@open-mercato/cezar 0.9.3 → 0.10.0-pr892.1298

package/dist/runs/run-index.d.ts

@@ -0,0 +1,19 @@
+import { type RunRecord } from './store.ts';
+/**
+ * The READ-ONLY half of `runs.json`, for the workspace-level run index (`GET
+ * /workspace/runs-index`) — the one place that must read a project's runs WITHOUT owning it.
+ *
+ * `RunStore.open` cannot be used here and the reason is the whole point of this module. Opening a
+ * store `mkdir`s `<dataDir>/runs/`, and the caller that opens one goes on to build a
+ * `ProjectContext` — which prunes orphan worktrees and calls `manager.recover()`, resuming
+ * interrupted runs. Building the workspace index must never do any of that: answering "which
+ * tasks exist" would restart agents across every registered project, and typing into a search box
+ * would spend tokens. Cold projects are precisely the ones the index exists to reach, so
+ * `contexts.peek()` (which returns nothing for them) is not an answer either.
+ *
+ * What this does share with the store is the schema and `reconcileLoadedRun`, so a `running` row
+ * left behind by a crashed process reads as interrupted here exactly as it would once the project
+ * were opened for real. A second, subtly different parse of that field would show a task as
+ * running in the palette and failed the moment you clicked it.
+ */
+export declare function readRunIndexFromDisk(dataDir: string): RunRecord[];

package/dist/runs/run-index.js

@@ -0,0 +1,43 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { reconcileLoadedRun, runRecordSchema } from './store.js';
+/**
+ * The READ-ONLY half of `runs.json`, for the workspace-level run index (`GET
+ * /workspace/runs-index`) — the one place that must read a project's runs WITHOUT owning it.
+ *
+ * `RunStore.open` cannot be used here and the reason is the whole point of this module. Opening a
+ * store `mkdir`s `<dataDir>/runs/`, and the caller that opens one goes on to build a
+ * `ProjectContext` — which prunes orphan worktrees and calls `manager.recover()`, resuming
+ * interrupted runs. Building the workspace index must never do any of that: answering "which
+ * tasks exist" would restart agents across every registered project, and typing into a search box
+ * would spend tokens. Cold projects are precisely the ones the index exists to reach, so
+ * `contexts.peek()` (which returns nothing for them) is not an answer either.
+ *
+ * What this does share with the store is the schema and `reconcileLoadedRun`, so a `running` row
+ * left behind by a crashed process reads as interrupted here exactly as it would once the project
+ * were opened for real. A second, subtly different parse of that field would show a task as
+ * running in the palette and failed the moment you clicked it.
+ */
+export function readRunIndexFromDisk(dataDir) {
+    const indexPath = join(dataDir, 'runs.json');
+    if (!existsSync(indexPath))
+        return [];
+    try {
+        const raw = JSON.parse(readFileSync(indexPath, 'utf8'));
+        const parsed = z.array(runRecordSchema).safeParse(raw);
+        if (!parsed.success)
+            return [];
+        // `reconcileLoadedRun` mutates, which is safe here in a way it is not in the store: these
+        // records were just parsed into fresh objects that nothing else holds a reference to.
+        // Never `keepLive` — this reader has no RunManager, so there is nothing to recover into.
+        return parsed.data.map((run) => reconcileLoadedRun(run));
+    }
+    catch {
+        // Corrupt or unreadable index. A project that cannot be read contributes nothing to the
+        // index rather than failing the whole workspace's search — the same degrade-quietly rule
+        // the rest of the registry follows.
