@ordewell/core 0.7.0 → 0.7.1

package/dist/index.d.mts

@@ -1,15 +1,15 @@
-import { aX as RunnerId, av as PlanStatus, a9 as LegacyPlanState, L as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, O as ITerminalRunner, M as IConfig, h as AiProvider, aJ as ProviderModelLists, m as ApprovalMode, _ as IsolationMergeResult, W as IsolationLandedTask, Q as IWorktreeIsolation, a5 as IsolationTaskStatus, as as PlanIsolation, b0 as RunnerTransport, aQ as RepoGroupLayout, P as ITerminalSession, y as DiscoveredModel, bc as Task, f as AgentProcessDeps, c as AgentAdapter, ap as OrdewellMcpServer, aS as ResearchProgress, aR as ResearchLogEntry, w as ConversationMessage, ay as PlannerToolHandler, bz as UsageRecord, bo as TaskSnapshot, r as AwaitingReason, T as IsolationHandoff, a2 as IsolationRun, a3 as IsolationTaskRecord, be as TaskIsolation, a6 as IsolationView, $ as IsolationOutcome, aP as RepairEvidence, bx as TreeSnapshot, bG as Verdict, a_ as RunnerRegistry, aO as QueuedTaskMessage, aN as QueuedMessage, b as ActiveTaskSession, ao as OrchestratorOption, bh as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aV as ResearchToolType, az as PlannerUsage, n as ApprovalPolicy, au as PlanState, bd as TaskCompleteArgs, t as CheckpointAnswer, aY as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, b1 as RunnerVersionProbe, b6 as StructuredSessionCapability, bp as TaskStartOptions, br as TaskTokenScope, b7 as StructuredTurnEnd, b5 as StructuredEvent, a$ as RunnerSpawnOptions, N as IPluginStore, aZ as RunnerPluginManifest, aW as ResolveContext, bn as TaskRunnerFlags } from './Task-CoKhvBa1.mjs';
-export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, u as CheckpointArgs, v as CommandLineTooLongError, D as DENY_ALL, x as DiscoveredMode, z as DiscoveryCommand, E as EditPlanArgs, F as EmbeddedNewlineError, G as ExecutableNotFoundError, H as FetchAllProviderModelsOptions, I as HeadlessRunner, J as HeadlessRunnerDeps, K as HeadlessSession, R as IntegrationDisposal, S as IsolationAvailability, U as IsolationHandoffRepo, V as IsolationInactiveReason, X as IsolationLanding, Y as IsolationMergeBlock, Z as IsolationMergeBlockReason, a0 as IsolationPruneResult, a1 as IsolationRepo, a4 as IsolationTaskRepo, a7 as LaunchDeps, a8 as LaunchPlan, aa as LineBuffer, ab as ListModelsArgs, ac as ListRunnersArgs, ad as McpClientConfig, ae as McpCredential, af as McpTool, ag as McpToolContext, ah as McpToolReply, ai as Message, aj as ModelCatalog, ak as ModelShortcut, al as ORCHESTRATOR_SHORTCUTS, am as ORDEWELL_MCP_PATH, an as ORDEWELL_MCP_SERVER_NAME, aq as OwnerOnlyFile, ar as PLANNER_TOOLS, at as PlanModificationWarnings, aw as PlannerStartOptions, ax as PlannerTokenScope, aA as PluginCloneFn, aB as PluginEntry, aC as PluginFeatures, aD as PluginMode, aE as PluginModelDiscovery, aF as PluginRunnerDef, aG as PreparedLaunch, aH as PreparedTask, aI as ProviderCredentialSource, aK as ProviderModelsResult, aL as PtySize, aM as PtyWrapOptions, aT as ResearchStep, aU as ResearchStepOutcome, b2 as StreamEvent, b3 as StreamStepEvent, b4 as StreamThinkingEvent, b8 as SubagentLogEntry, b9 as SubagentOutcome, ba as SubmitPlanArgs, bb as TASK_TOOLS, bf as TaskIsolationState, bg as TaskMode, bi as TaskModeUnsupportedError, bj as TaskModelAssignment, bk as TaskOutputArgs, bl as TaskOutputSummary, bm as TaskQueryArgs, bq as TaskStatus, bs as TaskToolHandler, bt as TaskTransport, bu as TaskType, bv as TaskWithParent, bw as ThinkingBlock, by as UsageLine, bA as UsageTotals, bB as UserPromptEntry, bC as UserStep, bD as ValidationCheck, bE as ValidationContext, bF as ValidationResult, bH as VerificationCheck, bI as WINDOWS_MAX_COMMAND_LINE, bJ as addPlannerUsage, bK as addTaskToPlan, bL as addUsage, bM as approvalScopes, bN as buildShellInvocation, bO as collectProviderCredentials, bP as createEmptyPlan, bQ as createTask, bR as emptyWarnings, bS as enabledRunners, bT as fetchAllProviderModels, bU as flattenTasks, bV as flattenTasksWithParents, bW as isAwaitingReason, bX as isExecutableResolved, bY as isGranted, bZ as isMeasured, b_ as isReservedRunnerName, b$ as isRunnerApproval, c0 as isRunnerTransport, c1 as isStructuredSession, c2 as keepExecutionState, c3 as knownModelId, c4 as mcpClientConfig, c5 as migrateLegacyPlan, c6 as migratePlanState, c7 as migrateTask, c8 as ownerOnlyConfigFile, c9 as partedPromptUsage, ca as planDirectLaunch, cb as planShellLaunch, cc as plannerContextFill, cd as posixShellQuote, ce as removeTaskFromPlan, cf as renumberTasks, cg as resolveModelShortcut, ch as resolveProvider, ci as sharedMcpServer, cj as stripAnsi, ck as toApprovalDecision, cl as toOrchestratorOptions, cm as updateTaskInPlan, cn as usageLine, co as validateModifiedPlan, cp as warningsText, cq as windowsCommandLine, cr as wrapWithPty } from './Task-CoKhvBa1.mjs';
-import { x as TaskOp, M as MergeGateView, p as SessionBroadcaster, A as ApplyTaskOpsResult, q as SessionMessage, r as SessionNotice, v as TaskLogEvent } from './plan-utils-CD1Xu65s.mjs';
-export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, j as MessageBlock, k as MessageRole, N as NO_TURN, O as OutputPreview, P as PlanBlock, l as PlanMarkerStatus, m as PromptHold, S as SerializedPlan, n as SerializedTask, o as SerializedTaskStatus, s as SubagentBlock, t as SubagentChild, u as SubagentStatus, T as TakenPrompt, w as TaskLogView, y as TaskRef, z as ThinkingDisplayBlock, B as ToolBlock, F as ToolHeadline, H as ToolStatus, I as TurnGate, U as UsageBlock, J as aheadOfDraft, K as applyTaskOps, Q as canMergeTasks, R as canSetDependencies, V as canSplitTask, W as capConflictFiles, X as classifyOutcome, Y as coalesceTaskLog, Z as dependencyCandidates, _ as dependentsOf, $ as diffRows, a0 as diffStat, a1 as diffSummary, a2 as digestTaskLog, a3 as drainNext, a4 as executionSummary, a5 as followTurn, a6 as fromTranscript, a7 as hasHiddenDetail, a8 as holdPrompt, a9 as outputLines, aa as outputPreview, ab as parseTaskOpsJson, ac as reduceConversation, ad as reduceTaskLog, ae as replayTaskLog, af as runnerToolSubject, ag as serializePlan, ah as serializeTask, ai as serializeTaskStatus, aj as stopTurn, ak as summarizeToolCall, al as taskStartedNotice, am as textHasTaskOps, an as toTaskLogEvent, ao as toolHeadline, ap as trimToolOutput, aq as truncateCheckpointSummary, ar as unsendAll, as as unsendLatest } from './plan-utils-CD1Xu65s.mjs';
-import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-DgpX0BU7.mjs';
