@ordewell/core 0.5.5 → 0.6.0

package/dist/index.d.ts

@@ -1,18 +1,16 @@
-import { H as RunnerId, v as PlanStatus, L as LegacyPlanState, k as IsolationMergeResult, g as IsolationLandedTask, I as IWorktreeIsolation, y as RepoGroupLayout, a as DiscoveredModel, T as Task, a3 as UsageRecord, O as SubagentOutcome, B as ResearchProgress, z as ResearchLogEntry, C as ConversationMessage, Z as TaskSnapshot, d as IsolationHandoff, U as TaskIsolation, s as IsolationView, P as PlanIsolation, Q as QueuedMessage, A as ActiveTaskSession, G as ResearchToolType, u as PlanState, aa as Verdict } from './Task-Vl5Zq_D-.js';
-export { D as DiscoveredMode, b as IntegrationDisposal, c as IsolationAvailability, e as IsolationHandoffRepo, f as IsolationInactiveReason, h as IsolationLanding, i as IsolationMergeBlock, j as IsolationMergeBlockReason, l as IsolationOutcome, m as IsolationPruneResult, n as IsolationRepo, o as IsolationRun, p as IsolationTaskRecord, q as IsolationTaskRepo, r as IsolationTaskStatus, M as Message, t as PlanModificationWarnings, w as PlannerUsage, x as PreparedTask, R as RepairEvidence, E as ResearchStep, F as ResearchStepOutcome, S as StreamEvent, J as StreamStepEvent, K as StreamThinkingEvent, N as SubagentLogEntry, V as TaskIsolationState, W as TaskMode, X as TaskModelAssignment, Y as TaskOutputSummary, _ as TaskStatus, $ as TaskType, a0 as TaskWithParent, a1 as ThinkingBlock, a2 as UsageLine, a4 as UsageTotals, a5 as UserPromptEntry, a6 as UserStep, a7 as ValidationCheck, a8 as ValidationContext, a9 as ValidationResult, ab as VerificationCheck, ac as addPlannerUsage, ad as addTaskToPlan, ae as addUsage, af as createEmptyPlan, ag as createTask, ah as emptyWarnings, ai as flattenTasks, aj as flattenTasksWithParents, ak as isMeasured, al as keepExecutionState, am as migrateLegacyPlan, an as migratePlanState, ao as migrateTask, ap as partedPromptUsage, aq as plannerContextFill, ar as removeTaskFromPlan, as as renumberTasks, at as updateTaskInPlan, au as usageLine, av as validateModifiedPlan, aw as warningsText } from './Task-Vl5Zq_D-.js';
-import { f as IFileSystem, R as ReadFileOpts, T as ToolOutcome, d as GrepOptions, c as GlobOptions, b as FindSymbolOptions, I as IConfig, A as AiProvider, r as ProviderModelLists, i as ITerminalSession, h as ITerminalRunner, w as RunnerRegistry, k as OrchestratorOption, u as RunnerInvocation, g as IPluginStore, v as RunnerPluginManifest, t as ResolveContext } from './ITerminalRunner-BV9Rd2o9.js';
-export { a as AllProviderModels, B as BlockingPrompt, C as CatalogModel, D as DiscoveryCommand, F as FetchAllProviderModelsOptions, G as GREP_DEFAULT_HEAD_LIMIT, e as GrepOutputMode, M as ModelCatalog, j as ModelShortcut, O as ORCHESTRATOR_SHORTCUTS, P as PluginCloneFn, l as PluginEntry, m as PluginFeatures, n as PluginMode, o as PluginModelDiscovery, p as PluginRunnerDef, q as ProviderCredentialSource, s as ProviderModelsResult, S as SEARCH_EXCLUSIONS, x as collectProviderCredentials, y as enabledRunners, z as fetchAllProviderModels, E as isReservedRunnerName, H as knownModelId, J as resolveModelShortcut, K as resolveProvider, L as toOrchestratorOptions } from './ITerminalRunner-BV9Rd2o9.js';
-import { I as IApproval, d as ApprovalRequest, a as ApprovalMode } from './ApprovalPolicy-BVhGdECT.js';
-export { A as ApprovalKind, b as ApprovalPolicy, c as ApprovalPolicyOptions, e as ApprovalSource, D as DENY_ALL } from './ApprovalPolicy-BVhGdECT.js';
-import { t as TaskOp, n as SessionBroadcaster, p as SessionNotice } from './plan-utils-BFaPo-IT.js';
-export { A as Adr0013IsolationRun, a as Adr0013PlanIsolation, b as Adr0013TaskRecord, c as ApplyTaskOpsResult, d as ApprovalBlock, e as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, f as ConversationInput, g as ConversationView, D as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, G as GatedConversation, L as LocalEntry, M as MessageBlock, i as MessageRole, N as NO_TURN, O as OutputPreview, P as PlanBlock, j as PlanMarkerStatus, k as PromptHold, S as SerializedPlan, l as SerializedTask, m as SerializedTaskStatus, o as SessionMessage, q as SubagentBlock, r as SubagentChild, s as SubagentStatus, T as TakenPrompt, u as TaskRef, v as ThinkingDisplayBlock, w as ToolBlock, x as ToolHeadline, y as ToolStatus, z as TurnGate, U as UsageBlock, B as aheadOfDraft, F as applyTaskOps, H as canMergeTasks, I as canSetDependencies, J as canSplitTask, K as capConflictFiles, Q as classifyOutcome, R as dependencyCandidates, V as dependentsOf, W as drainNext, X as executionSummary, Y as followTurn, Z as fromTranscript, _ as hasHiddenDetail, $ as holdPrompt, a0 as migratePlanIsolation, a1 as outputLines, a2 as outputPreview, a3 as parseTaskOpsJson, a4 as reduceConversation, a5 as serializePlan, a6 as serializeTask, a7 as serializeTaskStatus, a8 as stopTurn, a9 as summarizeToolCall, aa as taskStartedNotice, ab as textHasTaskOps, ac as toolHeadline, ad as truncateCheckpointSummary, ae as unsendAll, af as unsendLatest } from './plan-utils-BFaPo-IT.js';
-import { R as RunnerModeInfo } from './ModeResolver-D3XO0fT9.js';
-export { M as ManifestLookup, b as buildModeGuide, f as filteredBuildModes, r as resolveDefaultMode, a as resolveTaskMode, c as runnerModesFrom } from './ModeResolver-D3XO0fT9.js';
+import { aG as RunnerId, ag as PlanStatus, a6 as LegacyPlanState, I as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, L as ITerminalRunner, J as IConfig, h as AiProvider, as as ProviderModelLists, m as ApprovalMode, X as IsolationMergeResult, T as IsolationLandedTask, N as IWorktreeIsolation, a2 as IsolationTaskStatus, ad as PlanIsolation, aL as RunnerTransport, az as RepoGroupLayout, M as ITerminalSession, w as DiscoveredModel, aU as Task, f as AgentProcessDeps, c as AgentAdapter, aB as ResearchProgress, aA as ResearchLogEntry, u as ConversationMessage, b9 as UsageRecord, b1 as TaskSnapshot, r as AwaitingReason, Q as IsolationHandoff, $ as IsolationRun, a0 as IsolationTaskRecord, aV as TaskIsolation, a3 as IsolationView, Y as IsolationOutcome, ay as RepairEvidence, bg as Verdict, aJ as RunnerRegistry, ax as QueuedTaskMessage, aw as QueuedMessage, b as ActiveTaskSession, ac as OrchestratorOption, aY as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aE as ResearchToolType, ai as PlannerUsage, n as ApprovalPolicy, af as PlanState, aH as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, aQ as StructuredSessionCapability, b2 as TaskStartOptions, aR as StructuredTurnEnd, aP as StructuredEvent, aK as RunnerSpawnOptions, K as IPluginStore, aI as RunnerPluginManifest, aF as ResolveContext, b0 as TaskRunnerFlags } from './Task-CZJr6rmz.js';
+export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, t as CommandLineTooLongError, D as DENY_ALL, v as DiscoveredMode, x as DiscoveryCommand, E as EmbeddedNewlineError, y as ExecutableNotFoundError, F as FetchAllProviderModelsOptions, H as HeadlessRunner, z as HeadlessRunnerDeps, G as HeadlessSession, O as IntegrationDisposal, P as IsolationAvailability, R as IsolationHandoffRepo, S as IsolationInactiveReason, U as IsolationLanding, V as IsolationMergeBlock, W as IsolationMergeBlockReason, Z as IsolationPruneResult, _ as IsolationRepo, a1 as IsolationTaskRepo, a4 as LaunchDeps, a5 as LaunchPlan, a7 as LineBuffer, a8 as Message, a9 as ModelCatalog, aa as ModelShortcut, ab as ORCHESTRATOR_SHORTCUTS, ae as PlanModificationWarnings, ah as PlannerStartOptions, aj as PluginCloneFn, ak as PluginEntry, al as PluginFeatures, am as PluginMode, an as PluginModelDiscovery, ao as PluginRunnerDef, ap as PreparedLaunch, aq as PreparedTask, ar as ProviderCredentialSource, at as ProviderModelsResult, au as PtySize, av as PtyWrapOptions, aC as ResearchStep, aD as ResearchStepOutcome, aM as StreamEvent, aN as StreamStepEvent, aO as StreamThinkingEvent, aS as SubagentLogEntry, aT as SubagentOutcome, aW as TaskIsolationState, aX as TaskMode, aZ as TaskModeUnsupportedError, a_ as TaskModelAssignment, a$ as TaskOutputSummary, b3 as TaskStatus, b4 as TaskTransport, b5 as TaskType, b6 as TaskWithParent, b7 as ThinkingBlock, b8 as UsageLine, ba as UsageTotals, bb as UserPromptEntry, bc as UserStep, bd as ValidationCheck, be as ValidationContext, bf as ValidationResult, bh as VerificationCheck, bi as WINDOWS_MAX_COMMAND_LINE, bj as addPlannerUsage, bk as addTaskToPlan, bl as addUsage, bm as approvalScopes, bn as buildShellInvocation, bo as collectProviderCredentials, bp as createEmptyPlan, bq as createTask, br as emptyWarnings, bs as enabledRunners, bt as fetchAllProviderModels, bu as flattenTasks, bv as flattenTasksWithParents, bw as isAwaitingReason, bx as isExecutableResolved, by as isGranted, bz as isMeasured, bA as isReservedRunnerName, bB as isRunnerApproval, bC as isRunnerTransport, bD as isStructuredSession, bE as keepExecutionState, bF as knownModelId, bG as migrateLegacyPlan, bH as migratePlanState, bI as migrateTask, bJ as partedPromptUsage, bK as planDirectLaunch, bL as planShellLaunch, bM as plannerContextFill, bN as posixShellQuote, bO as removeTaskFromPlan, bP as renumberTasks, bQ as resolveModelShortcut, bR as resolveProvider, bS as stripAnsi, bT as toApprovalDecision, bU as toOrchestratorOptions, bV as updateTaskInPlan, bW as usageLine, bX as validateModifiedPlan, bY as warningsText, bZ as windowsCommandLine, b_ as wrapWithPty } from './Task-CZJr6rmz.js';
+import { t as TaskOp, l as SessionBroadcaster, A as ApplyTaskOpsResult, m as SessionMessage, n as SessionNotice, r as TaskLogEvent } from './plan-utils-_T5S7Mnk.js';
+export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DisplayBlock, E as EMPTY_CONVERSATION, e as EMPTY_HOLD, f as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, M as MessageBlock, g as MessageRole, N as NO_TURN, O as OutputPreview, P as PlanBlock, h as PlanMarkerStatus, i as PromptHold, S as SerializedPlan, j as SerializedTask, k as SerializedTaskStatus, o as SubagentBlock, p as SubagentChild, q as SubagentStatus, T as TakenPrompt, s as TaskLogView, u as TaskRef, v as ThinkingDisplayBlock, w as ToolBlock, x as ToolHeadline, y as ToolStatus, z as TurnGate, U as UsageBlock, B as aheadOfDraft, F as applyTaskOps, H as canMergeTasks, I as canSetDependencies, J as canSplitTask, K as capConflictFiles, Q as classifyOutcome, R as coalesceTaskLog, V as dependencyCandidates, W as dependentsOf, X as drainNext, Y as executionSummary, Z as followTurn, _ as fromTranscript, $ as hasHiddenDetail, a0 as holdPrompt, a1 as outputLines, a2 as outputPreview, a3 as parseTaskOpsJson, a4 as reduceConversation, a5 as reduceTaskLog, a6 as replayTaskLog, a7 as runnerToolSubject, a8 as serializePlan, a9 as serializeTask, aa as serializeTaskStatus, ab as stopTurn, ac as summarizeToolCall, ad as taskStartedNotice, ae as textHasTaskOps, af as toTaskLogEvent, ag as toolHeadline, ah as trimToolOutput, ai as truncateCheckpointSummary, aj as unsendAll, ak as unsendLatest } from './plan-utils-_T5S7Mnk.js';
+import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-D4dAl2r8.js';
+export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-D4dAl2r8.js';
+import { R as RunnerModeInfo } from './ModeResolver-DVYVRbJp.js';
+export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-DVYVRbJp.js';
 import { ChildProcess } from 'child_process';
-import { EventEmitter } from 'events';
-import { b as PlanParseError } from './parsing-BTP4bwkk.js';
-export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, T as TASK_OPS_ENVELOPE_KEY, c as TASK_QUERY_ENVELOPE_KEY, d as checkDepsResolve, e as checkImmutableLog, f as checkInProgress, g as checkNoCycles, h as checkUniqueIds, i as escapeControlCharsInStrings, j as extractJsonObject, k as extractObjectWithBalance, l as extractObjectsWithKey, m as looksLikePlanAttempt, o as opensWithJsonObject, p as parsePartialPlan, n as parsePlanJson, s as stripModelNoise, q as stripTrailingCommas, v as validatePlanModification } from './parsing-BTP4bwkk.js';
+import { b as PlanParseError } from './parsing-Bd6-b644.js';
+export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, T as TASK_OPS_ENVELOPE_KEY, c as TASK_QUERY_ENVELOPE_KEY, d as checkDepsResolve, e as checkImmutableLog, f as checkInProgress, g as checkNoCycles, h as checkUniqueIds, i as escapeControlCharsInStrings, j as extractJsonObject, k as extractObjectWithBalance, l as extractObjectsWithKey, m as looksLikePlanAttempt, o as opensWithJsonObject, p as parsePartialPlan, n as parsePlanJson, s as stripModelNoise, q as stripTrailingCommas, v as validatePlanModification } from './parsing-Bd6-b644.js';
 export { resolveOrderLabel, taskOrderLabel } from './order-labels.js';
+import 'events';
 
 interface SessionMeta {
     id: string;
@@ -128,7 +126,10 @@ declare function researchShellWarning(shell: ResearchShell): string | null;
  *
  * A segment is classified by the command that will actually execute, not by the
  * name at the front of it: wrappers are unwrapped first, recursively, so
- * `timeout 10 env nice rm -rf x` is an `rm`. See {@link WRAPPER_FAMILY}.
+ * `timeout 10 env nice rm -rf x` is an `rm`. See {@link WRAPPER_FAMILY}. A
+ * runner that feeds its command arguments nobody can see is unwrapped the same
+ * way but never runs unprompted ({@link XARGS_TARGETS}), and one that hands its
+ * command to a shell is refused ({@link REFUSED_RUNNERS}).
  *
  * A permitted binary is permitted with the flags it is known to be read-only
  * with, not with any flag at all: several of them will run a helper program or
@@ -260,16 +261,19 @@ declare abstract class BaseFileSystem implements IFileSystem {
      * Path confinement for `bash`: an `auto`-tier binary (`cat`, `find`, `rg`, …)
      * is only auto because *reading* is read-only — its arguments can still
      * name a path outside the workspace, which is the exact escape confinement
-     * closes for `readFile`/`glob`/`grep`. Each escaping path needs its own
-     * approval (scoped to its containing directory); approving one does not
-     * approve another, so a single command touching two external dirs prompts
-     * once per distinct scope rather than carrying the first grant to the rest.
+     * closes for `readFile`/`glob`/`grep`. Each escaping path is scoped to its
+     * containing directory, one entry per distinct scope.
      */
-    private authorizeCommandPaths;
+    private outsidePaths;
     /**
      * Three tiers (see `commandPolicy.ts`): read-only inspection runs silently,
      * anything else asks once and is remembered, and writes are refused outright
      * because a planner that mutates the workspace has stopped being a planner.
+     *
+     * Everything a command needs — its own approval and every outside directory
+     * it touches — is one request, so one command is one prompt. Each scope is
+     * still granted separately: approving the pair does not approve another
+     * directory the next command names.
      */
     bash(command: string, signal?: AbortSignal): Promise<ToolOutcome>;
 }
@@ -323,7 +327,9 @@ declare function grantScopeFor(abs: string, kind: 'file' | 'directory'): string;
  * Timeouts are load-bearing rather than defensive: a planner turn that blocks
  * forever on an unanswered prompt would hang the whole research loop with no
  * visible cause. On expiry the request resolves to denied and the model gets a
- * normal, actionable tool result.
+ * normal, actionable tool result. A task runner's request is the exception
+ * (ADR-0018, A1): the runner is parked on it rather than a research loop, and
+ * it waits for a person — or the supervisor — however long that takes.
  */
 interface PendingApproval {
     id: string;
@@ -336,20 +342,70 @@ interface PendingApprovalsOptions {
     /** Announce a new request to the surfaces. */
     onRequest?: (pending: PendingApproval) => void;
     /** Announce that a request is no longer actionable (answered or expired). */
-    onSettled?: (id: string, granted: boolean) => void;
+    onSettled?: (id: string, granted: boolean, settled: {
+        request: ApprovalRequest;
+        decision: ApprovalDecision;
+    }) => void;
+}
+interface AskOptions {
+    /**
+     * An id the caller already announced the request under. One still in use is
+     * refused — denied at once — rather than overwriting the request that has it.
+     */
+    id?: string;
+    /** Wait for an answer however long it takes. */
+    noTimeout?: boolean;
+    /**
+     * Given the answer as the request settles, before anything awaiting the
+     * promise runs: a caller about to tear down what asked (a runner being
+     * stopped) must deliver the answer before it goes.
+     */
+    onDecision?: (decision: ApprovalDecision) => void;
 }
 declare class PendingApprovals {
     private readonly opts;
     private readonly entries;
     constructor(opts?: PendingApprovalsOptions);
     /** Park a request and return the promise the approval policy awaits. */
-    ask(request: ApprovalRequest): Promise<boolean>;
-    /** Answer one request. Returns false when the id is unknown or already settled. */
-    resolve(id: string, granted: boolean): boolean;
+    ask(request: ApprovalRequest, options?: AskOptions): Promise<boolean>;
+    /** Park a request whose answer is more than yes or no. */
+    decide(request: ApprovalRequest, options?: AskOptions): Promise<ApprovalDecision>;
+    /**
+     * Answer one request. Returns false when the id is unknown or already
+     * settled. "Allow for this task" on a request that did not offer it is a
+     * plain allow: no grant is made that the requester never proposed.
+     */
+    resolve(id: string, answer: ApprovalAnswer): boolean;
     /** Everything still awaiting an answer — replayed to a surface that connects late. */
     outstanding(): PendingApproval[];
-    /** Deny everything in flight. Called on abort and on session reset. */
-    clear(): void;
+    /**
+     * Deny everything in flight, or only the requests `which` picks. Called on
+     * abort and on session reset.
+     */
+    clear(which?: (request: ApprovalRequest) => boolean, note?: string): void;
+}
+
+/**
+ * Carries a structured task's tool requests to the session's one approval
+ * seam (ADR-0018, A1), so a runner's request is answered through
+ * `resolveApproval` like any other — by a person on any surface, or by the
+ * supervisor (#28), with nothing here assuming which.
+ *
+ * Like the task log, it sits around the runner rather than inside the
+ * orchestrator: every way an attempt ends reaches the runner as a `stop`, and
+ * that is where a task's open requests are denied, before the session goes,
+ * so nothing is left waiting on a process that no longer exists.
+ */
+declare class RunnerApprovals {
+    private readonly approvals;
+    /** The open request ids of each live structured session. */
+    private readonly open;
+    constructor(approvals: PendingApprovals);
+    wrap(runner: ITerminalRunner): ITerminalRunner;
+    /** How many of a task's runner requests wait for an answer — what "waiting for approval" is derived from. */
+    waiting(taskId: string): number;
+    private watch;
+    private denySession;
 }
 