+        return [];
+    }
+}
+//# sourceMappingURL=run-index.js.map

package/dist/runs/run-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-index.js","sourceRoot":"","sources":["../../src/runs/run-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAkB,MAAM,YAAY,CAAC;AAEjF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAC/B,0FAA0F;QAC1F,sFAAsF;QACtF,yFAAyF;QACzF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;QACxF,yFAAyF;QACzF,oCAAoC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/runs/store.d.ts

@@ -1,5 +1,6 @@
 import { EventEmitter } from 'node:events';
 import { z } from 'zod';
+import type { RunnerId } from '../core/agent-runner.ts';
 export type RunStatus = 'queued' | 'running' | 'waiting' | 'review' | 'done' | 'failed' | 'cancelled';
 /**
  * A sub-state of `running` (spec 2026-07-18-subagent-monitoring-status, #490):
@@ -40,11 +41,14 @@ declare const stepStateSchema: z.ZodObject<{
     finishedAt: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
-    backend: z.ZodOptional<z.ZodEnum<{
+    backend: z.ZodOptional<z.ZodPipe<z.ZodEnum<{
         claude: "claude";
+        "claude-cli": "claude-cli";
         codex: "codex";
         opencode: "opencode";
-    }>>;
+        pi: "pi";
+    }>, z.ZodTransform<"claude" | "codex" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "opencode" | "pi">>>;
+    profileId: z.ZodOptional<z.ZodString>;
     costUsd: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /** One prompt message stacked onto a run while it waits for a free agent slot
@@ -57,7 +61,9 @@ declare const queuedMessageSchema: z.ZodObject<{
     images: z.ZodOptional<z.ZodArray<z.ZodString>>;
     createdAt: z.ZodString;
 }, z.core.$strip>;
-declare const runRecordSchema: z.ZodObject<{
+/** Exported for `./run-index.ts`, the read-only reader of the same file. Nothing else should
+ *  parse `runs.json` — see `reconcileLoadedRun` for why a second parser is a correctness risk. */
+export declare const runRecordSchema: z.ZodObject<{
     id: z.ZodString;
     title: z.ZodString;
     titleSummary: z.ZodOptional<z.ZodString>;
@@ -78,11 +84,14 @@ declare const runRecordSchema: z.ZodObject<{
     taskImages: z.ZodOptional<z.ZodArray<z.ZodString>>;
     model: z.ZodOptional<z.ZodString>;
     modelIdentity: z.ZodOptional<z.ZodString>;
-    runner: z.ZodOptional<z.ZodEnum<{
+    runner: z.ZodOptional<z.ZodPipe<z.ZodEnum<{
         claude: "claude";
+        "claude-cli": "claude-cli";
         codex: "codex";
         opencode: "opencode";
-    }>>;
+        pi: "pi";
+    }>, z.ZodTransform<"claude" | "codex" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "opencode" | "pi">>>;
+    agentProfile: z.ZodOptional<z.ZodString>;
     systemPrompt: z.ZodOptional<z.ZodString>;
     generateFollowups: z.ZodOptional<z.ZodBoolean>;
     autonomous: z.ZodOptional<z.ZodBoolean>;
@@ -107,6 +116,8 @@ declare const runRecordSchema: z.ZodObject<{
     }>>;
     monitoringWakeAt: z.ZodCatch<z.ZodOptional<z.ZodString>>;
     monitoringWakeCapReached: z.ZodOptional<z.ZodBoolean>;
+    autoResumeAt: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+    autoResumeAttempts: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
     createdAt: z.ZodString;
     startedAt: z.ZodOptional<z.ZodString>;
     finishedAt: z.ZodOptional<z.ZodString>;
@@ -175,11 +186,14 @@ declare const runRecordSchema: z.ZodObject<{
         finishedAt: z.ZodOptional<z.ZodString>;
         error: z.ZodOptional<z.ZodString>;
         sessionId: z.ZodOptional<z.ZodString>;
-        backend: z.ZodOptional<z.ZodEnum<{
+        backend: z.ZodOptional<z.ZodPipe<z.ZodEnum<{
             claude: "claude";
+            "claude-cli": "claude-cli";
             codex: "codex";
             opencode: "opencode";
-        }>>;
+            pi: "pi";
+        }>, z.ZodTransform<"claude" | "codex" | "opencode" | "pi", "claude" | "claude-cli" | "codex" | "opencode" | "pi">>>;
+        profileId: z.ZodOptional<z.ZodString>;
         costUsd: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
     workflowDef: z.ZodCatch<z.ZodOptional<z.ZodObject<{
@@ -195,6 +209,7 @@ declare const runRecordSchema: z.ZodObject<{
                 claude: "claude";
                 codex: "codex";
                 opencode: "opencode";
+                pi: "pi";
             }>>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -222,6 +237,22 @@ export interface RunEvent {
     type: string;
     [key: string]: unknown;
 }
+/**
+ * Reconcile one record just read off disk with the fact that whichever process wrote it is gone.
