@ordewell/core 0.10.3 → 0.10.5

package/dist/index.mjs

@@ -2,7 +2,7 @@ import {
   looksLikePlanAttempt,
   parsePlanJson,
   validatePlanTasks
-} from "./chunk-645FALZX.mjs";
+} from "./chunk-F3KIX7WR.mjs";
 import {
   ACT_RISK,
   AUTORUN_RISK,
@@ -19,6 +19,9 @@ import {
   addUsage,
   addUsageTotals,
   aheadOfDraft,
+  assignmentConsequence,
+  assignmentIssue,
+  assignmentIssueText,
   automergeSummary,
   autorunSummary,
   blockingFailures,
@@ -26,6 +29,7 @@ import {
   capConflictFiles,
   classifyOutcome,
   continuability,
+  countedSessionCost,
   dependentsNotice,
   diffRows,
   diffStat,
@@ -60,11 +64,13 @@ import {
   reduceRun,
   reduceTaskLog,
   replayTaskLog,
+  resumedSessionWindow,
   runnerToolSubject,
   sameMessage,
   serializePlan,
   serializeTask,
   serializeTaskStatus,
+  sessionOwner,
   skillLoadNotice,
   startAttemptUsage,
   stopTurn,
@@ -78,13 +84,14 @@ import {
   taskRowActions,
   taskRowView,
   taskStartedNotice,
+  taskUsageSummary,
   titledRefs,
   toolHeadline,
   truncateCheckpointSummary,
   unsendAll,
   unsendLatest,
   usageLine
-} from "./chunk-FH6M5QZG.mjs";
+} from "./chunk-6LEA6WAM.mjs";
 import {
   NOT_STARTED,
   PLAN_ENVELOPE_KEY,
@@ -111,6 +118,7 @@ import {
   extractObjectsWithKey,
   filterModelsForPrompt,
   isTaskRunning,
+  liveRunnerRefusal,
   opensWithJsonObject,
   parseAutonomyLevel,
   parseTaskOpsJson,
@@ -130,7 +138,7 @@ import {
   unavailableModeReason,
   unavailableTaskModeMessage,
   validateTaskEdit
-} from "./chunk-A57ITQE7.mjs";
+} from "./chunk-4QLFM73A.mjs";
 import {
   SELF_REPO,
   absorbRemoval,
@@ -144,7 +152,7 @@ import {
   noRemoval,
   repoRootOf,
   taskIsolationOf
-} from "./chunk-OYUSADFM.mjs";
+} from "./chunk-NJGID6BG.mjs";
 import {
   DEFAULT_RUNNERS,
   addTaskToPlan,
@@ -176,7 +184,7 @@ import {
   updateTaskInPlan,
   waitsForApproval,
   waitsForReset
-} from "./chunk-SM6BV6XS.mjs";
+} from "./chunk-RT4NQ2BZ.mjs";
 
 // src/models/TaskLog.ts
 var HEAD_LINES = 60;
@@ -278,6 +286,9 @@ function toTaskLogEvent(event) {
       };
     case "command_output":
       return { type: "command_output", text: event.text };
+    // Logged once the plan's write-back settles: see `TaskLogRecorder.note`.
+    case "model_switched":
+    case "model_drifted":
     case "background_agent":
       return null;
   }
@@ -4729,8 +4740,8 @@ function forms(text) {
 function sensitiveEnvValues(env) {
   return Object.entries(env).filter(([name, value]) => SENSITIVE_ENV_NAME.test(name) && !/_(?:URL|URI|PATH|FILE|DIR)$/i.test(name) && value !== void 0).map(([, value]) => (value ?? "").trim());
 }
-function carriesSecret(texts, held) {
-  const secrets = [...held].map((s) => s.trim()).filter((s) => s.length >= MIN_SECRET_LENGTH);
+function carriesSecret(texts, held2) {
+  const secrets = [...held2].map((s) => s.trim()).filter((s) => s.length >= MIN_SECRET_LENGTH);
   return texts.flatMap(forms).some((text) => secrets.some((secret) => text.includes(secret)) || TOKEN_SHAPES.some((shape) => shape.test(text)) || [...text.matchAll(SK_KEY)].some((m) => looksRandom(m[0].slice(3))));
 }
 
@@ -6406,7 +6417,7 @@ var CODEX_MANIFEST = {
     }
   },
   modelDiscovery: {
-    // Codex has no `codex models` subcommand (see docs/adr/0004). Discovery
+    // Codex has no `codex models` subcommand (see ADR-0004). Discovery
     // tries three sources in order, each falling through to the next:
     //
     // 1. `codex app-server` stdio JSON-RPC (`initialize` → `model/list`) —
@@ -6477,6 +6488,10 @@ function parseOpenCodeModels(stdout, manifest) {
   }
   return models;
 }
+function contextLimit(limit) {
+  const context = limit?.context;
+  return typeof context === "number" && Number.isFinite(context) && context > 0 ? { contextWindow: context } : {};
+}
 function parseOpenCodeModelsVerbose(stdout, manifest) {
   const normalized2 = stdout.endsWith("\n") ? stdout : stdout + "\n";
   const parts = normalized2.split(/^([A-Za-z0-9._-]+\/[^\s"{}]+)\n/m);
@@ -6492,12 +6507,14 @@ function parseOpenCodeModelsVerbose(stdout, manifest) {
     const jsonText = parts[i + 1].trim();
     if (seen.has(fullId)) continue;
     let variantIds = [];
+    let window = {};
     let modelLabel = prefLabels.get(fullId) || fullId.split("/").pop() || fullId;
     const runnerProvider = fullId.split("/")[0];
     try {
       const data = JSON.parse(jsonText);
       if (data.name) modelLabel = prefLabels.get(fullId) || data.name;
       variantIds = Object.keys(data.variants ?? {});
+      window = contextLimit(data.limit);
     } catch {
     }
     seen.add(fullId);
@@ -6505,12 +6522,15 @@ function parseOpenCodeModelsVerbose(stdout, manifest) {
       modelId: fullId,
       modelLabel,
       runnerProvider,
-      variants: variantIds.map((id) => ({ id, label: id.charAt(0).toUpperCase() + id.slice(1) }))
+      variants: variantIds.map((id) => ({ id, label: id.charAt(0).toUpperCase() + id.slice(1) })),
+      ...window
     });
   }
-  if (models.length === 0) return [];
-  const prefOrder = preferred?.map((p) => p.id) ?? [];
-  models.sort((a, b) => {
+  return preferredFirst(models, manifest);
+}
+function preferredFirst(models, manifest) {
+  const prefOrder = manifest.modelDiscovery.preferredPatterns?.map((p) => p.id) ?? [];
+  return [...models].sort((a, b) => {
     const ai = prefOrder.indexOf(a.modelId);
     const bi = prefOrder.indexOf(b.modelId);
     if (ai >= 0 && bi >= 0) return ai - bi;
@@ -6518,7 +6538,37 @@ function parseOpenCodeModelsVerbose(stdout, manifest) {
     if (bi >= 0) return 1;
     return a.modelId.localeCompare(b.modelId);
   });
-  return models;
+}
+function parseOpenCodeModelsApi(stdout, manifest) {
+  let data;
+  try {
+    data = JSON.parse(stdout)?.data;
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(data)) return [];
+  const prefLabels = new Map((manifest.modelDiscovery.preferredPatterns ?? []).map((p) => [p.id, p.label]));
+  const seen = /* @__PURE__ */ new Set();
+  const models = [];
+  for (const entry of data) {
+    if (!entry || typeof entry.providerID !== "string" || typeof entry.modelID !== "string") continue;
+    if (entry.enabled === false) continue;
+    const fullId = `${entry.providerID}/${entry.modelID}`;
+    if (seen.has(fullId)) continue;
+    seen.add(fullId);
+    const variantIds = Array.isArray(entry.variants) ? entry.variants.flatMap((v) => {
+      const id = v?.id;
+      return typeof id === "string" && id ? [id] : [];
+    }) : [];
+    models.push({
+      modelId: fullId,
+      modelLabel: prefLabels.get(fullId) || typeof entry.name === "string" && entry.name || entry.modelID,
+      runnerProvider: entry.providerID,
+      variants: variantIds.map((id) => ({ id, label: id.charAt(0).toUpperCase() + id.slice(1) })),
+      ...contextLimit(entry.limit)
+    });
+  }
+  return preferredFirst(models, manifest);
 }
 
 // src/plugins/builtin/opencode.manifest.ts
@@ -6534,13 +6584,17 @@ var OPENCODE_MANIFEST = {
   modelDiscovery: {
     method: "command",
     discoveryCommands: [
+      // v1 prints per-model variants under --verbose; v2 rejects the flag (a
+      // fast non-zero exit) and serves the same catalog, variants included, over
+      // `api model.list`. v1 is asked first so it never reaches the `api` form.
       { command: "opencode", args: ["models", "--verbose"], parser: parseOpenCodeModelsVerbose },
+      { command: "opencode", args: ["api", "model.list"], parser: parseOpenCodeModelsApi },
       { command: "opencode", args: ["models"], parser: parseOpenCodeModels }
     ],
     // No fallbackModels: the list must always reflect what `opencode models`
     // actually reports for THIS user (their configured providers only). A
     // hardcoded fallback previously leaked models the user didn't have.
-    // No static variants — per-model variants are fetched from opencode models --verbose
+    // No static variants — per-model variants come from the first two commands above
     providerQualifiedIds: true
   },
   contextFile: "AGENTS.md",
@@ -8151,6 +8205,7 @@ var LOG_KINDS = {
   turn_start: true,
   command: true,
   command_output: true,
+  model_switched: true,
   compaction: true,
   runner_loaded: true,
   turn_end: true,
@@ -8186,6 +8241,11 @@ ${s.content}` : ""}`).join("\n");
       return `${event.messageId ? `${event.messageId} ` : ""}/${event.name}${event.args ? ` ${event.args}` : ""}`;
     case "command_output":
       return event.text;
+    case "model_switched": {
+      const { plan } = event;
+      const planned = plan ? `; plan: ${plan.model?.model ?? "no model"}${plan.effort ? ` (${plan.effort})` : ""}` : "";
+      return `${event.from.model} \u2192 ${event.to.model}${planned}${event.kept ? `, kept: ${event.kept}` : ""}`;
+    }
     case "compaction":
       return `${event.trigger}${event.preTokens !== void 0 && event.postTokens !== void 0 ? `, ${event.preTokens} \u2192 ${event.postTokens} tokens` : ""}`;
     case "runner_loaded":
@@ -9745,6 +9805,7 @@ function canUseToolAnswer({ input, suggestions }, decision) {
     ...decision.decision === "allowForTask" && suggestions.length > 0 ? { updatedPermissions: suggestions } : {}
   };
 }
+var MODEL_COMMAND = "model";
 var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
 function usageRecord(usage, model, subagentId) {
   const record = {
@@ -9806,9 +9867,9 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   /** The model answering the planner's current message, as its `message_start` named it. */
   plannerModel;
   /**
-   * The session's `total_cost_usd` as last reported. Undefined after a resume:
-   * the CLI restores the resumed session's running total, and what Ordewell
-   * already counted of it is not ours to know here.
+   * The session's `total_cost_usd` as last counted. A resume starts from what
+   * was counted of that session before, and is undefined without it: the CLI
+   * restores the session's running total, which holds turns counted earlier.
    */
   reportedCostUsd = 0;
   reportedModelCostUsd = /* @__PURE__ */ new Map();
@@ -9849,6 +9910,19 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   terminalOnly = /* @__PURE__ */ new Set();
   /** Whether this process's `runner_loaded` went out: its first `init` sends it. */
   loadedReported = false;
+  /** The models `initialize` listed, which turn the ids the CLI reports back into the ones a plan holds. */
+  listedModels = [];
+  /** The id the task's main thread last reported answering on. */
+  mainModel;
+  /** What the plan should say the task runs: its spawn's model, then each switch followed. */
+  followedModel;
+  /**
+   * Model commands sent through the chat whose switch has not been seen yet,
+   * oldest first, each with the turns still to end before its own has. Several
+   * can be pending: a command's switch is first reported by the next turn's
+   * `init`, which can be another `/model`'s.
+   */
+  modelCommands = [];
   spawnSpec(opts, workspace) {
     if (opts.kind === "task") return this.taskSpawnSpec(opts);
     const args = [
@@ -9874,12 +9948,23 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
     if (opts.effort && opts.effort !== "adaptive") args.push("--effort", opts.effort);
     if (opts.resumeSessionId) {
       args.push("--resume", opts.resumeSessionId);
-      this.reportedCostUsd = void 0;
+      this.countFrom(opts.resumeSessionId, opts.resumeCost);
       this.pendingResume = opts.resumeSessionId;
     }
     this.configDir = workspace.CLAUDE_CONFIG_DIR ?? process.env.CLAUDE_CONFIG_DIR ?? path13.join(os6.homedir(), ".claude");
     return { command: "claude", args, env: NO_AUTO_MEMORY };
   }
+  sessionCost() {
+    const sessionId = this.sessionId ?? this.pendingResume;
+    if (!sessionId || this.reportedCostUsd === void 0) return null;
+    return { sessionId, usd: this.reportedCostUsd, modelUsd: Object.fromEntries(this.reportedModelCostUsd) };
+  }
+  /** A count kept for another session says nothing of this one's. */
+  countFrom(sessionId, counted) {
+    const known = counted?.sessionId === sessionId ? counted : void 0;
+    this.reportedCostUsd = known?.usd;
+    this.reportedModelCostUsd = new Map(Object.entries(known?.modelUsd ?? {}));
+  }
   savedOutput(abs) {
     return this.configDir !== null && this.sessionId !== null && inSavedOutput(abs, this.configDir, this.sessionId);
   }
@@ -9894,6 +9979,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
    */
   taskSpawnSpec(opts) {
     this.requestedMode = opts.flags.permissionMode;
+    this.followedModel = opts.model;
     const args = [
       ...TASK_PROTOCOL_ARGS,
       "--permission-prompt-tool",
@@ -9907,7 +9993,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
     if (opts.model) args.push("--model", opts.model);
     if (opts.resumeSessionId) {
       args.push("--resume", opts.resumeSessionId);
-      this.reportedCostUsd = void 0;
+      this.countFrom(opts.resumeSessionId, opts.resumeCost);
       this.pendingResume = opts.resumeSessionId;
     }
     if (opts.mcp) args.push("--append-system-prompt", TASK_COMPLETION_CONTRACT, ...this.ordewellServerArgs(opts.mcp, "task"));
@@ -9949,6 +10035,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
     if (opts.kind !== "task") return;
     const initialized = (await this.control({ subtype: "initialize" }, MODEL_PIN_TIMEOUT_MS))?.response;
     this.listedCommands = initialized?.commands ?? [];
+    this.listedModels = initialized?.models ?? [];
     if (opts.flags.permissionMode !== "plan" || !opts.model) return;
     const resolved = initialized?.models?.find((m) => m.value === opts.model)?.resolvedModel;
     if (resolved && resolved !== opts.model) await this.control({ subtype: "set_model", model: resolved }, MODEL_PIN_TIMEOUT_MS);
@@ -10002,6 +10089,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
     if (this.role !== "task" || !this.process || this.interruptRequested || this.pendingResume) return false;
     const uuid = randomUUID();
     this.steers.set(uuid, id);
+    this.noteModelCommand(text, 2);
     this.writeLine({ type: "user", uuid, message: { role: "user", content: [{ type: "text", text }] } });
     return true;
   }
@@ -10053,12 +10141,23 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   }
   turnPayload(message) {
     this.openTurnState();
+    this.noteModelCommand(message, 1);
     return `${JSON.stringify({
       type: "user",
       message: { role: "user", content: [{ type: "text", text: message }] }
     })}
 `;
   }
+  /**
+   * The CLI runs a message that starts with a slash command as that command,
+   * whether the surface sent it as one or as plain text, so the message
+   * itself says a model switch was asked for: every way into the chat counts.
+   */
+  noteModelCommand(text, turnsLeft) {
+    const [, name, args = ""] = /^\/(\S+)\s*([\s\S]*)$/.exec(text) ?? [];
+    if (this.role !== "task" || !name || (findRunnerCommand(this.commands(), name)?.name ?? name) !== MODEL_COMMAND) return;
+    this.modelCommands.push({ args: args.trim(), turnsLeft });
+  }
   openTurnState() {
     this.turnHasText = false;
     this.interruptRequested = false;
@@ -10170,6 +10269,7 @@ ${block.text}` : block.text });
           this.clearFollowOnTimer();
           if (this.refuseOtherMode(msg, emit)) return;
           this.readLoaded(msg, emit);
+          this.followModel(msg.model, emit);
         }
         if (msg.subtype === "commands_changed" && Array.isArray(msg.commands)) this.listedCommands = msg.commands;
         if (msg.subtype === "compact_boundary") {
@@ -10192,6 +10292,7 @@ ${block.text}` : block.text });
         return;
       case "result":
         this.reportSessionCost(msg, emit);
+        for (const command of this.modelCommands) command.turnsLeft = Math.max(0, command.turnsLeft - 1);
         if (this.interruptRequested && (msg.is_error || msg.subtype !== "success")) {
           this.interruptRequested = false;
           this.closeTurn({ type: "turn_end", interrupted: true }, emit);
@@ -10211,6 +10312,55 @@ ${block.text}` : block.text });
         return;
     }
   }
+  /**
+   * A task's main thread reported the model it answers on. A change is the
+   * user's own switch when a model command went out before it: Ordewell never
+   * passes `--fallback-model`, so nothing else should move it. A change with
+   * no command before it is reported as drift, and the plan does not follow
+   * it. A command whose turn ended with the model unchanged switched nothing,
+   * and is let go.
+   *
+   * Effort is never reported (recorded on 2.1.302, `task-effort-command`):
+   * `init` names the model alone, its `per_turn_effort_active` says effort is
+   * on, not which; `/effort low` only prints that it set it; and `/model`
+   * takes no effort (`/model haiku high` is "not found"). So a switch carries
+   * no effort and the plan's stays as planned.
+   */
+  followModel(reported, emit) {
+    if (this.role !== "task" || !reported || reported === "<synthetic>") return;
+    const previous = this.mainModel;
+    this.mainModel = reported;
+    if (previous === void 0 || previous === reported) {
+      this.modelCommands = this.modelCommands.filter((c) => c.turnsLeft > 0);
+      return;
+    }
+    const matched = this.modelCommands.findIndex((c) => this.runsAs(c.args, reported));
+    const command = this.modelCommands[Math.max(matched, 0)];
+    this.modelCommands = this.modelCommands.slice(Math.max(matched, 0) + 1);
+    const from = this.listedModel(previous, this.followedModel);
+    if (!command) {
+      emit({ type: "model_drifted", from, to: this.listedModel(reported, void 0) });
+      return;
+    }
+    const to = this.listedModel(reported, command.args);
+    this.followedModel = to.model;
+    emit({ type: "model_switched", from, to });
+  }
+  /** Whether the model value `asked` runs as the id `resolved`, by what `initialize` lists. */
+  runsAs(asked, resolved) {
+    return asked === resolved || this.listedModels.some((m) => m.value === asked && m.resolvedModel === resolved);
+  }
+  /**
+   * The value `initialize` lists for the id a model runs as. Several can share
+   * one (`sonnet`, `default`); the one asked for wins, and `default` only as a
+   * last resort, since it names whatever the CLI's default becomes.
+   */
+  listedModel(resolved, asked) {
+    const listed3 = this.listedModels.filter((m) => m.value && (m.resolvedModel === resolved || m.value === resolved));
+    const pick = listed3.find((m) => m.value === asked && asked !== "default") ?? listed3.find((m) => m.value !== "default") ?? listed3[0];
+    if (!pick?.value) return { model: resolved };
+    return { model: pick.value, ...pick.displayName ? { label: pick.displayName } : {} };
+  }
   /**
    * `--permission-mode auto` on a model or account without auto mode is not
    * refused: the CLI says nothing and starts in `default`, then asks about every
@@ -10294,8 +10444,10 @@ ${block.text}` : block.text });
    * {@link AgentEvent}), so nothing here has to reconcile with it.
    */
   handleStreamEvent(event, emit) {
-    if (event.type === "message_start") this.plannerModel = event.message?.model;
-    else if (event.type === "message_delta" && event.usage) emit({ type: "usage", record: usageRecord(event.usage, this.plannerModel) });
+    if (event.type === "message_start") {
+      this.plannerModel = event.message?.model;
+      this.followModel(this.plannerModel, emit);
+    } else if (event.type === "message_delta" && event.usage) emit({ type: "usage", record: usageRecord(event.usage, this.plannerModel) });
     else if (event.type === "content_block_start" && event.content_block?.type === "text") {
       this.pendingBreak = this.turnHasText;
     } else if (event.type === "content_block_delta" && event.delta?.type === "text_delta" && event.delta.text) {
@@ -10310,7 +10462,8 @@ ${block.text}` : block.text });
    * What only the result line knows: the cost, which covers every call the
    * session made — subagents included, since none of their lines carries one —
    * and the planner model's window. `total_cost_usd` is a running total, so a
-   * turn reports its growth. The first turn after a resume only sets the
+   * turn reports its growth. After a resume it grows from what was counted of
+   * the session before; with no count kept, the first turn only sets the
    * baseline: its total includes turns counted before, and a turn's own share
    * cannot be told apart from them.
    */
@@ -10890,6 +11043,97 @@ var CodexRpc = class {
   }
 };
 