-export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-DgpX0BU7.mjs';
-import { R as RunnerModeInfo } from './ModeResolver-Cv01ZDd9.mjs';
-export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-Cv01ZDd9.mjs';
+import { a$ as RunnerId, ax as PlanStatus, ab as LegacyPlanState, L as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, O as ITerminalRunner, M as IConfig, h as AiProvider, aM as ProviderModelLists, m as ApprovalMode, _ as IsolationMergeResult, W as IsolationLandedTask, Q as IWorktreeIsolation, a7 as IsolationTaskStatus, au as PlanIsolation, b4 as RunnerTransport, aU as RepoGroupLayout, P as ITerminalSession, y as DiscoveredModel, bh as Task, f as AgentProcessDeps, c as AgentAdapter, ar as OrdewellMcpServer, aW as ResearchProgress, aV as ResearchLogEntry, w as ConversationMessage, aA as PlannerToolHandler, bE as UsageRecord, bt as TaskSnapshot, r as AwaitingReason, T as IsolationHandoff, a3 as IsolationRun, a4 as IsolationTaskRecord, bj as TaskIsolation, a8 as IsolationView, $ as IsolationOutcome, aT as RepairEvidence, bC as TreeSnapshot, bL as Verdict, b2 as RunnerRegistry, aR as QueuedTaskMessage, aQ as QueuedMessage, b as ActiveTaskSession, aq as OrchestratorOption, bm as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aZ as ResearchToolType, aB as PlannerUsage, n as ApprovalPolicy, aw as PlanState, bi as TaskCompleteArgs, t as CheckpointAnswer, b0 as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, b5 as RunnerVersionProbe, ba as StructuredSessionCapability, bu as TaskStartOptions, bw as TaskTokenScope, bb as StructuredTurnEnd, b9 as StructuredEvent, b3 as RunnerSpawnOptions, N as IPluginStore, b1 as RunnerPluginManifest, a_ as ResolveContext, bs as TaskRunnerFlags } from './Task-BnLxkVQF.mjs';
+export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, u as CheckpointArgs, v as CommandLineTooLongError, D as DENY_ALL, x as DiscoveredMode, z as DiscoveryCommand, E as EditPlanArgs, F as EmbeddedNewlineError, G as ExecutableNotFoundError, H as FetchAllProviderModelsOptions, I as HeadlessRunner, J as HeadlessRunnerDeps, K as HeadlessSession, R as IntegrationDisposal, S as IsolationAvailability, U as IsolationHandoffRepo, V as IsolationInactiveReason, X as IsolationLanding, Y as IsolationMergeBlock, Z as IsolationMergeBlockReason, a0 as IsolationPruneResult, a1 as IsolationRemoval, a2 as IsolationRepo, a5 as IsolationTaskRef, a6 as IsolationTaskRepo, a9 as LaunchDeps, aa as LaunchPlan, ac as LineBuffer, ad as ListModelsArgs, ae as ListRunnersArgs, af as McpClientConfig, ag as McpCredential, ah as McpTool, ai as McpToolContext, aj as McpToolReply, ak as Message, al as ModelCatalog, am as ModelShortcut, an as ORCHESTRATOR_SHORTCUTS, ao as ORDEWELL_MCP_PATH, ap as ORDEWELL_MCP_SERVER_NAME, as as OwnerOnlyFile, at as PLANNER_TOOLS, av as PlanModificationWarnings, ay as PlannerStartOptions, az as PlannerTokenScope, aC as PluginCloneFn, aD as PluginEntry, aE as PluginFeatures, aF as PluginMode, aG as PluginModelDiscovery, aH as PluginRunnerDef, aI as PreparedLaunch, aJ as PreparedTask, aK as PreservedWork, aL as ProviderCredentialSource, aN as ProviderModelsResult, aO as PtySize, aP as PtyWrapOptions, aS as RefusedRemoval, aX as ResearchStep, aY as ResearchStepOutcome, b6 as StreamEvent, b7 as StreamStepEvent, b8 as StreamThinkingEvent, bc as SubagentLogEntry, bd as SubagentOutcome, be as SubmitPlanArgs, bf as TASK_COMPLETE_TOOL, bg as TASK_TOOLS, bk as TaskIsolationState, bl as TaskMode, bn as TaskModeUnsupportedError, bo as TaskModelAssignment, bp as TaskOutputArgs, bq as TaskOutputSummary, br as TaskQueryArgs, bv as TaskStatus, bx as TaskToolHandler, by as TaskTransport, bz as TaskType, bA as TaskWithParent, bB as ThinkingBlock, bD as UsageLine, bF as UsageTotals, bG as UserPromptEntry, bH as UserStep, bI as ValidationCheck, bJ as ValidationContext, bK as ValidationResult, bM as VerificationCheck, bN as WINDOWS_MAX_COMMAND_LINE, bO as addPlannerUsage, bP as addTaskToPlan, bQ as addUsage, bR as approvalScopes, bS as buildShellInvocation, bT as collectProviderCredentials, bU as createEmptyPlan, bV as createTask, bW as emptyWarnings, bX as enabledRunners, bY as fetchAllProviderModels, bZ as flattenTasks, b_ as flattenTasksWithParents, b$ as inheritedOps, c0 as isAwaitingReason, c1 as isExecutableResolved, c2 as isGranted, c3 as isMeasured, c4 as isReservedRunnerName, c5 as isRunnerApproval, c6 as isRunnerTransport, c7 as isStructuredSession, c8 as keepExecutionState, c9 as knownModelId, ca as mcpClientConfig, cb as migrateLegacyPlan, cc as migratePlanState, cd as migrateTask, ce as opsFlag, cf as ownerOnlyConfigFile, cg as partedPromptUsage, ch as planDirectLaunch, ci as planShellLaunch, cj as plannerContextFill, ck as posixShellQuote, cl as removeTaskFromPlan, cm as renumberTasks, cn as resolveModelShortcut, co as resolveProvider, cp as sharedMcpServer, cq as stripAnsi, cr as toApprovalDecision, cs as toOrchestratorOptions, ct as updateTaskInPlan, cu as usageLine, cv as validateModifiedPlan, cw as warningsText, cx as windowsCommandLine, cy as wrapWithPty } from './Task-BnLxkVQF.mjs';
+import { z as TaskOp, M as MergeGateView, r as SessionBroadcaster, A as ApplyTaskOpsResult, s as SessionMessage, t as SessionNotice, x as TaskLogEvent } from './plan-utils-CKgNtDwQ.mjs';
+export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, j as MessageBlock, k as MessageRole, N as NOT_STARTED, l as NO_TURN, m as NewTaskFields, O as OutputPreview, P as PlanBlock, n as PlanMarkerStatus, o as PromptHold, S as SerializedPlan, p as SerializedTask, q as SerializedTaskStatus, u as SubagentBlock, v as SubagentChild, w as SubagentStatus, T as TakenPrompt, y as TaskLogView, B as TaskRef, F as TaskRowAction, H as TaskRowContext, I as TaskRowIsolation, J as TaskRowKind, K as TaskRowPlacement, Q as TaskRowSubject, R as TaskRowView, U as TaskStatusKind, V as ThinkingDisplayBlock, W as ToolBlock, X as ToolHeadline, Y as ToolStatus, Z as TurnGate, _ as UsageBlock, $ as aheadOfDraft, a0 as applyTaskOps, a1 as approvalLabel, a2 as awaitingLabel, a3 as canMergeTasks, a4 as canSetDependencies, a5 as canSplitTask, a6 as capConflictFiles, a7 as classifyOutcome, a8 as coalesceTaskLog, a9 as dependencyCandidates, aa as dependentsNotice, ab as dependentsOf, ac as diffRows, ad as diffStat, ae as diffSummary, af as digestTaskLog, ag as drainNext, ah as executionSummary, ai as followTurn, aj as fromTranscript, ak as hasHiddenDetail, al as holdPrompt, am as isTaskRunning, an as markAction, ao as markRequestFor, ap as namedRepos, aq as newTaskFields, ar as opsEditable, as as outputLines, at as outputPreview, au as parseTaskOpsJson, av as pastGateConfirmation, aw as reduceConversation, ax as reduceTaskLog, ay as replayTaskLog, az as runnerToolSubject, aA as serializePlan, aB as serializeTask, aC as serializeTaskStatus, aD as stopTurn, aE as summarizeToolCall, aF as taskRowActions, aG as taskRowView, aH as taskStartedNotice, aI as taskStatusKind, aJ as textHasTaskOps, aK as titledRefs, aL as toTaskLogEvent, aM as toolHeadline, aN as trimToolOutput, aO as truncateCheckpointSummary, aP as unsendAll, aQ as unsendLatest } from './plan-utils-CKgNtDwQ.mjs';