+ *
+ * Mutates and returns `run`. Extracted from `RunStore.open` so the read-only index reader
+ * (`./run-index.ts`) answers the SAME question about a `running` row on disk. Two parsers that
+ * disagree here is a visible bug, not an internal one: the cockpit would show a task as running
+ * in the ⌘K index and failed the moment you opened it.
+ *
+ * `keepLive` (#367): leave `queued`/`running`/`waiting` untouched so the caller can recover them
+ * (RunManager.recover re-queues queued runs, resumes interrupted ones). Without it — one-shot CLI
+ * paths that never recover, and the index reader, which has no manager at all — live-looking runs
+ * are marked failed so no ghost stays behind.
+ */
+export declare function reconcileLoadedRun(run: RunRecord, opts?: {
+    keepLive?: boolean;
+}): RunRecord;
 /**
  * File-backed run store: `runs.json` index (atomic tmp+rename writes, the
  * pattern from @cezar/core's IssueStore) plus one append-only NDJSON event
@@ -233,12 +264,7 @@ export declare class RunStore extends EventEmitter {
     private runs;
     private saveTimer;
     private constructor();
-    /**
-     * `keepLive` (#367): leave `queued`/`running`/`waiting` statuses untouched
-     * so the caller can recover them (RunManager.recover re-queues queued runs,
-     * resumes interrupted ones). Without it — one-shot CLI paths that never
-     * recover — live-looking runs are marked failed so no ghost stays behind.
-     */
+    /** See `reconcileLoadedRun` for what `keepLive` (#367) decides about live-looking rows. */
     static open(dataDir: string, opts?: {
         keepLive?: boolean;
     }): RunStore;
@@ -249,7 +275,9 @@ export declare class RunStore extends EventEmitter {
         workflow: string;
         task: string;
         model?: string;
-        runner?: 'claude' | 'codex' | 'opencode';
+        runner?: RunnerId;
+        /** Composer's per-task agent account (spec 2026-07-29-agent-profiles). */
+        agentProfile?: string;
         generateFollowups?: boolean;
         autonomous?: boolean;
         worktree?: false;
@@ -292,13 +320,44 @@ export declare class RunStore extends EventEmitter {
      *  updated record rides the existing `run` SSE with no new event. Idempotent by
      *  design: opening an already-read thread just re-stamps a later `seenAt`. */
     setRead(id: string): RunRecord | undefined;
+    /** Mark one run as UNread (#775): drop the read receipt so the run rejoins the unread
+     *  list. The inverse of `setRead` and, like it, `touch`es so the updated record rides the
+     *  existing `run` SSE.
+     *
+     *  Deleting the field rather than adding a "manually unread" flag is the whole point:
+     *  absent `seenAt` is ALREADY what every reader treats as unread (`isUnread` in the
+     *  cockpit's read-state.ts, and `markAllRead`'s clause-for-clause copy of it below), so
+     *  clearing needs no new state and writes a shape any older cezar already parses.
+     *
+     *  Deliberately unconditional: clearing a receipt is always a legal write, so this
+     *  succeeds for an already-unread run (idempotent) and for statuses that can never wear
+     *  the marker. WHETHER the action means anything for a given run is UI policy, and lives
+     *  in the cockpit's `runActionFlags` — the same split the rest of the store keeps. */
+    setUnread(id: string): RunRecord | undefined;
     /** Bulk mark-read: stamp every currently-unread finished run; returns the count.