+// src/utils/wallTime.ts
+var MONTHS = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
+function lastMatch(re, text) {
+  let last = null;
+  for (const m of text.matchAll(re)) last = m;
+  return last;
+}
+function hour24(hour, meridiem) {
+  const h = Number(hour) % 12;
+  return meridiem.toLowerCase() === "pm" ? h + 12 : h;
+}
+function month(name) {
+  if (!name) return void 0;
+  const at = MONTHS.indexOf(name.toLowerCase());
+  return at < 0 ? void 0 : at;
+}
+function placeWallTime(wall, zone, now) {
+  const today = wallFields(now, zone);
+  const year = wall.year ?? today.year;
+  const monthIndex = wall.month ?? today.month;
+  const day = wall.day ?? today.day;
+  const at = fromWall(year, monthIndex, day, wall.hour, wall.minute, zone);
+  if (wall.day !== void 0 || at.getTime() >= now.getTime() - HOUR_MS) return at;
+  return fromWall(year, monthIndex, day + 1, wall.hour, wall.minute, zone);
+}
+var HOUR_MS = 60 * 6e4;
+function wallFields(instant, zone) {
+  if (!zone) {
+    return { year: instant.getFullYear(), month: instant.getMonth(), day: instant.getDate(), hour: instant.getHours(), minute: instant.getMinutes(), second: instant.getSeconds() };
+  }
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone: zone,
+    hourCycle: "h23",
+    year: "numeric",
+    month: "numeric",
+    day: "numeric",
+    hour: "numeric",
+    minute: "numeric",
+    second: "numeric"
+  }).formatToParts(instant);
+  const field = (type) => Number(parts.find((p) => p.type === type)?.value ?? 0);
+  return { year: field("year"), month: field("month") - 1, day: field("day"), hour: field("hour"), minute: field("minute"), second: field("second") };
+}
+function zoneOffsetMs(instant, zone) {
+  const f = wallFields(new Date(instant), zone);
+  return Date.UTC(f.year, f.month, f.day, f.hour, f.minute, f.second) - Math.floor(instant / 1e3) * 1e3;
+}
+function fromWall(year, monthIndex, day, hour, minute, zone) {
+  if (!zone) return new Date(year, monthIndex, day, hour, minute);
+  const asUtc = Date.UTC(year, monthIndex, day, hour, minute);
+  let instant = asUtc - zoneOffsetMs(asUtc, zone);
+  instant = asUtc - zoneOffsetMs(instant, zone);
+  return new Date(instant);
+}
+
+// src/services/harness/codexUsageLimit.ts
+var CODEX_RESET_RE = /[Tt]ry again at (?:([A-Z][a-z]{2}) (\d{1,2})(?:st|nd|rd|th)?, (\d{4}) )?(\d{1,2}):(\d{2}) ([AP]M)\./g;
+function codexUsageLimitReset(text, now) {
+  const m = lastMatch(CODEX_RESET_RE, text);
+  if (!m) return null;
+  const [, mon, day, year, hour, minute, meridiem] = m;
+  const wall = { hour: hour24(hour, meridiem), minute: Number(minute) };
+  if (mon) {
+    const at = month(mon);
+    if (at === void 0) return null;
+    Object.assign(wall, { month: at, day: Number(day), year: Number(year) });
+  }
+  return placeWallTime(wall, void 0, now);
+}
+function mergeCodexRateLimits(known, params) {
+  const snapshot = params?.rateLimits;
+  if (!snapshot || typeof snapshot !== "object") return known;
+  const id = snapshot.limitId ?? "";
+  const before = known.get(id);
+  const next = new Map(known);
+  next.set(id, { limitId: id, primary: snapshot.primary ?? before?.primary, secondary: snapshot.secondary ?? before?.secondary });
+  return next;
+}
+function isCodexUsageLimit(error) {
+  const info = error?.codexErrorInfo;
+  if (info === void 0 || info === null || info === "other") return void 0;
+  if (info === "usageLimitExceeded") return true;
+  return typeof info === "object" && "usageLimitExceeded" in info;
+}
+function codexUsageLimitSignal(error, limits, now) {
+  const limited = isCodexUsageLimit(error);
+  if (limited !== true) return limited;
+  const resets = [...limits.values()].flatMap((snapshot) => [snapshot.primary, snapshot.secondary]).flatMap((window) => window && (window.usedPercent ?? 0) >= 100 && typeof window.resetsAt === "number" ? [window.resetsAt * 1e3] : []).filter((at) => at > now.getTime());
+  return resets.length > 0 ? { resetsAt: new Date(Math.max(...resets)).toISOString() } : {};
+}
+
 // src/services/harness/CodexAdapter.ts
 var HANDSHAKE_TIMEOUT_MS = 3e4;
 var MCP_ATTACH_TIMEOUT_MS2 = 1e4;
@@ -11033,6 +11277,11 @@ var CodexAdapter = class extends StdioAgentAdapter {
   turn = null;
   /** The last turn this adapter ended — so its second end signal, landing late, ends nothing. */
   endedTurnId = null;
+  /**
+   * The account's limit windows as Codex last reported them. Only read when a
+   * turn fails on the usage limit; an update on its own acts on nothing.
+   */
+  rateLimits = /* @__PURE__ */ new Map();
   /** An interrupt was asked for during this turn, so however it ends, it was cut short. */
   interruptRequested = false;
   /**
@@ -11428,6 +11677,9 @@ ${this.exitMessage()}`);
       case "thread/tokenUsage/updated":
         this.emitUsage(msg.params, emit);
         return;
+      case "account/rateLimits/updated":
+        this.rateLimits = mergeCodexRateLimits(this.rateLimits, msg.params);
+        return;
       case "turn/started": {
         if (this.subagentOf(msg.params?.threadId)) return;
         this.turnHasText = false;
@@ -11468,7 +11720,7 @@ ${this.exitMessage()}`);
         const failure = msg.params;
         if (failure?.willRetry) return;
         this.closeTurn(emit);
-        emit({ type: "error", message: failure?.error?.message || "Codex ended the turn with an error." });
+        emit(this.turnFailed(failure?.error));
         return;
       }
       case "turn/completed": {
@@ -11479,7 +11731,7 @@ ${this.exitMessage()}`);
         if (this.interruptRequested || turn?.status === "interrupted") {
           emit({ type: "turn_end", interrupted: true });
         } else if (turn?.status === "failed") {
-          emit({ type: "error", message: turn.error?.message || "Codex ended the turn with an error." });
+          emit(this.turnFailed(turn.error));
         } else {
           emit({ type: "turn_end" });
         }
@@ -11491,6 +11743,11 @@ ${this.exitMessage()}`);
         return;
     }
   }
+  turnFailed(error) {
+    const message = error?.message || "Codex ended the turn with an error.";
+    const usageLimit = codexUsageLimitSignal(error, this.rateLimits, /* @__PURE__ */ new Date());
+    return usageLimit === void 0 ? { type: "error", message } : { type: "error", message, usageLimit };
+  }
   turnStarted(id) {
     const turn = this.turn;
     if (!turn || turn.id || typeof id !== "string") return;
@@ -11948,9 +12205,9 @@ function recordUnusable(servers, approval) {
   for (const server4 of servers) approval?.record?.(startRequest(server4), false, "unsupported");
 }
 var NOT_APPROVED = "not approved for planning";
-function heldServersNote(held, unreadable = []) {
+function heldServersNote(held2, unreadable = []) {
   const lines = [
-    ...held.map(({ server: server4, reason }) => `- ${server4.name} (${server4.source}): ${reason}`),
+    ...held2.map(({ server: server4, reason }) => `- ${server4.name} (${server4.source}): ${reason}`),
     ...unreadable.map((file) => `- ${file.source}: Ordewell could not read it (${file.reason})`)
   ];
   if (lines.length === 0) return "";
@@ -12087,8 +12344,8 @@ var PendingSteers = class {
    * False when it was already delivered, so a late failure does not recall it.
    */
   forget(id) {
-    for (const [messageId, held] of this.pending) {
-      if (held !== id) continue;
+    for (const [messageId, held2] of this.pending) {
+      if (held2 !== id) continue;
       this.pending.delete(messageId);
       return true;
     }
@@ -12166,9 +12423,9 @@ var ChildSessions = class {
   adopt(child, callId) {
     if (this.owners.get(child)) return null;
     this.owners.set(child, callId);
-    const held = this.held.get(child) ?? [];
+    const held2 = this.held.get(child) ?? [];
     this.held.delete(child);
-    return held;
+    return held2;
   }
   owns(callId) {
     return [...this.owners.values()].includes(callId);
@@ -12692,11 +12949,11 @@ var OpenCodeV2 = class {
   adoptChild(data, state, onEvent, turn) {
     const child = data.metadata?.sessionID;
     const callId = data.id;
-    const held = child && callId ? state.children.adopt(child, callId) : null;
-    if (!held || !callId) return;
+    const held2 = child && callId ? state.children.adopt(child, callId) : null;
+    if (!held2 || !callId) return;
     const model = state.stepModels.get(data.assistantMessageID ?? "");
     onEvent({ type: "subagent_started", subagentId: callId, brief: state.briefs.get(callId) ?? "", ...model ? { model } : {} });
-    for (const frame of held) this.onFrame(frame, state, turn, onEvent);
+    for (const frame of held2) this.onFrame(frame, state, turn, onEvent);
   }
   finishChild(callId, success, output, state, onEvent) {
     if (!state.children.owns(callId)) return;
@@ -13408,13 +13665,13 @@ var OpenCodeAdapter = class {
   trackSubagent(part, callId, turn, onEvent) {
     const state = part.state;
     const child = state?.metadata?.sessionId;
-    const held = child ? turn.children.adopt(child, callId) : null;
-    if (held) {
+    const held2 = child ? turn.children.adopt(child, callId) : null;
+    if (held2) {
       const input = state?.input ?? {};
       const brief2 = typeof input.description === "string" ? input.description : typeof input.prompt === "string" ? input.prompt : "";
       const model = flatModelId(state?.metadata?.model?.providerID, state?.metadata?.model?.modelID);
       onEvent({ type: "subagent_started", subagentId: callId, brief: brief2, ...model ? { model } : {} });
-      for (const frame of held) this.onFrame(frame, turn, onEvent);
+      for (const frame of held2) this.onFrame(frame, turn, onEvent);
     }
     const status = state?.status;
     if (status === "completed" || status === "error") {
@@ -13644,61 +13901,6 @@ var OPENCODE_REPO_CONFIG = {
   }
 };
 
-// src/utils/wallTime.ts
-var MONTHS = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
-function lastMatch(re, text) {
-  let last = null;
-  for (const m of text.matchAll(re)) last = m;
-  return last;
-}
-function hour24(hour, meridiem) {
-  const h = Number(hour) % 12;
-  return meridiem.toLowerCase() === "pm" ? h + 12 : h;
-}
-function month(name) {
-  if (!name) return void 0;
-  const at = MONTHS.indexOf(name.toLowerCase());
-  return at < 0 ? void 0 : at;
-}
-function placeWallTime(wall, zone, now) {
-  const today = wallFields(now, zone);
-  const year = wall.year ?? today.year;
-  const monthIndex = wall.month ?? today.month;
-  const day = wall.day ?? today.day;
-  const at = fromWall(year, monthIndex, day, wall.hour, wall.minute, zone);
-  if (wall.day !== void 0 || at.getTime() >= now.getTime() - HOUR_MS) return at;
-  return fromWall(year, monthIndex, day + 1, wall.hour, wall.minute, zone);
-}
-var HOUR_MS = 60 * 6e4;
-function wallFields(instant, zone) {
-  if (!zone) {
-    return { year: instant.getFullYear(), month: instant.getMonth(), day: instant.getDate(), hour: instant.getHours(), minute: instant.getMinutes(), second: instant.getSeconds() };
-  }
-  const parts = new Intl.DateTimeFormat("en-US", {
-    timeZone: zone,
-    hourCycle: "h23",
-    year: "numeric",
-    month: "numeric",
-    day: "numeric",
-    hour: "numeric",
-    minute: "numeric",
-    second: "numeric"
-  }).formatToParts(instant);
-  const field = (type) => Number(parts.find((p) => p.type === type)?.value ?? 0);
-  return { year: field("year"), month: field("month") - 1, day: field("day"), hour: field("hour"), minute: field("minute"), second: field("second") };
-}
-function zoneOffsetMs(instant, zone) {
-  const f = wallFields(new Date(instant), zone);
-  return Date.UTC(f.year, f.month, f.day, f.hour, f.minute, f.second) - Math.floor(instant / 1e3) * 1e3;
-}
-function fromWall(year, monthIndex, day, hour, minute, zone) {
-  if (!zone) return new Date(year, monthIndex, day, hour, minute);
-  const asUtc = Date.UTC(year, monthIndex, day, hour, minute);
-  let instant = asUtc - zoneOffsetMs(asUtc, zone);
-  instant = asUtc - zoneOffsetMs(instant, zone);
-  return new Date(instant);
-}
-
 // src/services/harness/claudeUsageLimit.ts
 var CLAUDE_RESET_RE = /You['’]ve hit your [^\n]*?· (?:your [^·\n]*? )?resets (?:([A-Z][a-z]{2}) (\d{1,2}), (?:(\d{4}), )?)?(\d{1,2})(?::(\d{2}))?([ap]m) \(([A-Za-z0-9_+\-/]+)\)/g;
 function claudeUsageLimitReset(text, now) {
@@ -13714,21 +13916,6 @@ function claudeUsageLimitReset(text, now) {
   return placeWallTime(wall, zone, now);
 }
 
-// src/services/harness/codexUsageLimit.ts
-var CODEX_RESET_RE = /[Tt]ry again at (?:([A-Z][a-z]{2}) (\d{1,2})(?:st|nd|rd|th)?, (\d{4}) )?(\d{1,2}):(\d{2}) ([AP]M)\./g;
-function codexUsageLimitReset(text, now) {
-  const m = lastMatch(CODEX_RESET_RE, text);
-  if (!m) return null;
-  const [, mon, day, year, hour, minute, meridiem] = m;
-  const wall = { hour: hour24(hour, meridiem), minute: Number(minute) };
-  if (mon) {
-    const at = month(mon);
-    if (at === void 0) return null;
-    Object.assign(wall, { month: at, day: Number(day), year: Number(year) });
-  }
-  return placeWallTime(wall, void 0, now);
-}
-
 // src/services/harness/connectors.ts
 var CONNECTORS = {
   "claude-code": { create: (deps) => new ClaudeCodeAdapter(deps), ordewellTools: CLAUDE_ORDEWELL, repoConfig: CLAUDE_REPO_CONFIG, usageLimitReset: claudeUsageLimitReset },
@@ -14059,6 +14246,7 @@ function parseCodexModelsCache(content) {
   }
 }
 var GEMINI_MODELS_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var NEGATIVE_TTL_MS = 6e4;
 function geminiDiscoveryCacheKey(apiKey) {
   const dir = globalDataDir();
   const hash = apiKey.slice(-8);
@@ -14126,7 +14314,8 @@ async function discoverGeminiModels(apiKey, baseUrl, fetchImpl) {
             modelId,
             modelLabel: m.displayName || modelId,
             runnerProvider: "gemini",
-            variants: []
+            variants: [],
+            ...typeof m.inputTokenLimit === "number" && m.inputTokenLimit > 0 ? { contextWindow: m.inputTokenLimit } : {}
           });
         }
       }
@@ -14188,26 +14377,33 @@ async function discoverFromApi(manifest, config, fetchImpl) {
     return null;
   }
 }
+function wasKilled(err) {
+  return !!err && typeof err === "object" && err.killed === true;
+}
 async function discoverFromCommand(manifest, execImpl) {
   const discovery = manifest.modelDiscovery;
   const commands = discovery.discoveryCommands ?? [
     { command: discovery.command, args: discovery.args || [], parser: discovery.parser }
   ];
   const runCommands = async () => {
+    let timedOut2 = false;
     for (const cmd of commands) {
       try {
         const { stdout } = await execImpl(`${cmd.command} ${cmd.args.join(" ")}`, { timeout: 45e3 });
         const models = parseModelOutput(stdout, cmd.parser, manifest);
-        if (models.length > 0) return applyVariants(mergeCanonicalAliases(models, manifest), manifest);
-      } catch {
+        if (models.length > 0) return { models: applyVariants(mergeCanonicalAliases(models, manifest), manifest), timedOut: timedOut2 };
+      } catch (err) {
+        if (wasKilled(err)) timedOut2 = true;
       }
     }
-    return null;
+    return { models: null, timedOut: timedOut2 };
   };
   const first = await runCommands();
-  if (first) return { models: first, fromFallback: false };
-  const second = await runCommands();
-  if (second) return { models: second, fromFallback: false };
+  if (first.models) return { models: first.models, fromFallback: false };
+  if (first.timedOut) {
+    const second = await runCommands();
+    if (second.models) return { models: second.models, fromFallback: false };
+  }
   return { models: applyVariants(buildFallbackModels(manifest), manifest), fromFallback: true };
 }
 function mergeCanonicalAliases(discovered, manifest) {
@@ -14244,16 +14440,33 @@ function parseLineByLine(stdout) {
 }
 var ModelDiscovery = class {
   cache = /* @__PURE__ */ new Map();
+  /**
+   * Degraded results (a fallback list, or empty) remembered for
+   * {@link NEGATIVE_TTL_MS}. They are deliberately not cached — a transient
+   * failure must heal — but re-running a failing CLI on every lookup is the
+   * other extreme.
+   */
+  misses = /* @__PURE__ */ new Map();
+  /**
+   * Discoveries still running, so a second lookup of the same runner joins the
+   * first instead of spawning the CLI again. A slow CLI is the case this
+   * exists for: a planner switch and a runner-list refresh land inside one
+   * another's wait, and two `opencode models` calls race each other for the
+   * same background service.
+   */
+  inflight = /* @__PURE__ */ new Map();
   registry;
   execImpl;
   fetchImpl;
   appServerClient;
   readFileImpl;
-  constructor(registry, execImpl = defaultExec2, fetchImpl, appServerClient = defaultAppServerClient, readFileImpl) {
+  now;
+  constructor(registry, execImpl = defaultExec2, fetchImpl, appServerClient = defaultAppServerClient, readFileImpl, now = Date.now) {
     this.registry = registry;
     this.execImpl = execImpl;
     this.fetchImpl = fetchImpl;
     this.appServerClient = appServerClient;
+    this.now = now;
     this.readFileImpl = readFileImpl ?? ((filePath) => {
       try {
         return fsSync3.readFileSync(filePath.replace(/^~/, osMod.homedir()), "utf8");
@@ -14297,10 +14510,20 @@ var ModelDiscovery = class {
     const runnerLabel = manifest.displayName || runner;
     return models.map((m) => ({ ...m, runnerId: runner, runnerLabel }));
   }
-  async discoverRaw(runner) {
-    if (this.cache.has(runner)) {
-      return this.cache.get(runner);
-    }
+  discoverRaw(runner) {
+    const cached2 = this.cache.get(runner);
+    if (cached2) return Promise.resolve(cached2);
+    const remembered = this.misses.get(runner);
+    if (remembered && this.now() - remembered.at < NEGATIVE_TTL_MS) return Promise.resolve(remembered.models);
+    const running = this.inflight.get(runner);
+    if (running) return running;
+    const started = this.discoverUncached(runner).finally(() => {
+      if (this.inflight.get(runner) === started) this.inflight.delete(runner);
+    });
+    this.inflight.set(runner, started);
+    return started;
+  }
+  async discoverUncached(runner) {
     const manifest = this.registry.getManifest(runner);
     if (!manifest) {
       return [];
@@ -14332,10 +14555,13 @@ var ModelDiscovery = class {
       models = buildFallbackModels(manifest);
     }
     if (cacheable && models.length > 0) this.cache.set(runner, models);
+    else this.misses.set(runner, { models, at: this.now() });
     return models;
   }
   clear() {
     this.cache.clear();
+    this.misses.clear();
+    this.inflight.clear();
   }
   /** Whatever `discover()` has already cached for `runner` — never triggers discovery. */
   getCached(runner) {
@@ -14497,6 +14723,7 @@ function parseMaxParallel(value) {
 // src/services/SettingsService.ts
 import * as fs10 from "fs";
 import * as path25 from "path";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/services/LoopGuards.ts
 var DEFAULT_SUPERVISOR_RETRY_LIMIT = 2;
@@ -14763,23 +14990,34 @@ function createWakePolicy(options) {
 // src/services/runnerExit.ts
 var USAGE_LIMIT_RE = /\b(?:usage|session|weekly|daily|monthly) limit\b|\brate limit (?:exceeded|reached)\b|\brate[- ]limited\b|\blimit (?:will )?reset\b|\bquota (?:exceeded|reached)\b|\btoo many requests\b/i;
 var USAGE_LIMIT_TAIL = 4096;
-function classifyRunnerStop(output) {
-  return USAGE_LIMIT_RE.test(output.slice(-USAGE_LIMIT_TAIL)) ? "usage-limit" : "stopped";
+function classifyRunnerStop(said2) {
+  if (typeof said2 !== "string" && said2.usageLimit !== void 0) return said2.usageLimit ? "usage-limit" : "stopped";
+  return USAGE_LIMIT_RE.test(wordsOf(said2).slice(-USAGE_LIMIT_TAIL)) ? "usage-limit" : "stopped";
+}
+function wordsOf(said2) {
+  return typeof said2 === "string" ? said2 : said2.message;
 }
 function stopsRunner(reason) {
   return reason !== "stop" && reason !== "load";
 }
-function readUsageLimitReset(runner, output, now = /* @__PURE__ */ new Date()) {
+function readUsageLimitReset(runner, said2, now = /* @__PURE__ */ new Date()) {
+  const reset = (typeof said2 === "string" ? null : reportedReset(said2)) ?? readReset(runner, wordsOf(said2), now);
+  if (!reset || reset.getTime() < now.getTime() - DAY_MS) return null;
+  return reset;
+}
+function reportedReset(failure) {
+  const at = failure.usageLimit ? failure.usageLimit.resetsAt : void 0;
+  const reset = at === void 0 ? null : new Date(at);
+  return reset && !Number.isNaN(reset.getTime()) ? reset : null;
+}
+function readReset(runner, output, now) {
   const read2 = connectorFor(runner)?.usageLimitReset;
   if (!read2) return null;
-  let reset;
   try {
-    reset = read2(output.slice(-USAGE_LIMIT_TAIL), now);
+    return read2(output.slice(-USAGE_LIMIT_TAIL), now);
   } catch {
     return null;
   }
-  if (!reset || reset.getTime() < now.getTime() - DAY_MS) return null;
-  return reset;
 }
 var DAY_MS = 24 * 60 * 6e4;
 
@@ -14883,15 +15121,15 @@ var ReplySplitter = class {
   push(segmentId, text) {
     const state = this.segments.get(segmentId);
     if (state === "text" || state === "plan") return { route: state, text };
-    const held = (state?.held ?? "") + text;
-    const opensWithObject = opensWithJsonObject(held);
+    const held2 = (state?.held ?? "") + text;
+    const opensWithObject = opensWithJsonObject(held2);
     if (opensWithObject === void 0) {
-      this.segments.set(segmentId, { held });
+      this.segments.set(segmentId, { held: held2 });
       return null;
     }
     const route = opensWithObject ? "plan" : "text";
     this.segments.set(segmentId, route);
-    return { route, text: held };
+    return { route, text: held2 };
   }
 };
 var TurnStream = class {
@@ -15046,6 +15284,7 @@ function plannerTranscript(history) {
   const loadsOf = /* @__PURE__ */ new Map();
   let owner = -1;
   for (const entry of history) {
+    if (entry.kind === "error") continue;
     if (entry.kind === "skill_load" && entry.skill) {
       const loads = entry.skill.invokedBy === "user" ? loadsOf.get(owner) : void 0;
       if (loads) loads.push(entry.skill);
@@ -16383,6 +16622,45 @@ function markOf(was, now) {
   return editedFields(was, now).length > 0 || was.status !== now.status ? "changed" : void 0;
 }
 
