@ordewell/core 0.10.4 → 0.10.6

package/dist/{plan-utils-POIz5d8z.d.ts → runSettingsText-BgXvajj2.d.ts}

@@ -1,6 +1,6 @@
-import { af as Task, a2 as RunnerId, an as TaskSnapshot, b as AwaitingReason, ar as UsageRecord, d as DiscoveredModel, ac as SkillsService, a7 as SkillInfo, X as RepoGroupLayout, I as IWorktreeIsolation, w as IsolationRun, k as IsolationHandoff, J as PlanIsolation, x as IsolationTaskRecord, ai as TaskIsolation, H as IsolationView, R as PrepareIntent, U as PreviousWork, s as IsolationOutcome, W as RepairEvidence, ap as TreeSnapshot, ag as TaskDiffRead, ah as TaskDiffResult, r as IsolationMergeResult, at as Verdict, am as TaskSkillSnapshot, al as TaskSkillNotice, ad as SubagentOutcome, L as LegacyPlanState, C as ConversationMessage, a9 as SkillLoadNotice, P as PendingPlanTurn, a as AttemptUsage, M as ModelUsage, as as UsageTotals, O as PlanUsage, f as ExecutionRecord, _ as ResearchStep, a1 as RunSettings, K as PlanState, ae as SupervisorLevel, $ as ResearchStepOutcome, Y as ResearchLogEntry, Q as PlannerUsage, aj as TaskIsolationState, aq as UsageLine } from './Task-DZs9eKgg.js';
-import { R as RunnerModeInfo } from './ModeResolver-Dy3Ef6p-.js';
-import { B as IRunnerSession, y as IConfig, aC as TaskMessageFrom, ai as RunnerCommand, an as RunnerMcpServer, av as StructuredTurnEnd, j as ApprovalDecision, au as StructuredEvent, ab as QueuedTaskMessage, k as ApprovalKind, q as ApprovalSource, z as IRunner, aq as RunnerRegistry } from './IRunner-D_UkkMbJ.js';
+import { ai as Task, a4 as RunnerId, aq as TaskSnapshot, b as AwaitingReason, av as UsageRecord, a5 as RunnerSessionCost, d as DiscoveredModel, af as SkillsService, aa as SkillInfo, Z as RepoGroupLayout, I as IWorktreeIsolation, w as IsolationRun, k as IsolationHandoff, J as PlanIsolation, x as IsolationTaskRecord, al as TaskIsolation, H as IsolationView, S as PrepareIntent, V as PreviousWork, s as IsolationOutcome, X as RepairEvidence, at as TreeSnapshot, aj as TaskDiffRead, ak as TaskDiffResult, r as IsolationMergeResult, ax as Verdict, ap as TaskSkillSnapshot, ao as TaskSkillNotice, ag as SubagentOutcome, L as LegacyPlanState, C as ConversationMessage, ac as SkillLoadNotice, P as PendingPlanTurn, a as AttemptUsage, a3 as RunSettings, O as PlanUsage, Y as ReplyRun, M as ModelUsage, aw as UsageTotals, f as ExecutionRecord, a0 as ResearchStep, K as PlanState, $ as ResearchProgress, _ as ResearchLogEntry, ab as SkillLoad, N as PlanStatus, ah as SupervisorLevel, a1 as ResearchStepOutcome, R as PlannerUsage, am as TaskIsolationState, as as TaskUsageSummary } from './Task-C0o4i3Nn.js';
+import { N as IRunnerSession, K as IConfig, aL as TaskMessageFrom, ax as RunnerModelRef, ap as RunnerCommand, au as RunnerMcpServer, aE as StructuredTurnEnd, j as ApprovalDecision, aD as StructuredEvent, ah as QueuedTaskMessage, k as ApprovalKind, q as ApprovalSource, M as IRunner, ay as RunnerRegistry, J as IApproval, aU as ToolOutcome, d as AgentProcessDeps, a as AgentAdapter, a4 as OrdewellMcpServer, L as IFileSystem, aV as UsageLimitSignal, ac as PlannerToolHandler, p as ApprovalRequest, i as ApprovalAnswer, f as AiProvider, a3 as OrchestratorOption, a9 as PlannerBackendId } from './IFileSystem-C4_mpfze.js';
+import { R as RunnerModeInfo } from './ModeResolver-DGK2rWHE.js';
 
 type NotificationAction = {
     label: string;
@@ -142,15 +142,15 @@ declare class PlanStore {
     setForcedPastGate(id: string, dependencies: string[]): void;
     /** A reason outlives nothing: any status but `awaiting_user` drops it, and the resume time with it; any status drops a skip's reason. */
     private setStatus;
-    blockDependents(id: string): void;
-    unblockDependents(id: string): void;
     setTaskVerdict(id: string, verdict: Task['verdict']): void;
     setTaskOutputSummary(id: string, summary: Task['outputSummary']): void;
-    setTaskRunnerSessionId(id: string, runnerSessionId: string | undefined): void;
+    /** The owner is saved with the session it belongs to, and dropped with it. */
+    setTaskRunnerSessionId(id: string, runnerSessionId: string | undefined, owner?: RunnerId): void;
+    setCarriedFrom(id: string, runner: RunnerId): void;
     clearCarriedFrom(id: string): void;
     startAttemptUsage(id: string, attempt: number, runner: string, startedAt: string): void;
     recordAttemptUsage(id: string, attempt: number, record: UsageRecord, now: string): void;
-    endAttemptUsage(id: string, attempt: number, now: string): void;
+    endAttemptUsage(id: string, attempt: number, now: string, runnerSessionCost?: RunnerSessionCost, sessionId?: string): void;
     setTaskAttemptSkills(id: string, skills: Task['attemptSkills']): void;
     /**
      * Widen the plan's runner set. Retargeting a task onto a runner the plan has
@@ -165,19 +165,90 @@ declare class PlanStore {
 }
 
 /**
- * The catalog a model/task-mode edit is checked against — the same discovered
- * models and manifest modes the planner was shown in the per-turn catalog
- * block (`PlannerConversation.catalogBlock`), so a refusal here can never name something
- * as invalid that the planner was never told about, or vice versa.
+ * Who writes a task's assignment. It decides what a model the writer names
+ * meets where the task's runner does not offer it or the allowlist excludes it
+ * (ADR-0003), which runners it may put a task on, and whether a live runner's
+ * hold applies (ADR-0041):
+ *
+ * - `plan`: a whole plan the planner submitted, and every planner task as it
+ *   lands. A stray model is replaced, and the planner is told what moved.
+ * - `edit`: the planner's edit. A stray model is refused, which the planner
+ *   answers in the same reply.
+ * - `user`: a user's direct edit. A stray model is refused, with the reason.
+ * - `userAdd`: a task the user adds. A stray model is replaced, and the user
+ *   is told what moved.
+ * - `runner`: a switch made with the runner's own `/model`, written as the
+ *   user's edit. The runner already runs it, so neither the allowlist nor the
+ *   live runner's hold applies.
+ */
+type AssignmentWriter = 'plan' | 'edit' | 'user' | 'userAdd' | 'runner';
+/**
+ * What an assignment is resolved against: the discovered models, the manifest
+ * modes and the allowlist, as the session holds them when the write lands —
+ * the same catalog the planner's per-turn block shows, so nothing is refused
+ * that the planner was never told about.
  */
-interface EditCatalog {
+interface AssignmentCatalog {
+    /** A runner absent, or listed with nothing, has models discovery could not find, not none. */
     modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>;
-    runnerModes: Partial<Record<RunnerId, RunnerModeInfo[]>>;
-    /** Raw (unfiltered) allowlist, keyed by runner — the same shape `coerceAssignments` takes. */
+    /** Absent when no runner's modes are known: no mode is then derived. */
+    runnerModes?: Partial<Record<RunnerId, readonly RunnerModeInfo[]>>;
+    /** Raw (unfiltered) allowlist, keyed by runner; read through {@link effectiveAllowlist}. */
     perRunnerAllowlist?: Partial<Record<RunnerId, string[]>>;
-    /** Full (true) or Guarded: the mode a task the planner writes lands on unless it is read-only (ADR-0031). Full when absent. */
+    /** Full (true) or Guarded: the mode a derived task lands on unless it is read-only (ADR-0001). Full when absent. */
     autonomousDefault?: boolean;
+    /**
+     * Whether a task's runner is live: an attempt of it is claimed, running,
+     * quiet or waiting on someone. Its model, effort and runner are then that
+     * runner's (ADR-0041): the process was started on them, and only the
+     * runner's own command moves them. Absent means none is.
+     */
+    liveRunner?: (taskId: string) => boolean;
+}
+/** What a runner offers a task, as discovery and its manifest have it. */
+interface RunnerCatalog {
+    models: DiscoveredModel[];
+    modes: RunnerModeInfo[];
+}
+/** A change the resolver made to what was written, named so it is never silent (ADR-0001). */
+interface AssignmentAdjustment {
+    taskId: string;
+    title: string;
+    field: 'assignedModel' | 'thinkingEffort';
+    from: string | null;
+    to: string | null;
+}
+
+/** Plan placement and dependency rules, shared with browser-bundled surfaces. */
+interface TreeTask<T> {
+    id: string;
+    order: number;
+    title: string;
+    subtasks?: readonly T[];
+}
+interface DependencyTask<T> extends TreeTask<T> {
+    dependencies: readonly string[];
+}
+interface TaskPlacement<T> {
+    task: T;
+    parent?: T;
+    ancestors: readonly T[];
+    siblings: readonly T[];
+    label: string;
+}
+declare function walkPlan<T extends TreeTask<T>>(tasks: readonly T[]): Generator<TaskPlacement<T>>;
+declare function taskPlacement<T extends TreeTask<T>>(tasks: readonly T[], id: string): TaskPlacement<T> | undefined;
+/** Includes the root: deletion has to detach every edge into the removed tree. */
+declare function subtreeIds<T extends TreeTask<T>>(tasks: readonly T[], id: string): Set<string>;
+/** Pickers offer earlier siblings; API validity is independent of display order. */
+declare function dependencyCandidates<T extends TreeTask<T>>(tasks: readonly T[], taskId?: string): T[];
+/** The surviving tasks whose dependency lists a subtree removal will change. */
+declare function dependentsOf<T extends DependencyTask<T>>(tasks: readonly T[], taskId: string): T[];
+interface DependencyCheck {
+    ok: boolean;
+    error?: string;
 }
+declare function canSetDependencies<T extends DependencyTask<T>>(tasks: readonly T[], taskId: string, dependencies: readonly string[]): DependencyCheck;
 
 /**
  * Targeted task edits emitted by the planner conversation (the 'task_ops'
@@ -231,6 +302,8 @@ interface ApplyTaskOpsResult {
     errors: string[];
     /** Human-readable summary of what changed, for the chat transcript. */
     summary: string[];
+    /** On ok, what the batch's tasks were adjusted to beyond what the planner wrote, as they stand at its end. */
+    adjustments?: AssignmentAdjustment[];
     /** On ok, the id of the task each batch handle names. */
     handles?: ReadonlyMap<string, string>;
 }
@@ -260,22 +333,7 @@ interface TaskRef {
     title: string;
     dependencies: string[];
 }
-/** The tasks listing `taskId` as a dependency — exactly what removing it detaches. */
-declare function dependentsOf<T extends Pick<TaskRef, 'id' | 'dependencies'>>(tasks: T[], taskId: string): T[];
-/**
- * The tasks that may become dependencies of `taskId`: those displayed before it.
- *
- * Offering only earlier tasks is what keeps a hand-edited graph valid without a
- * cycle check — dependencies then only ever point backwards in display order,
- * the same invariant `applyTaskOps` enforces. Omit `taskId` for a task that does
- * not exist yet: it lands last, so every current task is a candidate.
- */
-declare function dependencyCandidates<T extends Pick<TaskRef, 'id' | 'order'>>(tasks: readonly T[], taskId?: string): T[];
-/** Pre-flight check for a hand-edited dependency list: every id exists and comes earlier. */
-declare function canSetDependencies<T extends TaskRef>(tasks: readonly T[], taskId: string, dependencies: string[]): {
-    ok: boolean;
-    error?: string;
-};
+
 /** Pre-flight check for a split: the task exists and is not locked by execution. */
 declare function canSplitTask(tasks: readonly Task[], taskId: string): {
     ok: boolean;
@@ -287,7 +345,7 @@ declare function canSplitTask(tasks: readonly Task[], taskId: string): {
  * completed tasks untouched), or nothing is returned and `errors` explains
  * why. The caller commits `tasks` on ok.
  */
-declare function applyTaskOps(currentTasks: readonly Task[], newOps: TaskOp[], runners: RunnerId[], catalog?: EditCatalog, held?: readonly TaskOp[]): ApplyTaskOpsResult;
+declare function applyTaskOps(currentTasks: readonly Task[], newOps: TaskOp[], runners: RunnerId[], catalog?: AssignmentCatalog, held?: readonly TaskOp[]): ApplyTaskOpsResult;
 
 /**
  * Task skills end to end (ADR-0024): a skill reaches a runner only by being
@@ -358,6 +416,8 @@ interface IsolationRunListener {
     blocked(repos: string[]): void;
     /** An isolated run closed and handed its integration branches over. */
     handoff(handoff: IsolationHandoff): void;
+    /** The run was cleared up and forgotten: nothing was handed over, or it was discarded. */
+    closed(): void;
     /** Already said through the notifications; also for a surface that shows no toasts. */
     notice(level: IsolationNoticeLevel, message: string): void;
 }
@@ -724,6 +784,86 @@ declare class Landing {
     private isGroup;
 }
 