+import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-BnLh-_SK.mjs';
+export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-BnLh-_SK.mjs';
+import { R as RunnerModeInfo } from './ModeResolver-DZzJSdIU.mjs';
+export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-DZzJSdIU.mjs';
 import { ChildProcess } from 'child_process';
-import { b as PlanParseError } from './parsing-B4OCHH1_.mjs';
-export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, c as PlanTaskError, d as PlanTasksResult, T as TASK_OPS_ENVELOPE_KEY, e as TASK_QUERY_ENVELOPE_KEY, f as checkDepsResolve, g as checkImmutableLog, h as checkInProgress, i as checkNoCycles, j as checkUniqueIds, k as escapeControlCharsInStrings, l as extractJsonObject, m as extractObjectWithBalance, n as extractObjectsWithKey, o as looksLikePlanAttempt, p as opensWithJsonObject, q as parsePartialPlan, r as parsePlanJson, s as stripModelNoise, t as stripTrailingCommas, v as validatePlanModification, u as validatePlanTasks } from './parsing-B4OCHH1_.mjs';
-export { resolveOrderLabel, taskOrderLabel } from './order-labels.mjs';
+import { b as PlanParseError } from './parsing-B6ctfF80.mjs';
+export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, c as PlanTaskError, d as PlanTasksResult, T as TASK_OPS_ENVELOPE_KEY, e as TASK_QUERY_ENVELOPE_KEY, f as checkDepsResolve, g as checkImmutableLog, h as checkInProgress, i as checkNoCycles, j as checkUniqueIds, k as escapeControlCharsInStrings, l as extractJsonObject, m as extractObjectWithBalance, n as extractObjectsWithKey, o as looksLikePlanAttempt, p as opensWithJsonObject, q as parsePartialPlan, r as parsePlanJson, s as stripModelNoise, t as stripTrailingCommas, v as validatePlanModification, u as validatePlanTasks } from './parsing-B6ctfF80.mjs';
+export { resolveOrderLabel, taskOrderLabel, taskRef, titledTaskRef } from './order-labels.mjs';
 import 'events';
 import 'zod/v4';
 
@@ -1517,6 +1517,12 @@ interface IsolationRunControllerDeps {
     notifications: INotification;
     workspaceRoot: () => string;
     listener: IsolationRunListener;
+    /**
+     * The tasks no clean-up of the whole run may take a worktree from: an
+     * attempt is running them, or the plan has them in progress or waiting on
+     * the user mid-attempt.
+     */
+    liveTasks: () => ReadonlySet<string>;
 }
 /**
  * The lifecycle of a plan's isolation run (ADR-0013, ADR-0014, ADR-0020),
@@ -1533,6 +1539,7 @@ declare class IsolationRunController {
     private readonly notifications;
     private readonly workspaceRoot;
     private readonly listener;
+    private readonly liveTasks;
     private run;
     /** Copied paths already reported for the current run: every task gets the same copies. */
     private reportedCopies;
@@ -1561,6 +1568,7 @@ declare class IsolationRunController {
     get blocked(): boolean;
     /** What the plan persists of isolated execution; null when no run ever isolated. */
     get planIsolation(): PlanIsolation | null;
+    /** The one guard of every action on the run: a plan that never isolated is a request refused, not a fault. */
     requireRun(): IsolationRun;
     /** A task's record in the open run, only while that run isolates. */
     openRecord(taskId: string): IsolationTaskRecord | undefined;
@@ -1604,20 +1612,27 @@ declare class IsolationRunController {
      */
     continueBlocked(how: 'stash' | 'shared'): Promise<(() => Promise<void>) | null>;
     /**
-     * The one place an attempt's working directory is decided: the worktree
-     * prepared for it in an isolated run, the kept one for a conflict repair,
-     * else the workspace root. `worktree` says which. Does not itself report a
-     * worktree it creates as a change — the caller does once the attempt is
-     * committed as running, so a spawn abandoned or failed after this settles
-     * is not misreported as a change that stuck.
+     * The working directory of an attempt that may run in a worktree — which
+     * attempts do is the attempt kind's to say (see `attemptKind.attemptCwd`):
+     * the worktree prepared for it in an isolated run, the kept one for a
+     * conflict repair, else the workspace root. `worktree` says which. Does not
+     * itself report a worktree it creates as a change — the caller does once
+     * the attempt is committed as running, so a spawn abandoned or failed after
+     * this settles is not misreported as a change that stuck.
      */
     attemptCwd(task: Task, opts: {
         repair: boolean;
-        ops?: boolean;
     }): Promise<{
         cwd: string;
         worktree: boolean;
     }>;
+    /** The workspace root, for an attempt that runs outside any worktree. */
+    workspaceCwd(task: Task): Promise<{
+        cwd: string;
+        worktree: boolean;
+    }>;
+    private reopenCwd;
+    private prepareCwd;
     /**
      * Land a task's work on the run's integration branches. The record is
      * reported changed once the landing is set and before the first merge, so
@@ -1654,10 +1669,11 @@ declare class IsolationRunController {
      */
     refreshInHead(): Promise<boolean>;
     /**
-     * The tracked state of the workspace as an ops task starts, for
-     * {@link filesChangedSince} (ADR-0020). Null where the check does not run:
-     * a run that shares the workspace root, where every task's edits land in
-     * it, or a workspace git cannot isolate at all.
+     * The tracked state of the workspace as an attempt whose tree is checked
+     * starts (see `attemptKind.checksTree`), for {@link filesChangedSince}
+     * (ADR-0020). Null where the check does not run: a run that shares the
+     * workspace root, where every task's edits land in it, or a workspace git
+     * cannot isolate at all.