+// src/services/RunnerChange.ts
+var sameSet = (a, b) => a === void 0 || b === void 0 ? a === b : a.length === b.length && a.every((id) => b.includes(id));
+function scopeChange(told, now) {
+  const switchedOn = now.enabledRunners.filter((r) => !told.enabledRunners.includes(r));
+  const switchedOff = told.enabledRunners.filter((r) => !now.enabledRunners.includes(r));
+  const models = now.models;
+  const allowlists = [.../* @__PURE__ */ new Set([...Object.keys(told.allowlist), ...Object.keys(now.allowlist)])].map((runner) => ({
+    runner,
+    before: effectiveAllowlist(told.allowlist[runner], runner, models),
+    after: effectiveAllowlist(now.allowlist[runner], runner, models)
+  })).filter((c) => !sameSet(c.before, c.after));
+  return switchedOn.length || switchedOff.length || allowlists.length ? { switchedOn, switchedOff, allowlists } : null;
+}
+function flaggedTasks(rows, scope) {
+  return rows.flatMap(({ ref, task }) => {
+    const issue = assignmentIssue(task, scope);
+    return issue ? [{ ref, title: task.title, task, text: assignmentIssueText(issue), status: task.status, awaitingReason: task.awaitingReason, resumeAt: task.resumeAt }] : [];
+  });
+}
+function allowlistLine({ runner, before, after }) {
+  if (!after) return `${runner} is no longer limited: any of its models may be assigned.`;
+  if (!before) return `${runner} is now limited to: ${after.join(", ")}.`;
+  const added = after.filter((id) => !before.includes(id));
+  const removed = before.filter((id) => !after.includes(id));
+  return `${runner} models: ${[added.length ? `now allowed ${added.join(", ")}` : "", removed.length ? `no longer allowed ${removed.join(", ")}` : ""].filter(Boolean).join("; ")}.`;
+}
+function runnersChangedBlock(change, flagged, tools) {
+  return [
+    "<runners_changed>",
+    "The user changed which runners and models you may assign since your last turn.",
+    change.switchedOn.length ? `Runners switched on: ${change.switchedOn.join(", ")}.` : "",
+    change.switchedOff.length ? `Runners switched off: ${change.switchedOff.join(", ")}.` : "",
+    ...change.allowlists.map(allowlistLine),
+    flagged.length ? ["These tasks are now outside that:", ...flagged.map((f) => `- ${f.ref} "${f.title}" (${f.text}) \u2014 ${assignmentConsequence(f)}`)].join("\n") : "",
+    `${tools ? "list_runners and list_models give" : "<available_models> shows"} what you may assign now.${flagged.length ? " Consider moving the tasks above to an enabled runner and an allowed model, or tell the user why you left them." : ""}`,
+    "</runners_changed>"
+  ].filter(Boolean).join("\n");
+}
+
 // src/services/PlannerConversation.ts
 var CATALOG_MODEL_CAP = 100;
 var PLANNER_TOOLS_REMINDER = "Runners, models and modes may have changed since you last read them: call list_runners and list_models just before submit_plan.";
@@ -16447,6 +16725,17 @@ var PlannerTurnFailedError = class extends Error {
     this.name = "PlannerTurnFailedError";
   }
 };
+var PlannerUsageLimitError = class extends PlannerTurnFailedError {
+  resendAt;
+  /** Why nothing is sent again on its own, when nothing is. */
+  held;
+  constructor(limit) {
+    super(limit.text);
+    this.name = "PlannerUsageLimitError";
+    this.resendAt = limit.resendAt;
+    if (limit.held) this.held = limit.held;
+  }
+};
 var PlannerTurnStoppedError = class extends Error {
   constructor(options) {
     super("The planner turn was stopped.", options);
@@ -16472,6 +16761,8 @@ var PlannerConversation = class {
   savedInBackground = 0;
   /** What the planner was last told of autorun: by its opening prompt, or a turn's block since. */
   toldAutorun = false;
+  /** The runners and allowlist the planner was last told of: its opening prompt, or a turn's block since. Null until a conversation opens. */
+  toldScope = null;
   live = null;
   openTurn = null;
   get transcript() {
@@ -16587,8 +16878,8 @@ var PlannerConversation = class {
    * from the moment it is handed in until it lands, is refused, or the turn
    * ends: the backend's reply claims it, but it has not landed by then.
    */
-  showHeld(turn, held) {
-    const result = held?.kind === "task_ops" ? this.host.validateOps(held.ops) : void 0;
+  showHeld(turn, held2) {
+    const result = held2?.kind === "task_ops" ? this.host.validateOps(held2.ops) : void 0;
     if (!result?.ok) {
       this.clearHeld(turn);
       return;
@@ -16607,9 +16898,9 @@ var PlannerConversation = class {
    * a whole plan, which an edit cannot be layered on.
    */
   pendingOps() {
-    const held = this.openTurn?.submitted;
-    if (!held) return [];
-    return held.kind === "task_ops" ? held.ops : null;
+    const held2 = this.openTurn?.submitted;
+    if (!held2) return [];
+    return held2.kind === "task_ops" ? held2.ops : null;
   }
   /**
    * A read the planner makes through a tool. It spends the same per-turn budget
@@ -16649,7 +16940,8 @@ var PlannerConversation = class {
       history: plan.conversationHistory,
       researchLog: plan.researchLog,
       persisted: this.persisted,
-      savedInBackground: this.savedInBackground
+      savedInBackground: this.savedInBackground,
+      toldScope: this.toldScope
     };
   }
   /**
@@ -16663,7 +16955,9 @@ var PlannerConversation = class {
    * the undo is saved in turn, or a reload would bring the writes back.
    */
   restore(snapshot) {
-    if (this.host.plan() !== snapshot.plan || this.persisted !== snapshot.persisted) return false;
+    if (this.host.plan() !== snapshot.plan) return false;
+    this.toldScope = snapshot.toldScope;
+    if (this.persisted !== snapshot.persisted) return false;
     const undo = () => {
       const actions = (snapshot.plan.conversationHistory ?? []).filter((entry) => entry.actor === "Ordewell setting" && !(snapshot.history ?? []).includes(entry));
       snapshot.plan.conversationHistory = actions.length > 0 ? [...snapshot.history ?? [], ...actions] : snapshot.history;
@@ -16698,8 +16992,9 @@ var PlannerConversation = class {
    * at it.
    */
   rewindTargets() {
+    const opener = this.transcript.findIndex((m) => m.kind !== "error");
     return this.transcript.flatMap((m, index) => {
-      if (!isUserMessage(m) || index === 0) return [];
+      if (!isUserMessage(m) || index === opener) return [];
       const line = m.content.split("\n")[0];
       const preview = line.length > REWIND_PREVIEW_WIDTH ? `${line.slice(0, REWIND_PREVIEW_WIDTH - 1)}\u2026` : line;
       return [{ index, preview, content: m.content, timestamp: m.timestamp }];
@@ -16826,8 +17121,10 @@ var PlannerConversation = class {
     return this.userTurn("supersede", goal, signal, async (userTurn) => {
       const opening = await prepare();
       this.assertCurrent(userTurn);
+      userTurn.checkpoint = this.snapshot();
       this.recordUser(goal, (/* @__PURE__ */ new Date()).toISOString());
       this.toldAutorun = opening.autorun ?? false;
+      this.toldScope = this.host.assignmentScope();
       const turn = await this.host.aiService().startConversation({
         ...opening,
         // The system prompt's goal is the text as typed; skill bodies ride the
@@ -16837,7 +17134,9 @@ var PlannerConversation = class {
         onProgress: userTurn.stream.sink(),
         signal: userTurn.signal
       });
-      return this.settle(await this.drainTaskQueries(turn, userTurn), userTurn);
+      const settleable = await this.drainTaskQueries(turn, userTurn);
+      this.assertNotLimited(settleable, userTurn);
+      return this.settle(settleable, userTurn);
     });
   }
   /**
@@ -16870,13 +17169,16 @@ var PlannerConversation = class {
       // anything the turn appends as it runs goes after this point.
       at: priorHistory.length
     };
-    const contextBlock = [this.catalogBlock(), this.planContextBlock(), this.autorunBlock(), this.runUpdatesBlock()].filter(Boolean).join("\n\n");
+    const toldBefore = this.toldScope;
+    const contextBlock = [this.catalogBlock(), this.planContextBlock(), this.autorunBlock(), this.runnersChangedBlock(), this.runUpdatesBlock()].filter(Boolean).join("\n\n");
     const said2 = fromUser ? plannerMessage(message.text, message.skills) : "";
     const outgoing = [contextBlock, ...wakeUps, userTurn.wakeUp?.brief, said2].filter(Boolean).join("\n\n");
     const ai = this.host.aiService();
     try {
       const turn = this.canContinueLive() ? await ai.continueConversation(outgoing, userTurn.stream.sink(), signal) : await this.resume(outgoing, priorHistory, signal, userTurn.stream.sink());
       const settleable = await this.drainTaskQueries(turn, userTurn);
+      if (settleable.kind === "message" && (settleable.failed || userTurn.signal.aborted)) this.toldScope = toldBefore;
+      this.assertNotLimited(settleable, userTurn);
       if (userTurn.wakeUp) this.assertWakeUpAnswered(settleable, userTurn);
       this.assertCurrent(userTurn, settleable);
       return await this.settle(settleable, userTurn);
@@ -16895,6 +17197,34 @@ var PlannerConversation = class {
     if (userTurn.signal.aborted) throw new PlannerTurnStoppedError();
     if (turn.kind === "message" && turn.failed) throw new PlannerTurnFailedError(turn.text);
   }
+  /**
+   * A turn that ended on the planner's usage limit lands nothing. What it
+   * wrote is taken back, its failure is kept in its place, and the limit's
+   * wait is armed in the same save. Only a turn Ordewell started gets here,
+   * so a limit is never acted on for a planner nobody asked anything of.
+   */
+  assertNotLimited(turn, userTurn) {
+    if (turn.kind !== "message" || !turn.failed || userTurn.signal.aborted) return;
+    const said2 = { message: turn.text, usageLimit: turn.usageLimit };
+    if (classifyRunnerStop(said2) !== "usage-limit") return;
+    this.assertCurrent(userTurn);
+    if (userTurn.checkpoint) this.restore(userTurn.checkpoint);
+    const limit = this.host.usageLimit(said2);
+    this.host.mutate(() => {
+      this.recordFailure(limit.text);
+      return true;
+    }, () => this.host.broadcastPlan());
+    throw new PlannerUsageLimitError(limit);
+  }
+  /**
+   * A failure kept in the transcript, drawn as one on reload too, and never
+   * replayed to the planner. Stamped after the newest entry: surfaces take
+   * only entries newer than the last they synced.
+   */
+  recordFailure(text) {
+    const newest = this.transcript.reduce((latest, e) => Math.max(latest, Date.parse(e.timestamp) || 0), 0);
+    this.append("assistant", text, { kind: "error", timestamp: new Date(Math.max(Date.now(), newest + 1)).toISOString() });
+  }
   assertIdle(operation) {
     if (this.isTurnInFlight) throw new ConversationBusyError(operation);
   }
@@ -17036,6 +17366,7 @@ var PlannerConversation = class {
     const goal = opener || this.host.goal() || message;
     this.reset();
     this.toldAutorun = opening.autorun ?? false;
+    this.toldScope = this.host.assignmentScope();
     return this.host.aiService().startConversation({
       ...opening,
       runners,
@@ -17274,6 +17605,24 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
     this.toldAutorun = now;
     return now ? AUTORUN_ON : AUTORUN_OFF;
   }
+  /**
+   * The user's runner or allowlist change, when the planner was not told yet —
+   * the same once-per-change rule as autorun, for API and harness planners
+   * alike. Tasks the change leaves outside the scope are named, not touched.
+   *
+   * A reloaded session is not told: {@link resume} takes the scope as it is
+   * then, as it does the autorun rule, since the catalog the first turn carries
+   * and `list_runners` already show the runners as they are now.
+   */
+  runnersChangedBlock() {
+    const now = this.host.assignmentScope();
+    const told = this.toldScope;
+    this.toldScope = now;
+    const change = told && scopeChange(told, now);
+    if (!change) return null;
+    const flagged = flaggedTasks(flattenTasksWithParents(this.host.tasks()), now);
+    return runnersChangedBlock(change, flagged, this.host.aiService().plannerToolsAttached?.() ?? false);
+  }
   runUpdatesBlock() {
     const updates = this.host.takeRunUpdates();
     return updates.length > 0 ? ["Run update:", ...updates.map((update) => `- ${update}`)].join("\n") : null;
@@ -17354,7 +17703,6 @@ var WAKE_DEBOUNCE_MS = 5e3;
 var WAKE_UP_TURN_TIMEOUT_MS = 10 * 6e4;
 var HUNG_TURN_GRACE_MS = 3e4;
 var DEFAULT_WAKE_UP_READ_BUDGET = 12;
-var RESET_MARGIN_MS = 6e4;
 var DETAIL_CHARS = 240;
 var WakeUpTimeoutError = class extends Error {
   constructor(timeoutMs) {
@@ -17380,8 +17728,6 @@ var Supervisor = class {
   /** The run's end was reported: the scheduler can announce it more than once. */
   finished = false;
   runEndPending = false;
-  /** While the planner's usage limit holds wake-ups back: when it lets them go. */
-  limited = null;
   /** When each wake-up since the last pass was delivered, for the wake-up rate guard. */
   wakeUps = [];
   debounceMs;
@@ -17402,9 +17748,9 @@ var Supervisor = class {
   get awaitsRunEnd() {
     return this.runEndPending;
   }
-  /** Whether wake-ups alone may open a turn now: the supervisor watches, and no usage limit holds it. */
+  /** Whether wake-ups alone may open a turn now: the supervisor watches. A usage limit holds every turn, and is the planner turns' to wait out. */
   mayWake() {
-    return this.watching && this.limited === null;
+    return this.watching;
   }
   /**
    * What a wake-up turn is held to under the run's level. The brief is the
@@ -17471,8 +17817,6 @@ var Supervisor = class {
   /** The plan these events were about is gone: nothing gathered or waited on carries over. */
   reset() {
     this.disarm();
-    if (this.limited) clearTimeout(this.limited.timer);
-    this.limited = null;
     this.failures = 0;
     this.finished = false;
     this.runEndPending = false;
@@ -17523,9 +17867,13 @@ var Supervisor = class {
   }
   failed(err) {
     if (err instanceof PlannerTurnStoppedError || err instanceof PlannerTurnDiscardedError) return;
+    if (err instanceof PlannerUsageLimitError) {
+      if (err.resendAt === null) this.giveUp(`the planner hit its usage limit and ${err.held ?? "did not say when it resets"}`);
+      return;
+    }
     const reason = err instanceof Error ? err.message : String(err);
-    if (!(err instanceof WakeUpTimeoutError) && classifyRunnerStop(reason) === "usage-limit") {
-      this.waitForReset(reason);
+    if (!(err instanceof WakeUpTimeoutError) && !(err instanceof PlannerTurnFailedError) && classifyRunnerStop(reason) === "usage-limit") {
+      this.giveUp("the planner hit its usage limit and did not say when it resets");
       return;
     }
     this.failures++;
@@ -17536,22 +17884,6 @@ var Supervisor = class {
     }
     this.giveUp(`its wake-up turn failed twice (${brief(reason)})`);
   }
-  waitForReset(said2) {
-    const runner = this.host.plannerRunner();
-    const reset = runner ? readUsageLimitReset(runner, said2, new Date(this.now())) : null;
-    if (!reset) {
-      this.giveUp("the planner hit its usage limit and did not say when it resets");
-      return;
-    }
-    if (this.limited) clearTimeout(this.limited.timer);
-    const until = reset.getTime() + RESET_MARGIN_MS;
-    const timer = setTimeout(() => {
-      this.limited = null;
-      this.host.pump();
-    }, Math.max(0, until - this.now()));
-    this.limited = { until, timer };
-    this.host.notice("info", `The planner hit its usage limit. The supervisor's wake-ups wait until ${new Date(until).toISOString()}, and are delivered together then.`);
-  }
   /** The run goes on without a supervisor, and nothing that happened is lost (see {@link standDown}). */
   giveUp(reason) {
     this.host.goUnsupervised(reason);
@@ -17565,8 +17897,8 @@ var Supervisor = class {
   standDown() {
     this.disarm();
     this.runEndPending = false;
-    const held = this.policy.poll(Number.POSITIVE_INFINITY);
-    if (held) this.deliver(held);
+    const held2 = this.policy.poll(Number.POSITIVE_INFINITY);
+    if (held2) this.deliver(held2);
   }
   arm() {
     const due = this.policy.dueAt();
@@ -17757,78 +18089,224 @@ function runSettingsOf(settings) {
   }
   return out;
 }
+var SAVE_TRIES = 5;
+var LOCK_STALE_MS = 2e3;
+var LOCK_TIMEOUT_MS = 1e4;
+var LOCK_POLL_MS = 5;
+var LOCK_POLL_MAX_MS = 100;
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withFileLock(file, swap) {
+  const lock = `${file}.lock`;
+  const token = `${process.pid}:${randomUUID3()}`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  let last = null;
+  let poll = LOCK_POLL_MS;
+  for (; ; ) {
+    try {
+      const fd = fs10.openSync(lock, "wx");
+      try {
+        fs10.writeSync(fd, token);
+      } finally {
+        fs10.closeSync(fd);
+      }
+      break;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`Cannot save the settings file: ${lock} is still held after ${Math.round(LOCK_TIMEOUT_MS / 1e3)} seconds by a process that is not finishing, or it cannot be removed. Check for a process stuck saving there, and delete the file if there is none.`);
+    }
+    let holder;
+    let mtimeMs;
+    try {
+      holder = fs10.readFileSync(lock, "utf8");
+      mtimeMs = fs10.statSync(lock).mtimeMs;
+    } catch (err) {
+      if (gone(err)) {
+        last = null;
+        continue;
+      }
+      throw err;
+    }
+    const stale = Date.now() - mtimeMs > LOCK_STALE_MS;
+    if (last && last.token === holder && last.mtimeMs === mtimeMs && stale) {
+      unlinkLock(lock);
+      last = null;
+      continue;
+    }
+    last = stale ? { token: holder, mtimeMs } : null;
+    sleepSync(poll);
+    poll = Math.min(poll * 2, LOCK_POLL_MAX_MS);
+  }
+  try {
+    return swap();
+  } finally {
+    releaseLock(lock, token);
+  }
+}
+function gone(err) {
+  return err.code === "ENOENT";
+}
+function releaseLock(lock, token) {
+  let holder;
+  try {
+    holder = fs10.readFileSync(lock, "utf8");
+  } catch (err) {
+    if (gone(err)) return;
+    throw err;
+  }
+  if (holder === token) unlinkLock(lock);
+}
+function unlinkLock(lock) {
+  try {
+    fs10.unlinkSync(lock);
+  } catch (err) {
+    if (!gone(err)) throw err;
+  }
+}
 var SettingsService = class {
   filePath;
   cache = null;
-  cachedMtimeMs = null;
+  cachedStamp = null;
   constructor(filePath = getSettingsPath()) {
     this.filePath = filePath;
   }
   // Several processes share the settings file (VS Code extension host, web
-  // server, CLI), so the cache is keyed on the file's mtime: a write from any
+  // server, CLI), so the cache is keyed on the file's identity: a write from any
   // other process invalidates it. A stale cache here previously meant an
   // allowlist set in one surface never reached another's planner.
   getAll() {
-    const mtime = this.fileMtimeMs();
-    if (this.cache && mtime === this.cachedMtimeMs) return this.cache;
+    const stamp = this.fileStamp();
+    if (this.cache && stamp === this.cachedStamp) return this.cache;
     this.cache = this.load();
-    this.cachedMtimeMs = mtime;
+    this.cachedStamp = stamp;
     return this.cache;
   }
-  fileMtimeMs() {
+  /**
+   * Every write replaces the file, so its inode changes with it; the mtime
+   * alone cannot tell two writes apart on a filesystem whose timestamps are
+   * coarse, and a write that shares the last one's tick stayed unseen.
+   */
+  fileStamp(file = this.filePath) {
     try {
-      return fs10.statSync(this.filePath).mtimeMs;
+      const stat = fs10.statSync(file);
+      return `${stat.ino}:${stat.mtimeMs}:${stat.size}`;
     } catch {
       return null;
     }
   }
+  /**
+   * What a change is applied to: the file as it is now, never a copy held since
+   * an earlier read. Another process may have saved in between, and writing
+   * the whole file back would silently undo it.
+   */
+  current() {
+    this.cache = null;
+    return this.getAll();
+  }
+  /**
+   * Calls `listener` when another process (or this one) saves the file. The
+   * directory is watched, not the file: a write that swaps the file in leaves
+   * a watch on the old one pointing at nothing.
+   */
+  watch(listener) {
+    const dir = path25.dirname(this.filePath);
+    const name = path25.basename(this.filePath);
+    let seen = this.fileStamp();
+    let timer;
+    let watcher;
+    try {
+      fs10.mkdirSync(dir, { recursive: true });
+      watcher = fs10.watch(dir, (_event, changed) => {
+        if (changed && changed !== name) return;
+        clearTimeout(timer);
+        timer = setTimeout(() => {
+          const stamp = this.fileStamp();
+          if (stamp === seen) return;
+          seen = stamp;
+          listener();
+        }, 50);
+      });
+    } catch {
+      return { dispose() {
+      } };
+    }
+    return { dispose: () => {
+      clearTimeout(timer);
+      watcher.close();
+    } };
+  }
   getModelAllowlist(runner) {
     return this.getAll().modelAllowlist?.[runner];
   }
   setModelAllowlist(runner, ids) {
-    this.getAll();
-    if (ids === void 0) {
-      if (this.cache.modelAllowlist) {
-        delete this.cache.modelAllowlist[runner];
-        if (Object.keys(this.cache.modelAllowlist).length === 0) {
-          this.cache.modelAllowlist = void 0;
+    this.save(() => {
+      if (ids === void 0) {
+        if (this.cache.modelAllowlist) {
+          delete this.cache.modelAllowlist[runner];
+          if (Object.keys(this.cache.modelAllowlist).length === 0) {
+            this.cache.modelAllowlist = void 0;
+          }
         }
+      } else {
+        if (!this.cache.modelAllowlist) {
+          this.cache.modelAllowlist = {};
+        }
+        this.cache.modelAllowlist[runner] = ids;
       }
-    } else {
-      if (!this.cache.modelAllowlist) {
-        this.cache.modelAllowlist = {};
-      }
-      this.cache.modelAllowlist[runner] = ids;
-    }
-    this.persist();
+    });
   }
   getPlannerModel(provider) {
     return this.getAll().plannerModels?.[provider];
   }
   setPlannerModel(provider, entry) {
-    this.getAll();
-    if (entry === void 0) {
-      if (this.cache.plannerModels) {
-        delete this.cache.plannerModels[provider];
-        if (Object.keys(this.cache.plannerModels).length === 0) {
-          this.cache.plannerModels = void 0;
+    this.save(() => {
+      if (entry === void 0) {
+        if (this.cache.plannerModels) {
+          delete this.cache.plannerModels[provider];
+          if (Object.keys(this.cache.plannerModels).length === 0) {
+            this.cache.plannerModels = void 0;
+          }
         }
+      } else {
+        if (!this.cache.plannerModels) {
+          this.cache.plannerModels = {};
+        }
+        this.cache.plannerModels[provider] = entry.effort ? { model: entry.model, effort: entry.effort } : { model: entry.model };
       }
-    } else {
-      if (!this.cache.plannerModels) {
-        this.cache.plannerModels = {};
-      }
-      this.cache.plannerModels[provider] = entry.effort ? { model: entry.model, effort: entry.effort } : { model: entry.model };
-    }
-    this.persist();
+    });
   }
   getEnabledRunners() {
     return this.getAll().enabledRunners;
   }
   setEnabledRunners(ids) {
-    this.getAll();
-    this.cache.enabledRunners = [...ids];
-    this.persist();
+    this.save(() => {
+      this.cache.enabledRunners = [...ids];
+    });
+  }
+  /**
+   * Change the list from what the file holds at this moment: the change is
+   * handed the saved list (undefined when the user never chose) and its result
+   * is saved in the same call. A list worked out from an earlier read would
+   * save over what another surface set since. It may be handed the list again,
+   * when another process saved before this one could (see {@link save}).
+   */
+  updateEnabledRunners(change) {
+    return this.save(() => {
+      const next = [...change(this.cache.enabledRunners)];
+      this.cache.enabledRunners = next;
+      return next;
+    });
+  }
+  /** Save `ids` as the user's choice unless one is saved already, judged on the file as it is now. */
+  setEnabledRunnersIfUnset(ids) {
+    return this.save(() => {
+      if (this.cache.enabledRunners !== void 0) return false;
+      this.cache.enabledRunners = [...ids];
+      return true;
+    });
   }
   /**
    * Full or Guarded (ADR-0001), as saved here (ADR-0030). A value set in the
@@ -17846,9 +18324,9 @@ var SettingsService = class {
     return env !== void 0 && env.trim() !== "";
   }
   setAutonomousMode(enabled) {
-    this.getAll();
-    this.cache.autonomousMode = enabled;
-    this.persist();
+    this.save(() => {
+      this.cache.autonomousMode = enabled;
+    });
   }
   getRunSettings() {
     return runSettingsOf(this.getAll());
@@ -17860,11 +18338,11 @@ var SettingsService = class {
         throw new RunSettingsError(RUN_SETTING_CHECKS[key].refusal);
       }
     }
-    this.getAll();
-    for (const key of RUN_SETTING_KEYS) {
-      if (changes[key] !== void 0) this.cache[key] = changes[key];
-    }
-    this.persist();
+    this.save(() => {
+      for (const key of RUN_SETTING_KEYS) {
+        if (changes[key] !== void 0) this.cache[key] = changes[key];
+      }
+    });
     return this.getRunSettings();
   }
   load() {
@@ -17893,13 +18371,43 @@ var SettingsService = class {
     }
     return {};
   }
-  persist() {
+  /**
+   * Makes `change` to the file as it is now, and saves it. Another process can
+   * save between that read and this write; the file is looked at again just
+   * before ours replaces it, and when it moved the change is made afresh from
+   * what that process saved, so neither save undoes the other. A file that
+   * keeps moving is written over after {@link SAVE_TRIES} tries rather than
+   * never. The look and the swap are one step under the file's lock
+   * ({@link withFileLock}). A change that changes nothing writes nothing.
+   */
+  save(change) {
+    for (let tries = 1; ; tries++) {
+      const before = JSON.stringify(this.current());
+      const read2 = this.cachedStamp;
+      const result = change();
+      if (JSON.stringify(this.cache) === before || this.persist(tries < SAVE_TRIES ? read2 : void 0)) return result;
+    }
+  }
+  /** False, saving nothing, when the file is no longer the one stamped `expected`. */
+  persist(expected) {
     const dir = path25.dirname(this.filePath);
     if (!fs10.existsSync(dir)) {
       fs10.mkdirSync(dir, { recursive: true });
     }
-    fs10.writeFileSync(this.filePath, JSON.stringify(this.cache, null, 2));
-    this.cachedMtimeMs = this.fileMtimeMs();
+    const staging = `${this.filePath}.${process.pid}.tmp`;
+    fs10.writeFileSync(staging, JSON.stringify(this.cache, null, 2));
+    const stamp = this.fileStamp(staging);
+    const swapped = withFileLock(this.filePath, () => {
+      if (expected !== void 0 && this.fileStamp() !== expected) return false;
+      fs10.renameSync(staging, this.filePath);
+      return true;
+    });
+    if (!swapped) {
+      fs10.rmSync(staging, { force: true });
+      return false;
+    }
+    this.cachedStamp = stamp;
+    return true;
   }
 };
 