+/**
+ * Why a task cannot start now: the one start rule (ADR-0034), which the
+ * scheduler, the explicit starts, the command seam's refusals, the task row's
+ * merge gate and the planner's notes all read. {@link startWaits} lists every
+ * one that holds, in this order, so the first is the reason a task waits.
+ */
+type StartWait = 
+/** Under way, waiting on the user, or ended: only a retry, a continue or a resume starts it again. */
+{
+    kind: 'started';
+}
+/** Mark complete is landing its work. */
+ | {
+    kind: 'completing';
+}
+/** An AI task with no prompt yet: there is nothing to run. */
+ | {
+    kind: 'no-prompt';
+}
+/** Outside the user's approval record (ADR-0035). */
+ | {
+    kind: 'unapproved';
+}
+/** Pulled out of the scheduler: cancelled, marked not done, or a spawn that failed. */
+ | {
+    kind: 'on-hold';
+}
+/** The failed tasks it waits on through its dependencies (ADR-0034). */
+ | {
+    kind: 'blocked';
+    failed: string[];
+}
+/** What its dependencies still hold it back for (see {@link unmetDependencies}). */
+ | {
+    kind: 'dependencies';
+    waiting: string[];
+}
+/** A force start queued behind the dependencies still under way or yet to run, which starts once they finish. */
+ | {
+    kind: 'queued';
+    waiting: string[];
+}
+/** An ops task, and a Merge all is under way (ADR-0020). */
+ | {
+    kind: 'merging';
+}
+/** Its runner hit its usage limit: nothing more starts on that runner until the reset. */
+ | {
+    kind: 'usage-limit';
+    runner: string;
+}
+/** A planner turn holds new starts until its reply ends (ADR-0029). */
+ | {
+    kind: 'start-hold';
+}
+/** Its merge gate (ADR-0020): the ancestors whose landed work is not in the user's branch yet. */
+ | {
+    kind: 'merge-gate';
+    unmerged: string[];
+}
+/** A user task: the user does it by hand, and nothing starts it. */
+ | {
+    kind: 'by-hand';
+};
+/**
+ * A start the user forced, which goes past what the scheduler waits for: a
+ * hold, a failed dependency (ADR-0034), its runner's usage limit, and the
+ * merge gate they confirmed (ADR-0020). Made now, it is the user's own act
+ * and goes past the whole gate and a planner turn's start hold. Queued behind
+ * its dependencies, it starts later with nobody asking, so it waits for a
+ * start hold as the scheduler's starts do, and goes past only the gate it was
+ * confirmed past: `pastGate`.
+ */
+type ForcedStart = {
+    queued: false;
+} | {
+    queued: true;
+    pastGate: readonly string[];
+};
+
 /**
  * The variables one workspace's planner and agents run with, on top of the
  * daemon's own environment (ADR-0016).
@@ -799,6 +939,23 @@ type TaskLogEvent =
     preTokens?: number;
     postTokens?: number;
 }
+/**
+ * The runner's main thread moved to another model, and what the plan says
+ * once the write-back settled (#106): written from its outcome, not from the
+ * runner's event, so the line never claims an edit that did not land.
+ * `kept` says why the plan did not follow, when it did not. A log saved
+ * before the plan's side was recorded has no `plan`: it says nothing of it.
+ */
+ | {
+    type: 'model_switched';
+    from: RunnerModelRef;
+    to: RunnerModelRef;
+    plan?: {
+        model?: RunnerModelRef;
+        effort?: string;
+    };
+    kept?: string;
+}
 /** What the runner loaded from the user's and the project's setup, as its process started. */
  | {
     type: 'runner_loaded';
@@ -807,13 +964,21 @@ type TaskLogEvent =
 } | {
     type: 'turn_end';
     reason: StructuredTurnEnd;
-} | {
+}
+/**
+ * A piece of the run `runId` of the agent's reply (see `AgentEvent`). A log
+ * saved before runs carried an id has none, and opens each later run of a
+ * turn with the paragraph break that joined it.
+ */
+ | {
     type: 'text_delta';
+    runId?: string;
     text: string;
 }
-/** A complete run of the agent's reply, authoritative over the deltas streamed for it. */
+/** A complete run of the agent's reply, authoritative over the deltas streamed under its `runId`. */
  | {
     type: 'text';
+    runId?: string;
     text: string;
 } | {
     type: 'thinking_delta';
@@ -940,15 +1105,17 @@ declare function trimToolOutput(output: string): {
 };
 /**
  * The log entry for one structured event, or null for what the log does not
- * keep: background-agent launches, which the subagent's own events already show.
+ * keep: background-agent launches, which the subagent's own events already
+ * show, and a model change, which is logged with what the plan made of it.
  */
 declare function toTaskLogEvent(event: StructuredEvent): TaskLogEvent | null;
 /** A log as a surface is sent it, live or read back: everything but the skills' bodies. */
 declare function taskLogForSurface(events: readonly TaskLogEvent[]): TaskLogEvent[];
 /**
- * Merge runs of deltas into one event each. Deltas arrive a few characters at
- * a time; merged, a batch is one message on the wire and one line on disk,
- * and the view folds to the same blocks either way.
+ * Merge consecutive deltas of one stream into one event each: of one run of
+ * text, or of one voice's thinking. Deltas arrive a few characters at a time;
+ * merged, a batch is one message on the wire and one line on disk, and the
+ * view folds to the same blocks either way.
  */
 declare function coalesceTaskLog(events: readonly TaskLogEvent[]): TaskLogEvent[];
 /**
@@ -1078,6 +1245,8 @@ type SurfacePlanState = (Omit<Extract<PlanState, {
 });
 type SerializedPlan = {
     runSettings?: LegacyPlanState['runSettings'];
+    /** What waits on the planner's usage limit, and when it goes, so a surface can say so and offer to cancel it. */
+    plannerResend?: LegacyPlanState['plannerResend'];
     tasks: SerializedTask[];
     runners: RunnerId[];
     generatedAt: string;
@@ -1109,8 +1278,9 @@ type PlannerTurnOutcome = 'message' | 'plan' | 'task_ops' | 'stopped' | 'error';
  * `planner_turn_ended` with the same `turnId`; every turn-scoped message in
  * between carries it. The stream is provisional and the settled messages are
  * authoritative:
- * - `planner_message` replaces the streamed text of the turn's final segment —
- *   a surface drops what it accumulated and shows the message instead.
+ * - `planner_message` settles the streamed text of each run it carries in that
+ *   run's segment, where it streamed — a surface drops what it accumulated
+ *   there and shows the run's text instead.
  * - A reply that is a JSON envelope (plan, taskOps, taskQuery) never arrives
  *   as `planner_text_delta`; it streams as `plan_token`, the "building plan"
  *   display.
@@ -1132,9 +1302,12 @@ type SessionMessage =
 }
 /**
  * The settled reply of a planner turn, emitted by the session once the turn
- * is classified. Authoritative over any `planner_text_delta` of its turn's
- * final segment. `turnId` is absent for replies sent outside a streamed turn.
+ * is classified. `turnId` is absent for replies sent outside a streamed turn.
  * `supervisor`: the supervisor said it in a wake-up turn (ADR-0029).
+ * `runs`: what the reply shows, run by run, each authoritative over its
+ * segment's `planner_text_delta`s; `content` stays the whole reply. Without
+ * runs (a note the conversation wrote, an older daemon) the message is
+ * authoritative over the turn's final segment.
  */
  | {
     type: 'planner_message';
@@ -1142,6 +1315,7 @@ type SessionMessage =
     timestamp: string;
     turnId?: string;
     supervisor?: true;
+    runs?: ReplyRun[];
 }
 /**
  * A planner turn began. Emitted once per turn by whoever runs the turn,
@@ -1334,6 +1508,8 @@ type SessionMessage =
     type: 'isolation_merge';
     result: IsolationMergeResult;
     trigger?: AutoMergeTrigger;
+} | {
+    type: 'run_closed';
 } | {
     type: 'planner_liveness';
 } | {
@@ -1511,6 +1687,22 @@ interface OrchestratorObserver {
         resumeAt: string | null;
         cancelled?: true;
     }): void;
+    /**
+     * A task's runner now answers on another model (#106). `asked` when a model
+     * command sent through its chat chose it: the user's own choice, which the
+     * plan is to follow. `attemptEnded` when the attempt that runs `sessionId`
+     * is no longer the task's, so the switch says nothing of what runs next.
+     * `effort` only where the runner reported one.
+     */
+    onModelSwitched?(data: {
+        taskId: string;
+        sessionId: string;
+        from: RunnerModelRef;
+        model: RunnerModelRef;
+        effort?: string;
+        asked: boolean;
+        attemptEnded: boolean;
+    }): void;
     /** A live task's runner went silent (ADR-0018's idle timer); paused while it waits on input, a checkpoint or an approval. */
     onTaskIdle?(data: {
         taskId: string;
@@ -1541,6 +1733,8 @@ interface OrchestratorObserver {
     }): void;
     /** An isolated run settled; emitted before `onExecutionComplete`, which surfaces treat as terminal. */
     onIsolationHandoff?(handoff: IsolationHandoff): void;
+    /** The isolated run was cleared up and forgotten, by a Merge all that left nothing to hand over or by a discard. */
+    onRunClosed?(): void;
     /**
      * What a run says about how it isolates — the fallback to the workspace root,
      * shared paths, copies, a stash. Beside the notification channel, which a
@@ -1596,6 +1790,12 @@ interface TaskOrchestratorDeps {
     skillsAt: (roots: readonly string[]) => SkillLookup;
     /** What the task's last saved attempt did, or null when it left no log (ADR-0020). */
     previousAttemptFromLog: (taskId: string) => string | null;
+    /**
+     * The newest attempt the task has a saved log for, 0 for none. An attempt's
+     * log is saved under its number, so a new one is numbered past a log kept
+     * from before the task had ledgers.
+     */
+    lastLoggedAttempt: (taskId: string) => number;
     /**
      * The open run's settings, read as each automatic merge is decided rather
      * than copied when the run opens, so a change to the run under way applies
@@ -1625,12 +1825,13 @@ interface TaskOrchestratorOptions {
     workspaceEnv?: (cwd: string) => Promise<WorkspaceEnv>;
     skillsAt?: (roots: readonly string[]) => SkillLookup;
     previousAttemptFromLog?: (taskId: string) => string | null;
+    lastLoggedAttempt?: (taskId: string) => number;
     runSettings?: () => SchedulerRunSettings | undefined;
     /** Every task is approved unless a Session supplies its record: an orchestrator on its own has no user to ask. */
     isApproved?: (taskId: string) => boolean;
 }
 /**
- * The pure scheduler. Owns execution state (`running`, `planStatus`,
+ * The pure scheduler. Owns execution state (the {@link RunState},
  * `reviewApproved`, the live task attempts, the start hold) and the verifier.
  * All task-shaped state — the plan tree, the flat index, the completed set
  * — lives in {@link PlanStore}, injected at construction. The orchestrator
@@ -1647,8 +1848,8 @@ declare class TaskOrchestrator {
     private output;
     private attempts;
     private verifier;
-    private running;
-    private planStatus;
+    /** Changed only by start, stop, a plan load, a usage-limit pause, a move off the limit, and {@link settleRun}. */
+    private runState;
     /** Planner turns in flight that new starts wait for (ADR-0029); running attempts carry on. */
     private startHolds;
     /** Bumped by the user's Stop: a start admitted under an older generation never takes its claim. */
@@ -1660,14 +1861,6 @@ declare class TaskOrchestrator {
     private mergesInFlight;
     private retryCounts;
     private spawnCounts;
-    /** A full-plan run a usage-limit pause holds: no new start until the reset resumes it. */
-    private heldOnLimit;
-    /**
-     * A full-plan run that ended with failed tasks and the tasks they block
-     * (ADR-0034). A retry of a failed task continues it, so what it blocked
-     * starts once it passes — without this the retried task ran alone.
-     */
-    private endedOnFailure;
     /** A Merge all is under way: no ops task starts until it ends (ADR-0020). */
     private merging;
     /** The last "waiting for Merge all" notice, so a run paused at a gate says it once, not on every tick. */
@@ -1683,6 +1876,12 @@ declare class TaskOrchestrator {
      * task whose spawn always throws.
      */
     private onHold;
+    /**
+     * Force starts queued behind dependencies the scheduler will not start them
+     * after: outside a run it drives, or past a failed dependency, which it
+     * never forces. Each starts once those still under way have finished.
+     */
+    private queuedStarts;
     /**
      * Tasks Mark complete is landing after it ended their attempt: in progress
      * with no attempt for as long as that takes, and not orphans for it.
@@ -1704,6 +1903,7 @@ declare class TaskOrchestrator {
     private observers;
     private skillsAt;
     private previousAttemptFromLog;
+    private lastLoggedAttempt;
     private runSettings;
     private isApproved;
     constructor(deps: TaskOrchestratorDeps);
@@ -1820,11 +2020,14 @@ declare class TaskOrchestrator {
     admitStart(): StartAdmission;
     /**
      * Something can still start that nobody has to ask for again: a start
-     * admitted and not yet claimed, or a task that resumes on its own at its
-     * usage limit's reset. A Stop is owed to it, whether or not anything runs.
+     * admitted and not yet claimed, a force start queued behind its
+     * dependencies, or a task that resumes on its own at its usage limit's
+     * reset. A Stop is owed to it, whether or not anything runs.
      */
     get startsPending(): boolean;
-    /** Run `work`, which awaits before it claims, under an admission it holds throughout; it is handed the generation it was admitted under. */
+    /** A start admitted now that nothing has to count as live work: one that claims before it awaits, or follows on from one that did. */
+    private admittedNow;
+    /** Run `work`, which awaits before it claims, under an admission it holds throughout and claims under. */
     private whileAdmitted;
     /**
      * "Merge all"; a settled run that merged everything is cleared up and
@@ -1849,10 +2052,20 @@ declare class TaskOrchestrator {
     runMergeView(): RunMergeView | null;
     /**
      * The ancestors an ops or user task waits on at its merge gate: those whose
-     * landed work is not in the user's branch yet (ADR-0020). Empty once the
-     * task has started, and for every other task.
+     * landed work is not in the user's branch yet (ADR-0020). Empty for every
+     * other task. Judged whatever the task's status but `completed` — a retry of
+     * a failed ops task acts on the checkout as a first start does — so a start
+     * the user is about to confirm is told what it would act without.
      */
     getMergeGate(taskId: string): string[];
+    /**
+     * Every reason a task cannot start now, from the one start rule
+     * (ADR-0034); none when it can. `forced` judges a start the user forced.
+     * Takes the task, not its id: the command seam judges one as a held edit
+     * leaves it.
+     */
+    startWaits(task: Readonly<Task>, forced?: ForcedStart): StartWait[];
+    private startRule;
     /** The failed tasks a task not started yet waits on, through its dependencies (ADR-0034); empty when it is not blocked. */
     getBlockedBy(taskId: string): string[];
     loadPlan(tasks: readonly Task[], planRunners?: RunnerId[]): void;
@@ -1871,8 +2084,16 @@ declare class TaskOrchestrator {
      * not a retry, and the tasks it blocks wait for that retry (ADR-0034).
      */
     reconcilePlan(newTasks: Task[], planRunners?: RunnerId[]): void;
+    /** Start the full-plan run, or continue one that is held or ended on a failure. */
     start(origin?: RunOrigin): Promise<void>;
-    /** A usage-limit pause holds the run: spawning more would spend the same exhausted limit. */
+    /**
+     * A usage-limit pause with a reset to wait for holds the run (ADR-0018,
+     * U1): spawning more would spend the same exhausted limit, and the run
+     * stays open — neither handed over nor merged at its end — however it was
+     * started, so a task started alone keeps its run for the reset too. A pause
+     * no reset will resume holds nothing: it keeps only its own runner's tasks
+     * from starting (`readiness.usage-limit`).
+     */
     private holdOnLimit;
     /**
      * Stop the run. The user's Stop also withdraws every start admitted before
@@ -1932,12 +2153,18 @@ declare class TaskOrchestrator {
      * integration branch.
      */
     private land;
-    /** Settle a task by how its landing went; `onLanded` is what the path that landed it adds to completing it. */
+    /**
+     * Settle a task by how its landing went; `onLanded` is what the path that
+     * landed it adds to completing it. `admission` is the start the landed work
+     * came from, which a repair follows on from.
+     */
     private applyLanding;
     /**
      * Work that did not land waits on the user — it never fails the task or
      * blocks its dependents — unless its conflict is owed a repair, which takes
      * the slot the ending attempt freed and never one more than the run allows.
+     * The repair follows on from the start whose work it repairs: a Stop since
+     * that was admitted withdraws it.
      */
     private settleUnlanded;
     private landResolved;
@@ -1960,10 +2187,10 @@ declare class TaskOrchestrator {
      */
     private openFor;
     /**
-     * {@link openFor} for an explicit start admitted at `admittedAt`. A Stop
-     * while the run opened interrupts that opening too, which then opens
-     * nothing; the start says it was stopped rather than going quiet as if a
-     * dirty tree were waiting on the user.
+     * {@link openFor} for an explicit start under `admission`. A Stop while the
+     * run opened interrupts that opening too, which then opens nothing; the
+     * start says it was stopped rather than going quiet as if a dirty tree were
+     * waiting on the user.
      */
     private openForAdmitted;
     /** The kind a task's next attempt starts as, short of a repair or a continue: what is weighed before one exists. */
@@ -2018,14 +2245,35 @@ declare class TaskOrchestrator {
     /**
      * Keep a task paused on its runner's usage limit from resuming on its own:
      * it waits for a manual retry, as one whose reset time could not be read
-     * does. What a surface's cancel calls, and what moving the task to another
-     * runner has to call first. False when no resume was scheduled for it.
+     * does. What a surface's cancel calls. A run the pause held goes on once
+     * nothing else waits on a reset. False when no resume was scheduled for it.
+     */
+    cancelScheduledResume(taskId: string): Promise<boolean>;
+    /** {@link cancelScheduledResume} without its tick, for a caller that ticks or starts once it is done. */
+    private dropResume;
+    /**
+     * The hold a usage-limit pause put on the run is released once nothing
+     * waits on a reset (ADR-0018, U1) — however the last wait went: the reset,
+     * a cancel, Mark complete or the task leaving the plan. The run is still
+     * open, so the next tick schedules it.
+     */
+    private releaseHold;
+    /**
+     * The runner whose attempt left the task's work, when the task has been
+     * moved off it since: a session cannot cross runners, so whatever starts
+     * the task next is a carry-over of that work, the rule a paused task's move
+     * follows (ADR-0018, U1).
      */
-    cancelScheduledResume(taskId: string): boolean;
+    private movedFrom;
     /**
      * Run before writing assignments so cancellation sees the old runner's
      * shared wait. A session cannot cross runners, so the next attempt is a
      * carry-over of the paused attempt's files (ADR-0018, U1).
+     *
+     * The move routes the task around the limit, so a run the pause held goes
+     * on, as a retry would continue it. That run is still open — a hold never
+     * closes one — and every edit that calls this ticks once it is written,
+     * which starts the task.
      */
     releaseMovedResume(taskId: string, changes: Partial<Task>): Partial<Task>;
     /**
@@ -2070,26 +2318,65 @@ declare class TaskOrchestrator {
     /**
      * Retry a task paused on a usage limit, continuing its saved session where
      * it left one (ADR-0018, K1), then release the hold the pause put on the
-     * run once nothing else waits on a reset.
+     * run once nothing else waits on a reset. `now` is the Resume now that
+     * asked for it, or for another task on its runner, which sweeps it along.
      */
     private resumeTask;
     /**
-     * A resume at the limit's reset that nobody waits on cannot be refused to
-     * anyone, so one that may not claim waits for the user instead — its resume
-     * time dropped, and said — unless a Stop is why, which said so itself.
+     * A resume nobody asked for cannot be refused to anyone. At the limit's
+     * reset, one that may not claim waits for the user instead — its resume
+     * time dropped, and said. One swept along by a Resume now keeps its resume
+     * time, which its caller arms again: the reset has not come. A Stop says
+     * so itself.
      */
-    private mayResumeAtReset;
+    private mayResume;
     /**
-     * Manually start a single AI task right now, bypassing dependency/readiness
-     * gating (the "force start" affordance on a task card) but never the claim:
-     * it still needs the user's approval, a free slot, and no Stop since it was
-     * asked for, and throws {@link TaskControlError} saying which it lacks.
+     * Manually start a single AI task right now (the "force start" affordance on
+     * a task card), past a failed dependency (ADR-0034) or a merge gate
+     * (ADR-0020), but never past the claim: it still needs the user's approval,
+     * a free slot, and no Stop since it was asked for, and throws
+     * {@link TaskControlError} saying which it lacks. A dependency still under
+     * way or yet to run is not forced past: the task is released to the
+     * scheduler instead, which starts it once they finish, and the line saying
+     * so is the answer.
      * Reuses the scheduler's own claim so a force-started task gets the same
      * augmented prompt, session tracking, and exit handling — callers must not
      * re-spawn the runner themselves. No-op if the task is unknown, not an AI
      * task, or already running.
      */
-    forceStartTask(taskId: string, origin?: RunOrigin): Promise<void>;
+    forceStartTask(taskId: string, origin?: RunOrigin): Promise<string | undefined>;
+    /**
+     * A forced start, from its run opening to its claim. It is judged again once
+     * the run has opened, against the task as it stands then, which is what
+     * the claim reads and runs. A queued one that something holds back again
+     * meanwhile goes back in the queue; one made now that an edit gave
+     * dependencies still under way waits for them as if forced after the edit,
+     * and says so.
+     */
+    private startForced;
+    /**
+     * A force start of a task whose dependencies are still under way or yet to
+     * run: started now, it would build on work that is not there, so it waits
+     * for them in the run, off any hold, and says so. Dependencies are never
+     * bypassed silently. A blocked task is forced past its failure as asked.
+     * What it goes past at the merge gate is the gate the user confirmed now.
+     */
+    private queueBehindDependencies;
+    /**
+     * Starts the queued force starts nothing holds back any more. One the
+     * scheduler now drives the run for, that nothing blocks and that was not
+     * confirmed past a gate, is left to it. One at a gate the user did not
+     * confirm — work that landed after they forced the start — waits for Merge
+     * all, or for another force start, and says so once.
+     */
+    private startQueued;
+    /**
+     * A queued start the start rule holds back, at a gate it was not confirmed
+     * past or otherwise. Taken out of the queue by now, so its dependencies
+     * still under way read as `dependencies` rather than `queued`.
+     */
+    private holdsQueued;
+    private sayQueuedAtGate;
     private refuseOpsDuringMerge;
     /**
      * A force start passes a merge gate (ADR-0020), and the surface confirmed it
@@ -2097,24 +2384,27 @@ declare class TaskOrchestrator {
      * on is not in the user's branch.
      */
     private notePastGate;
-    /**
-     * Run exactly one task outside full-plan scheduling. The active/starting
-     * session still contributes to {@link hasLiveWork} so every surface exposes
-     * Stop and disables Execute Plan, but onVerdict cannot auto-schedule other
-     * tasks because the plan scheduler's `running` flag remains false.
-     */
-    runTask(taskId: string): Promise<void>;
     getCompletedCount(): number;
     getTotalCount(): number;
     isAllComplete(): boolean;
     isAnyFailed(): boolean;
     approveReview(origin?: RunOrigin): Promise<void>;
     tick(): Promise<void>;
-    /** How a run that ended on failures ends: what it finished, what failed, and what that blocks. */
+    /**
+     * The one step that decides, with nothing at work and nothing the scheduler
+     * can start, whether the run goes on, is held, waits on the user or is over
+     * (ADR-0034). Every surface takes `onExecutionComplete` as the run's end, so
+     * only an end emits it. A run the scheduler is not driving — tasks started
+     * on their own — ends on a verdict; a cancel, Mark complete or failed spawn
+     * just closes it, so the next run decides its own mode rather than inherit
+     * this one's.
+     */
+    private settleRun;
     /** Skipped work is not completed work, so a run with any says so rather than that everything completed. */
     private sayFinished;
+    /** How a run that ended on failures ends: what it finished, what failed, and what that blocks. */
     private sayEndedOnFailure;
-    /** Whether the scheduler may start `id` now: it passes every readiness gate and a slot is free. */
+    /** Whether the scheduler may start `id` now: nothing in the start rule holds it back, and a slot is free. */
     private stillReady;
     /**
      * A run paused at merge gates says so, as plainly as a task that waits on
@@ -2123,9 +2413,10 @@ declare class TaskOrchestrator {
     private sayGate;
     /**
      * Why a start may not take its claim now, or null when it may: a Stop came
-     * since it was admitted (ADR-0029), the task is outside the user's approval
-     * record (ADR-0035), or every slot is taken. Read in the same synchronous
-     * step as the claim it guards, so nothing can change in between.
+     * since it was admitted (ADR-0029), the task left the plan or is being
+     * marked complete, it is outside the user's approval record (ADR-0035), or
+     * every slot is taken. Read in the same synchronous step as the claim it
+     * guards, so nothing can change in between.
      */
     private claimRefusal;
     /** An explicit start's refusal, before it changes anything: its caller's answer, as a {@link TaskControlError}. */
@@ -2137,7 +2428,10 @@ declare class TaskOrchestrator {
      * start, a retry's, a continue, a resume, a repair. Checked and taken in one
      * synchronous step ({@link claimRefusal}), then marked claimed before
      * anything is awaited, so no other start can take the same task or slot.
-     * A task already claimed is not claimed again: there is nothing to start.
+     * The task is read here, as it stands: a start that awaited first — its run
+     * opening, the user's answer — runs what the plan holds now, not what it
+     * held when it was asked for. A task already claimed is not claimed again:
+     * there is nothing to start.
      */
     private claim;
     private runClaimed;
@@ -2165,6 +2459,8 @@ declare class TaskOrchestrator {
      * A spawn whose attempt ended while it was in flight: kill what it produced
      * and take back the claim it made. Only the claim — whatever ended the
      * attempt may have decided the task since (mark complete, cancel, retry).
+     * A task Mark complete is landing stays in progress until that lands:
+     * back to not started, the scheduler would start it again under the landing.
      */
     private abandonSpawn;
     private tell;
@@ -2194,153 +2490,1828 @@ declare class TaskOrchestrator {
 }
 
