@oar-sh/oar 0.9.2 → 0.9.4

package/server/copilot-worker/copilot-sdk-session-process.mjs

@@ -63,10 +63,12 @@ import { resolveCopilotProviderConfig } from './copilot-byok-provider.mjs';
 import {
   createBackgroundShellTracker,
   createReplayGate,
+  describeSettledAgent,
   describeSettledShell,
   isContinuationOpeningEvent,
+  settledAgentFromNotification,
 } from './copilot-continuation-signals.mjs';
-import { createCopilotEventNormalizer } from './copilot-sdk-event-normalizer.mjs';
+import { createCopilotEventNormalizer, formatToolActivityText } from './copilot-sdk-event-normalizer.mjs';
 import {
   DEFAULT_MODEL_SWITCH_TIMEOUT_MS,
   createCopilotModelSwitcher,
@@ -74,6 +76,16 @@ import {
   normalizeRelayEffort,
 } from './copilot-model-switch.mjs';
 import { createCopilotQuestionBridge } from './copilot-question-bridge.mjs';
+import {
+  RELAY_ASK_USER_TOOL_DESCRIPTION,
+  RELAY_ASK_USER_TOOL_NAME,
+  RELAY_ASK_USER_TOOL_PARAMETERS,
+  formatAskUserToolResult,
+  isToolOverrideRejection,
+  parseAskUserToolArguments,
+} from './copilot-ask-user-tool.mjs';
+import { buildCopilotRemoteRelayTool } from './copilot-remote-relay-tool.mjs';
+import { createRemoteRelayToolGate } from '../../shared/remote-relay-tool-core.mjs';
 import {
   EXIT_PLAN_BOARD_POSTED_FEEDBACK,
   EXIT_PLAN_NO_BOARD_FEEDBACK,
@@ -89,6 +101,11 @@ import {
 } from './copilot-prompt-context.mjs';
 import { EMPTY_TURN_COMPLETION_NOTE } from '../../shared/empty-turn-completion.mjs';
 import { buildModelSnapshotFields, extractModelDescriptors } from '../../shared/model-descriptors.mjs';
+import { buildRelayStopFailure } from '../../shared/relay-stop-failure.mjs';
+import { STEER_FOLDED_TEXT, STEER_STOPPED_TEXT } from '../../shared/steer-settle-markers.mjs';
+import { buildSteerSettleFailure } from '../../shared/steer-settle-failure.mjs';
+import { shouldEmitStreamUpdate } from '../../shared/stream-emit-gating.mjs';
+import { withSteerNote } from '../../shared/steer-note.mjs';
 
 // How long the runtime may sit with no session activity before the worker
 // closes it. The worker process itself stays up and reconnects lazily on the
@@ -132,6 +149,45 @@ const DEFAULT_CONTINUATION_RETRY_DELAY_MS = 500;
 const CONTINUATION_REGISTRATION_TIMEOUT_MS = 10_000;
 /** Cap on activity lines carried between turns, so a chatty runtime cannot grow them. */
 const MAX_PENDING_ACTIVITIES = 20;
+/**
+ * Backstop for the compaction hold: `session.compaction_start` without a
+ * matching `_complete` (a runtime that died mid-compaction and was resumed)
+ * must not hold steering forever. Sized far above any plausible compaction,
+ * like the Claude worker's `compactionStaleMs`.
+ */
+const DEFAULT_COMPACTION_STALE_MS = 10 * 60_000;
+/**
+ * Backoff between attempts to save a consumed steer's settle marker (~31 s in
+ * all); after the last one the row fails terminally instead. Same ladder as
+ * the Claude worker, because it protects the same invariant: a prompt the
+ * runtime already consumed is never re-run.
+ */
+const DEFAULT_SETTLE_RETRY_DELAYS_MS = Object.freeze([1_000, 2_000, 4_000, 8_000, 8_000, 8_000]);
+const DEFAULT_MAX_TERMINAL_SETTLE_ATTEMPTS = 5;
+/** Debounce for re-reading the runtime's queued lane after `pending_messages.modified`. */
+const DEFAULT_QUEUE_LANE_REFRESH_MS = 150;
+/**
+ * How long a Stop's acknowledgement is held back for the reply of the row it
+ * named when that row's early settle is still publishing (see interruptTurn).
+ * Bounded: an unresponsive relay must not hold the Stop itself.
+ */
+const STOPPED_ROW_PUBLISH_WAIT_MS = 5_000;
+/**
+ * Debounce for re-reading `rpc.tasks.list()` after `session.background_tasks_changed`
+ * (which carries no payload and fires ~20 times per shell call).
+ */
+const DEFAULT_TASK_REFRESH_MS = 250;
+/** Trailing throttle for enrichment-only card updates (a live tool call, tokens). */
+const DEFAULT_TASK_PUBLISH_THROTTLE_MS = 2_000;
+/**
+ * How long a pushed prompt the runtime had not started when the turn's idle
+ * arrived is kept unsettled, waiting for the runtime to open its run. The
+ * drain's idle can race a send that resolved a moment earlier; the runtime
+ * then starts the prompt right away (`immediate` when idle) and its
+ * `user.message` adopts the row as a turn of its own. Same value as the
+ * Claude worker's fold grace, for the same reason.
+ */
+const DEFAULT_ORPHAN_GRACE_MS = 2_000;
 
 /**
  * Appended to the partial answer when the RUNTIME interrupted the turn on its
@@ -145,15 +201,27 @@ export const RUNTIME_INTERRUPTED_NOTE =
 
 /**
  * Published to a steered queue row whose prompt the runtime accepted but never
- * opened work on before the interaction ended. The prompt is still queued
- * INSIDE the runtime, so it will be answered at the start of the next turn —
- * requeuing the row would run it twice. Mirrors the Claude worker's
- * handed-off-context note, which exists for the same reason.
+ * opened work on before the interaction ended normally. The prompt is still
+ * queued INSIDE the runtime, so it will be answered at the start of the next
+ * turn — requeuing the row would run it twice. With `mode: "immediate"` the
+ * runtime drains every pushed prompt before it idles, so this is a defensive
+ * fallback rather than a routine outcome.
  */
 export const STEERED_ROW_MERGED_NOTE =
   '_(This message was delivered while the previous turn was still running; the reply continues in '
   + 'the next turn.)_';
 
+/**
+ * The reply of a continuation row opened only so a background task's question
+ * had a row to hang its card off (see `ensureInteractiveTurn`). The runtime
+ * produced no root work for it, so nothing else would ever answer the row.
+ */
+export const BACKGROUND_QUESTION_NOTE =
+  'System note: a background task asked for input here; it carries on in the background.';
+
+/** The provider name in the at-most-once settle failure wording. */
+const SETTLE_AGENT_LABEL = 'Copilot';
+
 /**
  * The `trigger` reported to `POST /api/continuation-turn`, matching the value
  * the Claude worker sends so the relay's `CONTINUATION … trigger=` log line and
@@ -199,6 +267,22 @@ function isStaleAttemptError(error) {
   return detail.includes('stale_attempt');
 }
 
+/**
+ * Whether publishing `action` makes its row worth keeping (`entry.showedWork`).
+ * A bookkeeping line only tracks background work the task card already shows,
+ * and so does a line carried in from between turns (a shell or agent the card
+ * showed finishing) — unless it reports a failure. The card lists running
+ * tasks only, so a failed agent's card vanishes exactly like a finished one's,
+ * and a `subagent.failed` between turns reaches no row: that line is the
+ * failure's only trace. It renders only through its row's response, so
+ * dropping the row would drop the failure with it.
+ */
+function showsWork(action) {
+  if (action.channel === 'init') return false;
+  if (action.carried) return action.reportsFailure === true;
+  return !action.bookkeeping;
+}
+
 export function createCopilotSdkSessionRunner({
   api,
   sdkSessionId,
@@ -220,15 +304,16 @@ export function createCopilotSdkSessionRunner({
   resolveProviderConfigImpl = resolveCopilotProviderConfig,
   // Threading seam for `MessageOptions.mode` ("enqueue" | "immediate").
   //
-  // A BYOK probe against runtime 1.0.82 ran a mid-turn send three ways —
-  // "enqueue", "immediate" and unset — and all three behaved IDENTICALLY: the
-  // send resolves in ~2ms with a message id, the prompt is queued
-  // (`pending_messages.modified`), the in-flight model call runs to completion
-  // untouched, and the prompt is picked up at the NEXT model-call boundary with
-  // its own `user.message`. Neither mode interrupts anything. "enqueue" is the
-  // documented default and preserves FIFO order, which is what the relay queue
-  // contract wants, so it is what this sends. See §5 of the plan doc.
-  resolveSendModeImpl = () => 'enqueue',
+  // "immediate", always (fake-provider probe against runtime 1.0.88,
+  // 2026-09-25). Mid-turn it is a real steer: injected at the next tool
+  // boundary as `user.message{delivery:"steering"}` (or, when the model is
+  // mid-stream, moved to the FRONT of the queue and run right after as
+  // `delivery:"queued"`). When the main loop is idle both modes start a run at
+  // once — except that an "enqueue" message sent while a background agent or
+  // an attached shell keeps `session.idle` deferred sits FROZEN until that
+  // work ends, while an "immediate" one runs immediately. So immediate is the
+  // only mode that never strands a message behind background work.
+  resolveSendModeImpl = () => 'immediate',
   // Interactive surfaces. Tests inject a fake bridge; nothing here reaches the
   // relay without one.
   createQuestionBridgeImpl = createCopilotQuestionBridge,
@@ -259,6 +344,35 @@ export function createCopilotSdkSessionRunner({
   // How long a settled continuation waits for its row before giving up on it.
   // Must outlast the registration's own retries; a test shortens it.
   continuationRegistrationTimeoutMs = CONTINUATION_REGISTRATION_TIMEOUT_MS,
+  compactionStaleMs = DEFAULT_COMPACTION_STALE_MS,
+  settleRetryDelaysMs = DEFAULT_SETTLE_RETRY_DELAYS_MS,
+  maxTerminalSettleAttempts = DEFAULT_MAX_TERMINAL_SETTLE_ATTEMPTS,
+  queueLaneRefreshMs = DEFAULT_QUEUE_LANE_REFRESH_MS,
+  orphanGraceMs = DEFAULT_ORPHAN_GRACE_MS,
+  // Register the relay's own `ask_user` (with `multi_select`) over the
+  // runtime's built-in one. A runtime that refuses the override falls back
+  // to the built-in for the rest of this worker's life.
+  relayAskUserTool = true,
+  // Whether sessions carry the relay's `remote_relay` tool
+  // (shared/remote-relay-tool-core.mjs). Default: ask the relay.
+  remoteRelayToolGate = null,
+  taskRefreshMs = DEFAULT_TASK_REFRESH_MS,
+  taskPublishThrottleMs = DEFAULT_TASK_PUBLISH_THROTTLE_MS,
+  // Called with `true`/`false` whenever the runner flips between accepting
+  // deliveries and holding them (see isDeliveryHeld). The worker wires it to
+  // the socket link: a hold withdraws the relay's readiness, and its end
+  // re-arms it at once so a held message steers into the resumed turn.
+  onDeliveryReadinessChange = () => {},
+  // False while the connected relay does not understand the `steering-held`
+  // hand-back (a worker updated on disk before the relay restarted): a held
+  // delivery is then pushed the legacy way instead of being handed back into
+  // a retry-and-backoff requeue.
+  canHandBackHeldDelivery = () => true,
+  // Called when the set of recallable (un-steerable) rows changes. The worker
+  // wires it to an immediate heartbeat: the client's Cancel appears from the
+  // heartbeat snapshot, and a 10 s wait would often outlast the window in
+  // which the runtime still holds the message (live check 2026-09-25).
+  onCancellableChange = () => {},
   dbg = () => {},
 } = {}) {
   let client = null;
@@ -303,12 +417,105 @@ export function createCopilotSdkSessionRunner({
   let starting = null;
   let disposed = false;
   let detachRuntimeExit = () => {};
-  // Prompts this worker sent that the runtime accepted but had not started work
-  // on when the interaction ended. They stay in the runtime's pending queue and
-  // are picked up FIRST in the next interaction, ahead of that turn's own
-  // prompt — so the next turn's segments are shifted by this many, and without
-  // it the primary row would be answered with a leftover prompt's reply.
-  let carriedPrompts = 0;
+  // A compaction in progress (`session.compaction_start` seen, no `_complete`
+  // yet). Holds steering: a message pushed now would land inside the
+  // compaction's replay. `compactingSince` backs the stale cap.
+  let compactingSince = 0;
+  // The last readiness value reported to `onDeliveryReadinessChange`, so the
+  // link only hears about flips.
+  let lastReportedDeliveryReady = null;
+  // Rows whose prompt the runtime consumed and whose settle marker is being
+  // saved (id → { message, variant }). Reported by the heartbeat WITH a
+  // terminal error until the publish lands, so recovery can never re-run them
+  // (see publishSettleMarker).
+  const settlingMessages = new Map();
+  // Settle markers that could not be posted even terminally; the heartbeat
+  // hands them to the relay to fail (id → terminalError).
+  const settleFailedTerminals = new Map();
+  // Per-row chains of `/api/queue-consumed` POSTs, so a mark and a later
+  // un-mark for the same row reach the relay in order.
+  const consumedMarkChains = new Map();
+  // The runtime's queued lane as last read from `rpc.queue.pendingItems`:
+  // runtime message id → stable queue item id. What un-steer needs, and what
+  // decides which pushed rows the client may still cancel.
+  let queuedLane = new Map();
+  // The rest of the last queue snapshot: how many immediate messages wait in
+  // the runtime's steering lane (entries not yet folded into the running
+  // turn), and how many items the queued lane holds. The steering lane has no
+  // ids — only its newest entry can be removed (`queue.removeMostRecent`,
+  // LIFO across both lanes; probe 2026-09-25) — so these decide whether our
+  // newest steer is still recallable.
+  let waitingSteers = 0;
+  let queuedItemCount = 0;
+  // Guards for the LIFO recall (removeMostRecent takes the runtime's NEWEST
+  // waiting message, whoever sent it):
+  //  - `steerSendsInFlight`: steer sends whose `send()` has not resolved yet.
+  //    The runtime may already count such a message while this worker cannot
+  //    yet name it, so no "newest" recall is attempted while any is in flight.
+  //  - `steerSendSeq`: send order across every owned turn, so "our newest
+  //    unconsumed steer" is decided by when it was sent, not by which turn
+  //    object happens to hold it.
+  //  - `unsteerChain`: un-steers run one at a time (each re-reads the queue).
+  // Steer sends never wait on an un-steer; the recall check and its remove
+  // request run in the same tick, so no send can be issued between them.
+  //
+  // What else removeMostRecent can take (live probe, runtime 1.0.85,
+  // 2026-09-26): only user-facing sends. The runtime's own notifications
+  // (agent_idle / agent_completed / shell_completed) never show in either
+  // lane — with one pending and nothing of ours queued the remove answered
+  // `removed:false`, and the notification was still delivered after a remove
+  // that took our steer. A `source:"system"` send is hidden from pendingItems
+  // and skipped (the remove took the OLDER user steer; the system one still
+  // ran). An `agent-*`-sourced send is listed and removable, but the
+  // runtime's inter-agent prompts never passed through the main lanes. So the
+  // read-then-remove window cannot drop a runtime message; what it can still
+  // hit is a message another client of the session pushed in that window,
+  // which the two guards below detect:
+  //  - `recallWatches`: runtime id → { taken } for a recall in progress. A
+  //    root `user.message` naming it sets `taken` from the event callback
+  //    itself — the SDK dispatches a notification before it resolves a later
+  //    RPC answer, whereas `entry.consumed` is set on the dispatch chain and
+  //    can lag behind a slow publish.
+  //  - `recalledRuntimeIds`: runtime id → row id of every prompt pulled back
+  //    and cancelled. One must never run; if it does, the remove took
+  //    another message and the row was cancelled wrongly — logged loudly.
+  let steerSendsInFlight = 0;
+  let lastCancellableSignature = '';
+  let steerSendSeq = 0;
+  let unsteerChain = Promise.resolve();
+  const recallWatches = new Map();
+  const recalledRuntimeIds = new Map();
+  const MAX_RECALLED_RUNTIME_IDS = 200;
+  /** How long an un-steer may wait on the runtime before it gives up. */
+  const UNSTEER_TIMEOUT_MS = 5_000;
+  let queueLaneTimer = null;
+  let queueLaneRefreshChain = Promise.resolve();
+  // Whether the session's `rpc.queue` / `rpc.interruptMainTurn` / `rpc.tasks`
+  // are present. Probed per session (the runtime auto-updates under the relay
+  // and every one of these is @experimental); a missing surface degrades to
+  // the previous behaviour, never to an error.
+  let sessionRpc = { queue: false, interruptMainTurn: false, tasks: false };
+  // Set once a runtime refused the relay's `ask_user` override: every later
+  // session is built without it (the built-in + wording heuristic remain).
+  let askUserOverrideRejected = false;
+  // The runtime's background task registry as last read from
+  // `rpc.tasks.list()` (id → TaskInfo), and what the event stream adds per
+  // agent that the registry does not carry: the live tool call, a running
+  // token count, the model announced at spawn. Both feed the task panel
+  // cards; the registry alone decides liveness (the lifecycle pin).
+  let backgroundTasks = new Map();
+  const agentDetails = new Map();
+  let taskRefreshTimer = null;
+  let taskRefreshChain = Promise.resolve();
+  let lastTaskRefreshAt = 0;
+  let taskPublishTimer = null;
+  let lastPublishedTasksSignature = '';
+  // Cap expiry is bounded: a task whose cancel the runtime refuses (or that
+  // keeps failing) this many times is abandoned — dropped from the live set so
+  // it stops pinning the runtime — rather than held forever.
+  const taskCancelRefusals = new Map();
+  const abandonedTasks = new Set();
+  const MAX_TASK_CANCEL_REFUSALS = 3;
   // Blocking handlers currently waiting on a human (`ask_user`, an ask-mode
   // tool approval). The runtime emits NO events while blocked in one, and the
   // question timeout is 8 hours against a 120s stall ceiling — so without this
@@ -316,6 +523,17 @@ export function createCopilotSdkSessionRunner({
   // the human's eventual answer to a runtime whose row is already settled.
   // Same guard the Cursor worker's `hasPendingClientWork` provides.
   let pendingHumanRequests = 0;
+  // Running `remote_relay` calls. The runtime is just as silent while one
+  // runs (the relay may wait up to 600 s for a remote turn, plus an approval
+  // card), so they hold the stall watchdog and the idle shutdown too — but
+  // not steering: nobody is answering a card here.
+  let pendingRelayToolCalls = 0;
+  // `remote_relay` is registered only while this relay has paired remotes.
+  // Asked once when the worker starts; a session build waits for that first
+  // answer (it is async anyway), and every runtime stop asks again so the
+  // next session picks up a remote paired in the meantime.
+  const remoteRelayGate = remoteRelayToolGate || createRemoteRelayToolGate({ api });
+  void remoteRelayGate.refresh();
   // The `SessionConfig.provider` block this session was BUILT with, or null for
   // a hosted (`github`) session. Set by `buildSessionConfig` rather than by a
   // second throwaway resolve here, so "is this BYOK?" and "what did the runtime
@@ -334,10 +552,11 @@ export function createCopilotSdkSessionRunner({
   // continuation opening, or by the grace expiring on a runtime that decided it
   // had nothing to say.
   let continuationDueSince = 0;
-  // Transcript lines produced between turns (a settled shell's notification).
-  // They belong to the turn they trigger, so they are carried into it rather
-  // than dropped — the same trade the Claude worker's `pendingActivities`
-  // makes.
+  // Transcript lines produced between turns (a settled shell's or background
+  // agent's notification), as `{ text, reportsFailure }`. They belong to the
+  // turn they trigger, so they are carried into it rather than dropped — the
+  // same trade the Claude worker's `pendingActivities` makes. A line that
+  // reports a failure keeps the row it lands on (see `showsWork`).
   let pendingActivities = [];
   // The relay mode of the last delivered turn. A self-initiated turn has no
   // delivery to read a mode off, and it is a continuation OF that turn's work,
@@ -345,33 +564,73 @@ export function createCopilotSdkSessionRunner({
   // plan-board gating behaving the same either side of a background wait.
   let lastRelayMode = 'agent';
 