      */
     snapshotWorkspace(): Promise<TreeSnapshot | null>;
     /** Tracked files changed since `snapshot`; none when the run has since gone on in the workspace root. */
@@ -1672,7 +1688,9 @@ declare class IsolationRunController {
     /**
      * Mark which added task resolves which conflict. The resolver merges the
      * conflicted task's branch by hand in its own worktree; once that lands, the
-     * conflicted task can land in turn.
+     * conflicted task can land in turn — through the same merge, so a resolver
+     * that did not really bring it along conflicts again instead of being taken
+     * at its word.
      */
     linkResolver(resolverId: string, conflictedId: string): void;
     /** The conflicted task a landed resolver was added for, forgotten as it is returned. */
@@ -1687,11 +1705,28 @@ declare class IsolationRunController {
      * HEAD somehow does not contain stays for the next run's sweep.
      */
     merge(): Promise<IsolationMergeResult>;
-    /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
+    /**
+     * Worktrees and task branches go; the integration branch and the record stay
+     * for review and merge. Refused while a task of the run is still live.
+     */
     cleanup(): Promise<void>;
-    /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
+    /**
+     * The run and everything it made go, and the plan forgets it; the next run
+     * starts afresh. Refused while a task of the run is still live.
+     */
     discard(): Promise<void>;
+    /** The records of tasks still live, whose worktrees no clean-up of the whole run may take. */
+    private liveRecords;
+    private refuseWhileLive;
+    /**
+     * Clear a settled run up once everything it landed is merged — and only
+     * when nothing else is left in it: a live task, or a worktree holding work
+     * that never landed, keeps the whole run, worktrees and branches, rather
+     * than leaving that work to a deletion.
+     */
     private clearMerged;
+    /** Say what a removal kept back instead of deleting: where the work went, or which worktree stayed. */
+    private report;
     private forget;
     private assess;
     private activate;
@@ -2008,8 +2043,18 @@ declare class TaskOrchestrator {
      * task whose spawn always throws.
      */
     private onHold;
-    /** The plan's isolation run and the open run's lifecycle (ADR-0013); see {@link IsolationRunController}. */
-    private runs;
+    /**
+     * Tasks Mark complete is landing after it ended their attempt: in progress
+     * with no attempt for as long as that takes, and not orphans for it.
+     */
+    private completing;
+    /**
+     * The plan's isolation run and the open run's lifecycle (ADR-0013); see
+     * {@link IsolationRunController}. Read and acted on there directly, except
+     * Merge all: that goes through {@link mergeRun}, which keeps it apart from
+     * ops tasks and starts the tasks its merge lets through.
+     */
+    readonly runs: IsolationRunController;
     /** A passed attempt's work onto the integration branch, and the conflict repair a landing may need. */
     private landing;
     private registry;
@@ -2054,13 +2099,24 @@ declare class TaskOrchestrator {
     private envForTask;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason?: string): void;
-    private atCheckpoint;
+    /** What the task's waiting checkpoint asks, whole; undefined once it settles or when none waits. */
+    getCheckpointQuestion(taskId: string): string | undefined;
+    awaitsCheckpoint(taskId: string): boolean;
     /**
      * Send a structured task a user message (ADR-0018, M1). Mid-turn it queues
      * behind the turn; a task waiting for input takes it at once and is back in
      * progress. Returns the message's id, for {@link removeQueuedTaskMessage}.
      */
     sendTaskMessage(taskId: string, text: string): string;
+    /**
+     * Force send (ADR-0023, F1–F3): interrupt the running turn and deliver the
+     * message as the next one, ahead of anything queued, without the task
+     * waiting for input in between. A task already waiting for input just takes it.
+     */
+    forceSendTaskMessage(taskId: string, text: string): string;
+    private messageTask;
+    /** Force send a message still queued behind the running turn; false once the runner has it. */
+    forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
     /** Take back a message still queued behind a turn; false once it was delivered. */
     removeQueuedTaskMessage(taskId: string, id: string): boolean;
     /** Stop a structured task's running turn; it then waits for input like any turn that ends without its marker. */
@@ -2095,30 +2151,13 @@ declare class TaskOrchestrator {
     /** Task id → session id of every attempt whose runner is up; a spawn in flight has no session yet. */
     get activeSessionMap(): Map<string, string>;
     getAttempt(taskId: string): TaskAttemptSnapshot | undefined;
-    /** Where a task's isolated work stands; null when the plan has no isolation run to speak of. */
-    getTaskIsolation(taskId: string): TaskIsolation | null;
-    /**
-     * The plan's isolation as a surface shows it, for one with no stream to have
-     * told it — a reconnected webview, a session just loaded. Null without a run.
-     */
-    isolationView(): IsolationView | null;
     getAttemptSession(taskId: string): ITerminalSession | undefined;
     get queuedCount(): number;
-    /** A run is waiting on the user to stash or to go on without isolation. */
-    get awaitingIsolationChoice(): boolean;
-    /**
-     * Take over a plan's persisted isolation, or none for a plan that has not
-     * isolated yet, pruning what a crashed process left behind. Silent on the
-     * observer: adopting is not a change to persist.
-     */
-    adoptIsolation(state: PlanIsolation | null): Promise<void>;
-    reviewRunDiff(): Promise<string>;
     /**
      * "Merge all"; a settled run that merged everything is cleared up and
      * forgotten. During a run it merges what has landed and the run goes on:
      * the tasks waiting at a merge gate for that work then start (ADR-0020).
-     * Never while an ops task runs, and no ops task starts until it ends — the
-     * one overlap the plan cannot order, because the merge is the user's.
+     * Never alongside ops work, either way round ({@link mergeExcludes}).
      */
     mergeRun(): Promise<IsolationMergeResult>;
     /**
@@ -2133,13 +2172,7 @@ declare class TaskOrchestrator {
      * the task has started, and for every other task.
      */
     getMergeGate(taskId: string): string[];
-    /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
-    cleanupRun(): Promise<void>;
-    /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
-    discardRun(): Promise<void>;
     private watchBlockingPrompts;
-    /** What the plan persists of isolated execution; null when no run ever isolated. */
-    get isolationRecord(): PlanIsolation | null;
     /** The transport the plan's latest run copied from the setting; null before its first run. */
     get runnerTransport(): RunnerTransport | null;
     /** Take over a saved plan's copied transport. The next run copies the setting afresh. */
@@ -2167,6 +2200,30 @@ declare class TaskOrchestrator {
     start(): Promise<void>;
     private haltOnFailure;
     stop(): void;
+    /** Name the tasks a stop took down, so none is mistaken for one still at work. */
+    private sayStopped;
+    /**
+     * A task in progress with no attempt has nothing running it: a stop, a plan
+     * load or anything else that ended its attempt left its status behind. It
+     * is put back to not started, and said, so it can be retried rather than
+     * read as running — or, in an isolated run, count as live work forever.
+     */
+    private recoverOrphans;
+    /**
+     * Task ids still live, whose worktrees no clean-up of the whole run may
+     * take: an attempt is running them, or the plan has them in progress or
+     * waiting on the user mid-attempt — at a checkpoint, or for input. One
+     * waiting on the user's decision instead (a conflict, a usage limit, files
+     * an ops task changed) is not: no runner is at work on it, and a clean-up
+     * keeps what it holds on a branch before its worktree goes.