@@ -18383,7 +18891,7 @@ var EnvConfig = class extends BaseConfig {
 };
 
 // src/services/mergeResultNotice.ts
-function blockNotice({ repo, reason, files }) {
+function blockNotice({ repo, reason, files, expected, actual, rebasing }) {
   switch (reason) {
     case "merge-in-progress":
       return `${repo} has a merge in progress`;
@@ -18393,10 +18901,22 @@ function blockNotice({ repo, reason, files }) {
       return `${repo} has uncommitted changes to ${files.join(", ")}`;
     case "partial-landing":
       return `${repo} holds part of a task whose landing could not be rolled back`;
+    case "wrong-branch":
+      return `${repo === SELF_REPO ? "your checkout" : repo} is ${actual ? `on ${actual}` : rebasing ? "in the middle of a rebase" : "on a detached HEAD"}; this run started on ${expected}`;
     case "git-error":
       return `git could not check ${repo}`;
   }
 }
+function branchFix(blocked) {
+  if (blocked.length === 0 || blocked.some((b) => b.reason !== "wrong-branch")) return "";
+  const rebasing = blocked.filter((b) => b.rebasing);
+  if (rebasing.length > 0) {
+    const where = rebasing.map((b) => b.repo === SELF_REPO ? "your checkout" : b.repo).join(", ");
+    return ` Finish or abort the rebase in ${where}${rebasing.length < blocked.length ? " and check out the branch each other repository started on" : ""}, then press Merge all again.`;
+  }
+  const started = [...new Set(blocked.map((b) => b.expected))];
+  return started.length === 1 && blocked.length === 1 ? ` Check out ${started[0]} and press Merge all again.` : " Check out the branch each repository started on and press Merge all again.";
+}
 function landedNotice(landed2) {
   if (landed2.length === 0) return "Nothing was merged.";
   return landed2.length === 1 ? `${landed2[0]} was merged already and stays merged.` : `${landed2.join(", ")} were merged already and stay merged.`;
@@ -18413,7 +18933,7 @@ function describeMergeResult(result, branch, group, repaired = []) {
       return { level: "info", message: repaired.length > 0 ? `${base} ${repairedNotice(repaired)}` : base };
     }
     case "blocked":
-      return { level: "warn", message: `Merged nothing, so every tree is as it was: ${result.blocked.map(blockNotice).join("; ")}.` };
+      return { level: "warn", message: `Merged nothing, so every tree is as it was: ${result.blocked.map(blockNotice).join("; ")}.${branchFix(result.blocked)}` };
     case "conflict":
       return {
         level: "warn",
@@ -18777,7 +19297,7 @@ var GitWorktreeIsolation = class {
       path: repoPath,
       root,
       baseRef,
-      ...branch ? { baseBranch: branch } : {},
+      ...branch ? { baseBranch: branch } : { startedDetached: true },
       integrationBranch: integrationBranchFor(run.id)
     };
     if (!(await this.tryGit(root, ["branch", repo.integrationBranch, baseRef])).ok) return null;
@@ -19130,7 +19650,9 @@ var GitWorktreeIsolation = class {
   async mergeAll(run) {
     const partial = await this.settleLanding(run);
     if (partial.length > 0) return { outcome: "blocked", blocked: partial.map((repo) => ({ repo, reason: "partial-landing", files: [] })) };
+    const misplaced = await this.offBaseBranch(run.repos);
     const repos = await this.reposWithWork(run);
+    if (misplaced.length > 0) return { outcome: "blocked", blocked: misplaced };
     if (run.repos.length === 1 || !await this.canPreflight()) return this.mergeInTurn(repos);
     const blocked = [];
     for (const repo of repos) {
@@ -19148,6 +19670,27 @@ var GitWorktreeIsolation = class {
     }
     return withWork;
   }
+  /**
+   * A merge goes into whatever is checked out, which is only what the user
+   * meant if it is the branch the run started on. A run that started on a
+   * detached HEAD named no branch, so anything is as good as it was.
+   */
+  async offBaseBranch(repos) {
+    const off = [];
+    for (const repo of repos) {
+      if (!repo.baseBranch) continue;
+      const current = (await this.tryGit(repo.root, ["symbolic-ref", "--short", "-q", "HEAD"])).stdout.trim();
+      if (current === repo.baseBranch) continue;
+      off.push({
+        repo: repo.path,
+        reason: "wrong-branch",
+        files: [],
+        expected: repo.baseBranch,
+        ...current ? { actual: current } : await this.rebaseInProgress(repo.root) ? { rebasing: true } : {}
+      });
+    }
+    return off;
+  }
   /** `git merge-tree --write-tree`, which merges without touching a tree, arrived in git 2.38. */
   async canPreflight() {
     const version = await this.tryGit(void 0, ["--version"]);
@@ -19635,6 +20178,14 @@ var GitWorktreeIsolation = class {
     if ((await this.tryGit(cwd, ["rev-parse", "-q", "--verify", "MERGE_HEAD"])).ok) return true;
     return (await this.tryGit(cwd, ["ls-files", "-u"])).stdout.trim() !== "";
   }
+  /** A rebase leaves HEAD detached, so it is told from a checkout the user detached on purpose. */
+  async rebaseInProgress(cwd) {
+    for (const dir of ["rebase-merge", "rebase-apply"]) {
+      const found = await this.tryGit(cwd, ["rev-parse", "--git-path", dir]);
+      if (found.ok && fs13.existsSync(path28.resolve(cwd, found.stdout.trim()))) return true;
+    }
+    return false;
+  }
   async abortMerge(cwd) {
     if (!(await this.tryGit(cwd, ["merge", "--abort"])).ok) await this.tryGit(cwd, ["reset", "--hard"]);
   }
@@ -19655,6 +20206,29 @@ function createWorktreeIsolation(deps) {
   return new GitWorktreeIsolation(deps);
 }
 
+// src/services/mergeWording.ts
+function isRepoGroup(handoff) {
+  return handoff.repos.some((r) => r.path !== ".");
+}
+function reposWithWork(handoff) {
+  const withWork = handoff.repos.filter((r) => r.landed.length > 0);
+  return (withWork.length > 0 ? withWork : handoff.repos).map((r) => r.path);
+}
+function mergeTarget(handoff) {
+  if (!isRepoGroup(handoff)) return handoff.repos[0]?.baseBranch ?? "the branch you have checked out";
+  const targets = handoff.repos.filter((r) => reposWithWork(handoff).includes(r.path));
+  const branches = new Set(targets.map((r) => r.baseBranch));
+  const [only] = branches;
+  if (branches.size === 1 && only) return `${only} in each of ${targets.map((r) => r.path).join(", ")}`;
+  return `each of ${targets.map((r) => `${r.path} (${r.baseBranch ?? "as checked out"})`).join(", ")}`;
+}
+function checkoutRule(handoff) {
+  const named3 = handoff.repos.filter((r) => r.baseBranch);
+  if (named3.length === 0) return "";
+  if (!isRepoGroup(handoff)) return ` Nothing is merged unless ${named3[0].baseBranch} is checked out.`;
+  return " Nothing is merged unless each repository is on the branch it started on.";
+}
+
 // src/interfaces/ILogger.ts
 var ConsoleLogger = class {
   warn(scope, message, err) {
@@ -19707,7 +20281,10 @@ async function settleReply(opts) {
         opts.onProgress({ type: "interrupted" });
         return { done: turn };
       }
-      if (attempt.failure !== void 0) return { done: { ...message(attempt.failure), failed: true } };
+      if (attempt.failure !== void 0) {
+        const { usageLimit } = attempt;
+        return { done: { ...message(attempt.failure), failed: true, ...usageLimit !== void 0 && { usageLimit } } };
+      }
       if (!attempt.text.trim()) return { done: message(emptyReplyReport(deniedStep(attempt))) };
       const reply2 = opts.classify ? classifyPlannerReply(attempt.text, opts.classify) : { kind: "prose" };
       switch (reply2.kind) {
@@ -20638,7 +21215,7 @@ var CONVERSATION_TOOL_DEFINITIONS = toGeminiToolDeclarations(true);
 function tokenCount(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
-function usageRecordFrom(usage) {
+function usageRecordFrom(usage, model) {
   if (!usage) return void 0;
   const inputTokens = tokenCount(usage.promptTokenCount);
   const answerTokens = tokenCount(usage.candidatesTokenCount);
@@ -20646,6 +21223,7 @@ function usageRecordFrom(usage) {
   const reportedOutput = [answerTokens, thoughtTokens].filter((t) => t !== void 0);
   const record = {
     source: "google",
+    model,
     ...inputTokens !== void 0 ? { inputTokens } : {},
     ...reportedOutput.length > 0 ? { outputTokens: reportedOutput.reduce((a, b) => a + b, 0) } : {},
     ...tokenCount(usage.cachedContentTokenCount) !== void 0 ? { cachedInputTokens: tokenCount(usage.cachedContentTokenCount) } : {}
@@ -20654,15 +21232,31 @@ function usageRecordFrom(usage) {
   return anyReported ? record : void 0;
 }
 var GeminiResearchChat = class {
-  constructor(chat, hooks = {}) {
-    this.chat = chat;
+  constructor(getModel, open, hooks = {}) {
+    this.getModel = getModel;
+    this.open = open;
     this.hooks = hooks;
+    this.model = getModel();
+    this.chat = open(this.model);
   }
-  chat;
+  getModel;
+  open;
   hooks;
+  chat;
+  /** The model `chat` calls, named on its usage records. */
+  model;
+  /** The SDK binds a chat to one model, so a switch reopens it on the new one over the history so far. */
+  async current() {
+    const model = this.getModel();
+    if (model !== this.model) {
+      this.chat = this.open(model, await this.chat.getHistory());
+      this.model = model;
+    }
+    return this.chat;
+  }
   async sendMessage(text, signal) {
     if (signal?.aborted) throw new DOMException("Aborted", "AbortError");
-    const result = await this.chat.sendMessageStream(text);
+    const result = await (await this.current()).sendMessageStream(text);
     return this.consume(result.stream);
   }
   async sendToolResults(results, signal) {
@@ -20673,7 +21267,7 @@ var GeminiResearchChat = class {
         response: { output: r.output, truncated: r.truncated, totalChars: r.totalChars }
       }
     }));
-    const result = await this.chat.sendMessageStream(funcResponses);
+    const result = await (await this.current()).sendMessageStream(funcResponses);
     return this.consume(result.stream);
   }
   /**
@@ -20713,7 +21307,7 @@ var GeminiResearchChat = class {
         }
       }
     }
-    const usageRecord3 = usageRecordFrom(usage);
+    const usageRecord3 = usageRecordFrom(usage, this.model);
     if (usageRecord3) this.hooks.onUsage?.(usageRecord3);
     return {
       text,
@@ -20729,6 +21323,8 @@ var GeminiService = class extends BaseAiService {
   genAI = null;
   genAIKey = "";
   model = null;
+  /** The id `model` was made for; the SDK's own `model.model` is its `models/…` resource path. */
+  modelId = "";
   constructor(config) {
     super(config);
   }
@@ -20742,13 +21338,18 @@ var GeminiService = class extends BaseAiService {
     }
     return true;
   }
-  getPlanningModel() {
+  /** The planner model picked for this session, as the API names it. */
+  plannerModel() {
+    return normalizeGeminiModel(this.config.orchestratorModel || this.config.planningModel);
+  }
+  getPlanningModel(model = this.plannerModel()) {
     this.init();
-    if (!this.model || this.model.model !== this.config.planningModel) {
+    if (!this.model || this.modelId !== model) {
       this.model = this.genAI.getGenerativeModel({
-        model: this.config.planningModel,
+        model,
         generationConfig: { temperature: 0.3, topP: 0.95, maxOutputTokens: 16384 }
       });
+      this.modelId = model;
     }
     return this.model;
   }
@@ -20763,7 +21364,6 @@ var GeminiService = class extends BaseAiService {
   }
   async startConversation(req) {
     this.ensureInit();
-    const genModel = this.getPlanningModel();
     const contextStr = await BaseAiService.collectResearchContext(req.fs, req.runners);
     const systemPrompt = buildConversationSystemPrompt(
       req.goal,
@@ -20792,13 +21392,14 @@ ${m.content}` });
     if ((req.priorHistory?.length ?? 0) > 0 && seededHistory[seededHistory.length - 1].role === "user") {
       seededHistory.push({ role: "model", parts: [{ text: "Understood." }] });
     }
-    const chat = genModel.startChat({
-      history: seededHistory,
-      tools: [{ functionDeclarations: req.plannerTools ? CONVERSATION_TOOL_DEFINITIONS : TOOL_DEFINITIONS }],
+    const tools = [{ functionDeclarations: req.plannerTools ? CONVERSATION_TOOL_DEFINITIONS : TOOL_DEFINITIONS }];
+    const open = (model, history = seededHistory) => this.getPlanningModel(model).startChat({
+      history,
+      tools,
       generationConfig: { temperature: 0.3, topP: 0.95, maxOutputTokens: 16384 }
     });
     let currentProgress = req.onProgress;
-    const researchChat = new GeminiResearchChat(chat, {
+    const researchChat = new GeminiResearchChat(() => this.plannerModel(), open, {
       onReasoning: (text, segmentId) => currentProgress({ type: "thinking", text, segmentId }),
       onContent: (text, segmentId) => currentProgress({ type: "text_delta", text, segmentId }),
       onUsage: (record) => currentProgress({ type: "usage", record })
@@ -20871,18 +21472,17 @@ ${repairHint}` }] : parts;
   async researchAndPlan(userDescription, runners, modelsByRunner, fs18, onProgress, fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
     this.ensureInit();
     const { autonomousDefault } = modes;
-    const genModel = this.getPlanningModel();
     const contextStr = await BaseAiService.collectResearchContext(fs18, runners);
     const systemPrompt = buildResearchPrompt(userDescription, contextStr, modelsByRunner, runners, runnerModes, modes);
     const firstMessage = `${buildResearchToolsPrompt()}
 