+  /**
+   * The turn a human request belongs to, opened on demand when none is live.
+   *
+   * A card needs a `processing` row (`/api/relay-question` 409s otherwise),
+   * and a background agent can ask long after the turn that spawned it settled
+   * on `assistant.idle`. Nothing else opens a row for that question, so it
+   * gets a continuation of its own — the Claude worker opens one before an
+   * off-turn `AskUserQuestion` for the same reason. `humanOrigin`: unless root
+   * work joins it, it closes itself once its last card is done.
+   */
+  function ensureInteractiveTurn() {
+    if (activeTurn || !session || disposed) return activeTurn;
+    const turn = openContinuationTurn();
+    turn.humanOrigin = true;
+    return turn;
+  }
+
   async function whileAwaitingHuman(run) {
+    // Captured once: the card belongs to this turn's row even when another
+    // turn owns the event stream by the time it is created or answered.
+    const turn = ensureInteractiveTurn();
     pendingHumanRequests += 1;
+    if (turn) {
+      if (turn.humanRequests === 0) turn.humansIdle = new Promise((resolve) => { turn.resolveHumansIdle = resolve; });
+      turn.humanRequests += 1;
+      turn.askedHuman = true;
+    }
+    // An open card holds steering: the relay's readiness is withdrawn at once.
+    syncDeliveryReadiness();
     try {
-      return await run();
+      return await run(turn);
     } finally {
       pendingHumanRequests -= 1;
+      if (turn) {
+        turn.humanRequests -= 1;
+        if (turn.humanRequests === 0) {
+          turn.resolveHumansIdle();
+          // A row opened only for questions: no terminator is coming for it.
+          if (turn.humanOrigin && !turn.rootWork && !turn.settled) {
+            turn.result = { subtype: 'completed', text: BACKGROUND_QUESTION_NOTE };
+            turn.settle();
+          }
+        }
+      }
       // The clock restarts from the answer, not from before the wait.
       touch();
       activeTurn?.armStall?.();
+      // The answer re-arms the relay immediately, so a message queued while
+      // the card was open steers into the resumed turn within one round trip.
+      syncDeliveryReadiness();
     }
   }
 
   /**
-   * Hold an interactive callback until the active turn's queue row exists.
+   * Hold an interactive callback until its turn's queue row exists.
    *
    * A continuation becomes the active turn synchronously but gets its row
    * asynchronously, and the runtime can block on `user_input.requested` (or an
    * ask-mode approval) in that gap — the question bridge would then see no
-   * active message and degrade to an unsupported answer / local rejection for
-   * a card that was milliseconds from having a real row id. Bounded by the
+   * row and degrade to an unsupported answer / local rejection for a card
+   * that was milliseconds from having a real row id. Bounded by the
    * registration timeout (the registration itself can hang on a dead relay);
    * on expiry — or on a registration that gave up (`rowReady` → false) — the
    * caller proceeds and degrades exactly as before. Delivered turns are
    * registered from birth and skip straight through.
    */
-  async function awaitInteractiveRow() {
-    const turn = activeTurn;
+  async function awaitInteractiveRow(turn) {
     if (!turn || turn.registered || !turn.rowReady) return;
     let timer = null;
     await Promise.race([
@@ -537,19 +796,89 @@ export function createCopilotSdkSessionRunner({
   }
 
   /**
-   * Publish an action, or hold it if the turn has no queue row yet.
+   * Publish an action onto the row that owns the runtime's current run, or
+   * hold it if the turn has no queue row yet.
    *
    * The single gate every producer goes through. A continuation's row is
    * created asynchronously, and a POST carrying `messageId: null` is not merely
    * useless — the relay's activity/stream routes key on it, so it would be
    * attributed to nothing at all.
+   *
+   * One turn can answer several rows in sequence (the primary, then a message
+   * pushed mid-turn that the runtime ran as its own `delivery:"queued"` run).
+   * Root-level traffic — stream, thoughts, activity, subagent lanes — goes to
+   * whichever row owns the run in progress (`turn.currentOwner`); the stream
+   * text is re-cut to that row's own segments so a second run's prose never
+   * appears under the first row.
    */
   async function emitAction(turn, action) {
     if (!turn.registered) {
       turn.bufferedActions.push(action);
       return;
     }
-    await dispatchAction(turn.message, action, turn.state);
+    await dispatchOwned(turn, action);
+  }
+
+  async function dispatchOwned(turn, action) {
+    const owner = turn.currentOwner || turn.primaryEntry;
+    if (!owner || owner.settled) {
+      // Nothing left to publish into (every row this turn owned has settled);
+      // the text still lands in the runtime's own transcript.
+      return;
+    }
+    if (showsWork(action)) owner.showedWork = true;
+    if (action.channel === 'stream' && !action.payload?.subagentRunId) {
+      // Re-cut to the owner's own segments, and gated against what THAT row
+      // last received (the normalizer gated against the whole interaction).
+      const text = textFor(turn, owner);
+      if (!shouldEmitStreamUpdate(text, owner.state.lastStreamedText)) return;
+      await dispatchAction(owner.message, { channel: 'stream', payload: { ...action.payload, text } }, owner.state);
+      return;
+    }
+    await dispatchAction(owner.message, action, owner.state);
+  }
+
+  /**
+   * Which row a normalizer segment's text belongs to. A segment nobody
+   * claimed (text produced before any prompt boundary — the answer to a
+   * prompt carried over from a previous interaction, or a turn the runtime
+   * answered without echoing a `user.message` at all) belongs to the next
+   * claimed segment's row, failing that to the turn's own row.
+   */
+  function segmentOwner(turn, index) {
+    const owners = turn.segmentOwners;
+    if (owners[index]) return owners[index];
+    for (let j = index + 1; j < owners.length; j += 1) {
+      if (owners[j]) return owners[j];
+    }
+    return turn.primaryEntry;
+  }
+
+  function textFor(turn, entry, segmentTexts = null) {
+    const count = Math.max(turn.normalizer.promptCount(), turn.segmentOwners.length);
+    const parts = [];
+    for (let index = 0; index < count; index += 1) {
+      if (segmentOwner(turn, index) !== entry) continue;
+      const text = String(segmentTexts?.[index] ?? turn.normalizer.segmentText(index) ?? '');
+      if (text.trim()) parts.push(text);
+    }
+    return parts.join('\n\n');
+  }
+
+  /**
+   * The final reply text for `entry`: its segments, with the task-completion
+   * summary taking precedence on the last one (the normalizer's
+   * `result.segmentTexts` already applies that rule; before this the runner
+   * read `segmentText` directly and lost the summary — the "Cha…" fragment
+   * case of 2026-09-12). A turn that opened no segment at all falls back to
+   * the whole composed text for its own row, which is strictly better than
+   * publishing nothing.
+   */
+  function finalTextFor(turn, entry, result) {
+    const segmentTexts = Array.isArray(result?.segmentTexts) ? result.segmentTexts : null;
+    const text = textFor(turn, entry, segmentTexts).trim();
+    if (text || entry !== turn.primaryEntry) return text;
+    return String(result?.text || entry.state.lastStreamedText || '').trim();
   }
 
   async function publishFinalStream(message, text) {
@@ -563,26 +892,54 @@ export function createCopilotSdkSessionRunner({
     }).catch(() => {});
   }
 
-  async function publishResponse(message, { text, model, terminalError = null, modelOrigin }) {
-    await api('POST', '/api/response', {
-      messageId: message.id,
-      conversationId: message.conversationId,
-      text: String(text || ''),
-      model: model || null,
-      modelOrigin: modelOrigin
-        || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
-      ...(terminalError ? { terminalError } : {}),
-      ...attemptFields(message),
-    }).catch(async (error) => {
+  /**
+   * Publish a row's outcome. Returns 'published' | 'stale' | 'failed' |
+   * 'requeued' so the settle paths can tell a landed marker from a lost one.
+   *
+   * `kind` ('folded' | 'stopped') stamps the settle stubs of a steered row the
+   * runtime consumed without answering on its own row; `consumedSteerIds`
+   * names the steers folded into the turn this response finishes, so the
+   * relay marks them consumed in the same fenced write. A response carrying a
+   * kind is never requeued on failure (the prompt was consumed — re-running it
+   * is the one thing that must not happen); `requeueOnFailure: false` opts an
+   * ordinary response out of the requeue too.
+   */
+  async function publishResponse(message, {
+    text, model, terminalError = null, modelOrigin, kind = null, consumedSteerIds = null,
+    requeueOnFailure = true,
+  }) {
+    const consumed = Array.isArray(consumedSteerIds)
+      ? consumedSteerIds
+        .map((entry) => ({ id: String(entry?.id || '').trim(), attemptId: entry?.attemptId || null }))
+        .filter((entry) => entry.id)
+      : [];
+    try {
+      await api('POST', '/api/response', {
+        messageId: message.id,
+        conversationId: message.conversationId,
+        text: String(text || ''),
+        model: model || null,
+        modelOrigin: modelOrigin
+          || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
+        ...(terminalError ? { terminalError } : {}),
+        ...(kind ? { kind } : {}),
+        ...(consumed.length ? { consumedSteerIds: consumed } : {}),
+        ...attemptFields(message),
+      });
+      return 'published';
+    } catch (error) {
       // A stale_attempt 409 means the row already moved on to another attempt
       // (requeued and re-delivered); the requeue would 409 the same way, and
       // the newer attempt owes the row its answer — drop this one.
       if (isStaleAttemptError(error)) {
         dbg('response refused as stale_attempt; dropping', message.id);
-        return;
+        return 'stale';
       }
-      await api('POST', '/api/requeue', { messageId: message.id, ...attemptFields(message) }).catch(() => {});
-    });
+      if (kind || !requeueOnFailure) return 'failed';
+      const requeued = await api('POST', '/api/requeue', { messageId: message.id, ...attemptFields(message) })
+        .then(() => true, () => false);
+      return requeued ? 'requeued' : 'failed';
+    }
   }
 
   function terminalErrorRecord(message, classified) {
@@ -596,6 +953,117 @@ export function createCopilotSdkSessionRunner({
     };
   }
 