+     */
+    private liveTaskIds;
+    /**
+     * Whether the run may close with its handoff: no task is live. A handoff
+     * tells the user the run has finished, and a Merge all after it clears the
+     * run up, so neither may happen under a task the plan still shows at work.
+     */
+    private get settled();
     onUserTaskComplete(taskId: string): Promise<void>;
     private onVerdict;
     private afterVerdict;
@@ -2192,24 +2249,17 @@ declare class TaskOrchestrator {
      * the ending attempt freed and never one more than the run allows.
      */
     private settleUnlanded;
-    /**
-     * Mark which added task resolves which conflict. The resolver merges the
-     * conflicted task's branch by hand in its own worktree; once that lands, the
-     * conflicted task's branch is already on the integration branch and it can
-     * land in turn — through the same merge, so a resolver that did not really
-     * bring it along conflicts again instead of being taken at its word.
-     */
-    linkConflictResolver(resolverId: string, conflictedId: string): void;
     private landResolved;
     getReadyTasks(): Task[];
     private readiness;
     /**
-     * Open the run a task starts in, and for a change task decide whether it
-     * isolates (ADR-0020): an ops task needs no worktree, so it never waits on
-     * that choice. False while a dirty tree waits on the user; `resume` is what
-     * their choice replays.
+     * Open the run a task starts in, and decide whether it isolates if the
+     * task's next attempt needs that ({@link decidesIsolation}). False while a
+     * dirty tree waits on the user; `resume` is what their choice replays.
      */
     private openFor;
+    /** The kind a task's next attempt starts as, short of a repair or a continue: what is weighed before one exists. */
+    private nextAttemptKind;
     /**
      * Cancel a running (or scheduled) task: kill its session and return it to
      * 'pending' — "not executed". The task is put on hold so the scheduler
@@ -2321,11 +2371,6 @@ declare class TaskOrchestrator {
     private abandonSpawn;
     private tell;
     private say;
-    /**
-     * Whether the run in force, or else the next one, gives each task its own
-     * worktrees, and of which repo group — what the planner is told.
-     */
-    plannerIsolation(): Promise<IsolatedExecution>;
     /**
      * Replay the start a dirty tree turned away. `stash` puts the user's tracked
      * changes on the git stash first, so the run isolates; `shared` runs this one
@@ -2518,7 +2563,9 @@ declare class RunnerInstallation {
      * typing a real goal is the failure this exists to prevent.
      *
      * "Usable" is deliberately shallow: the binary answers `--version`, and the
-     * runner declares a planner transport. Whether the user's subscription is
+     * runner has a connector to plan over. Plugin runners have none yet: a
+     * manifest-level planner capability, so a plugin can declare itself
+     * plannable, is a follow-up. Whether the user's subscription is
      * live cannot be known without spending a turn on it, so an expired login
      * surfaces where it actually bites — as the agent's own error text on the
      * first turn.
@@ -2672,7 +2719,7 @@ interface EnvAdmission {
  */
 declare function admitSettingsEnv(env: Record<string, unknown>): EnvAdmission;
 
-/** Whether a runner's tasks can run on the structured transport. */
+/** Whether a runner's tasks can run on the structured transport (ADR-0018, S3). */
 declare function supportsTaskMode(runner: string): boolean;
 /** The adapter that drives one task. Throws {@link TaskModeUnsupportedError} for a runner without a connector. */
 declare function createTaskAdapter(runner: string, deps: AgentProcessDeps): TaskModeAgentAdapter;
@@ -2802,8 +2849,12 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     private pendingResume;
     /** The `--mcp-config` file of the running process, which holds its token; removed with the process. */
     private mcpConfig;
-    /** `mcp__ordewell__`, once this process was given the server. */
-    private ordewellToolPrefix;
+    /** Whether this process was given the server, so its tools' requests are Ordewell's own. */
+    private givenOrdewell;
+    /** Messages written into a running task turn, by the `uuid` their echo will carry, until it does (ADR-0023). */
+    private readonly steers;
+    /** The last turn's `result` ended it, so a steer's echo now opens a turn the CLI started for that message. */
+    private turnClosed;
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
     /**
      * A task's run: the manifest decides what its mode and effort mean
@@ -2814,13 +2865,7 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * without it `-p` refuses them silently and nothing can ever surface one.
      */
     private taskSpawnSpec;
-    /**
-     * `--mcp-config` takes a path as well as inline JSON; the path keeps the
-     * token out of the argv every local user can list (ADR-0022, A5). The file
-     * lives exactly as long as the process that reads it. `alwaysLoad` because
-     * the CLI otherwise defers MCP tools behind its tool search, and a model
-     * that has to look an Ordewell tool up first tends to go on without it.
-     */
+    /** The file holding the token lives exactly as long as the process that reads it. */
     private ordewellServerArgs;
     private removeMcpConfig;
     start(opts: AgentStartOptions): Promise<void>;
@@ -2833,6 +2878,15 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * as an interrupted `turn_end`.
      */
     interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * A `user` line written mid-turn is Claude Code's own queue (ADR-0023): the
+     * CLI attaches it to the next tool result, or runs it as a turn of its own
+     * after `result` — an interrupted one included — so it never lets go of one,
+     * and nothing is ever reported dropped. Refused while an interrupt is in
+     * flight, and before a `--resume` is taken up: a refused resume closes stdin
+     * with the message unread.
+     */
+    steer(id: string, text: string): Promise<boolean>;
     /** Send a control request and wait for its answer; null when none came in time or the process ended. */
     private control;
     /**
@@ -2852,6 +2906,13 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     dispose(): void;
     private clearFollowOnTimer;
     protected turnPayload(message: string): string;
+    private openTurnState;
+    /**
+     * The echo of a steered message: the model has it. After a closed turn it
+     * opens the CLI's own turn for the message, which then runs like one Ordewell
+     * sent. The first prompt is echoed too, and is no steer.
+     */
+    private steerDelivered;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
     /**
      * `--permission-mode auto` on a model or account without auto mode is not
@@ -2919,10 +2980,7 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private startOpts;
     /** Whether this turn has already emitted prose — see the `agentMessage` case. */
     private turnHasText;
-    /**
-     * The turn in flight. Its id arrives with `turn/started` or the `turn/start`
-     * response, whichever lands first; `turn/interrupt` cannot be sent without it.
-     */
+    /** The turn in flight. `turn/interrupt` and `turn/steer` cannot be sent before it has an id. */
     private turn;
     /** The JSON-RPC id of the `turn/start` that opened {@link turn}. */
     private turnRequestId;
@@ -2930,6 +2988,12 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private endedTurnId;
     /** An interrupt was asked for during this turn, so however it ends, it was cut short. */
     private interruptRequested;
+    /**
+     * Turns an interrupt cut short. Codex leaves their command running and
+     * reports it when it ends, inside whatever turn is live by then — a report
+     * that belongs to no turn of the agent's any more (ADR-0023, F4).
+     */
+    private readonly interruptedTurnIds;
     /** An interrupt asked for before Codex named the turn, sent once it does. */
     private interruptOnStart;
     /** A task's approval requests still waiting for an answer, by the request id as a string. */
@@ -2988,6 +3052,17 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * with an empty result, then ends the turn as `interrupted`.
      */
     interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * `turn/steer` into the running turn (ADR-0023). Codex answers with the
+     * turn's id at once — acceptance, not delivery — and shows the input to the
+     * model after the item in flight, as a `userMessage` item carrying the
+     * `clientUserMessageId` sent; that item is the delivery. The request needs
+     * the turn's id, so a steer asked for before Codex named the turn waits for
+     * it, as an interrupt does. Refused when the turn has ended or is another one.
