
+      // fields plus `multi_select`, so a model can declare a multi-select
+      // question instead of the relay guessing from its wording.
+      ...(relayAskUserTool && !askUserOverrideRejected ? { tools: [buildRelayAskUserTool()] } : {}),
       // Permission policy follows the conversation's relay mode: agent and
       // autopilot auto-approve, plan denies non-read tools with feedback, and
       // ask asks the human through a relay question card. The handler reads the
@@ -717,9 +1906,15 @@ export function createCopilotSdkSessionRunner({
       // the deserializer is strict, so it is always a real boolean.
       onUserInputRequest: async (request) => {
         try {
-          const { answer, wasFreeform } = await whileAwaitingHuman(() => questionBridge.askUserInput(request, {
-            signal: activeTurn?.abortController?.signal || null,
-          }));
+          const { answer, wasFreeform } = await whileAwaitingHuman(async (turn) => {
+            // Same gate as the approval path: an `ask_user` fired straight
+            // after a continuation opened must get the row, not a null id.
+            await awaitInteractiveRow(turn);
+            return questionBridge.askUserInput(request, {
+              signal: turn?.abortController?.signal || null,
+              message: turn?.message,
+            });
+          });
           return { answer, wasFreeform };
         } catch (error) {
           dbg('user input question failed', error?.message || String(error));
@@ -736,12 +1931,59 @@ export function createCopilotSdkSessionRunner({
           feedback: posted ? EXIT_PLAN_BOARD_POSTED_FEEDBACK : EXIT_PLAN_NO_BOARD_FEEDBACK,
         };
       },
-      // Structured elicitation has no relay card type of its own; declining is
-      // in-band and lets the model continue, which a hang would not.
-      onElicitationRequest: () => ({ action: 'decline' }),
+      // Structured elicitation (audit #17): a form-mode request with a schema
+      // becomes a relay question card carrying `requestedSchema`; the relay's
+      // answer route validates the submission and stores `structuredAnswer`,
+      // which maps 1:1 onto the SDK's `ElicitationResult.content`. Everything
+      // that cannot round-trip — url mode (a browser redirect), a missing or
+      // non-object schema, a bridge without the structured surface, a timeout,
+      // a closing bridge, an answer the relay could not validate — declines
+      // in-band exactly as before, which lets the model continue where a hang
+      // or a throw would fail the tool call silently.
+      onElicitationRequest: (request) => handleElicitationRequest(request),
     };
   }
 
+  /**
+   * `onElicitationRequest` → a schema-carrying relay question card →
+   * `{ action: 'accept', content }` with the validated structured answer, or
+   * `{ action: 'decline' }` for everything that cannot round-trip.
+   *
+   * Runs under the same human-gating as `ask_user`: the stall watchdog is held
+   * off while the card waits, and an elicitation raised the moment a
+   * continuation opens waits for the row its card will hang off (`rowReady`)
+   * instead of minting a card against a null message id.
+   */
+  async function handleElicitationRequest(request) {
+    try {
+      const mode = String(request?.mode || 'form').trim().toLowerCase();
+      const schema = request?.requestedSchema;
+      const hasSchema = !!schema && typeof schema === 'object' && !Array.isArray(schema)
+        && !!schema.properties && typeof schema.properties === 'object';
+      if (mode === 'url' || !hasSchema || typeof questionBridge.askStructured !== 'function') {
+        return { action: 'decline' };
+      }
+      const source = String(request?.elicitationSource || '').trim();
+      const message = String(request?.message || '').trim()
+        || 'Copilot needs structured input to continue this turn.';
+      const result = await whileAwaitingHuman(async (turn) => {
+        await awaitInteractiveRow(turn);
+        return questionBridge.askStructured({
+          prompt: source ? `${message}\n\n(Requested by ${source}.)` : message,
+          requestedSchema: schema,
+        }, { signal: turn?.abortController?.signal || null, message: turn?.message });
+      });
+      const content = result?.structuredAnswer;
+      if (result?.timedOut || !content || typeof content !== 'object' || Array.isArray(content)) {
+        return { action: 'decline' };
+      }
+      return { action: 'accept', content };
+    } catch (error) {
+      dbg('elicitation bridging failed, declining', error?.message || String(error));
+      return { action: 'decline' };
+    }
+  }
+
   /**
    * Post the `plan_ready` board for a turn. Returns whether a board went out,
    * which the exit-plan handler turns into the feedback the agent sees.
@@ -779,8 +2021,8 @@ export function createCopilotSdkSessionRunner({
     dbg('copilot runtime exited', detail);
     const turn = activeTurn;
     if (turn && !turn.settled) {
-      // handlePendingPayload's catch tears the runtime down and publishes the
-      // failure record.
+      // driveTurn tears the runtime down and publishes the failure record
+      // onto every row the turn owns.
       turn.fail(new Error(`the Copilot runtime exited before the turn completed (${detail})`));
       return;
     }
@@ -815,65 +2057,69 @@ export function createCopilotSdkSessionRunner({
   }
 
   /**
-   * Best-effort model switch: a rejected switch must not fail the turn, it
-   * just runs on the session's current model (and says so in the log).
+   * Bring the live session onto the dequeued row's (model, effort) selection.
    *
-   * This is the HOSTED path only. A BYOK session cannot switch this way — see
-   * `switchModel`.
+   * Hosted sessions go through `modelSwitch.apply` and its OBSERVED RPCs
+   * (audit #9/#13): a selection the runtime does not confirm — a thrown
+   * switchTo, a confirmation-required result, a deferred switch that never
+   * drains, an unsupported effort level — THROWS the unconfirmed error, which
+   * fails the row terminally before the prompt is ever sent. The common path
+   * (same model, same effort) costs zero RPCs.
+   *
+   * BYOK sessions try the same RPCs first, but only when the freshly resolved
+   * `SessionConfig.provider` block for the target model matches the one the
+   * session was built with: the block carries MODEL-SPECIFIC token ceilings
+   * that no RPC can update (runtime 1.0.82 has no setProvider, and the
+   * registry surface is rejected alongside the singular whole-session
+   * `provider`), so an in-place switch is only sufficient when the ceilings do
+   * not move. A block that differs — or an RPC the runtime rejects — falls
+   * back to the dispose+resume rebuild, which carries the effort in the
+   * rebuilt config. Nothing is lost either way: the relay session id IS the
+   * SDK session id, so the rebuild takes the ordinary resume path.
    */
-  async function applyModel(model) {
-    if (!model || typeof session?.setModel !== 'function') return;
-    try {
-      await session.setModel(model);
-      appliedModel = model;
-    } catch (error) {
-      dbg('copilot setModel failed', model, error?.message || String(error));
+  async function applySelection(model, effort) {
+    if (!byokProvider) {
+      await modelSwitch.apply(session, { model, effort, byok: false });
+      return session;
+    }
+    const nextProvider = resolveProviderConfigImpl({ env, model: model || defaultModel, dbg });
+    const ceilingsMatch = JSON.stringify(nextProvider) === JSON.stringify(byokProvider);
+    if (ceilingsMatch) {
+      const attempt = await modelSwitch.apply(session, { model, effort, byok: true });
+      if (attempt.ok) return session;
+      dbg('BYOK model RPC not honoured, rebuilding the session', model, attempt.detail || '');
+    } else {
+      dbg('BYOK ceilings differ for the target model; rebuilding the session', model);
     }
+    return rebuildByokSession(model, effort);
   }
 
   /**
-   * Switch a live session onto a different model.
-   *
-   * Hosted sessions just call `setModel()`. BYOK sessions cannot: their token
-   * ceilings live in `SessionConfig.provider`, which is fixed at session
-   * creation. Runtime 1.0.82 exposes **no** way to update it — `setModel()`
-   * takes reasoning/context options but no provider, there is no
-   * `setProvider`, and the one runtime registry-add RPC belongs to the
-   * experimental named-`providers`/`models` surface, which the runtime
-   * explicitly REJECTS when combined with the singular whole-session
-   * `provider` this worker uses.
-   *
-   * So a bare `setModel()` on a BYOK session leaves the previous model's
-   * ceilings in place, and both directions of that are harmful: ceilings too
-   * high turn compaction into hard API rejections, ceilings too low compact a
-   * conversation that had plenty of room left.
-   *
-   * The session is therefore disposed and rebuilt with freshly resolved
-   * ceilings. Nothing is lost: the relay session id IS the SDK session id, the
-   * runtime's state persists under it, and the rebuild takes the ordinary
-   * resume path — the same one every worker restart already uses.
+   * Dispose the BYOK session and rebuild it with freshly resolved ceilings —
+   * the switch mechanism of last resort for a session whose
+   * `SessionConfig.provider` is immutable. The rebuilt config carries the
+   * requested model AND effort, and the resumed session is trusted to be on
+   * them by construction (`ProviderConfig.modelId` falls back to
+   * `SessionConfig.model`), so this path never re-enters the RPC attempt —
+   * which is also what makes it terminate: RPC refusal → rebuild → done.
    */
-  async function switchModel(model, relayMode) {
-    if (!byokProvider) {
-      await applyModel(model);
-      return session;
-    }
-    dbg('rebuilding the copilot session for a BYOK model switch', model);
+  async function rebuildByokSession(model, effort) {
+    dbg('rebuilding the copilot session for a BYOK model/effort switch', model);
     const closing = session;
     session = null;
-    appliedModel = '';
+    modelSwitch.reset();
     // Disconnect first so the runtime is not holding two handles on one
     // session id while the resume runs.
     try { await closing?.disconnect?.(); } catch (error) {
       dbg('session disconnect before model switch failed', error?.message || String(error));
     }
-    return ensureSession(model, relayMode);
+    return ensureSession(model, effort);
   }
 
-  async function ensureSession(model, relayMode) {
+  async function ensureSession(model, effort) {
     await ensureClient();
     if (!session) {
-      const config = buildSessionConfig(model, relayMode);
+      const config = buildSessionConfig(model, effort);
       // Resume first, always. On a brand-new conversation this costs one
       // failed RPC; on every other path (worker restart, idle shutdown,
       // relay restart) it is the difference between continuing the
@@ -882,7 +2128,7 @@ export function createCopilotSdkSessionRunner({
       // exists and the NEXT reconnect must resume it.
       let resumed = false;
       try {
-        session = await client.resumeSession(sdkSessionId, config);
+        session = await openSession((cfg) => client.resumeSession(sdkSessionId, cfg), config);
         resumed = true;
         dbg(`resumed copilot session ${sdkSessionId.slice(0, 8)}`);
       } catch (error) {
@@ -896,24 +2142,45 @@ export function createCopilotSdkSessionRunner({
           throw error;
         }
         dbg('copilot session state not found, creating', error?.message || String(error));
-        session = await client.createSession(config);
+        session = await openSession((cfg) => client.createSession(cfg), config);
         dbg(`created copilot session ${sdkSessionId.slice(0, 8)}`);
       }
-      if (resumed) {
-        // A resumed session keeps whatever model it was created with —
+      // Which experimental surfaces THIS runtime has (it auto-updates under
+      // the relay): decides un-steer and the targeted Stop for the session.
+      probeSessionRpc(session);
+      scheduleQueueLaneRefresh();
+      if (resumed && !byokProvider) {
+        // A resumed HOSTED session keeps whatever model it was created with —
         // `config.model` is not guaranteed to be honoured on resume — so the
-        // requested model is applied explicitly rather than assumed. Assuming
-        // it is what made a mismatch permanent: `appliedModel` would already
-        // equal the request, so the per-turn switch below could never fire.
-        appliedModel = '';
-        await applyModel(model);
+        // selection is applied explicitly (and observably) rather than
+        // assumed. Assuming it is what made a mismatch permanent: the tracked
+        // model would already equal the request, so the per-turn switch below
+        // could never fire.
+        modelSwitch.reset();
+        await modelSwitch.apply(session, { model, effort, byok: false });
       } else {
-        appliedModel = model || '';
+        // A created session is on `config.model` by construction; a resumed
+        // BYOK session is trusted the same way because `config.model` feeds
+        // `ProviderConfig.modelId` — and an RPC attempt here would recurse
+        // through the rebuild path that just built this config.
+        modelSwitch.noteApplied(model || '', byokProvider ? effort : null);
+        if (!byokProvider) {
+          // A hosted CREATE carries no effort in the config (the field is only
+          // valid for models that support it, unknowable pre-session), so an
+          // explicit level on the conversation's first turn still goes through
+          // the validated effort-only RPC. `null` effort is a no-op here.
+          await modelSwitch.apply(session, { model, effort, byok: false });
+        }
       }
+      // The freshly (re)built session is the first chance to see the runtime's
+      // catalog — publish it so a restarted relay repopulates without waiting
+      // for a model switch. Off the turn's critical path (fire-and-forget) and
+      // deduped, so an unchanged catalog on every resume costs one list() and
+      // no POST.
+      publishModelSnapshot(resumed ? 'session-resume' : 'session-start');
       return session;
     }
-    if (model && model !== appliedModel) return switchModel(model, relayMode);
-    return session;
+    return applySelection(model, effort);
   }
 