 Explore the workspace to understand the codebase, then generate the plan.`;
-    const chat = genModel.startChat({
-      history: [{ role: "user", parts: [{ text: systemPrompt }] }],
+    const open = (model, history = [{ role: "user", parts: [{ text: systemPrompt }] }]) => this.getPlanningModel(model).startChat({
+      history,
       tools: [{ functionDeclarations: TOOL_DEFINITIONS }],
       generationConfig: { temperature: 0.3, topP: 0.95, maxOutputTokens: 16384 }
     });
-    const researchChat = new GeminiResearchChat(chat, {
+    const researchChat = new GeminiResearchChat(() => this.plannerModel(), open, {
       onUsage: (record) => onProgress({ type: "usage", record })
     });
     const result = await this.runResearchLoop(researchChat, firstMessage, fs18, onProgress, runners, void 0, fetcher, userDescription, runnerModes, autonomousDefault, signal);
@@ -20918,7 +21518,7 @@ import OpenAI from "openai";
 import { v4 as uuidv44 } from "uuid";
 var KEYLESS_PLACEHOLDER = "not-needed";
 var OpenAiResearchChat = class {
-  constructor(messages, getClient, getModel, tools, onReasoning, onContent, getSource = () => "openai", onUsage, contextWindow) {
+  constructor(messages, getClient, getModel, tools, onReasoning, onContent, getSource = () => "openai", onUsage) {
     this.messages = messages;
     this.getClient = getClient;
     this.getModel = getModel;
@@ -20927,7 +21527,6 @@ var OpenAiResearchChat = class {
     this.onContent = onContent;
     this.getSource = getSource;
     this.onUsage = onUsage;
-    this.contextWindow = contextWindow;
   }
   messages;
   getClient;
@@ -20937,7 +21536,6 @@ var OpenAiResearchChat = class {
   onContent;
   getSource;
   onUsage;
-  contextWindow;
   async sendMessage(text, signal) {
     this.answerAbandonedCalls();
     this.messages.push({ role: "user", content: text });
@@ -21052,7 +21650,6 @@ var OpenAiResearchChat = class {
       record.reportedCost = { amount: reported.cost, currency: "USD" };
       hasMeasure = true;
     }
-    if (this.contextWindow && this.contextWindow > 0) record.contextWindow = this.contextWindow;
     return hasMeasure ? record : void 0;
   }
 };
@@ -21179,8 +21776,7 @@ ${buildResearchToolsPrompt()}` }
       (delta, segmentId) => currentProgress({ type: "thinking", text: delta, segmentId }),
       (delta, segmentId) => currentProgress({ type: "text_delta", text: delta, segmentId }),
       () => this.config.aiProvider,
-      (record) => currentProgress({ type: "usage", record }),
-      req.contextWindow
+      (record) => currentProgress({ type: "usage", record })
     );
     const ctx = {
       chat,
@@ -21742,6 +22338,10 @@ var VerdictEngine = class {
     this.generations.clear();
   }
 };
+var EXIT_CHECK = "exit_code";
+function endedByExit(verdict) {
+  return verdict.checks.some((check2) => check2.name === EXIT_CHECK);
+}
 function exitVerdict(exitCode) {
   const normalized2 = exitCode == null ? 0 : exitCode;
   const exitOk = normalized2 === 0;
@@ -21750,7 +22350,7 @@ function exitVerdict(exitCode) {
     reason: exitOk ? "Failed verification: the runner exited cleanly but never called task_complete." : `Failed verification: the runner exited with code ${normalized2} without calling task_complete.`,
     checks: [
       { name: "task_complete", passed: false, skipped: false, detail: "the runner exited before calling task_complete" },
-      { name: "exit_code", passed: exitOk, skipped: false, detail: exitOk ? "the runner exited cleanly (code 0)" : `the runner exited with code ${normalized2}` }
+      { name: EXIT_CHECK, passed: exitOk, skipped: false, detail: exitOk ? "the runner exited cleanly (code 0)" : `the runner exited with code ${normalized2}` }
     ],
     decidedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -21949,6 +22549,7 @@ var PlanStore = class {
     this.rebuild();
     for (const task of this._allTasks) {
       if (task.status === "failed") task.status = "pending";
+      if (task.runnerSessionId && !task.runnerSessionOwner) task.runnerSessionOwner = sessionOwner(task) ?? task.assignedRunner;
     }
     this.validateAssignedRunners();
   }
@@ -22078,9 +22679,17 @@ var PlanStore = class {
     const task = this._taskMap.get(id);
     if (task) task.outputSummary = summary;
   }
-  setTaskRunnerSessionId(id, runnerSessionId) {
+  /** The owner is saved with the session it belongs to, and dropped with it. */
+  setTaskRunnerSessionId(id, runnerSessionId, owner) {
+    const task = this._taskMap.get(id);
+    if (!task) return;
+    task.runnerSessionId = runnerSessionId;
+    if (runnerSessionId && owner) task.runnerSessionOwner = owner;
+    else delete task.runnerSessionOwner;
+  }
+  setCarriedFrom(id, runner) {
     const task = this._taskMap.get(id);
-    if (task) task.runnerSessionId = runnerSessionId;
+    if (task) task.carriedFrom = runner;
   }
   clearCarriedFrom(id) {
     const task = this._taskMap.get(id);
@@ -22094,9 +22703,9 @@ var PlanStore = class {
     const task = this._taskMap.get(id);
     if (task?.attemptUsage) task.attemptUsage = task.attemptUsage.map((usage) => usage.attempt === attempt ? addAttemptUsage(usage, record, now) : usage);
   }
-  endAttemptUsage(id, attempt, now) {
+  endAttemptUsage(id, attempt, now, runnerSessionCost, sessionId) {
     const task = this._taskMap.get(id);
-    if (task?.attemptUsage) task.attemptUsage = task.attemptUsage.map((usage) => usage.attempt === attempt ? endAttemptUsage(usage, now) : usage);
+    if (task?.attemptUsage) task.attemptUsage = task.attemptUsage.map((usage) => usage.attempt === attempt ? endAttemptUsage(usage, now, runnerSessionCost, sessionId) : usage);
   }
   setTaskAttemptSkills(id, skills) {
     const task = this._taskMap.get(id);
@@ -22954,6 +23563,8 @@ function conflictResolverTask(task, run, plan) {
 }
 
 // src/services/UsageLimitWaits.ts
+var RESUME_MARGIN_MS = 6e4;
+var RELAPSE_MS = 5 * 6e4;
 var UsageLimitWaits = class {
   constructor(onDue) {
     this.onDue = onDue;
@@ -23076,6 +23687,9 @@ function selectReadyTasks(input) {
     gated
   };
 }
+function isBlocked(task, store) {
+  return blockedIn(task, blockingFailures(store.allTasks));
+}
 var blockedIn = (task, blocked) => task.status === "blocked" || blocked.has(task.id);
 function dependencyMet(depId, store, runs) {
   return waitingBehind([depId], store, runs).length === 0;
@@ -23205,6 +23819,12 @@ var TaskOrchestrator = class _TaskOrchestrator {
    * task whose spawn always throws.
    */
   onHold = /* @__PURE__ */ new Set();
+  /**
+   * Force starts queued behind dependencies the scheduler will not start them
+   * after: outside a run it drives, or past a failed dependency, which it
+   * never forces. Each starts once those still under way have finished.
+   */
+  queuedStarts = /* @__PURE__ */ new Set();
   /**
    * Tasks Mark complete is landing after it ended their attempt: in progress
    * with no attempt for as long as that takes, and not orphans for it.
@@ -23226,6 +23846,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
   observers = [];
   skillsAt;
   previousAttemptFromLog;
+  lastLoggedAttempt;
   runSettings;
   isApproved;
   constructor(deps) {
@@ -23241,6 +23862,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
     this.workspaceEnv = deps.workspaceEnv;
     this.skillsAt = deps.skillsAt;
     this.previousAttemptFromLog = deps.previousAttemptFromLog;
+    this.lastLoggedAttempt = deps.lastLoggedAttempt;
     this.runSettings = deps.runSettings;
     this.isApproved = deps.isApproved;
     this.store.onMutate = () => this.emit("onTaskChanged");
@@ -23305,6 +23927,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
       workspaceEnv: options.workspaceEnv ?? ((cwd) => resolveWorkspaceEnv(cwd)),
       skillsAt: options.skillsAt ?? ((roots) => new SkillsService(roots)),
       previousAttemptFromLog: options.previousAttemptFromLog ?? (() => null),
+      lastLoggedAttempt: options.lastLoggedAttempt ?? (() => 0),
       runSettings: options.runSettings ?? (() => void 0),
       isApproved: options.isApproved ?? (() => true)
     });
@@ -23561,10 +24184,10 @@ var TaskOrchestrator = class _TaskOrchestrator {
    */
   holdStarts() {
     this.startHolds++;
-    let held = true;
+    let held2 = true;
     return () => {
-      if (!held) return;
-      held = false;
+      if (!held2) return;
+      held2 = false;
       this.startHolds--;
     };
   }
@@ -23575,24 +24198,25 @@ var TaskOrchestrator = class _TaskOrchestrator {
    */
   admitStart() {
     const generation2 = this.stopGeneration;
-    let held = true;
+    let held2 = true;
     this.admissions++;
     return {
       current: () => generation2 === this.stopGeneration,
       release: () => {
-        if (!held) return;
-        held = false;
+        if (!held2) return;
+        held2 = false;
         this.admissions--;
       }
     };
   }
   /**
    * Something can still start that nobody has to ask for again: a start
-   * admitted and not yet claimed, or a task that resumes on its own at its
-   * usage limit's reset. A Stop is owed to it, whether or not anything runs.
+   * admitted and not yet claimed, a force start queued behind its
+   * dependencies, or a task that resumes on its own at its usage limit's
+   * reset. A Stop is owed to it, whether or not anything runs.
    */
   get startsPending() {
-    return this.admissions > 0 || this.store.allTasks.some(waitsForReset);
+    return this.admissions > 0 || this.queuedStarts.size > 0 || this.store.allTasks.some(waitsForReset);
   }
   /** Run `work`, which awaits before it claims, under an admission it holds throughout; it is handed the generation it was admitted under. */
   async whileAdmitted(work) {
@@ -23691,6 +24315,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
     this.retryCounts.clear();
     this.spawnCounts.clear();
     this.onHold.clear();
+    this.queuedStarts.clear();
     this.recoverOrphans();
     this.rearmLimitWaits();
   }
@@ -23778,6 +24403,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
     }
     this.runs.interrupt();
     this.onHold.clear();
+    if (reason === "user") this.queuedStarts.clear();
     for (const t of this.store.allTasks.filter(waitsForReset)) this.cancelScheduledResume(t.id);
     this.sayStopped(stopped);
     this.recoverOrphans();
@@ -23877,6 +24503,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
     const attempt = this.attempts.get(taskId);
     if (!task || !attempt) return;
     attempt.decided = true;
+    const stoppedMidTurn = endedByExit(verdict) ? saidInFlight(attempt) : null;
     console.error(`[TaskOrchestrator] Task ${taskRefOf(this.store.planTasks, task.id) ?? `#${task.order}`} "${task.title}" verdict=${verdict.outcome}`);
     console.error(`[TaskOrchestrator] Runner: ${task.assignedRunner}, Model: ${task.assignedModel?.modelId ?? "default"}`);
     console.error(`[TaskOrchestrator] Prompt preview: ${(task.prompt ?? "").slice(0, 200)}`);
@@ -23898,8 +24525,8 @@ ${summary || "(empty: no output captured)"}`);
       this.tell("warn", `Ops task "${task.title}" finished, but changed tracked files in your checkout: ${capConflictFiles(changedFiles)}. An ops task must not change repository files, so nothing was committed: look at the changes, then mark it complete or retry it.`);
     } else if (landing) {
       await this.applyLanding(task, landing, () => this.notifications.info(`Task "${task.title}" completed.`));
-    } else if (classifyRunnerStop(attempt.session?.getOutput() ?? "") === "usage-limit") {
-      this.pauseOnLimit(task, attempt, attempt.session?.getOutput() ?? "");
+    } else if (stoppedMidTurn !== null && classifyRunnerStop(stoppedMidTurn) === "usage-limit") {
+      this.pauseOnLimit(task, attempt, stoppedMidTurn);
       if (attempt.worktree) await this.runs.release(taskId, { keep: true });
     } else {
       this.store.markFailed(taskId);
@@ -23914,16 +24541,17 @@ ${summary || "(empty: no output captured)"}`);
     const status = this.store.get(taskId)?.status;
     if (status === "completed" || status === "failed" || status === "awaiting_user") this.emit("onTaskSettled", { taskId });
     this.emit("onTaskChanged");
-    if (!this.running) {
-      if (this.attempts.size === 0) {
-        if (this.store.isFinished()) this.planStatus = "completed";
-        this.emit("onTick");
-        if (this.settled) await this.closeRun();
-        this.emit("onExecutionComplete");
-      }
+    if (this.running) {
+      await this.tick();
       return;
     }
-    await this.tick();
+    await this.startQueued();
+    if (this.attempts.size === 0) {
+      if (this.store.isFinished()) this.planStatus = "completed";
+      this.emit("onTick");
+      if (this.settled) await this.closeRun();
+      this.emit("onExecutionComplete");
+    }
   }
   /**
    * A repair's verdict never replaces the verdict the task's own work earned,
@@ -24191,11 +24819,17 @@ ${summary || "(empty: no output captured)"}`);
       const resumes = this.awaitsResume;
       this.retryCounts.set(taskId, (this.retryCounts.get(taskId) ?? 0) + 1);
       const ended = this.endAttempt(taskId, "retry");
+      const movedFrom = this.movedFrom(task);
       this.store.retry(taskId);
+      if (movedFrom) this.store.setCarriedFrom(taskId, movedFrom);
       this.store.unblockDependents(taskId);
       this.onHold.delete(taskId);
       this.emit("onTaskChanged");
-      await this.runs.release(taskId, { keep: false }, ended?.integration);
+      if (movedFrom) {
+        await ended?.integration;
+      } else {
+        await this.runs.release(taskId, { keep: false }, ended?.integration);
+      }
       if (admittedAt !== this.stopGeneration) return;
       if (resumes) await this.start(origin);
       else await this.tick();
@@ -24246,6 +24880,16 @@ ${summary || "(empty: no output captured)"}`);
     this.emit("onTaskChanged");
     return true;
   }
+  /**
+   * The runner whose attempt left the task's work, when the task has been
+   * moved off it since: a session cannot cross runners, so whatever starts
+   * the task next is a carry-over of that work, the rule a paused task's move
+   * follows (ADR-0018, U1).
+   */
+  movedFrom(task) {
+    const owner = sessionOwner(task);
+    return owner && owner !== this.store.resolveTaskRunner(task) ? owner : void 0;
+  }
   /**
    * Run before writing assignments so cancellation sees the old runner's
    * shared wait. A session cannot cross runners, so the next attempt is a
@@ -24303,7 +24947,7 @@ ${summary || "(empty: no output captured)"}`);
     const summary = this.output.finalText(taskId);
     this.endAttempt(taskId, "usage-limit");
     this.pauseOnLimit(task, attempt, attempt.turnError ?? "");
-    this.store.setTaskOutputSummary(taskId, summarizeOutput(attempt.turnError ?? `${attempt.runner} hit its usage limit`, summary));
+    this.store.setTaskOutputSummary(taskId, summarizeOutput(attempt.turnError?.message ?? `${attempt.runner} hit its usage limit`, summary));
     if (attempt.worktree) await this.runs.release(taskId, { keep: true });
     await this.afterVerdict(taskId);
   }
@@ -24402,10 +25046,14 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
     return false;
   }
   /**
-   * Manually start a single AI task right now, bypassing dependency/readiness
-   * gating (the "force start" affordance on a task card) but never the claim:
-   * it still needs the user's approval, a free slot, and no Stop since it was
-   * asked for, and throws {@link TaskControlError} saying which it lacks.
+   * Manually start a single AI task right now (the "force start" affordance on
+   * a task card), past a failed dependency (ADR-0034) or a merge gate
+   * (ADR-0020), but never past the claim: it still needs the user's approval,
+   * a free slot, and no Stop since it was asked for, and throws
+   * {@link TaskControlError} saying which it lacks. A dependency still under
+   * way or yet to run is not forced past: the task is released to the
+   * scheduler instead, which starts it once they finish, and the line saying
+   * so is the answer.
    * Reuses the scheduler's own claim so a force-started task gets the same
    * augmented prompt, session tracking, and exit handling — callers must not
    * re-spawn the runner themselves. No-op if the task is unknown, not an AI
@@ -24416,8 +25064,12 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
     if (!task || task.type !== "ai") return;
     if (this.attempts.has(taskId)) return;
     this.refuseOpsDuringMerge(task);
+    const queued2 = this.queuedBehindDependencies(task);
+    if (queued2) return queued2;
     await this.whileAdmitted(async (admittedAt) => {
-      if (!await this.openForAdmitted(taskId, origin, () => this.forceStartTask(taskId, origin), admittedAt)) return;
+      if (!await this.openForAdmitted(taskId, origin, async () => {
+        await this.forceStartTask(taskId, origin);
+      }, admittedAt)) return;
       if (this.attempts.has(taskId)) return;
       this.refuseOpsDuringMerge(task);
       this.refuseClaim(task, admittedAt);
@@ -24426,6 +25078,68 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
       await this.claimed(task, admittedAt);
     });
   }
+  /**
+   * A force start of a task whose dependencies are still under way or yet to
+   * run: started now, it would build on work that is not there, so it waits
+   * for them in the run, off any hold, and says so. Dependencies are never
+   * bypassed silently. A blocked task is forced past its failure as asked.
+   */
+  queuedBehindDependencies(task) {
+    const waiting = this.underWayBefore(task);
+    if (waiting.length === 0) return null;
+    this.onHold.delete(task.id);
+    if (!this.running || isBlocked(task, this.store)) this.queuedStarts.add(task.id);
+    const names = waiting.map((id) => `task "${this.store.get(id)?.title ?? id}"`);
+    const listed3 = names.length === 1 ? names[0] : `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`;
+    const idle = this.running || waiting.some((id) => this.attempts.has(id)) ? "" : " Nothing is running now: run the plan to start them.";
+    const queued2 = `Task "${task.title}" is approved and starts once ${listed3} ${names.length === 1 ? "finishes" : "finish"}.${idle}`;
+    this.tell("info", queued2);
+    this.emit("onTaskChanged");
+    return queued2;
+  }
+  /**
+   * A task's unmet dependencies, less the failed or blocked ones a force start
+   * goes past. A blocked one is gone past for its failure only: the work under
+   * way or yet to run that it waits on is still waited for, through it.
+   */
+  underWayBefore(task) {
+    const blocked = blockingFailures(this.store.allTasks);
+    const waiting = /* @__PURE__ */ new Set();
+    const seen = /* @__PURE__ */ new Set();
+    const walk = (of) => {
+      for (const id of unmetDependencies(of, this.store, this.runs)) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        const dep = this.store.get(id);
+        if (dep?.status === "failed") continue;
+        if (dep && (dep.status === "blocked" || blocked.has(id))) walk(dep);
+        else waiting.add(id);
+      }
+    };
+    walk(task);
+    return [...waiting];
+  }
+  /**
+   * Starts the queued force starts whose dependencies have now finished. One
+   * the scheduler now drives the run for, and nothing blocks, is left to it.
+   */
+  async startQueued() {
+    for (const id of [...this.queuedStarts]) {
+      const task = this.store.get(id);
+      if (!task || this.attempts.has(id) || task.status === "completed" || task.status === "skipped") {
+        this.queuedStarts.delete(id);
+        continue;
+      }
+      if (this.underWayBefore(task).length > 0) continue;
+      this.queuedStarts.delete(id);
+      if (this.running && !isBlocked(task, this.store)) continue;
+      try {
+        await this.forceStartTask(id);
+      } catch (err) {
+        this.tell("warn", `Task "${task.title}" did not start once its dependencies finished: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  }
   refuseOpsDuringMerge(task) {
     if (this.merging && mergeExcludes(this.nextAttemptKind(task.id))) {
       throw new TaskControlError(`A Merge all is under way: ops task "${task.title}" can start once it has finished.`);
@@ -24490,6 +25204,7 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
   async tick() {
     const admittedAt = this.stopGeneration;
     this.recoverOrphans();
+    await this.startQueued();
     if (!this.running) {
       if (this.attempts.size === 0 && this.runs.isOpen && this.settled) await this.closeRun();
       return;
@@ -24646,7 +25361,7 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
     if (refused3) return { refused: refused3 };
     const attempt = {
       taskId: task.id,
-      attempt: Math.max(this.spawnCounts.get(task.id) ?? 0, ...task.attemptUsage?.map((u) => u.attempt) ?? []) + 1,
+      attempt: Math.max(this.spawnCounts.get(task.id) ?? 0, this.lastLoggedAttempt(task.id), ...task.attemptUsage?.map((u) => u.attempt) ?? []) + 1,
       phase: "starting",
       session: null,
       runner: this.store.resolveTaskRunner(task),
@@ -24660,6 +25375,7 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
       skills: [],
       autoResumed: opts.autoResumed === true,
       turnError: null,
+      turnOutputFrom: 0,
       reminded: false
     };
     this.spawnCounts.set(task.id, attempt.attempt);
@@ -24733,6 +25449,8 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
         title: task.title,
         env,
         resumeSessionId: kind.kind === "continuation" ? kind.resumeSessionId : void 0,
+        resumeCost: kind.kind === "continuation" ? countedSessionCost(task.attemptUsage, kind.resumeSessionId) : void 0,
+        resumeWindow: kind.kind === "continuation" ? resumedSessionWindow(task.attemptUsage, attempt.runner, attempt.attempt, kind.resumeSessionId) : void 0,
         attempt: attempt.attempt,
         ...attempt.skills.length > 0 ? { skills: attempt.skills } : {},
         onNotice: (message) => this.tell("warn", `Task "${task.title}": ${message}`)
@@ -24757,8 +25475,21 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
       this.output.attach(task.id, session);
       this.verifier.watch(task, session);
       session.onEvent((event) => {
-        if (event.type === "turn_start") attempt.turnError = null;
-        else if (event.type === "error") attempt.turnError = event.message;
+        if (event.type === "turn_start") {
+          attempt.turnError = null;
+          attempt.turnOutputFrom = session.getOutput().length;
+        } else if (event.type === "error") attempt.turnError = event;
+        else if (event.type === "model_switched" || event.type === "model_drifted") {
+          this.emit("onModelSwitched", {
+            taskId: task.id,
+            sessionId: session.id,
+            from: event.from,
+            model: event.to,
+            ...event.type === "model_switched" && event.effort ? { effort: event.effort } : {},
+            asked: event.type === "model_switched",
+            attemptEnded: this.attempts.get(task.id) !== attempt
+          });
+        }
       });
       session.onTurnEnd((reason) => this.onTurnEnd(task.id, attempt, session, reason));
       return true;
@@ -24768,6 +25499,16 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
         return false;
       }
       this.endAttempt(task.id, "spawn-failed");
+      const refusal = err instanceof Error ? err.message : String(err);
+      if (attempt.kind.kind !== "repair" && classifyRunnerStop(refusal) === "usage-limit") {
+        this.pauseOnLimit(task, attempt, refusal);
+        this.store.setTaskOutputSummary(task.id, summarizeOutput(refusal, ""));
+        await this.runs.release(task.id, { keep: true });
+        this.emit("onTaskSettled", { taskId: task.id });
+        this.emit("onTaskChanged");
+        await this.tick();
+        return false;
+      }
       if (attempt.kind.kind === "continuation") {
         const refused3 = err instanceof RunnerStartupExit;
         const reason = refused3 ? unresumedMessage(task, `${attempt.runner} could not find its saved session`) : unresumedMessage(task, `could not start: ${err instanceof Error ? err.message : String(err)}`);
@@ -24887,12 +25628,13 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
   endAttempt(taskId, reason) {
     const attempt = this.attempts.get(taskId);
     this.attempts.delete(taskId);
+    const session = attempt?.session ?? null;
+    const nativeSessionId = session?.nativeSessionId() ?? null;
     if (attempt) {
-      this.store.endAttemptUsage(taskId, attempt.attempt, (/* @__PURE__ */ new Date()).toISOString());
+      this.store.endAttemptUsage(taskId, attempt.attempt, (/* @__PURE__ */ new Date()).toISOString(), session?.sessionCost?.() ?? void 0, nativeSessionId ?? void 0);
       this.output.detach(taskId);
     }
-    const session = attempt?.session ?? null;
-    if (session) this.saveNativeSession(taskId, session.nativeSessionId());
+    if (attempt && session) this.saveNativeSession(taskId, nativeSessionId, attempt.runner);
     if (stopsRunner(reason)) {
       const task = this.store.get(taskId);
       if (task) this.verifier.clear(task);
@@ -24901,8 +25643,8 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
     return attempt;
   }
   /** Kept on the task once the attempt ends, so a continue can resume it after a reload (ADR-0018, K1). */
-  saveNativeSession(taskId, nativeSessionId) {
-    if (nativeSessionId) this.store.setTaskRunnerSessionId(taskId, nativeSessionId);
+  saveNativeSession(taskId, nativeSessionId, runner) {
+    if (nativeSessionId) this.store.setTaskRunnerSessionId(taskId, nativeSessionId, runner);
   }
   endAllAttempts(reason) {
     const ended = [...this.attempts.values()];
@@ -24912,13 +25654,17 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
     return ended;
   }
 };
-var RESUME_MARGIN_MS = 6e4;
-var RELAPSE_MS = 5 * 6e4;
 var LIMIT_RESET_MESSAGE = "Your usage limit has reset. Carry on with the task from where you stopped.";
 var OPS_RETRY_TAIL_LINES = 60;
 function unresumedMessage(task, why) {
   return `Could not continue task "${task.title}": ${why}. Retry starts it afresh.`;
 }
+function saidInFlight(attempt) {
+  const session = attempt.session;
+  if (!session || session.turnState() !== "working") return null;
+  if (attempt.turnError?.usageLimit !== void 0) return attempt.turnError;
+  return session.getOutput().slice(attempt.turnOutputFrom);
+}
 