+  // ------------------------------------------------- at-most-once settling --
+
+  /**
+   * Claim a consumed row as settling — synchronously, BEFORE anything stops
+   * reporting it as live, so no heartbeat can see it unowned. `variant` picks
+   * the terminal wording should its settle never land.
+   */
+  function claimSettling(message, variant = 'folded') {
+    const id = String(message?.id || '').trim();
+    if (id && !settlingMessages.has(id)) settlingMessages.set(id, { message, variant });
+  }
+
+  /** Release a settled row — unless it was handed to the relay to fail. */
+  function releaseSettling(id) {
+    const key = String(id || '').trim();
+    if (!settleFailedTerminals.has(key)) settlingMessages.delete(key);
+  }
+
+  /**
+   * Mark rows whose prompt the runtime has folded into a running turn as
+   * consumed on the relay (the moment `user.message{delivery:"steering"}`
+   * confirms it). Best-effort: the worker's own settle still owns these rows
+   * while it lives; the mark only protects them when it does not — a crash
+   * before the settle marker lands must fail the row, never re-run it.
+   */
+  function markConsumed(conversationId, entries = [], { consumed = true } = {}) {
+    const rows = entries
+      .map((entry) => ({ id: String(entry?.id || '').trim(), attemptId: entry?.attemptId || null }))
+      .filter((entry) => entry.id);
+    if (!rows.length) return Promise.resolve();
+    const previous = Promise.allSettled(rows.map((row) => consumedMarkChains.get(row.id)).filter(Boolean));
+    const post = previous.then(() => api('POST', '/api/queue-consumed', {
+      conversationId: String(conversationId || sdkSessionId || ''),
+      entries: rows,
+      ...(consumed ? {} : { consumed: false }),
+    })).catch((error) => {
+      dbg('consumed mark failed', rows.map((entry) => entry.id).join(','), error?.message || String(error));
+    });
+    for (const row of rows) consumedMarkChains.set(row.id, post);
+    post.then(() => {
+      for (const row of rows) if (consumedMarkChains.get(row.id) === post) consumedMarkChains.delete(row.id);
+    });
+    return post;
+  }
+
+  /** Heartbeat payload: rows whose terminal failure the relay must post. */
+  function getSettleFailed() {
+    return [...settleFailedTerminals.entries()].map(([id, terminalError]) => ({
+      id,
+      attemptId: settlingMessages.get(id)?.message?.attemptId || null,
+      terminalError,
+    }));
+  }
+
+  function acknowledgeSettleFailed(ids = []) {
+    for (const id of ids) {
+      const key = String(id || '').trim();
+      if (!settleFailedTerminals.delete(key)) continue;
+      settlingMessages.delete(key);
+    }
+  }
+
+  const sleep = (ms) => new Promise((resolve) => { const t = setTimeout(resolve, ms); t.unref?.(); });
+
+  /**
+   * Save the settle marker of a steered message the runtime already consumed
+   * — at most once. The row stays in `settlingMessages`, and so in every
+   * heartbeat, until the relay commits the marker. A marker that cannot be
+   * saved within the retry budget ends as a terminal failure — never a
+   * requeue — and if even that cannot be posted, the heartbeat hands the row
+   * to the relay to fail. Ported from the Claude worker; same guarantees.
+   */
+  async function publishSettleMarker(message, { text, model, kind, variant = 'folded' }) {
+    const id = String(message?.id || '').trim();
+    if (!id) return;
+    claimSettling(message, variant);
+    try {
+      for (let attempt = 0; ; attempt += 1) {
+        const outcome = await publishResponse(message, { text, model, kind });
+        if (outcome !== 'failed') return;
+        if (attempt >= settleRetryDelaysMs.length) break;
+        await sleep(settleRetryDelaysMs[attempt]);
+      }
+      dbg('settle marker could not be saved; failing the row terminally', id);
+      const terminalError = buildSteerSettleFailure(message, { variant, agentLabel: SETTLE_AGENT_LABEL });
+      const retryMs = Math.max(100, Number(settleRetryDelaysMs.at(-1)) || 0);
+      for (let attempt = 0; attempt < Math.max(1, maxTerminalSettleAttempts); attempt += 1) {
+        if (attempt) await sleep(retryMs);
+        const outcome = await publishResponse(message, {
+          text: terminalError.message,
+          model,
+          terminalError,
+          requeueOnFailure: false,
+        });
+        if (outcome !== 'failed') return;
+        // Second channel: the requeue route fails a row outright when handed
+        // a terminal error.
+        const failedViaRequeue = await api('POST', '/api/requeue', {
+          messageId: id,
+          terminalError,
+          ...attemptFields(message),
+        }).then(() => true, (error) => isStaleAttemptError(error));
+        if (failedViaRequeue) return;
+      }
+      dbg('terminal settle could not be posted; handing it to the heartbeat', id);
+      settleFailedTerminals.set(id, terminalError);
+    } finally {
+      releaseSettling(id);
+    }
+  }
+
   /**
    * Per-turn usage capture, recorded on the runner.
    *
@@ -731,16 +1199,34 @@ export function createCopilotSdkSessionRunner({
       return;
     }
     touch();
+    observeRecalls(event);
     observeBackgroundShells(event);
-    // Keeps the confirmed-model tracking truthful for switches this worker did
-    // not ask for, and resolves the bounded wait on a deferred switch's drain.
-    // Behind the replay gate on purpose: a historical `session.model_change`
-    // must not confirm a pending switch.
-    modelSwitch.observeEvent(event);
-    // A LIVE model change moves the catalog's currentModel; replays cannot get
-    // here (the gate above), so this cannot re-publish days-old state.
-    if (event?.type === 'session.model_change') publishModelSnapshot('model-change');
+    observeBackgroundAgents(event);
+    observeCompaction(event);
+    observeQueueLane(event);
+    // A background subagent's spawn emits a SESSION-level
+    // `session.model_change{source:"agent"}` for the subagent's own model
+    // (live-probed on 1.0.88). It is not the main thread's model: feeding it
+    // to the switcher would confirm a pending switch with the wrong model and
+    // move the catalog's currentModel.
+    const agentModelChange = event?.type === 'session.model_change'
+      && String(event?.data?.source || '').trim().toLowerCase() === 'agent';
+    if (!agentModelChange) {
+      // Keeps the confirmed-model tracking truthful for switches this worker
+      // did not ask for, and resolves the bounded wait on a deferred switch's
+      // drain. Behind the replay gate on purpose: a historical
+      // `session.model_change` must not confirm a pending switch.
+      modelSwitch.observeEvent(event);
+      // A LIVE model change moves the catalog's currentModel; replays cannot
+      // get here (the gate above), so this cannot re-publish days-old state.
+      if (event?.type === 'session.model_change') publishModelSnapshot('model-change');
+    }
     let turn = activeTurn;
+    if (!turn) {
+      // A prompt this worker pushed whose run the runtime opened after its
+      // turn had already settled is that row's own turn, not a continuation.
+      turn = adoptOrphanedRun(event);
+    }
     if (!turn) {
       // The runtime started work with no row open. Anything that is not the
       // START of work (terminators, connection bookkeeping) stays a no-op:
@@ -777,15 +1263,396 @@ export function createCopilotSdkSessionRunner({
    * backgroundWorkHoldsRuntime. Advisory: a failed post never disturbs events.
    */
   function publishBackgroundShellTasks() {
-    const tasks = backgroundShells.live().map((shell) => ({
+    publishBackgroundTasks({ immediate: true });
+  }
+
+  /** The panel rows for the shell tracker's set — the path without `rpc.tasks`. */
+  function shellTrackerCards() {
+    return backgroundShells.live().map((shell) => ({
       taskId: shell.shellId,
       taskType: 'local_bash',
       description: shell.description || 'Detached shell',
       startedAt: shell.startedAt || null,
       stoppable: false,
     }));
-    api('POST', '/api/background-tasks', { conversationId: sdkSessionId, tasks })
-      .catch((error) => dbg('background task publish failed', error?.message || String(error)));
+  }
+
+  /**
+   * The panel rows for the runtime's task registry: background agents and
+   * shells still running, each with what the events added. `stoppable` is
+   * true because `rpc.tasks.cancel` is present whenever this path is taken.
+   */
+  function registryCards() {
+    const cards = [];
+    for (const task of backgroundTasks.values()) {
+      if (task.status !== 'running') continue;
+      const startedAt = Date.parse(String(task.startedAt || '')) || null;
+      if (task.type === 'shell') {
+        cards.push({
+          taskId: task.id,
+          taskType: 'local_bash',
+          description: task.description || task.command || 'Background shell',
+          startedAt,
+          stoppable: true,
+          ...(task.progressSummary ? { summary: task.progressSummary } : {}),
+        });
+        continue;
+      }
+      if (task.type !== 'agent') continue;
+      const detail = agentDetails.get(task.id) || {};
+      const model = task.resolvedModel || task.model || detail.model || '';
+      const inherited = !model;
+      cards.push({
+        taskId: task.id,
+        taskType: 'local_agent',
+        description: task.description || task.displayName || detail.displayName || 'Background agent',
+        startedAt: startedAt || detail.startedAt || null,
+        stoppable: true,
+        subagentType: task.agentType || detail.agentType || null,
+        model: model || appliedModel() || defaultModel || null,
+        modelInherited: inherited,
+        ...(detail.lastToolCall ? { lastToolCall: detail.lastToolCall } : {}),
+        ...(Number.isFinite(detail.totalTokens) && detail.totalTokens > 0 ? { totalTokens: detail.totalTokens } : {}),
+        ...(task.progressSummary ? { summary: task.progressSummary } : {}),
+      });
+    }
+    return cards;
+  }
+
+  /**
+   * Mirror the live background work into the relay's task panel (REPLACE
+   * semantics, the same route the Claude worker publishes on). Set changes
+   * publish at once; enrichment-only changes (a tool call, tokens) ride a
+   * trailing throttle. Advisory: a failed post never disturbs events.
+   */
+  function publishBackgroundTasks({ immediate = false } = {}) {
+    const run = () => {
+      if (taskPublishTimer) {
+        clearTimeout(taskPublishTimer);
+        taskPublishTimer = null;
+      }
+      const tasks = sessionRpc.tasks ? registryCards() : shellTrackerCards();
+      const signature = JSON.stringify(tasks);
+      if (signature === lastPublishedTasksSignature) return;
+      lastPublishedTasksSignature = signature;
+      api('POST', '/api/background-tasks', { conversationId: sdkSessionId, tasks })
+        .catch((error) => dbg('background task publish failed', error?.message || String(error)));
+    };
+    if (immediate || !(taskPublishThrottleMs > 0)) {
+      run();
+      return;
+    }
+    if (taskPublishTimer) return;
+    taskPublishTimer = setTimeout(run, taskPublishThrottleMs);
+    taskPublishTimer.unref?.();
+  }
+
+  // ------------------------------------------------------- background tasks --
+
+  /**
+   * What the event stream knows about background agents that the registry
+   * does not: spawn details, the live tool call, a running token count, and
+   * the completion heralds. `session.background_tasks_changed` itself is
+   * empty and only says "re-read the registry".
+   */
+  function observeBackgroundAgents(event) {
+    const type = String(event?.type || '');
+    const data = event?.data && typeof event.data === 'object' ? event.data : {};
+    const agentId = String(event?.agentId || '').trim();
+    if (type === 'session.background_tasks_changed') {
+      scheduleTaskRefresh();
+      return;
+    }
+    if (type === 'subagent.started' && String(data.executionMode || '').trim().toLowerCase() === 'background' && agentId) {
+      // Kept for the life of the session (a finished agent's late events must
+      // still be recognised as background), bounded so a long session cannot
+      // grow it forever.
+      while (agentDetails.size >= 500) agentDetails.delete(agentDetails.keys().next().value);
+      agentDetails.set(agentId, {
+        displayName: String(data.agentDisplayName || data.agentName || '').trim(),
+        agentType: String(data.agentType || '').trim(),
+        model: String(data.model || '').trim(),
+        lastToolCall: '',
+        totalTokens: 0,
+        startedAt: Date.now(),
+      });
+      scheduleTaskRefresh();
+      return;
+    }
+    const settledAgent = settledAgentFromNotification(event);
+    if (settledAgent) {
+      dbg('background agent settled', settledAgent.agentId, settledAgent.status);
+      // The runtime is about to re-invoke the model off the back of this
+      // (`read_agent` + a reply): pin the runtime for the continuation, and
+      // carry a line into the turn it triggers when no turn is open to take
+      // it. Same shape as a settled shell's herald.
+      continuationDueSince = Date.now();
+      const note = describeSettledAgent(settledAgent);
+      if (note && !activeTurn && pendingActivities.length < MAX_PENDING_ACTIVITIES) {
+        pendingActivities.push({ text: note, reportsFailure: settledAgent.status === 'failed' });
+      }
+      scheduleTaskRefresh();
+      return;
+    }
+    if (agentId && agentDetails.has(agentId)) {
+      const detail = agentDetails.get(agentId);
+      if (type === 'tool.execution_start') {
+        detail.lastToolCall = formatToolActivityText(data.toolName, data.arguments);
+        publishBackgroundTasks();
+      } else if (type === 'assistant.usage') {
+        const used = (Number(data.inputTokens) || 0) + (Number(data.outputTokens) || 0);
+        if (used > 0) {
+          detail.totalTokens += used;
+          publishBackgroundTasks();
+        }
+      } else if (type === 'subagent.completed' || type === 'subagent.failed') {
+        const total = Number(data.totalTokens);
+        if (Number.isFinite(total) && total > 0) detail.totalTokens = total;
+        scheduleTaskRefresh();
+      }
+    }
+  }
+
+  function scheduleTaskRefresh() {
+    if (!sessionRpc.tasks || taskRefreshTimer) return;
+    taskRefreshTimer = setTimeout(() => {
+      taskRefreshTimer = null;
+      taskRefreshChain = taskRefreshChain.then(() => refreshBackgroundTasks()).catch(() => {});
+    }, taskRefreshMs);
+    taskRefreshTimer.unref?.();
+  }
+
+  /**
+   * Re-read the runtime's task registry. Running agents and shells become
+   * cards (with a progress line when the runtime has one); finished entries
+   * are removed from the runtime's tracking so the registry cannot grow for
+   * the life of the session. A refresh that fails leaves the last read in
+   * place — a stale card beats a vanished one.
+   */
+  async function refreshBackgroundTasks() {
+    const target = session;
+    if (!target || !sessionRpc.tasks) return;
+    lastTaskRefreshAt = Date.now();
+    let listed;
+    try {
+      listed = await target.rpc.tasks.list();
+    } catch (error) {
+      dbg('tasks.list failed', error?.message || String(error));
+      return;
+    }
+    if (session !== target) return;
+    const next = new Map();
+    for (const task of Array.isArray(listed?.tasks) ? listed.tasks : []) {
+      const id = String(task?.id || '').trim();
+      if (!id || abandonedTasks.has(id)) continue;
+      const status = String(task?.status || '').trim().toLowerCase();
+      // Only running tasks are live. 'idle' (a multi-turn agent waiting for
+      // messages) holds nothing and shows nowhere until it is messaged
+      // (roadmap: tasks.sendMessage); finished entries are left to the
+      // runtime's own tracking — removing them here could race the root
+      // agent's `read_agent` follow-up that the completion notification
+      // triggers.
+      if (status === 'running') {
+        next.set(id, { ...task, id, status, progressSummary: backgroundTasks.get(id)?.progressSummary || '' });
+      }
+    }
+    // Progress lines for the live set: the agent's latest intent / last
+    // activity, a shell's last output line. One RPC per live task per refresh
+    // (refreshes are debounced), best effort.
+    if (typeof target.rpc.tasks.getProgress === 'function') {
+      for (const task of next.values()) {
+        try {
+          const progress = (await target.rpc.tasks.getProgress({ id: task.id }))?.progress || null;
+          task.progressSummary = summarizeTaskProgress(progress);
+        } catch { /* a card without a progress line */ }
+      }
+    }
+    if (session !== target) return;
+    const setChanged = next.size !== backgroundTasks.size
+      || [...next.keys()].some((id) => !backgroundTasks.has(id));
+    backgroundTasks = next;
+    publishBackgroundTasks({ immediate: setChanged });
+    // The lifecycle poll (every `lifecyclePollMs`) picks the new set up; a
+    // re-evaluation here would re-schedule a refresh and spin.
+  }
+
+  function summarizeTaskProgress(progress) {
+    if (!progress || typeof progress !== 'object') return '';
+    if (progress.type === 'agent') {
+      const intent = String(progress.latestIntent || '').trim();
+      if (intent) return intent.slice(0, 300);
+      const lines = Array.isArray(progress.recentActivity) ? progress.recentActivity : [];
+      const last = lines.length ? String(lines[lines.length - 1]?.message || '').trim() : '';
+      return last.slice(0, 300);
+    }
+    if (progress.type === 'shell') {
+      const output = String(progress.recentOutput || '').trim();
+      if (!output || output === '(no output yet)') return '';
+      const lines = output.split('\n').map((line) => line.trim()).filter(Boolean);
+      return (lines[lines.length - 1] || '').slice(0, 300);
+    }
+    return '';
+  }
+
+  /** The live tasks from the registry (running agents + shells). */
+  function runningBackgroundTasks() {
+    return [...backgroundTasks.values()].filter((task) => task.status === 'running');
+  }
+
+  /**
+   * Stop one background task (the panel's per-card Stop, or a subagent lane's
+   * Stop for a background agent). Returns whether the runtime cancelled it.
+   */
+  async function stopBackgroundTask(taskId) {
+    const id = String(taskId || '').trim();
+    if (!id || !session || !sessionRpc.tasks) return false;
+    try {
+      const outcome = await session.rpc.tasks.cancel({ id });
+      const cancelled = outcome?.cancelled === true;
+      dbg(cancelled ? 'background task cancelled' : 'background task cancel refused', id);
+      if (cancelled) scheduleTaskRefresh();
+      return cancelled;
+    } catch (error) {
+      dbg('tasks.cancel failed', id, error?.message || String(error));
+      return false;
+    }
+  }
+
+
+
+  /**
+   * The compaction hold. A message pushed while the runtime is compacting
+   * would be injected into the compaction's replay, so steering is held from
+   * `session.compaction_start` to `_complete` (the runtime queues messages
+   * sent during a compaction itself, but holding them relay-side keeps the
+   * bubble cancellable and the composer truthful — the Claude rule).
+   */
+  function observeCompaction(event) {
+    const type = String(event?.type || '');
+    if (event?.agentId) return;
+    if (type === 'session.compaction_start') {
+      compactingSince = Date.now();
+      syncDeliveryReadiness();
+    } else if (type === 'session.compaction_complete') {
+      compactingSince = 0;
+      syncDeliveryReadiness();
+    }
+  }
+
+  function isCompacting() {
+    if (!compactingSince) return false;
+    if (Date.now() - compactingSince < compactionStaleMs) return true;
+    dbg('compaction hold went stale; releasing it');
+    compactingSince = 0;
+    return false;
+  }
+
+  /**
+   * Keep `queuedLane` current. `pending_messages.modified` carries no payload
+   * (it only says "the queue changed"), so it schedules a debounced
+   * `rpc.queue.pendingItems()` read. What matters here is which pushed rows
+   * are still in the QUEUED lane: those the runtime has not consumed and the
+   * client may still cancel (`cancellableIds` on the steering snapshot).
+   */
+  function observeQueueLane(event) {
+    if (String(event?.type || '') !== 'pending_messages.modified') return;
+    scheduleQueueLaneRefresh();
+  }
+
+  /** Un-steer's synchronous view of the runtime taking a prompt (see `recallWatches`). */
+  function observeRecalls(event) {
+    if (String(event?.type || '') !== 'user.message' || event?.agentId) return;
+    const runtimeId = String(event?.data?.messageId || '').trim();
+    if (!runtimeId) return;
+    const watch = recallWatches.get(runtimeId);
+    if (watch) watch.taken = true;
+    const recalledRow = recalledRuntimeIds.get(runtimeId);
+    if (recalledRow) {
+      dbg('UN-STEER MISMATCH: a prompt recalled and cancelled is running after all; the remove took another message',
+        recalledRow, runtimeId);
+    }
+  }
+
+  function scheduleQueueLaneRefresh() {
+    if (!sessionRpc.queue || queueLaneTimer) return;
+    queueLaneTimer = setTimeout(() => {
+      queueLaneTimer = null;
+      queueLaneRefreshChain = queueLaneRefreshChain.then(() => refreshQueueLane()).catch(() => {});
+    }, queueLaneRefreshMs);
+    queueLaneTimer.unref?.();
+  }
+
+  async function refreshQueueLane() {
+    const target = session;
+    if (!target || !sessionRpc.queue) return;
+    try {
+      const snapshot = await target.rpc.queue.pendingItems();
+      const next = new Map();
+      for (const item of Array.isArray(snapshot?.items) ? snapshot.items : []) {
+        const runtimeId = String(item?.messageId || '').trim();
+        const itemId = String(item?.id || '').trim();
+        if (runtimeId && itemId) next.set(runtimeId, itemId);
+      }
+      if (session !== target) return;
+      queuedLane = next;
+      queuedItemCount = Array.isArray(snapshot?.items) ? snapshot.items.length : 0;
+      const steering = Array.isArray(snapshot?.steeringMessages) ? snapshot.steeringMessages.length : 0;
+      const inFlight = Number(snapshot?.inFlightSteeringCount) || 0;
+      waitingSteers = Math.max(0, steering - inFlight);
+    } catch (error) {
+      dbg('queue.pendingItems failed', error?.message || String(error));
+    }
+    noteCancellableChange();
+  }
+
+  /** Tell the worker when the recallable set changed (see onCancellableChange). */
+  function noteCancellableChange() {
+    const signature = cancellableIds().join(',');
+    if (signature === lastCancellableSignature) return;
+    lastCancellableSignature = signature;
+    try {
+      onCancellableChange();
+    } catch (error) {
+      dbg('cancellable listener failed', error?.message || String(error));
+    }
+  }
+
+  /** Our pushed steers the runtime has not started on yet, in send order. */
+  function unconsumedSteers() {
+    const list = [];
+    for (const entry of ownedEntries()) {
+      if (entry.role === 'steer' && !entry.consumed && !entry.settled && entry.runtimeId) list.push(entry);
+    }
+    return list.sort((a, b) => (a.sendSeq || 0) - (b.sendSeq || 0));
+  }
+
+  /**
+   * How `entry` can still be pulled back out of the runtime, or null: by its
+   * stable id when it sits in the queued lane, or with removeMostRecent when
+   * it is the runtime's newest waiting message (our newest unconsumed steer,
+   * at least one steer waiting, nothing in the queued lane that a LIFO remove
+   * would take instead).
+   */
+  function recallMethodFor(entry) {
+    if (!entry || entry.role !== 'steer' || entry.consumed || entry.settled || !entry.runtimeId) return null;
+    const itemId = queuedLane.get(entry.runtimeId);
+    if (itemId) return { kind: 'queued', itemId };
+    if (typeof session?.rpc?.queue?.removeMostRecent !== 'function') return null;
+    if (steerSendsInFlight > 0 || queuedItemCount > 0 || waitingSteers < 1) return null;
+    const pending = unconsumedSteers();
+    return pending.length && pending[pending.length - 1] === entry ? { kind: 'newest' } : null;
+  }
+
+  /** Probe the experimental RPC surfaces once per session. */
+  function probeSessionRpc(target) {
+    sessionRpc = {
+      queue: typeof target?.rpc?.queue?.pendingItems === 'function'
+        && typeof target?.rpc?.queue?.removeAt === 'function',
+      interruptMainTurn: typeof target?.rpc?.interruptMainTurn === 'function',
+      tasks: typeof target?.rpc?.tasks?.list === 'function'
+        && typeof target?.rpc?.tasks?.cancel === 'function',
+    };
+    dbg(`copilot session rpc surfaces: queue=${sessionRpc.queue} interruptMainTurn=${sessionRpc.interruptMainTurn} tasks=${sessionRpc.tasks}`);
   }
 
   function observeBackgroundShells(event) {
@@ -809,7 +1676,7 @@ export function createCopilotSdkSessionRunner({
       // closed to new lines, so the note belongs to the continuation this
       // notification is about to trigger.
       if (note && !activeTurn && pendingActivities.length < MAX_PENDING_ACTIVITIES) {
-        pendingActivities.push(note);
+        pendingActivities.push({ text: note, reportsFailure: false });
       }
     }
     // Only the runtime's own `system.notification` heralds a continuation. A
@@ -835,9 +1702,13 @@ export function createCopilotSdkSessionRunner({
     // — but it is guarded anyway: re-routing INTO a settled turn would recurse
     // through this function forever, so it is treated as "no owner".
     if (!turn || turn.settled) {
-      // Same rule as `routeEvent`: only the start of work opens a row.
-      if (!isContinuationOpeningEvent(event)) return;
-      turn = openContinuationTurn();
+      // Same rules as `routeEvent`: a pushed prompt's late run is its own
+      // turn; otherwise only the start of work opens a row.
+      turn = adoptOrphanedRun(event);
+      if (!turn) {
+        if (!isContinuationOpeningEvent(event)) return;
+        turn = openContinuationTurn();
+      }
     }
     await handleTurnEvent(turn, event);
   }
@@ -848,6 +1719,9 @@ export function createCopilotSdkSessionRunner({
       return;
     }
     turn.armStall?.();
+    // Root work ends on the runtime's own terminator, so a question-only
+    // continuation it joins no longer closes itself (whileAwaitingHuman).
+    if (isContinuationOpeningEvent(event)) turn.rootWork = true;
     let actions = [];
     try {
       actions = turn.normalizer.normalize(event);
@@ -855,6 +1729,12 @@ export function createCopilotSdkSessionRunner({
       dbg('normalize failed', String(event?.type || ''), error?.message || String(error));
       return;
     }
+    // The prompt boundary: the runtime has started work on a prompt. Decides
+    // which row owns the segment the normalizer just opened, and settles the
+    // previous run's row when this one is a new run (see noteUserMessage).
+    if (String(event?.type || '') === 'user.message' && !event?.agentId) {
+      await noteUserMessage(turn, event);
+    }
     for (const action of actions) {
       if (action.channel === 'result') {
         turn.result = action.payload;
@@ -874,27 +1754,150 @@ export function createCopilotSdkSessionRunner({
     while (turn.bufferedActions.length) {
       const batch = turn.bufferedActions.splice(0);
       for (const action of batch) {
-        await dispatchAction(turn.message, action, turn.state).catch(() => {});
+        await dispatchOwned(turn, action).catch(() => {});
       }
     }
   }
 