   async function stopRuntime(reason) {
@@ -924,15 +2191,38 @@ export function createCopilotSdkSessionRunner({
     const closingClient = client;
     session = null;
     client = null;
-    appliedModel = '';
+    modelSwitch.reset();
     // Detached shells are children of the runtime process, so stopping it ends
     // them: the tracked set is state about a process that no longer exists and
     // must not pin the next one. The replay gate is reset for the same reason —
     // the next connection resumes and arms its own window.
-    backgroundShells.reset();
+    if (backgroundShells.size() || backgroundTasks.size) {
+      backgroundShells.reset();
+      // Background agents and shells die with the runtime (live-probed: a
+      // disconnect cancels the agents and drops the shells from the registry);
+      // clear their panel cards too.
+      backgroundTasks = new Map();
+      agentDetails.clear();
+      publishBackgroundTasks({ immediate: true });
+    }
+    if (taskRefreshTimer) {
+      clearTimeout(taskRefreshTimer);
+      taskRefreshTimer = null;
+    }
     replayGate.reset();
+    // A settled turn waiting on a card (driveTurn) would wait for an answer
+    // nothing can take any more: the agent that asked died with the runtime.
+    for (const turn of publishingTurns) turn.abortController.abort();
     continuationDueSince = 0;
     pendingActivities = [];
+    compactingSince = 0;
+    queuedLane = new Map();
+    waitingSteers = 0;
+    queuedItemCount = 0;
+    steerSendsInFlight = 0;
+    sessionRpc = { queue: false, interruptMainTurn: false, tasks: false };
+    askUserOverrideRejected = false;
+    syncDeliveryReadiness();
     if (!closingSession && !closingClient) return;
     dbg(`stopping the copilot runtime (${reason})`);
     try { await closingSession?.disconnect?.(); } catch (error) {
@@ -975,22 +2265,62 @@ export function createCopilotSdkSessionRunner({
       dbg('continuation grace expired with no continuation turn');
       continuationDueSince = 0;
     }
+    if (sessionRpc.tasks) {
+      // The registry is the truth: live agents and shells hold the runtime up
+      // to the cap (the relay's background-task slider, 0 = unlimited), and on
+      // expiry they are CANCELLED — the runtime can stop them now — rather
+      // than forgotten. Bounded: a task whose cancel the runtime refuses a
+      // few times is abandoned instead of pinning the runtime forever. A
+      // re-read once per lifecycle poll catches state the events miss (a
+      // shell that exited after a cancel emits no notification).
+      const capMs = Number(getBackgroundTaskTimeoutMs()) || 0;
+      const live = runningBackgroundTasks();
+      if (!live.length) return false;
+      if (capMs > 0) {
+        for (const task of live) {
+          const startedAt = Date.parse(String(task.startedAt || '')) || agentDetails.get(task.id)?.startedAt || 0;
+          if (!startedAt || now - startedAt < capMs) continue;
+          const refusals = taskCancelRefusals.get(task.id) || 0;
+          if (refusals >= MAX_TASK_CANCEL_REFUSALS) {
+            dbg('background task cap reached and the runtime would not cancel it; abandoning it', task.id);
+            abandonedTasks.add(task.id);
+            backgroundTasks.delete(task.id);
+            publishBackgroundTasks({ immediate: true });
+            continue;
+          }
+          dbg('background task cap reached; cancelling it', task.id, task.description || task.command || '');
+          void stopBackgroundTask(task.id).then((cancelled) => {
+            if (!cancelled) taskCancelRefusals.set(task.id, (taskCancelRefusals.get(task.id) || 0) + 1);
+          });
+        }
+        if (!runningBackgroundTasks().length) return false;
+      }
+      if (now - lastTaskRefreshAt >= lifecyclePollMs) scheduleTaskRefresh();
+      return true;
+    }
     if (!backgroundShells.size()) return false;
-    const capMs = Number(getBackgroundTaskTimeoutMs()) || 0;
+    // Without the registry there is no Stop and no card worth the name, so an
+    // unlimited slider (0) must not mean "a forgotten `sleep 99999` pins the
+    // runtime forever": the old 30-minute default applies on this path.
+    const capMs = Number(getBackgroundTaskTimeoutMs()) || DEFAULT_BACKGROUND_TASK_TIMEOUT_MS;
+    let expiredAny = false;
     for (const shell of backgroundShells.expireOlderThan(capMs)) {
+      expiredAny = true;
       dbg(
         'background shell cap reached; it no longer holds the runtime open',
         shell.shellId,
         shell.description || '(no description)',
       );
     }
+    if (expiredAny) publishBackgroundShellTasks();
     return backgroundShells.size() > 0;
   }
 
   function evaluateLifecycle() {
     // A pending question card means a human is mid-answer; tearing the runtime
-    // down under them would discard the session the answer belongs to.
-    if (disposed || activeTurn || pendingHumanRequests > 0 || !client) return;
+    // down under them would discard the session the answer belongs to. A turn
+    // that is still publishing counts too: it settled, but its rows are live.
+    if (disposed || activeTurn || publishingTurns.size > 0 || pendingHumanRequests > 0 || !client) return;
     if (!(idleShutdownMs > 0)) return;
     // Evaluated before the idle clock so the caps still expire on a runtime
     // that has been quiet far longer than the idle window.
@@ -1019,18 +2349,81 @@ export function createCopilotSdkSessionRunner({
     return String(message?.providerModel || '').trim() || defaultModel;
   }
 
-  function createTurn(message, { kind = 'delivered' } = {}) {
+  /**
+   * A queue row this turn owes an answer.
+   *
+   * `role`: 'primary' (the delivered row that opened the turn), 'steer' (a row
+   * delivered mid-turn and pushed into the same runtime interaction) or
+   * 'self' (the synthetic row of a self-initiated turn). An entry is owned —
+   * heartbeat-claimed, crash-guard-requeued — from creation until `released`.
+   */
+  function createEntry(turn, message, role) {
+    const entry = {
+      turn,
+      message,
+      role,
+      // The id `send()` resolved; the key `user.message.messageId` matches.
+      runtimeId: null,
+      // A root `user.message` named this entry: the runtime has taken the
+      // prompt. `delivery` is the runtime's own word for how.
+      consumed: false,
+      delivery: null,
+      interactionId: null,
+      // The entry whose run absorbed this one (`delivery:"steering"`).
+      foldedInto: null,
+      consumedMarked: false,
+      // Its outcome was decided and its publishes started / it landed.
+      settled: false,
+      released: false,
+      cancelled: false,
+      // Something worth keeping was published on this row: the run's own
+      // work (a tool line, a thought, a lane), or a carried-in line that
+      // reports a failure — not bookkeeping, and not the other lines carried
+      // in from between turns (`showsWork`). Decides whether an empty
+      // continuation may vanish.
+      showedWork: false,
+      // `lastStreamedText` is what this row last received on /api/stream —
+      // the stream gate and the abort/error fallback text both read it.
+      state: { lastStreamedText: '' },
+    };
+    entry.done = new Promise((resolve) => { entry.resolveDone = resolve; });
+    turn.entries.push(entry);
+    return entry;
+  }
+
+  function assignRuntimeId(turn, entry, runtimeId) {
+    const id = String(runtimeId || '').trim();
+    entry.runtimeId = id || null;
+    if (!id) return;
+    turn.pushed.set(id, entry);
+    // The runtime can start work on a prompt before the send() that pushed it
+    // has resolved with its id. The boundary was remembered; reconcile it now,
+    // on the dispatch chain so it orders after the events already captured.
+    const unclaimed = turn.unclaimedUserMessages.get(id);
+    if (!unclaimed) return;
+    turn.unclaimedUserMessages.delete(id);
+    dispatchChain = dispatchChain
+      .then(() => adoptSegment(turn, entry, unclaimed))
+      .catch((error) => { dbg('late prompt-boundary reconcile failed', error?.message || String(error)); });
+  }
+
+  function createTurn(message, { kind = 'delivered', adoptEntry = null } = {}) {
     const continuation = kind === 'continuation';
     const turn = {
       // 'delivered' (a queue row arrived) | 'continuation' (the runtime started
       // work by itself and this worker minted a synthetic row for it).
       kind,
       message,
-      normalizer: createNormalizerImpl(),
-      state: { lastStreamedText: '' },
+      model: '',
+      // The runner's cross-turn knowledge of background agents rides in, so a
+      // later turn's normalizer opens no lane for an agent spawned earlier.
+      normalizer: createNormalizerImpl({ isBackgroundAgent: (agentId) => agentDetails.has(agentId) }),
       result: null,
+      failure: null,
       settled: false,
       aborted: false,
+      // The row the user pressed Stop on (from the abort control), when known.
+      abortedRowId: null,
       stallTimer: null,
       planBoardPosted: false,
       // Set when a mutating tool was actually approved and run this turn.
@@ -1045,65 +2438,100 @@ export function createCopilotSdkSessionRunner({
       // rather than failing the worker.
       discarded: false,
       controlState: null,
-      // How many prompts have been SENT into this interaction. The runtime
-      // consumes queued prompts in order, and opens one `user.message` segment
-      // per prompt as it picks each up, so send order IS segment order.
-      //
-      // Deliberately not derived from the normalizer's live segment count: at
-      // the moment a steering send happens the runtime may not have opened the
-      // previous prompt's segment yet, and the steered row would then be
-      // attributed the PREVIOUS prompt's answer.
-      //
-      // Starts at 1, not 0: this turn's own prompt is always its first, and
-      // counting it here rather than after `send()` resolves closes the race
-      // where a steering delivery lands between the two. A continuation sent no
-      // prompt at all, so it starts at 0.
-      promptsSent: continuation ? 0 : 1,
-      // The segment this turn's OWN reply lands in. For a delivered turn that
-      // is where its prompt is picked up — non-zero when a previous interaction
-      // left prompts queued inside the runtime, which are consumed first. A
-      // continuation has no `user.message` of its own, so the normalizer's
-      // implicit first segment is its own.
-      baseSegment: continuation ? 0 : carriedPrompts,
-      // The segment the NEXT prompt steered into this interaction will be
-      // answered in. Tracked explicitly rather than derived, because the two
-      // kinds differ: a delivered turn's own prompt occupies `baseSegment`, so
-      // the next is `baseSegment + 1`; a continuation occupies segment 0
-      // without having sent anything, so the first steered prompt opens
-      // segment 1. Getting this wrong cross-publishes the continuation's reply
-      // into the user's row.
-      nextSegmentIndex: continuation ? 1 : carriedPrompts + 1,
-      // The lowest segment index any prompt SENT by this turn can occupy — the
-      // floor for the carried-prompt arithmetic when the interaction ends.
-      firstSentSegment: continuation ? 1 : carriedPrompts,
       // Cancels any relay question card this turn is blocked on, so an aborted
       // turn does not leave a human answering into the void.
       abortController: new AbortController(),
-      // Queue rows delivered mid-turn and steered into this interaction. Each
-      // one is owed a response by THIS turn — the runtime answers them all
-      // under a single `session.idle`, so nothing else will settle them.
-      steeredRows: [],
+      // Cards (questions, ask-mode approvals, elicitations) open on this
+      // turn's row; `humansIdle` resolves when the last one is done. A turn
+      // that settles with one still open publishes only after it (driveTurn).
+      humanRequests: 0,
+      humansIdle: null,
+      // Whether any card was ever raised on this turn's row.
+      askedHuman: false,
+      // Opened by `ensureInteractiveTurn` for a question rather than by the
+      // runtime, and whether root work has joined it since.
+      humanOrigin: false,
+      rootWork: false,
+      // Every row this turn owes an answer, in push order.
+      entries: [],
+      // runtime message id → entry, for the `user.message` acknowledgement.
+      pushed: new Map(),
+      // Normalizer segment index → the entry whose row the segment's text
+      // belongs to. A `delivery:"steering"` prompt's segment belongs to the
+      // run it was folded into; a `queued`/`idle` one starts its own run.
+      segmentOwners: [],
+      // The entry whose run the runtime is working on right now.
+      currentOwner: null,
+      primaryEntry: null,
+      // Early settles (a previous run's row, published when the next run
+      // opened) run off the event dispatch chain; driveTurn awaits them
+      // before releasing ownership.
+      settlePromises: [],
+      // False until the turn-opening send() has resolved: the delivery hold.
+      primarySent: continuation,
+      // Root `user.message`s whose id no pushed entry knew yet (the event beat
+      // the send() resolution): runtime id → boundary, reconciled by
+      // assignRuntimeId.
+      unclaimedUserMessages: new Map(),
     };
+    if (adoptEntry) {
+      // A pushed row whose run the runtime opened after the turn it was pushed
+      // into had already settled: it becomes the primary of a turn of its own.
+      adoptEntry.turn = turn;
+      turn.entries.push(adoptEntry);
+      turn.primaryEntry = adoptEntry;
+      if (adoptEntry.runtimeId) turn.pushed.set(adoptEntry.runtimeId, adoptEntry);
+      turn.primarySent = true;
+    } else {
+      turn.primaryEntry = createEntry(turn, message, continuation ? 'self' : 'primary');
+    }
+    turn.currentOwner = turn.primaryEntry;
+    if (continuation) turn.segmentOwners[0] = turn.primaryEntry;
+    turn.primaryReady = new Promise((resolve) => { turn.resolvePrimaryReady = resolve; });
+    if (turn.primarySent) turn.resolvePrimaryReady();
+    if (continuation) {
+      // The single in-flight registration for this turn's synthetic row, and
+      // the signal that abandons it. One promise, stored ON the turn, so the
+      // drive path and a late HTTP response reason about the SAME attempt —
+      // registration and abandonment used to run blind of each other, and a
+      // registration resolving after the local deadline would adopt a row into
+      // a turn already torn down (audit #6).
+      turn.registration = null;
+      turn.registrationAbort = new AbortController();
+      // Resolves `true` once the row exists, `false` once registration gave up
+      // or was abandoned. Interactive handlers gate question creation on it: a
+      // `user_input.requested` in the gap between "continuation opened" and
+      // "row registered" would otherwise mint its card against no row id and
+      // degrade to an unsupported answer (audit #7).
+      turn.rowReady = new Promise((resolve) => { turn.resolveRowReady = resolve; });
+    }
     turn.done = new Promise((resolve, reject) => {
       turn.resolveDone = resolve;
       turn.rejectDone = reject;
     });
     // The stall watchdog and the runtime-exit observer can reject `turn.done`
-    // before `runTurn` reaches its `await` — an unhandled rejection that the
-    // worker crash guard would escalate into a whole-worker failure. This
-    // handler exists only to mark the promise as handled; the real await path
-    // still sees the rejection.
+    // before anything awaits it — an unhandled rejection that the worker crash
+    // guard would escalate into a whole-worker failure. This handler exists
+    // only to mark the promise as handled; driveTurn still sees the rejection.
     turn.done.catch(() => {});
     turn.settle = () => {
       if (turn.settled) return;
       turn.settled = true;
       turn.disarmStall();
+      // The terminal event releases the event stream at once — see
+      // `beginPublishing`. The queue rows stay owned until the publishes land.
+      beginPublishing(turn);
+      turn.resolvePrimaryReady();
+      syncDeliveryReadiness();
       turn.resolveDone();
     };
     turn.fail = (error) => {
       if (turn.settled) return;
       turn.settled = true;
       turn.disarmStall();
+      beginPublishing(turn);
+      turn.resolvePrimaryReady();
+      syncDeliveryReadiness();
       turn.rejectDone(error);
     };
     turn.disarmStall = () => {
@@ -1132,41 +2560,513 @@ export function createCopilotSdkSessionRunner({
     return turn;
   }
 