 /**
- * Task references: the one grammar for naming a task in a plan, both ways.
- * A label is rendered from a task's order under its parent ("2", "2.1"), and
- * a reference written by anyone — the planner, a tool call, a command — is
- * resolved back against the plan tree. Pure and import-free so a
- * browser-bundled surface can use it through `@ordewell/core/plan-utils`.
+ * The planner's read channel: a `{"taskQuery":{...}}` reply asking Ordewell to
+ * show it what the per-turn plan block deliberately leaves out.
+ *
+ * The plan block carries only short fields, so a planner asked to "add a line
+ * to task 3's prompt" would be rewriting text it has never read. Inlining every
+ * body on every turn was rejected — a twenty-task plan re-sends thousands of
+ * tokens per message — so the planner asks instead, and pays for the detail
+ * only on the turns it uses it.
+ *
+ * This module owns the wire shape and the rendering of the answer; the loop,
+ * the budgets and the injection live in the Session, and the classification
+ * lives in PlanRepair alongside the plan and task-ops envelopes.
  */
-/** The shape a reference resolves over: the plan's task tree, or a surface's projection of it. */
-interface RefTask<T> {
-    id: string;
-    order: number;
-    title: string;
-    subtasks?: readonly T[];
-}
+/** The long fields a query may ask for. Everything else is already in the plan block. */
+declare const TASK_QUERY_FIELDS: readonly ["description", "prompt", "userSteps", "verdict", "outputSummary", "userStoriesCovered", "skills", "output"];
+type TaskQueryField = typeof TASK_QUERY_FIELDS[number];
+/** Lines a `output` read returns when the query sets no count. */
+declare const OUTPUT_LINES_DEFAULT = 80;
+/** Hard cap on `outputLines` — the tail read is bounded however the planner asks. */
+declare const OUTPUT_LINES_MAX = 400;
 /**
- * The parent a label extends. A label is the full path ("3.2.1"), so a parent
- * below the top level carries the label it was itself reached by; without one
- * the parent's order stands for it, which is right for a top-level parent.
+ * Character budget the rendered answer converges to. A running output tail is
+ * the only part with no natural bound — a runner may print for minutes — so
+ * the tail absorbs the clamp; everything else (task bodies, the catalog cap)
+ * is bounded upstream.
  */
-interface RefParent {
-    order: number;
-    label?: string;
+declare const TASK_QUERY_ANSWER_MAX_CHARS = 20000;
+interface TaskQuery {
+    /** Task references to read in full, as {@link resolveTaskRef} reads them. */
+    tasks: string[];
+    /** Narrows what comes back. Omitted means every field in {@link TASK_QUERY_FIELDS}. */
+    fields?: TaskQueryField[];
+    /** Also return the full runner/model catalog with labels, variants and mode descriptions. */
+    catalog: boolean;
+    /** Line count for `output` reads. Clamped at render to [1, {@link OUTPUT_LINES_MAX}]. */
+    outputLines?: number;
+    /** A previous answer's next offset: the output tail then covers only what came after it. */
+    outputSince?: number;
+}
+declare function textHasTaskQuery(text: string): boolean;
+/** Parse a `{"taskQuery":...}` reply. Throws PlanParseError when the JSON is unusable. */
+declare function parseTaskQueryJson(text: string): TaskQuery;
+/** Stable identity of a query, so a turn can recognise the planner asking the same thing twice. */
+declare function taskQuerySignature(query: TaskQuery): string;
+/** What a full-catalog read is answered from. Models arrive already allowlist-filtered. */
+interface TaskQueryCatalog {
+    runners: RunnerId[];
+    models: Partial<Record<RunnerId, DiscoveredModel[]>>;
+    modes: Record<RunnerId, RunnerModeInfo[]>;
+    autonomousDefault: boolean;
 }
-/** Dotted path label for a task, e.g. "2.1" for the first subtask of task 2, "2.1.3" one level down. */
-declare function taskOrderLabel(task: {
-    order: number;
-}, parent?: RefParent): string;
-/** How a surface refers to a task in prose: "#2", or "#2.1" for a subtask. */
-declare function taskRef(task: {
-    order: number;
-}, parent?: RefParent): string;
-/** A task named in full, as a confirmation or a picker title does: "#2 Deploy". */
-declare function titledTaskRef(task: {
-    order: number;
-    title: string;
-}, parent?: RefParent): string;
 /**
- * The reference {@link taskRef} renders for the task a plan tree holds, by id
- * — its full path, dotted, for a subtask. Undefined when the tree holds no such task.
+ * Appended when the planner has spent its read budget, or asked the identical
+ * question twice. The detail still comes back — refusing it would leave the
+ * planner editing text it has not read, which is the whole failure this
+ * channel exists to prevent — but the turn is told to land.
  */
-declare function taskRefOf<T extends RefTask<T>>(tasks: readonly T[], id: string): string | undefined;
+declare const TASK_QUERY_ANSWER_OR_OPS: string;
 /**
- * The reference and title {@link titledTaskRef} renders for the task a plan
- * tree holds, by id — its full path, dotted, for a subtask. Undefined when the
- * tree holds no such task.
+ * The protocol as the planner is taught it, owned here beside the parser so the
+ * two cannot drift. Both planner backends get these lines verbatim (ADR-0009):
+ * a harness planner has no tool loop to reach, so the envelope is the channel.
  */
-declare function titledTaskRefOf<T extends RefTask<T>>(tasks: readonly T[], id: string): string | undefined;
+declare const TASK_QUERY_PROTOCOL: string[];
+/** The one-line reminder the per-turn plan block carries, so the protocol has a single owner. */
+declare const TASK_QUERY_REMINDER = "- To READ a task in full (prompt, user steps, verdict, output, user stories) or the whole model/mode catalog before editing, reply with ONLY {\"taskQuery\":{\"tasks\":[\"<id or #order>\"],\"catalog\":true}} \u2014 it changes nothing, and you then reply again with your ops.";
 /**
- * Resolve a written reference to a task at any depth: an id, then an order
- * label with or without "#" ("#2", "2", "#2.1"), then an exact title.
- *
- * An order label is read against the tree, never a flattened list: subtask
- * orders restart at 1 under each parent, so "#2" always means top-level task 2
- * and a subtask is reachable only by its dotted path ("#2.1", "#2.1.3").
+ * Where an `output` read is answered from: the orchestrator's live capture of
+ * the task's latest attempt. Injected so this module stays planner-side and
+ * never imports the orchestrator.
  */
-declare function resolveTaskRef<T extends RefTask<T>>(tasks: readonly T[], ref: string | number): T | undefined;
+type LiveOutputLookup = (taskId: string, opts: LiveTailOptions) => LiveTail | null;
+/**
+ * Render the injected answer to one read. Never persisted — it is context for
+ * the planner's next reply and nothing else — so it is built fresh from live
+ * state on every query rather than cached. `liveOutput` backs the `output`
+ * field; omitting it reads as "nothing captured".
+ */
+declare function renderTaskQueryAnswer(query: TaskQuery, tasks: readonly Task[], catalog: TaskQueryCatalog, liveOutput?: LiveOutputLookup): string;
 
 /**
- * Pure, no-imports helper so a browser surface can format a conflict's files
- * without pulling `isolationRecord` — and its `path` import — into a webview
- * bundle. Kept out of `isolationRecord.ts` for exactly that reason.
+ * The SSRF guard for anything that leaves the machine on the planner's behalf.
+ * An unguarded `http://169.254.169.254/` would hand a prompt-injected planner
+ * the cloud metadata credentials, so every outbound host is vetted here: IP
+ * literals by range, names by every address DNS answers with.
  */
-declare function capConflictFiles(files: string[], max?: number): string;
+type ResolveAll = (host: string) => Promise<string[]>;
 
-/** How a run is started, watched and merged: the user's, not a plan's (ADR-0030). */
-interface GlobalRunSettings {
-    supervisorLevel: SupervisorLevel;
-    mergeAtGatesAutomatically: boolean;
-    /** Start a plan when the planner submits it, approved as if the user had pressed Execute. */
-    autorun: boolean;
-    /** Retries an Act supervisor may make of one task in a run (a loop guard). */
-    supervisorRetryLimit: number;
-    /** Reads a wake-up turn may make, in place of a user message's caps. */
-    wakeUpReadBudget: number;
+/**
+ * The one decision every planner web read goes through, whichever runner
+ * plans and whichever path carries the bytes (ADR-0027). A fetch names the
+ * URL it reads; a search names its query and the provider that receives it.
+ */
+type WebRead = {
+    kind: 'fetch';
+    url: string;
 }
-declare const RUN_SETTINGS_DEFAULTS: Readonly<GlobalRunSettings>;
-declare class RunSettingsError extends Error {
-    constructor(message: string);
+/** `provider` keys the grant; `providerLabel`, when given, names it to the person asked. */
+ | {
+    kind: 'search';
+    query: string;
+    provider: string;
+    providerLabel?: string;
+    note?: string;
+};
+/** A refusal's `reason` is written for the planner: it says what to do next. */
+type WebReadDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+};
+interface DecideOptions {
+    /**
+     * Research subagents run in the background where nothing can prompt
+     * (ADR-0008, T6). When false, a read that would ask is refused with the gap
+     * to report, rather than raising a prompt nobody can answer.
+     */
+    prompting?: boolean;
 }
-interface UserSettings {
-    modelAllowlist?: Record<string, string[]>;
-    /** Last model (and its thinking effort) the user chose for each planner backend, keyed by planner backend id. */
-    plannerModels?: Record<string, {
-        model: string;
-        effort?: string;
-    }>;
+interface WebReadPolicyOptions {
+    approval: IApproval;
+    /** The secrets Ordewell holds — provider keys, MCP tokens — read per request. */
+    secrets?: () => Iterable<string>;
+    /** Defaults to `process.env`; its credential-named values are secrets too. */
+    env?: () => Record<string, string | undefined>;
+    /** How many web reads one planner turn may make; read per request, so a settings change applies at once. */
+    budget?: () => number;
+    /** The planner turn in progress; a new one starts a new budget. */
+    turn?: () => string | undefined;
+    /** Override DNS resolution (every answer for a name) in tests. */
+    resolveHost?: ResolveAll;
+}
+declare const DEFAULT_WEB_READ_BUDGET = 40;
+declare class WebReadPolicy {
+    private readonly approval;
+    private readonly resolveHost;
+    private readonly secrets;
+    private readonly env;
+    private readonly budget;
+    private readonly turn;
+    private spent;
+    constructor(opts: WebReadPolicyOptions);
     /**
-     * Runners the user picked for planning. Absent — not empty — is what falls
-     * back to the environment's defaults; `[]` is a deliberate "none of them".
+     * Every check that needs no network runs first, then the budget and the
+     * approval, and only then is a fetch's host resolved: a lookup is itself a
+     * request, so `<data>.attacker.example` would leave through DNS even for a
+     * read that is then excluded, over budget or declined.
      */
-    enabledRunners?: string[];
-    /** Full (true) or Guarded (false), ADR-0001; Full until the user chooses. */
-    autonomousMode?: boolean;
-    supervisorLevel?: SupervisorLevel;
-    mergeAtGatesAutomatically?: boolean;
-    autorun?: boolean;
-    supervisorRetryLimit?: number;
-    wakeUpReadBudget?: number;
+    decide(read: WebRead, opts?: DecideOptions): Promise<WebReadDecision>;
+    private subagentRefusal;
+    /**
+     * Whether a search through `provider` would run without asking anyone, for
+     * a runner whose own search raises no request and is set on or off when
+     * its session starts (ADR-0027). A zero budget disables it; no query is
+     * known yet, so secrets and individual reads cannot be checked or counted.
+     */
+    searchesUnasked(provider: string): boolean;
+    /** The last check, the one that leaves the machine: every DNS answer for the host must be public. */
+    private resolved;
+    private refuse;
+    private vetFetch;
+    private vetSearch;
+    private spend;
+    private refund;
+    private carriesSecret;
 }
-/**
- * The model allowlist, remembered planner models and enabled runners are shared
- * across processes by default. `ORDEWELL_SETTINGS_PATH` lets independent runs
- * use separate files: otherwise a write in one run would change another's
- * settings when `getAll()` detects the new mtime.
- */
-declare function getSettingsPath(): string;
-/** The run settings `settings` holds, each one it leaves out at its default. */
-declare function runSettingsOf(settings: UserSettings): GlobalRunSettings;
-declare class SettingsService {
-    private filePath;
-    private cache;
-    private cachedMtimeMs;
-    constructor(filePath?: string);
-    getAll(): UserSettings;
-    private fileMtimeMs;
-    getModelAllowlist(runner: string): string[] | undefined;
-    setModelAllowlist(runner: string, ids: string[] | undefined): void;
-    getPlannerModel(provider: string): {
-        model: string;
-        effort?: string;
-    } | undefined;
-    setPlannerModel(provider: string, entry: {
-        model: string;
-        effort?: string;
-    } | undefined): void;
-    getEnabledRunners(): string[] | undefined;
-    setEnabledRunners(ids: string[]): void;
+
+interface IWebFetcher {
     /**
-     * Full or Guarded (ADR-0001), as saved here (ADR-0030). A value set in the
-     * environment wins, so a script or CI run can fix its own without touching
-     * the user's file.
+     * The web-read policy's decision (ADR-0027), for a read this fetcher will
+     * carry or one a runner carries natively, such as Claude's `WebFetch`.
+     * `fetch` and `search` decide for themselves; never call both.
      */
-    autonomousMode(): boolean;
-    /** Whether `ORDEWELL_AUTONOMOUS_MODE` decides the level, whatever this file says. */
-    autonomousModeOverridden(): boolean;
-    setAutonomousMode(enabled: boolean): void;
-    getRunSettings(): GlobalRunSettings;
-    /** Checks every value before writing any, so a refused change saves nothing. */
-    updateRunSettings(changes: Partial<GlobalRunSettings>): GlobalRunSettings;
-    private load;
-    private persist;
+    decide(read: WebRead): Promise<WebReadDecision>;
+    /** Whether a runner's own search through `provider` would run unasked; see `WebReadPolicy.searchesUnasked`. */
+    searchesUnasked?(provider: string): boolean;
+    fetch(url: string): Promise<ToolOutcome>;
+    /**
+     * Optional web search. A fetcher without it makes the `web_search` tool
+     * report itself unavailable rather than failing the turn — the same
+     * degradation `fetch` already uses when no fetcher is wired at all.
+     */
+    search?(query: string): Promise<ToolOutcome>;
+    /**
+     * A variant of this fetcher for a research subagent: same policy, cache,
+     * transport and budget, but a read that would ask a person is refused
+     * instead (ADR-0027, ADR-0008 T6). Absent means subagents get no web tools
+     * and the `fetch`/`web_search` tools report themselves unavailable.
+     */
+    forSubagent?(): IWebFetcher;
 }
 