 // src/services/Planner.ts
 function plannerModesWith(req) {
@@ -25021,15 +25767,15 @@ var ModelResolver = class {
     return toOrchestratorOptions({}, ORCHESTRATOR_SHORTCUTS);
   }
   async modelsForRunners(runners) {
-    const out = {};
-    for (const runner of runners) {
+    const unique = [...new Set(runners)];
+    const discovered = await Promise.all(unique.map(async (runner) => {
       try {
-        out[runner] = await this.discovery.discover(runner);
+        return [runner, await this.discovery.discover(runner)];
       } catch {
-        out[runner] = [];
+        return [runner, []];
       }
-    }
-    return out;
+    }));
+    return Object.fromEntries(discovered);
   }
   async pickerOptions() {
     if (this.cachedPickerOptions) return this.cachedPickerOptions;
@@ -25076,21 +25822,18 @@ var ModelResolver = class {
     return this.cachedPickerOptions ?? [];
   }
   /**
-   * The planner model's context window, from whatever catalog is already
-   * cached (#49): a vendor model comes from the picker catalog, a harness
-   * planner's model from the runner's own discovered models. Reads only —
-   * never triggers a fetch or discovery of its own, so an unknown window stays
-   * unknown and context fill is omitted rather than guessed.
+   * A model's context window from whatever catalog is already cached (#49),
+   * for a usage record whose reporter stated none: a vendor's model from the
+   * picker catalog (its own `/models` endpoint), a runner's model from that
+   * runner's own discovered listing. `source` is the record's reporter, and
+   * `model` the id it named. Reads only — never triggers a fetch or discovery
+   * of its own, so an unknown window stays unknown and context fill is
+   * omitted rather than guessed.
    */
-  contextWindowFor(modelId) {
-    if (!modelId) return void 0;
-    const picker = this.cachedPickerOptions?.find((o) => o.id === modelId)?.contextWindow;
-    if (picker && picker > 0) return picker;
-    for (const runner of this.config.enabledRunners ?? []) {
-      const found = this.discovery.getCached(runner)?.find((m) => m.modelId === modelId)?.contextWindow;
-      if (found && found > 0) return found;
-    }
-    return void 0;
+  contextWindowFor(source, model) {
+    if (!model) return void 0;
+    const window = isApiProvider(source) ? this.cachedPickerOptions?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.contextWindow : this.discovery.getCached(source)?.find((m) => m.modelId === model)?.contextWindow;
+    return window && window > 0 ? window : void 0;
   }
   invalidate() {
     this.discovery.clear();
@@ -25116,24 +25859,28 @@ var defaultExec3 = async (command, options) => {
   return { stdout: String(stdout) };
 };
 var CHECK_TIMEOUT_MS = 8e3;
+var NEGATIVE_TTL_MS2 = 6e4;
 var RunnerInstallation = class {
   cache = /* @__PURE__ */ new Map();
   inflight = /* @__PURE__ */ new Map();
   registry;
   execImpl;
-  constructor(registry, execImpl = defaultExec3) {
+  now;
+  constructor(registry, execImpl = defaultExec3, now = Date.now) {
     this.registry = registry;
     this.execImpl = execImpl;
+    this.now = now;
   }
   /** True if the runner's CLI responds to `--version`. Cached per process. */
   async isInstalled(runner) {
-    if (this.cache.has(runner)) return this.cache.get(runner);
+    const cached2 = this.cache.get(runner);
+    if (cached2 && (cached2.installed || this.now() - cached2.at < NEGATIVE_TTL_MS2)) return cached2.installed;
     const existing = this.inflight.get(runner);
     if (existing) return existing;
     const manifest = this.registry.getManifest(runner);
     const command = manifest?.runner.command;
     if (!command) {
-      this.cache.set(runner, false);
+      this.cache.set(runner, { installed: false, at: this.now() });
       return false;
     }
     const probe = (async () => {
@@ -25144,13 +25891,22 @@ var RunnerInstallation = class {
         return false;
       }
     })().then((installed) => {
-      this.cache.set(runner, installed);
+      this.cache.set(runner, { installed, at: this.now() });
       this.inflight.delete(runner);
       return installed;
     });
     this.inflight.set(runner, probe);
     return probe;
   }
+  /**
+   * Forget cached "not installed" verdicts so the next probe re-runs them. A
+   * runner-list refresh calls this, so a CLI installed while the host runs is
+   * offered without a restart. An installed verdict stays: it cannot have
+   * changed without the binary going away, and re-probing one costs a spawn.
+   */
+  refresh() {
+    for (const [runner, probe] of this.cache) if (!probe.installed) this.cache.delete(runner);
+  }
   /**
    * Whether this runner can serve as a harness planner (ADR-0009, T9), and why
    * not when it cannot. Surfaces call this to grey out an unusable agent in the
@@ -25581,6 +26337,8 @@ var PlannerSession = class {
    * outlives the session — nothing from one goal may reach the next.
    */
   nativeSessionId = null;
+  /** What was counted of that session's running cost, so a resume counts on from it rather than dropping its first turn. */
+  sessionCost = null;
   /** Set once the first spawn attached. */
   start = null;
   /**
@@ -25771,6 +26529,7 @@ var CliAgentAiService = class {
         // hit its rate limit, or lost its login must say so in the chat rather
         // than leave an empty planner bubble.
         failure: turn.error,
+        usageLimit: turn.usageLimit,
         fullText: [...carried, turn.text].filter((part) => part.trim()).join("\n\n")
       };
     };
@@ -25837,6 +26596,7 @@ var CliAgentAiService = class {
     };
     const subagentUsage = /* @__PURE__ */ new Map();
     let error;
+    let usageLimit;
     let stepIndex = 0;
     let backgroundAgents = 0;
     const truncate = (value) => value.length > LOG_MAX_CHARS ? `${value.slice(0, LOG_MAX_CHARS)}
@@ -25945,6 +26705,7 @@ var CliAgentAiService = class {
         }
         case "error":
           error = event.message;
+          usageLimit = event.usageLimit;
           return;
         case "turn_end":
           return;
@@ -25963,12 +26724,13 @@ var CliAgentAiService = class {
       settle(id, "The agent ended the turn without reporting this call's result.", false, "not_executed");
     }
     session.nativeSessionId = adapter.nativeSessionId() ?? session.nativeSessionId;
+    session.sessionCost = adapter.sessionCost?.() ?? session.sessionCost;
     if (error || signal?.aborted) session.stop();
     if (error) {
       const failure = failureAfterReply(text.slice(finalRunStart), Math.max(blockStart, finalRunStart) - finalRunStart, error);
       onProgress({ type: "text_retracted", segmentId: finalSegment });
       text = text.slice(0, finalRunStart);
-      return { text, researchLog, error: failure, aborted: signal?.aborted, backgroundAgents };
+      return { text, researchLog, error: failure, usageLimit, aborted: signal?.aborted, backgroundAgents };
     }
     return { text, researchLog, error, aborted: signal?.aborted, backgroundAgents };
   }
@@ -26024,7 +26786,7 @@ var CliAgentAiService = class {
     session.stop();
     const start = session.start;
     if (!start) throw new Error("No active planner conversation.");
-    return this.startAdapter({ ...start.startOptions, resumeSessionId: session.nativeSessionId ?? void 0 }, start.tools, session);
+    return this.startAdapter({ ...start.startOptions, resumeSessionId: session.nativeSessionId ?? void 0, resumeCost: session.sessionCost ?? void 0 }, start.tools, session);
   }
   /**
    * What the planner gets of the repository's config, its runner being
@@ -26036,9 +26798,9 @@ var CliAgentAiService = class {
     const reader = connectorFor(this.runner)?.repoConfig;
     if (!reader) return { systemPrompt };
     const found = reader.projectServers(cwd);
-    const { started, held } = await decideProjectServers(found.servers, { repoRoot: repoRoot(cwd), approval, approvals: this.projectServerApprovals });
+    const { started, held: held2 } = await decideProjectServers(found.servers, { repoRoot: repoRoot(cwd), approval, approvals: this.projectServerApprovals });
     return {
-      systemPrompt: [systemPrompt, instructionsBlock(reader.instructions(cwd)), heldServersNote(held.map((server4) => ({ server: server4, reason: NOT_APPROVED })), found.unreadable)].filter(Boolean).join("\n\n"),
+      systemPrompt: [systemPrompt, instructionsBlock(reader.instructions(cwd)), heldServersNote(held2.map((server4) => ({ server: server4, reason: NOT_APPROVED })), found.unreadable)].filter(Boolean).join("\n\n"),
       ...started.length > 0 ? { projectServers: started } : {}
     };
   }
@@ -26203,6 +26965,10 @@ var SessionCatalog = class {
   allowlist() {
     return this.deps.settings().modelAllowlist ?? {};
   }
+  /** The enabled runners and allowlist together, for whoever compares an assignment with them. */
+  scope() {
+    return { enabledRunners: this.enabledRunners(), allowlist: this.allowlist(), models: this.models() };
+  }
   /** The models the user allows on one runner; unset means no restriction. */
   allowlistFor(runner) {
     return this.allowlist()[runner];
@@ -26217,7 +26983,7 @@ var SessionCatalog = class {
    */
   models() {
     const out = { ...this.discovered };
-    for (const runner of /* @__PURE__ */ new Set([...Object.keys(out), ...this.deps.planRunners()])) {
+    for (const runner of /* @__PURE__ */ new Set([...Object.keys(out), ...this.deps.planRunners(), ...this.enabledRunners()])) {
       const cached2 = this.deps.modelResolver.getCachedRunnerModels(runner);
       if (cached2.length > 0) out[runner] = cached2;
     }
@@ -26254,9 +27020,16 @@ var SessionCatalog = class {
    * asked for.
    */
   async live() {
-    const runners = this.enabledRunners();
-    await this.discover(runners);
-    return this.queryCatalog(runners);
+    await this.discover(this.enabledRunners());
+    return this.current();
+  }
+  /**
+   * What {@link live} answers, from what is cached and without discovering:
+   * the enabled runners, however the plan was started. The per-turn block
+   * reads this, so it can never offer a different set than `list_runners`.
+   */
+  current() {
+    return this.queryCatalog(this.enabledRunners());
   }
   queryCatalog(runners) {
     const registered = runners.filter((runner) => this.deps.registry.getManifest(runner) !== void 0);
@@ -26282,7 +27055,8 @@ var SessionCatalog = class {
       modelsByRunner: this.models(),
       runnerModes: this.modes(runners),
       perRunnerAllowlist: this.allowlist(),
-      autonomousDefault: this.deps.config.autonomousMode
+      autonomousDefault: this.deps.config.autonomousMode,
+      ...this.deps.liveRunner ? { liveRunner: this.deps.liveRunner } : {}
     };
   }
   /** What a runner offers, as `runnerAssignment` needs it. Spawns the runner's CLI to list models. */
@@ -26347,6 +27121,108 @@ function forkPlanState(plan, tasks, dialogue, now) {
   };
 }
 
+// src/services/PlannerResend.ts
+var HELD = "Send a message once it has reset: what waits goes with it.";
+var WAIT = "planner";
+var PlannerResend = class {
+  constructor(host) {
+    this.host = host;
+  }
+  host;
+  waits = new UsageLimitWaits(() => this.due());
+  /** When the last resend at a reset went out, until a turn lands: a limit in that window is a relapse. */
+  resentAt = null;
+  /** Whether turns wait on the limit: until the reset, or for the user's next message. */
+  holds() {
+    return this.host.plan()?.plannerResend !== void 0;
+  }
+  /** A planner turn Ordewell started ended on the planner's usage limit, which it reported as `said`. */
+  limited(said2) {
+    const plan = this.host.plan();
+    const runner = this.host.plannerRunner() ?? void 0;
+    const now = /* @__PURE__ */ new Date();
+    const relapsed = this.resentAt !== null && now.getTime() - this.resentAt < RELAPSE_MS;
+    this.resentAt = null;
+    this.waits.clear();
+    const name = runner ?? "Planner";
+    const reset = runner && !relapsed ? readUsageLimitReset(runner, said2, now) : null;
+    if (!reset) {
+      if (plan) plan.plannerResend = runner ? { runner } : {};
+      const held2 = relapsed ? "hit it again right after the resend" : "did not say when it resets";
+      const text = relapsed ? `${name} usage limit again right after the resend, so nothing is resent on its own. ${HELD}` : `${name} usage limit; it did not say when it resets. ${HELD}`;
+      return { text, resendAt: null, held: held2 };
+    }
+    const at = new Date(reset.getTime() + RESUME_MARGIN_MS);
+    if (plan) plan.plannerResend = { runner, at: at.toISOString() };
+    this.waits.arm(WAIT, at);
+    return { text: `${name} usage limit, resets ${resumeTime(reset, now)}. Resending at ${resumeTime(at, now)}; anything you send meanwhile goes with it.`, resendAt: at };
+  }
+  /**
+   * A new input arrived — the user's message, or a wake-up the supervisor
+   * asked for. What was held for one goes with it now; so does what waits on
+   * a runner the planner has left, since nothing it waits for applies to the
+   * planner that will answer. True when it lifted a wait.
+   */
+  arrived() {
+    const saved = this.host.plan()?.plannerResend;
+    if (!saved || saved.at !== void 0 && !this.switched(saved)) return false;
+    this.lift();
+    return true;
+  }
+  /** Keep what waits from going on its own; it goes with the user's next message. False when nothing waits on a reset. */
+  cancel() {
+    const plan = this.host.plan();
+    const saved = plan?.plannerResend;
+    if (!plan || saved?.at === void 0) return false;
+    this.waits.clear();
+    plan.plannerResend = held(saved);
+    return true;
+  }
+  /** A turn landed: the resend before it got past the limit. */
+  landed() {
+    this.resentAt = null;
+  }
+  /** A plan adopted off disk: re-arm the wait it saved. A time already past resends at once. */
+  restore() {
+    this.reset();
+    const saved = this.host.plan()?.plannerResend;
+    if (saved?.at === void 0) return;
+    const at = Date.parse(saved.at);
+    if (Number.isNaN(at)) delete saved.at;
+    else this.waits.arm(WAIT, new Date(at));
+  }
+  /** The plan is gone: nothing it waited on carries over. */
+  reset() {
+    this.waits.clear();
+    this.resentAt = null;
+  }
+  due() {
+    const plan = this.host.plan();
+    const saved = plan?.plannerResend;
+    if (!plan || saved?.at === void 0) return;
+    if (this.switched(saved)) {
+      plan.plannerResend = held(saved);
+      this.host.changed();
+      this.host.notice(`The planner no longer runs on ${saved.runner}, whose usage limit it waited on, so nothing was resent. ${HELD}`);
+      return;
+    }
+    delete plan.plannerResend;
+    this.resentAt = Date.now();
+    this.host.due();
+  }
+  lift() {
+    this.waits.clear();
+    const plan = this.host.plan();
+    if (plan) delete plan.plannerResend;
+  }
+  switched(saved) {
+    return saved.runner !== void 0 && saved.runner !== (this.host.plannerRunner() ?? void 0);
+  }
+};
+function held({ runner }) {
+  return runner ? { runner } : {};
+}
+
 // src/services/PlanTurns.ts
 var START_HOLD_TIMEOUT_MS = 5 * 6e4;
 function turnPrompt(batch) {
@@ -26363,6 +27239,16 @@ var PlanTurns = class {
   constructor(host, holdTimeoutMs = START_HOLD_TIMEOUT_MS) {
     this.host = host;
     this.holdTimeoutMs = holdTimeoutMs;
+    this.resend = new PlannerResend({
+      plan: () => host.plan(),
+      plannerRunner: () => host.plannerRunner(),
+      due: () => {
+        host.announce();
+        this.pump();
+      },
+      changed: () => host.announce(),
+      notice: (message) => host.notice(message)
+    });
   }
   host;
   holdTimeoutMs;
@@ -26375,6 +27261,33 @@ var PlanTurns = class {
   /** The user stopped the turn wake-ups waited behind: they wait for the next input to open one, not for the stop's release. */
   quiet = false;
   seq = 0;
+  resend;
+  /** A turn ended on the planner's usage limit: arm the wait for its inputs. Saved with the failure the turn records. */
+  usageLimit(said2) {
+    return this.resend.limited(said2);
+  }
+  /** Keep what waits on the planner's usage limit from being sent at the reset; see {@link PlannerResend.cancel}. */
+  cancelResend() {
+    if (!this.resend.cancel()) return false;
+    this.host.announce();
+    return true;
+  }
+  /**
+   * The conversation's opening ended on the planner's usage limit: its goal
+   * waits with the limit, ahead of what was sent behind it, whose senders are
+   * answered now as any sent during the wait are.
+   */
+  waitOnLimit(input) {
+    const plan = this.host.plan();
+    if (!plan) return;
+    plan.pendingTurns = [this.pending(input, false), ...plan.pendingTurns ?? []];
+    this.host.persist();
+    for (const t of plan.pendingTurns) if (t.source === "user") this.settle(t.id, (w) => w.resolve(plan));
+  }
+  /** A plan adopted off disk: the wait it saved is armed again. */
+  restoreResend() {
+    this.resend.restore();
+  }
   /** Whether a turn this module opened is in flight. */
   get busy() {
     return this.running !== null;
@@ -26416,25 +27329,33 @@ var PlanTurns = class {
   admit(input, forced) {
     const plan = this.host.plan();
     if (!plan) return Promise.reject(new Error("No planning conversation to continue"));
-    const entry = {
-      id: `turn-${Date.now()}-${++this.seq}`,
-      source: input.source,
-      text: input.text,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      ...input.skills && input.skills.length > 0 ? { skills: [...input.skills] } : {},
-      ...forced ? { forced: true } : {}
-    };
+    const entry = this.pending(input, forced);
     this.quiet = false;
+    if (this.resend.arrived()) this.host.announce();
     const pending = plan.pendingTurns ?? [];
     const at = forced ? pending.findIndex((t) => !t.forced && !this.running?.ids.has(t.id)) : -1;
     plan.pendingTurns = at === -1 ? [...pending, entry] : [...pending.slice(0, at), entry, ...pending.slice(at)];
     this.host.persist();
+    if (input.source === "user" && this.resend.holds()) {
+      this.pump();
+      return Promise.resolve(plan);
+    }
     const settled = new Promise((resolve9, reject) => {
       this.waiters.set(entry.id, { resolve: resolve9, reject, signal: input.signal });
     });
     this.pump();
     return settled;
   }
+  pending(input, forced) {
+    return {
+      id: `turn-${Date.now()}-${++this.seq}`,
+      source: input.source,
+      text: input.text,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      ...input.skills && input.skills.length > 0 ? { skills: [...input.skills] } : {},
+      ...forced ? { forced: true } : {}
+    };
+  }
   /**
    * Start the next turn if one is due: nothing of ours is in flight, the
    * conversation is free, and inputs wait. The host calls it when any planner
@@ -26445,7 +27366,7 @@ var PlanTurns = class {
    * the plan, what still waits, and the planner in use at that moment.
    */
   pump() {
-    if (this.running || this.detecting) return;
+    if (this.running || this.detecting || this.resend.holds()) return;
     const plan = this.host.plan();
     if (!plan || this.host.conversationBusy()) return;
     const batch = this.liveBatch(plan);
@@ -26525,6 +27446,7 @@ var PlanTurns = class {
    * conversation's to abandon; whatever it settles lands nothing here.
    */
   abandon() {
+    this.resend.reset();
     this.running?.release();
     this.running = null;
     this.quiet = false;
@@ -26568,8 +27490,10 @@ var PlanTurns = class {
     clearTimeout(timeout);
     if (this.running !== running) return;
     const forceStopped = !outcome.ok && running.forceStopped === true;
+    const limited = !outcome.ok && outcome.err instanceof PlannerUsageLimitError;
+    if (outcome.ok) this.resend.landed();
     try {
-      const dropped = outcome.ok || isInterruption(outcome.err) && !forceStopped ? ids : new Set(batch.filter((t) => t.source === "user").map((t) => t.id));
+      const dropped = limited ? /* @__PURE__ */ new Set() : outcome.ok || isInterruption(outcome.err) && !forceStopped ? ids : new Set(batch.filter((t) => t.source === "user").map((t) => t.id));
       const took = this.take(plan, dropped);
       if (forceStopped) plan.pendingTurns = [...(plan.pendingTurns ?? []).filter((t) => t.forced), ...(plan.pendingTurns ?? []).filter((t) => !t.forced)];
       if (took || forceStopped) this.host.persist();
@@ -26583,7 +27507,11 @@ var PlanTurns = class {
       const ended = outcome;
       const waiting = new Set((plan.pendingTurns ?? []).map((t) => t.id));
       for (const t of batch) {
-        if (forceStopped && waiting.has(t.id)) continue;
+        if (limited && t.source === "user") {
+          this.settle(t.id, (w) => w.resolve(plan));
+          continue;
+        }
+        if ((forceStopped || limited) && waiting.has(t.id)) continue;
         const delivered = this.settle(t.id, (w) => ended.ok ? w.resolve(ended.plan) : w.reject(ended.err));
         if (!delivered && !ended.ok && !isInterruption(ended.err) && t.source === "user") this.host.notice(replayFailed(t, ended.err));
       }
@@ -26642,7 +27570,6 @@ var RunSupervision = class {
       blockedBy: (failedId) => [...blockingFailures([...this.host.tasks()])].filter(([, failures]) => failures.includes(failedId)).map(([taskId]) => taskId),
       readBudget: () => this.settings()?.wakeUpReadBudget ?? host.userSettings().wakeUpReadBudget,
       retryLimit: () => this.retryLimit(),
-      plannerRunner: () => host.plannerRunner(),
       restartPlanner: () => host.restartPlanner(),
       abandonTurn: () => host.abandonTurn(),
       goUnsupervised: (reason) => this.goUnsupervised(reason),
@@ -27123,8 +28050,8 @@ function dropLegacyFile(sessionsDir, meta) {
   const legacy = path30.join(sessionsDir, legacySessionFilename(meta));
   if (legacy === path30.join(sessionsDir, sessionFilename(meta)) || !fs14.existsSync(legacy)) return;
   try {
-    const held = JSON.parse(fs14.readFileSync(legacy, "utf-8")).meta?.id;
-    if (held === meta.id) fs14.unlinkSync(legacy);
+    const held2 = JSON.parse(fs14.readFileSync(legacy, "utf-8")).meta?.id;
+    if (held2 === meta.id) fs14.unlinkSync(legacy);
   } catch {
   }
 }
@@ -27257,24 +28184,25 @@ function listTaskLogAttempts(location, taskId) {
   }
   return names.map((name) => /^([1-9]\d*)\.jsonl$/.exec(name)?.[1]).filter((n) => n !== void 0).map(Number).sort((a, b) => a - b);
 }
-function openTaskLog(location, taskId) {
+function openTaskLog(location, taskId, attempt) {
   ensureStateDirIgnored(location.baseDir);
   const dir = taskDir(location, taskId);
   fs15.mkdirSync(dir, { recursive: true });
-  let attempt = (listTaskLogAttempts(location, taskId).pop() ?? 0) + 1;
+  const next = (listTaskLogAttempts(location, taskId).pop() ?? 0) + 1;
+  let number = attempt !== void 0 && Number.isInteger(attempt) && attempt >= 1 ? attempt : next;
   for (; ; ) {
-    const file = path31.join(dir, `${attempt}${EXTENSION}`);
+    const file = path31.join(dir, `${number}${EXTENSION}`);
     try {
       fs15.writeFileSync(file, "", { flag: "wx" });
     } catch (err) {
       if (err.code === "EEXIST") {
-        attempt += 1;
+        number = Math.max(number + 1, next);
         continue;
       }
       throw err;
     }
     return {
-      attempt,
+      attempt: number,
       append(events) {
         if (events.length === 0) return;
         fs15.appendFileSync(file, events.map((e) => `${JSON.stringify(e)}
@@ -27320,11 +28248,13 @@ var TaskLogRecorder = class {
   open;
   flushMs;
   logger;
+  /** Each task's latest attempt, by the session it records: its log takes a {@link note} until the next attempt starts. */
+  latest = /* @__PURE__ */ new Map();
   wrap(runner) {
     return {
       spawn: async (opts) => {
         const session = await runner.spawn(opts);
-        this.record(opts.taskId, session, opts.skills);
+        this.record(opts.taskId, session, opts.skills, opts.attempt);
         return session;
       },
       stop: (sessionId) => runner.stop(sessionId),
@@ -27334,11 +28264,20 @@ var TaskLogRecorder = class {
       }
     };
   }
+  /**
+   * An entry the session did not emit, written into the log of the attempt
+   * that runs `sessionId` and sent at once: what Ordewell made of one of its
+   * events once that settled. Dropped once the task's next attempt started.
+   */
+  note(sessionId, taskId, entry) {
+    const attempt = this.latest.get(taskId);
+    if (attempt?.sessionId === sessionId) attempt.note(entry);
+  }
   /** Start a new attempt's log for `session`, opening with the skills it was given, and keep it until the session exits. */
-  record(taskId, session, skills = []) {
+  record(taskId, session, skills = [], attemptNumber) {
     let file;
     try {
-      file = this.open(this.deps.location(), taskId);
+      file = this.open(this.deps.location(), taskId, attemptNumber);
     } catch (err) {
       this.logger.warn("taskLog", `could not create the log of task ${taskId}; it streams but is not saved`, err);
       file = null;
@@ -27365,6 +28304,10 @@ var TaskLogRecorder = class {
       }
       this.deps.broadcast({ type: "task_log", taskId, attempt, events: taskLogForSurface(events) });
     };
+    this.latest.set(taskId, { sessionId: session.id, note: (entry) => {
+      pending.push(entry);
+      flush();
+    } });
     const openCalls = /* @__PURE__ */ new Set();
     session.onEvent((event) => {
       const entry = toTaskLogEvent(event);
@@ -27385,21 +28328,82 @@ var TaskLogRecorder = class {
   }
 };
 