      *  "Unread" here is the same rule the cockpit paints (`isUnread` in read-state.ts),
-     *  clause for clause: a `done` or `failed` run that finished and has not been seen
-     *  since. Cancelled runs are never unread — you stopped them yourself — and archived
-     *  ones never are either, since archiving is a stronger "done with this" than reading;
-     *  both are skipped, as are runs already read. Keeping the two rules identical is what
-     *  makes the returned count the number the cockpit's unread badge was showing. */
+     *  clause for clause:
+     *   - a `done` or `failed` run that finished and has not been seen since;
+     *   - cancelled runs are never unread — you stopped them yourself;
+     *   - archived ones never are either, since archiving is a stronger "done with this"
+     *     than reading;
+     *   - and a `failed` run with a pending `autoResumeAt` is not a done item AT ALL
+     *     (`isScheduledResume`, spec 2026-08-03-auto-resume-after-usage-limit): it has an
+     *     appointment to pick the work back up, so there is no outcome to have missed.
+     *
+     *  Keeping the two rules identical is what makes the returned count the number the
+     *  cockpit's unread badge was showing. The `autoResumeAt` clause is the one that drifted
+     *  (#803): `isUnread` gained it with auto-resume and this sweep did not, so a task waiting
+     *  out a usage limit was uncounted by the badge but stamped read by the sweep — and this
+     *  comment asserted an invariant the code no longer held.
+     *
+     *  This rule lives in two languages of the same repo, which is why it has now drifted
+     *  once. The cockpit cannot import it (`packages/web` does not depend on the service, and
+     *  should not), so a single definition would have to move to `packages/contract` — the one
+     *  package both sides already import. Worth doing; deliberately not done here, because
+     *  widening the contract package's remit from "shapes" to "behavior" is a design change
+     *  that deserves its own review rather than riding along in a bug fix. Until then: EDIT
+     *  BOTH, and the case-table tests on either side are what catch you if you don't. */
     markAllRead(): number;
     appendEvent(runId: string, event: {
         type: string;

package/dist/runs/store.js

@@ -6,7 +6,31 @@ import { z } from 'zod';
 import { collectSecretValues, redactDeep, redactSecrets } from '../core/secret-redaction.js';
 // Type-only module (zod + nothing else), so this cannot cycle back into the store.
 import { workflowDefSchema } from '../workflows/types.js';
+import { RUNNER_IDS } from '../core/agent-runner.js';
 const usageCounterSchema = z.number().finite().nonnegative();
+/**
+ * A runner id as it may appear in a PERSISTED record, normalized to the three
+ * ids the rest of cezar speaks (#547).
+ *
+ * `claude-cli` is the legacy spelling of `claude` — still a member of
+ * `AgentBackend` and still accepted by `createRunner`, and named by
+ * `BACKWARD_COMPATIBILITY.md` §3 as an id `runs.json` keeps parseable. The enum
+ * here did not accept it, so that promise was false: the loader `safeParse`s the
+ * WHOLE array, so one record carrying it would have dropped every run in the
+ * file — the exact failure mode §3 exists to warn about.
+ *
+ * Parse-and-fold rather than widen: the legacy id is accepted on the way in and
+ * collapsed to `claude`, so no consumer, wire type or contract schema ever sees
+ * a fourth runner. The narrowing is one-way and permanent (the index is
+ * re-serialized from the parsed records), which is what "old run records
+ * normalise identically to `claude`" in `core/model-identity.ts` has always
+ * claimed. Use ONLY for read-back of stored state — request bodies, settings and
+ * workflow step defs stay the three selectable ids (`RunnerId`), because nothing
+ * should be able to ASK for the legacy spelling.