-  function buildSessionConfig(model, relayMode, reasoningEffort = null) {
+  /**
+   * The relay's `ask_user` tool: same name and fields as the runtime's
+   * built-in, plus `multi_select`. The handler runs under exactly the same
+   * human-gating as the built-in path (`onUserInputRequest`): the stall
+   * watchdog is held, steering is held (a question card is open), and a card
+   * raised the moment a continuation opens waits for its row. It never
+   * throws: a failed card answers in-band so the model can carry on.
+   */
+  function buildRelayAskUserTool() {
+    return {
+      name: RELAY_ASK_USER_TOOL_NAME,
+      description: RELAY_ASK_USER_TOOL_DESCRIPTION,
+      parameters: RELAY_ASK_USER_TOOL_PARAMETERS,
+      overridesBuiltInTool: true,
+      // The built-in asks no permission either: asking a question is not an action.
+      skipPermission: true,
+      defer: 'never',
+      handler: async (args, invocation) => {
+        const { question, choices, multiSelect } = parseAskUserToolArguments(args);
+        try {
+          const result = await whileAwaitingHuman(async (turn) => {
+            await awaitInteractiveRow(turn);
+            // Cancelled by either side: the turn (Stop, teardown) or the
+            // runtime itself (a subagent cancelled via tasks.cancel, a
+            // disconnect) — a card nobody will read must not hold steering.
+            const signal = combineSignals(turn?.abortController?.signal, invocation?.signal);
+            return questionBridge.askUserInput(
+              { question, choices, allowFreeform: true, multiSelect, source: 'relay-ask-user-tool' },
+              { signal, message: turn?.message },
+            );
+          });
+          return formatAskUserToolResult({
+            answer: result?.answer,
+            wasFreeform: result?.wasFreeform !== false,
+            timedOut: result?.timedOut === true,
+          });
+        } catch (error) {
+          dbg('relay ask_user failed', error?.message || String(error));
+          return USER_INPUT_UNSUPPORTED_ANSWER;
+        }
+      },
+    };
+  }
+
+  /**
+   * The relay's `remote_relay` tool (copilot-remote-relay-tool.mjs). Every call
+   * is counted while it runs: the stall watchdog re-arms instead of failing the
+   * row, and the lifecycle keeps the runtime up. The clock restarts from the
+   * answer, like after a card. A call is cancelled by the runtime (its
+   * invocation signal) or by a Stop of the turn it started under.
+   */
+  function buildRemoteRelayTool() {
+    return buildCopilotRemoteRelayTool({
+      api,
+      getConversationId: () => activeTurn?.message?.conversationId || sdkSessionId || '',
+      getSignal: (invocation) => combineSignals(activeTurn?.remoteRelayStop?.signal, invocation?.signal),
+      runCall: async (fn) => {
+        pendingRelayToolCalls += 1;
+        try {
+          return await fn();
+        } finally {
+          pendingRelayToolCalls -= 1;
+          touch();
+          activeTurn?.armStall?.();
+        }
+      },
+      dbg,
+    });
+  }
+
+  /** One signal that aborts when any of the given ones does (nulls ignored). */
+  function combineSignals(...signals) {
+    const live = signals.filter((signal) => signal && typeof signal.aborted === 'boolean');
+    if (live.length <= 1) return live[0] || null;
+    if (typeof AbortSignal.any === 'function') return AbortSignal.any(live);
+    const controller = new AbortController();
+    for (const signal of live) {
+      if (signal.aborted) { controller.abort(); break; }
+      signal.addEventListener('abort', () => controller.abort(), { once: true });
+    }
+    return controller.signal;
+  }
+
+  /**
+   * Open a session, retrying once without the relay's `ask_user` when the
+   * runtime refuses the override (an older runtime). The refusal is
+   * remembered until the runtime is stopped — the next runtime (possibly
+   * auto-updated under the relay) gets another try. Only the override goes:
+   * the relay's other tools (`remote_relay`) override nothing and stay.
+   */
+  async function openSession(open, config) {
+    try {
+      return await open(config);
+    } catch (error) {
+      const tools = Array.isArray(config?.tools) ? config.tools : [];
+      const isAskUserOverride = (tool) => tool?.name === RELAY_ASK_USER_TOOL_NAME && tool?.overridesBuiltInTool === true;
+      if (!tools.some(isAskUserOverride) || !isToolOverrideRejection(error) || isSessionNotFoundError(error)) throw error;
+      dbg('the runtime refused the relay ask_user override; using its built-in ask_user', error?.message || String(error));
+      askUserOverrideRejected = true;
+      const { tools: _tools, ...withoutTools } = config;
+      const kept = tools.filter((tool) => !isAskUserOverride(tool));
+      return open(kept.length ? { ...withoutTools, tools: kept } : withoutTools);
+    }
+  }
+
+  /** The relay's own session tools; each is added only when it applies. */
+  function relaySessionTools() {
+    return [
+      // The relay's `ask_user` (see copilot-ask-user-tool.mjs): the built-in's
+      // fields plus `multi_select`, so a model can declare a multi-select
+      // question instead of the relay guessing from its wording.
+      ...(relayAskUserTool && !askUserOverrideRejected ? [buildRelayAskUserTool()] : []),
+      ...(remoteRelayGate.isEnabled() ? [buildRemoteRelayTool()] : []),
+    ];
+  }
+
+  function buildSessionConfig(model, reasoningEffort = null) {
     // Built once per session, not per request. Reads the mode off the LIVE turn
     // rather than closing over the one the session was built with, because one
     // session serves every turn and the user can switch modes between them.
+    // With no turn live (a background agent's request) it is the mode of the
+    // last delivered turn, as for a continuation.
     const decidePermission = createCopilotPermissionHandler({
       // Only the ask-mode branch actually blocks on a human; wrapping it keeps
-      // the stall watchdog off a turn where someone is deciding.
+      // the stall watchdog off a turn where someone is deciding, and only
+      // there can an approval open a row of its own.
       bridge: {
-        askToolApproval: (permissionRequest, options) => whileAwaitingHuman(async () => {
+        askToolApproval: (permissionRequest, options) => whileAwaitingHuman(async (turn) => {
           // An ask-mode approval raised the moment a continuation opens must
           // wait for the row its card will hang off — see `awaitInteractiveRow`.
-          await awaitInteractiveRow();
-          return questionBridge.askToolApproval(permissionRequest, options);
+          await awaitInteractiveRow(turn);
+          return questionBridge.askToolApproval(permissionRequest, {
+            ...options,
+            signal: turn?.abortController?.signal || options?.signal || null,
+            message: turn?.message,
+          });
         }),
       },
-      getRelayMode: () => activeTurn?.message?.relayMode || relayMode,
+      getRelayMode: () => activeTurn?.message?.relayMode || lastRelayMode,
       // An aborted turn must not leave the human staring at a card whose answer
       // nothing will read; the bridge times the card out instead.
       getSignal: () => activeTurn?.abortController?.signal || null,
@@ -911,6 +1914,7 @@ export function createCopilotSdkSessionRunner({
     const provider = resolveProviderConfigImpl({ env, model: model || defaultModel, dbg });
     byokProvider = provider;
     const effort = normalizeRelayEffort(reasoningEffort);
+    const tools = relaySessionTools();
     return {
       // The relay session id IS the SDK session id, so the runtime's own state
       // under ~/.copilot/session-state/<id> is addressable by conversation and
@@ -933,6 +1937,8 @@ export function createCopilotSdkSessionRunner({
       // The runtime's own defaults, pinned. See DEFAULT_INFINITE_SESSION_CONFIG.
       ...(infiniteSessionConfig ? { infiniteSessions: { ...infiniteSessionConfig } } : {}),
       onEvent: routeEvent,
+      // The relay's own tools (`relaySessionTools`); omitted when there are none.
+      ...(tools.length ? { tools } : {}),
       // Permission policy follows the conversation's relay mode: agent and
       // autopilot auto-approve, plan denies non-read tools with feedback, and
       // ask asks the human through a relay question card. The handler reads the
@@ -956,12 +1962,13 @@ export function createCopilotSdkSessionRunner({
       // the deserializer is strict, so it is always a real boolean.
       onUserInputRequest: async (request) => {
         try {
-          const { answer, wasFreeform } = await whileAwaitingHuman(async () => {
+          const { answer, wasFreeform } = await whileAwaitingHuman(async (turn) => {
             // Same gate as the approval path: an `ask_user` fired straight
             // after a continuation opened must get the row, not a null id.
-            await awaitInteractiveRow();
+            await awaitInteractiveRow(turn);
             return questionBridge.askUserInput(request, {
-              signal: activeTurn?.abortController?.signal || null,
+              signal: turn?.abortController?.signal || null,
+              message: turn?.message,
             });
           });
           return { answer, wasFreeform };
@@ -1015,12 +2022,12 @@ export function createCopilotSdkSessionRunner({
       const source = String(request?.elicitationSource || '').trim();
       const message = String(request?.message || '').trim()
         || 'Copilot needs structured input to continue this turn.';
-      const result = await whileAwaitingHuman(async () => {
-        await awaitInteractiveRow();
+      const result = await whileAwaitingHuman(async (turn) => {
+        await awaitInteractiveRow(turn);
         return questionBridge.askStructured({
           prompt: source ? `${message}\n\n(Requested by ${source}.)` : message,
           requestedSchema: schema,
-        }, { signal: activeTurn?.abortController?.signal || null });
+        }, { signal: turn?.abortController?.signal || null, message: turn?.message });
       });
       const content = result?.structuredAnswer;
       if (result?.timedOut || !content || typeof content !== 'object' || Array.isArray(content)) {
@@ -1070,8 +2077,8 @@ export function createCopilotSdkSessionRunner({
     dbg('copilot runtime exited', detail);
     const turn = activeTurn;
     if (turn && !turn.settled) {
-      // handlePendingPayload's catch tears the runtime down and publishes the
-      // failure record.
+      // driveTurn tears the runtime down and publishes the failure record
+      // onto every row the turn owns.
       turn.fail(new Error(`the Copilot runtime exited before the turn completed (${detail})`));
       return;
     }
@@ -1126,7 +2133,7 @@ export function createCopilotSdkSessionRunner({
    * rebuilt config. Nothing is lost either way: the relay session id IS the
    * SDK session id, so the rebuild takes the ordinary resume path.
    */
-  async function applySelection(model, effort, relayMode) {
+  async function applySelection(model, effort) {
     if (!byokProvider) {
       await modelSwitch.apply(session, { model, effort, byok: false });
       return session;
@@ -1140,7 +2147,7 @@ export function createCopilotSdkSessionRunner({
     } else {
       dbg('BYOK ceilings differ for the target model; rebuilding the session', model);
     }
-    return rebuildByokSession(model, effort, relayMode);
+    return rebuildByokSession(model, effort);
   }
 
   /**
@@ -1152,7 +2159,7 @@ export function createCopilotSdkSessionRunner({
    * `SessionConfig.model`), so this path never re-enters the RPC attempt —
    * which is also what makes it terminate: RPC refusal → rebuild → done.
    */
-  async function rebuildByokSession(model, effort, relayMode) {
+  async function rebuildByokSession(model, effort) {
     dbg('rebuilding the copilot session for a BYOK model/effort switch', model);
     const closing = session;
     session = null;
@@ -1162,13 +2169,16 @@ export function createCopilotSdkSessionRunner({
     try { await closing?.disconnect?.(); } catch (error) {
       dbg('session disconnect before model switch failed', error?.message || String(error));
     }
-    return ensureSession(model, effort, relayMode);
+    return ensureSession(model, effort);
   }
 
-  async function ensureSession(model, effort, relayMode) {
+  async function ensureSession(model, effort) {
     await ensureClient();
     if (!session) {
-      const config = buildSessionConfig(model, relayMode, effort);
+      // The tool list is part of the session: wait for the worker's first
+      // registration answer (bounded, and it fails closed).
+      await remoteRelayGate.ready();
+      const config = buildSessionConfig(model, effort);
       // Resume first, always. On a brand-new conversation this costs one
       // failed RPC; on every other path (worker restart, idle shutdown,
       // relay restart) it is the difference between continuing the
@@ -1177,7 +2187,7 @@ export function createCopilotSdkSessionRunner({
       // exists and the NEXT reconnect must resume it.
       let resumed = false;
       try {
-        session = await client.resumeSession(sdkSessionId, config);
+        session = await openSession((cfg) => client.resumeSession(sdkSessionId, cfg), config);
         resumed = true;
         dbg(`resumed copilot session ${sdkSessionId.slice(0, 8)}`);
       } catch (error) {
@@ -1191,9 +2201,13 @@ export function createCopilotSdkSessionRunner({
           throw error;
         }
         dbg('copilot session state not found, creating', error?.message || String(error));
-        session = await client.createSession(config);
+        session = await openSession((cfg) => client.createSession(cfg), config);
         dbg(`created copilot session ${sdkSessionId.slice(0, 8)}`);
       }
+      // Which experimental surfaces THIS runtime has (it auto-updates under
+      // the relay): decides un-steer and the targeted Stop for the session.
+      probeSessionRpc(session);
+      scheduleQueueLaneRefresh();
       if (resumed && !byokProvider) {
         // A resumed HOSTED session keeps whatever model it was created with —
         // `config.model` is not guaranteed to be honoured on resume — so the
@@ -1225,11 +2239,13 @@ export function createCopilotSdkSessionRunner({
       publishModelSnapshot(resumed ? 'session-resume' : 'session-start');
       return session;
     }
-    return applySelection(model, effort, relayMode);
+    return applySelection(model, effort);
   }
 
   async function stopRuntime(reason) {
     stopLifecycleTimer();
+    // The next session is built from a fresh registration answer.
+    void remoteRelayGate.refresh();
     try { detachRuntimeExit(); } catch { /* the observer is best-effort */ }
     detachRuntimeExit = () => {};
     const closingSession = session;
@@ -1241,14 +2257,33 @@ export function createCopilotSdkSessionRunner({
     // them: the tracked set is state about a process that no longer exists and
     // must not pin the next one. The replay gate is reset for the same reason —
     // the next connection resumes and arms its own window.
-    if (backgroundShells.size()) {
+    if (backgroundShells.size() || backgroundTasks.size) {
       backgroundShells.reset();
-      // The shells died with the runtime; clear their panel cards too.
-      publishBackgroundShellTasks();
+      // Background agents and shells die with the runtime (live-probed: a
+      // disconnect cancels the agents and drops the shells from the registry);
+      // clear their panel cards too.
+      backgroundTasks = new Map();
+      agentDetails.clear();
+      publishBackgroundTasks({ immediate: true });
+    }
+    if (taskRefreshTimer) {
+      clearTimeout(taskRefreshTimer);
+      taskRefreshTimer = null;
     }
     replayGate.reset();
+    // A settled turn waiting on a card (driveTurn) would wait for an answer
+    // nothing can take any more: the agent that asked died with the runtime.
+    for (const turn of publishingTurns) turn.abortController.abort();
     continuationDueSince = 0;
     pendingActivities = [];
+    compactingSince = 0;
+    queuedLane = new Map();
+    waitingSteers = 0;
+    queuedItemCount = 0;
+    steerSendsInFlight = 0;
+    sessionRpc = { queue: false, interruptMainTurn: false, tasks: false };
+    askUserOverrideRejected = false;
+    syncDeliveryReadiness();
     if (!closingSession && !closingClient) return;
     dbg(`stopping the copilot runtime (${reason})`);
     try { await closingSession?.disconnect?.(); } catch (error) {
@@ -1291,8 +2326,44 @@ export function createCopilotSdkSessionRunner({
       dbg('continuation grace expired with no continuation turn');
       continuationDueSince = 0;
     }
+    if (sessionRpc.tasks) {
+      // The registry is the truth: live agents and shells hold the runtime up
+      // to the cap (the relay's background-task slider, 0 = unlimited), and on
+      // expiry they are CANCELLED — the runtime can stop them now — rather
+      // than forgotten. Bounded: a task whose cancel the runtime refuses a
+      // few times is abandoned instead of pinning the runtime forever. A
+      // re-read once per lifecycle poll catches state the events miss (a
+      // shell that exited after a cancel emits no notification).
+      const capMs = Number(getBackgroundTaskTimeoutMs()) || 0;
+      const live = runningBackgroundTasks();
+      if (!live.length) return false;
+      if (capMs > 0) {
+        for (const task of live) {
+          const startedAt = Date.parse(String(task.startedAt || '')) || agentDetails.get(task.id)?.startedAt || 0;
+          if (!startedAt || now - startedAt < capMs) continue;
+          const refusals = taskCancelRefusals.get(task.id) || 0;
+          if (refusals >= MAX_TASK_CANCEL_REFUSALS) {
+            dbg('background task cap reached and the runtime would not cancel it; abandoning it', task.id);
+            abandonedTasks.add(task.id);
+            backgroundTasks.delete(task.id);
+            publishBackgroundTasks({ immediate: true });
+            continue;
+          }
+          dbg('background task cap reached; cancelling it', task.id, task.description || task.command || '');
+          void stopBackgroundTask(task.id).then((cancelled) => {
+            if (!cancelled) taskCancelRefusals.set(task.id, (taskCancelRefusals.get(task.id) || 0) + 1);
+          });
+        }
+        if (!runningBackgroundTasks().length) return false;
+      }
+      if (now - lastTaskRefreshAt >= lifecyclePollMs) scheduleTaskRefresh();
+      return true;
+    }
     if (!backgroundShells.size()) return false;
-    const capMs = Number(getBackgroundTaskTimeoutMs()) || 0;
+    // Without the registry there is no Stop and no card worth the name, so an
+    // unlimited slider (0) must not mean "a forgotten `sleep 99999` pins the
+    // runtime forever": the old 30-minute default applies on this path.
+    const capMs = Number(getBackgroundTaskTimeoutMs()) || DEFAULT_BACKGROUND_TASK_TIMEOUT_MS;
     let expiredAny = false;
     for (const shell of backgroundShells.expireOlderThan(capMs)) {
       expiredAny = true;
@@ -1310,7 +2381,9 @@ export function createCopilotSdkSessionRunner({
     // A pending question card means a human is mid-answer; tearing the runtime
     // down under them would discard the session the answer belongs to. A turn
     // that is still publishing counts too: it settled, but its rows are live.
-    if (disposed || activeTurn || publishingTurns.size > 0 || pendingHumanRequests > 0 || !client) return;
+    if (
+      disposed || activeTurn || publishingTurns.size > 0 || pendingHumanRequests > 0 || pendingRelayToolCalls > 0 || !client
+    ) return;
     if (!(idleShutdownMs > 0)) return;
     // Evaluated before the idle clock so the caps still expire on a runtime
     // that has been quiet far longer than the idle window.
@@ -1339,18 +2412,81 @@ export function createCopilotSdkSessionRunner({
     return String(message?.providerModel || '').trim() || defaultModel;
   }
 