-  async function runTurn(message) {
+  // ----------------------------------------------------- prompt boundaries --
+
+  function claimSegment(turn, index, owner) {
+    // Leading unowned segments (text the runtime produced before any prompt
+    // boundary, e.g. the answer to a prompt carried over from a previous
+    // interaction) go to the first owner: that is where the merged note sent
+    // the reader.
+    for (let j = 0; j <= index; j += 1) {
+      if (!turn.segmentOwners[j]) turn.segmentOwners[j] = owner;
+    }
+  }
+
+  /**
+   * A root `user.message` arrived: the runtime started work on a prompt. Called
+   * on the dispatch chain right after the normalizer opened the prompt's
+   * segment, so `promptCount() - 1` is that segment.
+   */
+  async function noteUserMessage(turn, event) {
+    const data = event?.data && typeof event.data === 'object' ? event.data : {};
+    const index = Math.max(0, turn.normalizer.promptCount() - 1);
+    const runtimeId = String(data.messageId || '').trim();
+    const boundary = {
+      index,
+      delivery: String(data.delivery || '').trim().toLowerCase(),
+      interactionId: String(data.interactionId || '').trim(),
+    };
+    const entry = runtimeId ? turn.pushed.get(runtimeId) : null;
+    if (entry) {
+      await adoptSegment(turn, entry, boundary);
+      return;
+    }
+    // Not one of ours (yet): a prompt the runtime injected itself (an autopilot
+    // nudge, a carried-over prompt from a previous interaction), or a pushed
+    // prompt whose send() has not resolved with its id. Its text belongs to
+    // the run in progress until proven otherwise.
+    if (runtimeId && !turn.unclaimedUserMessages.has(runtimeId)) turn.unclaimedUserMessages.set(runtimeId, boundary);
+    claimSegment(turn, index, turn.currentOwner || turn.primaryEntry);
+  }
+
+  /**
+   * Bind a prompt boundary to the entry it names.
+   *
+   * `delivery:"steering"`: the runtime folded the prompt into the run already
+   * in progress — the reply that follows belongs to that run's row, and this
+   * row will settle with the fold marker (Claude's `folded`). The relay is
+   * told the prompt is consumed at once, so a crash between now and the
+   * marker fails the row instead of re-running it.
+   *
+   * Anything else (`queued`, `idle`, unknown): the prompt starts its own run
+   * on the same interaction. The previous run is over — nothing more will be
+   * produced for its row, so it is settled right away rather than at the
+   * drain's end, exactly as a Claude context finalizes when the CLI opens the
+   * next one.
+   */
+  async function adoptSegment(turn, entry, { index, delivery, interactionId }) {
+    entry.consumed = true;
+    noteCancellableChange();
+    entry.delivery = delivery || null;
+    entry.interactionId = interactionId || null;
+    const running = turn.currentOwner || turn.primaryEntry;
+    if (delivery === 'steering' && running && running !== entry && !running.settled) {
+      entry.foldedInto = running;
+      turn.segmentOwners[index] = running;
+      claimSegment(turn, index, running);
+      if (entry.role === 'steer' && !entry.consumedMarked) {
+        entry.consumedMarked = true;
+        void markConsumed(entry.message.conversationId, [entry.message]);
+      }
+      dbg('steered prompt folded into the running turn', entry.message.id, `→ ${running.message.id || '(continuation)'}`);
+      return;
+    }
+    turn.segmentOwners[index] = entry;
+    claimSegment(turn, index, entry);
+    if (running === entry) return;
+    turn.currentOwner = entry;
+    if (running && !running.settled) {
+      dbg('pushed prompt runs as its own turn; settling the previous run', entry.message.id, `after ${running.message.id || '(continuation)'}`);
+      // Off the dispatch chain: a slow relay must not stall the events of
+      // the run that just opened (or its terminator) behind this publish.
+      // A continuation whose row is not minted yet (a steer pushed past the
+      // hold after its wait ran out) settles once the row exists — publishing
+      // now would name no row — or is discarded with it.
+      const settled = running.message?.id || !turn.rowReady
+        ? settleEntry(turn, running, { type: 'completed' })
+        : turn.rowReady.then((ready) => settleEntry(turn, running, { type: ready ? 'completed' : 'discarded' }));
+      turn.settlePromises.push(settled);
+    }
+  }
+
+  // -------------------------------------------------------------- settling --
+
+  /**
+   * Whether a completed row with no text has nothing to show at all: the
+   * runtime opened it by itself (typically right after a background agent
+   * finished), its run published no tool line, thought or lane, no card was
+   * raised on it, no user message was folded into it, and nothing carried in
+   * reported a failure. Such a row would only ever read "the turn completed
+   * without a text reply", and the task card already showed the agent
+   * finishing (live, gpt-5.6-luna, 2026-09-26). A failed agent's card is gone
+   * by then, so the row carrying its failure line is kept (`showsWork`).
+   * Every delivered row keeps the note — somebody asked something there.
+   */
+  function settlesSilently(turn, entry, folded) {
+    return turn.kind === 'continuation'
+      && entry.role === 'self'
+      && !turn.humanOrigin
+      && !turn.askedHuman
+      && !turn.planBoardPosted
+      && !entry.showedWork
+      && !folded.length
+      && Boolean(entry.message?.id);
+  }
+
+  /**
+   * Settle a silent continuation by tearing its row down: the requeue route's
+   * continuation branch drops a processing continuation without an answer
+   * (`dropped: 'continuation'`), the same teardown a dead worker's rows get.
+   * A lost request leaves the row to that same stale-continuation recovery.
+   */
+  async function dropSilentContinuation(entry) {
+    dbg('continuation ended with nothing to show; dropping its row', entry.message.id);
+    await api('POST', '/api/requeue', { messageId: entry.message.id, ...attemptFields(entry.message) })
+      .catch((error) => { dbg('silent continuation drop failed', entry.message.id, error?.message || String(error)); });
+  }
+
+  /**
+   * Decide and publish one row's outcome. Idempotent per entry. A run owner's
+   * settle also settles the steers folded into its run (they were answered by
+   * its reply), in push order, after the reply itself.
+   */
+  async function settleEntry(turn, entry, outcome) {
+    if (entry.settled) return;
+    entry.settled = true;
+    const model = turn.result?.model || turn.normalizer.model || turn.model || null;
+    const folded = turn.entries.filter((other) => other !== entry && !other.settled && other.foldedInto === entry);
+    try {
+      switch (outcome.type) {
+        case 'completed': {
+          const text = finalTextFor(turn, entry, turn.result);
+          if (!text && settlesSilently(turn, entry, folded)) {
+            await dropSilentContinuation(entry);
+            break;
+          }
+          const published = text || EMPTY_TURN_COMPLETION_NOTE;
+          if (entry.role !== 'steer' && shouldPostPlanBoard({
+            relayMode: entry.message.relayMode,
+            finalText: text,
+            alreadyPosted: turn.planBoardPosted,
+            acted: turn.acted === true,
+          })) {
+            await publishPlanBoard(turn, text, 'plan-mode-fallback');
+          }
+          await publishFinalStream(entry.message, published);
+          await publishResponse(entry.message, {
+            text: published,
+            model,
+            consumedSteerIds: folded.map((other) => other.message),
+          });
+          break;
+        }
+        case 'aborted-by-user': {
+          // The queue row's fate belongs to the server-side abort control,
+          // exactly as in the Claude and Cursor workers. Publishing a response
+          // here would double-settle the row.
+          await publishFinalStream(entry.message, finalTextFor(turn, entry, turn.result));
+          break;
+        }
+        case 'user-stopped': {
+          // The run a Stop cut short while naming another row. The abort ack
+          // fails only the row it names, so this one is failed here — as
+          // stopped, never requeued: a requeue would re-run a prompt the user
+          // stopped (the Claude worker's lingering-stopped rule). Claimed
+          // first, so a crash meanwhile fails it rather than re-running it.
+          const id = String(entry.message.id || '');
+          const terminalError = buildRelayStopFailure();
+          claimSettling(entry.message, 'stopped');
+          try {
+            await publishFinalStream(entry.message, finalTextFor(turn, entry, turn.result));
+            const outcome = await publishResponse(entry.message, {
+              text: terminalError.message,
+              model,
+              terminalError,
+              requeueOnFailure: false,
+              consumedSteerIds: folded.map((other) => other.message),
+            });
+            // Not even the stop landed: the heartbeat hands it to the relay to fail.
+            if (outcome === 'failed' && id) settleFailedTerminals.set(id, terminalError);
+          } finally {
+            releaseSettling(id);
+          }
+          break;
+        }
+        case 'runtime-interrupted': {
+          const own = finalTextFor(turn, entry, turn.result);
+          const text = own ? `${own}\n\n${RUNTIME_INTERRUPTED_NOTE}` : RUNTIME_INTERRUPTED_NOTE;
+          await publishFinalStream(entry.message, text);
+          await publishResponse(entry.message, { text, model, consumedSteerIds: folded.map((other) => other.message) });
+          break;
+        }
+        case 'error': {
+          const { classified } = outcome;
+          await publishFinalStream(entry.message, entry.state.lastStreamedText);
+          await publishResponse(entry.message, {
+            text: classified.text,
+            model,
+            terminalError: terminalErrorRecord(entry.message, classified),
+            consumedSteerIds: folded.map((other) => other.message),
+          });
+          break;
+        }
+        case 'folded':
+          await publishSettleMarker(entry.message, { text: STEER_FOLDED_TEXT, model, kind: 'folded', variant: 'folded' });
+          break;
+        case 'stopped':
+          await publishSettleMarker(entry.message, { text: STEER_STOPPED_TEXT, model, kind: 'stopped', variant: 'stopped' });
+          break;
+        case 'merged-note':
+          // Accepted by the runtime, never started: still queued inside it, so
+          // it will be answered at the start of the next interaction — a
+          // requeue would run it twice.
+          await publishFinalStream(entry.message, STEERED_ROW_MERGED_NOTE);
+          await publishResponse(entry.message, { text: STEERED_ROW_MERGED_NOTE, model });
+          break;
+        case 'cancelled':
+        case 'discarded':
+        default:
+          break;
+      }
+    } catch (error) {
+      dbg('settle publish failed', entry.message?.id || '(no id)', outcome.type, error?.message || String(error));
+    } finally {
+      entry.released = true;
+      entry.resolveDone(true);
+    }
+    for (const other of folded) {
+      const foldOutcome = outcome.type === 'completed' || outcome.type === 'merged-note'
+        ? { type: 'folded' }
+        : outcome.type === 'error' ? outcome : { type: 'stopped' };
+      await settleEntry(turn, other, foldOutcome);
+    }
+  }
+
+  /** Remove our unconsumed prompts from the runtime's queued lane (best effort). */
+  async function clearOwnedQueuedItems(entries) {
+    if (!entries.length || !session || !sessionRpc.queue) return;
+    await refreshQueueLane();
+    for (const entry of entries) {
+      const itemId = queuedLane.get(entry.runtimeId);
+      if (!itemId) continue;
+      try {
+        await session.rpc.queue.removeAt({ id: itemId });
+        dbg('removed a stopped prompt from the runtime queue', entry.message.id);
+      } catch (error) {
+        dbg('queue.removeAt after Stop failed', entry.message.id, error?.message || String(error));
+      }
+    }
+  }
+
+  /**
+   * Hold pushed-but-unstarted prompts for the orphan grace, then return the
+   * ones the runtime still did not open (an opened one was adopted meanwhile
+   * and belongs to a turn of its own now).
+   */
+  async function settleAfterOrphanGrace(turn, orphans) {
+    if (!orphans.length) return [];
+    if (orphanGraceMs > 0) {
+      dbg('pushed prompts not started at idle; waiting for the runtime to open them', orphans.map((entry) => entry.message.id).join(','));
+      await sleep(orphanGraceMs);
+    }
+    return orphans.filter((entry) => entry.turn === turn && !entry.settled);
+  }
+
+  /**
+   * Publish everything a finished turn still owes, per row.
+   *
+   * Shared by both turn kinds: the runtime does not distinguish a turn it
+   * started from one it was asked for, so neither does the reporting.
+   */
+  async function finishTurn(turn) {
+    const result = turn.result;
+    const failure = turn.failure;
+    // Capture only. The POST fires from driveTurn's `finally`, after the rows
+    // have been published.
+    captureTurnUsage(turn.primaryEntry.message, result);
+
+    const pending = turn.entries.filter((entry) => !entry.settled && entry.turn === turn);
+    if (!pending.length) return;
+
+    if (failure) {
+      const classified = classifyCopilotTurnException(failure);
+      dbg('copilot turn failed', turn.message?.id || '(continuation)', classified.detail);
+      for (const entry of pending) {
+        if (entry.settled) continue;
+        await settleEntry(turn, entry, { type: 'error', classified });
+      }
+      return;
+    }
+    if (result?.isError) {
+      const classified = classifyCopilotSessionError(result.errorData || { message: result.errorMessage });
+      dbg('turn failed', turn.message?.id || '(continuation)', classified.stableCode);
+      for (const entry of pending) {
+        if (entry.settled) continue;
+        await settleEntry(turn, entry, { type: 'error', classified });
+      }
+      return;
+    }
+
+    const live = turn.currentOwner || turn.primaryEntry;
+    // The row the user pressed Stop on. Normally the live one; the relay's
+    // live-turn picker can also land on another row this turn owns, in which
+    // case THAT row is left to the relay's abort control and the live row
+    // keeps its partial reply. A Stop naming a row that is no longer pending
+    // (its early settle already published, or it is no row of this turn's)
+    // still cut the live run short — and nobody else will settle that row.
+    const namedPending = turn.aborted && turn.abortedRowId
+      ? pending.find((entry) => String(entry.message?.id || '') === turn.abortedRowId) || null
+      : null;
+    const stopped = turn.aborted ? namedPending || (turn.abortedRowId ? null : live) : null;
+    const cutRun = turn.aborted && !stopped && !live.settled ? live : null;
+    const settleOne = async (entry) => {
+      // A row that moved to a turn of its own (adoptOrphanedRun) is not ours.
+      if (entry.turn !== turn || entry.settled) return;
+      const ownsRun = entry === live || (!entry.foldedInto && entry.consumed);
+      if (turn.aborted) {
+        // A user Stop. The stopped row is settled server-side; every other
+        // row pushed into the interaction went unanswered — the runtime
+        // clears both its lanes on an interrupt — and says so, with Resend.
+        if (entry === stopped) {
+          dbg('turn aborted', entry.message.id);
+          await settleEntry(turn, entry, { type: 'aborted-by-user' });
+        } else if (entry === cutRun) {
+          dbg('turn aborted by a Stop that named another row', entry.message.id, `named ${turn.abortedRowId}`);
+          await settleEntry(turn, entry, { type: 'user-stopped' });
+        } else if (ownsRun) {
+          await settleEntry(turn, entry, { type: 'completed' });
+        } else {
+          await settleEntry(turn, entry, { type: 'stopped' });
+        }
+        return;
+      }
+      if (result?.aborted) {
+        // The runtime interrupted the turn on its own. Nothing server-side is
+        // waiting to settle these rows.
+        if (entry === live) {
+          dbg('turn interrupted by the runtime', entry.message.id);
+          await settleEntry(turn, entry, { type: 'runtime-interrupted' });
+        } else if (ownsRun) {
+          await settleEntry(turn, entry, { type: 'completed' });
+        } else {
+          await settleEntry(turn, entry, { type: 'stopped' });
+        }
+        return;
+      }
+      if (ownsRun) {
+        await settleEntry(turn, entry, { type: 'completed' });
+      } else if (entry.foldedInto) {
+        await settleEntry(turn, entry, { type: 'folded' });
+      } else {
+        await settleEntry(turn, entry, { type: 'merged-note' });
+      }
+    };
+    // A normal end with pushed prompts the runtime never started: the runtime
+    // gets a moment to open their runs (adoptOrphanedRun takes them) before
+    // they are noted as carried over — AFTER the rows whose replies are
+    // complete have been published, so a finished answer never waits on the
+    // grace. Not on a Stop (the runtime cleared them) and not on an error.
+    const orphans = (!turn.aborted && !result?.aborted)
+      ? pending.filter((entry) => entry.role === 'steer' && !entry.consumed && !entry.foldedInto)
+      : [];
+    if (turn.aborted || result?.aborted) {
+      // Belt and braces: `interruptMainTurn({flushQueued:false})` and
+      // `abort()` both empty the runtime's steering AND queued lanes
+      // (probe-verified 2026-09-25), so nothing pushed runs after a Stop. Any
+      // prompt of ours still listed in the queued lane is removed by id anyway
+      // before its row is marked stopped. (The id-less steering lane cannot be
+      // targeted, and needs no help.)
+      await clearOwnedQueuedItems(pending.filter((entry) => !entry.consumed && entry.runtimeId));
+    }
+    // The stopped row first: settling it before the live row's cascade means
+    // the cascade (which settles the steers folded into a run) cannot touch
+    // the row the relay's abort control owns. A cut run goes first too, so
+    // the steers folded into it settle through its cascade, after its stop.
+    const first = stopped || cutRun;
+    const ordered = first ? [first, ...pending.filter((entry) => entry !== first)] : pending;
+    for (const entry of ordered) {
+      if (!orphans.includes(entry)) await settleOne(entry);
+    }
+    for (const entry of await settleAfterOrphanGrace(turn, orphans)) {
+      await settleOne(entry);
+    }
+  }
+
+  // ------------------------------------------------------------ lifecycle --
+
+  /**
+   * The turn a Stop is for. Every turn's control poller runs until its
+   * `driveTurn` finishes, so a turn that is still publishing can claim a Stop
+   * meant for another: the Stop goes to the turn owning the row it names, and
+   * one naming no owned row goes to the turn that is running.
+   */
+  function stopTarget(turn, control) {
+    const rowId = String(control?.queueMessageId || '').trim();
+    if (rowId) {
+      for (const candidate of [activeTurn, ...publishingTurns]) {
+        if (candidate?.entries.some((entry) => !entry.released && String(entry.message?.id || '') === rowId)) {
+          return candidate;
+        }
+      }
+    }
+    return turn.settled && activeTurn ? activeTurn : turn;
+  }
+
+  /**
+   * Handle a Stop for `turn`. When the row it names settled early and its
+   * reply is still publishing, the Stop resolves only once that reply has
+   * landed: the relay's ack then fails the named row, which is a no-op on a
+   * completed one but would overwrite a reply still in flight.
+   */
+  async function interruptTurn(turn, control) {
+    const rowId = String(control?.queueMessageId || '').trim() || null;
+    const publishing = rowId
+      ? turn.entries.find((entry) => String(entry.message?.id || '') === rowId && entry.settled && !entry.released)
+      : null;
+    await interruptRun(turn, rowId);
+    if (publishing) await withTimeout(publishing.done, STOPPED_ROW_PUBLISH_WAIT_MS, false);
+  }
+
+  /**
+   * Interrupt the turn the user stopped. `interruptMainTurn` (when the
+   * runtime has it) stops the main agent loop and nothing else: background
+   * agents and promoted shells keep running under their own Stop, exactly
+   * like the Claude worker's targeted interrupt. `session.abort()` — the
+   * fallback — also cancels every background agent and clears both message
+   * lanes. Either way the runtime answers with an aborted idle event, which
+   * settles the turn through the normal terminator.
+   */
+  async function interruptRun(turn, rowId) {
+    if (turn.settled) {
+      // Its run is over and the main loop may already belong to the next
+      // turn, so nothing is interrupted. While it waits on a card (driveTurn)
+      // the Stop ends the cards, and the row settles as stopped.
+      if (turn.humanRequests > 0) {
+        turn.aborted = true;
+        turn.abortedRowId = rowId;
+        turn.abortController.abort();
+      }
+      return;
+    }
+    turn.aborted = true;
+    turn.abortedRowId = rowId;
+    // While `ensureSession` is still connecting there is no session to abort
+    // and this would be a silent no-op; `runTurn` re-checks `turn.aborted`
+    // once the session exists and settles there instead.
+    if (!session) return;
+    if (sessionRpc.interruptMainTurn) {
+      try {
+        const outcome = await session.rpc.interruptMainTurn({ flushQueued: false });
+        if (outcome?.interrupted === false) {
+          // Nothing was processing: no aborted idle will come. The turn is
+          // over as far as the runtime is concerned.
+          dbg('interruptMainTurn found no main turn in flight; settling locally', turn.message?.id || '');
+          turn.settle();
+        }
+        return;
+      } catch (error) {
+        dbg('interruptMainTurn failed; falling back to abort()', error?.message || String(error));
+      }
+    }
+    await session.abort?.();
+  }
+
+  /**
+   * Start a delivered turn: bring the session up, send the prompt, and hand
+   * the turn's lifecycle to `driveTurn`. Resolves when THIS row has settled —
+   * which can be before the turn ends, when a message pushed later ran as its
+   * own run and this one's reply was already complete.
+   */
+  async function runTurn(turn) {
+    const { message } = turn;
+    const entry = turn.primaryEntry;
     const model = resolvePerTurnModel(message);
+    // The dequeued row's reasoning effort (audit #9). Normalisation happens in
+    // the switcher: `none`/absent mean "the model's default".
+    const effort = message?.reasoningEffort ?? null;
     const relayMode = message?.relayMode || 'agent';
     lastRelayMode = relayMode;
-    const turn = createTurn(message);
+    turn.model = model;
     // Set before the session is touched: the heartbeat's owner-recovery guard
     // reads the active ids, so a cold-start delivery must already own its row.
     activeTurn = turn;
-
-    const controlState = controlPoller?.start?.({
-      queueMessageId: message.id,
-      onAbortTurn: async () => {
-        turn.aborted = true;
-        // While `ensureSession` is still connecting there is no session to
-        // abort and this would be a silent no-op; `runTurn` re-checks
-        // `turn.aborted` once the session exists and settles there instead.
-        if (!session) return;
-        // The runtime answers an abort with `abort` → `agent.interrupted` →
-        // `assistant.turn_end` → `session.idle{aborted:true}`, which settles
-        // the turn through the normal terminator; this only asks for it.
-        await session.abort?.();
-      },
-    });
-
+    // The delivery hold begins: nothing steers in until the prompt is sent.
+    syncDeliveryReadiness();
+    // Session-wide, not per row: the client's Stop targets whichever of this
+    // turn's rows is live, and the relay only hands out controls for rows
+    // this worker owns.
+    turn.controlState = controlPoller?.start?.({
+      queueMessageId: '',
+      onAbortTurn: (control) => interruptTurn(stopTarget(turn, control), control),
+    }) || null;
+    turn.drive = driveTurn(turn);
     try {
-      await ensureSession(model, relayMode);
+      await ensureSession(model, effort);
       if (turn.aborted) {
         // The abort landed while the session was still being built. Nothing
-        // was sent, so there is no runtime turn to interrupt — ask anyway (a
-        // queued prompt from a previous delivery could still be running) and
-        // settle locally rather than sending a prompt the user just cancelled.
+        // was sent, so there is no runtime turn to interrupt — settle locally
+        // rather than sending a prompt the user just cancelled.
         dbg('turn aborted before send', message.id);
-        try { await session?.abort?.(); } catch (error) {
-          dbg('abort during session setup failed', error?.message || String(error));
-        }
         turn.settle();
       } else {
         turn.armStall();
@@ -1174,27 +3074,152 @@ export function createCopilotSdkSessionRunner({
         const { prompt: body, attachments } = buildMessageOptionsImpl(message);
         // Relay mode marker + (on a mode change) the standing mode instructions,
         // the relay tool guidance and the live preview-lane block.
-        const prefix = await buildRelayContextPrefix(message).catch(() => '');
-        const prompt = withRelayContext(prefix, body);
+        const context = await buildRelayContextPrefix(message).catch(() => null);
+        const prompt = withRelayContext(context?.prefix, body);
         // `mode` and `attachments` are FIELDS of the single MessageOptions
         // argument — `send()` takes no second parameter, so passing options
         // positionally drops them silently.
-        await session.send({
+        const sending = session.send({
           prompt,
           ...(attachments?.length ? { attachments } : {}),
           ...(sendMode ? { mode: sendMode } : {}),
           agentMode: copilotAgentModeForRelayMode(relayMode),
         });
-        // `send()` resolves once the runtime accepted the prompt — it is NOT
-        // the turn's completion; the event stream is.
-        await turn.done;
+        // A send that never resolves (a wedged runtime) must not hold this
+        // delivery hostage once the watchdog has failed the turn: the id is
+        // still recorded if it ever arrives, but the wait ends with the turn.
+        const settledFirst = Symbol('turn-settled');
+        const runtimeId = await Promise.race([
+          sending,
+          turn.done.then(() => settledFirst, () => settledFirst),
+        ]);
+        if (runtimeId === settledFirst) {
+          sending.then((id) => assignRuntimeId(turn, entry, id)).catch(() => {});
+        } else {
+          assignRuntimeId(turn, entry, runtimeId);
+          // Committed only now that `send()` accepted the prompt (audit #32): a
+          // failed send means the runtime never READ the mode guidance, and
+          // committing before it would make the same-mode retry omit it.
+          context?.commit();
+          // The runtime has the prompt: the delivery hold ends and later
+          // deliveries steer into this turn.
+          turn.primarySent = true;
+          turn.resolvePrimaryReady();
+          syncDeliveryReadiness();
+        }
       }
-    } finally {
-      controlPoller?.stop?.(controlState);
-      await quiesceTurn(turn);
+    } catch (error) {
+      // A failure that killed the session (or came from starting it) leaves a
+      // handle nothing else can use; drop it so the next delivery rebuilds and
+      // resumes rather than sending into a dead runtime. An UNCONFIRMED MODEL
+      // SWITCH is the exception: the session is healthy and merely still on
+      // its previous model, and tearing the runtime down over it would kill
+      // any live background work for a selection problem the user fixes by
+      // picking another model.
+      if (!isModelSwitchUnconfirmedError(error)) {
+        await stopRuntime('turn-failure').catch(() => {});
+      }
+      turn.fail(error);
     }
+    // `send()` resolving is NOT the turn's completion; the event stream is.
+    await awaitEntry(turn, entry);
+    return true;
+  }
 