+ */
+const storedRunnerSchema = z
+    .enum([...RUNNER_IDS, 'claude-cli'])
+    .transform((id) => (id === 'claude-cli' ? 'claude' : id));
 const stepStateSchema = z.object({
     id: z.string(),
     name: z.string(),
@@ -26,8 +50,15 @@ const stepStateSchema = z.object({
     error: z.string().optional(),
     /** Latest backend-owned session id, used for same-backend Continue. */
     sessionId: z.string().optional(),
-    /** Backend that owns `sessionId`. Optional so pre-affinity runs.json files still parse. */
-    backend: z.enum(['claude', 'codex', 'opencode']).optional(),
+    /** Backend that owns `sessionId`. Optional so pre-affinity runs.json files still parse;
+     *  `storedRunnerSchema` so a legacy `claude-cli` folds to `claude` instead of failing (#547). */
+    backend: storedRunnerSchema.optional(),
+    /** Agent profile (account) this step actually spawned under — `default`, or a stored profile
+     *  id (spec 2026-07-29-agent-profiles). Recorded rather than re-derived because a session id
+     *  only means something inside the config dir that created it: `sessionId` and `profileId` are
+     *  a PAIR. Without it, changing the project's account would silently make Continue resume
+     *  against the wrong account's session store. Absent = the discovered default. */
+    profileId: z.string().optional(),
     /** Dollar cost reported by the claude CLI for this step's turns. */
     costUsd: z.number().optional(),
 });
@@ -42,7 +73,9 @@ const queuedMessageSchema = z.object({
     images: z.array(z.string()).optional(),
     createdAt: z.string(),
 });
-const runRecordSchema = z.object({
+/** Exported for `./run-index.ts`, the read-only reader of the same file. Nothing else should
+ *  parse `runs.json` — see `reconcileLoadedRun` for why a second parser is a correctness risk. */
+export const runRecordSchema = z.object({
     id: z.string(),
     title: z.string(),
     /** Display title (#389): the auto-derived summary of the first agent turn,
@@ -80,10 +113,20 @@ const runRecordSchema = z.object({
      *  (e.g. `anthropic/claude-opus-4-8`) the run actually used, resolved from the
      *  free-text `model` against the chosen runner. Additive and optional: pre-#405
      *  records carry only `model`, and it stays the human/hand-edit surface; this
-     *  is the parseable identity cost attribution and reproducible replay key off. */
+     *  is the parseable identity cost attribution and reproducible replay key off.
+     *
+     *  Read in production by the session header's agent badge (#546), which shows it
+     *  whenever it says something `model` does not — so this is no longer a
+     *  write-only field whose next reader has to guess whether it is load-bearing. */
     modelIdentity: z.string().optional(),
-    /** Agent backend this run used — drives "open in CLI" resume command. */
-    runner: z.enum(['claude', 'codex', 'opencode']).optional(),
+    /** Agent backend this run used — drives "open in CLI" resume command. `storedRunnerSchema`
+     *  so a legacy `claude-cli` record folds to `claude` instead of failing the whole index (#547). */
+    runner: storedRunnerSchema.optional(),
+    /** Per-task agent-account override from the composer (spec 2026-07-29-agent-profiles), applying
+     *  to steps that run on `runner`. Steps on a DIFFERENT backend still resolve from the project's
+     *  own selection — an override for Claude says nothing about which Codex account a mixed
+     *  workflow's codex step should use. Absent = follow the project. */
+    agentProfile: z.string().optional(),
     /** Echo of the extra system prompt this run actually used (R2): the
      *  `POST /api/runs` override, or the `config.json` default it fell back to.
      *  Deliberately NOT the full composed prompt — skill bodies and the handoff
@@ -118,6 +161,17 @@ const runRecordSchema = z.object({
     monitoringWakeAt: z.string().datetime().optional().catch(undefined),
     /** True only for the live epoch that exhausted all automatic monitoring checks. */
     monitoringWakeCapReached: z.boolean().optional(),
+    /**
+     * Exact deadline at which a run stopped by a provider USAGE LIMIT resumes itself
+     * (spec 2026-08-03-auto-resume-after-usage-limit) — the reset instant the provider named plus a
+     * short grace. Present only while such a resume is pending: the run is `failed`, the timer is
+     * armed, and the cockpit says so. Deliberately survives a restart (`RunStore.open` keeps it) —
+     * it is what lets `recover()` re-arm a wait that may be hours long.
+     */
+    autoResumeAt: z.string().datetime().optional().catch(undefined),
+    /** Consecutive automatic resumes since the last human turn — the safety cap's counter.