+     */
+    steer(id: string, text: string): Promise<boolean>;
+    /** The one way input reaches a running turn: a task message, or a deny note. */
+    private requestSteer;
     /**
      * Answer an open approval in its own result schema. Codex's decline carries
      * no message, so a deny note reaches the agent as input steered into the
@@ -2997,7 +3072,15 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     protected turnPayload(message: string): string;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
     private turnStarted;
+    /**
+     * Ahead of the event that ends the turn: a steer Codex accepted and the turn
+     * never consumed is gone — Codex keeps no queue across turns — and one not
+     * yet accepted never will be (ADR-0023, D4).
+     */
     private closeTurn;
+    private fromInterruptedTurn;
+    /** The `userMessage` item a steer turns into once the item before it completes: the model has it. */
+    private steerDelivered;
     /**
      * The child thread id when `threadId` names a subagent's thread, or undefined
      * for the planner's own. Codex replays both threads on one stream and only
@@ -3094,15 +3177,14 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     private readonly processEnded;
     private planner;
     private task;
-    /** Whether this turn has already emitted reply text — see {@link emitPart}. */
-    private turnHasText;
     /** The last assistant message already settled — the baseline {@link recoverReply} measures a new reply against. */
     private lastAssistantId;
     private taskTurn;
     /** An abort was posted during the current task turn, so the idle that follows ends it as interrupted. */
     private interruptRequested;
-    /** A task's requests waiting for an answer, by request id, with the session that asked. */
-    private readonly openPermissions;
+    private readonly permissions;
+    /** Messages handed into the running task turn, until the model reads them (ADR-0023). Kept across turns: the server keeps the message too. */
+    private readonly steers;
     /** Set once the server turns out to speak the 2.x API, which then owns the session. */
     private v2;
     /** The Ordewell server this process was configured with; null when none was given or its config could not be merged. */
@@ -3120,6 +3202,20 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * {@link recoverReply}, never applies.
      */
     private sendTask;
+    /**
+     * The prompt that carries a task message: the mode as the agent, the task
+     * model and effort, and only `question` withheld. A steer names its own
+     * `messageID` so the frames can be told apart from the first prompt's.
+     */
+    private taskPromptBody;
+    /** Hand a message into the running task turn (ADR-0023, D2), naming it so its delivery is observable. */
+    steer(id: string, text: string): Promise<boolean>;
+    /**
+     * Messages handed over but unread when the turn ended. Each is deleted from
+     * the session — so the next turn's re-send is not a duplicate — and reported
+     * dropped, which is what puts it back in Ordewell's queue.
+     */
+    private dropUnreadSteers;
     /**
      * Whatever of the turn's own messages the stream missed. Each part is
      * emitted once, so a turn the stream saw whole adds nothing here; one that
@@ -3207,48 +3303,15 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * none of this turn's business.
      */
     private onFrame;
-    /**
-     * Stream one piece of a reply text part. The part's paragraph break goes out
-     * with its first visible delta, so the deltas add up to exactly the text the
-     * completed part then re-sends; a part that is only whitespace so far is
-     * held back, for the reason {@link emitPart} drops one.
-     */
-    private onTextDelta;
-    /**
-     * Deny one permission request (T1). OpenCode blocks the turn until the
-     * request is answered, so this must answer — `reject` rather than a silent
-     * drop, which is the same "absent answer is a denial" invariant ADR-0008
-     * states for Ordewell's own tools. The refusal is announced so the timeline
-     * shows the planner reaching for something it may not have.
-     */
-    private denyPermission;
-    /**
-     * A task's request. Under a mode whose manifest sets `approvals: auto` —
-     * `build`, which the terminal transport runs with `--auto` — it is answered
-     * at once with what `run --auto` answers, so the same plan behaves the same
-     * on both transports (ADR-0001), and announced already decided so the log
-     * still shows it. Any other mode leaves it open for an approval card.
-     */
-    private askPermission;
+    /** A planner's request is refused (T1); a task's is answered at once or left open for a card. */
+    private onPermissionAsked;
     /**
      * `POST /permission/:id/reply` is the current answer. The per-session path
      * it replaced is tried only when a server too old to know the new one 404s.
      */
     private replyPermission;
-    /**
-     * Open `/event` for one turn and wait until it is connected. The stream
-     * stopped being best-effort the moment permission answers moved onto it: a
-     * request raised before we connect is one nobody answers, and the turn
-     * hangs on it. Waiting is bounded so a server that never opens `/event`
-     * still gets its turn.
-     */
+    /** `/event` for one turn — see {@link openEventStream}. Load-bearing for {@link onPermissionAsked}. */
     private openStream;
-    /**
-     * Server-sent events from `/event`: the turn's live text, reasoning, tool
-     * activity and usage, and the only channel permission requests arrive on —
-     * so the stream is load-bearing for {@link denyPermission}.
-     */
-    private streamEvents;
     private json;
     private request;
     private headers;
@@ -3694,11 +3757,14 @@ interface SessionEventRelayDeps {
     /** Where isolation notices go, for a host whose notifications are not seen by the user. */
     onNotice?: (notice: SessionNotice) => void;
     store: Pick<PlanStore, 'allTasks' | 'snapshot'>;
-    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getTaskIsolation' | 'getQueuedTaskMessages' | 'getMergeGate' | 'mergeGateView'>;
+    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getQueuedTaskMessages' | 'getMergeGate' | 'mergeGateView'>;
+    runs: Pick<IsolationRunController, 'taskIsolation'>;
     /** Shared with the Session, which snapshots, restores and clears it. */
     usage: PlannerUsageLedger;
     /** How many of a task's runner requests wait for an answer (ADR-0018, A1). */
     awaitingApproval?: (taskId: string) => number;
+    /** What a task's waiting checkpoint asks, whole. */
+    checkpointQuestion?: (taskId: string) => string | undefined;
 }
 /** Every orchestrator event the relay announces; `onTaskSettled` is persistence only, so it is the Session's. */
 type RelayObserver = Required<Omit<OrchestratorObserver, 'onTaskSettled'>>;
@@ -3713,8 +3779,10 @@ declare class SessionEventRelay {
     private readonly onNotice?;
     private readonly store;
     private readonly orchestrator;
+    private readonly runs;
     private readonly usage;
     private readonly awaitingApproval;
+    private readonly checkpointQuestion;
     /**
      * The in-flight turn's subagent activity, grouped one run per subagent so a
      * replay nests each step under its own brief/result. Folded into the plan's
@@ -3780,16 +3848,6 @@ declare function openTaskLog(location: TaskLogLocation, taskId: string): TaskLog
  */
 declare function readTaskLog(location: TaskLogLocation, taskId: string, attempt: number): TaskLogEvent[];
 
-/**
- * A direct (non-planner) plan edit the session refused. Distinct from a plain
- * Error so a surface can tell "you asked for something invalid" from "something
- * broke" and say which — the HTTP routes used to collapse both into 404/500,
- * which read to the TUI and VS Code as the edit silently doing nothing. Carries
- * no status code: core is transport-agnostic, the route maps it.