 /**
@@ -587,6 +643,37 @@ interface WorktreeIsolationDeps {
 }
 declare function createWorktreeIsolation(deps: WorktreeIsolationDeps): IWorktreeIsolation;
 
+/** A task record as ADR-0013 persisted it, for one repository. */
+interface Adr0013TaskRecord {
+    taskId: string;
+    order: number;
+    title: string;
+    branch: string;
+    worktree: string;
+    status: IsolationTaskStatus;
+    linked: string[];
+}
+/** A run as ADR-0013 persisted it (0.4.23): one repository, its refs on the run itself. */
+interface Adr0013IsolationRun {
+    id: string;
+    workspaceRoot: string;
+    baseRef: string;
+    baseBranch?: string;
+    integrationBranch: string;
+    tasks: Record<string, Adr0013TaskRecord>;
+}
+interface Adr0013PlanIsolation {
+    run: Adr0013IsolationRun;
+    resolvers: Record<string, string>;
+}
+/**
+ * A persisted plan isolation in today's shape. A run saved in the ADR-0013
+ * format — recognised by its own `integrationBranch` — becomes a group of one
+ * at `.`, keeping its branches, so a session saved by 0.4.23 resumes and hands
+ * off exactly as it would have.
+ */
+declare function migratePlanIsolation(state: PlanIsolation | Adr0013PlanIsolation): PlanIsolation;
+
 interface ILogger {
     warn(scope: string, message: string, err?: unknown): void;
 }
@@ -613,6 +700,11 @@ interface UserSettings {
      * back to the environment's defaults; `[]` is a deliberate "none of them".
      */
     enabledRunners?: string[];
+    /**
+     * How tasks' runners are driven (ADR-0018). A run copies it onto its plan
+     * when it starts, so a change applies from the next run.
+     */
+    runnerTransport: RunnerTransport;
 }
 /**
  * Where the user's toggles live. `ORDEWELL_SETTINGS_PATH` overrides it so several
@@ -629,6 +721,12 @@ declare class SettingsService {
     private filePath;
     private cache;
     private cachedMtimeMs;
+    /**
+     * Whether the transport on disk (or just set) is the user's own choice.
+     * Writing the default back out would turn it into one, and a later change of
+     * default would then never reach this user.
+     */
+    private transportChosen;
     constructor(filePath?: string);
     getAll(): UserSettings;
     private fileMtimeMs;
@@ -636,6 +734,8 @@ declare class SettingsService {
     setTdd(enabled: boolean): void;
     getVerification(): boolean;
     setVerification(enabled: boolean): void;
+    getRunnerTransport(): RunnerTransport;
+    setRunnerTransport(transport: RunnerTransport): void;
     getModelAllowlist(runner: string): string[] | undefined;
     setModelAllowlist(runner: string, ids: string[] | undefined): void;
     getPlannerModel(provider: string): {
@@ -812,492 +912,7 @@ type LiveOutputLookup = (taskId: string, opts: LiveTailOptions) => LiveTail | nu
  * state on every query rather than cached. `liveOutput` backs the `output`
  * field; omitting it reads as "nothing captured".
  */
-declare function renderTaskQueryAnswer(query: TaskQuery, tasks: Task[], catalog: TaskQueryCatalog, liveOutput?: LiveOutputLookup): string;
-
-declare abstract class AbstractTerminalSession implements ITerminalSession {
-    id: string;
-    taskId: string;
-    protected exited: boolean;
-    protected outputEmitter: EventEmitter<any>;
-    protected exitEmitter: EventEmitter<any>;
-    constructor(id: string, taskId: string);
-    protected baseHandleExit(code: number): void;
-    onOutput(callback: (text: string) => void): void;
-    onExit(callback: (code: number) => void): void;
-    abstract kill(): void;
-    abstract getOutput(): string;
-    abstract write(text: string): void;
-}
-declare abstract class AbstractRunner<S extends ITerminalSession> implements ITerminalRunner {
-    protected sessions: Map<string, S>;
-    get activeCount(): number;
-    stop(sessionId: string): void;
-    stopAll(): void;
-    protected registerSession(id: string, session: S): void;
-    abstract spawn(opts: {
-        taskId: string;
-        runner: string;
-        prompt: string;
-        modelId?: string;
-        thinkingEffort?: string;
-        mode?: string;
-        headless?: boolean;
-        cwd: string;
-        registry?: RunnerRegistry;
-    }): Promise<ITerminalSession>;
-}
-
-declare function stripAnsi(text: string): string;
-declare function posixShellQuote(s: string): string;
-/**
- * Wrap a command for execution inside a POSIX login shell, which is what
- * resolves runner binaries managed by nvm/volta/asdf.
- *
- * Deliberately POSIX-only. This used to take a `platform` and emit
- * `powershell.exe -Command "'claude' '-p' '…'"` for Windows, which PowerShell
- * cannot run at all: a quoted string in leading position is parsed in
- * expression mode, so the invocation died with a parse error before the runner
- * started — a task that failed instantly, every time, on that platform. Windows
- * has no login-shell equivalent to emulate (its PATH comes from the registry
- * and is already inherited), so {@link planShellLaunch} starts the runner
- * directly there instead of routing it through a shell. Platform choice belongs
- * to that function; this one only knows how to phrase the POSIX half.
- */
-declare function buildShellInvocation(command: string, args: string[]): {
-    shellPath: string;
-    shellArgs: string[];
-};
-/** A terminal size in cells. */
-interface PtySize {
-    cols: number;
-    rows: number;
-}
-/**
- * Options for {@link wrapWithPty}. `size` sets the PTY's window size before the
- * wrapped command starts. `controlChannel` makes the wrapper listen on its fd 3
- * for `"<cols> <rows>"` lines and resize the PTY live — the caller spawns the
- * child with an extra pipe there and writes resize requests into it.
- */
-interface PtyWrapOptions {
-    size?: PtySize;
-    controlChannel?: boolean;
-}
-/**
- * Wrap a command in `script` to allocate the PTY some runners require when
- * headless; `-e` propagates the child's exit code so verification still works.
- *
- * POSIX-only by nature — there is no `script` on Windows, which
- * `HeadlessRunner`'s `hasScriptCmd` probe already discovers, so this is never
- * reached there.
- *
- * `script` sizes its PTY off the terminal it is attached to; spawned off a pipe
- * (every transport here) it allocates 0x0, which a runner TUI renders as
- * garbage. `stty` fixes the size on the PTY slave before the command starts, so
- * the TUI reads its true dimensions via ioctl.
- *
- * The control channel can only live on a *separate* fd from the agent's stdin,
- * so the wrapper saves the PTY on fd 4 first: POSIX sends an asynchronous
- * command's stdin to `/dev/null`, so the watcher's own stdin cannot be the PTY.
- * A background job also inherits an fd 0 that is not the terminal; `stty` names
- * fd 4 explicitly for that reason.
- */
-declare function wrapWithPty(command: string, args: string[], opts?: PtyWrapOptions): {
-    command: string;
-    args: string[];
-};
-
-/**
- * cmd.exe's command-line buffer. A longer line is truncated rather than
- * rejected, which would corrupt a planner's system prompt or a task's prompt
- * mid-sentence and produce a confident answer to half a question — so the
- * batch route refuses instead. See {@link CommandLineTooLongError}.
- */
-declare const CMD_EXE_MAX_COMMAND_LINE = 8191;
-/**
- * CreateProcess's own ceiling, which the native and PowerShell routes are
- * bounded by instead. Windows truncates here too, so the same refusal applies —
- * it is simply four times further away.
- */
-declare const WINDOWS_MAX_COMMAND_LINE = 32767;
-interface LaunchPlan {
-    /** The executable handed to `spawn()` or `vscode.window.createTerminal`. */
-    file: string;
-    /** Arguments for `file`. Pass verbatim when {@link verbatim} is set. */
-    args: string[];
-    /**
-     * Windows batch route only: `args` is already a quoted command line and must
-     * not be re-quoted. Maps to `windowsVerbatimArguments` for `spawn`, and to
-     * the string form of `shellArgs` for a VS Code terminal.
-     */
-    verbatim?: boolean;
-}
-/** Test seam: every OS touchpoint is injectable, and production uses the defaults. */
-interface LaunchDeps {
-    platform?: NodeJS.Platform;
-    /** The PATH executables are looked up on. Defaults to the augmented PATH. */
-    resolvePath?: () => Promise<string>;
-    /** True when `candidate` names an existing file. */
-    exists?: (candidate: string) => boolean;
-    /** Absolute path to the Windows command interpreter. */
-    comSpec?: () => string;
-    /** Absolute path to Windows PowerShell. */
-    powerShell?: () => string;
-    /** PATHEXT, as the environment reports it. */
-    pathExt?: () => string;
-}
-/**
- * Thrown when a command's arguments do not fit the buffer of the only
- * interpreter that can start it. Windows truncates rather than rejecting, and a
- * system prompt cut off mid-sentence makes the planner answer half a question
- * confidently — the silent success this repo refuses — so this is raised
- * instead. `TaskOrchestrator.startTask` catches it and holds the task, so the
- * message is what the user reads: it names the fix, because they cannot infer
- * it from a truncated prompt.
- */
-declare class CommandLineTooLongError extends Error {
-    readonly command: string;
-    readonly length: number;
-    readonly limit: number;
-    constructor(command: string, length: number, limit?: number);
-}
-/**
- * Thrown when only a batch shim resolved for a multi-line argument. cmd.exe
- * reads up to the first CR/LF and discards the rest with no error and exit code
- * 0 — quoting does not help — so the agent would get the first paragraph of its
- * prompt without the completion marker instruction, then exit looking successful.
- */
-declare class EmbeddedNewlineError extends Error {
-    readonly command: string;
-    constructor(command: string);
-}
-/**
- * Thrown when `command` cannot be resolved to a real file. Kept distinguishable
- * from `WorkspaceNotFoundError` (utils/workspace) even though both a missing
- * cwd and a missing binary surface as the same `spawn` ENOENT to Node — the two
- * are checked, and named, separately so the failure names the actual cause.
- */
-declare class ExecutableNotFoundError extends Error {
-    readonly command: string;
-    readonly searchedPath: string;
-    constructor(command: string, searchedPath: string);
-}
-/**
- * Whether `command` actually resolves to a file, given the plan
- * {@link planDirectLaunch} produced for it and the PATH it was resolved
- * against.
- *
- * POSIX is deliberately identity in `planDirectLaunch` (execvp does its own
- * PATH search), so the search is repeated here instead. Windows already did
- * the search inside `planDirectLaunch` — signalled by the returned file
- * differing from the bare command name it was given; an unresolved command
- * comes back unchanged.
- */
-declare function isExecutableResolved(command: string, plan: LaunchPlan, PATH: string, deps?: LaunchDeps): boolean;
-/** The verbatim command line cmd.exe receives after `/d /s /c`, before wrapping. */
-declare function windowsCommandLine(file: string, args: string[]): string;
-/**
- * How to start `command` with `args` through `spawn()`, with no shell.
- *
- * POSIX returns its input unchanged — execvp already searches PATH, and adding
- * a resolution step there would be a new way for a working setup to break.
- *
- * Windows resolves the command against PATH × PATHEXT, preferring a native
- * executable (spawned directly) over a batch shim (through cmd.exe) over a
- * PowerShell script shim (through `powershell.exe -File`). A command that
- * resolves to nothing is returned unchanged, so the caller's existing ENOENT —
- * which names what the user typed — is what surfaces rather than a second,
- * vaguer error from here.
- *
- * The tiers are tried in preference order and the first that *fits* wins, with
- * one deliberate exception: an overflowing batch shim does not fall through to
- * PowerShell. Overflow means a very large prompt, which is precisely where
- * `-File` argument fidelity is least worth betting on, and where a clear held
- * task beats a plausibly-mangled one. So capacity does not reorder the tiers —
- * a `.ps1` beside a too-long `.cmd` still raises.
- *
- * A line break does reorder them: cmd.exe cannot carry one at any length, so a
- * `.ps1` beside a `.cmd` wins, and a lone `.cmd` raises.
- *
- * @throws {CommandLineTooLongError} when the selected route's buffer cannot
- * carry the arguments.
- * @throws {EmbeddedNewlineError} when the arguments span lines and only the
- * batch route resolved.
- */
-declare function planDirectLaunch(command: string, args: string[], deps?: LaunchDeps): Promise<LaunchPlan>;
-/**
- * How to start `command` for a surface that hands an executable and arguments
- * to a terminal — the VS Code runner today, a Windows TUI later.
- *
- * On POSIX this is the login shell, unchanged: `bash -lc` runs the user's
- * profile, which is how nvm/volta/asdf-managed runner binaries resolve at all.
- * Windows has no login-shell equivalent (its PATH comes from the registry and
- * is already inherited), so it takes the direct route instead. That is not just
- * a simplification: it means the runner's own exit code is the terminal's exit
- * code, rather than a `$LASTEXITCODE` that PowerShell propagates unreliably —
- * and the exit code is half of what {@link VerdictEngine} judges a task on.
- */
-declare function planShellLaunch(command: string, args: string[], deps?: LaunchDeps): Promise<LaunchPlan>;
-
-type SpawnFn = (command: string, args: string[], options: {
-    env: NodeJS.ProcessEnv;
-    stdio: Array<'pipe' | 'ignore'>;
-    cwd: string;
-    /** Set by the Windows batch route, where `args` is already a quoted command line. */
-    windowsVerbatimArguments?: boolean;
-}) => ChildProcess;
-/** Test seam: every OS touchpoint is injectable; production uses the defaults. */
-interface HeadlessRunnerDeps {
-    spawnImpl?: SpawnFn;
-    hasScriptCmd?: () => boolean;
-    resolvePath?: () => Promise<string>;
-    /**
-     * Overrides for executable resolution ({@link planDirectLaunch}). Only the
-     * Windows branch consults them, so a POSIX test never needs to pass anything.
-     */
-    launchDeps?: LaunchDeps;
-}
-declare class HeadlessSession extends AbstractTerminalSession {
-    private spawnImpl;
-    readonly interactive: boolean;
-    private process;
-    private outputBuffer;
-    private controlStream;
-    constructor(id: string, taskId: string, spawnImpl: SpawnFn, interactive?: boolean);
-    get isStarted(): boolean;
-    start(launch: LaunchPlan, cwd: string, resolvedPath: string, env?: Record<string, string>, options?: {
-        controlChannel?: boolean;
-    }): void;
-    kill(): void;
-    getOutput(): string;
-    write(text: string): void;
-    /** PTY resize requests from a surface that owns the terminal rendering the wrapper. */
-    writeControl(text: string): void;
-}
-type RunnerSpawnOptions = Parameters<ITerminalRunner['spawn']>[0];
-/** Everything needed to start one runner process, resolved before any child exists. */
-interface PreparedLaunch {
-    launch: LaunchPlan;
-    resolvedPath: string;
-    env: Record<string, string>;
-    /** True when the invocation was wrapped in `script` to allocate a PTY. */
-    pty: boolean;
-    /** True when the started process needs an explicit Enter sent to submit its pre-filled prompt. */
-    submitPromptKey: boolean;
-}
-declare class HeadlessRunner extends AbstractRunner<HeadlessSession> {
-    private spawnImpl;
-    private hasScriptCmd;
-    private resolvePath;
-    private launchDeps;
-    private spawnCount;
-    /**
-     * Session shape: a piped subprocess is not a terminal, so runners get their
-     * non-interactive subcommand. The VS Code runner owns a pseudoterminal and
-     * overrides this to true. Autonomy is a separate axis (see `ResolveContext`)
-     * and stays on either way — no surface has a human answering permission
-     * prompts on the orchestrator's behalf.
-     */
-    protected readonly defaultInteractive: boolean;
-    constructor(deps?: HeadlessRunnerDeps);
-    /**
-     * Unique per spawn, not per task: a retry reuses its task id and ids often
-     * share a prefix, and a shared registry key let the old attempt's exit
-     * unregister the new one. Unlike TmuxRunner, nothing outside this process
-     * keys on the id, so a counter is enough to scope it to the attempt.
-     */
-    protected nextSessionId(taskId: string): string;
-    protected createSession(id: string, taskId: string): HeadlessSession;
-    /** Everything up to, but not including, spawning — so a surface that owns its own child reaches the same decisions. */
-    protected prepareLaunch(opts: RunnerSpawnOptions, ptyOptions?: PtyWrapOptions): Promise<PreparedLaunch>;
-    spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
-}
-
-/**
- * The harness-planner transport contract (ADR-0009).
- *
- * One adapter per coding agent, each speaking that agent's own programmatic
- * protocol and normalizing it to the event union below. Everything above this
- * line — reply classification, the repair loop, plan validation, the four
- * surfaces — is already provider-agnostic, so an adapter is the entire cost of
- * teaching Ordewell to plan with another agent.
- */
-/**
- * One normalized event from a running agent turn. Deliberately smaller than
- * any single agent's native protocol: this is the intersection Ordewell can act
- * on, not a lossless re-encoding. Event fidelity differs by agent — `thinking`
- * is rich on Claude Code and absent elsewhere — so consumers must tolerate a
- * turn that emits nothing but `assistant_text` and `turn_end`.
- */
-type AgentEvent = 
-/**
- * A complete run of the assistant's reply. Concatenated in order to form the
- * turn's text. When the same run already streamed as `assistant_text_delta`,
- * this is the authoritative copy of it — it replaces the deltas, it is not
- * appended after them.
- */
-{
-    type: 'assistant_text';
-    text: string;
-}
-/**
- * An incremental piece of the assistant's reply, for agents that stream
- * partial messages. The planner's own text only: a subagent's words never
- * arrive here, so they can never become the reply.
- */
- | {
-    type: 'assistant_text_delta';
-    text: string;
-}
-/**
- * Reasoning the agent chose to expose. Never contributes to the reply text.
- * Like `assistant_text`, it supersedes deltas already streamed for it.
- */
- | {
-    type: 'thinking';
-    text: string;
-    subagentId?: string;
-} | {
-    type: 'thinking_delta';
-    text: string;
-    subagentId?: string;
-}
-/** `subagentId` marks a call made inside a subagent rather than by the planner itself. */
- | {
-    type: 'tool_call';
-    id: string;
-    name: string;
-    args: Record<string, unknown>;
-    subagentId?: string;
-} | {
-    type: 'tool_result';
-    id: string;
-    name: string;
-    output: string;
-    success: boolean;
-    subagentId?: string;
-}
-/** One model call's usage, as the agent reported it — never estimated. */
- | {
-    type: 'usage';
-    record: UsageRecord;
-}
-/** The agent delegated `brief` to a subagent, whose events carry `subagentId` until it finishes. */
- | {
-    type: 'subagent_started';
-    subagentId: string;
-    brief: string;
-    model?: string;
-} | {
-    type: 'subagent_finished';
-    subagentId: string;
-    outcome: SubagentOutcome;
-    digest: string;
-}
-/**
- * The agent asked to do something its read-only mode does not cover. Always
- * auto-denied (T1) — a planner that can mutate is not a planner. The adapter
- * is responsible for answering the agent so the turn does not hang.
- */
- | {
-    type: 'permission_request';
-    id: string;
-    name: string;
-    detail: string;
-}
-/**
- * The agent delegated work to a subagent it left running in the background,
- * and may end its turn before that work reports. Ordewell's conversation is
- * request/response: a turn that ends hands control back to the user, and
- * anything the agent says afterwards arrives with no turn open and is lost.
- * Naming the launch is what lets the service ask for the results in time.
- */
- | {
-    type: 'background_agent';
-    id: string;
-}
-/** The agent finished its turn and is waiting for the next user message. */
- | {
-    type: 'turn_end';
-}
-/** The turn failed. Carries the agent's own words — never a Ordewell paraphrase. */
- | {
-    type: 'error';
-    message: string;
-};
-interface AgentStartOptions {
-    /** Workspace root. The agent explores from here and, in read-only mode, cannot leave it. */
-    cwd: string;
-    /** The planner system prompt, in its harness variant. */
-    systemPrompt: string;
-    /** Model id from the runner's own discovery catalog. Omitted means the agent's default. */
-    model?: string;
-    /** Variant / reasoning effort id from that model's `variants` list. */
-    effort?: string;
-    /**
-     * The agent's own session id from a previous run. A hint only: Ordewell's
-     * transcript is the source of truth (T4), so a failed resume degrades to a
-     * fresh session seeded from the stored history rather than an error.
-     */
-    resumeSessionId?: string;
-}
-interface AgentAdapter {
-    /** The runner id this adapter drives — `claude-code`, `codex`, `opencode`. */
-    readonly agentId: string;
-    /** Spawn the agent in its read-only mode and get it ready to receive messages. */
-    start(opts: AgentStartOptions): Promise<void>;
-    /**
-     * Send one user message and stream the turn's events until it ends. Resolves
-     * when the agent yields the floor; rejects only when the transport itself
-     * failed in a way no `error` event could describe.
-     *
-     * `onActivity`, when given, fires on raw transport traffic — every stdio
-     * line or stream chunk the process produces — independent of whether that
-     * traffic becomes an `AgentEvent`. An adapter may legitimately emit nothing
-     * for long stretches (a subagent's filtered output, most often); a caller
-     * using presence-of-events as a liveness signal would read that silence as
-     * a hang. `onActivity` is the seam that keeps liveness detection from being
-     * coupled to what each adapter chooses to surface.
-     */
-    send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
-    /** The agent's native session id once it has announced one. Resumption hint only. */
-    nativeSessionId(): string | null;
-    /** Kill the process and release its resources. Idempotent. */
-    dispose(): void;
-}
-/**
- * The single injected boundary between Ordewell and the operating system —
- * the same pattern `HeadlessRunnerDeps` uses for task execution. Tests feed
- * recorded agent output through `spawn` (and, for HTTP-transport agents,
- * `fetch`) so one test exercises adapter parsing, event mapping, reply
- * classification and the repair loop as a single observable behavior.
- */
-interface AgentProcessDeps {
-    spawn: SpawnFn;
-    fetch: typeof globalThis.fetch;
-    /** Resolves the PATH agents are spawned under. Defaults to the augmented PATH. */
-    resolvePath?: () => Promise<string>;
-    /** Host platform. Defaults to the real one; injected so OS-specific behavior is testable anywhere. */
-    platform?: NodeJS.Platform;
-    /** True when `workspace` names an existing directory. Defaults to a real filesystem check. */
-    isDirectory?: (workspace: string) => boolean;
-    /** True when `candidate` names an existing, spawnable file. Defaults to a real filesystem check. */
-    exists?: (candidate: string) => boolean;
-    /** The workspace's own variables for a cwd (ADR-0016). Defaults to {@link resolveWorkspaceEnv}. */
-    workspaceEnv?: (cwd: string) => Promise<Record<string, string>>;
-}
-/** Builds the adapter for one runner id, or null when that runner cannot plan. */
-type AgentAdapterFactory = (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
-/**
- * Split a stream of chunks into complete lines. Every agent transport here is
- * newline-delimited JSON of some shape, and a chunk boundary lands mid-object
- * often enough that parsing per-chunk silently drops events.
- */
-declare class LineBuffer {
-    private buffer;
-    push(chunk: string, onLine: (line: string) => void): void;
-    /** Anything left unterminated when the stream closed. */
-    flush(): string;
-}
+declare function renderTaskQueryAnswer(query: TaskQuery, tasks: readonly Task[], catalog: TaskQueryCatalog, liveOutput?: LiveOutputLookup): string;
 