+     *  Persisted so a restart cannot reset a loop back to zero. */
+    autoResumeAttempts: z.number().int().min(0).optional().catch(undefined),
     createdAt: z.string(),
     startedAt: z.string().optional(),
     finishedAt: z.string().optional(),
@@ -191,7 +245,8 @@ const runRecordSchema = z.object({
     /** Read receipt (#unread-done-items): the ISO time the cockpit last opened this
      *  run's thread. A finished run reads as "unread" until it has been seen since it
      *  finished — see `isUnread()` in the cockpit's `lib/read-state.ts`. Absent on old
-     *  runs and on every run not yet opened, which the unread rule treats as unread. */
+     *  runs, on every run not yet opened, and on one `setUnread` put back to unread
+     *  (#775) — the unread rule treats all three alike. */
     seenAt: z.string().optional(),
     currentStepId: z.string().optional(),
     error: z.string().optional(),
@@ -235,6 +290,19 @@ const MAX_PR_CANDIDATES = 8;
  * invisible to the janitor, #407). Reasoning items are skipped: thinking text
  * speculates about PRs the task never touches.
  */
+/**
+ * Archiving IS resigning from a task, so an archived run can never carry a pending usage-limit
+ * resume (spec 2026-08-03-auto-resume-after-usage-limit). The rule lives HERE rather than in the
+ * archive route because the bulk "Archive finished" sweep never goes through that route, and a
+ * user who archives fifty finished tasks has resigned from all fifty.
+ *
+ * The engine needs no telling: its timer re-reads the record before it fires and no sweep re-arms
+ * an archived run, so a cleared field is the whole cancellation.
+ */
+function clearPendingAutoResume(run) {
+    run.autoResumeAt = undefined;
+    run.autoResumeAttempts = undefined;
+}
 function eventTextFragments(event) {
     const fragments = [];
     for (const key of ['text', 'result', 'message']) {
@@ -326,6 +394,49 @@ function createdPrUrl(haystack) {
     }
     return before;
 }
+/**
+ * Reconcile one record just read off disk with the fact that whichever process wrote it is gone.
+ *
+ * Mutates and returns `run`. Extracted from `RunStore.open` so the read-only index reader
+ * (`./run-index.ts`) answers the SAME question about a `running` row on disk. Two parsers that
+ * disagree here is a visible bug, not an internal one: the cockpit would show a task as running
+ * in the ⌘K index and failed the moment you opened it.
+ *
+ * `keepLive` (#367): leave `queued`/`running`/`waiting` untouched so the caller can recover them
+ * (RunManager.recover re-queues queued runs, resumes interrupted ones). Without it — one-shot CLI
+ * paths that never recover, and the index reader, which has no manager at all — live-looking runs
+ * are marked failed so no ghost stays behind.
+ */
+export function reconcileLoadedRun(run, opts) {
+    // A run that was live when the previous process exited can never finish —
+    // surface that instead of a forever-"running" ghost. `review` survives
+    // restarts on purpose: the gate is pure data (worktree + branch + record)
+    // with no live process, so the diff panel, Send back (resume) and Draft PR
+    // all still work.
+    if (!opts?.keepLive &&
+        (run.status === 'running' || run.status === 'queued' || run.status === 'waiting')) {
+        run.status = 'failed';
+        run.error = 'interrupted — cezar process exited during the run';
+        run.finishedAt = run.finishedAt ?? new Date().toISOString();
+        for (const step of run.steps) {
+            if (step.status === 'running' || step.status === 'waiting')
+                step.status = 'failed';
+        }
+    }
+    if (!['running', 'waiting', 'queued'].includes(run.status)) {
+        run.activity = undefined;
+        run.monitoringWakeAt = undefined;
+    }
+    // A pending usage-limit resume survives the restart on purpose (the wait can be
+    // hours) — `RunManager.recover()` re-arms it from this field. It can only mean
+    // anything on a `failed` run, so anywhere else it is stale bookkeeping.