-    return finishTurn(turn, model);
+  /**
+   * Wait for a row's settle. A row's settle is not necessarily the turn's
+   * end: a prompt pushed later may still be running on the same interaction,
+   * and this delivery must not wait for it. But when the turn IS over, wait
+   * for its wrap-up too (ownership release, usage ingest), so a caller that
+   * awaited the delivery sees a quiescent runner — the contract every test
+   * and the crash guard rely on. `driveTurn` never rejects.
+   */
+  async function awaitEntry(turn, entry) {
+    await entry.done;
+    if (turn.settled && turn.drive) await turn.drive.catch(() => {});
+  }
+
+  /**
+   * Run a turn from its first event to its last publish.
+   *
+   * Row ownership is released only after every publish has landed: a
+   * heartbeat firing inside the publish window with no active ids would tell
+   * the relay this worker owns nothing, and the still-`processing` rows would
+   * be recovered underneath it. (The EVENT stream was already released at the
+   * terminator — see `beginPublishing` — so the runtime's next self-initiated
+   * turn can open while this one is still writing.)
+   */
+  async function driveTurn(turn) {
+    try {
+      await turn.done;
+    } catch (error) {
+      turn.failure = turn.failure || error;
+    }
+    // A card still open on this row — a background agent asking while the
+    // main loop went idle (a root question cannot get here: the loop is
+    // blocked on its handler) — keeps the row processing until it is done:
+    // the relay opens cards only on a processing row, and `/api/response`
+    // cancels the ones still open. The event stream is already released
+    // (`beginPublishing`), so new root work opens a turn of its own meanwhile.
+    if (!turn.aborted && !turn.failure && turn.humanRequests > 0) await turn.humansIdle;
+    try {
+      await quiesceTurn(turn);
+      if (turn.failure && turn.kind === 'delivered' && !isModelSwitchUnconfirmedError(turn.failure) && session) {
+        // A stall or a runtime death mid-turn (a setup failure already tore
+        // the runtime down in runTurn).
+        await stopRuntime('turn-failure').catch(() => {});
+      }
+      if (turn.kind === 'continuation') {
+        // Nothing can be published before the row exists. The buffer is
+        // drained by the registration itself; this only covers actions that
+        // arrived during the drain.
+        await awaitContinuationRow(turn);
+        // The invariant is the id, not the flag: registration can also give up
+        // by throwing, or by taking longer than `awaitContinuationRow` waits,
+        // and publishing against `messageId: null` would attribute the whole
+        // turn to nothing at all.
+        if (!turn.message.id) {
+          if (!turn.discarded) abandonContinuationRegistration(turn, 'no relay row at publish time');
+          dbg('continuation output dropped (no relay row)');
+          const classified = classifyCopilotTurnException(
+            turn.failure || new Error('the relay refused a continuation row for this turn'),
+          );
+          for (const entry of turn.entries) {
+            if (entry.settled || entry.turn !== turn) continue;
+            // The steering path is still waiting on any row it handed us, and
+            // it has no row of its own to fall back to.
+            await settleEntry(turn, entry, entry.role === 'self' ? { type: 'discarded' } : { type: 'error', classified });
+          }
+          return;
+        }
+        await flushBufferedActions(turn);
+      }
+      await finishTurn(turn);
+    } catch (error) {
+      dbg('turn publish failed', error?.message || String(error));
+    } finally {
+      // Early settles still in flight must land before the rows stop being
+      // reported (settleEntry never rejects, but this is the ordering guard).
+      await Promise.allSettled(turn.settlePromises);
+      controlPoller?.stop?.(turn.controlState);
+      turn.controlState = null;
+      // Every path through the turn — published, failed, aborted, threw — has
+      // finished by here. Anything still unresolved is released so no caller
+      // waits forever; its row is left to the relay's recovery.
+      for (const entry of turn.entries) {
+        if (entry.turn !== turn || entry.released) continue;
+        entry.settled = true;
+        entry.released = true;
+        entry.resolveDone(true);
+      }
+      // Released only once every publish for this turn's rows has landed.
+      releaseTurnOwnership(turn);
+      touch();
+      syncDeliveryReadiness();
+      // The ingest is advisory, never awaited, and must never be able to
+      // delay a reply that is already written.
+      postTurnUsage();
+    }
   }
 