+// src/services/ContextWindowFill.ts
+var ContextWindowFill = class {
+  constructor(catalog, last = {}) {
+    this.catalog = catalog;
+    if (last.contextWindow !== void 0) this.known.set(modelKey(last.source, last.model), last.contextWindow);
+  }
+  catalog;
+  /** The window known for each model of the stream, by reporter and model. */
+  known = /* @__PURE__ */ new Map();
+  fill(record) {
+    if (record.subagentId || record.aggregate) return record;
+    const key = modelKey(record.source, record.model);
+    const reported = record.contextWindow !== void 0 && record.contextWindow > 0 ? record.contextWindow : void 0;
+    const window = reported ?? this.known.get(key) ?? (record.model ? positive(this.catalog(record.source, record.model)) : void 0);
+    if (window !== void 0) this.known.set(key, window);
+    return window === void 0 || window === record.contextWindow ? record : { ...record, contextWindow: window };
+  }
+};
+function modelKey(source, model) {
+  return JSON.stringify([source ?? null, model ?? null]);
+}
+function withContextWindows(runner, catalog) {
+  return {
+    spawn: async (opts) => windowedSession(await runner.spawn(opts), new ContextWindowFill(catalog, opts.resumeWindow)),
+    stop: (sessionId) => runner.stop(sessionId),
+    stopAll: () => runner.stopAll(),
+    get activeCount() {
+      return runner.activeCount;
+    }
+  };
+}
+function windowedSession(session, windows) {
+  const listeners = [];
+  session.onEvent((event) => {
+    const filled = event.type === "usage" ? { ...event, record: windows.fill(event.record) } : event;
+    for (const listener of listeners) listener(filled);
+  });
+  const onEvent = (listener) => {
+    listeners.push(listener);
+  };
+  return new Proxy(session, {
+    get: (target, prop) => {
+      if (prop === "onEvent") return onEvent;
+      const value = Reflect.get(target, prop, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+function positive(n) {
+  return n !== void 0 && n > 0 ? n : void 0;
+}
+
 // src/services/PlannerUsage.ts
 var PlannerUsageLedger = class {
+  /** `catalogWindow` serves the window of a planner model whose backend reports none. */
+  constructor(catalogWindow = () => void 0) {
+    this.catalogWindow = catalogWindow;
+    this.windows = new ContextWindowFill(catalogWindow);
+  }
+  catalogWindow;
   usage = { totals: {} };
+  windows;
   /** Fold one model call's record into the totals; returns the running ledger. */
   record(record) {
-    this.usage = addPlannerUsage(this.usage, record);
+    this.usage = addPlannerUsage(this.usage, this.windows.fill(record));
     return this.usage;
   }
   /** Adopt a persisted ledger (a reopened session) or start from zero. */
   restore(usage) {
     this.usage = usage ?? { totals: {} };
+    this.windows = new ContextWindowFill(this.catalogWindow, this.usage);
   }
   /** Start a fresh session's ledger from zero. */
   clear() {
     this.usage = { totals: {} };
+    this.windows = new ContextWindowFill(this.catalogWindow);
   }
   /** Whether anything has been recorded — a plan with no usage says nothing. */
   get hasUsage() {
@@ -27494,19 +28498,54 @@ var PlanEditor = class {
    * between AI and MAN, are the patches that can leave a task incoherent
    * (unschedulable, or carrying fields that mean nothing for its new type),
    * so both go through the same {@link validateTaskEdit} guard the planner's
-   * task-ops applier uses (as the 'direct' actor, which skips the lock rule)
-   * rather than a second copy of the rules — and throws, so the surface can
-   * say why. Gated on the task existing so an edit to an unknown id still
+   * task-ops applier uses (as the 'direct' actor, which skips the lock rule
+   * but not a live runner's hold on its model) rather than a second copy of
+   * the rules — and throws, so the surface can say why. Gated on the task existing so an edit to an unknown id still
    * falls through to the no-op `store.update` below instead of throwing.
    * Attached skills meet the rule a planner's do: a planner skill is refused,
-   * a name not found yet only warns.
+   * a name not found yet only warns. A runner change is made by
+   * {@link setTaskRunner}, which re-derives what the runner scopes, ahead of
+   * the rest of the patch.
    *
    * Edits to one task commit in call order: the skill check waits on git, so
    * two quick chip edits (`[a]` then `[a, b]`) could otherwise land the first
    * one last.
    */
   updateTask(taskId, changes) {
-    const edit = (this.taskEdits.get(taskId) ?? Promise.resolve()).then(() => this.applyTaskUpdate(taskId, changes));
+    return this.inTaskOrder(taskId, () => this.applyTaskUpdate(taskId, changes));
+  }
+  /**
+   * The plan follows a model switch the user made with the runner's own
+   * command (#106), as a direct edit of theirs: saved and announced as
+   * `task_updated`, so every surface shows it, and what a later retry or
+   * continue spawns on. It is the one model edit a live runner allows, since
+   * it says what that runner already runs, and the one that skips the
+   * allowlist: the user picked it in the runner. The runner's own label is
+   * used only for a model discovery does not list. Effort is the runner's
+   * when it reported one, else the plan's, either clamped to what the new
+   * model offers; none for a model discovery does not list. `live` is asked
+   * as the edit lands, after the edits queued ahead of it: by then the plan
+   * may be another one, whose task of the same id the switch says nothing of.
+   */
+  followRunnerModel(taskId, model, effort, live) {
+    return this.inTaskOrder(taskId, async () => {
+      const task = this.store.get(taskId);
+      if (!task || task.type === "user" || !live()) return null;
+      const listed3 = this.catalog.models()[task.assignedRunner]?.find((m) => m.modelId === model.model);
+      const thinkingEffort = clampThinkingEffort(effort ?? task.assignedModel?.thinkingEffort, listed3?.variants ?? []);
+      if (task.assignedModel?.modelId === model.model && task.assignedModel.thinkingEffort === thinkingEffort) return this.plan();
+      const assignedModel = {
+        modelId: model.model,
+        modelLabel: listed3?.modelLabel ?? model.label ?? model.model,
+        ...thinkingEffort ? { thinkingEffort } : {},
+        ...listed3 ? { availableVariants: listed3.variants.map((v) => v.id) } : {}
+      };
+      return this.commitTaskUpdate(taskId, { assignedModel });
+    });
+  }
+  /** Edits to one task commit in call order; see {@link updateTask}. */
+  inTaskOrder(taskId, apply) {
+    const edit = (this.taskEdits.get(taskId) ?? Promise.resolve()).then(apply);
     const settled = edit.catch(() => {
     });
     this.taskEdits.set(taskId, settled);
@@ -27522,22 +28561,31 @@ var PlanEditor = class {
     const target = this.store.get(taskId);
     const skills = "skills" in changes && target ? await checkTaskSkillsEdit(target, typedSkills, this.taskSkills()) : void 0;
     if (skills?.errors.length) throw new PlanEditError(skills.errors.map((e) => e.message).join(" "));
-    if ((changes.dependencies || changes.type || changes.assignedModel || changes.taskMode || "ops" in changes) && target) {
+    if ((changes.dependencies || changes.type || "assignedModel" in changes || "assignedRunner" in changes || changes.taskMode || "ops" in changes) && target) {
       const check2 = validateTaskEdit("direct", this.store.planTasks, taskId, changes, this.catalog.edit());
       if (!check2.ok) throw new PlanEditError(check2.error ?? "Those changes are not valid");
       if (check2.clear?.length || check2.set) {
         changes = { ...changes, ...Object.fromEntries((check2.clear ?? []).map((f) => [f, void 0])), ...check2.set };
       }
     }
-    const plan = await this.commit(
+    const { assignedRunner, ...rest } = changes;
+    if (target && assignedRunner && assignedRunner !== target.assignedRunner) {
+      const moved = await this.setTaskRunner(taskId, assignedRunner);
+      if (!moved || Object.keys(rest).length === 0) return moved;
+      changes = rest;
+    }
+    const plan = await this.commitTaskUpdate(taskId, changes);
+    if (plan) for (const warning of skills?.warnings ?? []) this.notice("warn", warning);
+    return plan;
+  }
+  commitTaskUpdate(taskId, changes) {
+    return this.commit(
       () => {
         changes = this.scheduler.releaseMovedResume(taskId, changes);
         return Boolean(this.store.update(taskId, changes));
       },
       () => this.broadcast({ type: "task_updated", taskId, changes })
     );
-    if (plan) for (const warning of skills?.warnings ?? []) this.notice("warn", warning);
-    return plan;
   }
   /**
    * Replace one task's dependency list — the named entry point the surfaces'
@@ -27554,7 +28602,8 @@ var PlanEditor = class {
    * because a runner change is never a single-field edit: the task's model,
    * thinking effort and mode are all scoped to its runner, so they are
    * re-derived from the new runner's catalog (see {@link retargetTaskRunner}).
-   * That needs discovery, which is why it is not a branch inside `updateTask`.
+   * That needs discovery, which is why `updateTask` hands a runner change here
+   * rather than writing it as a field.
    *
    * The runner is also admitted into `plan.runners` — see {@link admitRunner}.
    */
@@ -27564,11 +28613,13 @@ var PlanEditor = class {
     const task = this.store.get(taskId);
     if (!task) return null;
     if (task.assignedRunner === runner || task.type === "user") return plan;
+    this.refuseLiveRetarget(task);
     const catalog = await this.catalog.runner(runner);
     const from = this.catalog.edit([task.assignedRunner]).runnerModes[task.assignedRunner];
     const changes = retargetTaskRunner(task, runner, this.allowedCatalog(catalog, runner), from);
     if (Object.keys(changes).length === 0) return this.plan();
     this.refuseUnavailableMode(runner, changes.taskMode, catalog.modes);
+    this.refuseLiveRetarget(task);
     return this.commit(() => {
       if (!this.store.update(taskId, this.scheduler.releaseMovedResume(taskId, changes))) return false;
       this.admitRunner(runner, catalog.models);
@@ -27602,6 +28653,9 @@ var PlanEditor = class {
       return true;
     });
   }
+  refuseLiveRetarget(task) {
+    if (this.catalog.edit().liveRunner?.(task.id)) throw new PlanEditError(liveRunnerRefusal(task));
+  }
   /**
    * A mode the host cannot run is refused, with its reason, not swapped for
    * another: the plan is the source of truth for what runs (ADR-0001), and a
@@ -27931,6 +28985,10 @@ var ExecutionCommands = class {
     const all = this.all(tasks);
     const live = all.filter(({ task }) => this.host.running(task.id));
     if (this.host.hasLiveWork()) {
+      if (actor.kind === "user") {
+        const waiting = all.filter(({ task }) => this.host.waitsForApproval(task.id)).length;
+        return { act: async () => ({ message: await this.host.joinRun(waiting) }) };
+      }
       return { refusal: `The plan is already running (${named2(live)} ${live.length === 1 ? "is" : "are"} running). Start one more ready task with run_task, or wait.` };
     }
     const toRun = all.filter(({ task }) => task.type === "ai" && task.status !== "completed" && task.status !== "skipped");
@@ -28356,8 +29414,11 @@ function mergeStopped(result) {
   switch (result.outcome) {
     case "merged":
       return "it merged";
-    case "blocked":
-      return "the user's checkout has changes that overlap what it would merge";
+    case "blocked": {
+      const off = result.blocked.filter((b) => b.reason === "wrong-branch");
+      if (off.length === 0) return "the user's checkout has changes that overlap what it would merge";
+      return off.map((b) => `${b.repo === "." ? "the checkout" : b.repo} is ${b.actual ? `on ${b.actual}` : b.rebasing ? "in the middle of a rebase" : "on a detached HEAD"}, not ${b.expected}, which the run started on`).join("; ");
+    }
     case "conflict":
       return `it conflicts in ${result.repo}${result.files?.length ? `: ${result.files.slice(0, 5).join(", ")}` : ""}`;
     case "failed":
@@ -28482,11 +29543,17 @@ function liveAiService(config, workspaceRoot, mcpServer) {
 function isPlannerApproval(request) {
   return !isRunnerApproval(request);
 }
+function writtenTasks(before, after) {
+  const said2 = ({ subtasks: _subtasks, status: _status, ...task }) => JSON.stringify(task);
+  const prior = new Map(flattenTasks(before).map((t) => [t.id, said2(t)]));
+  return flattenTasks(after).filter((t) => prior.get(t.id) !== said2(t)).map((t) => t.id);
+}
 function createSession(deps) {
   const pinnedAiService = deps.aiService;
   const mcpServer = deps.mcpServer ?? sharedMcpServer();
   const aiService = pinnedAiService ? () => pinnedAiService : liveAiService(deps.config, deps.workspaceRoot, mcpServer);
   const store = new PlanStore();
+  const catalogWindow = (source, model) => deps.modelResolver.contextWindowFor?.(source, model);
   const taskLogs = new TaskLogRecorder({
     broadcast: deps.broadcast,
     // Read through the Session, whose id and workspace are the ones it saves
@@ -28520,7 +29587,7 @@ function createSession(deps) {
   const orchestrator = TaskOrchestrator.compose({
     config: deps.config,
     notifications: deps.notifications,
-    runner: taskLogs.wrap(runnerApprovals.wrap(deps.runner)),
+    runner: taskLogs.wrap(runnerApprovals.wrap(withContextWindows(deps.runner, catalogWindow))),
     store,
     output: deps.taskOutput,
     isolation: deps.isolation,
@@ -28528,10 +29595,11 @@ function createSession(deps) {
     workspaceRoot: deps.workspaceRoot,
     skillsAt: (roots) => (deps.skillsService ?? new SkillsService(roots)).forRoot(roots),
     previousAttemptFromLog: (taskId) => lastAttemptDigest(session.taskLogLocation, taskId),
+    lastLoggedAttempt: (taskId) => session.taskLogAttempts(taskId).at(-1) ?? 0,
     runSettings: () => session.planState?.runSettings,
     isApproved: (taskId) => session.isApproved(taskId)
   });
-  const usage = new PlannerUsageLedger();
+  const usage = new PlannerUsageLedger(catalogWindow);
   const events = new SessionEventRelay({
     broadcast: deps.broadcast,
     onNotice: deps.onNotice,
@@ -28580,7 +29648,8 @@ function createSession(deps) {
     modelResolver: deps.modelResolver,
     settings: deps.settings,
     // Read through the Session, which holds the plan; the catalog is built first.
-    planRunners: () => session.planState?.runners ?? []
+    planRunners: () => session.planState?.runners ?? [],
+    liveRunner: (taskId) => orchestrator.getAttempt(taskId) !== void 0
   });
   const session = new Session({
     config: deps.config,
@@ -28602,6 +29671,7 @@ function createSession(deps) {
     usage,
     approvals,
     approvalPolicy,
+    taskLogs,
     // Every planner's web reads, carried here or natively, are decided by the
     // one policy, which asks through the same channel as paths and commands.
     // The response cache and search provider are process-wide, so parallel
@@ -28652,6 +29722,7 @@ var Session = class {
   fsAdapter;
   approvals;
   approvalPolicy;
+  taskLogs;
   fetcher;
   settingsFn;
   save;
@@ -28687,7 +29758,7 @@ var Session = class {
     turnId: () => this.conversation.currentTurnId,
     recordSkillLoad: (skill) => this.conversation.recordPlannerSkill(skill),
     liveCatalog: () => this.liveCatalog(),
-    coerce: (tasks) => coerceAssignments(tasks, this.catalog.allowlist(), this.catalog.models()),
+    coerce: (tasks) => coerceAssignments(tasks, this.catalog.allowlist(), this.catalog.models(), this.store.planTasks),
     submitPlan: (tasks) => this.submitPlanFromTool(tasks),
     editPlan: (ops) => this.editPlanFromTool(ops),
     tasks: () => this.store.planTasks,
@@ -28732,6 +29803,7 @@ var Session = class {
     this.usage = parts.usage;
     this.approvals = parts.approvals;
     this.approvalPolicy = parts.approvalPolicy;
+    this.taskLogs = parts.taskLogs;
     this.fetcher = parts.fetcher;
     this.skillsService = parts.skillsService;
     this.save = parts.saveSession;
@@ -28741,7 +29813,8 @@ var Session = class {
       aiService: () => this.aiService(),
       onProgress: (p) => this.events.progress(p),
       opening: (runners) => this.conversationOpening(runners),
-      catalog: () => this.catalog.queryCatalog(this.plan?.runners ?? []),
+      catalog: () => this.catalog.current(),
+      assignmentScope: () => this.catalog.scope(),
       autorun: () => this.userRunSettings().autorun,
       takeRunUpdates: () => this.untoldRunUpdates.splice(0),
       tasks: () => this.store.planTasks,
@@ -28761,13 +29834,18 @@ var Session = class {
       turnAborted: () => this.approvals.clear(isPlannerApproval),
       // After the turn has announced its end, so the next one never starts
       // ahead of it on a surface.
-      turnReleased: () => queueMicrotask(() => this.turns.pump())
+      turnReleased: () => queueMicrotask(() => this.turns.pump()),
+      usageLimit: (said2) => this.turns.usageLimit(said2)
     });
     this.turns = new PlanTurns({
       plan: () => this.closed ? null : this.plan,
       conversationBusy: () => this.conversation.isTurnInFlight,
       mayWake: () => this.supervision.mayWake(),
       persist: () => this.persist({ background: true }),
+      announce: () => {
+        this.persist({ background: true });
+        this.events.planGenerated(this.plan, this.goal);
+      },
       interrupt: () => {
         this.conversation.stopTurn("force_send");
       },
@@ -28784,7 +29862,8 @@ var Session = class {
       },
       notice: (message) => this.notice("error", message),
       plannerDetecting: () => installedPlannerAnswered() ? null : installedPlannerDetected(),
-      assertPlannerReady: () => this.assertPlannerReady()
+      assertPlannerReady: () => this.assertPlannerReady(),
+      plannerRunner: () => runnerForProvider(this.config.aiProvider)
     });
     this.supervision = new RunSupervision({
       plan: () => this.plan,
@@ -28802,7 +29881,6 @@ var Session = class {
       },
       deliver: (digest) => this.turns.enqueue({ source: "supervisor", text: digest }),
       pump: () => this.turns.pump(),
-      plannerRunner: () => runnerForProvider(this.config.aiProvider),
       restartPlanner: () => this.aiService().restart?.(),
       abandonTurn: () => this.conversation.abandonHungTurn(),
       notice: (level, message) => this.notice(level, message)
@@ -28884,6 +29962,7 @@ var Session = class {
       tasks: () => this.plan ? this.store.planTasks : null,
       planApproved: () => this.plan?.approved === true,
       taskApproved: (taskId) => this.isApproved(taskId),
+      waitsForApproval: (taskId) => this.waitsForApproval(taskId),
       approve: (taskIds) => this.approve(taskIds),
       autonomous: () => this.config.autonomousMode,
       autorun: () => this.userRunSettings().autorun,
@@ -28905,6 +29984,7 @@ var Session = class {
       blockedBy: (taskId) => this.orchestrator.getBlockedBy(taskId),
       waitingRequests: (taskId) => this.approvals.outstanding().filter(({ request }) => isRunnerApproval(request) && request.taskId === taskId).map(({ id, request }) => ({ id, subject: request.subject })),
       runPlan: (actor) => this.runWholePlan(runOrigin(actor)),
+      joinRun: (approved) => this.joinRun(approved),
       startTask: (taskId, actor) => this.startOneTask(taskId, runOrigin(actor)),
       stopTask: (taskId) => this.cancelTask(taskId),
       stopRun: () => this.stopExecution(),
@@ -28933,8 +30013,8 @@ var Session = class {
    * one: nothing it would start is approved until the user executes it.
    */
   heldEdit(taskId) {
-    const held = this.conversation.pendingOps();