 interface CliAgentAiServiceDeps extends Partial<AgentProcessDeps> {
     /** Overrides adapter construction. Tests supply a fake agent; production picks by runner id. */
@@ -1371,6 +986,11 @@ declare class CliAgentAiService implements IAiService {
      * at once, which all three of these do routinely.
      */
     private runTurn;
+    /**
+     * The only way this service starts an agent, and it takes a planner start by
+     * type: the read-only boundary (ADR-0008/0009) cannot be crossed into task
+     * mode from here without changing this signature.
+     */
     private startAdapter;
     /**
      * The live agent process, restarted from its own session id if it died
@@ -1651,6 +1271,7 @@ declare abstract class BaseAiService {
 
 declare class GeminiService extends BaseAiService implements IAiService {
     private genAI;
+    private genAIKey;
     private model;
     constructor(config: IConfig);
     private init;
@@ -1680,7 +1301,14 @@ declare class GeminiService extends BaseAiService implements IAiService {
 
 declare class OpenAiService extends BaseAiService implements IAiService {
     private client;
+    private clientCredentials;
     constructor(config: IConfig);
+    /**
+     * Rebuilt whenever the key or endpoint differs from the one the client was
+     * made with. A Session outlives `/key` and endpoint edits, so a client cached
+     * for good kept sending the previous key: the provider answered 401 for a
+     * key the user had already replaced.
+     */
     private getClient;
     ensureInit(): void;
     private requireModel;
@@ -1702,16 +1330,18 @@ declare class OpenAiService extends BaseAiService implements IAiService {
 
 /**
  * The deep module owning all plan-shaped state. Holds `planTasks` (the ordered
- * tree the user edits), the flattened `allTasks` view, the `taskMap` index, and
- * the `completedTasks`/`failedTasks` sets the scheduler reads. The orchestrator
- * calls `markCompleted`/`markFailed`/`markInProgress`/`retry` to update task
- * status — it never mutates task state directly.
+ * tree the user edits), the flattened `allTasks` view and the `taskMap` index.
+ * The orchestrator calls `markCompleted`/`markFailed`/`markInProgress`/`retry`
+ * to update task status — it never mutates task state directly.
+ *
+ * Completion and failure are read from `task.status` and nothing else, so
+ * `isCompleted`, `completedCount`, `isAllComplete` and the scheduler's
+ * dependency checks cannot disagree. The store owns its task objects: `load`
+ * copies what it is given, the getters hand out readonly views, and
+ * `snapshot` is the copy a caller may keep or write to disk.
  *
  * `rebuild` is the internal seam that keeps the flat views in sync with the
- * tree. Structural removals (remove/merge/split) additionally prune
- * `completedTasks`/`failedTasks` for ids that no longer exist; `removeFromActive`
- * deliberately does not, so a completed task that leaves the active list still
- * satisfies its dependents' dependency checks.
+ * tree.
  *
  * `planRunners` lives here because it's part of the plan's identity (the runner
  * set, carried on the plan). `validateAssignedRunners` is pure store logic.
@@ -1720,15 +1350,13 @@ declare class PlanStore {
     private _planTasks;
     private _allTasks;
     private _taskMap;
-    private _completedTasks;
-    private _failedTasks;
     private _planRunners;
     private _onMutate;
     private _executionLog;
-    /** Hook called after every structural mutation (add/remove/update/merge/split/load). */
+    /** Hook called after every structural mutation (add/remove/update/merge/split/resetForRun). */
     set onMutate(cb: (() => void) | null);
-    get planTasks(): Task[];
-    get allTasks(): Task[];
+    get planTasks(): ReadonlyArray<Readonly<Task>>;
+    get allTasks(): ReadonlyArray<Readonly<Task>>;
     get planRunners(): RunnerId[];
     get completedCount(): number;
     get failedCount(): number;
@@ -1736,8 +1364,10 @@ declare class PlanStore {
     isAnyFailed(): boolean;
     isCompleted(id: string): boolean;
     isFailed(id: string): boolean;
-    get(taskId: string): Task | undefined;
-    getExecutionLog(): TaskSnapshot[];
+    get(taskId: string): Readonly<Task> | undefined;
+    /** A copy of the task tree, detached from the store: later status changes do not reach it. */
+    snapshot(): Task[];
+    getExecutionLog(): ReadonlyArray<TaskSnapshot>;
     appendToLog(snapshot: TaskSnapshot): void;
     /**
      * Drop a task's archived snapshot. Un-marking a completion has to erase the
@@ -1745,10 +1375,10 @@ declare class PlanStore {
      * left-behind snapshot would keep feeding them a result that no longer exists.
      */
     removeFromLog(taskId: string): void;
-    removeFromActive(taskId: string): void;
     clearLog(): void;
     private notifyMutate;
-    load(tasks: Task[], runners: RunnerId[]): void;
+    private countStatus;
+    load(tasks: ReadonlyArray<Readonly<Task>>, runners: readonly RunnerId[]): void;
     add(partial: Partial<Task>): Task;
     remove(taskId: string): void;
     update(taskId: string, changes: Partial<Task>): Task | undefined;
@@ -1768,13 +1398,16 @@ declare class PlanStore {
     markCompleted(id: string): void;
     markFailed(id: string): void;
     markInProgress(id: string): void;
-    markAwaitingUser(id: string): void;
+    markAwaitingUser(id: string, reason?: AwaitingReason): void;
     markPending(id: string): void;
     retry(id: string): void;
+    /** A reason outlives nothing: any status but `awaiting_user` drops it. */
+    private setStatus;
     blockDependents(id: string): void;
     unblockDependents(id: string): void;
     setTaskVerdict(id: string, verdict: Task['verdict']): void;
     setTaskOutputSummary(id: string, summary: Task['outputSummary']): void;
+    setTaskTransport(id: string, transport: Task['transport']): void;
     getPlanVisualization(): {
         tasks: {
             id: string;
@@ -1791,16 +1424,310 @@ declare class PlanStore {
      * plan's first one instead.
      */
     admitRunner(runner: RunnerId): void;
-    resolveTaskRunner(task: Task): RunnerId;
+    resolveTaskRunner(task: Readonly<Task>): RunnerId;
     private rebuild;
+    private validateAssignedRunners;
+}
+
+type IsolationNoticeLevel = 'info' | 'warn' | 'error';
+/**
+ * What the controller reports. It never schedules or emits on its own: the
+ * orchestrator turns these into observer events and decides what runs next.
+ */
+interface IsolationRunListener {
+    /** The run record changed and should be persisted with the plan. */
+    changed(): void;
     /**
-     * Drop completed/failed ids that no longer exist in the plan. Called by the
-     * structural removals (remove/merge/split) — but NOT by removeFromActive,
-     * where a completed task leaves the active list yet must still satisfy its
-     * dependents' dependency checks.
+     * A run opened — the one moment shared by Execute, a manual task run and
+     * a force start, so whatever a run pins for its whole length is read here.
      */
-    private pruneTerminalSets;
-    private validateAssignedRunners;
+    opened(): void;
+    /** A run did not start: `repos` of the group have tracked changes. */
+    blocked(repos: string[]): void;
+    /** An isolated run closed and handed its integration branches over. */
+    handoff(handoff: IsolationHandoff): void;
+    /** Already said through the notifications; also for a surface that shows no toasts. */
+    notice(level: IsolationNoticeLevel, message: string): void;
+    /**
+     * These tasks' worktrees are about to be removed. An agent left running in
+     * one would sit in a deleted directory, so it has to go first.
+     */
+    releasing(taskIds: string[]): void;
+}
+interface IsolationRunControllerDeps {
+    isolation: IWorktreeIsolation;
+    config: IConfig;
+    notifications: INotification;
+    workspaceRoot: () => string;
+    listener: IsolationRunListener;
+}
+/**
+ * The lifecycle of a plan's isolation run (ADR-0013, ADR-0014), between the
+ * scheduler and the git layer: deciding at a run's start whether it executes
+ * in worktrees, a blocked run and how it goes on, each attempt's working
+ * directory, releasing worktrees, the handoff when the run closes, and what the
+ * user does with it afterwards. The record it keeps outlives one run — a
+ * resumed plan continues it.
+ */
+declare class IsolationRunController {
+    private readonly isolation;
+    private readonly config;
+    private readonly notifications;
+    private readonly workspaceRoot;
+    private readonly listener;
+    private run;
+    /** Copied paths already reported for the current run: every task gets the same copies. */
+    private reportedCopies;
+    /**
+     * How the open run executes; null while no run is open. A run is one
+     * Execute-Plan or one manual task run, from its start until it settles or
+     * is stopped.
+     */
+    private mode;
+    /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
+    private resolvers;
+    private opening;
+    /** The start a dirty tree turned away, handed back once the user chooses how to go on. */
+    private blockedStart;
+    /** The dirty repos behind {@link blockedStart}, for the stash notice. */
+    private blockedRepos;
+    constructor(deps: IsolationRunControllerDeps);
+    /** The plan's run record, open or not; null when the plan has not isolated. */
+    get current(): IsolationRun | null;
+    get isOpen(): boolean;
+    /** The open run executes in worktrees. */
+    get isolating(): boolean;
+    /** A run is waiting on the user to stash or to go on without isolation. */
+    get blocked(): boolean;
+    /** What the plan persists of isolated execution; null when no run ever isolated. */
+    get planIsolation(): PlanIsolation | null;
+    requireRun(): IsolationRun;
+    /** A task's record in the open run, only while that run isolates. */
+    openRecord(taskId: string): IsolationTaskRecord | undefined;
+    /** Where a task's isolated work stands; null when the plan has no isolation run to speak of. */
+    taskIsolation(taskId: string): TaskIsolation | null;
+    view(): IsolationView | null;
+    /**
+     * Take over a plan's persisted isolation, or none for a plan that has not
+     * isolated yet. Whatever a crashed process left behind for the run — a
+     * worktree still marked active, a directory no record owns — is pruned,
+     * while kept, failed and conflicted worktrees stay for the user.
+     *
+     * Deliberately not reported as a change: adopting is not a change to
+     * persist, and a host that adopts without persisting (VS Code's restore)
+     * would otherwise write a new session file on every reload.
+     */
+    adopt(state: PlanIsolation | null): Promise<void>;
+    /**
+     * Open a run if none is: decide once, at its start, whether it executes in
+     * worktrees. `resume` is what a dirty tree parks until the user chooses how
+     * to go on. Resolves false when the run did not start.
+     */
+    open(resume: () => Promise<void>): Promise<boolean>;
+    /**
+     * Whether the run in force, or else the next one, gives each task its own
+     * worktrees, and of which repo group — what the planner is told, since it
+     * decides whether tasks on the same file have to be ordered and which shared
+     * paths two tasks must not edit at once. A tree that would block counts as
+     * not isolating: the user may yet run without isolation, and ordering is
+     * the safe rule then.
+     */
+    plannerLayout(): Promise<IsolatedExecution>;
+    /**
+     * Go on with the start a dirty tree turned away. `stash` puts the user's
+     * tracked changes on the git stash first, so the run isolates; `shared` runs
+     * this one run in the workspace root, knowingly. Returns the parked start for
+     * the caller to replay; null when nothing was parked.
+     */
+    continueBlocked(how: 'stash' | 'shared'): Promise<(() => Promise<void>) | null>;
+    /**
+     * The one place an attempt's working directory is decided: the worktree
+     * prepared for it in an isolated run, the kept one for a conflict repair,
+     * else the workspace root. `worktree` says which. Does not itself report a
+     * worktree it creates as a change — the caller does once the attempt is
+     * committed as running, so a spawn abandoned or failed after this settles
+     * is not misreported as a change that stuck.
+     */
+    attemptCwd(task: Task, opts: {
+        repair: boolean;
+    }): Promise<{
+        cwd: string;
+        worktree: boolean;
+    }>;
+    /**
+     * Land a task's work on the run's integration branches. The record is
+     * reported changed once the landing is set and before the first merge, so
+     * a crash mid-landing leaves the tips to roll back to, and again once it
+     * settles. A git error is `failed`, never a throw.
+     */
+    integrate(task: Task): Promise<IsolationOutcome>;
+    /** What a conflict repair's work shows (ADR-0015); git that cannot tell counts against it. */
+    verifyRepair(task: Task): Promise<RepairEvidence>;
+    /**
+     * Let go of a task's worktree. `keep` leaves it and its branch for
+     * inspection; otherwise both go. A landing still in flight settles first, so
+     * the worktree is never torn down underneath its merge.
+     */
+    release(taskId: string, opts: {
+        keep: boolean;
+    }, landing?: Promise<unknown> | null): Promise<void>;
+    /** Close the open run. An isolated one hands its integration branch over for review. */
+    close(): Promise<void>;
+    /**
+     * A stop or a plan load: the open run ends without a handoff and a parked
+     * start is dropped. `keepOpen` spares a run the scheduler is still driving.
+     */
+    interrupt(opts?: {
+        keepOpen?: boolean;
+    }): void;
+    /**
+     * Mark which added task resolves which conflict. The resolver merges the
+     * conflicted task's branch by hand in its own worktree; once that lands, the
+     * conflicted task can land in turn.
+     */
+    linkResolver(resolverId: string, conflictedId: string): void;
+    /** The conflicted task a landed resolver was added for, forgotten as it is returned. */
+    takeResolver(resolverId: string): string | undefined;
+    reviewDiff(): Promise<string>;
+    /**
+     * "Merge all": the run's integration branches into whatever the user has
+     * checked out, in every repo or none. Once everything merged, the run has
+     * nothing left to hand over, so it is cleared up and forgotten; a branch
+     * the user's HEAD somehow does not contain stays for the next run's sweep.
+     */
+    merge(): Promise<IsolationMergeResult>;
+    /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
+    cleanup(): Promise<void>;
+    /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
+    discard(): Promise<void>;
+    private clearMerged;
+    private forget;
+    private decide;
+    private activate;
+    private begin;
+    /** What earlier runs left merged in the group goes; a failure here is worth a word, never a stopped run. */
+    private sweep;
+    /**
+     * The plan's run carries on while it still has any record: anything landed
+     * means a resumed plan's dependents must start from a tip that holds their
+     * predecessors' work, and anything held — a kept attempt, a conflict, a
+     * repair — is work the user may still want, which a fresh run's mint would
+     * delete. Only a run with no records at all is superseded.
+     */
+    private continuableRun;
+    /**
+     * A run with no records at all holds only superseded attempts, so it goes
+     * whole. One that cannot be continued for another reason — it ran from a
+     * different workspace path — keeps its integration branch in each repo that
+     * has not merged it: only the user gives landed work up.
+     */
+    private mint;
+    private reportCopies;
+    private tell;
+}
+
+/** Which repair of a task an attempt is, of the most `conflictRepairAttempts` allows. */
+interface RepairAttempt {
+    n: number;
+    limit: number;
+}
+/** One thing the user is told about a landing. */
+interface LandingMessage {
+    level: 'info' | 'warn' | 'error';
+    text: string;
+    /** Also handed to a surface that shows no toasts: ADR-0015 logs every conflict repair as a notice. */
+    repairLog?: true;
+}
+/**
+ * How a landing settled, for the orchestrator to apply — it marks the task,
+ * starts the repair and says the messages. By the time one is returned the
+ * merge has happened or not, and the run record says so.
+ *
+ * - `landed`: the work is on the integration branch of every repo it changed.
+ * - `nothing-to-land`: the attempt ran in the workspace root, or the task
+ *   holds no unlanded work; it is done as it stands.
+ * - `repair-needed`: the landing conflicted and the task is owed `repair`
+ *   (ADR-0015), in the worktree kept for it.
+ * - `awaiting_user`: the work did not land and waits on the user, worktree
+ *   kept — a conflict with no repair left (`conflict`), a merge git refused
+ *   (`landing-failed`), or a repair that did not land (`repair-failed`). None
+ *   of them halts the run.
+ */
+type LandingOutcome = {
+    kind: 'landed';
+    messages: LandingMessage[];
+} | {
+    kind: 'nothing-to-land';
+    messages: LandingMessage[];
+} | {
+    kind: 'repair-needed';
+    repair: RepairAttempt;
+    messages: LandingMessage[];
+} | {
+    kind: 'awaiting_user';
+    reason: 'conflict' | 'landing-failed' | 'repair-failed';
+    messages: LandingMessage[];
+};
+interface LandingDeps {
+    runs: IsolationRunController;
+    config: Pick<IConfig, 'conflictRepairAttempts'>;
+    /** Read-only: only the orchestrator changes a task. */
+    tasks: Pick<PlanStore, 'get'>;
+}
+/**
+ * Landing and Conflict repair (ADR-0013, ADR-0014, ADR-0015): a passed
+ * attempt's work onto the run's integration branches through the
+ * {@link IsolationRunController}, and what a landing that did not go through
+ * leads to. It answers with a {@link LandingOutcome} rather than acting on it —
+ * it never marks a task, starts an attempt or emits — so the scheduler stays
+ * the one place that decides what runs. A repair is spent when it starts: the
+ * controller's `reopen` counts it before the runner spawns, and nothing here
+ * hands one back.
+ */
+declare class Landing {
+    private readonly runs;
+    private readonly config;
+    private readonly tasks;
+    constructor(deps: LandingDeps);
+    /**
+     * Land a passed attempt's work. One whose worktree has no unlanded record
+     * behind it any more — the run was discarded under it — cannot land.
+     */
+    landPassed(task: Task, attempt: {
+        worktree: boolean;
+    }): Promise<LandingOutcome>;
+    /** Mark complete is a passed verdict the user vouches for: what the task holds unlanded lands the same way. */
+    landVouched(task: Task): Promise<LandingOutcome>;
+    /**
+     * A repair's verdict decides only whether its work may try to land; the
+     * task keeps the verdict its own work earned. Evidence comes before the
+     * queue, and the landing after it is the one every task goes through, so a
+     * repair the tip has moved past again is a fresh conflict, not a pass.
+     */
+    settleRepair(task: Task, verdict: Verdict): Promise<LandingOutcome>;
+    /** A repair that ended without landing leaves the task as its conflict did: waiting on the user, worktree and refs kept. */
+    unrepaired(task: Task, why: string): Promise<Extract<LandingOutcome, {
+        kind: 'awaiting_user';
+    }>>;
+    /**
+     * Land the conflicted task a resolver was added for, now that the resolver
+     * has landed. Its branch is on the integration branch by then, so it merges
+     * clean — and one the resolver did not really bring along conflicts again
+     * instead of being taken at its word. Null when there is nothing to land.
+     */
+    landResolved(resolverId: string): Promise<{
+        task: Readonly<Task>;
+        outcome: LandingOutcome;
+    } | null>;
+    /** The repair a conflicted task is owed next; null when repair is off, used up, or there is no isolated run to repair it in. */
+    nextRepair(taskId: string): RepairAttempt | null;
+    /** What a repair is asked to do; read once `reopen` has recorded the tips it must bring in. */
+    repairPrompt(task: Task): string;
+    private hasUnlandedWork;
+    private unmerged;
+    private noRepairReason;
+    private describeEvidence;
+    private isGroup;
 }
 