-declare const EMPTY_RUN: RunView;
-declare function reduceRun(view: RunView, input: RunInput): RunView;
+/**
+ * A person's approvals of project MCP servers, kept across sessions
+ * (ADR-0028). Keyed by repository root and scope, which names the server
+ * and hashes its definition: a changed definition is a new question.
+ */
+interface ProjectServerApprovals {
+    approved(repoRoot: string, scope: string): boolean;
+    remember(repoRoot: string, scope: string): void;
+}
 
-/** What the blocked rule reads of a task; structural, so a surface's own task shape answers it too. */
-interface BlockingSubject {
+interface CliAgentAiServiceDeps extends Partial<AgentProcessDeps> {
+    /** Overrides adapter construction. Tests supply a fake agent; production picks by runner id. */
+    createAdapter?: (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
+    /** Workspace root the agent explores. Defaults to the host process's cwd. */
+    workspaceRoot?: () => string;
+    /** Where a conversation's planner tools are served (ADR-0022). Absent: no conversation can start. */
+    mcpServer?: OrdewellMcpServer;
+    /** A person's approvals of project MCP servers, kept across sessions (ADR-0028). Defaults to Ordewell's data directory. */
+    projectServerApprovals?: ProjectServerApprovals;
+}
+/**
+ * A coding agent driven as Ordewell's planner (ADR-0009).
+ *
+ * The second transport behind `IAiService`, sitting beside `OpenAiService` and
+ * `GeminiService`. It deliberately does **not** extend {@link BaseAiService}:
+ * that class's body is Ordewell executing research tools on a model's behalf,
+ * which is precisely the part a coding agent replaces. What it reuses instead
+ * is everything above the transport — `settleReply` (the empty-reply nudge
+ * and the turn's settling), the plan validator, the `ResearchProgress` events the
+ * four surfaces already render. That is why this backend reaches VS Code, the
+ * web UI, the CLI and the TUI without any of them learning a coding agent is
+ * on the other end.
+ */
+declare class CliAgentAiService implements IAiService {
+    private config;
+    private readonly runner;
+    private readonly processDeps;
+    private readonly makeAdapter;
+    private readonly workspaceRoot;
+    private environmentSecrets;
+    /** The conversation's session, from its start until the next session boundary. */
+    private session;
+    private readonly mcpServer;
+    private readonly projectServerApprovals;
+    private activeAbort;
+    constructor(config: IConfig, deps?: CliAgentAiServiceDeps);
+    hasActiveConversation(): boolean;
+    /**
+     * False when the running agent process was spawned under a model/effort the
+     * user has since changed in the picker. Unlike a vendor backend, the model
+     * is a spawn-time argument to the agent CLI (`--model`), not a per-request
+     * field — `continueConversation` sends the next turn to whatever process is
+     * already running, so a plain config read here would silently keep planning
+     * on the old model. No conversation yet is vacuously "current".
+     */
+    conversationMatchesConfig(): boolean;
+    /** Always: a conversation whose planner cannot reach the Ordewell MCP server fails to start rather than falling back to the envelopes. */
+    plannerToolsAttached(): boolean;
+    /** The agent's own session id, a resumption hint only — Ordewell's transcript is authoritative (T4). */
+    nativeSessionId(): string | null;
+    heldSecrets(): readonly string[];
+    restart(): void;
+    reset(): void;
+    startConversation(req: ConversationRequest): Promise<ConversationTurn>;
+    continueConversation(userMessage: string, onProgress: (progress: ResearchProgress) => void, signal?: AbortSignal): Promise<ConversationTurn>;
+    private openingMessage;
+    /**
+     * Drive one user message to a settled planner turn through
+     * {@link settleReply}, the loop the API backend settles through too. The
+     * tool rounds belong to the agent now, so one call is one agent turn —
+     * continued while it left subagents running in the background.
+     */
+    private runConversation;
+    /**
+     * Run one agent turn: stream its events into `ResearchProgress`, collect the
+     * reply text, and return the research steps produced. Tool calls are matched
+     * to their results by the agent's own call id — matching by tool name puts
+     * one file's body on another file's row the moment an agent runs two reads
+     * at once, which all three of these do routinely.
+     */
+    /**
+     * A turn, and then — while the agent ended it with subagents still in the
+     * background — a turn asking it to wait for them: whatever they find would
+     * otherwise be said into a closed turn, or, in a one-shot, into a session
+     * already thrown away. Bounded by `waits`, shared across a reply's sends.
+     */
+    private runTurnAwaitingAgents;
+    private runTurn;
+    /**
+     * The only way this service starts an agent, and it takes a planner start by
+     * type: the read-only boundary (ADR-0008/0009) cannot be crossed into task
+     * mode from here without changing this signature. A planner that cannot
+     * reach its tools cannot submit a plan, so it is respawned once and never
+     * left to plan without them (ADR-0025).
+     */
+    private startAdapter;
+    private newAdapter;
+    /** Whether the web-read policy lets the runner's own session-wide search run unasked now (ADR-0027). */
+    private nativeSearch;
+    /**
+     * The live agent process, restarted from its own session id if it died
+     * between turns. Resume is a hint: when it fails, the caller's next
+     * `startConversation` reseeds from Ordewell's transcript, which is the same
+     * degradation `restoreChat` already performs on every surface.
+     *
+     * Also restarted when the policy's decision on the runner's own search has
+     * changed since the process was spawned: the running thread would otherwise
+     * keep searching unasked after Full turned Guarded. Codex 0.162 applies
+     * `thread/resume`'s `config.web_search` either way (checked live).
+     */
+    private ensureAdapter;
+    /**
+     * What the planner gets of the repository's config, its runner being
+     * launched without it (ADR-0028): the instruction files, which are text, in
+     * its system prompt, and the project MCP servers it may start. Decided once
+     * per conversation, so a respawn starts the same servers without asking.
+     */
+    private repoConfig;
+    private plannerModel;
+    /**
+     * A plan from one-shot agent sessions: only what a submit_plan call
+     * accepted, never the reply text, so a plan the tool refused cannot come
+     * back in as the JSON the agent echoed. A session that ends without an
+     * accepted call is followed by one corrective session, then fails.
+     */
+    private submittedPlan;
+    /**
+     * A single agent session that answers one prompt and exits. Used by every
+     * non-conversational entry point. A plan-shaped envelope in its text
+     * streams to the plan display, as a vendor planner's one-shot does, and the
+     * prose around it is not streamed at all, since no turn is open to show it in.
+     */
+    private oneShot;
+    researchAndPlan(userDescription: string, runners: RunnerId[], modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, fs: IFileSystem, onProgress: (progress: ResearchProgress) => void, _fetcher?: IWebFetcher, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, signal?: AbortSignal): Promise<{
+        tasks: Task[];
+        researchLog: ResearchLogEntry[];
+        researchResults: string;
+    }>;
+    generatePlanDirect(userDescription: string, runners?: RunnerId[], modelsByRunner?: Partial<Record<RunnerId, DiscoveredModel[]>>, onToken?: (token: string) => void, _fs?: IFileSystem, _fetcher?: IWebFetcher, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, signal?: AbortSignal): Promise<Task[]>;
+}
+
+/**
+ * The planner tools a session offers its conversation (ADR-0022). A backend
+ * that can inject the Ordewell MCP server into its planner issues a planner
+ * token bound to `sessionId` and these handlers; API planners use the same task read handlers directly in their tool loop.
+ */
+interface PlannerToolsOffer {
+    sessionId: string;
+    handler: PlannerToolHandler;
+}
+/**
+ * Everything the conversation loop needs to start planning (ADR-0002).
+ * The AI service keeps the tool-use message history internally across turns;
+ * the surfaces only exchange user/assistant messages with it.
+ */
+interface ConversationRequest {
+    goal: string;
+    runners: RunnerId[];
+    modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>;
+    fs: IFileSystem;
+    onProgress: (progress: ResearchProgress) => void;
+    fetcher?: IWebFetcher;
+    runnerModes?: Record<RunnerId, RunnerModeInfo[]>;
+    autonomousDefault?: boolean;
+    /** Where tasks will run (ADR-0013, ADR-0014): in worktrees, the prompt drops file-overlap ordering and describes a repo group. */
+    isolatedExecution?: IsolatedExecution;
+    /** A plan the planner submits starts at once (ADR-0030), so the opening prompt has no outline gate. */
+    autorun?: boolean;
+    signal?: AbortSignal;
+    /**
+     * Persisted dialogue to seed a resumed conversation (session reload). The
+     * turns are injected into the message history verbatim — no LLM call happens
+     * for them; the first call is the turn opened by `initialMessage`.
+     */
+    priorHistory?: ConversationMessage[];
+    /**
+     * The user message that opens this turn. Defaults to `goal` — set it when
+     * resuming so the system prompt keeps the original goal while the turn
+     * carries the user's new message.
+     */
+    initialMessage?: string;
+    plannerTools?: PlannerToolsOffer;
+    /**
+     * The session's approval policy, which a harness planner's own tool
+     * requests are decided against as the API planner's are (ADR-0026). Absent:
+     * nobody can be asked, so they are denied.
+     */
+    approval?: IApproval;
+    /**
+     * The workspace's skill catalog. Every planner is shown the task skills it
+     * may attach; only one with tools is shown the planner skills, which load
+     * through `load_skill` alone (ADR-0024).
+     */
+    skills?: readonly SkillInfo[];
+}
+/**
+ * A run of a turn's reply text, as a backend reports it. `narration`: it began
+ * before its call's last tool call, so it stays when a corrective retry
+ * discards what the call replied.
+ */
+interface TurnRun extends ReplyRun {
+    narration?: true;
+}
+/**
+ * One planner turn's outcome. The planner talks to the user (`message`),
+ * commits a full plan (`plan`, a `{tasks:[...]}` JSON object), emits targeted
+ * task edits (`task_ops`, a `{taskOps:[...]}` JSON object), or asks to read
+ * task bodies and the full catalog before editing (`task_query`, a
+ * `{taskQuery:{...}}` JSON object). The Session validates and applies task ops
+ * atomically and answers queries out of its own state; the AI service only
+ * parses them.
+ */
+type ConversationTurn = 
+/**
+ * `aborted`: the call was stopped, and `text` is only what it had by then.
+ * `failed`: the call ended without a reply (a dead agent, a usage limit),
+ * and `text` says why; `usageLimit`, where the runner also said in a field
+ * whether that was its usage limit (see {@link TurnFailure}).
+ * `runs`, on every kind: the reply's runs the turn's surviving calls
+ * streamed, in order, and last a note written in the planner's place when
+ * `text` is one. An envelope's own run is not among them. Absent from a
+ * backend that does not report runs.
+ */
+{
+    kind: 'message';
+    text: string;
+    researchLog: ResearchLogEntry[];
+    aborted?: boolean;
+    failed?: boolean;
+    usageLimit?: UsageLimitSignal | false;
+    runs?: TurnRun[];
+} | {
+    kind: 'plan';
+    tasks: Task[];
+    text: string;
+    researchLog: ResearchLogEntry[];
+    runs?: TurnRun[];
+} | {
+    kind: 'task_ops';
+    ops: TaskOp[];
+    text: string;
+    researchLog: ResearchLogEntry[];
+    runs?: TurnRun[];
+} | {
+    kind: 'task_query';
+    query: TaskQuery;
+    text: string;
+    researchLog: ResearchLogEntry[];
+    runs?: TurnRun[];
+};
+interface IAiService {
+    /** Credential values from the harness planner's effective environment, for the outbound secret check. */
+    heldSecrets?(): readonly string[];
+    /**
+     * Begin the planner conversation: collect workspace context, run the
+     * research/tool loop, and return the first planner turn. The service
+     * retains the full API message history for subsequent
+     * {@link continueConversation} calls.
+     */
+    startConversation(req: ConversationRequest): Promise<ConversationTurn>;
+    /**
+     * Feed the user's reply into the active conversation and return the next
+     * planner turn. Throws if no conversation is active.
+     */
+    continueConversation(userMessage: string, onProgress: (progress: ResearchProgress) => void, signal?: AbortSignal): Promise<ConversationTurn>;
+    /**
+     * Whether a planner conversation is currently held in memory. A branching
+     * predicate only — never a test for whether there is anything to release.
+     * The harness backend holds an OS process that outlives its conversation, so
+     * guarding {@link reset} with this leaks an agent process; call `reset`
+     * unconditionally instead.
+     */
+    hasActiveConversation(): boolean;
+    /**
+     * Optional: end the planner's live process but keep its own session id, so
+     * the next turn starts a fresh one resumed from it (ADR-0009). What a
+     * supervisor does to a planner that crashed or hung (ADR-0029). Absent where
+     * there is no process to end: the next call is a fresh request anyway.
+     */
+    restart?(): void;
+    /**
+     * Whether the active conversation (if any) still matches the planner
+     * model/effort currently configured. Optional, and true when absent: a
+     * vendor backend re-reads its model from config on every turn, so there is
+     * nothing to drift. A harness planner (ADR-0009) is the exception — its
+     * model is baked into the agent process at spawn — so only
+     * {@link CliAgentAiService} answers this for real. False tells the caller
+     * the same thing an absent conversation would: don't call
+     * `continueConversation`, restart instead so the new model takes effect.
+     */
+    conversationMatchesConfig?(): boolean;
+    /**
+     * Whether the planner reads the catalog and submits plans through Ordewell's
+     * MCP tools (ADR-0022). Optional, and false when absent: only a harness
+     * planner the server attached to has them, and every other planner keeps
+     * the per-turn catalog and the envelopes.
+     */
+    plannerToolsAttached?(): boolean;
+    /**
+     * Optional: prune bulky raw tool output out of the live conversation, in
+     * place, keeping subagent digests. Returns the characters removed. Absent
+     * where the backend holds no tool transcript to prune (a harness planner's
+     * agent owns its own context).
+     */
+    pruneContext?(): number;
+    /**
+     * One-shot research + plan for non-conversational surfaces (CLI `plan --goal`,
+     * web REST). Never asks questions — it plans with what it can find.
+     */
+    researchAndPlan(userDescription: string, runners: RunnerId[], modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, fs: IFileSystem, onProgress: (progress: ResearchProgress) => void, fetcher?: IWebFetcher, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, signal?: AbortSignal): Promise<{
+        tasks: Task[];
+        researchLog: ResearchLogEntry[];
+        researchResults: string;
+    }>;
+    generatePlanDirect(userDescription: string, runners: RunnerId[], modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, onToken?: (token: string) => void, fs?: IFileSystem, fetcher?: IWebFetcher, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, signal?: AbortSignal): Promise<Task[]>;
+    /**
+     * Release everything this service holds: the conversation, any in-flight
+     * turn, and — on the harness backend — the agent process itself. Idempotent
+     * and cheap in every implementation, so callers never gate it.
+     */
+    reset(): void;
+}
+/**
+ * The single branch point between planner transports. Two of them talk HTTP to
+ * an LLM vendor; the third (ADR-0009) drives a coding agent already installed
+ * on the machine. Everything downstream — the plan contract, the research-step
+ * stream, the four surfaces — is shared.
+ */
+declare function createAiService(config: IConfig, deps?: CliAgentAiServiceDeps): IAiService;
+
+/** The dialogue record a fork carries — what {@link PlannerConversation.clone} returns. */
+interface ForkedDialogue {
+    conversationHistory: ConversationMessage[];
+    researchLog: ResearchLogEntry[];
+}
+
+/** A user's message as sent, and the skills its `/name` tokens load. */
+interface SkillInvocation {
+    text: string;
+    skills: SkillLoad[];
+}
+/**
+ * A path with the home directory written `~`, for a notice or listing. On
+ * Windows the drive letter's case is not significant and the separators are
+ * rendered `/`, so the same skill reads alike wherever the session reloads.
+ */
+declare function abbreviateHome(file: string, home?: string, platform?: NodeJS.Platform): string;
+/**
+ * Resolve the `/skill-name` tokens in a message to snapshots of the skills they
+ * name. Pure and exported so surfaces can resolve without a full Session. The text itself is never rewritten.
+ *
+ * Every distinct skill named loads, once, in the order first named. A token
+ * naming no skill is plain text, wherever it stands — a whole message of
+ * `/unknown` included: embedded in a sentence it is as likely to be incidental
+ * text (a path, an example command) as a typo'd invocation. So is one naming
+ * a skill with `user-invocable: false`, which only the model may invoke.
+ */
+declare function resolveSkillInvocation(text: string, skillsService: Pick<SkillsService, 'findSkill'>, home?: string): SkillInvocation;
+/**
+ * What the planner receives for a user message: the bodies of the skills it
+ * loaded, then the message as the user wrote it. The one composition for a
+ * live send and for a replay of the transcript, so a resumed conversation
+ * hands the planner what the live one did.
+ */
+declare function plannerMessage(text: string, loads: readonly SkillLoad[]): string;
+/**
+ * The transcript as the planner is to see it on a replay: each user message
+ * carries the skills loaded after it, composed by {@link plannerMessage}, and
+ * the load entries themselves are folded away. Sessions saved before skill
+ * loads existed hold the expanded text in the message and replay unchanged.
+ * A failed turn's entry is left out: the planner never said it.
+ */
+declare function plannerTranscript(history: readonly ConversationMessage[]): ConversationMessage[];
+
+/**
+ * What a stopped runner says about why it stopped, and what ending an attempt
+ * does to the runner it leaves behind. TaskOrchestrator acts on the answers.
+ */
+
+/**
+ * A turn's failure as its runner reported it: its words, and `usageLimit`
+ * where its protocol also says in a field whether it was the limit (Codex's
+ * `codexErrorInfo`).
+ */
+interface TurnFailure {
+    message: string;
+    usageLimit?: UsageLimitSignal | false;
+}
+
+/** What a usage limit that ended a planner turn led to. */
+interface PlannerLimit {
+    /** The line the transcript keeps, drawn as a failure. */
+    text: string;
+    /** When what the turn took goes again on its own; null when it waits for the user's next message. */
+    resendAt: Date | null;
+    /** Why nothing goes again on its own, when nothing does: what the planner did, as in "the planner hit its usage limit and …". */
+    held?: string;
+}
+
+/**
+ * What the user allows the plan to be built from right now: the enabled
+ * runners and each runner's model allowlist. Structural, so a surface that
+ * only holds the two lists can ask without a session.
+ */
+interface AssignmentScope {
+    enabledRunners: readonly string[];
+    allowlist: Readonly<Record<string, readonly string[] | undefined>>;
+    /**
+     * The models discovery has found per runner, where the holder has them. An
+     * allowlist is read against them exactly as the planner's catalog reads it
+     * (ids only another runner lists limit nothing), so a flag never says a
+     * model is off a list the planner sees as no limit.
+     */
+    models?: Readonly<Partial<Record<RunnerId, readonly DiscoveredModel[]>>>;
+}
+/** The part of a task an assignment is read from. */
+interface AssignedTask {
+    type: string;
+    status: string;
+    assignedRunner: string;
+    assignedModel?: {
+        modelId: string;
+        modelLabel?: string;
+    };
+}
+type AssignmentIssue = {
+    kind: 'runner-off';
+    runner: string;
+} | {
+    kind: 'model-off-list';
+    runner: string;
+    modelId: string;
+    modelLabel: string;
+};
+/**
+ * Whether a task sits outside the scope it is read against. This only names
+ * the mismatch: such a task still runs (ADR-0003, P1) — the allowlist and the
+ * enabled runners shape what is planned, not what is started — and the user or
+ * the planner may move it. A runner that is off settles the matter before its
+ * model is looked at.
+ */
+declare function assignmentIssue(task: AssignedTask, scope: AssignmentScope): AssignmentIssue | null;
+declare function assignmentIssueText(issue: AssignmentIssue): string;
+
+/**
+ * The planner turn (see CONTEXT.md): the one piece of planner work that holds
+ * the conversation, from its claim to its settled outcome. Its signal is what a
+ * stop aborts.
+ */
+declare class PlannerTurn {
+    private readonly controller;
+    private dropped;
+    private forced;
+    get signal(): AbortSignal;
+    /** The plan it was answering was dropped under it, so nothing it settles may land. */
+    get abandoned(): boolean;
+    /** A force send stopped it, not the user: the forced turn follows. A turn already stopped stays the user's stop. */
+    get forceSent(): boolean;
+    stop(by?: 'force_send'): void;
+    abandon(): void;
+}
+/** What a planner turn may change: the whole plan, or tasks through edits. */
+type PlanChange = 'plan' | 'edit';
+/**
+ * A wake-up turn (ADR-0029): a supervisor's turn on wake-up digests alone, no
+ * user message in it. What it may do is its level's, decided by the host.
+ */
+interface WakeUpTurn {
+    /** Reads the turn may make, in place of a user message's caps. */
+    readBudget: number;
+    /**
+     * Why a whole plan, or a task edit, is refused in this turn, worded for the
+     * model; undefined when its level allows it. Asked when the change is made
+     * and again as it lands, so a level lowered during the turn applies at once.
+     */
+    refused(change: PlanChange): string | undefined;
+    /** Told to the model after the digests and never saved, like the plan block: who it is in this turn, and what it may do. */
+    brief?: string;
+}
+/** A read made through a planner tool: refused once the turn's budget is gone, else answered, told to land when the budget asks it to. */
+type ToolRead<T> = {
+    status: 'refused';
+} | {
+    status: 'answered';
+    value: T;
+    landNow: boolean;
+};
+/** A plan or task edit handed to the open turn over a channel other than its reply (ADR-0022). */
+type PlannerSubmission = {
+    kind: 'plan';
+    tasks: Task[];
+} | {
+    kind: 'task_ops';
+    ops: TaskOp[];
+};
+/** Everything (re)opening a conversation needs besides the dialogue itself. */
+type ConversationOpening = Omit<ConversationRequest, 'goal' | 'onProgress' | 'signal' | 'priorHistory' | 'initialMessage'>;
+/**
+ * What the conversation needs from the session that hosts it. The session keeps
+ * plan state, persistence and scheduling; the conversation reaches them only
+ * through here, so a fake host is enough to drive it.
+ */
+interface PlannerConversationHost {
+    /** The plan the transcript lives on (`conversationHistory`, `researchLog`). */
+    plan(): LegacyPlanState | null;
+    goal(): string;
+    aiService(): IAiService;
+    onProgress(progress: ResearchProgress): void;
+    /** Fresh discovery, allowlist-filtered the way the system prompt shows it. */
+    opening(runners: RunnerId[]): Promise<ConversationOpening>;
+    /** What the per-turn catalog block and every read draw from, as of now. */
+    catalog(): TaskQueryCatalog;
+    /** Whether autorun is on now (ADR-0030); the planner is told in the turn after it changes. */
+    autorun(): boolean;
+    /** The enabled runners and allowlist as of now; the planner is told in the turn after either changes. */
+    assignmentScope(): AssignmentScope;
+    tasks(): readonly Task[];
+    /**
+     * Why a task cannot start now, from the scheduler's start rule (ADR-0034);
+     * none once nothing holds it back, or while the plan is not yet approved.
+     */
+    startWaits(task: Readonly<Task>): readonly StartWait[];
+    /**
+     * The orchestrator's live capture for a task's latest attempt, backing the
+     * `output` field of a read. Injected the same way as the catalog so the
+     * conversation never reaches into execution state directly.
+     */
+    liveOutput: LiveOutputLookup;
+    isExecuting(): boolean;
+    /** The session's single mutation ritual: op → persist → notify (default: the plan). */
+    mutate(op: () => boolean, notify?: () => void): LegacyPlanState | null;
+    broadcast: SessionBroadcaster;
+    /** `turnId`: the planner turn whose commit this is, when one is. */
+    broadcastPlan(turnId?: string): void;
+    /**
+     * Validate a batch against live state; nothing of it is applied. A
+     * supervisor's batch that trips the oscillation guard is refused, and the
+     * user is told of the trip once, in the supervisor's voice (ADR-0029): a note
+     * saved as it is written, like any of Ordewell's own, which a turn in flight
+     * holds nothing in.
+     */
+    validateOps(ops: TaskOp[]): ApplyTaskOpsResult;
+    /** The workspace's skill catalog under its repo group's layout, which the skills a plan or edit attaches are checked against. */
+    taskSkills(): SkillLookup;
+    /** Tell the user something the transcript does not carry. */
+    notice(level: SessionNotice['level'], message: string): void;
+    /** Load planner-produced tasks: an edit keeps run state, a commit starts over. Returns how many landed. */
+    adoptTasks(tasks: readonly Task[], how: 'edit' | 'commit'): number;
+    capturePrd(text: string): void;
+    /** The planner turn was stopped or abandoned: whatever it is waiting on (a parked approval) will never be answered. */
+    turnAborted(): void;
+    /** A planner turn is about to take the conversation, which nothing holds now. */
+    turnClaiming?(): void;
+    /** A planner turn let the conversation go, so the next one may take it. */
+    turnReleased?(): void;
+    /** A turn ended on the planner's usage limit, which it reported as `said`: what is sent again, and when. */
+    usageLimit(said: TurnFailure): PlannerLimit;
+}
+/**
+ * A conversation edit (rewind, fork) the conversation refused because the
+ * request itself is wrong — no such message, nothing to fork. Transport-agnostic
+ * like `PlanEditError`: a route maps it to a status, core carries none.
+ */
+declare class ConversationEditError extends Error {
+    constructor(message: string);
+}
+/**
+ * Refused because a planner turn is in flight. Distinct from a bad request:
+ * the same call succeeds once the turn settles, and the turn would otherwise
+ * append its reply to a transcript that no longer holds the message it
+ * answers.
+ */
+declare class ConversationBusyError extends ConversationEditError {
+    constructor(operation: string);
+}
+/**
+ * A planner turn that settled after the plan it was answering was dropped (a
+ * new plan, another session adopted, the session closed). Nothing it produced
+ * was committed: landing it would write one session's reply into another's
+ * transcript.
+ */
+declare class PlannerTurnDiscardedError extends Error {
+    constructor(options?: ErrorOptions);
+}
+/**
+ * A wake-up turn's backend ended without a reply — a dead agent, a usage
+ * limit — and said why. A user's turn shows that in the chat instead; a
+ * wake-up has nobody waiting on it, so its supervisor is told (ADR-0029).
+ */
+declare class PlannerTurnFailedError extends Error {
+    constructor(message: string);
+}
+/**
+ * A planner turn ended on the planner's usage limit (#84). Nothing of it
+ * lands: the transcript keeps the failure instead, out of the planner's own
+ * dialogue, and the turn's inputs wait to be sent again — at `resendAt`, or
+ * with the next input when it is null.
+ */
+declare class PlannerUsageLimitError extends PlannerTurnFailedError {
+    readonly resendAt: Date | null;
+    /** Why nothing is sent again on its own, when nothing is. */
+    readonly held?: string;
+    constructor(limit: PlannerLimit);
+}
+/**
+ * The user stopped the turn and the backend reported that as a thrown error
+ * rather than a settled reply. Typed so a surface can stay quiet for it without
+ * reading the message: some SDKs' abort errors are plain `Error`s by name, and
+ * a real failure can mention "aborted" too.
+ */
+declare class PlannerTurnStoppedError extends Error {
+    constructor(options?: ErrorOptions);
+}
+/** A user message a rewind can fork the conversation from just before. */
+interface RewindTarget {
+    /** Position in the transcript — what {@link PlannerConversation.cloneBefore} takes. */
+    index: number;
+    preview: string;
+    /** The whole message — the preview cuts it to one line, and a surface confirming the rewind quotes it. */
+    content: string;
+    timestamp: string;
+}
+/** What a rewind forks from, and the message it lands just before. */
+interface RewoundDialogue {
+    dialogue: ForkedDialogue;
+    rewoundMessage: string;
+}
+/** What a compaction left behind. */
+interface ConversationCompaction {
+    summary: string;
+    /** Transcript entries kept verbatim after the summary entry. */
+    keptMessages: number;
+}
+interface ReplyOptions {
+    signal?: AbortSignal;
+    /**
+     * Run inside the mutation that lands the turn's outcome — the edit, the
+     * plan or the reply — so what the caller drops with it (the inputs the turn
+     * answered) leaves disk in the same save.
+     */
+    onCommit?: () => void;
+    /** Wake-up digests delivered with this turn (ADR-0029), oldest first, ahead of the user's message if there is one. */
+    wakeUps?: readonly string[];
+    /** Set when the turn is a wake-up's alone. */
+    wakeUp?: WakeUpTurn;
+    /** The user's message was force sent: the turn replaces the one it stopped (ADR-0023). */
+    forced?: boolean;
+}
+/**
+ * The planner conversation (ADR-0002), end to end: the persisted dialogue
+ * record, the live model context behind it, and every turn from the user's
+ * message to a settled, persisted outcome.
+ *
+ * It is the only writer of `conversationHistory` and of the planner's
+ * `researchLog`. The writes land on the host's plan object — which is what the
+ * session persists and broadcasts — and only ever inside the host's mutation
+ * ritual, so each reaches disk in the save made for it. A planner turn writes
+ * nothing until the mutation that lands it ({@link land}): any other save made
+ * while it runs finds nothing of it to persist.
+ *
+ * The live model context (a vendor service's message list, a harness planner's
+ * process and native session id) is disposable: {@link reset} drops it and the
+ * next turn is replayed from the transcript. That is what lets the transcript
+ * be replaced by a summary, or copied into a fork, without the model's memory
+ * drifting from it.
+ */
+declare class PlannerConversation {
+    private readonly host;
+    private readonly briefing;
+    private live;
+    private openTurn;
+    constructor(host: PlannerConversationHost);
+    get transcript(): readonly ConversationMessage[];
+    /** Whether a planner turn holds the conversation. */
+    get isTurnInFlight(): boolean;
+    /** Stop the planner turn in flight; it settles as stopped. False when none is. */
+    stopTurn(by?: 'force_send'): boolean;
+    /**
+     * Drop the planner turn in flight together with the plan it was answering:
+     * it is stopped, whatever it settles is discarded, and the conversation is
+     * free at once rather than when the abandoned turn finishes unwinding.
+     */
+    abandonTurn(): void;
+    /**
+     * Free the conversation from a turn that did not end when stopped — a hung
+     * wake-up (ADR-0029). Unlike {@link abandonTurn} the plan stays, so the turn
+     * is forgotten as its failure would have been: nothing it held lands, and
+     * what it would have told the planner is told to the next turn.
+     */
+    abandonHungTurn(): void;
+    /**
+     * Let the live turn go. A user turn's end is announced now, and it says
+     * nothing after — not its stream, not its held edit, not its end again —
+     * since it may settle at any time later: the API services restart nothing,
+     * and a hung call settles whenever it settles, while the next turn runs.
+     */
+    private drop;
+    /**
+     * Run planner work that is not a conversation turn — one-shot plan
+     * generation — as the planner turn, so it is stopped, refused and superseded
+     * like one. It starts a fresh plan, so it supersedes the turn in flight.
+     */
+    hold<T>(signal: AbortSignal | undefined, body: (turn: PlannerTurn) => Promise<T>): Promise<T>;
+    /**
+     * Take the conversation for a new planner turn. A caller's own signal stops
+     * the turn too; the relay is detached on release because a caller may reuse
+     * that signal, and a stale listener would stop the next turn with it.
+     */
+    private claim;
+    /** The user turn being answered, for what the host raises during it — an approval the turn's research asks for. */
+    get currentTurnId(): string | undefined;
+    /** The open turn's wake-up rules, when the supervisor is answering it rather than the user's message. */
+    get currentWakeUp(): WakeUpTurn | undefined;
+    /** A skill the planner loaded in the open turn, held with the turn; false when none is open to take it. */
+    recordPlannerSkill(skill: SkillLoad): boolean;
+    /**
+     * Hand the open turn a plan (already validated) or a task edit. The turn
+     * settles with it exactly as with the same plan or ops parsed out of its
+     * reply, and it wins over any envelope that reply carries. A later
+     * submission replaces an earlier one. False when no user turn is open.
+     */
+    submit(submission: PlannerSubmission): boolean;
+    /**
+     * Tell surfaces what the turn's edit would leave, from the same applier that
+     * lands it, so an edit that would not apply shows nothing. It stays shown
+     * from the moment it is handed in until it lands, is refused, or the turn
+     * ends: the backend's reply claims it, but it has not landed by then.
+     */
+    private showHeld;
+    private clearHeld;
+    /**
+     * The edit the open turn already holds, for a further edit in the same reply
+     * to join rather than replace. Empty when it holds nothing; null when it holds
+     * a whole plan, which an edit cannot be layered on.
+     */
+    pendingOps(): TaskOp[] | null;
+    /**
+     * A read the planner makes through a tool. It spends the same per-turn budget
+     * as an envelope read, so a planner cannot read more by switching channels:
+     * past the soft limit, or on a repeated question, the answer still comes but
+     * is told to land the turn; at the hard limit it is refused. `signature`
+     * names the question, for the repeat check.
+     */
+    read<T>(signature: string, answer: () => Promise<T>): Promise<ToolRead<T>>;
+    /** Whether the model still holds this conversation in memory. */
+    get isActive(): boolean;
+    /** Call inside the host's mutation ritual. */
+    append(role: ConversationMessage['role'], content: string, opts?: {
+        timestamp?: string;
+        kind?: ConversationMessage['kind'];
+        runs?: ReplyRun[];
+        actor?: ConversationMessage['actor'];
+    }): void;
+    private appendEntries;
+    /** Swap the whole transcript. The live context no longer matches it, so pair with {@link reset}. */
+    replace(messages: readonly ConversationMessage[]): void;
+    /**
+     * The plan scope this conversation served is gone: drop the live model
+     * context, and what the planner was told outside the transcript in it (see
+     * {@link PlannerBriefing}). Idempotent; the harness backend holds an OS
+     * process here, so callers never gate it on {@link isActive}.
+     */
+    reset(): void;
+    /** A run update for the planner's next turn, whoever opens it (ADR-0029). */
+    tellRunUpdate(text: string): void;
+    /** Drop the live model context alone: the next turn replays from the transcript. */
+    private dropContext;
+    /**
+     * The user messages a rewind may land before. The opening message is the
+     * goal: cutting it leaves a conversation about nothing, which is a new
+     * session, not a rewind. After a compaction the summary entry, always
+     * first, plays the goal's part: what it replaced is gone, so a rewind stops
+     * at it.
+     */
+    rewindTargets(): RewindTarget[];
+    /**
+     * Replace the transcript with a summary of it, keeping the last two
+     * exchanges as they were, and drop the live context so the next message
+     * replays from the shorter record.
+     *
+     * The summary is one hidden turn through whichever planner is configured —
+     * on the live context when it still matches, replayed from the transcript
+     * when not — so the compaction is the same for a vendor API and a harness
+     * agent. Whatever the turn emits besides the summary is discarded, ops
+     * included: it condenses the conversation, never the plan. Nothing is
+     * written until the summary is in hand, so a failed or stopped turn leaves
+     * the transcript exactly as it was.
+     */
+    compact(signal?: AbortSignal): Promise<ConversationCompaction>;
+    private summarize;
+    /**