   /**
@@ -1216,111 +3241,6 @@ export function createCopilotSdkSessionRunner({
     await closeStraySubagentRuns(turn).catch(() => {});
   }
 
-  /**
-   * Publish a finished turn's outcome onto its queue row (and every row steered
-   * into it).
-   *
-   * Shared by both turn kinds. A continuation reaches it through
-   * `driveContinuation` instead of `runTurn`, but the outcomes are identical:
-   * the runtime does not distinguish a turn it started from one it was asked
-   * for, so neither does the reporting.
-   */
-  async function finishTurn(turn, model) {
-    const { message } = turn;
-    const result = turn.result;
-    const responseModel = result?.model || turn.normalizer.model || model || null;
-    // Capture only. The POST fires from `handlePendingPayload`'s `finally`,
-    // after this row has been published.
-    captureTurnUsage(message, result);
-
-    // Whatever this interaction did not get to stays queued in the runtime and
-    // shifts the NEXT interaction's segments: the prompts this turn sent occupy
-    // `[firstSentSegment, nextSegmentIndex)`, and the ones the runtime never
-    // opened a segment for are still in its pending queue.
-    //
-    // The `max` against `firstSentSegment` is what makes this correct for a
-    // continuation, which occupies segment 0 without having sent anything: a
-    // continuation that opened no segment at all (an empty self-initiated turn)
-    // would otherwise report one carried prompt and shift the next real turn's
-    // answer by one.
-    const segmentsOpened = turn.normalizer.promptCount();
-    carriedPrompts = Math.max(0, turn.nextSegmentIndex - Math.max(turn.firstSentSegment, segmentsOpened));
-
-    // This row's own reply. Falls back to the whole composed text when the
-    // runtime opened no segment at all (an empty or immediately-failed turn),
-    // which is strictly better than publishing nothing.
-    const ownText = String(
-      turn.normalizer.segmentText(turn.baseSegment) || result?.text || turn.state.lastStreamedText || '',
-    ).trim();
-
-    // A user-initiated abort publishes the partial text and nothing else: the
-    // queue row's fate belongs to the server-side abort control, exactly as in
-    // the Claude and Cursor workers. Publishing a response here would
-    // double-settle the row.
-    if (turn.aborted) {
-      dbg('turn aborted', message.id);
-      // This row's segment only: the steered rows publish their own, and
-      // publishing the composed text here would show their replies twice.
-      await publishFinalStream(message, ownText);
-      // A steered row is NOT covered by the abort control (which knows only
-      // about the row the user aborted), so it still has to be settled here or
-      // it holds `processing` forever behind a renewing lease.
-      await settleSteeredRows(turn, result, responseModel);
-      return true;
-    }
-
-    // The runtime aborted on its own (`result.aborted` with no relay-side
-    // abort control in flight). Nothing server-side is waiting to settle this
-    // row, so returning here would leave it pending until the delivery
-    // watchdog fails it with a misleading "Relay timeout" — the row has to be
-    // settled with a record that says what actually happened.
-    if (result?.aborted) {
-      dbg('turn interrupted by the runtime', message.id);
-      const text = ownText ? `${ownText}\n\n${RUNTIME_INTERRUPTED_NOTE}` : RUNTIME_INTERRUPTED_NOTE;
-      await publishFinalStream(message, text);
-      await publishResponse(message, { text, model: responseModel });
-      await settleSteeredRows(turn, result, responseModel);
-      return true;
-    }
-
-    if (result?.isError) {
-      const classified = classifyCopilotSessionError(result.errorData || { message: result.errorMessage });
-      dbg('turn failed', message.id, classified.stableCode);
-      await publishFinalStream(message, turn.state.lastStreamedText);
-      await publishResponse(message, {
-        text: classified.text,
-        model: responseModel,
-        terminalError: terminalErrorRecord(message, classified),
-      });
-      // The steered rows failed with it — they were being answered by the same
-      // interaction. They get the same terminal record so each row says why.
-      await settleSteeredRows(turn, result, responseModel, classified);
-      return true;
-    }
-
-    // The turn produced a plan but never called exit-plan-mode (or the runtime
-    // build has no such hook). Same text-shape fallback the siblings use, and
-    // it must go out BEFORE the response: `/api/relay-board` 409s once the
-    // queue row leaves `processing`.
-    if (shouldPostPlanBoard({
-      relayMode: message.relayMode,
-      finalText: ownText,
-      alreadyPosted: turn.planBoardPosted,
-      acted: turn.acted === true,
-    })) {
-      await publishPlanBoard(turn, ownText, 'plan-mode-fallback');
-    }
-
-    // A terminal, non-error turn with no prose is COMPLETE, not a failed
-    // delivery — requeuing re-runs deterministically empty work until the
-    // retry cap fails the row with a misleading "Relay timeout".
-    const publishedText = ownText || EMPTY_TURN_COMPLETION_NOTE;
-    await publishFinalStream(message, publishedText);
-    await publishResponse(message, { text: publishedText, model: responseModel });
-    await settleSteeredRows(turn, result, responseModel);
-    return true;
-  }
-
   // ----------------------------------------------------------- continuation --
 