 /**
@@ -1833,6 +1760,15 @@ interface WorkspaceEnv {
 interface OrchestratorObserver {
     /** Any task-shaped state changed (store mutation, checkpoint, retry, …). */
     onTaskChanged?(): void;
+    /**
+     * A run reached an outcome that stands until the user acts — completed,
+     * failed, or awaiting the user — on its own, not as the answer to a call.
+     * Emitted before the `onTaskChanged` that announces it, so a listener can
+     * save the outcome before any surface is told.
+     */
+    onTaskSettled?(data: {
+        taskId: string;
+    }): void;
     onTick?(): void;
     onExecutionComplete?(): void;
     /** Queued user messages are ready to be processed by the planner. */
@@ -1868,6 +1804,14 @@ interface OrchestratorObserver {
         message: string;
     }): void;
 }
+/**
+ * A message or interrupt a task cannot take: it is not running, it runs on the
+ * terminal transport, or it is waiting on something a message does not answer.
+ * The request is wrong, not the orchestrator, so a surface says why.
+ */
+declare class TaskControlError extends Error {
+    constructor(message: string);
+}
 type AttemptPhase = 'starting' | 'running' | 'integrating';
 /** Read-only view of a task's live attempt. */
 interface TaskAttemptSnapshot {
@@ -1879,6 +1823,50 @@ interface TaskAttemptSnapshot {
     cwd: string | null;
     startedAt: string;
 }
+/**
+ * The wiring a {@link TaskOrchestrator} runs on, every collaborator resolved.
+ * {@link createTaskOrchestrator} is the only production caller; tests build one
+ * through that factory too. The constructor makes nothing itself, so there is
+ * exactly one place defaults live.
+ */
+interface TaskOrchestratorDeps {
+    config: IConfig;
+    notifications: INotification;
+    terminalRunner: ITerminalRunner;
+    store: PlanStore;
+    output: TaskOutputSource;
+    /** The plan's isolation run and the open run's lifecycle (ADR-0013). */
+    runs: IsolationRunController;
+    /** A passed attempt's work onto the integration branch, and any conflict repair. */
+    landing: Landing;
+    registry: RunnerRegistry | null;
+    /** The workspace root, read at call time — VS Code can change it. */
+    workspaceRoot: () => string;
+    /** The workspace's own variables for a task's cwd (ADR-0016). */
+    workspaceEnv: (cwd: string) => Promise<WorkspaceEnv>;
+    /** Read live at each spawn, so a toggle takes effect on the next task. */
+    tddEnabled: () => boolean;
+    /** Read once as a run opens, never per spawn (ADR-0018, S1). */
+    runnerTransport: () => RunnerTransport;
+}
+/**
+ * What a caller supplies to {@link createTaskOrchestrator}; every optional one
+ * gets its default there. This is what a host or test chooses, not the resolved
+ * wiring the orchestrator itself runs on.
+ */
+interface TaskOrchestratorOptions {
+    config: IConfig;
+    notifications: INotification;
+    terminalRunner: ITerminalRunner;
+    store?: PlanStore;
+    output?: TaskOutputSource;
+    isolation?: IWorktreeIsolation;
+    registry?: RunnerRegistry | null;
+    workspaceRoot?: () => string;
+    workspaceEnv?: (cwd: string) => Promise<WorkspaceEnv>;
+    tddEnabled?: () => boolean;
+    runnerTransport?: () => RunnerTransport;
+}
 /**
  * The pure scheduler. Owns execution state (`running`, `planStatus`,
  * `reviewApproved`, the live task attempts, `messageQueue`) and the verifier.
@@ -1893,25 +1881,17 @@ declare class TaskOrchestrator {
     private config;
     private notifications;
     private terminalRunner;
-    private output;
     private store;
+    private output;
     private attempts;
     private verifier;
     private running;
     private planStatus;
     private messageQueue;
-    private queueSeq;
     private reviewApproved;
     private retryCounts;
     private spawnCounts;
-    /**
-     * The terminal a verdict left open, by task. It stays so the user can read
-     * the agent's output or keep talking to it — but only while its worktree
-     * does: once that is removed the agent sits in a deleted directory, and a
-     * newer attempt in the same worktree would share it with a second agent.
-     * Without this, every task of every run left one agent process running
-     * until the daemon stopped.
-     */
+    /** The terminal a verdict left open, by task; see {@link LingeringRunners}. */
     private lingering;
     /**
      * A full-plan run a failure paused. Retrying the failed task is the explicit
@@ -1930,53 +1910,69 @@ declare class TaskOrchestrator {
      * task whose spawn always throws.
      */
     private onHold;
-    private isolation;
-    /** The plan's isolation run (ADR-0013). Outlives one run: a resumed plan continues it. */
-    private isolationRun;
-    /** Copied paths already reported for the current run: every task gets the same copies. */
-    private reportedCopies;
-    /**
-     * How the open run executes; null while no run is open. A run is one
-     * Execute-Plan or one manual task run, from its start until it settles or
-     * is stopped.
-     */
-    private runMode;
-    /** Resolver task id → the conflicted task it resolves; see {@link linkConflictResolver}. */
-    private resolvers;
-    private opening;
-    /** The start a dirty tree turned away, replayed once the user chooses how to go on. */
-    private blockedStart;
-    /** The dirty repos behind {@link blockedStart}, for the stash notice. */
-    private blockedRepos;
+    /** The plan's isolation run and the open run's lifecycle (ADR-0013); see {@link IsolationRunController}. */
+    private runs;
+    /** A passed attempt's work onto the integration branch, and the conflict repair a landing may need. */
+    private landing;
     private registry;
     private workspaceRootFn;
     private observers;
     private tddEnabled;
-    constructor(config: IConfig, notifications: INotification, terminalRunner: ITerminalRunner, store?: PlanStore, output?: TaskOutputSource, isolation?: IWorktreeIsolation);
+    private readRunnerTransport;
+    /**
+     * The setting as the latest run copied it when it opened. Every spawn of
+     * that run uses this, so flipping the setting mid-run changes the next run
+     * only — the plan, not a live setting, says what runs (ADR-0001).
+     */
+    private planTransport;
+    constructor(deps: TaskOrchestratorDeps);
+    /**
+     * The composition root: resolves every optional collaborator and wires the
+     * isolation listener that the constructor cannot, because it needs the
+     * instance's own (private) emit and lingering seams. Nothing else in the
+     * codebase constructs an orchestrator, so this is the one place defaults
+     * live — a host or test supplies what it cares about and gets the rest.
+     */
+    static compose(options: TaskOrchestratorOptions): TaskOrchestrator;
     /** Advisory silence timestamp for a task's live runner, or null if not idle. */
     getIdleSince(taskId: string): string | null;
     /** Recent clean output of a task's latest attempt, running or ended; null if it never ran. */
     getLiveOutput(taskId: string, opts: LiveTailOptions): LiveTail | null;
     get storeInstance(): PlanStore;
-    setWorkspaceRoot(fn: () => string): void;
-    setWorkspaceEnvResolver(resolve: (cwd: string) => Promise<WorkspaceEnv>): void;
     /**
      * The variables a task's agent gets from its workspace. What cannot be
      * applied is said once — silently starting without them is how agents ran
      * under the wrong account when an edited `.envrc` was left unallowed.
      */
     private envForTask;
-    setRegistry(registry: RunnerRegistry): void;
-    /**
-     * A getter rather than a value where the caller has one: every task gets its
-     * prompt composed at spawn time, but only a full-plan run passes through a
-     * point where a snapshot could be refreshed — so "Run task", force-start and
-     * retry would compose against whatever the last run happened to set.
-     */
-    setTddEnabled(enabled: boolean | (() => boolean)): void;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason?: string): void;
+    private atCheckpoint;
+    /**
+     * Send a structured task a user message (ADR-0018, M1). Mid-turn it queues
+     * behind the turn; a task waiting for input takes it at once and is back in
+     * progress. Returns the message's id, for {@link removeQueuedTaskMessage}.
+     */
+    sendTaskMessage(taskId: string, text: string): string;
+    /** Take back a message still queued behind a turn; false once it was delivered. */
+    removeQueuedTaskMessage(taskId: string, id: string): boolean;
+    /** Stop a structured task's running turn; it then waits for input like any turn that ends without its marker. */
+    interruptTask(taskId: string): Promise<void>;
+    /** What is waiting for a structured task's turn to end; empty for any other task. */
+    getQueuedTaskMessages(taskId: string): QueuedTaskMessage[];
+    private structuredSession;
+    /**
+     * A structured turn that ended without the done marker (ADR-0018, W1). No
+     * verdict is guessed: the task waits for input, unless a checkpoint in the
+     * same turn already has it waiting, or a queued message went straight out —
+     * the session never passes through idle then, so nothing flickers.
+     */
+    private onTurnEnd;
     subscribe(observer: OrchestratorObserver): () => void;
+    /**
+     * Isolated per observer: one that throws must not take down the scheduler
+     * or stop the remaining observers from hearing the event.
+     */
     private emit;
     get isRunning(): boolean;
     /**
@@ -2005,35 +2001,24 @@ declare class TaskOrchestrator {
     get awaitingIsolationChoice(): boolean;
     /**
      * Take over a plan's persisted isolation, or none for a plan that has not
-     * isolated yet. Whatever a crashed process left behind for the run — a
-     * worktree still marked active, a directory no record owns — is pruned,
-     * while kept, failed and conflicted worktrees stay for the user.
-     *
-     * Deliberately silent on the observer: adopting is not a change to persist,
-     * and a host that adopts without persisting (VS Code's restore) would
-     * otherwise write a new session file on every reload.
+     * isolated yet, pruning what a crashed process left behind. Silent on the
+     * observer: adopting is not a change to persist.
      */
     adoptIsolation(state: PlanIsolation | null): Promise<void>;
     reviewRunDiff(): Promise<string>;
-    /**
-     * "Merge all": the run's integration branches into whatever the user has
-     * checked out, in every repo or none. Once everything merged, the run has
-     * nothing left to hand over, so it is cleared up and forgotten; a branch
-     * the user's HEAD somehow does not contain stays for the next run's sweep.
-     */
+    /** "Merge all"; a run that merged everything is cleared up and forgotten. */
     mergeRun(): Promise<IsolationMergeResult>;
-    private clearMergedRun;
     /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
     cleanupRun(): Promise<void>;
     /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
     discardRun(): Promise<void>;
     private watchBlockingPrompts;
-    private closeLingering;
-    private closeLingeringOf;
-    private forgetRun;
-    private requireRun;
     /** What the plan persists of isolated execution; null when no run ever isolated. */
     get isolationRecord(): PlanIsolation | null;
+    /** The transport the plan's latest run copied from the setting; null before its first run. */
+    get runnerTransport(): RunnerTransport | null;
+    /** Take over a saved plan's copied transport. The next run copies the setting afresh. */
+    adoptRunnerTransport(transport: RunnerTransport | null): void;
     queueMessage(text: string): void;
     getQueuedMessages(): QueuedMessage[];
     /** Take one unsent message back out of the queue; false when it was never there (or already drained). */
@@ -2041,7 +2026,7 @@ declare class TaskOrchestrator {
     setQueuedMessages(messages: QueuedMessage[]): void;
     clearQueuedMessages(): void;
     processNextQueuedMessage(): QueuedMessage | null;
-    loadPlan(tasks: Task[], planRunners?: RunnerId[]): void;
+    loadPlan(tasks: readonly Task[], planRunners?: RunnerId[]): void;
     /**
      * Adopt an edited plan without letting go of the run in progress. Everything
      * the scheduler owns — live sessions, holds, retry counts, the verifier and
@@ -2059,42 +2044,29 @@ declare class TaskOrchestrator {
     stop(): void;
     onUserTaskComplete(taskId: string): Promise<void>;
     private onVerdict;
-    /** Whether a stopped runner's own tail says its account, not the task, ran out. */
-    private stoppedOnUsageLimit;
     private afterVerdict;
     /**
-     * A repair's verdict decides only whether its work may try to land. It never
-     * replaces the verdict the task's own work earned, and a repair that does not
-     * land leaves the task waiting on the user — never a failed task, so never a
-     * halted run.
+     * A repair's verdict never replaces the verdict the task's own work earned,
+     * and a repair that does not land leaves the task waiting on the user —
+     * never a failed task, so never a halted run.
      */
     private settleRepair;
     /**
-     * Evidence before the queue: the repair's work is committed and checked, and
-     * only then merged, through the same serialized landing as any other task —
-     * so a repair the tip has moved past again is a fresh conflict, not a pass.
+     * Hand an attempt's verdict to Landing. The attempt stays live while that
+     * settles — it may wait on the module's merge queue — so a cancel, retry or
+     * stop in that window still wins, and waits for the merge before tearing the
+     * worktree down; nothing counts the task as done before its work is on the
+     * integration branch.
      */
-    private landRepair;
-    private landedRepair;
-    /** A repair that did not land leaves the task as its conflict did: waiting on the user, worktree and refs kept. */
-    private unrepaired;
-    private describeEvidence;
+    private land;
+    /** Settle a task by how its landing went; `onLanded` is what the path that landed it adds to completing it. */
+    private applyLanding;
     /**
-     * Merge a passed attempt's worktree. The attempt stays live while it waits on
-     * the module's merge queue, so a cancel, retry or stop in that window still
-     * wins, and nothing counts the task as done before its work is on the
-     * integration branch.
+     * Work that did not land waits on the user — it never fails the task or
+     * halts the run — unless its conflict is owed a repair, which takes the slot
+     * the ending attempt freed and never one more than the run allows.
      */
-    private integrate;
-    /** A worktree whose work is not on the integration branch yet. */
-    private hasUnlandedWork;
-    private integrateWork;
-    /** Settle a task whose work passed, by what its integration reported. */
-    private landPassed;
-    private landUnmerged;
-    /** The repair a conflicted task is owed next; null when repair is off, used up, or there is no isolated run to repair it in. */
-    private nextRepair;
-    private noRepairReason;
+    private settleUnlanded;
     /**
      * Mark which added task resolves which conflict. The resolver merges the
      * conflicted task's branch by hand in its own worktree; once that lands, the
@@ -2104,21 +2076,7 @@ declare class TaskOrchestrator {
      */
     linkConflictResolver(resolverId: string, conflictedId: string): void;
     private landResolved;
-    /**
-     * Let go of a task's worktree. `keep` leaves it and its branch for
-     * inspection; otherwise both go. A merge still in flight finishes first, so
-     * the worktree is never torn down underneath it.
-     */
-    private releaseWorktree;
     getReadyTasks(): Task[];
-    /**
-     * In an isolated run a dependency is met once its work is on the integration
-     * branch, not merely once it passed: the dependent's worktree is cut from
-     * that branch, so starting earlier would hand it a tree without the work it
-     * depends on.
-     */
-    private dependencyMet;
-    isBlocked(task: Task): boolean;
     /**
      * Cancel a running (or scheduled) task: kill its session and return it to
      * 'pending' — "not executed". The task is put on hold so the scheduler
@@ -2151,6 +2109,15 @@ declare class TaskOrchestrator {
     markTaskIncomplete(taskId: string): Promise<void>;
     private logAndArchive;
     retryTask(taskId: string): Promise<void>;
+    /**
+     * Continue a finished structured task in its saved runner session (ADR-0018,
+     * K1): a retry whose first turn is the user's message, sent to the session
+     * the task ended in rather than a fresh one given its prompt again. Like a
+     * retry it is a new attempt in a fresh worktree from the integration tip —
+     * the same path, which is where the runner keeps its sessions — verified and
+     * landed like any other, and dependents are left alone.
+     */
+    continueTask(taskId: string, message: string): Promise<void>;
     /**
      * Manually start a single AI task right now, bypassing dependency/readiness
      * gating (the "force start" affordance on a task card). Reuses the scheduler's
@@ -2183,55 +2150,37 @@ declare class TaskOrchestrator {
     tick(): Promise<void>;
     private startTask;
     /**
-     * A spawn whose attempt ended while it was in flight: kill what it produced
-     * and take back the claim it made. Only the claim — whatever ended the
-     * attempt may have decided the task since (mark complete, cancel, retry).
+     * The fallible half of starting a task: resolving its cwd/worktree and
+     * spawning the runner. Resolves false when the attempt never committed —
+     * abandoned because it was ended from under it, or a failed spawn already
+     * unwound (both leave `startTask` with nothing further to announce).
      */
-    private abandonSpawn;
-    private repairPrompt;
+    private spawnAttempt;
     /**
-     * The one place an attempt's working directory is decided. Async so a
-     * per-attempt workspace (worktree isolation, #12) can be prepared here.
-     */
-    private resolveAttemptCwd;
-    private tell;
-    private reportCopies;
-    /**
-     * Open a run if none is: decide once, at its start, whether it executes in
-     * worktrees. `resume` is what a dirty tree parks until the user chooses how
-     * to go on. Resolves false when the run did not start.
+     * Say on the task how this attempt is driven, when its plan asked for the
+     * structured transport; a terminal plan's tasks record nothing. A structured
+     * request that came back a terminal session is a fallback, and says why —
+     * a host without a router included — never a silent downgrade.
      */
-    private openRun;
+    private recordTransport;
     /**
-     * Whether the run in force, or else the next one, gives each task its own
-     * worktrees, and of which repo group — what the planner is told, since it
-     * decides whether tasks on the same file have to be ordered and which shared
-     * paths two tasks must not edit at once. A tree that would block counts as
-     * not isolating: the user may yet run without isolation, and ordering is
-     * the safe rule then.
+     * A continue whose runner never announced the session it was told to
+     * resume. Nothing was continued, and nothing fresh was started in its place.
      */
-    plannerIsolation(): Promise<IsolatedExecution>;
-    private decideRun;
-    private activate;
-    /** What earlier runs left merged in the group goes; a failure here is worth a word, never a stopped run. */
-    private sweep;
+    private unresumed;
     /**
-     * The plan's run carries on while it still has any record: anything landed
-     * means a resumed plan's dependents must start from a tip that holds their
-     * predecessors' work, and anything held — a kept attempt, a conflict, a
-     * repair — is work the user may still want, which a fresh run's mint would
-     * delete. Only a run with no records at all is superseded.
+     * A spawn whose attempt ended while it was in flight: kill what it produced
+     * and take back the claim it made. Only the claim — whatever ended the
+     * attempt may have decided the task since (mark complete, cancel, retry).
      */
-    private continuableRun;
+    private abandonSpawn;
+    private tell;
+    private say;
     /**
-     * A run with no records at all holds only superseded attempts, so it goes
-     * whole. One that cannot be continued for another reason — it ran from a
-     * different workspace path — keeps its integration branch in each repo that
-     * has not merged it: only the user gives landed work up.
+     * Whether the run in force, or else the next one, gives each task its own
+     * worktrees, and of which repo group — what the planner is told.
      */
-    private mintRun;
-    /** Close the open run. An isolated one hands its integration branch over for review. */
-    private closeRun;
+    plannerIsolation(): Promise<IsolatedExecution>;
     /**
      * Replay the start a dirty tree turned away. `stash` puts the user's tracked
      * changes on the git stash first, so the run isolates; `shared` runs this one
@@ -2248,12 +2197,20 @@ declare class TaskOrchestrator {
      * stop(), and if that exit reaches VerdictEngine under the still-valid
      * generation it delivers a verdict that marks the task 'completed' for one
      * tick — long enough for the scheduler to start a dependent task. A verdict
-     * leaves the runner up so its terminal stays readable, and stop/load reset
-     * the whole verifier themselves.
+     * leaves a terminal runner up so its screen stays readable (a structured one
+     * ends), and stop/load reset the whole verifier themselves.
      */
     private endAttempt;
+    /** Kept on the task once the attempt ends, so a continue can resume it after a reload (ADR-0018, K1). */
+    private saveNativeSession;
     private endAllAttempts;
 }
+/**
+ * Build a {@link TaskOrchestrator}, filling in every collaborator a caller did
+ * not inject. The one entry point for hosts, bench harnesses and tests alike;
+ * {@link TaskOrchestrator} itself constructs nothing.
+ */
+declare function createTaskOrchestrator(options: TaskOrchestratorOptions): TaskOrchestrator;
 