+     * A copy of the dialogue record for a forked session to carry. Refused
+     * mid-turn: the copy would hold the user's message without the reply to it.
+     * The live context is not part of it — the fork replays from this record on
+     * its first turn, like any adopted session.
+     */
+    clone(): ForkedDialogue;
+    /**
+     * A copy of the dialogue as it stood just before the user message at
+     * `index` (a position from {@link rewindTargets}) — what a rewind forks
+     * from — plus that message's full text, for a surface to offer back. This
+     * conversation is not touched. The research trace is cut at the same point
+     * by time: its entries carry no link to the message that caused them.
+     */
+    cloneBefore(index: number): RewoundDialogue;
+    /**
+     * What the skill check of a landed plan or edit warned about, kept in the
+     * transcript so every surface shows it, on reload too, and not only the
+     * planner that may have read it in a tool result. Call inside the host's
+     * mutation ritual, so the broadcast plan carries it.
+     */
+    recordSkillWarnings(warnings: readonly string[], timestamp?: string): void;
+    /**
+     * A call at the command seam (ADR-0029), kept where it happened in the
+     * dialogue: a reload shows it, and a planner replayed from the transcript
+     * knows what was started or stopped, and by whom. Call inside the host's
+     * mutation ritual.
+     */
+    recordExecution(record: ExecutionRecord, text: string): void;
+    /**
+     * Open the conversation on the host's fresh plan: the goal is its first
+     * message. `prepare` (discovery) runs inside the turn, so a stop reaches it.
+     */
+    start(goal: SkillInvocation, prepare: () => Promise<ConversationOpening>, signal?: AbortSignal): Promise<LegacyPlanState>;
+    /**
+     * Every later user message, to a persisted outcome. A turn that throws lands
+     * nothing: what it held is dropped with it, so session memory never drifts
+     * from disk and the UI.
+     */
+    reply(message: string | SkillInvocation, options?: ReplyOptions): Promise<LegacyPlanState>;
+    private replyTurn;
+    /**
+     * A wake-up turn lands only a real answer. Stopped — by the user, or by its
+     * timeout — it lands nothing, not the fragment a backend hands back; a
+     * failure is thrown rather than shown, for the supervisor to retry
+     * (ADR-0029).
+     */
+    private assertWakeUpAnswered;
+    /**
+     * A turn that ended on the planner's usage limit lands nothing: what it held
+     * is dropped, its failure is kept in its place, and the limit's wait is armed
+     * in the same save. Only a turn Ordewell started gets here, so a limit is
+     * never acted on for a planner nobody asked anything of.
+     */
+    private assertNotLimited;
+    /**
+     * A failure kept in the transcript, drawn as one on reload too, and never
+     * replayed to the planner. Stamped after the newest entry: surfaces take
+     * only entries newer than the last they synced.
+     */
+    private recordFailure;
+    private assertIdle;
+    /** Refuse to land a turn that no longer belongs here: it was abandoned, or its plan is no longer the host's. */
+    private assertCurrent;
+    /**
+     * {@link assertCurrent} on the far side of an await that precedes a plan
+     * mutation: the skill check waits on git, and a stop, rewind or session
+     * switch in that window drops the edit instead of landing it on whatever
+     * plan is current by then. A stop counts here because nothing has landed
+     * yet — the user asked for the turn to end before it changed the plan.
+     */
+    private assertStillCurrent;
+    /**
+     * A live conversation is only safe to continue in-place when it also
+     * matches the model/effort configured right now — a harness planner's
+     * running process was spawned with the old one baked in and cannot pick up
+     * a switch (ADR-0009). Otherwise the turn resumes from the transcript.
+     */
+    private canContinueLive;
+    /**
+     * Bracket one user turn with its start and end, under an id minted here:
+     * the turn is where the stream a surface draws begins and ends, and only the
+     * conversation sees all of it — every backend call, read and retry.
+     */
+    private userTurn;
+    private requirePlan;
+    /** The message as typed, then one entry per skill it loaded, sharing its timestamp so a reload keeps them together. */
+    private userEntries;
+    private userPrompt;
+    /** Hold what the turn writes until it lands, each entry where the transcript stands now; see {@link TurnWrites}. */
+    private holdWrites;
+    /**
+     * The one mutation that lands a turn's outcome (ADR-0029). What the turn held
+     * goes in first — each entry where it belongs, ahead of what was written
+     * after it, then the research and the subagents — so the transcript reads in
+     * the order it happened and the inputs leave the plan's pending turns in the
+     * save that carried their answer. `outcome` makes the turn's change to the
+     * plan and returns what the turn said, which is written, then sent in that
+     * order; `announce` follows it on every surface. The turn's briefing is told
+     * unless the planner gave no answer (`unheard`): a failure, or a stop.
+     */
+    private land;
+    private writeHeld;
+    private recordResearch;
+    /**
+     * The opening a replay starts under, read fresh, the live context dropped
+     * first; what it states of autorun and the runners is what the planner is
+     * told by it. A turn abandoned while the opening was read stops here: the
+     * backend may be its successor's by now.
+     */
+    private reopen;
+    /**
+     * Reopen the model context from the transcript — because the in-memory one
+     * is gone (session reload, extension restart), or because it is stale
+     * against the planner config now in effect. No LLM call happens for the
+     * replayed turns; the first call is the one the user's message opens.
+     */
+    private resume;
+    /**
+     * Answer every read the planner emits until it says something else.
+     *
+     * The channel is a text envelope rather than a registered tool because the
+     * protocol has to be identical on both planner backends (ADR-0009): Ordewell
+     * owns a tool loop only in the API case, and a harness planner running as a
+     * coding-agent subprocess can only be reached this way.
+     *
+     * Draining here — outside {@link repairLoop} — is what keeps reads free of
+     * the repair budget. A planner that looks a task up and *then* fumbles its
+     * ops JSON still gets its two corrective retries; charging it for the read
+     * would cost it the chance to fix the edit.
+     */
+    private drainTaskQueries;
+    /**
+     * A call cut off by something other than the turn's own stop failed: what it
+     * hands back is a fragment of an answer, and the turn keeps what it was sent,
+     * as any failure does. Nothing of Ordewell's resets a backend under a turn on
+     * the same plan (see `PlannerBackend`); one that changes the plan abandons the turn.
+     */
+    private failedIfCutOff;
+    /**
+     * The backend's answer, with what was handed in while it ran standing in
+     * for whatever its reply carried. Taken once: a corrective re-send after a
+     * rejected edit must not settle on the same submission again. A stopped
+     * turn commits nothing, the same as a stopped reply with a plan in it.
+     */
+    private claimSubmission;
+    /**
+     * Render one read out of live state. Never persisted to the transcript: the
+     * detail is context for the planner's next reply, and re-sending it on every
+     * later turn is exactly the cost this channel exists to avoid.
+     */
+    private taskQueryAnswer;
+    /**
+     * Drive a planner turn, its reads already drained, to a persisted, broadcast
+     * outcome. Task edits apply atomically; validation failures are fed back to
+     * the model for up to 2 silent retries, then surfaced as a message with the
+     * plan untouched. The first turn and every later turn route through here —
+     * one path, not two.
+     */
+    private settle;
+    /** A name not found at submit only warns: a task the attaching one depends on may create it. */
+    private warnSkills;
+    /** Validate + commit a task_ops turn atomically. Returns the errors on rejection (plan untouched). */
+    private applyTaskOps;
+    /** The edit was refused as it landed: what it showed is not coming. */
+    private refusedHeld;
+    /** Commit a settled (non-task_ops) turn: a whole plan, or what it said. */
+    private commit;
+    /**
+     * The runs a reply is saved and sent with (ADR-0017 A1): the narration the
+     * turn kept from calls it did not settle on, then the reply's own. None from
+     * a backend that reports no runs, whose reply then stands as one message.
+     */
+    private shown;
+    /** What a plan or edit turn said beside what it landed: its reply, or an envelope's narration. */
+    private said;
+    /**
+     * The catalog the planner may actually draw from — model ids and task-mode
+     * ids, per runner in the plan — emitted on EVERY turn, before any plan exists
+     * or after. The system prompt shows this once at conversation start; a long
+     * clarifying conversation outlives that single showing and the planner
+     * starts misquoting it, so this re-states it per turn instead.
+     *
+     * The host's catalog is allowlist-filtered, so a restricted allowlist stays a
+     * hard bound on every turn, and reads the plan's runners live, so a runner
+     * admitted mid-session by a retarget is shown like every other. A planner
+     * with Ordewell's tools gets a reminder to read the catalog instead.
+     */
+    private catalogBlock;
+    /**
+     * The "you are here" block for post-plan chat: current tasks with stable
+     * references, plus the read and edit protocols. Injected per turn (never
+     * persisted) so the model always sees live statuses — including which tasks
+     * are locked by a running execution.
+     */
+    private planContextBlock;
+    /** One line per task, subtasks indented under their parent, with stable references — null until the plan has tasks. */
+    private currentPlanLines;
+}
+
+/**
+ * Task references: the one grammar for naming a task in a plan, both ways.
+ * A label is rendered from a task's order under its parent ("2", "2.1"), and
+ * a reference written by anyone — the planner, a tool call, a command — is
+ * resolved back against the plan tree. Pure so a
+ * browser-bundled surface can use it through `@ordewell/core/plan-utils`.
+ */
+/** The shape a reference resolves over: the plan's task tree, or a surface's projection of it. */
+type RefTask<T> = TreeTask<T>;
+/**
+ * The parent a label extends. A label is the full path ("3.2.1"), so a parent
+ * below the top level carries the label it was itself reached by; without one
+ * the parent's order stands for it, which is right for a top-level parent.
+ */
+interface RefParent {
+    order: number;
+    label?: string;
+}
+/** Dotted path label for a task, e.g. "2.1" for the first subtask of task 2, "2.1.3" one level down. */
+declare function taskOrderLabel(task: {
+    order: number;
+}, parent?: RefParent): string;
+/** How a surface refers to a task in prose: "#2", or "#2.1" for a subtask. */
+declare function taskRef(task: {
+    order: number;
+}, parent?: RefParent): string;
+/** A task named in full, as a confirmation or a picker title does: "#2 Deploy". */
+declare function titledTaskRef(task: {
+    order: number;
+    title: string;
+}, parent?: RefParent): string;
+/**
+ * The reference {@link taskRef} renders for the task a plan tree holds, by id
+ * — its full path, dotted, for a subtask. Undefined when the tree holds no such task.
+ */
+declare function taskRefOf<T extends RefTask<T>>(tasks: readonly T[], id: string): string | undefined;
+/**
+ * The reference and title {@link titledTaskRef} renders for the task a plan
+ * tree holds, by id — its full path, dotted, for a subtask. Undefined when the
+ * tree holds no such task.
+ */
+declare function titledTaskRefOf<T extends RefTask<T>>(tasks: readonly T[], id: string): string | undefined;
+/**
+ * Resolve a written reference to a task at any depth: an id, then an order
+ * label with or without "#" ("#2", "2", "#2.1"), then an exact title.
+ *
+ * An order label is read against the tree, never a flattened list: subtask
+ * orders restart at 1 under each parent, so "#2" always means top-level task 2
+ * and a subtask is reachable only by its dotted path ("#2.1", "#2.1.3").
+ */
+declare function resolveTaskRef<T extends RefTask<T>>(tasks: readonly T[], ref: string | number): T | undefined;
+/**
+ * A reference as the user types one: {@link resolveTaskRef}, then a unique
+ * prefix of a task's id at any depth. Only the user's: a model's reference
+ * that names no task is refused, never matched to the one task a fragment of
+ * it happens to fit.
+ */
+declare function resolveUserTaskRef<T extends RefTask<T>>(tasks: readonly T[], ref: string | number): T | undefined;
+
+interface SessionMeta {
+    id: string;
+    goal: string;
+    runners: RunnerId[];
+    taskCount: number;
+    status: PlanStatus;
+    createdAt: string;
+    updatedAt: string;
+}
+interface SessionData {
+    meta: SessionMeta;
+    /** The full plan state — including conversationHistory, prdMarkdown, and queuedMessages. */
+    plan: LegacyPlanState;
+}
+
+/**
+ * The bridge between "core needs an answer" and "a human somewhere is looking
+ * at a UI". Core cannot prompt: the human may be at a browser, a TUI, a CLI
+ * stream, or a VS Code webview, and on the web server they are on the far end
+ * of a socket. So the Session parks a promise here, announces the request
+ * through the normal broadcast seam, and every surface answers through the
+ * same `resolve(id, granted)` call.
+ *
+ * Timeouts are load-bearing rather than defensive: a planner turn that blocks
+ * forever on an unanswered prompt would hang the whole research loop with no
+ * visible cause. On expiry the request resolves to denied and the model gets a
+ * normal, actionable tool result. A task runner's request is the exception
+ * (ADR-0018, A1): the runner is parked on it rather than a research loop, and
+ * it waits for a person — or the supervisor — however long that takes.
+ */
+interface PendingApproval {
+    id: string;
+    request: ApprovalRequest;
+    createdAt: string;
+}
+interface PendingApprovalsOptions {
+    /** Denies and resolves after this long with no answer. Default 5 minutes. */
+    timeoutMs?: number;
+    /** Announce a new request to the surfaces. */
+    onRequest?: (pending: PendingApproval) => void;
+    /** Announce that a request is no longer actionable (answered or expired). */
+    onSettled?: (id: string, granted: boolean, settled: {
+        request: ApprovalRequest;
+        decision: ApprovalDecision;
+    }) => void;
+}
+interface AskOptions {
+    /**
+     * An id the caller already announced the request under. One still in use is
+     * refused — denied at once — rather than overwriting the request that has it.
+     */
+    id?: string;
+    /** Wait for an answer however long it takes. */
+    noTimeout?: boolean;
+    /**
+     * Given the answer as the request settles, before anything awaiting the
+     * promise runs: a caller about to tear down what asked (a runner being
+     * stopped) must deliver the answer before it goes.
+     */
+    onDecision?: (decision: ApprovalDecision) => void;
+}
+declare class PendingApprovals {
+    private readonly opts;
+    private readonly entries;
+    private readonly listeners;
+    constructor(opts?: PendingApprovalsOptions);
+    /** Hear each new request once it is announced — the supervisor wakes on a runner's (ADR-0029). */
+    listen(listener: (pending: PendingApproval) => void): () => void;
+    /** Park a request and return the promise the approval policy awaits. */
+    ask(request: ApprovalRequest, options?: AskOptions): Promise<boolean>;
+    /** Park a request whose answer is more than yes or no. */
+    decide(request: ApprovalRequest, options?: AskOptions): Promise<ApprovalDecision>;
+    /**
+     * Answer one request. Returns false when the id is unknown or already
+     * settled. "Allow for this task" on a request that did not offer it is a
+     * plain allow: no grant is made that the requester never proposed.
+     */
+    resolve(id: string, answer: ApprovalAnswer): boolean;
+    /** Everything still awaiting an answer — replayed to a surface that connects late. */
+    outstanding(): PendingApproval[];
+    /**
+     * Deny everything in flight, or only the requests `which` picks. Called on
+     * abort and on session reset.
+     */
+    clear(which?: (request: ApprovalRequest) => boolean, note?: string): void;
+}
+
+/**
+ * Pure, no-imports helper so a browser surface can format a conflict's files
+ * without pulling `isolationRecord` — and its `path` import — into a webview
+ * bundle. Kept out of `isolationRecord.ts` for exactly that reason.
+ */
+declare function capConflictFiles(files: string[], max?: number): string;
+
+/** How a run is started, watched and merged: the user's, not a plan's (ADR-0030). */
+interface GlobalRunSettings {
+    supervisorLevel: SupervisorLevel;
+    mergeAtGatesAutomatically: boolean;
+    /** Start a plan when the planner submits it, approved as if the user had pressed Execute. */
+    autorun: boolean;
+    /** Retries an Act supervisor may make of one task in a run (a loop guard). */
+    supervisorRetryLimit: number;
+    /** Reads a wake-up turn may make, in place of a user message's caps. */
+    wakeUpReadBudget: number;
+}
+declare const RUN_SETTINGS_DEFAULTS: Readonly<GlobalRunSettings>;
+declare class RunSettingsError extends Error {
+    constructor(message: string);
+}
+interface UserSettings {
+    modelAllowlist?: Record<string, string[]>;
+    /** Last model (and its thinking effort) the user chose for each planner backend, keyed by planner backend id. */
+    plannerModels?: Record<string, {
+        model: string;
+        effort?: string;
+    }>;
+    /**
+     * Runners the user picked for planning. Absent — not empty — is what falls
+     * back to the environment's defaults; `[]` is a deliberate "none of them".
+     */
+    enabledRunners?: string[];
+    /** Full (true) or Guarded (false), ADR-0001; Full until the user chooses. */
+    autonomousMode?: boolean;
+    supervisorLevel?: SupervisorLevel;
+    mergeAtGatesAutomatically?: boolean;
+    autorun?: boolean;
+    supervisorRetryLimit?: number;
+    wakeUpReadBudget?: number;
+}
+/**
+ * The model allowlist, remembered planner models and enabled runners are shared
+ * across processes by default. `ORDEWELL_SETTINGS_PATH` lets independent runs
+ * use separate files: otherwise a write in one run would change another's
+ * settings when `getAll()` detects the new mtime.
+ */
+declare function getSettingsPath(): string;
+/** The run settings `settings` holds, each one it leaves out at its default. */
+declare function runSettingsOf(settings: UserSettings): GlobalRunSettings;
+declare class SettingsService {
+    private filePath;
+    private cache;
+    private cachedStamp;
+    constructor(filePath?: string);
+    getAll(): UserSettings;
+    /**
+     * Every write replaces the file, so its inode changes with it; the mtime
+     * alone cannot tell two writes apart on a filesystem whose timestamps are
+     * coarse, and a write that shares the last one's tick stayed unseen.
+     */
+    private fileStamp;
+    /**
+     * What a change is applied to: the file as it is now, never a copy held since
+     * an earlier read. Another process may have saved in between, and writing
+     * the whole file back would silently undo it.
+     */
+    private current;
+    /**
+     * Calls `listener` when another process (or this one) saves the file. The
+     * directory is watched, not the file: a write that swaps the file in leaves
+     * a watch on the old one pointing at nothing.
+     */
+    watch(listener: () => void): {
+        dispose(): void;
+    };
+    getModelAllowlist(runner: string): string[] | undefined;
+    setModelAllowlist(runner: string, ids: string[] | undefined): void;
+    getPlannerModel(provider: string): {
+        model: string;
+        effort?: string;
+    } | undefined;
+    setPlannerModel(provider: string, entry: {
+        model: string;
+        effort?: string;
+    } | undefined): void;
+    getEnabledRunners(): string[] | undefined;
+    setEnabledRunners(ids: string[]): void;
+    /**
+     * Change the list from what the file holds at this moment: the change is
+     * handed the saved list (undefined when the user never chose) and its result
+     * is saved in the same call. A list worked out from an earlier read would
+     * save over what another surface set since. It may be handed the list again,
+     * when another process saved before this one could (see {@link save}).
+     */
+    updateEnabledRunners(change: (saved: string[] | undefined) => string[]): string[];
+    /** Save `ids` as the user's choice unless one is saved already, judged on the file as it is now. */
+    setEnabledRunnersIfUnset(ids: string[]): boolean;
+    /**
+     * Full or Guarded (ADR-0001), as saved here (ADR-0030). A value set in the
+     * environment wins, so a script or CI run can fix its own without touching
+     * the user's file.
+     */
+    autonomousMode(): boolean;
+    /** Whether `ORDEWELL_AUTONOMOUS_MODE` decides the level, whatever this file says. */
+    autonomousModeOverridden(): boolean;
+    setAutonomousMode(enabled: boolean): void;
+    getRunSettings(): GlobalRunSettings;
+    /** Checks every value before writing any, so a refused change saves nothing. */
+    updateRunSettings(changes: Partial<GlobalRunSettings>): GlobalRunSettings;
+    private load;
+    /**
+     * Makes `change` to the file as it is now, and saves it. Another process can
+     * save between that read and this write; the file is looked at again just
+     * before ours replaces it, and when it moved the change is made afresh from
+     * what that process saved, so neither save undoes the other. A file that
+     * keeps moving is written over after {@link SAVE_TRIES} tries rather than
+     * never. The look and the swap are one step under the file's lock
+     * ({@link withFileLock}). A change that changes nothing writes nothing.
+     */
+    private save;
+    /** False, saving nothing, when the file is no longer the one stamped `expected`. */
+    private persist;
+}
+
+/** What the preflight reads: the planner choice and whatever it needs to be reachable. */
+type PlannerReadinessConfig = Pick<IConfig, 'aiProvider' | 'planningModel' | 'openaiCompatibleBaseUrl' | 'getProviderApiKey'>;
+/**
+ * Why the selected planner cannot plan yet, as data. Each surface words it with
+ * its own command spelling (`describePlannerNotReady`), so a daemon, a chat and
+ * a shell script can all say the same thing without sharing a syntax.
+ */
+type PlannerNotReady = {
+    code: 'no_key';
+    provider: AiProvider;
+    label: string;
+    keyEnvVar: string;
+} | {
+    code: 'no_base_url';
+    provider: AiProvider;
+    label: string;
+    baseUrlEnvVar: string;
+} | {
+    code: 'no_model';
+    provider: AiProvider;
+    label: string;
+};
+/**
+ * What the selected planner still needs before it can plan, or null when it is
+ * ready. There are two ways in (ADR-0009), and only one of them involves a
+ * credential: a harness planner drives a coding agent already installed on the
+ * machine, authenticated by the user's own subscription, so demanding an API
+ * key of it turns a working setup into a wall. Its model is optional too: an
+ * unset id means "the agent's own default".
+ */
+declare function plannerNotReady(config: PlannerReadinessConfig): PlannerNotReady | null;
+/**
+ * `plannerNotReady` judged on a host's own config — the one way every host
+ * builds the preflight's input, so none can hand it a key the selected
+ * planner's transport will not read (a stored OpenRouter key passing for an
+ * OpenAI planner, which then failed inside the transport). Every planner turn
+ * judges through this too, so none can let through what another refuses.
+ */
+declare function plannerNotReadyFor(config: Pick<IConfig, 'aiProvider' | 'orchestratorModel' | 'planningModel' | 'openaiCompatibleBaseUrl' | 'getProviderApiKey'>): PlannerNotReady | null;
+/** How one surface spells the commands a not-ready message points at. */
+interface PlannerCommandSyntax {
+    pickPlanner: string;
+    setKey(provider: AiProvider): string;
+    setModel: string;
+}
+declare const TERMINAL_UI_COMMANDS: PlannerCommandSyntax;
+/** The VS Code chat shares the terminal's slash commands, except that its `/model` needs `set`. */
+declare const CHAT_COMMANDS: PlannerCommandSyntax;
+declare const HEADLESS_CLI_COMMANDS: PlannerCommandSyntax;
+declare function describePlannerNotReady(reason: PlannerNotReady, commands: PlannerCommandSyntax): string;
+/**
+ * A planner turn refused before it began. Carries the reason as data so a
+ * client that spells commands differently (the headless CLI) can re-word it;
+ * the message is the terminal UI's spelling, which is what most clients show.
+ */
+declare class PlannerNotReadyError extends Error {
+    readonly reason: PlannerNotReady;
+    constructor(reason: PlannerNotReady);
+}
+
+/** What the user last picked for one planner backend. */
+interface PlannerModelChoice {
+    model: string;
+    effort?: string;
+}
+/**
+ * A candidate model as this planner's catalog lists it. Deliberately plain
+ * data: a harness planner's catalog is its runner's own model list and a
+ * vendor's is a picker list (ADR-0009), and the rule below is the same for
+ * both — so the caller normalizes, and this module never reaches for a
+ * ModelResolver, a config or the network.
+ */
+interface PlannerModelCandidate {
+    id: string;
+    variants?: {
+        id: string;
+    }[];
+}
+interface PlannerModelRecall {
+    model: string;
+    effort: string;
+    source: 'remembered' | 'catalog-default' | 'none';
+}
+/** The slice of `SettingsService` this needs, so tests can pass a plain object. */
+interface PlannerModelStore {
+    getPlannerModel(provider: string): PlannerModelChoice | undefined;
+    setPlannerModel(provider: string, entry: PlannerModelChoice | undefined): void;
+}
+/**
+ * Remembers, per planner backend, the model the user last chose for it.
+ *
+ * Switching the planner has to clear the model — an id is scoped to the agent
+ * that listed it, so an OpenRouter slug handed to Claude Code points it at
+ * something it cannot spawn. That clear is correct and stays; what was missing
+ * is that switching *back* then forced a re-pick of a model the user had
+ * already chosen. The rule itself is `selectPlanner`'s; this is the storage
+ * the surfaces that keep their memory in the settings file hand it.
+ */
+declare class PlannerModelMemory {
+    private store;
+    constructor(store: PlannerModelStore);
+    /** Record what the user picked for `provider`; a blank model forgets it instead. */
+    remember(provider: string, model: string, effort?: string): void;
+    getPlannerModel(provider: string): PlannerModelChoice | undefined;
+    /**
+     * What the model and effort should become when `provider` takes over the
+     * planner, given the models it actually serves. The `source` is what the
+     * three surfaces word their notice from — restored, defaulted, or nothing.
+     */
+    recall(provider: string, catalog: PlannerModelCandidate[]): PlannerModelRecall;
+}
+
+/**
+ * The daemon contract: every HTTP body the local daemon sends, in one place.
+ *
+ * The daemon's routes build their bodies against these types and the CLI's
+ * `ApiClient` reads them back, so a field added on one side is a compile error
+ * on the other. Before this there were three hand-written copies — the routes'
+ * inline `c.json`, the client's per-method generics, and the TUI's slice of the
+ * client — and they had drifted (the client declared a `headless` field the
+ * daemon never sent, and typed `GET /sessions/:id`'s plan as the wrong shape).
+ *
+ * Types only. Core is the one package both the daemon and its clients already
+ * depend on; importing from the daemon would pull its runtime into the CLI.
+ */
+/**
+ * Why a request was refused, as a stable code a client switches on instead of
+ * reading the message. Absent on a refusal nobody needs to tell apart — a
+ * missing field, say — where the message is all there is.
+ */
+type DaemonErrorCode = 'session_not_found' | 'task_not_found' | 'no_plan' | 'already_executing' | 'workspace_not_found' | 'workspace_not_a_project' | 'conversation_busy'
+/** The user stopped the planner turn: the turn ended as asked, so a client stays quiet. */
+ | 'planner_turn_stopped'
+/** The planner turn settled after its plan was dropped; nothing it produced was kept. */
+ | 'planner_turn_discarded'
+/** The selected planner cannot plan yet (no key, no base URL, no model); `plannerNotReady` says which. */
+ | 'planner_not_ready'
+/** The request asked for something the plan, task or conversation does not allow. */
+ | 'refused' | 'checkpoint_not_waiting' | 'approval_not_outstanding';
+/** The body of every non-2xx answer a route gives. */
+interface ErrorBody {
+    error: string;
+    code?: DaemonErrorCode;
+    /** Set with `workspace_not_a_project`: the directory the daemon refused, so a client can offer to initialize it. */
+    workspace?: string;
+    /** Set with `planner_not_ready`: the reason as data, so a client can word it in its own commands. */
+    plannerNotReady?: PlannerNotReady;
+}
+/**
+ * What the command seam said of a control the user pressed (ADR-0029), for the
+ * surface to show as it is, so each words a control alike. Absent from a daemon
+ * older than the field, and from a call that never reached the seam.
+ */
+interface Worded {
+    message?: string;
+}
+interface OkResponse extends Worded {
+    ok: boolean;
+}
+/** A task start's answer: `queued` says why it did not start now, when the task waits for its dependencies instead. */
+interface TaskStartResponse extends OkResponse {
+    queued?: string;
+}
+/**
+ * A plan as the planner routes return it: the session's plan state, not the
+ * `SerializedPlan` a websocket `plan_generated` carries. The two differ —
+ * this one holds raw tasks and the dialogue's bookkeeping — and a client that
+ * reads either reads only the fields it needs. Skill bodies stay in the
+ * session: loads and attempt snapshots arrive as notices.
+ */
+interface PlanResponse {
+    plan: SurfacePlan;
+}
+/** `POST /plans/:id/review/approve`: the plan the user signed off, as it now runs. */
+interface ApproveReviewResponse extends PlanResponse, Worded {
+}
+/** `POST /plans/:id/resolve-conflict`: `null` when the session had no conflict to hand a resolver task. */
+interface ResolveConflictResponse {
+    plan: SurfacePlan | null;
+}
+/** What `GET /api/models` returns, and what the pool's provider discovery produces. */
+interface ModelsResponse {
+    models: DiscoveredModel[];
+    modelsByRunner: Record<string, DiscoveredModel[]>;
+    /** Each runner's manifest modes, so a surface can offer a per-task mode picker. */
+    modesByRunner: Record<string, RunnerModeInfo[]>;
+    orchestratorModel: string;
+    providers: AiProvider[];
+    /** Full cross-provider catalog for the orchestrator (planner) model picker. */
+    orchestratorModels: OrchestratorOption[];
+    /** Per-provider catalog-fetch failures, keyed by provider id. */
+    providerErrors: Record<string, string>;
+}
+/** One-shot planning answers in the phase-tagged shape a saved session is read back in. */
+interface GeneratePlanResponse extends Pick<ModelsResponse, 'models' | 'modelsByRunner'> {
+    plan: SurfacePlanState;
+    /** The host notes the plan's transcript records, a skill check's warnings among them, which the phase-tagged plan does not carry. */
+    notes?: string[];
+}
+interface ExecuteResponse extends Worded {
+    status: 'running';
+}
+interface StopResponse extends Worded {
+    status: 'stopped';
+}
+interface CancelPlanningResponse {
+    cancelled: boolean;
+}
+/** `POST …/resume/cancel` (cancelled is true: a task with no resume scheduled is refused) and `POST …/converse/resend/cancel` (false when nothing waited). */
+interface CancelResumeResponse extends Worded {
+    cancelled: boolean;
+}
+interface TaskMessageResponse {
+    id: string;
+}
+interface ForceSendResponse extends Worded {
+    sent: boolean;
+}
+interface RemoveMessageResponse extends Worded {
+    removed: boolean;
+}
+interface MergeGateEntry {
+    id: string;
+    order: number;
+    title: string;
+}
+interface MergeGateResponse {
+    mergeGate: MergeGateEntry[];
+}
+interface IsolationDiffResponse {
+    diff: string;
+}
+/** A merge that conflicts or is blocked is an outcome, not a refusal, so it answers 200 with the result. */
+type IsolationMergeResponse = IsolationMergeResult;
+/** A fork the daemon has already adopted. */
+interface ConversationForkResponse {
+    sessionId: string;
+    goal: string;
+    plan: SurfacePlan;
+}
+/** A fork made by a rewind, with the full text of the message it was made just before. */
+interface ConversationRewindResponse extends ConversationForkResponse {
+    rewoundMessage: string;
+}
+interface RewindTargetsResponse {
+    targets: RewindTarget[];
+}
+interface ConversationCompactResponse extends ConversationCompaction, PlanResponse {
+}
+interface PrdResponse {
+    prdMarkdown: string;
+}
+interface RunnerEntry {
+    id: string;
+    name: string;
+    enabled: boolean;
+}
+interface RunnersResponse {
+    runners: RunnerEntry[];
+    orchestratorModel: string;
+}
+/** Sessions: a saved one comes off its file, a live one from the pool's store. */
+interface SessionResponse {
+    meta: SessionMeta;
+    plan: SurfacePlanState;
+    /**
+     * The live session's run as `Session.runSnapshot()` holds it, isolation
+     * marks and handoff included. Absent for a session nobody holds: the saved
+     * file has no run to speak of, and a surface does not rebuild one from it.
+     */
+    run?: RunView;
+}
+interface AdoptSessionResponse extends OkResponse {
+    plan: SurfacePlan;
+    goal: string;
+    /** The adopted session's run, as {@link SessionResponse.run}. */
+    run?: RunView;
+}
+interface TaskLogAttemptsResponse {
+    /** Captured with the synchronous listing, including an empty listing. */
+    position?: StreamStamp;
+    attempts: number[];
+}
+interface TaskLogResponse {
+    /** Captured with the synchronous log read; live batches after it are not in events. */
+    position?: StreamStamp;
+    attempt: number;
+    events: TaskLogEvent[];
+}
+type SessionListResponse = SessionMeta[];
+interface SettingsResponse {
+    orchestratorModel: string;
+    /** Who plans (ADR-0009) — a vendor id, or a runner serving as a harness planner. */
+    aiProvider: PlannerBackendId;
+    plannerThinkingEffort: string;
+    maxParallel: number;
+    modelAllowlist: UserSettings['modelAllowlist'];
+    plannerModels: UserSettings['plannerModels'];
+    /** The user's run settings (ADR-0030), each at its default until set. */
+    run: GlobalRunSettings;
+}
+/** What `PATCH /api/settings` answers: the settings as they now stand, plus what the write itself decided. */
+interface SettingsUpdateResponse extends SettingsResponse {
+    /**
+     * Which model a planner switch landed on and why — remembered for that
+     * backend, its catalog default, or none. Present only when the write changed
+     * the planner; absent for every other write, where nothing was recalled.
+     */
+    switchRecall?: PlannerModelRecall;
+    /** Env keys the daemon refused to apply, so a client does not persist what the daemon would not. */
+    rejectedEnvKeys?: string[];
+}
+interface CommandDescriptor {
+    name: string;
+    description: string;
+}
+interface CommandsResponse {
+    commands: CommandDescriptor[];
+}
+interface WorkspacesResponse {
+    workspaces: string[];
+}
+interface ApprovalsResponse {
+    pending: PendingApproval[];
+    approvedScopes: string[];
+}
+interface ApprovalAnswerResponse extends OkResponse {
+    granted: boolean;
+    decision: ApprovalDecision['decision'];
+}
+/**
+ * Where a frame stands in its session's broadcast stream. A client holding
+ * several sockets on one session gets every broadcast on each, and a frame's
+ * content is no identity: two clears of a held edit are the same JSON. `seq`
+ * rises by one per broadcast of the session for as long as the daemon runs,
+ * whichever Session object holds the id; `stream` names the daemon process,
+ * so a restarted daemon's numbering is never compared with the last one's.
+ */
+interface StreamStamp {
+    stream: string;
+    seq: number;
+}
+/** A broadcast as the session's socket carries it. Unstamped from a daemon older than the stamp. */
+type SessionFrame = (SessionMessage | SessionNotice) & Partial<StreamStamp>;
+type ApprovalRequestMessage = Extract<SessionMessage, {
+    type: 'approval_request';
+}>;
+/**
+ * What a session's socket sends right after `connected`: its run as it stands,
+ * so a client that joins mid-run has the run view before the next update —
+ * the held edit's preview included — and the planner's approval requests
+ * still waiting, which no later frame would announce again. `seq` is the last
+ * broadcast it accounts for. Every frame after it is a {@link SessionFrame}.
+ */
+interface RunSnapshotFrame extends Partial<StreamStamp> {
+    type: 'run_snapshot';
+    sessionId: string;
+    view: RunView;
+    /** Absent from a daemon older than the field: nothing is known, not "none waiting". */
+    approvals?: ApprovalRequestMessage[];
+}
+
+declare const EMPTY_RUN: RunView;
+declare function reduceRun(view: RunView, input: RunInput): RunView;
+
+/** What the blocked rule reads of a task; structural, so a surface's own task shape answers it too. */
+interface BlockingSubject {
     id: string;
     status: string;
     dependencies: readonly string[];
@@ -2610,10 +4581,10 @@ declare function reduceConversation(view: ConversationView, input: ConversationI
 