-  function createTurn(message, { kind = 'delivered' } = {}) {
-    const continuation = kind === 'continuation';
-    const turn = {
-      // 'delivered' (a queue row arrived) | 'continuation' (the runtime started
-      // work by itself and this worker minted a synthetic row for it).
-      kind,
-      message,
-      normalizer: createNormalizerImpl(),
-      state: { lastStreamedText: '' },
+  /**
+   * A queue row this turn owes an answer.
+   *
+   * `role`: 'primary' (the delivered row that opened the turn), 'steer' (a row
+   * delivered mid-turn and pushed into the same runtime interaction) or
+   * 'self' (the synthetic row of a self-initiated turn). An entry is owned —
+   * heartbeat-claimed, crash-guard-requeued — from creation until `released`.
+   */
+  function createEntry(turn, message, role) {
+    const entry = {
+      turn,
+      message,
+      role,
+      // The id `send()` resolved; the key `user.message.messageId` matches.
+      runtimeId: null,
+      // A root `user.message` named this entry: the runtime has taken the
+      // prompt. `delivery` is the runtime's own word for how.
+      consumed: false,
+      delivery: null,
+      interactionId: null,
+      // The entry whose run absorbed this one (`delivery:"steering"`).
+      foldedInto: null,
+      consumedMarked: false,
+      // Its outcome was decided and its publishes started / it landed.
+      settled: false,
+      released: false,
+      cancelled: false,
+      // Something worth keeping was published on this row: the run's own
+      // work (a tool line, a thought, a lane), or a carried-in line that
+      // reports a failure — not bookkeeping, and not the other lines carried
+      // in from between turns (`showsWork`). Decides whether an empty
+      // continuation may vanish.
+      showedWork: false,
+      // `lastStreamedText` is what this row last received on /api/stream —
+      // the stream gate and the abort/error fallback text both read it.
+      state: { lastStreamedText: '' },
+    };
+    entry.done = new Promise((resolve) => { entry.resolveDone = resolve; });
+    turn.entries.push(entry);
+    return entry;
+  }
+
+  function assignRuntimeId(turn, entry, runtimeId) {
+    const id = String(runtimeId || '').trim();
+    entry.runtimeId = id || null;
+    if (!id) return;
+    turn.pushed.set(id, entry);
+    // The runtime can start work on a prompt before the send() that pushed it
+    // has resolved with its id. The boundary was remembered; reconcile it now,
+    // on the dispatch chain so it orders after the events already captured.
+    const unclaimed = turn.unclaimedUserMessages.get(id);
+    if (!unclaimed) return;
+    turn.unclaimedUserMessages.delete(id);
+    dispatchChain = dispatchChain
+      .then(() => adoptSegment(turn, entry, unclaimed))
+      .catch((error) => { dbg('late prompt-boundary reconcile failed', error?.message || String(error)); });
+  }
+
+  function createTurn(message, { kind = 'delivered', adoptEntry = null } = {}) {
+    const continuation = kind === 'continuation';
+    const turn = {
+      // 'delivered' (a queue row arrived) | 'continuation' (the runtime started
+      // work by itself and this worker minted a synthetic row for it).
+      kind,
+      message,
+      model: '',
+      // The runner's cross-turn knowledge of background agents rides in, so a
+      // later turn's normalizer opens no lane for an agent spawned earlier.
+      normalizer: createNormalizerImpl({ isBackgroundAgent: (agentId) => agentDetails.has(agentId) }),
       result: null,
+      failure: null,
       settled: false,
       aborted: false,
+      // The row the user pressed Stop on (from the abort control), when known.
+      abortedRowId: null,
       stallTimer: null,
       planBoardPosted: false,
       // Set when a mutating tool was actually approved and run this turn.
@@ -1365,45 +2501,61 @@ export function createCopilotSdkSessionRunner({
       // rather than failing the worker.
       discarded: false,
       controlState: null,
-      // How many prompts have been SENT into this interaction. The runtime
-      // consumes queued prompts in order, and opens one `user.message` segment
-      // per prompt as it picks each up, so send order IS segment order.
-      //
-      // Deliberately not derived from the normalizer's live segment count: at
-      // the moment a steering send happens the runtime may not have opened the
-      // previous prompt's segment yet, and the steered row would then be
-      // attributed the PREVIOUS prompt's answer.
-      //
-      // Starts at 1, not 0: this turn's own prompt is always its first, and
-      // counting it here rather than after `send()` resolves closes the race
-      // where a steering delivery lands between the two. A continuation sent no
-      // prompt at all, so it starts at 0.
-      promptsSent: continuation ? 0 : 1,
-      // The segment this turn's OWN reply lands in. For a delivered turn that
-      // is where its prompt is picked up — non-zero when a previous interaction
-      // left prompts queued inside the runtime, which are consumed first. A
-      // continuation has no `user.message` of its own, so the normalizer's
-      // implicit first segment is its own.
-      baseSegment: continuation ? 0 : carriedPrompts,
-      // The segment the NEXT prompt steered into this interaction will be
-      // answered in. Tracked explicitly rather than derived, because the two
-      // kinds differ: a delivered turn's own prompt occupies `baseSegment`, so
-      // the next is `baseSegment + 1`; a continuation occupies segment 0
-      // without having sent anything, so the first steered prompt opens
-      // segment 1. Getting this wrong cross-publishes the continuation's reply
-      // into the user's row.
-      nextSegmentIndex: continuation ? 1 : carriedPrompts + 1,
-      // The lowest segment index any prompt SENT by this turn can occupy — the
-      // floor for the carried-prompt arithmetic when the interaction ends.
-      firstSentSegment: continuation ? 1 : carriedPrompts,
       // Cancels any relay question card this turn is blocked on, so an aborted
       // turn does not leave a human answering into the void.
       abortController: new AbortController(),
-      // Queue rows delivered mid-turn and steered into this interaction. Each
-      // one is owed a response by THIS turn — the runtime answers them all
-      // under a single `session.idle`, so nothing else will settle them.
-      steeredRows: [],
+      // Cancels the `remote_relay` calls that started under this turn — on the
+      // user's Stop only. Not `abortController`: that one also fires when the
+      // turn settles normally, and a background agent's call must outlive that.
+      remoteRelayStop: new AbortController(),
+      // Cards (questions, ask-mode approvals, elicitations) open on this
+      // turn's row; `humansIdle` resolves when the last one is done. A turn
+      // that settles with one still open publishes only after it (driveTurn).
+      humanRequests: 0,
+      humansIdle: null,
+      // Whether any card was ever raised on this turn's row.
+      askedHuman: false,
+      // Opened by `ensureInteractiveTurn` for a question rather than by the
+      // runtime, and whether root work has joined it since.
+      humanOrigin: false,
+      rootWork: false,
+      // Every row this turn owes an answer, in push order.
+      entries: [],
+      // runtime message id → entry, for the `user.message` acknowledgement.
+      pushed: new Map(),
+      // Normalizer segment index → the entry whose row the segment's text
+      // belongs to. A `delivery:"steering"` prompt's segment belongs to the
+      // run it was folded into; a `queued`/`idle` one starts its own run.
+      segmentOwners: [],
+      // The entry whose run the runtime is working on right now.
+      currentOwner: null,
+      primaryEntry: null,
+      // Early settles (a previous run's row, published when the next run
+      // opened) run off the event dispatch chain; driveTurn awaits them
+      // before releasing ownership.
+      settlePromises: [],
+      // False until the turn-opening send() has resolved: the delivery hold.
+      primarySent: continuation,
+      // Root `user.message`s whose id no pushed entry knew yet (the event beat
+      // the send() resolution): runtime id → boundary, reconciled by
+      // assignRuntimeId.
+      unclaimedUserMessages: new Map(),
     };
+    if (adoptEntry) {
+      // A pushed row whose run the runtime opened after the turn it was pushed
+      // into had already settled: it becomes the primary of a turn of its own.
+      adoptEntry.turn = turn;
+      turn.entries.push(adoptEntry);
+      turn.primaryEntry = adoptEntry;
+      if (adoptEntry.runtimeId) turn.pushed.set(adoptEntry.runtimeId, adoptEntry);
+      turn.primarySent = true;
+    } else {
+      turn.primaryEntry = createEntry(turn, message, continuation ? 'self' : 'primary');
+    }
+    turn.currentOwner = turn.primaryEntry;
+    if (continuation) turn.segmentOwners[0] = turn.primaryEntry;
+    turn.primaryReady = new Promise((resolve) => { turn.resolvePrimaryReady = resolve; });
+    if (turn.primarySent) turn.resolvePrimaryReady();
     if (continuation) {
       // The single in-flight registration for this turn's synthetic row, and
       // the signal that abandons it. One promise, stored ON the turn, so the
@@ -1425,18 +2577,19 @@ export function createCopilotSdkSessionRunner({
       turn.rejectDone = reject;
     });
     // The stall watchdog and the runtime-exit observer can reject `turn.done`
-    // before `runTurn` reaches its `await` — an unhandled rejection that the
-    // worker crash guard would escalate into a whole-worker failure. This
-    // handler exists only to mark the promise as handled; the real await path
-    // still sees the rejection.
+    // before anything awaits it — an unhandled rejection that the worker crash
+    // guard would escalate into a whole-worker failure. This handler exists
+    // only to mark the promise as handled; driveTurn still sees the rejection.
     turn.done.catch(() => {});
     turn.settle = () => {
       if (turn.settled) return;
       turn.settled = true;
       turn.disarmStall();
       // The terminal event releases the event stream at once — see
-      // `beginPublishing`. The queue row stays owned until the publish lands.
+      // `beginPublishing`. The queue rows stay owned until the publishes land.
       beginPublishing(turn);
+      turn.resolvePrimaryReady();
+      syncDeliveryReadiness();
       turn.resolveDone();
     };
     turn.fail = (error) => {
@@ -1444,6 +2597,8 @@ export function createCopilotSdkSessionRunner({
       turn.settled = true;
       turn.disarmStall();
       beginPublishing(turn);
+      turn.resolvePrimaryReady();
+      syncDeliveryReadiness();
       turn.rejectDone(error);
     };
     turn.disarmStall = () => {
@@ -1458,7 +2613,9 @@ export function createCopilotSdkSessionRunner({
         // A human staring at a question card is not a stalled runtime. Re-arm
         // rather than fail: the card has its own (much longer) timeout, and
         // failing the row here would settle it while the answer is still coming.
-        if (pendingHumanRequests > 0) {
+        // A remote_relay call waiting on another relay is the same kind of
+        // silence; the relay bounds that wait itself.
+        if (pendingHumanRequests > 0 || pendingRelayToolCalls > 0) {
           turn.armStall();
           return;
         }
@@ -1472,44 +2629,517 @@ export function createCopilotSdkSessionRunner({
     return turn;
   }
 