 /**
  * Everything needed to produce a plan from a goal. Carries the planning context
@@ -2570,6 +2527,11 @@ interface EnvAdmission {
  */
 declare function admitSettingsEnv(env: Record<string, unknown>): EnvAdmission;
 
+/** Whether a runner's tasks can run on the structured transport. */
+declare function supportsTaskMode(runner: string): boolean;
+/** The adapter that drives one task. Throws {@link TaskModeUnsupportedError} for a runner without a connector. */
+declare function createTaskAdapter(runner: string, deps: AgentProcessDeps): TaskModeAgentAdapter;
+
 interface SpawnSpec {
     command: string;
     args: string[];
@@ -2615,12 +2577,16 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     private betweenTurns;
     /** Set once a turn has ended: after that, out-of-turn events are stale, not startup. */
     private hadTurn;
+    /** A task's session, which wants what the agent says on its own after a turn closed; a planner registers none and drops it. */
+    private outOfTurnListener;
     private disposed;
     /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
     protected processEnded: Promise<void>;
     /** The environment the agent was spawned under, for any side process a handshake needs. */
     protected spawnEnv: NodeJS.ProcessEnv;
     private markEnded;
+    /** What this process is to the user — a planner or a task's runner — for the words a failure is reported in. */
+    protected role: 'planner' | 'task';
     constructor(deps: AgentProcessDeps);
     /** The command line that starts this agent in its read-only mode. */
     protected abstract spawnSpec(opts: AgentStartOptions): SpawnSpec;
@@ -2635,7 +2601,9 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     protected handshake(_opts: AgentStartOptions): Promise<void>;
     start(opts: AgentStartOptions): Promise<void>;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
+    onOutOfTurn(listener: (event: AgentEvent) => void): void;
     nativeSessionId(): string | null;
+    onProcessExit(listener: (code: number) => void): void;
     dispose(): void;
     /** Write one raw protocol line to the agent. */
     protected writeLine(payload: unknown): void;
@@ -2655,8 +2623,15 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
  * same way. It is the richest of the three streams — partial messages and
  * separate thinking blocks — which is why this agent went first.
  */
-declare class ClaudeCodeAdapter extends StdioAgentAdapter {
+declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAgentAdapter {
     readonly agentId = "claude-code";
+    private interruptCount;
+    /** Interrupts sent and not yet acknowledged, by request id. */
+    private readonly pendingControl;
+    /** An interrupt was sent during the current turn, so an aborted result is that interrupt, not a failure. */
+    private interruptRequested;
+    /** A task's tool requests still waiting for an answer, by request id, with what the answer echoes back. */
+    private readonly openPermissions;
     /** Whether this turn has already emitted reply text — see {@link handleLine}. */
     private turnHasText;
     /** The text block streaming now follows earlier reply text, so its first delta opens the paragraph. */
@@ -2676,9 +2651,63 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter {
     private readonly openSubagents;
     /** Subagent messages already counted. A message arrives as one line per content block, each repeating its usage. */
     private readonly countedSubagentMessages;
+    /** Background tasks (shells, agents) the CLI reports as still running, as of its last `background_tasks_changed`. */
+    private backgroundTaskCount;
+    /**
+     * A task's turn whose `result` arrived while background work was still open.
+     * The CLI reports that result when the model stops talking, then opens a turn
+     * of its own when the work finishes; a turn ended at the first result would
+     * lose everything said after it, the completion marker included.
+     */
+    private resultHeld;
+    private followOnTimer;
+    /** The mode a task asked for, to hold the CLI to it once its `init` says what it started in. */
+    private requestedMode;
+    /** The session `--resume` asked for, until the CLI's `init` shows it was taken up. */
+    private pendingResume;
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
+    /**
+     * A task's run: the manifest decides what its mode and effort mean
+     * (ADR-0001), and this adds only the protocol around them. No tool list and
+     * no system prompt — the task's prompt is its first turn, as on the terminal
+     * transport. `--permission-prompt-tool stdio` routes the questions the mode
+     * leaves open to the control channel, where the adapter must answer them;
+     * without it `-p` refuses them silently and nothing can ever surface one.
+     */
+    private taskSpawnSpec;
+    /**
+     * Claude Code's soft interrupt: the turn stops, the process and its session
+     * stay. The CLI acknowledges on the control channel, then closes the turn
+     * with an `error_during_execution` result, which {@link handleLine} reports
+     * as an interrupted `turn_end`.
+     */
+    interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * A `--resume` the CLI cannot find is answered at once with an error result
+     * and no `init`, after which it waits on stdin for input it never reads — a
+     * turn sent to it would hang. Closing stdin lets it exit. The id it echoes is
+     * not recorded: no session was taken up, and a continue must not offer it again.
+     */
+    private refuseResume;
+    /**
+     * The answer to an open tool request, in the shape the CLI validates: an
+     * allow echoes the call's own input (an absent one is warned about and
+     * replaced), and "for this task" hands back Claude's own suggestions — never
+     * a grant of Ordewell's making.
+     */
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
+    dispose(): void;
+    private clearFollowOnTimer;
     protected turnPayload(message: string): string;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
+    /**
+     * `--permission-mode auto` on a model or account without auto mode is not
+     * refused: the CLI says nothing and starts in `default`, then asks about every
+     * write — a request nobody is there to answer. The plan, not the CLI, decides
+     * the mode (ADR-0001), so a different one fails the turn rather than running.
+     */
+    private refuseOtherMode;
+    private awaitFollowOnTurn;
     private startSubagent;
     /**
      * A subagent's messages do not stream, so each line's usage is the snapshot
@@ -2711,8 +2740,10 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter {
 }
 
 /**
- * Codex as a planner, over its `app-server` stdio JSON-RPC transport
- * (ADR-0009).
+ * Codex as a planner (ADR-0009) and as a task's runner (ADR-0018, #54), over
+ * its `app-server` stdio JSON-RPC transport. The start switch decides the
+ * thread's settings and who answers its requests; everything a turn reports
+ * is read the same way for both.
  *
  * Ordewell already speaks a slice of this protocol — `ModelDiscovery` drives
  * `initialize` → `model/list` to build the Codex model catalog — so the
@@ -2724,7 +2755,7 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter {
  * version that renames them will surface as a visible dead turn rather than a
  * hang, because the base class watches the process as well as the protocol.
  */
-declare class CodexAdapter extends StdioAgentAdapter {
+declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAdapter {
     readonly agentId = "codex";
     private threadId;
     /** The model Codex opened the thread with — usage records name it. */
@@ -2735,6 +2766,28 @@ declare class CodexAdapter extends StdioAgentAdapter {
     private startOpts;
     /** Whether this turn has already emitted prose — see the `agentMessage` case. */
     private turnHasText;
+    /**
+     * The turn in flight. Its id arrives with `turn/started` or the `turn/start`
+     * response, whichever lands first; `turn/interrupt` cannot be sent without it.
+     */
+    private turn;
+    /** The JSON-RPC id of the `turn/start` that opened {@link turn}. */
+    private turnRequestId;
+    /** The last turn this adapter ended — so its second end signal, landing late, ends nothing. */
+    private endedTurnId;
+    /** An interrupt was asked for during this turn, so however it ends, it was cut short. */
+    private interruptRequested;
+    /** An interrupt asked for before Codex named the turn, sent once it does. */
+    private interruptOnStart;
+    /** A task's approval requests still waiting for an answer, by the request id as a string. */
+    private readonly openPermissions;
+    /**
+     * The files each in-flight `fileChange` item touches. Its approval request
+     * names only the item, and a person deciding needs to see the files.
+     */
+    private readonly fileChangePaths;
+    /** Requests this adapter sent and awaits an answer to, by JSON-RPC id. */
+    private readonly pendingRequests;
     private resumeAttempted;
     private resumeFallbackSent;
     private sandbox;
@@ -2746,22 +2799,41 @@ declare class CodexAdapter extends StdioAgentAdapter {
     private readonly subagents;
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
     /**
-     * `initialize`, then `thread/start`, both before the first user message. The
-     * thread is pinned to the read-only sandbox with approvals set to `never` —
-     * with nobody watching a planner's prompts, "ask" would mean "hang", which is
-     * ADR-0008's absent-is-denial invariant kept by construction.
+     * `initialize`, then `thread/start`, both before the first user message. A
+     * planner's thread is pinned to the read-only sandbox with approvals set to
+     * `never` — with nobody watching a planner's prompts, "ask" would mean
+     * "hang", which is ADR-0008's absent-is-denial invariant kept by
+     * construction. A task's runs as its mode says (see {@link threadParams}).
      */
     protected handshake(opts: AgentStartOptions): Promise<void>;
     /**
-     * Open the thread this session plans in. A resume id means the previous
+     * Open this session's thread. A resume id means the previous
      * process died mid-session: `thread/resume` puts the agent back in front of
-     * the context it already paid to read. A failed resume is not an error — the
-     * response handler falls back to a fresh thread, which is the same
-     * degradation `restoreChat` performs on every surface (T4).
+     * the context it already paid to read. A planner's failed resume is not an
+     * error — the response handler falls back to a fresh thread, which is the
+     * same degradation `restoreChat` performs on every surface (T4). A task's
+     * is: Continue (K1) offers the session that did the work, and a fresh thread
+     * in its place would pretend it was resumed.
      */
     private startThread;
+    private threadParams;
+    private effort;
+    /**
+     * `turn/interrupt` names the turn as well as the thread, so an interrupt
+     * asked for before Codex has named the turn waits for it. Codex acknowledges
+     * with an empty result, then ends the turn as `interrupted`.
+     */
+    interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * Answer an open approval in its own result schema. Codex's decline carries
+     * no message, so a deny note reaches the agent as input steered into the
+     * running turn.
+     */
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
     protected turnPayload(message: string): string;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
+    private turnStarted;
+    private closeTurn;
     /**
      * The child thread id when `threadId` names a subagent's thread, or undefined
      * for the planner's own. Codex replays both threads on one stream and only
@@ -2782,6 +2854,14 @@ declare class CodexAdapter extends StdioAgentAdapter {
      * not added a second time. Codex reports no price.
      */
     private emitUsage;
+    /**
+     * A task's server→client request. An approval stays open for someone to
+     * answer (ADR-0018, A1); everything else is answered at once, because an
+     * unanswered request stalls the turn forever.
+     */
+    private openTaskRequest;
+    /** The request as a person sees it, led by the field that says what it is about. */
+    private approvalInput;
     /**
      * Refuse one server→client request. Requests whose result schema can express
      * a refusal get that payload; everything else — a permission grant, a
@@ -2807,7 +2887,8 @@ declare class CodexAdapter extends StdioAgentAdapter {
 }
 