 /**
  * The view a saved session reopens with: what its transcript and research log
- * kept, in the order it happened — messages, notices and the compaction
- * summary, plan markers, tool calls with each subagent's calls nested under
- * it, and the token line. Reasoning and streamed text were never saved, so a
- * reload has none.
+ * kept, in the order it happened — messages, each reply run by run where it
+ * began, notices and the compaction summary, plan markers, tool calls with
+ * each subagent's calls nested under it, and the token line. Reasoning and
+ * streamed text that never settled were never saved, so a reload has none.
  *
  * The research log interleaves with the transcript by time. Entries older than
  * a compaction's first kept message went with the turns it condensed.
@@ -2638,8 +4609,9 @@ interface TaskLogView extends BlockList {
     /** What the runner reported over the attempt, subagents included. */
     readonly usage?: PlannerUsage;
     /**
-     * The block each run of deltas streams into, keyed by stream, so the run's
-     * authoritative copy replaces it instead of repeating it below.
+     * The block each stream of deltas writes into — a run of text by its id,
+     * thinking by whose it is — so the stream's authoritative copy replaces it
+     * instead of repeating it below.
      */
     readonly streams: Readonly<Record<string, string>>;
     /** The turn's latest agent text block, which a failure that repeats it takes the place of. */
@@ -2806,6 +4778,40 @@ declare function markdownTokens(text: string): readonly MarkdownToken[];
 /** A model's text as HTML, safe to set as a webview element's innerHTML. */
 declare function markdownHtml(text: string): string;
 