+  // ----------------------------------------------------- prompt boundaries --
+
+  function claimSegment(turn, index, owner) {
+    // Leading unowned segments (text the runtime produced before any prompt
+    // boundary, e.g. the answer to a prompt carried over from a previous
+    // interaction) go to the first owner: that is where the merged note sent
+    // the reader.
+    for (let j = 0; j <= index; j += 1) {
+      if (!turn.segmentOwners[j]) turn.segmentOwners[j] = owner;
+    }
+  }
+
+  /**
+   * A root `user.message` arrived: the runtime started work on a prompt. Called
+   * on the dispatch chain right after the normalizer opened the prompt's
+   * segment, so `promptCount() - 1` is that segment.
+   */
+  async function noteUserMessage(turn, event) {
+    const data = event?.data && typeof event.data === 'object' ? event.data : {};
+    const index = Math.max(0, turn.normalizer.promptCount() - 1);
+    const runtimeId = String(data.messageId || '').trim();
+    const boundary = {
+      index,
+      delivery: String(data.delivery || '').trim().toLowerCase(),
+      interactionId: String(data.interactionId || '').trim(),
+    };
+    const entry = runtimeId ? turn.pushed.get(runtimeId) : null;
+    if (entry) {
+      await adoptSegment(turn, entry, boundary);
+      return;
+    }
+    // Not one of ours (yet): a prompt the runtime injected itself (an autopilot
+    // nudge, a carried-over prompt from a previous interaction), or a pushed
+    // prompt whose send() has not resolved with its id. Its text belongs to
+    // the run in progress until proven otherwise.
+    if (runtimeId && !turn.unclaimedUserMessages.has(runtimeId)) turn.unclaimedUserMessages.set(runtimeId, boundary);
+    claimSegment(turn, index, turn.currentOwner || turn.primaryEntry);
+  }
+
+  /**
+   * Bind a prompt boundary to the entry it names.
+   *
+   * `delivery:"steering"`: the runtime folded the prompt into the run already
+   * in progress — the reply that follows belongs to that run's row, and this
+   * row will settle with the fold marker (Claude's `folded`). The relay is
+   * told the prompt is consumed at once, so a crash between now and the
+   * marker fails the row instead of re-running it.
+   *
+   * Anything else (`queued`, `idle`, unknown): the prompt starts its own run
+   * on the same interaction. The previous run is over — nothing more will be
+   * produced for its row, so it is settled right away rather than at the
+   * drain's end, exactly as a Claude context finalizes when the CLI opens the
+   * next one.
+   */
+  async function adoptSegment(turn, entry, { index, delivery, interactionId }) {
+    entry.consumed = true;
+    noteCancellableChange();
+    entry.delivery = delivery || null;
+    entry.interactionId = interactionId || null;
+    const running = turn.currentOwner || turn.primaryEntry;
+    if (delivery === 'steering' && running && running !== entry && !running.settled) {
+      entry.foldedInto = running;
+      turn.segmentOwners[index] = running;
+      claimSegment(turn, index, running);
+      if (entry.role === 'steer' && !entry.consumedMarked) {
+        entry.consumedMarked = true;
+        void markConsumed(entry.message.conversationId, [entry.message]);
+      }
+      dbg('steered prompt folded into the running turn', entry.message.id, `→ ${running.message.id || '(continuation)'}`);
+      return;
+    }
+    turn.segmentOwners[index] = entry;
+    claimSegment(turn, index, entry);
+    if (running === entry) return;
+    turn.currentOwner = entry;
+    if (running && !running.settled) {
+      dbg('pushed prompt runs as its own turn; settling the previous run', entry.message.id, `after ${running.message.id || '(continuation)'}`);
+      // Off the dispatch chain: a slow relay must not stall the events of
+      // the run that just opened (or its terminator) behind this publish.
+      // A continuation whose row is not minted yet (a steer pushed past the
+      // hold after its wait ran out) settles once the row exists — publishing
+      // now would name no row — or is discarded with it.
+      const settled = running.message?.id || !turn.rowReady
+        ? settleEntry(turn, running, { type: 'completed' })
+        : turn.rowReady.then((ready) => settleEntry(turn, running, { type: ready ? 'completed' : 'discarded' }));
+      turn.settlePromises.push(settled);
+    }
+  }
+
+  // -------------------------------------------------------------- settling --
+
+  /**
+   * Whether a completed row with no text has nothing to show at all: the
+   * runtime opened it by itself (typically right after a background agent
+   * finished), its run published no tool line, thought or lane, no card was
+   * raised on it, no user message was folded into it, and nothing carried in
+   * reported a failure. Such a row would only ever read "the turn completed
+   * without a text reply", and the task card already showed the agent
+   * finishing (live, gpt-5.6-luna, 2026-09-26). A failed agent's card is gone
+   * by then, so the row carrying its failure line is kept (`showsWork`).
+   * Every delivered row keeps the note — somebody asked something there.
+   */
+  function settlesSilently(turn, entry, folded) {
+    return turn.kind === 'continuation'
+      && entry.role === 'self'
+      && !turn.humanOrigin
+      && !turn.askedHuman
+      && !turn.planBoardPosted
+      && !entry.showedWork
+      && !folded.length
+      && Boolean(entry.message?.id);
+  }
+
+  /**
+   * Settle a silent continuation by tearing its row down: the requeue route's
+   * continuation branch drops a processing continuation without an answer
+   * (`dropped: 'continuation'`), the same teardown a dead worker's rows get.
+   * A lost request leaves the row to that same stale-continuation recovery.
+   */
+  async function dropSilentContinuation(entry) {
+    dbg('continuation ended with nothing to show; dropping its row', entry.message.id);
+    await api('POST', '/api/requeue', { messageId: entry.message.id, ...attemptFields(entry.message) })
+      .catch((error) => { dbg('silent continuation drop failed', entry.message.id, error?.message || String(error)); });
+  }
+
+  /**
+   * Decide and publish one row's outcome. Idempotent per entry. A run owner's
+   * settle also settles the steers folded into its run (they were answered by
+   * its reply), in push order, after the reply itself.
+   */
+  async function settleEntry(turn, entry, outcome) {
+    if (entry.settled) return;
+    entry.settled = true;
+    const model = turn.result?.model || turn.normalizer.model || turn.model || null;
+    const folded = turn.entries.filter((other) => other !== entry && !other.settled && other.foldedInto === entry);
+    try {
+      switch (outcome.type) {
+        case 'completed': {
+          const text = finalTextFor(turn, entry, turn.result);
+          if (!text && settlesSilently(turn, entry, folded)) {
+            await dropSilentContinuation(entry);
+            break;
+          }
+          const published = text || EMPTY_TURN_COMPLETION_NOTE;
+          if (entry.role !== 'steer' && shouldPostPlanBoard({
+            relayMode: entry.message.relayMode,
+            finalText: text,
+            alreadyPosted: turn.planBoardPosted,
+            acted: turn.acted === true,
+          })) {
+            await publishPlanBoard(turn, text, 'plan-mode-fallback');
+          }
+          await publishFinalStream(entry.message, published);
+          await publishResponse(entry.message, {
+            text: published,
+            model,
+            consumedSteerIds: folded.map((other) => other.message),
+          });
+          break;
+        }
+        case 'aborted-by-user': {
+          // The queue row's fate belongs to the server-side abort control,
+          // exactly as in the Claude and Cursor workers. Publishing a response
+          // here would double-settle the row.
+          await publishFinalStream(entry.message, finalTextFor(turn, entry, turn.result));
+          break;
+        }
+        case 'user-stopped': {
+          // The run a Stop cut short while naming another row. The abort ack
+          // fails only the row it names, so this one is failed here — as
+          // stopped, never requeued: a requeue would re-run a prompt the user
+          // stopped (the Claude worker's lingering-stopped rule). Claimed
+          // first, so a crash meanwhile fails it rather than re-running it.
+          const id = String(entry.message.id || '');
+          const terminalError = buildRelayStopFailure();
+          claimSettling(entry.message, 'stopped');
+          try {
+            await publishFinalStream(entry.message, finalTextFor(turn, entry, turn.result));
+            const outcome = await publishResponse(entry.message, {
+              text: terminalError.message,
+              model,
+              terminalError,
+              requeueOnFailure: false,
+              consumedSteerIds: folded.map((other) => other.message),
+            });
+            // Not even the stop landed: the heartbeat hands it to the relay to fail.
+            if (outcome === 'failed' && id) settleFailedTerminals.set(id, terminalError);
+          } finally {
+            releaseSettling(id);
+          }
+          break;
+        }
+        case 'runtime-interrupted': {
+          const own = finalTextFor(turn, entry, turn.result);
+          const text = own ? `${own}\n\n${RUNTIME_INTERRUPTED_NOTE}` : RUNTIME_INTERRUPTED_NOTE;
+          await publishFinalStream(entry.message, text);
+          await publishResponse(entry.message, { text, model, consumedSteerIds: folded.map((other) => other.message) });
+          break;
+        }
+        case 'error': {
+          const { classified } = outcome;
+          await publishFinalStream(entry.message, entry.state.lastStreamedText);
+          await publishResponse(entry.message, {
+            text: classified.text,
+            model,
+            terminalError: terminalErrorRecord(entry.message, classified),
+            consumedSteerIds: folded.map((other) => other.message),
+          });
+          break;
+        }
+        case 'folded':
+          await publishSettleMarker(entry.message, { text: STEER_FOLDED_TEXT, model, kind: 'folded', variant: 'folded' });
+          break;
+        case 'stopped':
+          await publishSettleMarker(entry.message, { text: STEER_STOPPED_TEXT, model, kind: 'stopped', variant: 'stopped' });
+          break;
+        case 'merged-note':
+          // Accepted by the runtime, never started: still queued inside it, so
+          // it will be answered at the start of the next interaction — a
+          // requeue would run it twice.
+          await publishFinalStream(entry.message, STEERED_ROW_MERGED_NOTE);
+          await publishResponse(entry.message, { text: STEERED_ROW_MERGED_NOTE, model });
+          break;
+        case 'cancelled':
+        case 'discarded':
+        default:
+          break;
+      }
+    } catch (error) {
+      dbg('settle publish failed', entry.message?.id || '(no id)', outcome.type, error?.message || String(error));
+    } finally {
+      entry.released = true;
+      entry.resolveDone(true);
+    }
+    for (const other of folded) {
+      const foldOutcome = outcome.type === 'completed' || outcome.type === 'merged-note'
+        ? { type: 'folded' }
+        : outcome.type === 'error' ? outcome : { type: 'stopped' };
+      await settleEntry(turn, other, foldOutcome);
+    }
+  }
+
+  /** Remove our unconsumed prompts from the runtime's queued lane (best effort). */
+  async function clearOwnedQueuedItems(entries) {
+    if (!entries.length || !session || !sessionRpc.queue) return;
+    await refreshQueueLane();
+    for (const entry of entries) {
+      const itemId = queuedLane.get(entry.runtimeId);
+      if (!itemId) continue;
+      try {
+        await session.rpc.queue.removeAt({ id: itemId });
+        dbg('removed a stopped prompt from the runtime queue', entry.message.id);
+      } catch (error) {
+        dbg('queue.removeAt after Stop failed', entry.message.id, error?.message || String(error));
+      }
+    }
+  }
+
+  /**
+   * Hold pushed-but-unstarted prompts for the orphan grace, then return the
+   * ones the runtime still did not open (an opened one was adopted meanwhile
+   * and belongs to a turn of its own now).
+   */
+  async function settleAfterOrphanGrace(turn, orphans) {
+    if (!orphans.length) return [];
+    if (orphanGraceMs > 0) {
+      dbg('pushed prompts not started at idle; waiting for the runtime to open them', orphans.map((entry) => entry.message.id).join(','));
+      await sleep(orphanGraceMs);
+    }
+    return orphans.filter((entry) => entry.turn === turn && !entry.settled);
+  }
+
+  /**
+   * Publish everything a finished turn still owes, per row.
+   *
+   * Shared by both turn kinds: the runtime does not distinguish a turn it
+   * started from one it was asked for, so neither does the reporting.
+   */
+  async function finishTurn(turn) {
+    const result = turn.result;
+    const failure = turn.failure;
+    // Capture only. The POST fires from driveTurn's `finally`, after the rows
+    // have been published.
+    captureTurnUsage(turn.primaryEntry.message, result);
+
+    const pending = turn.entries.filter((entry) => !entry.settled && entry.turn === turn);
+    if (!pending.length) return;
+
+    if (failure) {
+      const classified = classifyCopilotTurnException(failure);
+      dbg('copilot turn failed', turn.message?.id || '(continuation)', classified.detail);
+      for (const entry of pending) {
+        if (entry.settled) continue;
+        await settleEntry(turn, entry, { type: 'error', classified });
+      }
+      return;
+    }
+    if (result?.isError) {
+      const classified = classifyCopilotSessionError(result.errorData || { message: result.errorMessage });
+      dbg('turn failed', turn.message?.id || '(continuation)', classified.stableCode);
+      for (const entry of pending) {
+        if (entry.settled) continue;
+        await settleEntry(turn, entry, { type: 'error', classified });
+      }
+      return;
+    }
+
+    const live = turn.currentOwner || turn.primaryEntry;
+    // The row the user pressed Stop on. Normally the live one; the relay's
+    // live-turn picker can also land on another row this turn owns, in which
+    // case THAT row is left to the relay's abort control and the live row
+    // keeps its partial reply. A Stop naming a row that is no longer pending
+    // (its early settle already published, or it is no row of this turn's)
+    // still cut the live run short — and nobody else will settle that row.
+    const namedPending = turn.aborted && turn.abortedRowId
+      ? pending.find((entry) => String(entry.message?.id || '') === turn.abortedRowId) || null
+      : null;
+    const stopped = turn.aborted ? namedPending || (turn.abortedRowId ? null : live) : null;
+    const cutRun = turn.aborted && !stopped && !live.settled ? live : null;
+    const settleOne = async (entry) => {
+      // A row that moved to a turn of its own (adoptOrphanedRun) is not ours.
+      if (entry.turn !== turn || entry.settled) return;
+      const ownsRun = entry === live || (!entry.foldedInto && entry.consumed);
+      if (turn.aborted) {
+        // A user Stop. The stopped row is settled server-side; every other
+        // row pushed into the interaction went unanswered — the runtime
+        // clears both its lanes on an interrupt — and says so, with Resend.
+        if (entry === stopped) {
+          dbg('turn aborted', entry.message.id);
+          await settleEntry(turn, entry, { type: 'aborted-by-user' });
+        } else if (entry === cutRun) {
+          dbg('turn aborted by a Stop that named another row', entry.message.id, `named ${turn.abortedRowId}`);
+          await settleEntry(turn, entry, { type: 'user-stopped' });
+        } else if (ownsRun) {
+          await settleEntry(turn, entry, { type: 'completed' });
+        } else {
+          await settleEntry(turn, entry, { type: 'stopped' });
+        }
+        return;
+      }
+      if (result?.aborted) {
+        // The runtime interrupted the turn on its own. Nothing server-side is
+        // waiting to settle these rows.
+        if (entry === live) {
+          dbg('turn interrupted by the runtime', entry.message.id);
+          await settleEntry(turn, entry, { type: 'runtime-interrupted' });
+        } else if (ownsRun) {
+          await settleEntry(turn, entry, { type: 'completed' });
+        } else {
+          await settleEntry(turn, entry, { type: 'stopped' });
+        }
+        return;
+      }
+      if (ownsRun) {
+        await settleEntry(turn, entry, { type: 'completed' });
+      } else if (entry.foldedInto) {
+        await settleEntry(turn, entry, { type: 'folded' });
+      } else {
+        await settleEntry(turn, entry, { type: 'merged-note' });
+      }
+    };
+    // A normal end with pushed prompts the runtime never started: the runtime
+    // gets a moment to open their runs (adoptOrphanedRun takes them) before
+    // they are noted as carried over — AFTER the rows whose replies are
+    // complete have been published, so a finished answer never waits on the
+    // grace. Not on a Stop (the runtime cleared them) and not on an error.
+    const orphans = (!turn.aborted && !result?.aborted)
+      ? pending.filter((entry) => entry.role === 'steer' && !entry.consumed && !entry.foldedInto)
+      : [];
+    if (turn.aborted || result?.aborted) {
+      // Belt and braces: `interruptMainTurn({flushQueued:false})` and
+      // `abort()` both empty the runtime's steering AND queued lanes
+      // (probe-verified 2026-09-25), so nothing pushed runs after a Stop. Any
+      // prompt of ours still listed in the queued lane is removed by id anyway
+      // before its row is marked stopped. (The id-less steering lane cannot be
+      // targeted, and needs no help.)
+      await clearOwnedQueuedItems(pending.filter((entry) => !entry.consumed && entry.runtimeId));
+    }
+    // The stopped row first: settling it before the live row's cascade means
+    // the cascade (which settles the steers folded into a run) cannot touch
+    // the row the relay's abort control owns. A cut run goes first too, so
+    // the steers folded into it settle through its cascade, after its stop.
+    const first = stopped || cutRun;
+    const ordered = first ? [first, ...pending.filter((entry) => entry !== first)] : pending;
+    for (const entry of ordered) {
+      if (!orphans.includes(entry)) await settleOne(entry);
+    }
+    for (const entry of await settleAfterOrphanGrace(turn, orphans)) {
+      await settleOne(entry);
+    }
+  }
+
+  // ------------------------------------------------------------ lifecycle --
+
+  /**
+   * The turn a Stop is for. Every turn's control poller runs until its
+   * `driveTurn` finishes, so a turn that is still publishing can claim a Stop
+   * meant for another: the Stop goes to the turn owning the row it names, and
+   * one naming no owned row goes to the turn that is running.
+   */
+  function stopTarget(turn, control) {
+    const rowId = String(control?.queueMessageId || '').trim();
+    if (rowId) {
+      for (const candidate of [activeTurn, ...publishingTurns]) {
+        if (candidate?.entries.some((entry) => !entry.released && String(entry.message?.id || '') === rowId)) {
+          return candidate;
+        }
+      }
+    }
+    return turn.settled && activeTurn ? activeTurn : turn;
+  }
+
+  /**
+   * Handle a Stop for `turn`. When the row it names settled early and its
+   * reply is still publishing, the Stop resolves only once that reply has
+   * landed: the relay's ack then fails the named row, which is a no-op on a
+   * completed one but would overwrite a reply still in flight.
+   */
+  async function interruptTurn(turn, control) {
+    const rowId = String(control?.queueMessageId || '').trim() || null;
+    const publishing = rowId
+      ? turn.entries.find((entry) => String(entry.message?.id || '') === rowId && entry.settled && !entry.released)
+      : null;
+    await interruptRun(turn, rowId);
+    if (publishing) await withTimeout(publishing.done, STOPPED_ROW_PUBLISH_WAIT_MS, false);
+  }
+
+  /**
+   * Interrupt the turn the user stopped. `interruptMainTurn` (when the
+   * runtime has it) stops the main agent loop and nothing else: background
+   * agents and promoted shells keep running under their own Stop, exactly
+   * like the Claude worker's targeted interrupt. `session.abort()` — the
+   * fallback — also cancels every background agent and clears both message
+   * lanes. Either way the runtime answers with an aborted idle event, which
+   * settles the turn through the normal terminator.
+   */
+  async function interruptRun(turn, rowId) {
+    if (turn.settled) {
+      // Its run is over and the main loop may already belong to the next
+      // turn, so nothing is interrupted. While it waits on a card (driveTurn)
+      // the Stop ends the cards, and the row settles as stopped.
+      if (turn.humanRequests > 0) {
+        turn.aborted = true;
+        turn.abortedRowId = rowId;
+        turn.abortController.abort();
+      }
+      return;
+    }
+    turn.aborted = true;
+    turn.abortedRowId = rowId;
+    // A pending `remote_relay` call ends now rather than when the runtime gets
+    // round to it: the relay drops the request, withdraws its approval card
+    // and stops waiting on the remote, and the watchdog hold is released.
+    turn.remoteRelayStop?.abort();
+    // While `ensureSession` is still connecting there is no session to abort
+    // and this would be a silent no-op; `runTurn` re-checks `turn.aborted`
+    // once the session exists and settles there instead.
+    if (!session) return;
+    if (sessionRpc.interruptMainTurn) {
+      try {
+        const outcome = await session.rpc.interruptMainTurn({ flushQueued: false });
+        if (outcome?.interrupted === false) {
+          // Nothing was processing: no aborted idle will come. The turn is
+          // over as far as the runtime is concerned.
+          dbg('interruptMainTurn found no main turn in flight; settling locally', turn.message?.id || '');
+          turn.settle();
+        }
+        return;
+      } catch (error) {
+        dbg('interruptMainTurn failed; falling back to abort()', error?.message || String(error));
+      }
+    }
+    await session.abort?.();
+  }
+
+  /**
+   * Start a delivered turn: bring the session up, send the prompt, and hand
+   * the turn's lifecycle to `driveTurn`. Resolves when THIS row has settled —
+   * which can be before the turn ends, when a message pushed later ran as its
+   * own run and this one's reply was already complete.
+   */
   async function runTurn(turn) {
     const { message } = turn;
+    const entry = turn.primaryEntry;
     const model = resolvePerTurnModel(message);
     // The dequeued row's reasoning effort (audit #9). Normalisation happens in
     // the switcher: `none`/absent mean "the model's default".
     const effort = message?.reasoningEffort ?? null;
     const relayMode = message?.relayMode || 'agent';
     lastRelayMode = relayMode;
+    turn.model = model;
     // Set before the session is touched: the heartbeat's owner-recovery guard
     // reads the active ids, so a cold-start delivery must already own its row.
     activeTurn = turn;
-
-    const controlState = controlPoller?.start?.({
-      queueMessageId: message.id,
-      onAbortTurn: async () => {
-        turn.aborted = true;
-        // While `ensureSession` is still connecting there is no session to
-        // abort and this would be a silent no-op; `runTurn` re-checks
-        // `turn.aborted` once the session exists and settles there instead.
-        if (!session) return;
-        // The runtime answers an abort with `abort` → `agent.interrupted` →
-        // `assistant.turn_end` → `session.idle{aborted:true}`, which settles
-        // the turn through the normal terminator; this only asks for it.
-        await session.abort?.();
-      },
-    });
-
+    // The delivery hold begins: nothing steers in until the prompt is sent.
+    syncDeliveryReadiness();
+    // Session-wide, not per row: the client's Stop targets whichever of this
+    // turn's rows is live, and the relay only hands out controls for rows
+    // this worker owns.
+    turn.controlState = controlPoller?.start?.({
+      queueMessageId: '',
+      onAbortTurn: (control) => interruptTurn(stopTarget(turn, control), control),
+    }) || null;
+    turn.drive = driveTurn(turn);
     try {
-      await ensureSession(model, effort, relayMode);
+      await ensureSession(model, effort);
       if (turn.aborted) {
         // The abort landed while the session was still being built. Nothing
-        // was sent, so there is no runtime turn to interrupt — ask anyway (a
-        // queued prompt from a previous delivery could still be running) and
-        // settle locally rather than sending a prompt the user just cancelled.
+        // was sent, so there is no runtime turn to interrupt — settle locally
+        // rather than sending a prompt the user just cancelled.
         dbg('turn aborted before send', message.id);
-        try { await session?.abort?.(); } catch (error) {
-          dbg('abort during session setup failed', error?.message || String(error));
-        }
         turn.settle();
       } else {
         turn.armStall();
@@ -1522,26 +3152,147 @@ export function createCopilotSdkSessionRunner({
         // `mode` and `attachments` are FIELDS of the single MessageOptions
         // argument — `send()` takes no second parameter, so passing options
         // positionally drops them silently.
-        await session.send({
+        const sending = session.send({
           prompt,
           ...(attachments?.length ? { attachments } : {}),
           ...(sendMode ? { mode: sendMode } : {}),
           agentMode: copilotAgentModeForRelayMode(relayMode),
         });
-        // Committed only now that `send()` accepted the prompt (audit #32): a
-        // failed send means the runtime never READ the mode guidance, and
-        // committing before it would make the same-mode retry omit it.
-        context?.commit();
-        // `send()` resolves once the runtime accepted the prompt — it is NOT
-        // the turn's completion; the event stream is.
-        await turn.done;
+        // A send that never resolves (a wedged runtime) must not hold this
+        // delivery hostage once the watchdog has failed the turn: the id is
+        // still recorded if it ever arrives, but the wait ends with the turn.
+        const settledFirst = Symbol('turn-settled');
+        const runtimeId = await Promise.race([
+          sending,
+          turn.done.then(() => settledFirst, () => settledFirst),
+        ]);
+        if (runtimeId === settledFirst) {
+          sending.then((id) => assignRuntimeId(turn, entry, id)).catch(() => {});
+        } else {
+          assignRuntimeId(turn, entry, runtimeId);
+          // Committed only now that `send()` accepted the prompt (audit #32): a
+          // failed send means the runtime never READ the mode guidance, and
+          // committing before it would make the same-mode retry omit it.
+          context?.commit();
+          // The runtime has the prompt: the delivery hold ends and later
+          // deliveries steer into this turn.
+          turn.primarySent = true;
+          turn.resolvePrimaryReady();
+          syncDeliveryReadiness();
+        }
       }
-    } finally {
-      controlPoller?.stop?.(controlState);
-      await quiesceTurn(turn);
+    } catch (error) {
+      // A failure that killed the session (or came from starting it) leaves a
+      // handle nothing else can use; drop it so the next delivery rebuilds and
+      // resumes rather than sending into a dead runtime. An UNCONFIRMED MODEL
+      // SWITCH is the exception: the session is healthy and merely still on
+      // its previous model, and tearing the runtime down over it would kill
+      // any live background work for a selection problem the user fixes by
+      // picking another model.
+      if (!isModelSwitchUnconfirmedError(error)) {
+        await stopRuntime('turn-failure').catch(() => {});
+      }
+      turn.fail(error);
     }
+    // `send()` resolving is NOT the turn's completion; the event stream is.
+    await awaitEntry(turn, entry);
+    return true;
+  }
 
-    return finishTurn(turn, model);
+  /**
+   * Wait for a row's settle. A row's settle is not necessarily the turn's
+   * end: a prompt pushed later may still be running on the same interaction,
+   * and this delivery must not wait for it. But when the turn IS over, wait
+   * for its wrap-up too (ownership release, usage ingest), so a caller that
+   * awaited the delivery sees a quiescent runner — the contract every test
+   * and the crash guard rely on. `driveTurn` never rejects.
+   */
+  async function awaitEntry(turn, entry) {
+    await entry.done;
+    if (turn.settled && turn.drive) await turn.drive.catch(() => {});
+  }
+
+  /**
+   * Run a turn from its first event to its last publish.
+   *
+   * Row ownership is released only after every publish has landed: a
+   * heartbeat firing inside the publish window with no active ids would tell
+   * the relay this worker owns nothing, and the still-`processing` rows would
+   * be recovered underneath it. (The EVENT stream was already released at the
+   * terminator — see `beginPublishing` — so the runtime's next self-initiated
+   * turn can open while this one is still writing.)
+   */
+  async function driveTurn(turn) {
+    try {
+      await turn.done;
+    } catch (error) {
+      turn.failure = turn.failure || error;
+    }
+    // A card still open on this row — a background agent asking while the
+    // main loop went idle (a root question cannot get here: the loop is
+    // blocked on its handler) — keeps the row processing until it is done:
+    // the relay opens cards only on a processing row, and `/api/response`
+    // cancels the ones still open. The event stream is already released
+    // (`beginPublishing`), so new root work opens a turn of its own meanwhile.
+    if (!turn.aborted && !turn.failure && turn.humanRequests > 0) await turn.humansIdle;
+    try {
+      await quiesceTurn(turn);
+      if (turn.failure && turn.kind === 'delivered' && !isModelSwitchUnconfirmedError(turn.failure) && session) {
+        // A stall or a runtime death mid-turn (a setup failure already tore
+        // the runtime down in runTurn).
+        await stopRuntime('turn-failure').catch(() => {});
+      }
+      if (turn.kind === 'continuation') {
+        // Nothing can be published before the row exists. The buffer is
+        // drained by the registration itself; this only covers actions that
+        // arrived during the drain.
+        await awaitContinuationRow(turn);
+        // The invariant is the id, not the flag: registration can also give up
+        // by throwing, or by taking longer than `awaitContinuationRow` waits,
+        // and publishing against `messageId: null` would attribute the whole
+        // turn to nothing at all.
+        if (!turn.message.id) {
+          if (!turn.discarded) abandonContinuationRegistration(turn, 'no relay row at publish time');
+          dbg('continuation output dropped (no relay row)');
+          const classified = classifyCopilotTurnException(
+            turn.failure || new Error('the relay refused a continuation row for this turn'),
+          );
+          for (const entry of turn.entries) {
+            if (entry.settled || entry.turn !== turn) continue;
+            // The steering path is still waiting on any row it handed us, and
+            // it has no row of its own to fall back to.
+            await settleEntry(turn, entry, entry.role === 'self' ? { type: 'discarded' } : { type: 'error', classified });
+          }
+          return;
+        }
+        await flushBufferedActions(turn);
+      }
+      await finishTurn(turn);
+    } catch (error) {
+      dbg('turn publish failed', error?.message || String(error));
+    } finally {
+      // Early settles still in flight must land before the rows stop being
+      // reported (settleEntry never rejects, but this is the ordering guard).
+      await Promise.allSettled(turn.settlePromises);
+      controlPoller?.stop?.(turn.controlState);
+      turn.controlState = null;
+      // Every path through the turn — published, failed, aborted, threw — has
+      // finished by here. Anything still unresolved is released so no caller
+      // waits forever; its row is left to the relay's recovery.
+      for (const entry of turn.entries) {
+        if (entry.turn !== turn || entry.released) continue;
+        entry.settled = true;
+        entry.released = true;
+        entry.resolveDone(true);
+      }
+      // Released only once every publish for this turn's rows has landed.
+      releaseTurnOwnership(turn);
+      touch();
+      syncDeliveryReadiness();
+      // The ingest is advisory, never awaited, and must never be able to
+      // delay a reply that is already written.
+      postTurnUsage();
+    }
   }
 
   /**
@@ -1563,111 +3314,6 @@ export function createCopilotSdkSessionRunner({
     await closeStraySubagentRuns(turn).catch(() => {});
   }
 