   /**
@@ -1349,36 +3269,94 @@ export function createCopilotSdkSessionRunner({
     // The gap this pin covers has closed.
     continuationDueSince = 0;
     turn.armStall();
-    // Lines produced between turns (a settled shell's notification) belong to
-    // the turn they triggered.
+    // Lines produced between turns (a settled shell's or background agent's
+    // notification) belong to the turn they triggered.
     if (pendingActivities.length) {
-      for (const text of pendingActivities.splice(0)) {
-        turn.bufferedActions.push({ channel: 'activity', payload: { text, subagentRunId: null } });
+      for (const { text, reportsFailure } of pendingActivities.splice(0)) {
+        turn.bufferedActions.push({ channel: 'activity', payload: { text, subagentRunId: null }, carried: true, reportsFailure });
       }
     }
     dbg('opening a continuation turn for runtime-initiated work');
+    syncDeliveryReadiness();
     // Both are fire-and-forget by design (the SDK's event callback is
     // synchronous and cannot await a turn), so both must swallow: an unhandled
     // rejection here would reach the worker crash guard and take the whole
-    // process down over one lost continuation.
-    registerContinuationRow(turn).catch((error) => {
+    // process down over one lost continuation. The caught chain is what lives
+    // on the turn, so `awaitContinuationRow` can race it without re-handling.
+    turn.registration = registerContinuationRow(turn).catch((error) => {
       dbg('continuation registration threw', error?.message || String(error));
       if (turn.message.id) {
         // The row was created and only the bookkeeping after it failed. Release
         // the buffer to the drive path rather than throwing away a turn that
         // has somewhere to go.
         turn.registered = true;
+        turn.resolveRowReady?.(true);
+        syncDeliveryReadiness();
         return;
       }
-      turn.discarded = true;
-      turn.bufferedActions = [];
+      abandonContinuationRegistration(turn, 'registration threw');
     });
-    driveContinuation(turn).catch((error) => {
+    turn.drive = driveTurn(turn);
+    turn.drive.catch((error) => {
       dbg('continuation driver threw', error?.message || String(error));
     });
     return turn;
   }
 
+  /**
+   * A pushed row whose run the runtime opened AFTER the turn it was pushed
+   * into had settled (the drain's idle raced the send). It is not a
+   * self-initiated turn — it is that row's own turn, and its reply belongs on
+   * that row. Returns the new turn, or null when the id is not one of ours.
+   */
+  function adoptOrphanedRun(event) {
+    if (String(event?.type || '') !== 'user.message' || event?.agentId) return null;
+    const runtimeId = String(event?.data?.messageId || '').trim();
+    if (!runtimeId) return null;
+    for (const previous of publishingTurns) {
+      const entry = previous.pushed.get(runtimeId);
+      if (!entry || entry.consumed || entry.settled) continue;
+      previous.entries = previous.entries.filter((other) => other !== entry);
+      previous.pushed.delete(runtimeId);
+      // From here the entry belongs to the new turn (`entry.turn`); the old
+      // turn's settle passes skip rows that moved away.
+      const turn = createTurn(entry.message, { kind: 'delivered', adoptEntry: entry });
+      turn.model = resolvePerTurnModel(entry.message);
+      activeTurn = turn;
+      turn.armStall();
+      turn.controlState = controlPoller?.start?.({
+        queueMessageId: '',
+        onAbortTurn: (control) => interruptTurn(stopTarget(turn, control), control),
+      }) || null;
+      dbg('a pushed prompt opened its own run after its turn settled; adopting it', entry.message.id);
+      syncDeliveryReadiness();
+      turn.drive = driveTurn(turn);
+      turn.drive.catch((error) => {
+        dbg('adopted turn driver threw', error?.message || String(error));
+      });
+      return turn;
+    }
+    return null;
+  }
+
+  /**
+   * Give up on a continuation's synthetic row: nothing buffered will ever
+   * publish, and a registration still in flight must not adopt a row into this
+   * turn when it finally answers. The one place all three abandonment paths
+   * (retries exhausted, local deadline expired, registration threw) converge,
+   * so none of them can forget the abort signal or leave `rowReady` hanging.
+   */
+  function abandonContinuationRegistration(turn, reason) {
+    turn.discarded = true;
+    turn.bufferedActions = [];
+    turn.registrationAbort?.abort?.();
+    // Interactive handlers stop waiting and take their degraded path, and the
+    // delivery hold that waited for the row ends.
+    turn.resolveRowReady?.(false);
+    syncDeliveryReadiness();
+    dbg('continuation registration abandoned:', reason);
+  }
+
   /**
    * Create the synthetic queue row and release the turn's buffered output.
    *
@@ -1389,29 +3367,59 @@ export function createCopilotSdkSessionRunner({
    * session.
    */
   async function registerContinuationRow(turn) {
+    // One idempotency key for the whole loop: a retry whose predecessor was
+    // created server-side but whose response was lost must get the SAME row
+    // back, not mint a sibling nobody will ever settle.
+    const operationId = randomUUID();
+    // Abandonment is decided elsewhere (the drive path's deadline) while this
+    // loop is parked on an HTTP await, so the state is RE-checked after every
+    // await — the transport has no abort plumbing, which makes these recheck
+    // points the only cancellation this request has.
+    const signal = turn.registrationAbort?.signal || null;
+    const abandoned = () => turn.discarded || signal?.aborted === true;
     let response = null;
     for (let attempt = 0; attempt < 3 && !response?.messageId; attempt += 1) {
-      if (turn.discarded) return;
+      if (abandoned()) return;
       response = await api('POST', '/api/continuation-turn', {
         conversationId: sdkSessionId,
         sdkSessionId,
         relayMode: turn.message.relayMode,
         trigger: CONTINUATION_TRIGGER,
+        operationId,
       }).catch((error) => {
         dbg('continuation turn registration failed', error?.message || String(error));
         return null;
       });
       if (!response?.messageId) {
+        if (abandoned()) return;
         await new Promise((resolve) => { setTimeout(resolve, continuationRetryDelayMs); });
       }
     }
     if (!response?.messageId) {
-      turn.discarded = true;
-      turn.bufferedActions = [];
-      dbg('continuation turn discarded (no relay message id)');
+      abandonContinuationRegistration(turn, 'no relay message id after 3 attempts');
+      return;
+    }
+    const messageId = String(response.messageId);
+    const attemptId = String(response.attemptId || '') || null;
+    if (abandoned()) {
+      // The drive path gave up on this turn while the request was in flight,
+      // and the server has just created a row nobody will publish into.
+      // Starting controls or flushing output here would resurrect an abandoned
+      // turn; instead the orphan row is settled explicitly — the requeue
+      // route's continuation branch tears a processing continuation down as
+      // `dropped: 'continuation'` (the same teardown the Claude worker uses
+      // for a registration that outlived its hand-off).
+      dbg('late continuation registration; tearing the orphan row down', messageId);
+      await api('POST', '/api/requeue', {
+        messageId,
+        ...(attemptId ? { attemptId } : {}),
+      }).catch(() => {});
       return;
     }
-    turn.message.id = String(response.messageId);
+    turn.message.id = messageId;
+    // The attempt the row was minted under; every publish echoes it, exactly
+    // as a delivered row echoes the attempt id its delivery carried.
+    turn.message.attemptId = attemptId;
     // The route reports which conversation the synthetic row landed on;
     // trusting it beats assuming worker session id === conversation id.
     const conversationId = String(response.conversationId || '').trim();
@@ -1419,197 +3427,378 @@ export function createCopilotSdkSessionRunner({
     // Only now is there a row to abort, so this is where the control poller can
     // start.
     turn.controlState = controlPoller?.start?.({
-      queueMessageId: turn.message.id,
-      onAbortTurn: async () => {
-        turn.aborted = true;
-        if (!session) return;
-        await session.abort?.();
-      },
+      queueMessageId: '',
+      onAbortTurn: (control) => interruptTurn(stopTarget(turn, control), control),
     }) || null;
     await flushBufferedActions(turn);
     turn.registered = true;
-  }
-
-  /** Resolve once the continuation's row exists, or its registration gave up. */
-  async function awaitContinuationRow(turn, timeoutMs = continuationRegistrationTimeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (!turn.registered && !turn.discarded && Date.now() < deadline) {
-      await new Promise((resolve) => { setTimeout(resolve, 25); });
-    }
+    turn.resolveRowReady?.(true);
+    // The row exists: the delivery hold it imposed ends (canAcceptSteering).
+    syncDeliveryReadiness();
   }
 
   /**
-   * Run a continuation to its terminator and publish it, mirroring
-   * `handlePendingPayload`'s outer shape.
-   *
-   * `activeTurn` is cleared only after every publish has landed, exactly as for
-   * a delivered turn: a heartbeat firing inside the publish window with no
-   * active ids would tell the relay this worker owns nothing, and the
-   * still-`processing` synthetic row would be recovered underneath it.
+   * Resolve once the continuation's row exists, its registration gave up, or
+   * the local deadline expires — in which case the turn is ABANDONED, so the
+   * registration cannot later adopt a row into it (it tears the row down
+   * instead; see `registerContinuationRow`'s late-response branch).
    */
-  async function driveContinuation(turn) {
-    let failure = null;
-    try {
-      await turn.done;
-    } catch (error) {
-      failure = error;
-    }
-    try {
-      await quiesceTurn(turn);
-      // Nothing can be published before the row exists. The buffer is drained
-      // by the registration itself; this only covers actions that arrived
-      // during the drain.
-      await awaitContinuationRow(turn);
-      // The invariant is the id, not the flag: registration can also give up by
-      // throwing, or by taking longer than `awaitContinuationRow` waits, and
-      // publishing against `messageId: null` would attribute the whole turn to
-      // nothing at all.
-      if (!turn.message.id) {
-        turn.discarded = true;
-        turn.bufferedActions = [];
-        dbg('continuation output dropped (no relay row)');
-        // The steering path is still waiting on any row it handed us, and it
-        // has no row of its own to fall back to.
-        await settleSteeredRows(turn, null, null, classifyCopilotTurnException(
-          failure || new Error('the relay refused a continuation row for this turn'),
-        )).catch(() => {});
-        return;
-      }
-      await flushBufferedActions(turn);
-      if (failure) {
-        const classified = classifyCopilotTurnException(failure);
-        dbg('continuation turn failed', turn.message.id, classified.detail);
-        await publishResponse(turn.message, {
-          text: classified.text,
-          model: null,
-          terminalError: terminalErrorRecord(turn.message, classified),
-        });
-        await settleSteeredRows(turn, null, null, classified).catch(() => {});
-        return;
-      }
-      await finishTurn(turn, '');
-    } catch (error) {
-      dbg('continuation publish failed', error?.message || String(error));
-    } finally {
-      controlPoller?.stop?.(turn.controlState);
-      turn.controlState = null;
-      if (activeTurn === turn) activeTurn = null;
-      touch();
-      // A continuation spends real quota (the live capture burned a premium
-      // request on `read_bash` + the reply), so its numbers ride the same
-      // fire-and-forget ingest as a delivered turn's.
-      postTurnUsage();
+  async function awaitContinuationRow(turn, timeoutMs = continuationRegistrationTimeoutMs) {
+    if (turn.registered || turn.discarded) return;
+    let timer = null;
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(() => resolve('expired'), timeoutMs);
+      timer.unref?.();
+    });
+    // `turn.registration` is the caught chain and never rejects.
+    const outcome = await Promise.race([turn.registration || Promise.resolve(), expired]);
+    clearTimeout(timer);
+    if (outcome === 'expired' && !turn.registered && !turn.message.id) {
+      abandonContinuationRegistration(turn, 'registration outlived the local deadline');
     }
   }
 
-  /**
-   * Settle every queue row that was steered into this interaction.
-   *
-   * The runtime answers the original prompt AND every prompt queued behind it
-   * under ONE `session.idle` (live-verified — see the plan doc §5), so no
-   * second turn will ever settle these rows. Each one is answered with the text
-   * of ITS OWN prompt segment, which the normalizer separates using the
-   * `user.message` events that mark where the runtime picked each prompt up.
-   *
-   * A row whose prompt the runtime accepted but never started work on has no
-   * segment. It is NOT requeued: the prompt is still sitting in the runtime's
-   * pending queue and will be answered at the start of the next turn, so
-   * redelivering it would run the same prompt twice. It gets a note instead —
-   * the same trade the Claude worker makes for a handed-off context.
-   */
-  async function settleSteeredRows(turn, result, responseModel, classified = null) {
-    if (!turn.steeredRows.length) return;
-    for (const steered of turn.steeredRows) {
-      const { message: steeredMessage, segmentIndex } = steered;
-      let text = String(turn.normalizer.segmentText(segmentIndex) || '').trim();
-      if (classified) {
-        text = classified.text;
-      } else if (!text) {
-        text = STEERED_ROW_MERGED_NOTE;
-      }
-      await publishFinalStream(steeredMessage, text);
-      await publishResponse(steeredMessage, {
-        text,
-        model: responseModel,
-        ...(classified ? { terminalError: terminalErrorRecord(steeredMessage, classified) } : {}),
-      });
-      steered.settle?.();
-    }
-    turn.steeredRows.length = 0;
-  }
+  // --------------------------------------------------------------- steering --
 