+interface TaskLogBatch {
+    attempt: number;
+    events: TaskLogEvent[];
+    position?: StreamStamp;
+}
+/** A saved attempt and the live batches that follow it (ADR-0018 P1). */
+interface TaskLogFollow {
+    view: TaskLogView;
+    attempts: number[];
+    attempt: number;
+    pending: TaskLogBatch[];
+    loaded: boolean;
+    followLatest: boolean;
+    /** The outstanding pick; an older attempt read cannot replace it. */
+    loadingAttempt?: number;
+    /** The saved read's cutoff, also rejecting socket copies delivered after the read. */
+    position?: StreamStamp;
+}
+type TaskLogFollowInput = {
+    type: 'opened';
+} | ({
+    type: 'loaded';
+    attempts?: number[];
+    abandoned?: boolean;
+} & TaskLogBatch) | ({
+    type: 'live';
+} & TaskLogBatch) | {
+    type: 'picked';
+    attempt: number;
+};
+declare const EMPTY_TASK_LOG_FOLLOW: TaskLogFollow;
+/** Join by stream position, never by event content or socket arrival time. */
+declare function followTaskLog(state: TaskLogFollow, input: TaskLogFollowInput): TaskLogFollow;
+
 /**
  * What a row's status means to a reader, before any surface picks a word,
  * icon or colour for it. `quiet` is a running task whose runner has printed
@@ -2837,7 +4843,7 @@ declare function skippedLabel(reason: string | null): string;
  * for them (ADR-0035). Not a runner approval: nothing has started, so no
  * runner is asking anything.
  */
-declare const WAITS_FOR_APPROVAL_LABEL = "Waiting for your approval to start";
+declare const WAITS_FOR_APPROVAL_LABEL = "Waits for your approval";
 /** Runner requests a task waits on (ADR-0018, A1); null when none do. */
 declare function approvalLabel(count: number | undefined): string | null;
 /**
@@ -2914,6 +4920,11 @@ interface TaskRowSubject {
     mergeGate?: readonly string[];
     forcedPastGate?: readonly string[];
     attemptUsage?: readonly AttemptUsage[];
+    assignedRunner?: string;
+    assignedModel?: {
+        modelId: string;
+        modelLabel?: string;
+    };
 }
 interface TaskRowIsolation {
     state: TaskIsolationState;
@@ -2955,12 +4966,14 @@ interface TaskRowContext {
     }[];
     /** What a resume time is read against; the clock when absent. */
     now?: Date;
+    /** The enabled runners and allowlist an assignment is read against; without it no assignment is flagged. */
+    runnerScope?: AssignmentScope;
 }
 /** Whether the row stands for an AI task, a manual one, or an ops task (ADR-0020). */
 type TaskRowKind = 'ai' | 'user' | 'ops';
-interface TaskRowUsage extends UsageLine {
+/** The task's whole spend (see `taskUsageSummary`); `attempt` is the latest one, 0 before any reported. */
+interface TaskRowUsage extends Pick<TaskUsageSummary, 'totals' | 'contextFill'> {
     attempt: number;
-    wallTimeMs?: number;
 }
 interface TaskRowView {
     usage: TaskRowUsage | null;
@@ -2978,6 +4991,10 @@ interface TaskRowView {
     approvals: string | null;
     /** That it waits for the user's approval to start, in sentence case; null once it started, or when it needs none. */
     waitsForApproval: string | null;
+    /** Why the task's runner or model is one the user has since moved away from, in sentence case; null when it is not. The task still runs. */
+    assignmentFlag: string | null;
+    /** What the flag means for this task as it stands (a failed one runs again only if retried); set exactly when `assignmentFlag` is. */
+    assignmentConsequence: string | null;
     /** The task's mode is tagged autonomous: it runs without permission prompts. */
     autonomous: boolean;
     /** The repos its isolated work changed, by path; empty for a group of one. */
@@ -3040,9 +5057,10 @@ declare function titledRefs(ids: readonly string[], tasks: readonly Named[]): st
  * and a bare "Remove task?" would hide that.
  */
 declare function dependentsNotice(dependents: readonly {
+    id?: string;
     order: number;
     title: string;
-}[]): string | null;
+}[], tasks?: readonly Named[]): string | null;
 /**
  * What a start past a merge gate is asked with (ADR-0020): the work the task
  * would act without, named. `subject` is how the asking surface refers to the
@@ -3075,4 +5093,4 @@ declare function parseSwitch(arg: string): boolean | null;
 /** A whole number at least `min`, as typed; null for anything else. */
 declare function parseCount(arg: string | undefined, min: number): number | null;
 