-  /**
-   * Publish a finished turn's outcome onto its queue row (and every row steered
-   * into it).
-   *
-   * Shared by both turn kinds. A continuation reaches it through
-   * `driveContinuation` instead of `runTurn`, but the outcomes are identical:
-   * the runtime does not distinguish a turn it started from one it was asked
-   * for, so neither does the reporting.
-   */
-  async function finishTurn(turn, model) {
-    const { message } = turn;
-    const result = turn.result;
-    const responseModel = result?.model || turn.normalizer.model || model || null;
-    // Capture only. The POST fires from `handlePendingPayload`'s `finally`,
-    // after this row has been published.
-    captureTurnUsage(message, result);
-
-    // Whatever this interaction did not get to stays queued in the runtime and
-    // shifts the NEXT interaction's segments: the prompts this turn sent occupy
-    // `[firstSentSegment, nextSegmentIndex)`, and the ones the runtime never
-    // opened a segment for are still in its pending queue.
-    //
-    // The `max` against `firstSentSegment` is what makes this correct for a
-    // continuation, which occupies segment 0 without having sent anything: a
-    // continuation that opened no segment at all (an empty self-initiated turn)
-    // would otherwise report one carried prompt and shift the next real turn's
-    // answer by one.
-    const segmentsOpened = turn.normalizer.promptCount();
-    carriedPrompts = Math.max(0, turn.nextSegmentIndex - Math.max(turn.firstSentSegment, segmentsOpened));
-
-    // This row's own reply. Falls back to the whole composed text when the
-    // runtime opened no segment at all (an empty or immediately-failed turn),
-    // which is strictly better than publishing nothing.
-    const ownText = String(
-      turn.normalizer.segmentText(turn.baseSegment) || result?.text || turn.state.lastStreamedText || '',
-    ).trim();
-
-    // A user-initiated abort publishes the partial text and nothing else: the
-    // queue row's fate belongs to the server-side abort control, exactly as in
-    // the Claude and Cursor workers. Publishing a response here would
-    // double-settle the row.
-    if (turn.aborted) {
-      dbg('turn aborted', message.id);
-      // This row's segment only: the steered rows publish their own, and
-      // publishing the composed text here would show their replies twice.
-      await publishFinalStream(message, ownText);
-      // A steered row is NOT covered by the abort control (which knows only
-      // about the row the user aborted), so it still has to be settled here or
-      // it holds `processing` forever behind a renewing lease.
-      await settleSteeredRows(turn, result, responseModel);
-      return true;
-    }
-
-    // The runtime aborted on its own (`result.aborted` with no relay-side
-    // abort control in flight). Nothing server-side is waiting to settle this
-    // row, so returning here would leave it pending until the delivery
-    // watchdog fails it with a misleading "Relay timeout" — the row has to be
-    // settled with a record that says what actually happened.
-    if (result?.aborted) {
-      dbg('turn interrupted by the runtime', message.id);
-      const text = ownText ? `${ownText}\n\n${RUNTIME_INTERRUPTED_NOTE}` : RUNTIME_INTERRUPTED_NOTE;
-      await publishFinalStream(message, text);
-      await publishResponse(message, { text, model: responseModel });
-      await settleSteeredRows(turn, result, responseModel);
-      return true;
-    }
-
-    if (result?.isError) {
-      const classified = classifyCopilotSessionError(result.errorData || { message: result.errorMessage });
-      dbg('turn failed', message.id, classified.stableCode);
-      await publishFinalStream(message, turn.state.lastStreamedText);
-      await publishResponse(message, {
-        text: classified.text,
-        model: responseModel,
-        terminalError: terminalErrorRecord(message, classified),
-      });
-      // The steered rows failed with it — they were being answered by the same
-      // interaction. They get the same terminal record so each row says why.
-      await settleSteeredRows(turn, result, responseModel, classified);
-      return true;
-    }
-
-    // The turn produced a plan but never called exit-plan-mode (or the runtime
-    // build has no such hook). Same text-shape fallback the siblings use, and
-    // it must go out BEFORE the response: `/api/relay-board` 409s once the
-    // queue row leaves `processing`.
-    if (shouldPostPlanBoard({
-      relayMode: message.relayMode,
-      finalText: ownText,
-      alreadyPosted: turn.planBoardPosted,
-      acted: turn.acted === true,
-    })) {
-      await publishPlanBoard(turn, ownText, 'plan-mode-fallback');
-    }
-
-    // A terminal, non-error turn with no prose is COMPLETE, not a failed
-    // delivery — requeuing re-runs deterministically empty work until the
-    // retry cap fails the row with a misleading "Relay timeout".
-    const publishedText = ownText || EMPTY_TURN_COMPLETION_NOTE;
-    await publishFinalStream(message, publishedText);
-    await publishResponse(message, { text: publishedText, model: responseModel });
-    await settleSteeredRows(turn, result, responseModel);
-    return true;
-  }
-
   // ----------------------------------------------------------- continuation --
 
   /**
@@ -1696,14 +3342,15 @@ export function createCopilotSdkSessionRunner({
     // The gap this pin covers has closed.
     continuationDueSince = 0;
     turn.armStall();
-    // Lines produced between turns (a settled shell's notification) belong to
-    // the turn they triggered.
+    // Lines produced between turns (a settled shell's or background agent's
+    // notification) belong to the turn they triggered.
     if (pendingActivities.length) {
-      for (const text of pendingActivities.splice(0)) {
-        turn.bufferedActions.push({ channel: 'activity', payload: { text, subagentRunId: null } });
+      for (const { text, reportsFailure } of pendingActivities.splice(0)) {
+        turn.bufferedActions.push({ channel: 'activity', payload: { text, subagentRunId: null }, carried: true, reportsFailure });
       }
     }
     dbg('opening a continuation turn for runtime-initiated work');
+    syncDeliveryReadiness();
     // Both are fire-and-forget by design (the SDK's event callback is
     // synchronous and cannot await a turn), so both must swallow: an unhandled
     // rejection here would reach the worker crash guard and take the whole
@@ -1717,16 +3364,54 @@ export function createCopilotSdkSessionRunner({
         // has somewhere to go.
         turn.registered = true;
         turn.resolveRowReady?.(true);
+        syncDeliveryReadiness();
         return;
       }
       abandonContinuationRegistration(turn, 'registration threw');
     });
-    driveContinuation(turn).catch((error) => {
+    turn.drive = driveTurn(turn);
+    turn.drive.catch((error) => {
       dbg('continuation driver threw', error?.message || String(error));
     });
     return turn;
   }
 
+  /**
+   * A pushed row whose run the runtime opened AFTER the turn it was pushed
+   * into had settled (the drain's idle raced the send). It is not a
+   * self-initiated turn — it is that row's own turn, and its reply belongs on
+   * that row. Returns the new turn, or null when the id is not one of ours.
+   */
+  function adoptOrphanedRun(event) {
+    if (String(event?.type || '') !== 'user.message' || event?.agentId) return null;
+    const runtimeId = String(event?.data?.messageId || '').trim();
+    if (!runtimeId) return null;
+    for (const previous of publishingTurns) {
+      const entry = previous.pushed.get(runtimeId);
+      if (!entry || entry.consumed || entry.settled) continue;
+      previous.entries = previous.entries.filter((other) => other !== entry);
+      previous.pushed.delete(runtimeId);
+      // From here the entry belongs to the new turn (`entry.turn`); the old
+      // turn's settle passes skip rows that moved away.
+      const turn = createTurn(entry.message, { kind: 'delivered', adoptEntry: entry });
+      turn.model = resolvePerTurnModel(entry.message);
+      activeTurn = turn;
+      turn.armStall();
+      turn.controlState = controlPoller?.start?.({
+        queueMessageId: '',
+        onAbortTurn: (control) => interruptTurn(stopTarget(turn, control), control),
+      }) || null;
+      dbg('a pushed prompt opened its own run after its turn settled; adopting it', entry.message.id);
+      syncDeliveryReadiness();
+      turn.drive = driveTurn(turn);
+      turn.drive.catch((error) => {
+        dbg('adopted turn driver threw', error?.message || String(error));
+      });
+      return turn;
+    }
+    return null;
+  }
+
   /**
    * Give up on a continuation's synthetic row: nothing buffered will ever
    * publish, and a registration still in flight must not adopt a row into this
@@ -1738,8 +3423,10 @@ export function createCopilotSdkSessionRunner({
     turn.discarded = true;
     turn.bufferedActions = [];
     turn.registrationAbort?.abort?.();
-    // Interactive handlers stop waiting and take their degraded path.
+    // Interactive handlers stop waiting and take their degraded path, and the
+    // delivery hold that waited for the row ends.
     turn.resolveRowReady?.(false);
+    syncDeliveryReadiness();
     dbg('continuation registration abandoned:', reason);
   }
 
@@ -1813,16 +3500,14 @@ export function createCopilotSdkSessionRunner({
     // Only now is there a row to abort, so this is where the control poller can
     // start.
     turn.controlState = controlPoller?.start?.({
-      queueMessageId: turn.message.id,
-      onAbortTurn: async () => {
-        turn.aborted = true;
-        if (!session) return;
-        await session.abort?.();
-      },
+      queueMessageId: '',
+      onAbortTurn: (control) => interruptTurn(stopTarget(turn, control), control),
     }) || null;
     await flushBufferedActions(turn);
     turn.registered = true;
     turn.resolveRowReady?.(true);
+    // The row exists: the delivery hold it imposed ends (canAcceptSteering).
+    syncDeliveryReadiness();
   }
 
   /**
@@ -1846,184 +3531,347 @@ export function createCopilotSdkSessionRunner({
     }
   }
 
-  /**
-   * Run a continuation to its terminator and publish it, mirroring
-   * `handlePendingPayload`'s outer shape.
-   *
-   * Row ownership is released only after every publish has landed, exactly as
-   * for a delivered turn: a heartbeat firing inside the publish window with no
-   * active ids would tell the relay this worker owns nothing, and the
-   * still-`processing` synthetic row would be recovered underneath it. (The
-   * EVENT stream was already released at the terminator — see
-   * `beginPublishing` — so the runtime's next self-initiated turn can open
-   * while this one is still writing.)
-   */
-  async function driveContinuation(turn) {
-    let failure = null;
-    try {
-      await turn.done;
-    } catch (error) {
-      failure = error;
-    }
-    try {
-      await quiesceTurn(turn);
-      // Nothing can be published before the row exists. The buffer is drained
-      // by the registration itself; this only covers actions that arrived
-      // during the drain.
-      await awaitContinuationRow(turn);
-      // The invariant is the id, not the flag: registration can also give up by
-      // throwing, or by taking longer than `awaitContinuationRow` waits, and
-      // publishing against `messageId: null` would attribute the whole turn to
-      // nothing at all.
-      if (!turn.message.id) {
-        if (!turn.discarded) abandonContinuationRegistration(turn, 'no relay row at publish time');
-        dbg('continuation output dropped (no relay row)');
-        // The steering path is still waiting on any row it handed us, and it
-        // has no row of its own to fall back to.
-        await settleSteeredRows(turn, null, null, classifyCopilotTurnException(
-          failure || new Error('the relay refused a continuation row for this turn'),
-        )).catch(() => {});
-        return;
-      }
-      await flushBufferedActions(turn);
-      if (failure) {
-        const classified = classifyCopilotTurnException(failure);
-        dbg('continuation turn failed', turn.message.id, classified.detail);
-        await publishResponse(turn.message, {
-          text: classified.text,
-          model: null,
-          terminalError: terminalErrorRecord(turn.message, classified),
-        });
-        await settleSteeredRows(turn, null, null, classified).catch(() => {});
-        return;
-      }
-      await finishTurn(turn, '');
-    } catch (error) {
-      dbg('continuation publish failed', error?.message || String(error));
-    } finally {
-      controlPoller?.stop?.(turn.controlState);
-      turn.controlState = null;
-      releaseTurnOwnership(turn);
-      touch();
-      // A continuation spends real quota (the live capture burned a premium
-      // request on `read_bash` + the reply), so its numbers ride the same
-      // fire-and-forget ingest as a delivered turn's.
-      postTurnUsage();
-    }
-  }
+  // --------------------------------------------------------------- steering --
 