+    if (run.status !== 'failed')
+        run.autoResumeAt = undefined;
+    // The wake counter is intentionally process-local, so a restarted process
+    // starts a fresh epoch instead of displaying a stale cap.
+    run.monitoringWakeCapReached = undefined;
+    return run;
+}
 /**
  * File-backed run store: `runs.json` index (atomic tmp+rename writes, the
  * pattern from @cezar/core's IssueStore) plus one append-only NDJSON event
@@ -341,12 +452,7 @@ export class RunStore extends EventEmitter {
         this.dataDir = dataDir;
         this.setMaxListeners(100);
     }
-    /**
-     * `keepLive` (#367): leave `queued`/`running`/`waiting` statuses untouched
-     * so the caller can recover them (RunManager.recover re-queues queued runs,
-     * resumes interrupted ones). Without it — one-shot CLI paths that never
-     * recover — live-looking runs are marked failed so no ghost stays behind.
-     */
+    /** See `reconcileLoadedRun` for what `keepLive` (#367) decides about live-looking rows. */
     static open(dataDir, opts) {
         mkdirSync(join(dataDir, 'runs'), { recursive: true });
         const store = new RunStore(dataDir);
@@ -357,31 +463,7 @@ export class RunStore extends EventEmitter {
                 const parsed = z.array(runRecordSchema).safeParse(raw);
                 if (parsed.success) {
                     for (const run of parsed.data) {
-                        // A run that was live when the previous process exited can never
-                        // finish — surface that instead of a forever-"running" ghost.
-                        // `review` survives restarts on purpose: the gate is pure data
-                        // (worktree + branch + record) with no live process, so the diff
-                        // panel, Send back (resume) and Draft PR all still work.
-                        if (!opts?.keepLive &&
-                            (run.status === 'running' ||
-                                run.status === 'queued' ||
-                                run.status === 'waiting')) {
-                            run.status = 'failed';
-                            run.error = 'interrupted — cezar process exited during the run';
-                            run.finishedAt = run.finishedAt ?? new Date().toISOString();
-                            for (const step of run.steps) {
-                                if (step.status === 'running' || step.status === 'waiting')
-                                    step.status = 'failed';
-                            }
-                        }
-                        if (!['running', 'waiting', 'queued'].includes(run.status)) {
-                            run.activity = undefined;
-                            run.monitoringWakeAt = undefined;
-                        }
-                        // The wake counter is intentionally process-local, so a restarted
-                        // process starts a fresh epoch instead of displaying a stale cap.
-                        run.monitoringWakeCapReached = undefined;
-                        store.runs.set(run.id, run);
+                        store.runs.set(run.id, reconcileLoadedRun(run, opts));
                     }
                 }
             }
@@ -411,6 +493,7 @@ export class RunStore extends EventEmitter {
             task: input.task,
             model: input.model,
             runner: input.runner,
+            agentProfile: input.agentProfile,
             generateFollowups: input.generateFollowups,
             autonomous: input.autonomous,
             worktree: input.worktree,
@@ -450,6 +533,13 @@ export class RunStore extends EventEmitter {
             normalized.monitoringWakeAt = undefined;
             normalized.monitoringWakeCapReached = undefined;
         }
+        // …and the mirror image for the usage-limit resume (spec
+        // 2026-08-03-auto-resume-after-usage-limit): it is a promise made ABOUT a failed run, so a
+        // run coming back to life — the resume itself, a user Continue, a re-queue — retires it.
+        // The manager's timer re-checks the record before it fires, so a cleared field is enough.