- */
-declare class PlanEditError extends Error {
-    constructor(message: string);
-}
 /**
  * Options for plan generation. Progress is not overridable: every planner
  * progress event is translated to a SessionMessage inside the Session and
@@ -3921,6 +3979,8 @@ interface SessionParts {
     planner: SessionPlanner;
     store: PlanStore;
     orchestrator: TaskOrchestrator;
+    /** The orchestrator's own: Session reads the run and acts on it there, Merge all aside. */
+    runs: IsolationRunController;
     events: SessionEventRelay;
     usage: PlannerUsageLedger;
     approvals: PendingApprovals;
@@ -3949,6 +4009,7 @@ declare class Session {
     private readonly events;
     private readonly planner;
     private readonly orchestrator;
+    private readonly runs;
     private readonly store;
     private readonly config;
     private readonly registry;
@@ -3971,6 +4032,7 @@ declare class Session {
     private currentSessionId;
     private readonly skillsService;
     private readonly conversation;
+    private readonly editor;
     private readonly plannerTools;
     constructor(parts: SessionParts);
     /**
@@ -4067,6 +4129,8 @@ declare class Session {
      * variants, not as an id-only stub. Never triggers discovery itself.
      */
     private models;
+    /** What a runner offers, as `runnerAssignment` needs it. Spawns the runner's CLI to list models. */
+    private catalogFor;
     get planState(): LegacyPlanState | null;
     /**
      * The live plan in the shape a saved session is read back as. The disk
@@ -4221,12 +4285,21 @@ declare class Session {
     private finishedWork;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason?: string): void;
+    /** Whether an answer would reach the task: it waits at a checkpoint and a runner is left to hear it. */
+    awaitsCheckpoint(taskId: string): boolean;
     /**
      * A user message to a structured task (ADR-0018, M1); throws
      * `TaskControlError` for one that cannot take it. A task waiting for input
      * is back in progress, and saved so before any surface is told.
      */
     sendTaskMessage(taskId: string, text: string): string;
+    /**
+     * Force send (ADR-0023, F1): interrupt the task's running turn and deliver
+     * this message next. Throws `TaskControlError` where a plain message would,
+     * and for a task on the terminal transport.
+     */
+    forceSendTaskMessage(taskId: string, text: string): string;
+    forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
     removeQueuedTaskMessage(taskId: string, id: string): boolean;
     interruptTask(taskId: string): Promise<void>;
     getQueuedMessages(): QueuedMessage[];
@@ -4267,14 +4340,7 @@ declare class Session {
      */
     discardRun(): Promise<void>;
     private requireSettledRun;
-    /**
-     * The opt-in way through a merge conflict: add an AI task, on the conflicted
-     * task's own runner and model, that merges its branch by hand in a worktree
-     * of its own. When that task lands, the conflicted one lands through it (see
-     * {@link TaskOrchestrator.linkConflictResolver}). The automatic answer to a
-     * conflict is a repair, a new attempt of the same task (ADR-0015); a task is
-     * only ever added to the plan by this call.
-     */
+    /** Add the task that merges a conflicted task's branch by hand; see {@link PlanEditor.addConflictResolver}. */
     resolveConflictAsTask(taskId: string): Promise<LegacyPlanState | null>;
     stopExecution(): void;
     /**
@@ -4283,88 +4349,19 @@ declare class Session {
      * broadcast — in that order, once. A store op returning false aborts
      * before anything is persisted. PlanStore is the single authority for
      * task state; LegacyPlanState.tasks is populated only at persist time.
+     * Direct edits reach it through the {@link PlanEditor}, which adds the
+     * reschedule they owe.
      */
     private mutatePlan;
-    /**
-     * The direct-edit seam: {@link mutatePlan} plus the reschedule every
-     * structural edit owes an armed scheduler. Nothing else wakes one after a
-     * hand edit — the queue-drain path never runs, because a direct edit never
-     * queues — so a task the edit just unblocked would sit ready and never
-     * start. `tick()` no-ops while the scheduler is idle, so this costs nothing
-     * during plain planning. The planner-driven path re-ticks in
-     * {@link PlannerConversation} instead (`afterEdit`); it must not tick twice.
-     */
-    private editPlan;
-    /**
-     * Patch one task's fields. A hand-set dependency list, or a type flip
-     * between AI and MAN, are the patches that can leave a task incoherent
-     * (unschedulable, or carrying fields that mean nothing for its new type),
-     * so both go through the same {@link validateTaskEdit} guard the planner's
-     * task-ops applier uses (as the 'direct' actor, which skips the lock rule)
-     * rather than a second copy of the rules — and throws, so the surface can
-     * say why. Gated on the task existing so an edit to an unknown id still
-     * falls through to the no-op `store.update` below instead of throwing.
-     */
+    /** Patch one task's fields, checked as the planner's task ops are; see {@link PlanEditor.updateTask}. */
     updateTask(taskId: string, changes: Partial<Task>): Promise<LegacyPlanState | null>;
-    /**
-     * Move one task onto a different runner. Distinct from {@link updateTask}
-     * because a runner change is never a single-field edit: the task's model,
-     * thinking effort and mode are all scoped to its runner, so they are
-     * re-derived from the new runner's catalog (see {@link retargetTaskRunner}).
-     * That needs discovery, which is why it is not a branch inside `updateTask`.
-     *
-     * The runner is also admitted into `plan.runners` — see {@link admitRunner}.
-     */
+    /** Move one task onto a different runner, re-deriving what is scoped to it; see {@link PlanEditor.setTaskRunner}. */
     setTaskRunner(taskId: string, runner: RunnerId): Promise<LegacyPlanState | null>;
-    /** What a runner offers, as {@link runnerAssignment} needs it. Spawns the runner's CLI to list models. */
-    private catalogFor;
-    /**
-     * What a *derived* assignment may draw from: the runner's catalog narrowed to
-     * the user's allowlist. Deriving from the full catalog would hand a task the
-     * runner's first model regardless of a restriction the user set — the next
-     * planner turn's `coerceAssignments` would snap it back anyway, so the user
-     * would see their pick silently change instead of never being offered.
-     *
-     * `catalogFor` stays unnarrowed because {@link admitRunner} caches it as what
-     * the runner really offers, which is what effort clamping needs.
-     */
-    private allowedCatalog;
-    /**
-     * Make a runner a first-class member of this plan. Without this, the next
-     * planner turn's `coerceAssignments` would treat it as disallowed and snap
-     * every task on it back, silently undoing the user's choice; and that same
-     * pass clamps efforts against `modelsCache`, so a catalog missing from there
-     * makes the effort we just derived read as unverifiable.
-     */
-    private admitRunner;
-    /**
-     * Replace one task's dependency list — the named entry point the surfaces'
-     * dependency pickers call. The guard itself lives in {@link updateTask}, so
-     * a dependency list arriving as a plain field patch is rejected by the same
-     * rule instead of slipping past it.
-     */
+    /** Replace one task's dependency list, under the same guard as a field patch; see {@link PlanEditor.setTaskDependencies}. */
     setTaskDependencies(taskId: string, dependencies: string[]): Promise<LegacyPlanState | null>;
-    /**
-     * Delete one task. A running task is cancelled first: the plan can drop it
-     * either way, but nothing can reach its runner afterwards — the tmux session
-     * outlives the plan and the orchestrator keeps counting it as active. The
-     * planner-driven path refuses instead (see {@link applyTaskOps}); a user
-     * deleting their own task means it.