-export { type RunTask as $, ACT_RISK as A, type BlockingSubject as B, CHECKPOINT_TRUNCATE_LENGTH as C, type DiffRow as D, EMPTY_CONVERSATION as E, NO_TURN as F, type GatedConversation as G, type HeldEdit as H, type INotification as I, type NewTaskFields as J, type NotificationAction as K, type LiveTail as L, type MarkdownToken as M, NOT_STARTED as N, type OrchestratorObserver as O, type OutputPreview as P, type PlanBlock as Q, type PlanMarkerStatus as R, type PlanSnapshot as S, PlanStore as T, type PlannerModes as U, type PromptHold as V, RUN_SETTINGS_DEFAULTS as W, type RefTask as X, type RunInput as Y, type RunMergeView as Z, RunSettingsError as _, AUTORUN_RISK as a, capConflictFiles as a$, type RunTaskStatus as a0, type RunView as a1, type RunnerLoadedBlock as a2, STOPPED_BEFORE_START as a3, SUPERVISOR_LEVEL_LABEL as a4, type SerializedConversationMessage as a5, type SerializedPendingTurn as a6, type SerializedPlan as a7, type SerializedTask as a8, type SerializedTaskStatus as a9, type TaskRowContext as aA, type TaskRowIsolation as aB, type TaskRowKind as aC, type TaskRowPlacement as aD, type TaskRowSubject as aE, type TaskRowUsage as aF, type TaskRowView as aG, type TaskStatusKind as aH, type ThinkingDisplayBlock as aI, type ToolBlock as aJ, type ToolHeadline as aK, type ToolStatus as aL, type TurnGate as aM, type UsageBlock as aN, type UserSettings as aO, WAITS_FOR_APPROVAL_LABEL as aP, aheadOfDraft as aQ, applyTaskOps as aR, approvalLabel as aS, automergeSummary as aT, autorunSummary as aU, awaitingLabel as aV, blockedByLabel as aW, blockingFailures as aX, canMergeTasks as aY, canSetDependencies as aZ, canSplitTask as a_, type SessionBroadcaster as aa, type SessionMessage as ab, type SessionNotice as ac, SettingsService as ad, type SkillLoadBlock as ae, type SkillLookup as af, type SkillToken as ag, type StartAdmission as ah, type SubagentBlock as ai, type SubagentChild as aj, type SubagentStatus as ak, type SurfacePlan as al, type SurfacePlanState as am, type SurfaceTask as an, type TakenPrompt as ao, type TaskAttemptSnapshot as ap, TaskControlError as aq, type TaskLogEvent as ar, type TaskLogView as as, type TaskOp as at, TaskOrchestrator as au, type TaskOrchestratorDeps as av, type TaskOrchestratorOptions as aw, type TaskOutputSource as ax, type TaskRef as ay, type TaskRowAction as az, type ApplyTaskOpsResult as b, titledTaskRefOf as b$, classifyOutcome as b0, coalesceTaskLog as b1, dependencyCandidates as b2, dependentsNotice as b3, dependentsOf as b4, diffRows as b5, diffStat as b6, diffSummary as b7, digestTaskLog as b8, drainNext as b9, resolveTaskRef as bA, resumeLabel as bB, resumeTime as bC, runSettingsOf as bD, runnerToolSubject as bE, serializePlan as bF, serializeTask as bG, serializeTaskStatus as bH, skillTokens as bI, skippedLabel as bJ, stopTurn as bK, summarizeToolCall as bL, supervisorSummary as bM, surfacePlan as bN, surfacePlanState as bO, takeAt as bP, taskLogForSurface as bQ, taskOrderLabel as bR, taskRef as bS, taskRefOf as bT, taskRowActions as bU, taskRowView as bV, taskStartedNotice as bW, taskStatusKind as bX, textHasTaskOps as bY, titledRefs as bZ, titledTaskRef as b_, executionSummary as ba, followTurn as bb, fromTranscript as bc, getSettingsPath as bd, hasHiddenDetail as be, holdPrompt as bf, isTaskRunning as bg, loadedSkillTokens as bh, markAction as bi, markRequestFor as bj, markdownHtml as bk, markdownTokens as bl, namedRepos as bm, newTaskFields as bn, opsEditable as bo, outputLines as bp, outputPreview as bq, parseCount as br, parseSwitch as bs, parseTaskOpsJson as bt, pastGateConfirmation as bu, reconcileApprovals as bv, reduceConversation as bw, reduceRun as bx, reduceTaskLog as by, replayTaskLog as bz, type ApprovalBlock as c, toTaskLogEvent as c0, toolHeadline as c1, trimToolOutput as c2, truncateCheckpointSummary as c3, unsendAll as c4, unsendLatest as c5, type ApprovalStatus as d, type AutoMergeTrigger as e, type CommandBlock as f, type CommandStatus as g, type CompactionBlock as h, type ConversationInput as i, type ConversationView as j, type DiffRowKind as k, type DiffStat as l, type DisplayBlock as m, EMPTY_HOLD as n, EMPTY_RUN as o, EMPTY_TASK_LOG as p, type EditCatalog as q, type ExecutionSummary as r, type GlobalRunSettings as s, type HeldEditMark as t, type IsolatedExecution as u, IsolationRunController as v, type LiveTailOptions as w, type LocalEntry as x, type MessageBlock as y, type MessageRole as z };
+export { type ForceSendResponse as $, ACT_RISK as A, type BlockingSubject as B, CHAT_COMMANDS as C, type ConversationCompactResponse as D, type ConversationCompaction as E, ConversationEditError as F, type ConversationForkResponse as G, type ConversationInput as H, type ConversationRequest as I, type ConversationRewindResponse as J, type ConversationTurn as K, type ConversationView as L, DEFAULT_WEB_READ_BUDGET as M, type DaemonErrorCode as N, type DecideOptions as O, type DiffRow as P, type DiffRowKind as Q, type DiffStat as R, type DisplayBlock as S, EMPTY_CONVERSATION as T, EMPTY_HOLD as U, EMPTY_RUN as V, EMPTY_TASK_LOG as W, EMPTY_TASK_LOG_FOLLOW as X, type ErrorBody as Y, type ExecuteResponse as Z, type ExecutionSummary as _, AUTORUN_RISK as a, type RewindTargetsResponse as a$, type GatedConversation as a0, type GeneratePlanResponse as a1, type GlobalRunSettings as a2, HEADLESS_CLI_COMMANDS as a3, type HeldEdit as a4, type HeldEditMark as a5, type IAiService as a6, type INotification as a7, type IWebFetcher as a8, type IsolationDiffResponse as a9, type PlanResponse as aA, type PlanSnapshot as aB, PlanStore as aC, type PlannerCommandSyntax as aD, PlannerConversation as aE, type PlannerConversationHost as aF, type PlannerModelCandidate as aG, type PlannerModelChoice as aH, PlannerModelMemory as aI, type PlannerModelRecall as aJ, type PlannerModelStore as aK, type PlannerModes as aL, type PlannerNotReady as aM, PlannerNotReadyError as aN, type PlannerReadinessConfig as aO, type PlannerSubmission as aP, PlannerTurnDiscardedError as aQ, PlannerTurnStoppedError as aR, PlannerUsageLimitError as aS, type PrdResponse as aT, type PromptHold as aU, RUN_SETTINGS_DEFAULTS as aV, type RefTask as aW, type RemoveMessageResponse as aX, type ResolveAll as aY, type ResolveConflictResponse as aZ, type RewindTarget as a_, type IsolationMergeResponse as aa, IsolationRunController as ab, type LiveOutputLookup as ac, type LiveTail as ad, type LiveTailOptions as ae, type LocalEntry as af, type MarkdownToken as ag, type MergeGateEntry as ah, type MergeGateResponse as ai, type MessageBlock as aj, type MessageRole as ak, type ModelsResponse as al, NOT_STARTED as am, NO_TURN as an, type NewTaskFields as ao, type NotificationAction as ap, OUTPUT_LINES_DEFAULT as aq, OUTPUT_LINES_MAX as ar, type OkResponse as as, type OrchestratorObserver as at, type OutputPreview as au, type PendingApproval as av, PendingApprovals as aw, type PendingApprovalsOptions as ax, type PlanBlock as ay, type PlanMarkerStatus as az, type AdoptSessionResponse as b, type TaskPlacement as b$, type RunInput as b0, type RunMergeView as b1, RunSettingsError as b2, type RunSnapshotFrame as b3, type RunTask as b4, type RunTaskStatus as b5, type RunView as b6, type RunnerCatalog as b7, type RunnerLoadedBlock as b8, type RunnersResponse as b9, type SubagentChild as bA, type SubagentStatus as bB, type SurfacePlan as bC, type SurfacePlanState as bD, type SurfaceTask as bE, TASK_QUERY_ANSWER_MAX_CHARS as bF, TASK_QUERY_ANSWER_OR_OPS as bG, TASK_QUERY_FIELDS as bH, TASK_QUERY_PROTOCOL as bI, TASK_QUERY_REMINDER as bJ, TERMINAL_UI_COMMANDS as bK, type TakenPrompt as bL, type TaskAttemptSnapshot as bM, TaskControlError as bN, type TaskLogAttemptsResponse as bO, type TaskLogBatch as bP, type TaskLogEvent as bQ, type TaskLogFollow as bR, type TaskLogFollowInput as bS, type TaskLogResponse as bT, type TaskLogView as bU, type TaskMessageResponse as bV, type TaskOp as bW, TaskOrchestrator as bX, type TaskOrchestratorDeps as bY, type TaskOrchestratorOptions as bZ, type TaskOutputSource as b_, STOPPED_BEFORE_START as ba, SUPERVISOR_LEVEL_LABEL as bb, type SerializedConversationMessage as bc, type SerializedPendingTurn as bd, type SerializedPlan as be, type SerializedTask as bf, type SerializedTaskStatus as bg, type SessionBroadcaster as bh, type SessionData as bi, type SessionFrame as bj, type SessionListResponse as bk, type SessionMessage as bl, type SessionMeta as bm, type SessionNotice as bn, type SessionResponse as bo, type SettingsResponse as bp, SettingsService as bq, type SettingsUpdateResponse as br, type SkillInvocation as bs, type SkillLoadBlock as bt, type SkillToken as bu, type StartAdmission as bv, type StartWait as bw, type StopResponse as bx, type StreamStamp as by, type SubagentBlock as bz, type ApplyTaskOpsResult as c, loadedSkillTokens as c$, type TaskQuery as c0, type TaskQueryCatalog as c1, type TaskQueryField as c2, type TaskRef as c3, type TaskRowAction as c4, type TaskRowContext as c5, type TaskRowIsolation as c6, type TaskRowKind as c7, type TaskRowPlacement as c8, type TaskRowSubject as c9, awaitingLabel as cA, blockedByLabel as cB, blockingFailures as cC, canMergeTasks as cD, canSetDependencies as cE, canSplitTask as cF, capConflictFiles as cG, classifyOutcome as cH, coalesceTaskLog as cI, createAiService as cJ, dependencyCandidates as cK, dependentsNotice as cL, dependentsOf as cM, describePlannerNotReady as cN, diffRows as cO, diffStat as cP, diffSummary as cQ, digestTaskLog as cR, drainNext as cS, executionSummary as cT, followTaskLog as cU, followTurn as cV, fromTranscript as cW, getSettingsPath as cX, hasHiddenDetail as cY, holdPrompt as cZ, isTaskRunning as c_, type TaskRowUsage as ca, type TaskRowView as cb, type TaskStartResponse as cc, type TaskStatusKind as cd, type ThinkingDisplayBlock as ce, type ToolBlock as cf, type ToolHeadline as cg, type ToolStatus as ch, type TreeTask as ci, type TurnGate as cj, type UsageBlock as ck, type UserSettings as cl, WAITS_FOR_APPROVAL_LABEL as cm, type WebRead as cn, type WebReadDecision as co, WebReadPolicy as cp, type Worded as cq, type WorkspacesResponse as cr, abbreviateHome as cs, aheadOfDraft as ct, applyTaskOps as cu, approvalLabel as cv, assignmentIssue as cw, assignmentIssueText as cx, automergeSummary as cy, autorunSummary as cz, type ApprovalAnswerResponse as d, unsendAll as d$, markAction as d0, markRequestFor as d1, markdownHtml as d2, markdownTokens as d3, namedRepos as d4, newTaskFields as d5, opsEditable as d6, outputLines as d7, outputPreview as d8, parseCount as d9, skippedLabel as dA, stopTurn as dB, subtreeIds as dC, summarizeToolCall as dD, supervisorSummary as dE, surfacePlan as dF, surfacePlanState as dG, takeAt as dH, taskLogForSurface as dI, taskOrderLabel as dJ, taskPlacement as dK, taskQuerySignature as dL, taskRef as dM, taskRefOf as dN, taskRowActions as dO, taskRowView as dP, taskStartedNotice as dQ, taskStatusKind as dR, textHasTaskOps as dS, textHasTaskQuery as dT, titledRefs as dU, titledTaskRef as dV, titledTaskRefOf as dW, toTaskLogEvent as dX, toolHeadline as dY, trimToolOutput as dZ, truncateCheckpointSummary as d_, parseSwitch as da, parseTaskOpsJson as db, parseTaskQueryJson as dc, pastGateConfirmation as dd, plannerMessage as de, plannerNotReady as df, plannerNotReadyFor as dg, plannerTranscript as dh, reconcileApprovals as di, reduceConversation as dj, reduceRun as dk, reduceTaskLog as dl, renderTaskQueryAnswer as dm, replayTaskLog as dn, resolveSkillInvocation as dp, resolveTaskRef as dq, resolveUserTaskRef as dr, resumeLabel as ds, resumeTime as dt, runSettingsOf as du, runnerToolSubject as dv, serializePlan as dw, serializeTask as dx, serializeTaskStatus as dy, skillTokens as dz, type ApprovalBlock as e, unsendLatest as e0, walkPlan as e1, type ApprovalRequestMessage as f, type ApprovalStatus as g, type ApprovalsResponse as h, type ApproveReviewResponse as i, type AskOptions as j, type AssignmentCatalog as k, type AssignmentIssue as l, type AssignmentScope as m, type AssignmentWriter as n, type AutoMergeTrigger as o, CHECKPOINT_TRUNCATE_LENGTH as p, type CancelPlanningResponse as q, type CancelResumeResponse as r, CliAgentAiService as s, type CliAgentAiServiceDeps as t, type CommandBlock as u, type CommandDescriptor as v, type CommandStatus as w, type CommandsResponse as x, type CompactionBlock as y, ConversationBusyError as z };