   /**
-   * A delivery arrived while a turn was already running.
+   * A delivery arrived while a turn was already running: push it into the
+   * same runtime interaction as a steer.
    *
-   * The relay's worker socket is single-flight — it will not deliver a second
-   * row until `onDeliver` resolves — so this is not the normal path. It is
-   * reachable on a socket reconnect that redelivers, and it is the path a
-   * future relay change would take, so it steers rather than corrupting the
-   * turn: the prompt is queued into the SAME interaction (which is all
-   * `mode: "enqueue"` can do — it cannot interrupt an in-flight model call),
-   * and the row is adopted so the interaction's terminator settles it too.
+   * `mode: "immediate"` makes it a real steer — injected at the next tool
+   * boundary (`delivery:"steering"`, folded into the running reply), or run
+   * as its own turn right after when the model is mid-stream
+   * (`delivery:"queued"`). Either way the row is owned by this turn and
+   * settled by it (see adoptSegment / finishTurn); nothing else will.
    *
-   * The row is registered BEFORE the send so a failure between the two cannot
-   * leave a row nobody owns.
+   * The entry is registered BEFORE the send so a failure between the two
+   * cannot leave a row nobody owns.
    */
   async function steerIntoActiveTurn(turn, message) {
     const { prompt: body, attachments } = buildMessageOptionsImpl(message);
     // A real relay round trip on the first turn of a mode — long enough for the
     // turn to finish underneath us.
-    const prefix = await buildRelayContextPrefix(message).catch(() => '');
-    const prompt = withRelayContext(prefix, body);
+    const context = await buildRelayContextPrefix(message).catch(() => null);
+    // The hidden steer note (shared/steer-note.mjs): a steer that lands before
+    // the model's first output otherwise tempts it to answer only the newest
+    // message and drop the request it was working on (burn-in 2026-09-25).
+    // Not in a continuation: there the running work is the runtime's own
+    // follow-up, not a request of the user's to keep going with.
+    const prompt = withRelayContext(context?.prefix, turn.kind === 'continuation' ? body : withSteerNote(body));
     // Re-checked AFTER the awaits and before anything is sent or registered.
-    // `settleSteeredRows` has already run if the turn settled during them, so a
-    // row pushed now would never be settled and its caller would wait forever —
-    // wedging the single-flight delivery socket. Nothing has been sent yet, so
-    // handing the row back to the normal path is free.
+    // Nothing has been sent yet, so handing the row back to the normal path is
+    // free.
     if (turn.settled) {
       dbg('turn settled while steering was preparing; running it as a fresh turn', message.id);
       return NOT_STEERED;
     }
-    // Prompts are consumed in the order they were sent, and each opens its own
-    // `user.message` segment as it is picked up, so this prompt's send position
-    // (after any prompts carried over from a previous interaction, and after
-    // whatever the interaction itself occupies) is its segment index.
-    const segmentIndex = turn.nextSegmentIndex;
-    turn.nextSegmentIndex += 1;
-    turn.promptsSent += 1;
-    const steered = { message, segmentIndex };
-    steered.done = new Promise((resolve) => { steered.settle = resolve; });
-    turn.steeredRows.push(steered);
-    dbg('steering a mid-turn delivery into the running turn', message.id, `segment=${segmentIndex}`);
+    const entry = createEntry(turn, message, 'steer');
+    dbg('steering a mid-turn delivery into the running turn', message.id);
+    let runtimeId;
+    // Counted until send() names the message (see `steerSendsInFlight`).
+    steerSendsInFlight += 1;
+    entry.sendSeq = ++steerSendSeq;
     try {
-      await session.send({
+      runtimeId = await session.send({
         prompt,
         ...(attachments?.length ? { attachments } : {}),
-        mode: 'enqueue',
+        mode: 'immediate',
         agentMode: copilotAgentModeForRelayMode(message?.relayMode || 'agent'),
       });
     } catch (error) {
       // The prompt never reached the runtime, so nothing will answer it and the
       // row is safe to requeue — unlike an accepted one.
-      turn.steeredRows = turn.steeredRows.filter((entry) => entry !== steered);
+      turn.entries = turn.entries.filter((other) => other !== entry);
+      entry.settled = true;
+      entry.released = true;
+      entry.resolveDone(true);
+      steerSendsInFlight = Math.max(0, steerSendsInFlight - 1);
       dbg('steering send failed, requeuing the row', message.id, error?.message || String(error));
-      await api('POST', '/api/requeue', { messageId: message.id }).catch(() => {});
+      await api('POST', '/api/requeue', { messageId: message.id, ...attemptFields(message) }).catch(() => {});
       return true;
     }
-    // Resolves when the interaction settles this row in `settleSteeredRows`.
-    await steered.done;
+    assignRuntimeId(turn, entry, runtimeId);
+    steerSendsInFlight = Math.max(0, steerSendsInFlight - 1);
+    // Same commit-after-send rule as `runTurn` (audit #32): a steered prompt
+    // whose send failed never delivered its guidance, so the retry must
+    // include it again.
+    context?.commit();
+    scheduleQueueLaneRefresh();
+    // Resolves when the interaction settles this row.
+    await awaitEntry(turn, entry);
+    return true;
+  }
+
+  // ------------------------------------------------------------------ gate --
+
+  /**
+   * Whether a message delivered now would steer into the live turn. False
+   * while: no session / no live turn; the turn-opening prompt has not been
+   * sent yet, or a continuation's row does not exist yet (the delivery hold —
+   * a second send before the first would invert the runs, and a steer's run
+   * would settle the continuation's reply against no row while its buffered
+   * output flushed into the steered one); a question card, ask-mode approval
+   * or elicitation is open (the relay must not push past a card); a
+   * compaction is running.
+   */
+  function canAcceptSteering() {
+    if (disposed || !session) return false;
+    const turn = activeTurn;
+    if (!turn || turn.settled || turn.aborted) return false;
+    if (!turn.primarySent || awaitingRow(turn)) return false;
+    if (pendingHumanRequests > 0) return false;
+    if (isCompacting()) return false;
+    return true;
+  }
+
+  /** A continuation whose synthetic row is still being minted (and not given up on). */
+  function awaitingRow(turn) {
+    return turn.kind === 'continuation' && !turn.registered && !turn.discarded;
+  }
+
+  /**
+   * The one steering gate. A delivery arriving now is held — handed back to
+   * the queue instead of pushed — when a turn is live (or a human request /
+   * compaction is open) and it cannot accept a steer. The socket link consults
+   * this for its readiness too, idle or mid-delivery.
+   */
+  function isDeliveryHeld() {
+    if (disposed) return false;
+    const turn = activeTurn;
+    const live = Boolean(turn && !turn.settled);
+    if (!live && pendingHumanRequests === 0 && !isCompacting()) return false;
+    return !canAcceptSteering();
+  }
+
+  function syncDeliveryReadiness() {
+    const ready = !isDeliveryHeld();
+    if (ready === lastReportedDeliveryReady) return;
+    lastReportedDeliveryReady = ready;
+    try {
+      onDeliveryReadinessChange(ready);
+    } catch (error) {
+      dbg('delivery readiness listener failed', error?.message || String(error));
+    }
+  }
+
+  /**
+   * Give a held delivery back to the queue with no retry penalty. The relay
+   * re-delivers it once this worker signals ready again, i.e. when the hold
+   * ends — the message then steers into the resumed turn. Pushing it into the
+   * hold instead would bypass the question card or land inside a compaction.
+   */
+  async function handBackHeldDelivery(message) {
+    dbg('steering held; handing the delivery back to the queue', message.id || '(no id)');
+    if (!message.id) return false;
+    await api('POST', '/api/requeue', {
+      messageId: message.id,
+      class: 'steering-held',
+      ...attemptFields(message),
+    }).catch((error) => {
+      if (isStaleAttemptError(error)) {
+        dbg('steering-held hand-back refused as stale_attempt', message.id);
+        return;
+      }
+      dbg('steering-held hand-back failed', message.id, error?.message || String(error));
+    });
+    return false;
+  }
+
+  function* ownedEntries() {
+    if (activeTurn) yield* activeTurn.entries;
+    for (const turn of publishingTurns) yield* turn.entries;
+  }
+
+  /**
+   * Pushed rows the client may still cancel: unconsumed and recallable — in
+   * practice the newest waiting steer (immediate sends wait in the runtime's
+   * id-less steering lane), or any row that sits in the queued lane.
+   */
+  function cancellableIds() {
+    const ids = [];
+    for (const entry of unconsumedSteers()) {
+      if (!recallMethodFor(entry)) continue;
+      const id = String(entry.message?.id || '').trim();
+      if (id && !ids.includes(id)) ids.push(id);
+    }
+    return ids;
+  }
+
+  /**
+   * Composer-facing steering snapshot, published on the heartbeat: whether a
+   * turn is live, whether a message typed now would steer into it, and — when
+   * it would not — why. `supported` is how the client learns this Copilot
+   * conversation steers at all (its provider type alone cannot tell an SDK
+   * worker from the extension engine); `cancellableIds` are the pushed rows
+   * that may still be pulled back out of the runtime (decision 8).
+   */
+  function steeringState() {
+    const turn = activeTurn;
+    const turnActive = Boolean(turn && !turn.settled);
+    const canSteer = canAcceptSteering();
+    let holdReason = null;
+    if (turnActive && !canSteer) {
+      if (pendingHumanRequests > 0) holdReason = 'question';
+      else if (isCompacting()) holdReason = 'compaction';
+      else if (!turn.primarySent || awaitingRow(turn)) holdReason = 'delivery';
+      else holdReason = 'other';
+    }
+    const messageId = String(turn?.currentOwner?.message?.id || turn?.message?.id || '').trim() || null;
+    return { turnActive, canSteer, holdReason, messageId, supported: true, cancellableIds: cancellableIds() };
+  }
+
+  /**
+   * Re-read the queue, and — only if the prompt is still recallable at that
+   * instant — issue its remove request in the same tick as the check, so no
+   * steer send can be issued in between (JSON-RPC keeps request order).
+   */
+  async function recallPushedPrompt(entry, id) {
+    // Watched from before the read, so a fold that lands during the read or
+    // the remove is seen however far behind the dispatch chain runs.
+    const watch = { taken: false };
+    recallWatches.set(entry.runtimeId, watch);
+    try {
+      // Only the READ is bounded: a runtime that will not answer it gets no
+      // remove at all. Once a remove is sent it is seen through to its answer —
+      // giving up on it could leave the prompt removed and the row uncancelled.
+      const fresh = await withTimeout(refreshQueueLane().then(() => true), UNSTEER_TIMEOUT_MS, false);
+      if (!fresh) {
+        dbg('un-steer refused: the runtime did not answer the queue read in time', id);
+        return false;
+      }
+      const target = session;
+      const method = watch.taken ? null : recallMethodFor(entry);
+      if (!target || !method) {
+        dbg('un-steer refused: the runtime no longer holds this prompt as recallable', id);
+        return false;
+      }
+      const request = method.kind === 'queued'
+        ? target.rpc.queue.removeAt({ id: method.itemId })
+        : target.rpc.queue.removeMostRecent();
+      const removed = (await request)?.removed === true;
+      if (removed && (watch.taken || entry.consumed || entry.settled)) {
+        // The runtime took this prompt before it processed the remove, so
+        // what was removed is some other waiting message — another client's,
+        // never a runtime notification (see `recallWatches`). It cannot be put
+        // back; this row settles through its normal path.
+        dbg('UN-STEER MISMATCH: the runtime took the prompt before the remove; the remove took another message', id, method.kind);
+        return false;
+      }
+      return removed;
+    } finally {
+      if (recallWatches.get(entry.runtimeId) === watch) recallWatches.delete(entry.runtimeId);
+    }
+  }
+
+  function withTimeout(promise, ms, fallback) {
+    let timer = null;
+    return Promise.race([
+      promise,
+      new Promise((resolve) => { timer = setTimeout(() => resolve(fallback), ms); timer.unref?.(); }),
+    ]).finally(() => clearTimeout(timer));
+  }
+
+  /**
+   * Un-steer (decision 8, narrowed 2026-09-25 after the live check): pull a
+   * pushed-but-unconsumed row back out of the runtime and cancel it. Immediate
+   * sends wait in the runtime's id-less steering lane, so only the NEWEST
+   * waiting one is recallable (`queue.removeMostRecent`); a row in the queued
+   * lane goes by its stable id. A prompt the runtime already took cannot be
+   * recalled; the control is then a no-op and the row settles normally.
+   */
+  async function cancelPushedMessage(messageId) {
+    const id = String(messageId || '').trim();
+    if (!id) return false;
+    let entry = null;
+    for (const candidate of ownedEntries()) {
+      if (String(candidate.message?.id || '') === id) { entry = candidate; break; }
+    }
+    if (!entry || entry.consumed || entry.settled || !entry.runtimeId) {
+      dbg('un-steer refused: row not cancellable', id, entry ? `consumed=${entry.consumed} settled=${entry.settled}` : 'unknown row');
+      return false;
+    }
+    if (!session || !sessionRpc.queue) return false;
+    // One un-steer at a time; each re-reads the queue (that read is bounded —
+    // see recallPushedPrompt). Steer sends never wait on this chain.
+    const run = unsteerChain.then(() => recallPushedPrompt(entry, id));
+    unsteerChain = run.catch(() => false);
+    const removed = await run.catch((error) => {
+      dbg('un-steer failed', id, error?.message || String(error));
+      return false;
+    });
+    if (!removed) return false;
+    // Settled meanwhile by its turn's end, or taken since the answer (the
+    // remove then took another message): it keeps its normal outcome.
+    if (entry.consumed || entry.settled) {
+      dbg('un-steer raced the runtime taking the prompt or the row settling; leaving it to settle normally', id);
+      return false;
+    }
+    entry.cancelled = true;
+    entry.settled = true;
+    while (recalledRuntimeIds.size >= MAX_RECALLED_RUNTIME_IDS) recalledRuntimeIds.delete(recalledRuntimeIds.keys().next().value);
+    recalledRuntimeIds.set(entry.runtimeId, id);
+    dbg('un-steered a pushed prompt', id);
+    // The prompt is gone from the runtime; the row must end cancelled and
+    // never be re-delivered. It stays owned (settling, with the terminal
+    // wording the crash guard would send) until the relay acknowledges the
+    // cancel; if the relay never does, the heartbeat hands it over to fail.
+    claimSettling(entry.message, 'cancelled');
+    const cancelBody = {
+      conversationId: entry.message.conversationId,
+      messageId: id,
+      ...attemptFields(entry.message),
+    };
+    let acknowledged = false;
+    for (let attempt = 0; ; attempt += 1) {
+      acknowledged = await api('POST', '/api/queue-cancelled', cancelBody).then(() => true, (error) => {
+        dbg('queue-cancelled publish failed', id, error?.message || String(error));
+        // The row already left `processing` (answered, recovered, or already
+        // cancelled): nothing left for this worker to do.
+        return Number(error?.status) === 404 || Number(error?.status) === 409;
+      });
+      if (acknowledged || attempt >= settleRetryDelaysMs.length) break;
+      await sleep(settleRetryDelaysMs[attempt]);
+    }
+    if (!acknowledged) {
+      dbg('queue-cancelled could not be posted; handing the row to the heartbeat', id);
+      settleFailedTerminals.set(id, buildSteerSettleFailure(entry.message, { variant: 'cancelled', agentLabel: SETTLE_AGENT_LABEL }));
+    }
+    releaseSettling(id);
+    entry.released = true;
+    entry.resolveDone(true);
+    const turn = entry.turn;
+    if (turn) {
+      turn.entries = turn.entries.filter((other) => other !== entry);
+      turn.pushed.delete(entry.runtimeId);
+    }
+    scheduleQueueLaneRefresh();
     return true;
   }
 