+        if (normalized.status && ['running', 'waiting', 'queued'].includes(normalized.status)) {
+            normalized.autoResumeAt = undefined;
+        }
         Object.assign(run, this.redactPatch(normalized));
         this.touch(run);
         return run;
@@ -536,6 +626,8 @@ export class RunStore extends EventEmitter {
             return undefined;
         run.archived = archived;
         run.archivedAt = archived ? new Date().toISOString() : undefined;
+        if (archived)
+            clearPendingAutoResume(run);
         this.touch(run);
         return run;
     }
@@ -546,6 +638,7 @@ export class RunStore extends EventEmitter {
             if (!run.archived && ['done', 'failed', 'cancelled'].includes(run.status)) {
                 run.archived = true;
                 run.archivedAt = new Date().toISOString();
+                clearPendingAutoResume(run);
                 this.touch(run);
                 count++;
             }
@@ -564,19 +657,58 @@ export class RunStore extends EventEmitter {
         this.touch(run);
         return run;
     }
+    /** Mark one run as UNread (#775): drop the read receipt so the run rejoins the unread
+     *  list. The inverse of `setRead` and, like it, `touch`es so the updated record rides the
+     *  existing `run` SSE.
+     *
+     *  Deleting the field rather than adding a "manually unread" flag is the whole point:
+     *  absent `seenAt` is ALREADY what every reader treats as unread (`isUnread` in the
+     *  cockpit's read-state.ts, and `markAllRead`'s clause-for-clause copy of it below), so
+     *  clearing needs no new state and writes a shape any older cezar already parses.
+     *
+     *  Deliberately unconditional: clearing a receipt is always a legal write, so this
+     *  succeeds for an already-unread run (idempotent) and for statuses that can never wear
+     *  the marker. WHETHER the action means anything for a given run is UI policy, and lives
+     *  in the cockpit's `runActionFlags` — the same split the rest of the store keeps. */
+    setUnread(id) {
+        const run = this.runs.get(id);
+        if (!run)
+            return undefined;
+        delete run.seenAt;
+        this.touch(run);
+        return run;
+    }
     /** Bulk mark-read: stamp every currently-unread finished run; returns the count.
      *  "Unread" here is the same rule the cockpit paints (`isUnread` in read-state.ts),
-     *  clause for clause: a `done` or `failed` run that finished and has not been seen
-     *  since. Cancelled runs are never unread — you stopped them yourself — and archived
-     *  ones never are either, since archiving is a stronger "done with this" than reading;
-     *  both are skipped, as are runs already read. Keeping the two rules identical is what
-     *  makes the returned count the number the cockpit's unread badge was showing. */
+     *  clause for clause:
+     *   - a `done` or `failed` run that finished and has not been seen since;
+     *   - cancelled runs are never unread — you stopped them yourself;
+     *   - archived ones never are either, since archiving is a stronger "done with this"
+     *     than reading;
+     *   - and a `failed` run with a pending `autoResumeAt` is not a done item AT ALL
+     *     (`isScheduledResume`, spec 2026-08-03-auto-resume-after-usage-limit): it has an
+     *     appointment to pick the work back up, so there is no outcome to have missed.
+     *
+     *  Keeping the two rules identical is what makes the returned count the number the
+     *  cockpit's unread badge was showing. The `autoResumeAt` clause is the one that drifted
+     *  (#803): `isUnread` gained it with auto-resume and this sweep did not, so a task waiting
+     *  out a usage limit was uncounted by the badge but stamped read by the sweep — and this
+     *  comment asserted an invariant the code no longer held.
+     *
+     *  This rule lives in two languages of the same repo, which is why it has now drifted
+     *  once. The cockpit cannot import it (`packages/web` does not depend on the service, and
+     *  should not), so a single definition would have to move to `packages/contract` — the one
+     *  package both sides already import. Worth doing; deliberately not done here, because
+     *  widening the contract package's remit from "shapes" to "behavior" is a design change
+     *  that deserves its own review rather than riding along in a bug fix. Until then: EDIT
+     *  BOTH, and the case-table tests on either side are what catch you if you don't. */
     markAllRead() {
         const now = new Date().toISOString();
         let count = 0;
         for (const run of this.runs.values()) {
             const unread = !run.archived &&
                 (run.status === 'done' || run.status === 'failed') &&
+                !(run.status === 'failed' && run.autoResumeAt !== undefined) &&
                 run.finishedAt !== undefined &&
                 (run.seenAt === undefined || run.seenAt < run.finishedAt);
             if (!unread)