 /**
- * OpenCode as a planner, over its headless HTTP server (ADR-0009).
+ * OpenCode as a planner or a task runner, over its headless HTTP server
+ * (ADR-0009, ADR-0018).
  *
  * The odd one out: `opencode serve` is a real server rather than a stdio
  * protocol, so this adapter owns both halves of the boundary — it spawns the
@@ -2815,30 +2896,80 @@ declare class CodexAdapter extends StdioAgentAdapter {
  * talks to it through the injected `fetch`. Both are part of the one seam the
  * tests drive.
  *
- * The turn ends when the message POST resolves, and its response is the
+ * A planner turn ends when the message POST resolves, and its response is the
  * authoritative copy of the reply's last message. Everything else — reply text
  * as it streams, earlier model calls' text and reasoning, per-call usage, the
  * subagents a `task` call runs — arrives only on the server's `/event` channel.
  * An event name that changes between OpenCode versions therefore costs that
- * detail, never the final reply.
+ * detail, never the final reply. A task turn is posted asynchronously and read
+ * entirely from the stream — see {@link sendTask}.
  */
-declare class OpenCodeAdapter implements AgentAdapter {
+declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     private deps;
     readonly agentId = "opencode";
     private process;
     private baseUrl;
+    /** Sent on every request to a task's server, which a per-task password secures. */
+    private authorization;
     private sessionId;
     private stderrTail;
     private exited;
+    private exitCode;
     private disposed;
-    private opts;
+    private markEnded;
+    private readonly processEnded;
+    private planner;
+    private task;
     /** Whether this turn has already emitted reply text — see {@link emitPart}. */
     private turnHasText;
     /** The last assistant message already settled — the baseline {@link recoverReply} measures a new reply against. */
     private lastAssistantId;
+    private taskTurn;
+    /** An abort was posted during the current task turn, so the idle that follows ends it as interrupted. */
+    private interruptRequested;
+    /** A task's requests waiting for an answer, by request id, with the session that asked. */
+    private readonly openPermissions;
     constructor(deps: AgentProcessDeps);
     start(opts: AgentStartOptions): Promise<void>;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
+    /**
+     * One task turn. `prompt_async` only queues the work, so the turn is over
+     * when the session goes idle — OpenCode's own `run` rules: an idle frame
+     * counts once `/session/status` confirms it, because a late idle can belong
+     * to the turn before, and {@link pollStatus} stands behind the stream,
+     * which can miss a status frame. No request is held open for the turn, so
+     * fetch's 300s header timeout, the planner's reason for
+     * {@link recoverReply}, never applies.
+     */
+    private sendTask;
+    /**
+     * Whatever of the turn's own messages the stream missed. Each part is
+     * emitted once, so a turn the stream saw whole adds nothing here; one that
+     * lost its last text part still reaches the plain-text channel, where the
+     * done marker is looked for.
+     */
+    private readBack;
+    /**
+     * The stream can drop a status frame while still delivering the rest, so a
+     * task turn also reads the status itself. A busy session is this turn's own
+     * work as surely as a frame is.
+     */
+    private pollStatus;
+    /** An idle frame ends the turn only if the server agrees now. When it will not say, the frame is trusted, as upstream trusts it. */
+    private confirmIdle;
+    /** Whether the task's session is working, or null when the server will not say. A session absent from the map is idle. */
+    private sessionBusy;
+    /** What a frame of the task's own session says about the turn's end. */
+    private followTaskTurn;
+    /**
+     * Abort the running turn, keeping the server and its session. OpenCode
+     * acknowledges by going idle, which is also what ends the turn — as
+     * interrupted, because the request is remembered.
+     */
+    interrupt(timeoutMs: number): Promise<boolean>;
+    onProcessExit(listener: (code: number) => void): void;
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
+    private role;
     /**
      * Turn one settled assistant message into events. The settled response is
      * authoritative: it names the assistant message, so its parts are the ones
@@ -2907,6 +3038,27 @@ declare class OpenCodeAdapter implements AgentAdapter {
      * shows the planner reaching for something it may not have.
      */
     private denyPermission;
+    /**
+     * A task's request. Under a mode whose manifest sets `approvals: auto` —
+     * `build`, which the terminal transport runs with `--auto` — it is answered
+     * at once with what `run --auto` answers, so the same plan behaves the same
+     * on both transports (ADR-0001), and announced already decided so the log
+     * still shows it. Any other mode leaves it open for an approval card.
+     */
+    private askPermission;
+    /**
+     * `POST /permission/:id/reply` is the current answer. The per-session path
+     * it replaced is tried only when a server too old to know the new one 404s.
+     */
+    private replyPermission;
+    /**
+     * Open `/event` for one turn and wait until it is connected. The stream
+     * stopped being best-effort the moment permission answers moved onto it: a
+     * request raised before we connect is one nobody answers, and the turn
+     * hangs on it. Waiting is bounded so a server that never opens `/event`
+     * still gets its turn.
+     */
+    private openStream;
     /**
      * Server-sent events from `/event`: the turn's live text, reasoning, tool
      * activity and usage, and the only channel permission requests arrive on —
@@ -2914,6 +3066,8 @@ declare class OpenCodeAdapter implements AgentAdapter {
      */
     private streamEvents;
     private json;
+    private request;
+    private headers;
     nativeSessionId(): string | null;
     dispose(): void;
     private exitMessage;
@@ -2937,6 +3091,52 @@ declare function mapAgentTool(name: string): MappedTool;
  */
 declare function normalizeAgentArgs(tool: ResearchToolType, args: Record<string, unknown>): Record<string, unknown>;
 
+/** The dialogue record a fork carries — what {@link PlannerConversation.clone} returns. */
+interface ForkedDialogue {
+    conversationHistory: ConversationMessage[];
+    researchLog: ResearchLogEntry[];
+}
+
+/** Everything (re)opening a conversation needs besides the dialogue itself. */
+type ConversationOpening = Omit<ConversationRequest, 'goal' | 'onProgress' | 'signal' | 'priorHistory' | 'initialMessage'>;
+/**
+ * What the conversation needs from the session that hosts it. The session keeps
+ * plan state, persistence and scheduling; the conversation reaches them only
+ * through here, so a fake host is enough to drive it.
+ */
+interface PlannerConversationHost {
+    /** The plan the transcript lives on (`conversationHistory`, `researchLog`). */
+    plan(): LegacyPlanState | null;
+    goal(): string;
+    aiService(): IAiService;
+    onProgress(progress: ResearchProgress): void;
+    /** Fresh discovery, allowlist-filtered the way the system prompt shows it. */
+    opening(runners: RunnerId[]): Promise<ConversationOpening>;
+    /** What the per-turn catalog block and every read draw from, as of now. */
+    catalog(): TaskQueryCatalog;
+    tasks(): readonly Task[];
+    /**
+     * The orchestrator's live capture for a task's latest attempt, backing the
+     * `output` field of a read. Injected the same way as the catalog so the
+     * conversation never reaches into execution state directly.
+     */
+    liveOutput: LiveOutputLookup;
+    hasLiveWork(): boolean;
+    /** The session's single mutation ritual: op → persist → notify (default: the plan). */
+    mutate(op: () => boolean, notify?: () => void): LegacyPlanState | null;
+    broadcast: SessionBroadcaster;
+    /** `turnId`: the planner turn whose commit this is, when one is. */
+    broadcastPlan(turnId?: string): void;
+    /** Validate a batch against live state. Pure — nothing is applied. */
+    validateOps(ops: TaskOp[]): ApplyTaskOpsResult;
+    /** Load planner-produced tasks: an edit keeps run state, a commit starts over. Returns how many landed. */
+    adoptTasks(tasks: readonly Task[], how: 'edit' | 'commit'): number;
+    capturePrd(text: string): void;
+    /** Park a structural edit until the next batch boundary. Returns the queue length. */
+    queueEdit(userMessage: string): number;
+    /** Wake a scheduler an applied edit may have unblocked. */
+    afterEdit(): Promise<void>;
+}
 /**
  * A conversation edit (rewind, fork) the conversation refused because the
  * request itself is wrong — no such message, nothing to fork. Transport-agnostic
@@ -2963,12 +3163,232 @@ interface RewindTarget {
     content: string;
     timestamp: string;
 }
+/** What a rewind forks from, and the message it lands just before. */
+interface RewoundDialogue {
+    dialogue: ForkedDialogue;
+    rewoundMessage: string;
+}
 /** What a compaction left behind. */
 interface ConversationCompaction {
     summary: string;
     /** Transcript entries kept verbatim after the summary entry. */
     keptMessages: number;
 }
+/** A point a failed turn returns the dialogue to. Opaque outside this module. */
+interface TranscriptSnapshot {
+    readonly plan: LegacyPlanState;
+    readonly history: ConversationMessage[] | undefined;
+    readonly researchLog: ResearchLogEntry[] | undefined;
+    readonly persisted: number;
+    readonly savedInBackground: number;
+}
+interface ReplyOptions {
+    signal?: AbortSignal;
+    /** The user's words before skill expansion — what a mid-run queue replays later. */
+    verbatim?: string;
+}
+/**
+ * The planner conversation (ADR-0002), end to end: the persisted dialogue
+ * record, the live model context behind it, and every turn from the user's
+ * message to a settled, persisted outcome.
+ *
+ * It is the only writer of `conversationHistory` and of the planner's
+ * `researchLog`. The writes land on the host's plan object — which is what the
+ * session persists and broadcasts — but only ever inside the host's mutation
+ * ritual or ahead of a turn that will either reach it or be rolled back.
+ *
+ * The live model context (a vendor service's message list, a harness planner's
+ * process and native session id) is disposable: {@link reset} drops it and the
+ * next turn is replayed from the transcript. That is what lets the transcript
+ * be replaced by a summary, or copied into a fork, without the model's memory
+ * drifting from it.
+ */
+declare class PlannerConversation {
+    private readonly host;
+    /** Bumped on every persist, so a rollback can tell whether its writes already reached disk. */
+    private persisted;
+    /** Saves an execution event made while a turn may be in flight; see {@link restore}. */
+    private savedInBackground;
+    private turnsInFlight;
+    private compacting;
+    private openTurnId;
+    constructor(host: PlannerConversationHost);
+    get transcript(): readonly ConversationMessage[];
+    /** Whether a user turn is between its transcript append and its settled outcome. */
+    get isTurnInFlight(): boolean;
+    /** The user turn being answered, for what the host raises during it — an approval the turn's research asks for. */
+    get currentTurnId(): string | undefined;
+    /** Whether the model still holds this conversation in memory. */
+    get isActive(): boolean;
+    append(role: ConversationMessage['role'], content: string, opts?: {
+        timestamp?: string;
+        kind?: ConversationMessage['kind'];
+    }): void;
+    /** Swap the whole transcript. The live context no longer matches it, so pair with {@link reset}. */
+    replace(messages: readonly ConversationMessage[]): void;
+    snapshot(): TranscriptSnapshot | null;
+    /**
+     * Put the dialogue back where {@link snapshot} found it — unless anything
+     * was persisted since, because then memory already matches disk and every
+     * surface, and undoing it would erase work the user has seen land. Also a
+     * no-op once a different plan has been adopted.
+     *
+     * A background save (a task settling mid-turn) wrote the turn's writes to
+     * disk without landing anything the user saw, so it does not stop the undo;
+     * the undo is saved in turn, or a reload would bring the writes back.
+     */
+    restore(snapshot: TranscriptSnapshot): boolean;
+    /**
+     * The host calls this after every persist. `background` is a save no call
+     * of the user's made — an execution event landing mid-turn.
+     */
+    markPersisted(opts?: {
+        background?: boolean;
+    }): void;
+    /**
+     * Drop the live model context. Idempotent; the harness backend holds an OS
+     * process here, so callers never gate it on {@link isActive}.
+     */
+    reset(): void;
+    /**
+     * The user messages a rewind may land before. The opening message is the
+     * goal: cutting it leaves a conversation about nothing, which is a new
+     * session, not a rewind. After a compaction the summary entry, always
+     * first, plays the goal's part: what it replaced is gone, so a rewind stops
+     * at it.
+     */
+    rewindTargets(): RewindTarget[];
+    /**
+     * Replace the transcript with a summary of it, keeping the last two
+     * exchanges as they were, and drop the live context so the next message
+     * replays from the shorter record.
+     *
+     * The summary is one hidden turn through whichever planner is configured —
+     * on the live context when it still matches, replayed from the transcript
+     * when not — so the compaction is the same for a vendor API and a harness
+     * agent. Whatever the turn emits besides the summary is discarded, ops
+     * included: it condenses the conversation, never the plan. Nothing is
+     * written until the summary is in hand, so a failed or stopped turn leaves
+     * the transcript exactly as it was.
+     */
+    compact(signal?: AbortSignal): Promise<ConversationCompaction>;
+    private summarize;
+    /**
+     * A copy of the dialogue record for a forked session to carry. Refused
+     * mid-turn: the copy would hold the user's message without the reply to it.
+     * The live context is not part of it — the fork replays from this record on
+     * its first turn, like any adopted session.
+     */
+    clone(): ForkedDialogue;
+    /**
+     * A copy of the dialogue as it stood just before the user message at
+     * `index` (a position from {@link rewindTargets}) — what a rewind forks
+     * from — plus that message's full text, for a surface to offer back. This
+     * conversation is not touched. The research trace is cut at the same point
+     * by time: its entries carry no link to the message that caused them.
+     */
+    cloneBefore(index: number): RewoundDialogue;
+    /**
+     * Queued mid-run edits applied between batches. The user's message is
+     * already in the transcript from when it was queued; this records that it
+     * finally took effect, so a replay does not read the plan as never changed.
+     * Call inside the host's mutation ritual.
+     */
+    recordQueuedEdits(messages: string[], taskCount: number): void;
+    /**
+     * Queued edits the between-batches drain could not apply. Recorded so the
+     * transcript does not go on promising a change that never landed. Call
+     * inside the host's mutation ritual.
+     */
+    recordQueuedEditsFailed(messages: string[], reason: string): void;
+    /** Open the conversation on a fresh plan: the goal is its first message. */
+    start(goal: string, opening: ConversationOpening, signal?: AbortSignal): Promise<LegacyPlanState>;
+    /**
+     * Every later user message, from the transcript append to a persisted
+     * outcome. A turn that throws before anything was persisted takes its own
+     * writes back out, so session memory never drifts from disk and the UI.
+     */
+    reply(message: string, options?: ReplyOptions): Promise<LegacyPlanState>;
+    private replyTurn;
+    /**
+     * Whether a settled structural edit reaches work a runner is executing. Only
+     * these are queued: a whole-plan commit replaces the plan and would reset the
+     * run, and a task-ops batch that names an in-progress task changes it under
+     * the runner. An add, or an edit to any other task, is reconciled into the
+     * plan in place while the running batch keeps going.
+     */
+    private editTouchesLiveWork;
+    private assertIdle;
+    private inTurn;
+    /**
+     * Bracket one user turn with its start and end, under an id minted here:
+     * the turn is where the stream a surface draws begins and ends, and only the
+     * conversation sees all of it — every backend call, read and retry.
+     */
+    private userTurn;
+    private requirePlan;
+    private recordUser;
+    private recordResearch;
+    /**
+     * Reopen the model context from the transcript — because the in-memory one
+     * is gone (session reload, extension restart), or because it is stale
+     * against the planner config now in effect. No LLM call happens for the
+     * replayed turns; the first call is the one the user's message opens.
+     */
+    private resume;
+    /**
+     * Answer every read the planner emits until it says something else.
+     *
+     * The channel is a text envelope rather than a registered tool because the
+     * protocol has to be identical on both planner backends (ADR-0009): Ordewell
+     * owns a tool loop only in the API case, and a harness planner running as a
+     * coding-agent subprocess can only be reached this way.
+     *
+     * Draining here — outside {@link repairLoop} — is what keeps reads free of
+     * the repair budget. A planner that looks a task up and *then* fumbles its
+     * ops JSON still gets its two corrective retries; charging it for the read
+     * would cost it the chance to fix the edit.
+     */
+    private drainTaskQueries;
+    /**
+     * Render one read out of live state. Never persisted to the transcript: the
+     * detail is context for the planner's next reply, and re-sending it on every
+     * later turn is exactly the cost this channel exists to avoid.
+     */
+    private taskQueryAnswer;
+    /**
+     * Drive a planner turn to a persisted, broadcast outcome. Task edits apply
+     * atomically; validation failures are fed back to the model for up to 2
+     * silent retries, then surfaced as a message with the plan untouched. The
+     * first turn and every later turn route through here — one path, not two.
+     */
+    private settle;
+    /** Validate + commit a task_ops turn atomically. Returns the errors on rejection (plan untouched). */
+    private applyTaskOps;
+    /** Commit a settled (non-task_ops) turn through the host's mutation ritual. */
+    private commit;
+    /**
+     * The catalog the planner may actually draw from — model ids and task-mode
+     * ids, per runner in the plan — emitted on EVERY turn, before any plan exists
+     * or after. The system prompt shows this once at conversation start; a long
+     * clarifying conversation outlives that single showing and the planner
+     * starts misquoting it, so this re-states it per turn instead.
+     *
+     * The host's catalog is allowlist-filtered, so a restricted allowlist stays a
+     * hard bound on every turn, and reads the plan's runners live, so a runner
+     * admitted mid-session by a retarget is shown like every other.
+     */
+    private catalogBlock;
+    /**
+     * The "you are here" block for post-plan chat: current tasks with stable
+     * references, plus the read and edit protocols. Injected per turn (never
+     * persisted) so the model always sees live statuses — including which tasks
+     * are locked by a running execution.
+     */
+    private planContextBlock;
+    /** One line per task with stable references — null until the plan has tasks. */
+    private currentPlanLines;
+}
 
 declare const BUILTIN_SKILL_NAMES: readonly ["grilling", "to-spec", "improve-codebase-architecture"];
 interface SkillMetadata {
@@ -3003,6 +3423,126 @@ declare class SkillsService {
 }
 declare function createSkillsService(workspaceRoot?: string): SkillsService;
 