   /**
-   * Settle every queue row that was steered into this interaction.
+   * A delivery arrived while a turn was already running: push it into the
+   * same runtime interaction as a steer.
    *
-   * The runtime answers the original prompt AND every prompt queued behind it
-   * under ONE `session.idle` (live-verified — see the plan doc §5), so no
-   * second turn will ever settle these rows. Each one is answered with the text
-   * of ITS OWN prompt segment, which the normalizer separates using the
-   * `user.message` events that mark where the runtime picked each prompt up.
+   * `mode: "immediate"` makes it a real steer — injected at the next tool
+   * boundary (`delivery:"steering"`, folded into the running reply), or run
+   * as its own turn right after when the model is mid-stream
+   * (`delivery:"queued"`). Either way the row is owned by this turn and
+   * settled by it (see adoptSegment / finishTurn); nothing else will.
    *
-   * A row whose prompt the runtime accepted but never started work on has no
-   * segment. It is NOT requeued: the prompt is still sitting in the runtime's
-   * pending queue and will be answered at the start of the next turn, so
-   * redelivering it would run the same prompt twice. It gets a note instead —
-   * the same trade the Claude worker makes for a handed-off context.
-   */
-  async function settleSteeredRows(turn, result, responseModel, classified = null) {
-    if (!turn.steeredRows.length) return;
-    for (const steered of turn.steeredRows) {
-      const { message: steeredMessage, segmentIndex } = steered;
-      let text = String(turn.normalizer.segmentText(segmentIndex) || '').trim();
-      if (classified) {
-        text = classified.text;
-      } else if (!text) {
-        text = STEERED_ROW_MERGED_NOTE;
-      }
-      await publishFinalStream(steeredMessage, text);
-      await publishResponse(steeredMessage, {
-        text,
-        model: responseModel,
-        ...(classified ? { terminalError: terminalErrorRecord(steeredMessage, classified) } : {}),
-      });
-      steered.settle?.();
-    }
-    turn.steeredRows.length = 0;
-  }
-
-  /**
-   * A delivery arrived while a turn was already running.
-   *
-   * The relay's worker socket is single-flight — it will not deliver a second
-   * row until `onDeliver` resolves — so this is not the normal path. It is
-   * reachable on a socket reconnect that redelivers, and it is the path a
-   * future relay change would take, so it steers rather than corrupting the
-   * turn: the prompt is queued into the SAME interaction (which is all
-   * `mode: "enqueue"` can do — it cannot interrupt an in-flight model call),
-   * and the row is adopted so the interaction's terminator settles it too.
-   *
-   * The row is registered BEFORE the send so a failure between the two cannot
-   * leave a row nobody owns.
+   * The entry is registered BEFORE the send so a failure between the two
+   * cannot leave a row nobody owns.
    */
   async function steerIntoActiveTurn(turn, message) {
     const { prompt: body, attachments } = buildMessageOptionsImpl(message);
     // A real relay round trip on the first turn of a mode — long enough for the
     // turn to finish underneath us.
     const context = await buildRelayContextPrefix(message).catch(() => null);
-    const prompt = withRelayContext(context?.prefix, body);
+    // The hidden steer note (shared/steer-note.mjs): a steer that lands before
+    // the model's first output otherwise tempts it to answer only the newest
+    // message and drop the request it was working on (burn-in 2026-09-25).
+    // Not in a continuation: there the running work is the runtime's own
+    // follow-up, not a request of the user's to keep going with.
+    const prompt = withRelayContext(context?.prefix, turn.kind === 'continuation' ? body : withSteerNote(body));
     // Re-checked AFTER the awaits and before anything is sent or registered.
-    // `settleSteeredRows` has already run if the turn settled during them, so a
-    // row pushed now would never be settled and its caller would wait forever —
-    // wedging the single-flight delivery socket. Nothing has been sent yet, so
-    // handing the row back to the normal path is free.
+    // Nothing has been sent yet, so handing the row back to the normal path is
+    // free.
     if (turn.settled) {
       dbg('turn settled while steering was preparing; running it as a fresh turn', message.id);
       return NOT_STEERED;
     }
-    // Prompts are consumed in the order they were sent, and each opens its own
-    // `user.message` segment as it is picked up, so this prompt's send position
-    // (after any prompts carried over from a previous interaction, and after
-    // whatever the interaction itself occupies) is its segment index.
-    const segmentIndex = turn.nextSegmentIndex;
-    turn.nextSegmentIndex += 1;
-    turn.promptsSent += 1;
-    const steered = { message, segmentIndex };
-    steered.done = new Promise((resolve) => { steered.settle = resolve; });
-    turn.steeredRows.push(steered);
-    dbg('steering a mid-turn delivery into the running turn', message.id, `segment=${segmentIndex}`);
+    const entry = createEntry(turn, message, 'steer');
+    dbg('steering a mid-turn delivery into the running turn', message.id);
+    let runtimeId;
+    // Counted until send() names the message (see `steerSendsInFlight`).
+    steerSendsInFlight += 1;
+    entry.sendSeq = ++steerSendSeq;
     try {
-      await session.send({
+      runtimeId = await session.send({
         prompt,
         ...(attachments?.length ? { attachments } : {}),
-        mode: 'enqueue',
+        mode: 'immediate',
         agentMode: copilotAgentModeForRelayMode(message?.relayMode || 'agent'),
       });
     } catch (error) {
       // The prompt never reached the runtime, so nothing will answer it and the
       // row is safe to requeue — unlike an accepted one.
-      turn.steeredRows = turn.steeredRows.filter((entry) => entry !== steered);
+      turn.entries = turn.entries.filter((other) => other !== entry);
+      entry.settled = true;
+      entry.released = true;
+      entry.resolveDone(true);
+      steerSendsInFlight = Math.max(0, steerSendsInFlight - 1);
       dbg('steering send failed, requeuing the row', message.id, error?.message || String(error));
       await api('POST', '/api/requeue', { messageId: message.id, ...attemptFields(message) }).catch(() => {});
       return true;
     }
+    assignRuntimeId(turn, entry, runtimeId);
+    steerSendsInFlight = Math.max(0, steerSendsInFlight - 1);
     // Same commit-after-send rule as `runTurn` (audit #32): a steered prompt
     // whose send failed never delivered its guidance, so the retry must
     // include it again.
     context?.commit();
-    // Resolves when the interaction settles this row in `settleSteeredRows`.
-    await steered.done;
+    scheduleQueueLaneRefresh();
+    // Resolves when the interaction settles this row.
+    await awaitEntry(turn, entry);
+    return true;
+  }
+
+  // ------------------------------------------------------------------ gate --
+
+  /**
+   * Whether a message delivered now would steer into the live turn. False
+   * while: no session / no live turn; the turn-opening prompt has not been
+   * sent yet, or a continuation's row does not exist yet (the delivery hold —
+   * a second send before the first would invert the runs, and a steer's run
+   * would settle the continuation's reply against no row while its buffered
+   * output flushed into the steered one); a question card, ask-mode approval
+   * or elicitation is open (the relay must not push past a card); a
+   * compaction is running.
+   */
+  function canAcceptSteering() {
+    if (disposed || !session) return false;
+    const turn = activeTurn;
+    if (!turn || turn.settled || turn.aborted) return false;
+    if (!turn.primarySent || awaitingRow(turn)) return false;
+    if (pendingHumanRequests > 0) return false;
+    if (isCompacting()) return false;
+    return true;
+  }
+
+  /** A continuation whose synthetic row is still being minted (and not given up on). */
+  function awaitingRow(turn) {
+    return turn.kind === 'continuation' && !turn.registered && !turn.discarded;
+  }
+
+  /**
+   * The one steering gate. A delivery arriving now is held — handed back to
+   * the queue instead of pushed — when a turn is live (or a human request /
+   * compaction is open) and it cannot accept a steer. The socket link consults
+   * this for its readiness too, idle or mid-delivery.
+   */
+  function isDeliveryHeld() {
+    if (disposed) return false;
+    const turn = activeTurn;
+    const live = Boolean(turn && !turn.settled);
+    if (!live && pendingHumanRequests === 0 && !isCompacting()) return false;
+    return !canAcceptSteering();
+  }
+
+  function syncDeliveryReadiness() {
+    const ready = !isDeliveryHeld();
+    if (ready === lastReportedDeliveryReady) return;
+    lastReportedDeliveryReady = ready;
+    try {
+      onDeliveryReadinessChange(ready);
+    } catch (error) {
+      dbg('delivery readiness listener failed', error?.message || String(error));
+    }
+  }
+
+  /**
+   * Give a held delivery back to the queue with no retry penalty. The relay
+   * re-delivers it once this worker signals ready again, i.e. when the hold
+   * ends — the message then steers into the resumed turn. Pushing it into the
+   * hold instead would bypass the question card or land inside a compaction.
+   */
+  async function handBackHeldDelivery(message) {
+    dbg('steering held; handing the delivery back to the queue', message.id || '(no id)');
+    if (!message.id) return false;
+    await api('POST', '/api/requeue', {
+      messageId: message.id,
+      class: 'steering-held',
+      ...attemptFields(message),
+    }).catch((error) => {
+      if (isStaleAttemptError(error)) {
+        dbg('steering-held hand-back refused as stale_attempt', message.id);
+        return;
+      }
+      dbg('steering-held hand-back failed', message.id, error?.message || String(error));
+    });
+    return false;
+  }
+
+  function* ownedEntries() {
+    if (activeTurn) yield* activeTurn.entries;
+    for (const turn of publishingTurns) yield* turn.entries;
+  }
+
+  /**
+   * Pushed rows the client may still cancel: unconsumed and recallable — in
+   * practice the newest waiting steer (immediate sends wait in the runtime's
+   * id-less steering lane), or any row that sits in the queued lane.
+   */
+  function cancellableIds() {
+    const ids = [];
+    for (const entry of unconsumedSteers()) {
+      if (!recallMethodFor(entry)) continue;
+      const id = String(entry.message?.id || '').trim();
+      if (id && !ids.includes(id)) ids.push(id);
+    }
+    return ids;
+  }
+
+  /**
+   * Composer-facing steering snapshot, published on the heartbeat: whether a
+   * turn is live, whether a message typed now would steer into it, and — when
+   * it would not — why. `supported` is how the client learns this Copilot
+   * conversation steers at all (its provider type alone cannot tell an SDK
+   * worker from the extension engine); `cancellableIds` are the pushed rows
+   * that may still be pulled back out of the runtime (decision 8).
+   */
+  function steeringState() {
+    const turn = activeTurn;
+    const turnActive = Boolean(turn && !turn.settled);
+    const canSteer = canAcceptSteering();
+    let holdReason = null;
+    if (turnActive && !canSteer) {
+      if (pendingHumanRequests > 0) holdReason = 'question';
+      else if (isCompacting()) holdReason = 'compaction';
+      else if (!turn.primarySent || awaitingRow(turn)) holdReason = 'delivery';
+      else holdReason = 'other';
+    }
+    const messageId = String(turn?.currentOwner?.message?.id || turn?.message?.id || '').trim() || null;
+    return { turnActive, canSteer, holdReason, messageId, supported: true, cancellableIds: cancellableIds() };
+  }
+
+  /**
+   * Re-read the queue, and — only if the prompt is still recallable at that
+   * instant — issue its remove request in the same tick as the check, so no
+   * steer send can be issued in between (JSON-RPC keeps request order).
+   */
+  async function recallPushedPrompt(entry, id) {
+    // Watched from before the read, so a fold that lands during the read or
+    // the remove is seen however far behind the dispatch chain runs.
+    const watch = { taken: false };
+    recallWatches.set(entry.runtimeId, watch);
+    try {
+      // Only the READ is bounded: a runtime that will not answer it gets no
+      // remove at all. Once a remove is sent it is seen through to its answer —
+      // giving up on it could leave the prompt removed and the row uncancelled.
+      const fresh = await withTimeout(refreshQueueLane().then(() => true), UNSTEER_TIMEOUT_MS, false);
+      if (!fresh) {
+        dbg('un-steer refused: the runtime did not answer the queue read in time', id);
+        return false;
+      }
+      const target = session;
+      const method = watch.taken ? null : recallMethodFor(entry);
+      if (!target || !method) {
+        dbg('un-steer refused: the runtime no longer holds this prompt as recallable', id);
+        return false;
+      }
+      const request = method.kind === 'queued'
+        ? target.rpc.queue.removeAt({ id: method.itemId })
+        : target.rpc.queue.removeMostRecent();
+      const removed = (await request)?.removed === true;
+      if (removed && (watch.taken || entry.consumed || entry.settled)) {
+        // The runtime took this prompt before it processed the remove, so
+        // what was removed is some other waiting message — another client's,
+        // never a runtime notification (see `recallWatches`). It cannot be put
+        // back; this row settles through its normal path.
+        dbg('UN-STEER MISMATCH: the runtime took the prompt before the remove; the remove took another message', id, method.kind);
+        return false;
+      }
+      return removed;
+    } finally {
+      if (recallWatches.get(entry.runtimeId) === watch) recallWatches.delete(entry.runtimeId);
+    }
+  }
+
+  function withTimeout(promise, ms, fallback) {
+    let timer = null;
+    return Promise.race([
+      promise,
+      new Promise((resolve) => { timer = setTimeout(() => resolve(fallback), ms); timer.unref?.(); }),
+    ]).finally(() => clearTimeout(timer));
+  }
+
+  /**
+   * Un-steer (decision 8, narrowed 2026-09-25 after the live check): pull a
+   * pushed-but-unconsumed row back out of the runtime and cancel it. Immediate
+   * sends wait in the runtime's id-less steering lane, so only the NEWEST
+   * waiting one is recallable (`queue.removeMostRecent`); a row in the queued
+   * lane goes by its stable id. A prompt the runtime already took cannot be
+   * recalled; the control is then a no-op and the row settles normally.
+   */
+  async function cancelPushedMessage(messageId) {
+    const id = String(messageId || '').trim();
+    if (!id) return false;
+    let entry = null;
+    for (const candidate of ownedEntries()) {
+      if (String(candidate.message?.id || '') === id) { entry = candidate; break; }
+    }
+    if (!entry || entry.consumed || entry.settled || !entry.runtimeId) {
+      dbg('un-steer refused: row not cancellable', id, entry ? `consumed=${entry.consumed} settled=${entry.settled}` : 'unknown row');
+      return false;
+    }
+    if (!session || !sessionRpc.queue) return false;
+    // One un-steer at a time; each re-reads the queue (that read is bounded —
+    // see recallPushedPrompt). Steer sends never wait on this chain.
+    const run = unsteerChain.then(() => recallPushedPrompt(entry, id));
+    unsteerChain = run.catch(() => false);
+    const removed = await run.catch((error) => {
+      dbg('un-steer failed', id, error?.message || String(error));
+      return false;
+    });
+    if (!removed) return false;
+    // Settled meanwhile by its turn's end, or taken since the answer (the
+    // remove then took another message): it keeps its normal outcome.
+    if (entry.consumed || entry.settled) {
+      dbg('un-steer raced the runtime taking the prompt or the row settling; leaving it to settle normally', id);
+      return false;
+    }
+    entry.cancelled = true;
+    entry.settled = true;
+    while (recalledRuntimeIds.size >= MAX_RECALLED_RUNTIME_IDS) recalledRuntimeIds.delete(recalledRuntimeIds.keys().next().value);
+    recalledRuntimeIds.set(entry.runtimeId, id);
+    dbg('un-steered a pushed prompt', id);
+    // The prompt is gone from the runtime; the row must end cancelled and
+    // never be re-delivered. It stays owned (settling, with the terminal
+    // wording the crash guard would send) until the relay acknowledges the
+    // cancel; if the relay never does, the heartbeat hands it over to fail.
+    claimSettling(entry.message, 'cancelled');
+    const cancelBody = {
+      conversationId: entry.message.conversationId,
+      messageId: id,
+      ...attemptFields(entry.message),
+    };
+    let acknowledged = false;
+    for (let attempt = 0; ; attempt += 1) {
+      acknowledged = await api('POST', '/api/queue-cancelled', cancelBody).then(() => true, (error) => {
+        dbg('queue-cancelled publish failed', id, error?.message || String(error));
+        // The row already left `processing` (answered, recovered, or already
+        // cancelled): nothing left for this worker to do.
+        return Number(error?.status) === 404 || Number(error?.status) === 409;
+      });
+      if (acknowledged || attempt >= settleRetryDelaysMs.length) break;
+      await sleep(settleRetryDelaysMs[attempt]);
+    }
+    if (!acknowledged) {
+      dbg('queue-cancelled could not be posted; handing the row to the heartbeat', id);
+      settleFailedTerminals.set(id, buildSteerSettleFailure(entry.message, { variant: 'cancelled', agentLabel: SETTLE_AGENT_LABEL }));
+    }
+    releaseSettling(id);
+    entry.released = true;
+    entry.resolveDone(true);
+    const turn = entry.turn;
+    if (turn) {
+      turn.entries = turn.entries.filter((other) => other !== entry);
+      turn.pushed.delete(entry.runtimeId);
+    }
+    scheduleQueueLaneRefresh();
     return true;
   }
 
   async function handlePendingPayload(pending) {
     const message = pending?.message || null;
     if (!message) return false;
+    // Held (a card is open, a compaction is running, the turn-opening prompt
+    // is not sent yet): hand the row back with no retry penalty; the relay
+    // re-delivers it when the hold ends. An older relay (the worker updated on
+    // disk before the relay restarted) treats the hand-back as a failed
+    // delivery — retry, backoff, worker marked errored — so against one the
+    // message is pushed the legacy way.
+    if (isDeliveryHeld() && canHandBackHeldDelivery() !== false) return handBackHeldDelivery(message);
+    // Legacy path only: never send a second prompt before the turn-opening one
+    // (it would invert the runs), and never start a second turn beside one
+    // that is still connecting.
+    if (activeTurn && !activeTurn.settled && !activeTurn.primarySent) {
+      await activeTurn.primaryReady;
+    }
+    // Nor steer into a continuation before its row exists (canAcceptSteering);
+    // bounded like the registration itself, which can hang on a dead relay.
+    if (activeTurn && !activeTurn.settled && awaitingRow(activeTurn)) {
+      await withTimeout(activeTurn.rowReady, continuationRegistrationTimeoutMs, false);
+    }
     // A delivery that lands while a turn is running is steered into it rather
     // than starting a second one: the runtime has a single conversation and a
     // concurrent `send` would interleave into the same interaction anyway —
     // this way the row is owned and settled instead of orphaned.
-    //
-    // Deliberately OUTSIDE the try/finally below: that `finally` clears
-    // `activeTurn`, and a steered call returns while the turn it was steered
-    // into is still publishing. Clearing there would tell the heartbeat this
-    // worker owns nothing and the relay would recover the live row.
     if (activeTurn && !activeTurn.settled && session) {
       const turn = activeTurn;
       try {
@@ -2040,75 +3888,30 @@ export function createCopilotSdkSessionRunner({
         return true;
       }
     }
-    // Created here rather than inside `runTurn` so the catch and finally below
-    // act on THIS turn by identity: under split ownership, `activeTurn` may
-    // already belong to a newer turn (a continuation the runtime opened while
-    // this one was publishing) by the time they run.
     const turn = createTurn(message);
-    try {
-      return await runTurn(turn);
-    } catch (error) {
-      const classified = classifyCopilotTurnException(error);
-      dbg('copilot turn failed', message.id, classified.detail);
-      // A failure that killed the session (or came from starting it) leaves a
-      // handle nothing else can use; drop it so the next delivery rebuilds and
-      // resumes rather than sending into a dead runtime. An UNCONFIRMED MODEL
-      // SWITCH is the exception: the session is healthy and merely still on
-      // its previous model, and tearing the runtime down over it would kill
-      // any live detached shells for a selection problem the user fixes by
-      // picking another model.
-      if (!isModelSwitchUnconfirmedError(error)) {
-        await stopRuntime('turn-failure').catch(() => {});
-      }
-      await publishResponse(message, {
-        text: classified.text,
-        model: null,
-        terminalError: terminalErrorRecord(message, classified),
-      });
-      // Rows steered into the turn that just threw are owed a response too —
-      // and, more urgently, `steerIntoActiveTurn` is still awaiting their
-      // settle. Skipping this would wedge that caller (and its queue row)
-      // forever behind a heartbeat that keeps renewing the lease.
-      await settleSteeredRows(turn, null, null, classified).catch(() => {});
-      await closeStraySubagentRuns(turn).catch(() => {});
-      return true;
-    } finally {
-      // Released only once every publish for this row has landed. A heartbeat
-      // that fired during the publish window with the row unowned would tell
-      // the relay this worker owns nothing, and the still-processing row would
-      // be recovered (`owner-heartbeat-idle`) and re-delivered — a duplicate
-      // execution racing the response that was already on its way.
-      releaseTurnOwnership(turn);
-      touch();
-      // Every path through the turn — published, failed, aborted, threw — has
-      // finished by here, which is the only safe place for the ingest: it is
-      // advisory, it is not awaited, and it must never be able to delay a reply
-      // that is already written.
-      postTurnUsage();
-    }
+    return runTurn(turn);
   }
 
   // --------------------------------------------------------------- teardown --
 
   function getActiveQueueMessageId() {
-    if (activeTurn) return String(activeTurn.message?.id || '');
-    // A settled turn still publishing owns its row every bit as much: the
-    // heartbeat's owner-recovery guard must keep seeing it until the publish
-    // lands, or the relay recovers the row underneath the response in flight.
-    for (const turn of publishingTurns) {
-      const id = String(turn.message?.id || '');
-      if (id) return id;
+    const live = activeTurn?.currentOwner;
+    if (live && !live.released && live.message?.id) return String(live.message.id);
+    for (const entry of ownedEntries()) {
+      const id = String(entry.message?.id || '');
+      if (id && !entry.released) return id;
     }
     return '';
   }
 
   /**
-   * Every row this worker owns — the running turn's own plus any steered into
-   * it, and the same for every settled turn still publishing — as
-   * `{ id, attemptId }` entries. A steered row missing from it would be
-   * recovered mid-flight as `owner-heartbeat-mismatch` and re-delivered while
-   * the runtime was still answering it; a publishing row missing from it would
-   * be recovered as `owner-heartbeat-idle` while its response was on the wire.
+   * Every row this worker owns — the running turn's rows and the same for
+   * every settled turn still publishing — as `{ id, attemptId }` entries; a
+   * consumed row whose settle marker is still being saved carries the
+   * terminal failure the crash guard must send instead of a requeue, because
+   * its prompt must never run twice. A row missing from this list would be
+   * recovered mid-flight and re-delivered while the runtime was still
+   * answering it.
    *
    * Both the heartbeat (lease renewal) and the crash guard (requeue-on-exit)
    * read this: the crash guard takes the entries whole so its requeues stay
@@ -2117,24 +3920,36 @@ export function createCopilotSdkSessionRunner({
    */
   function getActiveQueueMessageIds() {
     const entries = [];
-    const push = (message) => {
-      const id = String(message?.id || '');
-      if (!id || entries.some((entry) => entry.id === id)) return;
-      entries.push({ id, attemptId: message?.attemptId || null });
-    };
-    const collect = (turn) => {
-      if (!turn) return;
-      push(turn.message);
-      for (const steered of turn.steeredRows || []) push(steered.message);
+    const byId = new Map();
+    const push = (message, terminalError = null) => {
+      const id = String(message?.id || '').trim();
+      if (!id) return;
+      const existing = byId.get(id);
+      if (existing) {
+        if (terminalError && !existing.terminalError) existing.terminalError = terminalError;
+        return;
+      }
+      const entry = { id, attemptId: message?.attemptId || null, ...(terminalError ? { terminalError } : {}) };
+      byId.set(id, entry);
+      entries.push(entry);
     };
-    collect(activeTurn);
-    for (const turn of publishingTurns) collect(turn);
+    for (const entry of ownedEntries()) {
+      if (entry.released) continue;
+      push(entry.message);
+    }
+    for (const { message, variant } of settlingMessages.values()) {
+      push(message, buildSteerSettleFailure(message, { variant, agentLabel: SETTLE_AGENT_LABEL }));
+    }
     return entries;
   }
 
   async function dispose() {
     disposed = true;
     stopLifecycleTimer();
+    if (queueLaneTimer) {
+      clearTimeout(queueLaneTimer);
+      queueLaneTimer = null;
+    }
     // A question card left `pending` would sit in the UI inviting an answer
     // that nothing is left to read. Time them out before the socket goes.
     await questionBridge.cancelPendingQuestions?.().catch?.(() => {});
@@ -2145,6 +3960,18 @@ export function createCopilotSdkSessionRunner({
     handlePendingPayload,
     getActiveQueueMessageId,
     getActiveQueueMessageIds,
+    // The delivery gate (the socket link's probes) and the composer snapshot
+    // (the heartbeat's).
+    canAcceptSteering,
+    isDeliveryHeld,
+    steeringState,
+    getSettleFailed,
+    acknowledgeSettleFailed,
+    cancelPushedMessage,
+    // The task panel's per-card Stop (`rpc.tasks.cancel`); also what a
+    // subagent lane's Stop tries — the runtime tracks sync agents in the same
+    // registry and refuses ids it does not know.
+    stopBackgroundTask,
     // "Active" spans both ownerships: a settled turn still publishing must
     // keep the worker's idle/shutdown gates closed just like a running one.
     isTurnActive: () => !!activeTurn || publishingTurns.size > 0,
@@ -2157,6 +3984,14 @@ export function createCopilotSdkSessionRunner({
     whenUsagePosted: () => usagePostChain,
     // The in-flight model-catalog snapshot POST — the same kind of seam.
     whenModelSnapshotPosted: () => modelSnapshotChain,
+    // The in-flight queued-lane read — same kind of seam.
+    whenQueueLaneRefreshed: () => queueLaneRefreshChain,
+    // The in-flight `rpc.tasks.list()` re-read — same kind of seam. A refresh
+    // that is still debounced counts too, so a caller sees the registry read
+    // that the last event scheduled.
+    whenTasksRefreshed: () => (taskRefreshTimer
+      ? new Promise((resolve) => { setTimeout(resolve, taskRefreshMs + 5); }).then(() => taskRefreshChain)
+      : taskRefreshChain),
     // Test seams / observability.
     _getState: () => ({
       hasClient: !!client,
@@ -2171,7 +4006,23 @@ export function createCopilotSdkSessionRunner({
       // Settled turns whose relay publishes have not all landed yet.
       publishingTurnCount: publishingTurns.size,
       backgroundShells: backgroundShells.live(),
+      backgroundTasks: sessionRpc.tasks ? registryCards() : shellTrackerCards(),
       continuationDueSince,
+      compacting: isCompacting(),
+      pendingHumanRequests,
+      pendingRelayToolCalls,
+      sessionRpc: { ...sessionRpc },
+      activeEntries: activeTurn
+        ? activeTurn.entries.map((entry) => ({
+            id: entry.message?.id || null,
+            role: entry.role,
+            runtimeId: entry.runtimeId,
+            consumed: entry.consumed,
+            delivery: entry.delivery,
+            settled: entry.settled,
+            foldedInto: entry.foldedInto?.message?.id || null,
+          }))
+        : [],
     }),
     _evaluateLifecycle: evaluateLifecycle,
   };