   async function handlePendingPayload(pending) {
     const message = pending?.message || null;
     if (!message) return false;
+    // Held (a card is open, a compaction is running, the turn-opening prompt
+    // is not sent yet): hand the row back with no retry penalty; the relay
+    // re-delivers it when the hold ends. An older relay (the worker updated on
+    // disk before the relay restarted) treats the hand-back as a failed
+    // delivery — retry, backoff, worker marked errored — so against one the
+    // message is pushed the legacy way.
+    if (isDeliveryHeld() && canHandBackHeldDelivery() !== false) return handBackHeldDelivery(message);
+    // Legacy path only: never send a second prompt before the turn-opening one
+    // (it would invert the runs), and never start a second turn beside one
+    // that is still connecting.
+    if (activeTurn && !activeTurn.settled && !activeTurn.primarySent) {
+      await activeTurn.primaryReady;
+    }
+    // Nor steer into a continuation before its row exists (canAcceptSteering);
+    // bounded like the registration itself, which can hang on a dead relay.
+    if (activeTurn && !activeTurn.settled && awaitingRow(activeTurn)) {
+      await withTimeout(activeTurn.rowReady, continuationRegistrationTimeoutMs, false);
+    }
     // A delivery that lands while a turn is running is steered into it rather
     // than starting a second one: the runtime has a single conversation and a
     // concurrent `send` would interleave into the same interaction anyway —
     // this way the row is owned and settled instead of orphaned.
-    //
-    // Deliberately OUTSIDE the try/finally below: that `finally` clears
-    // `activeTurn`, and a steered call returns while the turn it was steered
-    // into is still publishing. Clearing there would tell the heartbeat this
-    // worker owns nothing and the relay would recover the live row.
     if (activeTurn && !activeTurn.settled && session) {
       const turn = activeTurn;
       try {
@@ -1626,74 +3815,68 @@ export function createCopilotSdkSessionRunner({
         return true;
       }
     }
-    try {
-      return await runTurn(message);
-    } catch (error) {
-      const classified = classifyCopilotTurnException(error);
-      dbg('copilot turn failed', message.id, classified.detail);
-      // A failure that killed the session (or came from starting it) leaves a
-      // handle nothing else can use; drop it so the next delivery rebuilds and
-      // resumes rather than sending into a dead runtime.
-      await stopRuntime('turn-failure').catch(() => {});
-      await publishResponse(message, {
-        text: classified.text,
-        model: null,
-        terminalError: terminalErrorRecord(message, classified),
-      });
-      // Rows steered into the turn that just threw are owed a response too —
-      // and, more urgently, `steerIntoActiveTurn` is still awaiting their
-      // settle. Skipping this would wedge that caller (and its queue row)
-      // forever behind a heartbeat that keeps renewing the lease.
-      if (activeTurn) {
-        await settleSteeredRows(activeTurn, null, null, classified).catch(() => {});
-        await closeStraySubagentRuns(activeTurn).catch(() => {});
-      }
-      return true;
-    } finally {
-      // Cleared only once every publish for this row has landed. A heartbeat
-      // that fired during the publish window with no active ids would tell the
-      // relay this worker owns nothing, and the still-processing row would be
-      // recovered (`owner-heartbeat-idle`) and re-delivered — a duplicate
-      // execution racing the response that was already on its way.
-      activeTurn = null;
-      touch();
-      // Every path through the turn — published, failed, aborted, threw — has
-      // finished by here, which is the only safe place for the ingest: it is
-      // advisory, it is not awaited, and it must never be able to delay a reply
-      // that is already written.
-      postTurnUsage();
-    }
+    const turn = createTurn(message);
+    return runTurn(turn);
   }
 
   // --------------------------------------------------------------- teardown --
 
   function getActiveQueueMessageId() {
-    return activeTurn ? String(activeTurn.message?.id || '') : '';
+    const live = activeTurn?.currentOwner;
+    if (live && !live.released && live.message?.id) return String(live.message.id);
+    for (const entry of ownedEntries()) {
+      const id = String(entry.message?.id || '');
+      if (id && !entry.released) return id;
+    }
+    return '';
   }
 
   /**
-   * Every row this worker owns — the turn's own, plus any steered into it.
+   * Every row this worker owns — the running turn's rows and the same for
+   * every settled turn still publishing — as `{ id, attemptId }` entries; a
+   * consumed row whose settle marker is still being saved carries the
+   * terminal failure the crash guard must send instead of a requeue, because
+   * its prompt must never run twice. A row missing from this list would be
+   * recovered mid-flight and re-delivered while the runtime was still
+   * answering it.
    *
    * Both the heartbeat (lease renewal) and the crash guard (requeue-on-exit)
-   * read this. A steered row missing from it would be recovered mid-flight as
-   * `owner-heartbeat-mismatch` and re-delivered while the runtime was still
-   * answering it.
+   * read this: the crash guard takes the entries whole so its requeues stay
+   * fenced to this attempt, while the worker's heartbeat call site unwraps the
+   * ids (the claim payload is id-only).
    */
   function getActiveQueueMessageIds() {
-    if (!activeTurn) return [];
-    const ids = [];
-    const primary = String(activeTurn.message?.id || '');
-    if (primary) ids.push(primary);
-    for (const steered of activeTurn.steeredRows || []) {
-      const id = String(steered.message?.id || '');
-      if (id && !ids.includes(id)) ids.push(id);
+    const entries = [];
+    const byId = new Map();
+    const push = (message, terminalError = null) => {
+      const id = String(message?.id || '').trim();
+      if (!id) return;
+      const existing = byId.get(id);
+      if (existing) {
+        if (terminalError && !existing.terminalError) existing.terminalError = terminalError;
+        return;
+      }
+      const entry = { id, attemptId: message?.attemptId || null, ...(terminalError ? { terminalError } : {}) };
+      byId.set(id, entry);
+      entries.push(entry);
+    };
+    for (const entry of ownedEntries()) {
+      if (entry.released) continue;
+      push(entry.message);
     }
-    return ids;
+    for (const { message, variant } of settlingMessages.values()) {
+      push(message, buildSteerSettleFailure(message, { variant, agentLabel: SETTLE_AGENT_LABEL }));
+    }
+    return entries;
   }
 
   async function dispose() {
     disposed = true;
     stopLifecycleTimer();
+    if (queueLaneTimer) {
+      clearTimeout(queueLaneTimer);
+      queueLaneTimer = null;
+    }
     // A question card left `pending` would sit in the UI inviting an answer
     // that nothing is left to read. Time them out before the socket goes.
     await questionBridge.cancelPendingQuestions?.().catch?.(() => {});
@@ -1704,7 +3887,21 @@ export function createCopilotSdkSessionRunner({
     handlePendingPayload,
     getActiveQueueMessageId,
     getActiveQueueMessageIds,
-    isTurnActive: () => !!activeTurn,
+    // The delivery gate (the socket link's probes) and the composer snapshot
+    // (the heartbeat's).
+    canAcceptSteering,
+    isDeliveryHeld,
+    steeringState,
+    getSettleFailed,
+    acknowledgeSettleFailed,
+    cancelPushedMessage,
+    // The task panel's per-card Stop (`rpc.tasks.cancel`); also what a
+    // subagent lane's Stop tries — the runtime tracks sync agents in the same
+    // registry and refuses ids it does not know.
+    stopBackgroundTask,
+    // "Active" spans both ownerships: a settled turn still publishing must
+    // keep the worker's idle/shutdown gates closed just like a running one.
+    isTurnActive: () => !!activeTurn || publishingTurns.size > 0,
     dispose,
     // The turn's tokens/cost/TTFT, as posted to `/api/copilot-plan-usage`.
     getLastTurnUsage: () => lastTurnUsage,
@@ -1712,17 +3909,46 @@ export function createCopilotSdkSessionRunner({
     // never awaits this, which is what keeps a slow relay from holding a
     // finished reply.
     whenUsagePosted: () => usagePostChain,
+    // The in-flight model-catalog snapshot POST — the same kind of seam.
+    whenModelSnapshotPosted: () => modelSnapshotChain,
+    // The in-flight queued-lane read — same kind of seam.
+    whenQueueLaneRefreshed: () => queueLaneRefreshChain,
+    // The in-flight `rpc.tasks.list()` re-read — same kind of seam. A refresh
+    // that is still debounced counts too, so a caller sees the registry read
+    // that the last event scheduled.
+    whenTasksRefreshed: () => (taskRefreshTimer
+      ? new Promise((resolve) => { setTimeout(resolve, taskRefreshMs + 5); }).then(() => taskRefreshChain)
+      : taskRefreshChain),
     // Test seams / observability.
     _getState: () => ({
       hasClient: !!client,
       hasSession: !!session,
-      appliedModel,
+      appliedModel: appliedModel(),
+      // The confirmed reasoning effort (null = the model's default).
+      appliedEffort: modelSwitch.current().effort,
       lastActivityAt,
       // 'delivered' | 'continuation' | '' — which kind of turn, if any, owns
-      // the worker right now.
+      // the runtime-event stream right now.
       activeTurnKind: activeTurn?.kind || '',
+      // Settled turns whose relay publishes have not all landed yet.
+      publishingTurnCount: publishingTurns.size,
       backgroundShells: backgroundShells.live(),
+      backgroundTasks: sessionRpc.tasks ? registryCards() : shellTrackerCards(),
       continuationDueSince,
+      compacting: isCompacting(),
+      pendingHumanRequests,
+      sessionRpc: { ...sessionRpc },
+      activeEntries: activeTurn
+        ? activeTurn.entries.map((entry) => ({
+            id: entry.message?.id || null,
+            role: entry.role,
+            runtimeId: entry.runtimeId,
+            consumed: entry.consumed,
+            delivery: entry.delivery,
+            settled: entry.settled,
+            foldedInto: entry.foldedInto?.message?.id || null,
+          }))
+        : [],
     }),
     _evaluateLifecycle: evaluateLifecycle,
   };