+/** The `planner_usage` member of the session broadcast union. */
+type PlannerUsageMessage = Extract<SessionMessage, {
+    type: 'planner_usage';
+}>;
+/**
+ * The planner's session usage ledger (#49), owned by Session. Consumes the
+ * `usage` progress events a backend emits per model call, keeps the running
+ * session and per-subagent totals, and renders the `planner_usage` message.
+ * Session persists {@link snapshot} with the plan and restores it on load, so a
+ * reopened session shows its totals again. The accumulation itself lives in
+ * `models/Usage` — the one place the sum's currency-per-currency rule is
+ * defined — this module just holds the state and the broadcast shape.
+ */
+declare class PlannerUsageLedger {
+    private usage;
+    /** Fold one model call's record into the totals; returns the running ledger. */
+    record(record: UsageRecord): PlannerUsage;
+    /** Adopt a persisted ledger (a reopened session) or start from zero. */
+    restore(usage: PlannerUsage | undefined): void;
+    /** Start a fresh session's ledger from zero. */
+    clear(): void;
+    /** Whether anything has been recorded — a plan with no usage says nothing. */
+    get hasUsage(): boolean;
+    /** The value persisted onto the plan state. */
+    snapshot(): PlannerUsage;
+    /** The broadcast message for the totals as they stand now. */
+    message(turnId?: string): PlannerUsageMessage;
+}
+
+interface SessionEventRelayDeps {
+    broadcast: SessionBroadcaster;
+    /** Where isolation notices go, for a host whose notifications are not seen by the user. */
+    onNotice?: (notice: SessionNotice) => void;
+    store: Pick<PlanStore, 'allTasks' | 'snapshot'>;
+    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getTaskIsolation' | 'getQueuedTaskMessages'>;
+    /** Shared with the Session, which snapshots, restores and clears it. */
+    usage: PlannerUsageLedger;
+    /** How many of a task's runner requests wait for an answer (ADR-0018, A1). */
+    awaitingApproval?: (taskId: string) => number;
+}
+/** Every orchestrator event the relay announces; `onTaskSettled` is persistence only, so it is the Session's. */
+type RelayObserver = Required<Omit<OrchestratorObserver, 'onTaskSettled'>>;
+/**
+ * Turns orchestrator and planner events into {@link SessionMessage}
+ * broadcasts — the one place a surface's view of a Session is produced. It
+ * never persists: where an event also owes a save, the Session does that
+ * before handing the event on, so no surface sees state the disk lacks.
+ */
+declare class SessionEventRelay {
+    private readonly broadcast;
+    private readonly onNotice?;
+    private readonly store;
+    private readonly orchestrator;
+    private readonly usage;
+    private readonly awaitingApproval;
+    /**
+     * The in-flight turn's subagent activity, grouped one run per subagent so a
+     * replay nests each step under its own brief/result. Folded into the plan's
+     * researchLog at persist — see {@link flushSubagentRuns}.
+     */
+    private pendingSubagents;
+    private statusHeld;
+    private statusOwed;
+    constructor(deps: SessionEventRelayDeps);
+    /** `plan` is read per event: a Session with no plan (or mid-reset) announces nothing about tasks. */
+    observer(plan: () => LegacyPlanState | null): RelayObserver;
+    status(plan: LegacyPlanState | null): void;
+    /**
+     * Run `op` with status broadcasts held back. Store ops signal the observer
+     * as they go, which would put a status_update on the wire before the
+     * persist the caller owes — surfaces must never see plan state the disk
+     * does not have yet. {@link releaseStatus} sends the one held back.
+     */
+    holdStatus<T>(op: () => T): T;
+    releaseStatus(plan: LegacyPlanState | null): void;
+    executionComplete(plan: LegacyPlanState | null): void;
+    /** `turnId`: the planner turn whose commit this is, when one is. */
+    planGenerated(plan: LegacyPlanState | null, goal: string, turnId?: string): void;
+    progress(progress: ResearchProgress): void;
+    /** The run for `subagentId`, created on first sighting so a step arriving
+     * before (or without) its started event still gets a home. */
+    private subagentRun;
+    /**
+     * Fold the turn's subagent runs into the plan's researchLog as one contiguous
+     * group per subagent — its entry then its steps, in the order they started —
+     * so a replay nests each step under its own subagent however the live stream
+     * interleaved. A harness planner already logs its child steps through the
+     * turn's researchLog; they are pulled out of that position and re-grouped
+     * rather than duplicated.
+     */
+    flushSubagentRuns(plan: LegacyPlanState): void;
+    /** Forget a turn's subagent runs that will never be persisted. */
+    dropSubagentRuns(): void;
+}
+
+/** Which session's logs, in which workspace. */
+interface TaskLogLocation {
+    baseDir: string;
+    sessionId: string;
+}
+/** One attempt's file, open for appending. */
+interface TaskLogFile {
+    readonly attempt: number;
+    append(events: readonly TaskLogEvent[]): void;
+}
+/** The attempts a task has a log for, oldest first. */
+declare function listTaskLogAttempts(location: TaskLogLocation, taskId: string): number[];
+/**
+ * Start the next attempt's file. Numbered from what is on disk rather than
+ * from the orchestrator's count, which restarts at one whenever a plan is
+ * loaded and would overwrite the attempts before it.
+ */
+declare function openTaskLog(location: TaskLogLocation, taskId: string): TaskLogFile;
+/**
+ * One attempt's events, in order; empty when it has no log. A line that does
+ * not parse is skipped — the last one, most likely, cut off by a crash
+ * mid-write — so what was saved before it still reads.
+ */
+declare function readTaskLog(location: TaskLogLocation, taskId: string, attempt: number): TaskLogEvent[];
+
 /**
  * A direct (non-planner) plan edit the session refused. Distinct from a plain
  * Error so a surface can tell "you asked for something invalid" from "something
@@ -3022,12 +3562,14 @@ interface GeneratePlanOptions {
     signal?: AbortSignal;
 }
 /** The slice of Planner the Session drives — the injection seam for tests. */
-type SessionPlanner = Pick<Planner, 'generate' | 'modify' | 'modifyDuringExecution'>;
+type SessionPlanner = Pick<Planner, 'generate' | 'modifyDuringExecution'>;
 /** Runtime prefs read live — may toggle between operations. */
 interface SessionRuntimeSettings {
     tddEnabled: boolean;
     verificationEnabled?: boolean;
     modelAllowlist?: Record<string, string[]>;
+    /** Read once as a run starts, never per spawn (ADR-0018, S1). Absent means terminal. */
+    runnerTransport?: RunnerTransport;
 }
 /**
  * The whole of what a host reads off disk for a Session. Both hosts used to
@@ -3053,13 +3595,6 @@ declare function sessionRuntimeSettings(settings: UserSettings): SessionRuntimeS
  * occurrence — later repeats stay literal.
  */
 declare function resolveSkillInvocation(text: string, skillsService: Pick<SkillsService, 'findSkill' | 'listSkills'>): string;
-/**
- * Everything a delivery surface constructs to host a session. Structural config
- * (enabledRunners, orchestratorModel, providerModelLists) is snapshotted inside
- * `config` at construction and never re-read from the environment. Runtime
- * settings (tdd, verification) are read live via the `settings` callback so a toggle
- * between generate and execute takes effect.
- */
 /** Where a fork landed: the new session's id, and what adopting it needs. */
 interface ConversationFork {
     sessionId: string;
@@ -3070,6 +3605,15 @@ interface ConversationFork {
 interface ConversationRewind extends ConversationFork {
     rewoundMessage: string;
 }
+/** Writes one plan to the saved-session store: {@link saveSession}'s shape, injected so tests never touch disk. */
+type SaveSession = (plan: LegacyPlanState, goal: string, workspace: string, sessionId: string) => void;
+/**
+ * Everything a delivery surface constructs to host a session. Structural config
+ * (enabledRunners, orchestratorModel, providerModelLists) is snapshotted inside
+ * `config` at construction and never re-read from the environment. Runtime
+ * settings (tdd, verification) are read live via the `settings` callback so a toggle
+ * between generate and execute takes effect.
+ */
 interface SessionDeps {
     config: IConfig;
     notifications: INotification;
@@ -3117,49 +3661,75 @@ interface SessionDeps {
      * `config.worktreeIsolation`; tests inject `FakeWorktreeIsolation`.
      */
     isolation?: IWorktreeIsolation;
+    /** Persistence seam. Defaults to the saved-session store under the workspace. */
+    saveSession?: SaveSession;
+    /** Where a structured task's log is saved (ADR-0018, P1). Defaults to a file per attempt beside the session's. */
+    openTaskLog?: (location: TaskLogLocation, taskId: string) => TaskLogFile;
 }
 /**
- * The per-session execution stack — deepened from a wiring bag into the
- * lifecycle owner. Owns plan generation, execution, mutation, persistence, and
- * the orchestrator observer wiring. The orchestrator's observer is subscribed
- * once for the session's lifetime (not per-operation), which kills the
- * double-subscribe class of bug. Persistence is an internal seam: every plan
- * mutation routes through `persist()`, so the obligation has a home instead of
- * being scattered across 11 call sites.
+ * The composition root: builds every collaborator a Session drives and wires
+ * them to each other, so the Session only receives them. Hosts create a
+ * Session here; the optional {@link SessionDeps} are the seams tests fill.
+ */
+declare function createSession(deps: SessionDeps): Session;
+/** What {@link createSession} hands a Session: every collaborator, already built and wired. */
+interface SessionParts {
+    config: IConfig;
+    registry: RunnerRegistry;
+    workspace: string;
+    fsAdapter: IFileSystem;
+    broadcast: SessionBroadcaster;
+    onNotice?: (notice: SessionNotice) => void;
+    modelResolver: ModelResolver;
+    settings: () => SessionRuntimeSettings;
+    hostSessionId?: string;
+    aiService: () => IAiService;
+    planner: SessionPlanner;
+    store: PlanStore;
+    orchestrator: TaskOrchestrator;
+    events: SessionEventRelay;
+    usage: PlannerUsageLedger;
+    approvals: PendingApprovals;
+    approvalPolicy: ApprovalPolicy;
+    fetcher: IWebFetcher;
+    skillsService: Pick<SkillsService, 'findSkill' | 'listSkills'>;
+    saveSession: SaveSession;
+    /** The conversation's host is the Session itself, so only the Session can make it. */
+    conversation: (host: PlannerConversationHost) => PlannerConversation;
+}
+/**
+ * The per-session execution stack — the lifecycle owner. Owns plan
+ * generation, execution, mutation and persistence; built by
+ * {@link createSession}, which wires its collaborators. The orchestrator's
+ * observer is subscribed once for the session's lifetime (not per-operation),
+ * which kills the double-subscribe class of bug. Persistence is an internal
+ * seam: every plan mutation routes through `persist()`.
  *
- * The broadcast seam carries {@link SessionMessage} — the 15 plan-lifecycle
- * events. Catalog/config messages (setModels, setRunnerList, …) stay on the
- * host; Session never emits them.
+ * What surfaces see is produced by the {@link SessionEventRelay}: the
+ * {@link SessionMessage} plan-lifecycle events. Catalog/config messages
+ * (setModels, setRunnerList, …) stay on the host; Session never emits them.
  */
 declare class Session {
-    /** Injected by a test; when present it is the service, forever. */
-    private readonly pinnedAiService?;
-    private liveAiService;
-    private readonly usageLedger;
-    /**
-     * The in-flight turn's subagent activity, grouped one run per subagent so a
-     * replay nests each step under its own brief/result. Flushed into the plan's
-     * researchLog at persist — see {@link flushSubagentRuns}.
-     */
-    private pendingSubagents;
-    private liveAiProvider;
-    private readonly workspaceRootFn;
-    private planner;
-    private orchestrator;
-    private store;
-    private config;
-    private registry;
+    private readonly aiService;
+    private readonly usage;
+    private readonly events;
+    private readonly planner;
+    private readonly orchestrator;
+    private readonly store;
+    private readonly config;
+    private readonly registry;
     private plan;
     private goal;
     private workspace;
-    private broadcast;
-    private onNotice?;
-    private modelResolver;
-    private fsAdapter;
-    private approvals;
-    private approvalPolicy;
-    private fetcher;
-    private settingsFn;
+    private readonly broadcast;
+    private readonly onNotice?;
+    private readonly modelResolver;
+    private readonly fsAdapter;
+    private readonly approvals;
+    private readonly approvalPolicy;
+    private readonly fetcher;
+    private readonly settingsFn;
+    private readonly save;
     /** Last discovered model catalog — lets sync plan commits clamp thinking efforts to real variants. */
     private modelsCache;
     private unsubObserver;
@@ -3167,55 +3737,47 @@ declare class Session {
     private currentSessionId;
     private readonly skillsService;
     private readonly conversation;
-    constructor(deps: SessionDeps);
-    /**
-     * The planner transport for the provider configured *right now* (ADR-0009).
-     *
-     * Resolved on every read rather than once in the constructor, because a
-     * Session outlives the choice: VS Code hosts exactly one for the whole
-     * window, and the webview pills and `/planner` switch backends underneath it.
-     * The model id was already read live, so a service captured at construction
-     * meant a switched planner kept the old backend and got handed the new one's
-     * model — an OpenCode model id spawned as `claude --model opencode/…`, which
-     * the agent rejects as nonexistent.
-     *
-     * Switching releases the outgoing service: a harness planner holds an OS
-     * process, so dropping the reference without `reset()` leaks an agent.
-     */
-    private get aiService();
+    constructor(parts: SessionParts);
     /**
      * Answer an outstanding approval. Every surface funnels here — the web
      * server's HTTP route, the VS Code webview, the TUI prompt — so the decision
      * path is identical regardless of who is looking.
      */
-    resolveApproval(id: string, granted: boolean): boolean;
+    resolveApproval(id: string, answer: ApprovalAnswer): boolean;
     /** Requests still waiting for an answer, replayed to a surface that connects mid-prompt. */
     outstandingApprovals(): PendingApproval[];
     /** Scopes the user granted this session — surfaced so a UI can show what is already allowed. */
     approvedScopes(): string[];
     /** The stable id this session persists under — matches the host's id when one was provided. */
     get sessionId(): string;
-    get executionLog(): TaskSnapshot[];
+    /** Where this session's structured task logs are saved (ADR-0018, P1). */
+    get taskLogLocation(): TaskLogLocation;
+    /** The attempts of a task that have a saved log, oldest first. */
+    taskLogAttempts(taskId: string): number[];
+    /** One attempt's saved log, for `replayTaskLog` — what a reopened task view shows. */
+    taskLog(taskId: string, attempt: number): TaskLogEvent[];
+    get executionLog(): ReadonlyArray<TaskSnapshot>;
     /** Tasks always read from PlanStore — the single source of truth. */
-    get planTasks(): Task[];
-    private attachObserver;
-    private buildObserver;
-    private broadcastStatus;
-    private translateProgress;
-    /** The run for `subagentId`, created on first sighting so a step arriving
-     * before (or without) its started event still gets a home. */
-    private subagentRun;
+    get planTasks(): ReadonlyArray<Readonly<Task>>;
     /**
-     * Fold the turn's subagent runs into the plan's researchLog as one contiguous
-     * group per subagent — its entry then its steps, in the order they started —
-     * so a replay nests each step under its own subagent however the live stream
-     * interleaved. A harness planner already logs its child steps through the
-     * turn's researchLog; they are pulled out of that position and re-grouped
-     * rather than duplicated.
+     * The relay announces every orchestrator event; this adds the saves some of
+     * them owe, each made before the announcement so no surface sees state the
+     * disk lacks.
+     */
+    private observer;
+    /**
+     * Refresh the plan's task list from the store. LegacyPlanState.tasks is only
+     * ever written from the store (here and by the relay before it announces),
+     * and always as a detached copy: sharing the store's live
+     * tree let a host that edits `plan.tasks` rewrite task state behind the
+     * store's back.
+     */
+    private syncPlanTasks;
+    /**
+     * Persists PlanStore state to disk. PlanStore is the single authority.
+     * `background`: an execution event's save, which may land in the middle of a
+     * planner turn without settling it (see {@link PlannerConversation.restore}).
      */
-    private flushSubagentRuns;
-    /** Persists PlanStore state to disk. PlanStore is the single authority;
-     * LegacyPlanState.tasks is populated only here, at persist time. */
     private persist;
     /** A new plan on a long-lived Session gets its own persisted identity (unless the host fixed one). */
     private remintSessionId;
@@ -3269,7 +3831,6 @@ declare class Session {
      */
     get currentPlanState(): PlanState | null;
     get currentGoal(): string;
-    get isPlanning(): boolean;
     /**
      * A task is running right now. Deliberately live work, not the scheduler's
      * armed flag: a run paused on a user task, a hold or a cancellation has
@@ -3280,7 +3841,6 @@ declare class Session {
     /** See {@link TaskOrchestrator.hasLiveWork} — a spawned runner, not merely an armed scheduler. */
     get hasLiveWork(): boolean;
     get status(): 'approved' | 'running' | 'completed';
-    get sessionConfig(): IConfig;
     /**
      * Deny every parked approval as soon as a planning turn is aborted, for the
      * same reason `beginFreshPlan` does it: a prompt raised by a turn nobody is
@@ -3295,7 +3855,6 @@ declare class Session {
      * *next* turn's prompts the moment that stale signal aborted.
      */
     private denyApprovalsOnAbort;
-    startExecution(): Promise<void>;
     generatePlan(goal: string, runners: RunnerId[], options?: GeneratePlanOptions): Promise<LegacyPlanState>;
     /**
      * Kick off the planner conversation (ADR-0002): research + the first planner
@@ -3379,11 +3938,15 @@ declare class Session {
     /** Start whatever the scheduler can now fit — after the parallel limit was raised mid-run, say. */
     reschedule(): Promise<void>;
     retryTask(taskId: string): Promise<void>;
+    /**
+     * Continue a finished structured task in its saved runner session with the
+     * user's message (ADR-0018, K1); throws `TaskControlError` for a task that
+     * cannot be continued.
+     */
+    continueTask(taskId: string, message: string): Promise<void>;
     cancelTask(taskId: string): Promise<void>;
-    markAiTaskComplete(taskId: string): Promise<void>;
     markTaskComplete(taskId: string): Promise<void>;
     markTaskIncomplete(taskId: string): Promise<void>;
-    tick(): Promise<void>;
     processQueuedMessages(): Promise<void>;
     /**
      * Every finished task as the log records it: this run's own entries, plus
@@ -3393,15 +3956,18 @@ declare class Session {
     private finishedWork;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason?: string): void;
-    queueMessage(text: string): void;
+    /**
+     * A user message to a structured task (ADR-0018, M1); throws
+     * `TaskControlError` for one that cannot take it. A task waiting for input
+     * is back in progress, and saved so before any surface is told.
+     */
+    sendTaskMessage(taskId: string, text: string): string;
+    removeQueuedTaskMessage(taskId: string, id: string): boolean;
+    interruptTask(taskId: string): Promise<void>;
     getQueuedMessages(): QueuedMessage[];
     /** Take back one unsent message; the plan's persisted queue follows so a reload cannot resurrect it. */
     removeQueuedMessage(id: string): boolean;
-    setQueuedMessages(msgs: ReturnType<TaskOrchestrator['getQueuedMessages']>): void;
-    processNextQueuedMessage(): QueuedMessage | null;
-    get queuedCount(): number;
-    getTask(taskId: string): Task | undefined;
-    get isReviewApproved(): boolean;
+    setQueuedMessages(msgs: QueuedMessage[]): void;
     /** Replay a run a dirty tree blocked, after stashing the tracked changes. */
     continueWithStash(): Promise<void>;
     /** Replay a run a dirty tree blocked, in the workspace root, for this run only. */
@@ -3507,7 +4073,6 @@ declare class Session {
      * rule instead of slipping past it.
      */
     setTaskDependencies(taskId: string, dependencies: string[]): Promise<LegacyPlanState | null>;
-    completeTask(taskId: string): Promise<void>;
     /**
      * Delete one task. A running task is cancelled first: the plan can drop it
      * either way, but nothing can reach its runner afterwards — the tmux session
@@ -3530,9 +4095,6 @@ declare class Session {
      * moved on, not that the whole task should be refused.
      */
     addTask(draft: Partial<Task>): Promise<LegacyPlanState | null>;
-    mergeTasks(taskIdA: string, taskIdB: string): Promise<LegacyPlanState | null>;
-    mergeMultipleTasks(taskIds: string[]): Promise<LegacyPlanState | null>;
-    splitTask(taskId: string, newTasks: Partial<Task>[]): Promise<LegacyPlanState | null>;
     /**
      * Planner-driven merge: validate compatibility up front, then ask the planner
      * LLM to produce a single "merge" taskOps op combining the selected tasks.
@@ -3552,9 +4114,7 @@ declare class Session {
         sessionId?: string;
         persist?: boolean;
     }): void;
-    modifyPlan(userRequest: string): Promise<Task[]>;
     destroy(): void;
-    private broadcastPlan;
     get aiServiceInstance(): IAiService;
 }
 