-     */
+    /** Delete one task, cancelling its runner first if it runs; see {@link PlanEditor.removeTask}. */
     removeTask(taskId: string): Promise<LegacyPlanState | null>;
-    /**
-     * Add one task, filling in whatever the caller left unset. A task with no
-     * runnable assignment is not a lighter task but an unspawnable one, so the
-     * runner falls back to the plan's first and the model, effort and mode are
-     * derived from that runner's catalog — the same derivation a runner change
-     * uses ({@link runnerAssignment}), which is why this is async like
-     * {@link setTaskRunner}. Anything the caller did choose survives when the
-     * runner offers it.
-     *
-     * Dependencies naming tasks that don't exist are dropped rather than rejected:
-     * the caller is a picker over the current plan, so a stale id means the plan
-     * moved on, not that the whole task should be refused.
-     */
+    /** Add one task, deriving what the caller left unset; see {@link PlanEditor.addTask}. */
     addTask(draft: Partial<Task>): Promise<LegacyPlanState | null>;
     /**
      * Planner-driven merge: validate compatibility up front, then ask the planner
@@ -4389,6 +4386,19 @@ declare class Session {
     get aiServiceInstance(): IAiService;
 }
 
+/**
+ * A request on the plan the session refused: a direct (non-planner) edit that
+ * is not valid, or an isolation action on a plan with no isolated run to act
+ * on. Distinct from a plain Error so a surface can tell "you asked for
+ * something invalid" from "something broke" and say which — the HTTP routes
+ * used to collapse both into 404/500, which read to the TUI and VS Code as the
+ * edit silently doing nothing. Carries no status code: core is
+ * transport-agnostic, the route maps it.
+ */
+declare class PlanEditError extends Error {
+    constructor(message: string);
+}
+
 /**
  * Where Ordewell keeps machine-global data (settings, daemon tokens, caches,
  * user plugins). A single home for everything not tied to a project directory,
@@ -4419,6 +4429,8 @@ type CheckpointWithdrawnListener = (taskId: string) => void;
 type IdleListener = (taskId: string, idleSince: string | null) => void;
 declare class VerdictEngine {
     private markerSeen;
+    private pendingVerdicts;
+    private structuredSessions;
     private markerTails;
     private checkpointCarry;
     private pausedSessions;
@@ -4431,6 +4443,8 @@ declare class VerdictEngine {
      * answer is typed into the session instead.
      */
     private toolCheckpoints;
+    /** The question a task's checkpoint asks, whole, for as long as it waits — by either route. */
+    private checkpointQuestions;
     private idleListeners;
     /**
      * Per-task generation. Replaced on every watch(), clear() and verdict.
@@ -4479,6 +4493,8 @@ declare class VerdictEngine {
      * `\n`-terminated line, and the leading newline flushes a partial line.
      */
     private resumeToken;
+    /** What a task's waiting checkpoint asks, untruncated; undefined when none waits. */
+    getCheckpointQuestion(taskId: string): string | undefined;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason: string): void;
     /**
@@ -4497,6 +4513,10 @@ declare class VerdictEngine {
      * task's current one or another signal already settled it.
      */
     signalComplete(taskId: string, generation: number, report: TaskCompleteArgs): void;
+    /** The runner was told something after its evidence so far, so only what it reports from here counts. */
+    private supersede;
+    private acceptVerdict;
+    private publishVerdict;
     /**
      * The runner's `checkpoint` call (ADR-0022, V5): raised through the same
      * listeners as the marker, so the task waits on the user the same way, and
@@ -4504,6 +4524,8 @@ declare class VerdictEngine {
      * withdrawn, never left hanging, once the attempt is over or the call goes.
      */
     raiseCheckpoint(taskId: string, generation: number, question: string, signal: AbortSignal): Promise<CheckpointAnswer>;
+    /** The open `checkpoint` call can no longer be answered: refuse it, and let the task out of the wait. */
+    private callWentAway;
     private withdrawToolCheckpoint;
     private approvalOpened;
     private approvalClosed;
@@ -5067,8 +5089,9 @@ interface SessionLaunch {
  * an `ITerminalSession`, so everything downstream of `onOutput` is unchanged;
  * what a terminal cannot do sits on {@link StructuredSessionCapability}.
  *
- * Ordewell owns the message queue (M1): a message sent mid-turn waits for the
- * turn to end rather than being typed into a runner that is busy.
+ * Ordewell owns the message queue (M1). A message sent mid-turn is handed to a
+ * runner that can take one at its next step (ADR-0023); otherwise it waits for
+ * the turn to end rather than being typed into a runner that is busy.
  */
 declare class StructuredSession extends AbstractTerminalSession implements StructuredSessionCapability {
     private readonly launch;
@@ -5112,13 +5135,36 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     private issueTools;
     private revokeTools;
     protected baseHandleExit(code: number): void;
-    /** A reply typed at the task — a checkpoint answer, most often — is a user message. */
+    /**
+     * A reply typed at the task — a checkpoint answer, most often — is a user
+     * message like any other: into the running turn where the runner takes one,
+     * else the next turn. A runner that stopped to ask reads it at once either way.
+     */
     write(text: string): void;
     kill(): void;
     turnState(): 'working' | 'idle';
     onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
     onEvent(listener: (event: StructuredEvent) => void): void;
     sendMessage(text: string): string;
+    /**
+     * Force send (ADR-0023, F1–F3): interrupt the running turn — and the tool
+     * call in flight — then deliver this message as the turn that replaces it,
+     * ahead of everything still queued. With no turn to interrupt it is a plain
+     * {@link sendMessage}.
+     */
+    forceSend(text: string): string;
+    /** Force send a message still waiting in the queue. False once the runner has it, or it is gone. */
+    forceSendQueued(id: string): boolean;
+    /**
+     * Behind earlier forced messages and ahead of the rest, handed-over ones
+     * included: what the runner already has is the runner's to order (F2). Held
+     * back from steering while the interrupt runs, it opens the next turn — and
+     * a queue that is not empty when the turn ends is what keeps the task out of
+     * "waiting for input" between the two (F3).
+     */
+    private force;
+    private runningTurn;
+    /** No runner can recall a message once offered to it, so only a queued one comes back. */
     removeQueued(id: string): boolean;
     queued(): QueuedTaskMessage[];
     nativeSessionId(): string | null;
@@ -5136,6 +5182,16 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     private startAdapter;
     private openTurn;
     private deliver;
+    /**
+     * Offer the oldest queued message to the running turn (ADR-0023, D2), one at
+     * a time so the runner takes them in the order they were sent. A refusal
+     * leaves it, and everything behind it, for the turn's end.
+     */
+    private offerNext;
+    private steered;
+    private delivered;
+    /** Back to waiting in Ordewell's queue, removable again; the log hears of it only if it had shown as handed over. */
+    private requeue;
     private route;
     /**
      * The runner spoke with no message of ours in flight. When it is working — a
@@ -5150,9 +5206,17 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     /**
      * A queued message goes out as the turn closes, and the state never passes
      * through `idle` on the way, so a listener told the turn ended can already
-     * see the task is not waiting.
+     * see the task is not waiting. Nor does a message the runner owes, or one
+     * still being offered: the runner is about to read it, or Ordewell to send
+     * it (ADR-0023, D5).
      */
     private endTurn;
+    /**
+     * Between turns the oldest message opens the next one — but only once it is
+     * back in Ordewell's hands: while it is on offer or owed, nothing overtakes it.
+     */
+    private deliverNext;
+    private undeliverQueued;
     private emitEvent;
 }
 /**