-    if (!held || held.length === 0 || !this.plan) return false;
+    const held2 = this.conversation.pendingOps();
+    if (!held2 || held2.length === 0 || !this.plan) return false;
     if (taskId === void 0) return true;
     const before = this.store.get(taskId);
     const after = this.asEdited(taskId);
@@ -28947,10 +30027,10 @@ var Session = class {
   /** {@link editedTasks}, with the id each of the held batch's handles names in them. */
   editedPlan() {
     const unedited = { tasks: this.store.planTasks, handles: /* @__PURE__ */ new Map() };
-    const held = this.conversation.pendingOps();
-    if (!held || held.length === 0 || !this.plan) return unedited;
+    const held2 = this.conversation.pendingOps();
+    if (!held2 || held2.length === 0 || !this.plan) return unedited;
     const runners = this.editRunners();
-    const result = applyTaskOps(this.store.planTasks, held, runners, this.catalog.edit(runners));
+    const result = applyTaskOps(this.store.planTasks, held2, runners, this.catalog.edit(runners));
     return result.ok ? { tasks: result.tasks, handles: result.handles ?? /* @__PURE__ */ new Map() } : unedited;
   }
   /** The task as the open turn's held edit leaves it; undefined when that edit removes it. */
@@ -28974,9 +30054,9 @@ var Session = class {
    * rules, then, for the supervisor, the oscillation guard. `held` are the
    * ops the turn already holds, which `ops` join; errors are numbered by `ops`.
    */
-  checkPlannerOps(ops, held = []) {
+  checkPlannerOps(ops, held2 = []) {
     const runners = this.editRunners();
-    const result = applyTaskOps(this.store.planTasks, ops, runners, this.catalog.edit(runners), held);
+    const result = applyTaskOps(this.store.planTasks, ops, runners, this.catalog.edit(runners), held2);
     if (!result.ok || !this.supervisorEditing()) return result;
     const trip = this.supervision.checkEdit(this.store.planTasks, result.tasks);
     if (!trip) return result;
@@ -29146,6 +30226,9 @@ var Session = class {
       onUsageLimitWait: ({ taskId, runner, resumeAt, cancelled }) => {
         if (!cancelled) this.supervision.observe({ kind: "usage_limit", taskId, runner, resumeAt });
       },
+      onModelSwitched: (switched) => {
+        void this.followRunnerModel(switched);
+      },
       onTaskIdle: ({ taskId, idleSince }) => {
         this.supervision.observe({ kind: "task_idle", taskId, detail: `no output since ${idleSince}` });
       },
@@ -29266,10 +30349,12 @@ var Session = class {
    * boundary rewrites `in_progress` to `pending` — nothing is running when a
    * session comes off a file — so a surface that re-reads the plan mid-run must
    * come here instead, or every task it is watching reads as never started.
+   * An archived snapshot carries the task as it is now: a retry or continue
+   * keeps the archive while the live task runs on and spends more.
    */
   get currentPlanState() {
     if (!this.plan) return null;
-    const executionLog = this.store.getExecutionLog();
+    const executionLog = this.store.getExecutionLog().map((s) => ({ ...s, ...this.store.get(s.id) }));
     const logged = new Set(executionLog.map((s) => s.id));
     const pendingTasks = this.store.planTasks.filter((t) => !logged.has(t.id));
     const record = approvalRecordOf(this.plan);
@@ -29280,7 +30365,7 @@ var Session = class {
       phase: "executing",
       history: [],
       message: "",
-      executionLog: [...executionLog],
+      executionLog,
       pendingTasks,
       goal: this.goal,
       runners: this.plan.runners,
@@ -29450,16 +30535,20 @@ var Session = class {
       opened = this.openTurn(() => this.conversation.start(this.resolveSkillInvocation(goal), () => this.conversationOpening(chosenRunners), options?.signal));
     } catch (err) {
       if (this.opening === pending) this.opening = null;
-      for (const held2 of pending.held ?? []) held2.reject(err);
+      for (const held3 of pending.held ?? []) held3.reject(err);
       throw err;
     }
-    const held = pending.held ?? [];
+    const held2 = pending.held ?? [];
     pending.held = null;
-    for (const h of held) this.turns.follow(h.input, h.forced).then(h.resolve, h.reject);
+    for (const h of held2) this.turns.follow(h.input, h.forced).then(h.resolve, h.reject);
     try {
       const { landed: landed2, effects } = await opened;
       this.autorunSubmitted(effects);
       return landed2;
+    } catch (err) {
+      if (!(err instanceof PlannerUsageLimitError) || !this.plan) throw err;
+      this.turns.waitOnLimit({ source: "user", ...this.resolveSkillInvocation(goal) });
+      return this.plan;
     } finally {
       if (this.opening === pending) this.opening = null;
     }
@@ -29474,10 +30563,10 @@ var Session = class {
   behindOpening(input, forced = false) {
     const pending = this.opening;
     if (!pending) return null;
-    const held = pending.held;
-    if (!held) return this.turns.follow(input, forced);
+    const held2 = pending.held;
+    if (!held2) return this.turns.follow(input, forced);
     return new Promise((resolve9, reject) => {
-      held.push({ input, forced, resolve: resolve9, reject });
+      held2.push({ input, forced, resolve: resolve9, reject });
     });
   }
   /**
@@ -29576,12 +30665,12 @@ var Session = class {
     await this.liveCatalog();
     if (this.conversation.currentTurnId !== turn) return refuse(PLANNER_TURN_ENDED);
     if (!this.plan || this.store.planTasks.length === 0) return refuse("There is no plan to edit yet: submit one with submit_plan.");
-    const held = this.conversation.pendingOps();
-    if (!held) return refuse("A whole plan was submitted in this reply and replaces the plan when it ends: make the edit in your next reply.");
-    const result = this.checkPlannerOps(ops, held);
+    const held2 = this.conversation.pendingOps();
+    if (!held2) return refuse("A whole plan was submitted in this reply and replaces the plan when it ends: make the edit in your next reply.");
+    const result = this.checkPlannerOps(ops, held2);
     if (!result.ok) return { ok: false, errors: result.errors };
-    if (!this.conversation.submit({ kind: "task_ops", ops: [...held, ...ops] })) return refuse("No planning turn is open to take the edit.");
-    const { coerced } = coerceAssignments(result.tasks, this.catalog.allowlist(), this.catalog.models());
+    if (!this.conversation.submit({ kind: "task_ops", ops: [...held2, ...ops] })) return refuse("No planning turn is open to take the edit.");
+    const { coerced } = coerceAssignments(result.tasks, this.catalog.allowlist(), this.catalog.models(), this.store.planTasks);
     return { ok: true, summary: result.summary, coerced: coerced.map(({ taskId: _id, ...rest }) => rest) };
   }
   /** Whether the planner conversation is live (started and not yet committed to a plan). */
@@ -29618,9 +30707,6 @@ var Session = class {
       autonomousDefault: this.config.autonomousMode,
       autorun: this.userRunSettings().autorun,
       isolatedExecution: await this.runs.plannerLayout(),
-      // The planner's own model window, when a cached catalog knows it, so the
-      // usage line can show context fill (#49). Unknown stays absent.
-      contextWindow: this.modelResolver.contextWindowFor?.(this.config.orchestratorModel),
       fs: this.fsAdapter,
       fetcher: this.fetcher,
       approval: this.approvalPolicy,
@@ -29647,7 +30733,7 @@ var Session = class {
     for (const runner of runnersOf(tasks)) this.editor.admitRunner(runner, this.catalog.known(runner));
     const runners = this.plan.runners;
     const before = this.store.planTasks;
-    let coerced = coerceAssignments(tasks, this.catalog.allowlist(), this.catalog.models()).tasks;
+    let coerced = coerceAssignments(tasks, this.catalog.allowlist(), this.catalog.models(), before).tasks;
     if (how === "commit") coerced = keepExecutionState(before, carryPlannedModes(before, coerced, this.catalog.edit(runners)));
     const bySupervisor = this.supervisorEditing();
     const { tasks: stamped, added } = stampOrigin(before, coerced, bySupervisor);
@@ -29660,6 +30746,7 @@ var Session = class {
       this.store.resetForRun({ keepScheduledResumes: true });
     }
     if (bySupervisor) this.approve(added);
+    else if (this.conversation.currentWakeUp === void 0 && this.userRunSettings().autorun) this.approve(writtenTasks(before, coerced));
     return coerced.length;
   }
   preparePlannerTaskUpdates(tasks) {
@@ -29694,6 +30781,11 @@ var Session = class {
     if (changes.mergeAtGatesAutomatically) this.orchestrator.runSettingsChanged();
   }
   async executePlan() {
+    if (this.orchestrator.hasLiveWork) {
+      const outcome = await this.execute({ command: "run_plan" }, { kind: "user" });
+      if (!outcome.ok) throw new TaskControlError(outcome.message);
+      return;
+    }
     this.idlePlan();
     this.approve(flattenTasks(this.store.planTasks).map((t) => t.id));
     await this.runWholePlan("user");
@@ -29715,6 +30807,25 @@ var Session = class {
       await this.orchestrator.approveReview(origin);
     });
   }
+  /**
+   * Execute while a run is under way (#95): the seam has approved every task,
+   * as executing does, and the run takes them in. A run the scheduler was not
+   * driving, one task started on its own, becomes the plan's run, as Execute
+   * would make it.
+   */
+  async joinRun(approved) {
+    const plan = this.plan;
+    const scheduling = this.orchestrator.isScheduling;
+    await this.withSave(async () => {
+      plan.approved = true;
+      if (scheduling) await this.orchestrator.tick();
+      else if (this.orchestrator.isReviewApproved) await this.orchestrator.start("user");
+      else await this.orchestrator.approveReview("user");
+    });
+    const line = approved === 0 ? scheduling ? "The plan is already running, and no task waits for your approval." : "The plan is running: each task starts once its dependencies finish." : approved === 1 ? "Approved 1 task; it starts once its dependencies finish." : `Approved ${approved} tasks; each starts once its dependencies finish.`;
+    this.notice("info", line);
+    return line;
+  }
   async approveReview() {
     if (!this.plan) throw new NoPlanError("review");
     const plan = this.plan;
@@ -29723,9 +30834,12 @@ var Session = class {
     await this.withSave(() => this.orchestrator.approveReview("user"));
     return plan;
   }
+  /** Answers the line saying the task waits for its dependencies, when it was queued behind them rather than started. */
   async forceStartTask(taskId) {
     this.approveTask(taskId);
-    await this.startOneTask(taskId, "user");
+    if (!this.plan) return;
+    this.requireTask(taskId);
+    return this.withSave(() => this.orchestrator.forceStartTask(taskId, "user"));
   }
   async startOneTask(taskId, origin) {
     if (!this.plan) return;
@@ -29782,10 +30896,51 @@ var Session = class {
   async resumeNow(taskId) {
     await this.withSave(() => this.orchestrator.resumeNow(taskId, "user"));
   }
+  /**
+   * Keep what waits on the planner's usage limit from being sent at the reset:
+   * it goes with the user's next message instead. False when nothing waits on
+   * a reset.
+   */
+  cancelPlannerResend() {
+    return this.turns.cancelResend();
+  }
   /** Keep a task paused on a usage limit from resuming on its own; see {@link TaskOrchestrator.cancelScheduledResume}. */
   cancelScheduledResume(taskId) {
     return this.saved(() => this.orchestrator.cancelScheduledResume(taskId));
   }
+  /**
+   * The plan follows a model switch the user made in the runner (#106), and
+   * the task's log says what the plan holds once that settled: a write-back
+   * not made — no model command asked for the change, or the edit failed — is
+   * stated, never shown as made. Once the switch's attempt has ended, the plan
+   * may be another one, so nothing of it is said.
+   */
+  async followRunnerModel({ taskId, sessionId, from, model, effort, asked, attemptEnded }) {
+    let kept = asked ? void 0 : "no model command in the chat asked for it";
+    const live = () => this.orchestrator.activeSessionMap.get(taskId) === sessionId;
+    const ended = () => this.taskLogs.note(sessionId, taskId, { type: "model_switched", from, to: model, kept: kept ?? "its attempt had already ended" });
+    if (attemptEnded) return ended();
+    if (asked) {
+      try {
+        if (!await this.editor.followRunnerModel(taskId, model, effort, live) && !live()) return ended();
+      } catch (err) {
+        kept = `the plan could not follow it: ${err instanceof Error ? err.message : String(err)}`;
+        this.notice("warn", `The plan could not follow the model switch of task ${this.store.get(taskId)?.order ?? taskId}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    const assigned = this.store.get(taskId)?.assignedModel;
+    if (!kept && assigned?.modelId !== model.model) kept = "the plan did not take the edit";
+    this.taskLogs.note(sessionId, taskId, {
+      type: "model_switched",
+      from,
+      to: model,
+      plan: {
+        ...assigned ? { model: { model: assigned.modelId, label: assigned.modelLabel } } : {},
+        ...assigned?.thinkingEffort ? { effort: assigned.thinkingEffort } : {}
+      },
+      ...kept ? { kept } : {}
+    });
+  }
   /** Said through both channels: a host shows one or the other, never both (the daemon's toasts are no-ops). */
   notice(level, message) {
     this.notifications[level](message);
@@ -29857,8 +31012,8 @@ var Session = class {
     if (!this.plan) return EMPTY_RUN;
     const planned = reduceRun(EMPTY_RUN, { type: "plan_snapshot", plan: surfacePlan({ ...this.plan, tasks: this.store.snapshot() }) });
     const view = reduceRun(planned, this.events.statusMessage());
-    const held = this.sentHeld ? reduceRun(view, { type: "plan_edit_held", held: this.sentHeld }) : view;
-    return this.sentHandoff ? reduceRun(held, { type: "isolation_handoff", ...this.sentHandoff }) : held;
+    const held2 = this.sentHeld ? reduceRun(view, { type: "plan_edit_held", held: this.sentHeld }) : view;
+    return this.sentHandoff ? reduceRun(held2, { type: "isolation_handoff", ...this.sentHandoff }) : held2;
   }
   /** The ancestors a task waits on at its merge gate (ADR-0020); empty when it waits for no Merge all. */
   mergeGate(taskId) {
@@ -30017,6 +31172,7 @@ var Session = class {
     if (adopting) this.dropPlanScope();
     this.plan = plan;
     if (adopting) this.supervision.restore(plan.supervision);
+    if (adopting) this.turns.restoreResend();
     this.goal = goal;
     this.workspace = workspace;
     plan.approved ??= plan.status !== "draft" && plan.status !== "rejected";
@@ -30224,6 +31380,7 @@ var StructuredSession = class extends AbstractRunnerSession {
   messageCount = 0;
   interrupting = null;
   lastSessionId = null;
+  lastSessionCost = null;
   structuredEmitter = new EventEmitter2();
   permissionCount = 0;
   /**
@@ -30428,6 +31585,9 @@ var StructuredSession = class extends AbstractRunnerSession {
   nativeSessionId() {
     return this.adapter?.nativeSessionId() ?? this.lastSessionId;
   }
+  sessionCost() {
+    return this.adapter?.sessionCost?.() ?? this.lastSessionCost;
+  }
   answerPermission(id, decision) {
     const open = this.permissions.get(id);
     if (!open) return false;
@@ -30475,6 +31635,7 @@ var StructuredSession = class extends AbstractRunnerSession {
    */
   async restartInterrupted(turn) {
     const resumeSessionId = this.nativeSessionId() ?? this.startOptions.resumeSessionId;
+    const resumeCost = this.sessionCost() ?? this.startOptions.resumeCost;
     this.generation += 1;
     turn.abort.abort();
     if (this.adapter) {
@@ -30484,7 +31645,7 @@ var StructuredSession = class extends AbstractRunnerSession {
     for (const message of this.queue) this.requeue(message);
     try {
       this.revokeTools();
-      await this.startAttached({ ...this.startOptions, resumeSessionId });
+      await this.startAttached({ ...this.startOptions, resumeSessionId, resumeCost });
     } catch (err) {
       this.text.line(`Could not restart ${this.launch.runner} after the interrupt: ${err instanceof Error ? err.message : String(err)}`);
       this.withdrawPermissions();
@@ -30511,6 +31672,7 @@ var StructuredSession = class extends AbstractRunnerSession {
         return;
       }
       this.lastSessionId = adapter.nativeSessionId() ?? this.lastSessionId;
+      this.lastSessionCost = adapter.sessionCost?.() ?? this.lastSessionCost;
       this.withdrawPermissions();
       this.baseHandleExit(code);
     });
@@ -30548,6 +31710,7 @@ var StructuredSession = class extends AbstractRunnerSession {
       this.handleEvent({ type: "error", message: err instanceof Error ? err.message : String(err) });
     }).then(() => {
       this.lastSessionId = adapter.nativeSessionId() ?? this.lastSessionId;
+      this.lastSessionCost = adapter.sessionCost?.() ?? this.lastSessionCost;
       if (generation2 === this.generation) this.endTurn(turn, turn.reason);
     });
     this.offerNext();
@@ -30674,6 +31837,11 @@ var StructuredSession = class extends AbstractRunnerSession {
       case "error":
         this.text.failure(event.message);
         break;
+      // The plan follows the switch (#106), so a restart after an interrupt
+      // runs what the plan now says rather than what this attempt started on.
+      case "model_switched":
+        this.startOptions = { ...this.startOptions, model: event.to.model };
+        break;
       default:
         break;
     }
@@ -30754,7 +31922,8 @@ var StructuredRunner = class extends AbstractRunner {
         model: opts.modelId,
         mode: opts.mode ?? "default",
         flags: resolveTaskRunnerFlags(manifest, { mode: opts.mode ?? "default", model: opts.modelId, thinkingEffort: opts.thinkingEffort }),
-        resumeSessionId: opts.resumeSessionId
+        resumeSessionId: opts.resumeSessionId,
+        resumeCost: opts.resumeCost
       },
       interruptGraceMs: this.interruptGraceMs,
       tools: { server: this.mcp, scope: { sessionId: opts.planSessionId ?? "", taskId: opts.taskId, attempt: opts.attempt ?? 1 } },
@@ -31056,6 +32225,7 @@ export {
   PlannerNotReadyError,
   PlannerTurnDiscardedError,
   PlannerTurnStoppedError,
+  PlannerUsageLimitError,
   REFUSED_COMMANDS,
   RUN_SETTINGS_DEFAULTS,
   RunSettingsError,
@@ -31112,6 +32282,8 @@ export {
   approvalScopes,
   assertWorkspaceExists,
   assertWorkspaceIsProject,
+  assignmentIssue,
+  assignmentIssueText,
   augmentedPath,
   automergeSummary,
   autonomyLevelLabel,
@@ -31128,6 +32300,7 @@ export {
   canSetDependencies,
   canSplitTask,
   capConflictFiles,
+  checkoutRule,
   classifyCommand,
   classifyOutcome,
   clearAugmentedPathCache,
@@ -31141,6 +32314,7 @@ export {
   commandAllowedBy,
   configuredProviders,
   continuability,
+  countedSessionCost,
   createAiService,
   createEmptyPlan,
   createSession,
@@ -31204,6 +32378,7 @@ export {
   isMeasured,
   isOpenAiProvider,
   isPlannerBackend,
+  isRepoGroup,
   isRunnerApproval,
   isSupervisorLevel,
   isTaskRunning,
@@ -31226,6 +32401,7 @@ export {
   markdownHtml,
   markdownTokens,
   mcpClientConfig,
+  mergeTarget,
   migrateOldConfigDir,
   migratePlanIsolation,
   migratePlanState,
@@ -31275,6 +32451,7 @@ export {
   removedPluginNotice,
   renderTaskQueryAnswer,
   replayTaskLog,
+  reposWithWork,
   researchShellWarning,
   researchToolsPath,
   resetInstalledPlanner,
@@ -31288,6 +32465,7 @@ export {
   resolveWithin,
   resumeLabel,
   resumeTime,
+  resumedSessionWindow,
   runSettingsOf,
   runnerForProvider,
   runnerModesFrom,
@@ -31328,6 +32506,7 @@ export {
   taskRowView,
   taskStartedNotice,
   taskStatusKind,
+  taskUsageSummary,
   textHasTaskOps,
   textHasTaskQuery,
   titledRefs,