@@ -3575,6 +4135,11 @@ declare function globalDataDir(): string;
  */
 declare function migrateOldConfigDir(): void;
 
+/** Create `dir` (and its parents) owner-only, leaving any existing directory at its own mode. */
+declare function ensurePrivateDir(dir: string): void;
+/** Write `content` to `filePath`, atomically, ending at 0600 on POSIX. */
+declare function writePrivateFile(filePath: string, content: string): void;
+
 type VerdictListener = (taskId: string, verdict: Verdict) => void;
 type CheckpointListener = (taskId: string, summary: string) => void;
 /** Fires on every idleSince transition (null→timestamp on silence, timestamp→null on resume/teardown). */
@@ -3602,11 +4167,19 @@ declare class VerdictEngine {
     private lastGeneration;
     private idleTimers;
     private idleSince;
+    /** Tasks waiting on the user, whose silence is expected rather than a sign of a stuck runner. */
+    private idlePaused;
     onVerdict(listener: VerdictListener): void;
     onCheckpoint(listener: CheckpointListener): void;
     onIdleChange(listener: IdleListener): void;
     /** Advisory silence timestamp for a task, or null if it isn't idle. */
     getIdleSince(taskId: string): string | null;
+    /**
+     * Stop watching a task's silence while it waits on the user (ADR-0018, W1).
+     * Watching resumes when its next turn starts, or when a checkpoint is answered.
+     */
+    pauseIdle(taskId: string): void;
+    private resumeIdle;
     /** Restart the silence timer on fresh output; broadcasts the null transition if it was idle. */
     private touchIdle;
     /** Tear down idle tracking for a task; broadcasts the null transition if it was idle. */
@@ -3720,7 +4293,7 @@ declare function filterModelsForPrompt(modelsByRunner: Partial<Record<RunnerId,
 declare function clampThinkingEffort(effort: string | undefined, variants: {
     id: string;
 }[]): string | undefined;
-declare function coerceAssignments(tasks: Task[], perRunnerAllowlist: Partial<Record<RunnerId, string[]>>, allowedRunners?: RunnerId[], modelsByRunner?: Partial<Record<RunnerId, DiscoveredModel[]>>): Task[];
+declare function coerceAssignments(tasks: readonly Task[], perRunnerAllowlist: Partial<Record<RunnerId, string[]>>, allowedRunners?: RunnerId[], modelsByRunner?: Partial<Record<RunnerId, DiscoveredModel[]>>): Task[];
 
 /** What a runner offers a task: the models discovered for it and the modes its manifest declares. */
 interface RunnerCatalog {
@@ -3795,13 +4368,13 @@ declare function buildModifyDuringExecutionPrompt(executionLog: TaskSnapshot[],
  * task-ops protocol (with the "merge" op) is injected alongside it by
  * `planContextBlock`. The model emits a single taskOps merge op.
  */
-declare function buildMergePrompt(taskIds: string[], tasks: Task[]): string;
+declare function buildMergePrompt(taskIds: string[], tasks: readonly Task[]): string;
 /**
  * User-message prompt for a planner-driven split: asks the model to decompose
  * one task into a sequence of smaller tasks. The model decides the breakdown —
  * the user does not hand-type the parts.
  */
-declare function buildSplitPrompt(taskId: string, tasks: Task[]): string;
+declare function buildSplitPrompt(taskId: string, tasks: readonly Task[]): string;
 /**
  * Runner prompt for the opt-in task that resolves an integration conflict
  * (ADR-0013). The resolver's own worktree starts at the integration tip, so the
@@ -3977,16 +4550,16 @@ declare function summarizeOutput(reviewReason: string | undefined, output: strin
     logTail: string;
     capturedAt: string;
 };
-declare function collectDirectDependencyOutputs(task: Task, allTasks: Task[]): PriorOutput[];
+declare function collectDirectDependencyOutputs(task: Task, allTasks: readonly Task[]): PriorOutput[];
 declare function renderPriorOutputs(outputs: PriorOutput[]): string;
-declare function augmentPromptWithPriorOutputs(task: Task, allTasks: Task[]): string;
+declare function augmentPromptWithPriorOutputs(task: Task, allTasks: readonly Task[]): string;
 /**
  * Numbered task list for the model's context. `planTasks` is the nested task
  * tree; subtasks render indented under their parent with the same dotted
  * `taskOrderLabel` the other surfaces use, so an `N.M` the model echoes back
  * matches what `resolveTaskId` accepts.
  */
-declare function renderPlanMap(planTasks: Task[], currentTaskId: string, opts?: {
+declare function renderPlanMap(planTasks: readonly Task[], currentTaskId: string, opts?: {
     maxEntries?: number;
 }): string;
 interface ComposeOptions {
@@ -3994,7 +4567,14 @@ interface ComposeOptions {
     planMapMaxEntries?: number;
     tddEnabled?: boolean;
 }
-declare function composeAugmentedPrompt(task: Task, allTasks: Task[], opts?: ComposeOptions): string;
+declare function composeAugmentedPrompt(task: Task, allTasks: readonly Task[], opts?: ComposeOptions): string;
+/**
+ * The first turn of a continue (ADR-0018, K1): the user's message, then a
+ * short reminder of the protocol. The resumed session already holds the
+ * original prompt, so it is not sent again — but it holds the old worktree
+ * too, and this attempt's is fresh from the integration branch.
+ */
+declare function composeContinuationPrompt(task: Task, message: string): string;
 
 type ExecFileFn = (command: string, args: string[]) => Promise<{
     stdout: string;
@@ -4129,6 +4709,197 @@ declare class TmuxRunner extends AbstractRunner<TmuxSession> {
     }): Promise<ITerminalSession>;
 }
 
+interface StructuredRunnerDeps {
+    /** The OS boundary the adapters spawn through. `workspaceEnv` is always the spawn's own `env`. */
+    process?: Partial<Omit<AgentProcessDeps, 'workspaceEnv'>>;
+    /** Overrides adapter construction; production picks by runner id and refuses runners without a connector. */
+    createAdapter?: (runner: string, deps: AgentProcessDeps) => TaskModeAgentAdapter;
+    interruptGraceMs?: number;
+}
+interface SessionLaunch {
+    runner: string;
+    deps: AgentProcessDeps;
+    createAdapter: (runner: string, deps: AgentProcessDeps) => TaskModeAgentAdapter;
+    startOptions: TaskStartOptions;
+    interruptGraceMs: number;
+}
+/**
+ * One task driven over its runner's programmatic protocol (ADR-0018). It *is*
+ * an `ITerminalSession`, so everything downstream of `onOutput` is unchanged;
+ * what a terminal cannot do sits on {@link StructuredSessionCapability}.
+ *
+ * Ordewell owns the message queue (M1): a message sent mid-turn waits for the
+ * turn to end rather than being typed into a runner that is busy.
+ */
+declare class StructuredSession extends AbstractTerminalSession implements StructuredSessionCapability {
+    private readonly launch;
+    readonly transport: "structured";
+    private adapter;
+    private adapterStarted;
+    /** Bumped whenever the adapter is replaced, so the old one's late events and exit are ignored. */
+    private generation;
+    private output;
+    private readonly text;
+    private state;
+    private turn;
+    private turnCount;
+    private queue;
+    private messageCount;
+    private interrupting;
+    private lastSessionId;
+    private readonly structuredEmitter;
+    private permissionCount;
+    /**
+     * Open tool requests by the id this session gave them, with the runner's own
+     * id. The runner's ids are only unique to its process — Codex numbers its
+     * requests — while an approval must be answerable by id across the session.
+     */
+    private readonly permissions;
+    constructor(id: string, taskId: string, launch: SessionLaunch);
+    /** Start the runner and send the task's prompt as its first turn. */
+    start(prompt: string): Promise<void>;
+    getOutput(): string;
+    /** A reply typed at the task — a checkpoint answer, most often — is a user message. */
+    write(text: string): void;
+    kill(): void;
+    turnState(): 'working' | 'idle';
+    onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
+    onEvent(listener: (event: StructuredEvent) => void): void;
+    sendMessage(text: string): string;
+    removeQueued(id: string): boolean;
+    queued(): QueuedTaskMessage[];
+    nativeSessionId(): string | null;
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
+    /** Every open request goes unanswered once the process that asked is gone. */
+    private withdrawPermissions;
+    interrupt(): Promise<void>;
+    private interruptTurn;
+    /**
+     * The fallback when the runner ignores a soft interrupt: kill it and resume
+     * its session in a fresh process, the way the planner restarts from its
+     * session id after an abort.
+     */
+    private restartInterrupted;
+    private startAdapter;
+    private openTurn;
+    private deliver;
+    private route;
+    /**
+     * The runner spoke with no message of ours in flight. When it is working — a
+     * turn it opened itself once background work finished — that is a turn of the
+     * task like any other: the state says working, a queued message waits, and its
+     * end settles it. A message with no text in `turn_start` marks it as not ours.
+     */
+    private handleOutOfTurn;
+    private openPermission;
+    private cancelPermission;
+    private handleEvent;
+    /**
+     * A queued message goes out as the turn closes, and the state never passes
+     * through `idle` on the way, so a listener told the turn ended can already
+     * see the task is not waiting.
+     */
+    private endTurn;
+    private emitEvent;
+}
+/**
+ * The structured transport (ADR-0018): a task's runner as a plain child
+ * process speaking its protocol — no tmux, no `script` (W2). Only runners
+ * with a task-mode connector can be spawned here; routing the rest to the
+ * terminal transport is the caller's decision, not a silent downgrade here.
+ */
+declare class StructuredRunner extends AbstractRunner<StructuredSession> {
+    private spawnCount;
+    private readonly processDeps;
+    private readonly createAdapter;
+    private readonly interruptGraceMs;
+    constructor(deps?: StructuredRunnerDeps);
+    spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
+}
+
+interface TransportRoute {
+    transport: RunnerTransport;
+    /** Why a structured request runs on the terminal instead, in words a surface shows as is. */
+    fallback?: string;
+}
+/**
+ * Where one task runs (ADR-0018, S3): structured only when the plan asks for
+ * it and the task's runner has a task-mode connector. Anything else runs on
+ * the terminal, and a structured request says why.
+ */
+declare function routeTransport(requested: RunnerTransport | undefined, runner: string, registry?: RunnerRegistry | null): TransportRoute;
+/**
+ * The runner a host hands the orchestrator: its own terminal runner (tmux,
+ * headless, the VS Code terminal) and the structured one behind a single
+ * `ITerminalRunner`, picking per spawn by {@link routeTransport}.
+ *
+ * `stopAll` and `activeCount` reach both inner runners, so a host that shares
+ * one across plans (the daemon's tmux) keeps its per-plan wrapper above this.
+ */
+declare class TransportRouter implements ITerminalRunner {
+    private readonly runners;
+    /**
+     * Session ids the structured runner owns; every other id is the terminal's.
+     * Kept past exit, so a stop that arrives late never reaches the terminal
+     * runner with an id it does not know.
+     */
+    private readonly structuredIds;
+    constructor(runners: {
+        terminal: ITerminalRunner;
+        structured: ITerminalRunner;
+    });
+    get activeCount(): number;
+    spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
+    stop(sessionId: string): void;
+    stopAll(): void;
+}
+
+/** Whether a task can be continued in its saved runner session (ADR-0018, K1), and in which. */
+type Continuability = {
+    ok: true;
+    sessionId: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The rule every surface offers Continue by and the orchestrator enforces: a
+ * completed or failed task whose last attempt ran structured and left a
+ * session id behind. A conflict is resolved by its repair, not a new turn, and
+ * a terminal task has no session Ordewell can reach — Retry covers both.
+ */
+declare function continuability(task: Task): Continuability;
+declare function canContinue(task: Task): boolean;
+
+interface TaskLogRecorderDeps {
+    broadcast: SessionBroadcaster;
+    /** Where the session's logs go, read as each attempt starts: a session's id can change between plans. */
+    location: () => TaskLogLocation;
+    /** Opens an attempt's file; tests pass one that never touches the disk. */
+    open?: (location: TaskLogLocation, taskId: string) => TaskLogFile;
+    flushMs?: number;
+    logger?: ILogger;
+}
+/**
+ * Keeps each structured task's log (ADR-0018, P1): every event of an attempt
+ * is appended to that attempt's file and broadcast as `task_log`, in the same
+ * batches, so what a surface saw live and what it reloads are one sequence.
+ *
+ * It sits around the runner rather than inside the orchestrator, which stays
+ * unaware of logs; a terminal-transport session has no event stream and is
+ * passed through untouched.
+ */
+declare class TaskLogRecorder {
+    private readonly deps;
+    private readonly open;
+    private readonly flushMs;
+    private readonly logger;
+    constructor(deps: TaskLogRecorderDeps);
+    wrap(runner: ITerminalRunner): ITerminalRunner;
+    /** Start a new attempt's log for `session` and keep it until the session exits. */
+    record(taskId: string, session: ITerminalSession & StructuredSessionCapability): void;
+}
+
 /**
  * A workspace path that does not exist, or exists but is not a directory.
  * Checked at every surface that starts a planner or spawns an agent inside
@@ -4208,10 +4979,11 @@ declare function daemonTokenPath(port: number): string;
 /**
  * Mint this daemon's token and hand it off through the filesystem.
  *
- * Unlink-then-create-exclusively rather than a plain write: `mode` is ignored
- * when the file already exists, so writing over a pre-created file would leave
- * the token at whatever permissions that file already had, and an existing
- * symlink would carry the write somewhere else entirely.
+ * The write goes through `writePrivateFile` rather than a plain write because
+ * `mode` is ignored when the file already exists: writing over a pre-created
+ * file would leave the token at whatever permissions that file already had, and
+ * an existing symlink would carry the write somewhere else entirely. The helper
+ * writes a fresh 0600 temp file and renames it into place, so neither applies.
  */
 declare function mintDaemonToken(port: number): {
     token: string;
@@ -4397,6 +5169,14 @@ declare function assertInstallablePluginUrl(url: unknown): URL;
 declare function classifyPluginSource(source: string): PluginSource;
 
 declare function resolveArgs(manifest: RunnerPluginManifest, ctx: ResolveContext): RunnerInvocation;
+/**
+ * The manifest's meaning of a task's mode and effort, for a runner driven over
+ * its programmatic protocol rather than a command line built from
+ * `argsTemplate` (ADR-0018, C1). The effort stays a raw id behind the same
+ * `{{if thinking}}` gate as the template path: how an effort reaches the
+ * runner is protocol, which each adapter owns.
+ */
+declare function resolveTaskRunnerFlags(manifest: RunnerPluginManifest, ctx: Pick<ResolveContext, 'mode' | 'model' | 'thinkingEffort'>): TaskRunnerFlags;
 
 declare const CLAUDE_CODE_MANIFEST: RunnerPluginManifest;
 
@@ -4422,6 +5202,17 @@ declare function loadState(baseDir?: string, logger?: ILogger): LegacyPlanState
 declare function clearState(baseDir?: string): void;
 declare function stateExists(baseDir?: string): boolean;
 
+/**
+ * A path segment for an id that came from outside — a session id from a URL,
+ * a task id a planner wrote. A plain id is used as is; anything that could
+ * climb out of its directory, or is not portable as a file name, is hex-encoded.
+ */
+declare function idSegment(id: string): string;
+/**
+ * The directory beside a session's file for what it keeps outside that file —
+ * its task logs (ADR-0018, P1). It goes when the session does.
+ */
+declare function sessionDataDir(sessionId: string, baseDir?: string): string;
 declare function saveSession(plan: LegacyPlanState, goal: string, baseDir?: string, id?: string): SessionMeta;
 declare function listSessions(baseDir?: string, logger?: ILogger): SessionMeta[];
 declare function loadSession(sessionId: string, baseDir?: string, logger?: ILogger): {
@@ -4516,4 +5307,4 @@ declare const DEFAULT_MAX_PARALLEL = 3;
  */
 declare function parseMaxParallel(value: unknown): number | null;
 
-export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type AgentAdapter, type AgentAdapterFactory, type AgentEvent, type AgentProcessDeps, type AgentStartOptions, AiProvider, ApprovalMode, ApprovalRequest, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, CommandLineTooLongError, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, ConversationBusyError, type ConversationCompaction, ConversationEditError, type ConversationFork, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DiscoveredModel, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, ExecutableNotFoundError, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GeminiService, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type HasBinFn, HeadlessRunner, type HeadlessRunnerDeps, HeadlessSession, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, IsolationHandoff, IsolationLandedTask, IsolationMergeResult, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, LineBuffer, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PluginSource, type PrdBlock, type PreparedLaunch, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, type PtySize, type PtyWrapOptions, QueuedMessage, REFUSED_COMMANDS, ReadFileOpts, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, ResolveContext, type RewindTarget, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, type RunnerSpawnOptions, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, Session, SessionBroadcaster, type SessionData, type SessionDeps, type SessionMeta, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, SubagentOutcome, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskIsolation, TaskOp, TaskOrchestrator, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskSnapshot, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildShellInvocation, buildSplitPrompt, buildSubagentSystemPrompt, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, configuredProviders, createAiService, createSkillsService, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, hasTmux, includeGlobFor, isCliProvider, isExecutableResolved, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, planDirectLaunch, planShellLaunch, posixShellQuote, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveWithin, retargetTaskRunner, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionRuntimeSettings, stateExists, stripAnsi, stripModelPrefix, summarizeOutput, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, windowsCommandLine, withPath, wrapWithPty };
+export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, ApplyTaskOpsResult, ApprovalAnswer, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type AskOptions, AwaitingReason, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompaction, ConversationEditError, type ConversationFork, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DiscoveredModel, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GeminiService, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type HasBinFn, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, IsolationHandoff, IsolationLandedTask, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, PlannerUsage, type PluginSource, type PrdBlock, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, ResolveContext, type RewindTarget, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, RunnerSpawnOptions, RunnerTransport, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, SessionMessage, type SessionMeta, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredSessionCapability, StructuredTurnEnd, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskControlError, TaskIsolation, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSnapshot, TaskStartOptions, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, type TransportRoute, TransportRouter, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createSkillsService, createTaskAdapter, createTaskOrchestrator, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, hasTmux, idSegment, includeGlobFor, isCliProvider, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, retargetTaskRunner, routeTransport, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, withPath, writePrivateFile };