@ordewell/core 0.7.0 → 0.7.2

package/dist/index.d.ts

@@ -1,15 +1,15 @@
-import { aX as RunnerId, av as PlanStatus, a9 as LegacyPlanState, L as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, O as ITerminalRunner, M as IConfig, h as AiProvider, aJ as ProviderModelLists, m as ApprovalMode, _ as IsolationMergeResult, W as IsolationLandedTask, Q as IWorktreeIsolation, a5 as IsolationTaskStatus, as as PlanIsolation, b0 as RunnerTransport, aQ as RepoGroupLayout, P as ITerminalSession, y as DiscoveredModel, bc as Task, f as AgentProcessDeps, c as AgentAdapter, ap as OrdewellMcpServer, aS as ResearchProgress, aR as ResearchLogEntry, w as ConversationMessage, ay as PlannerToolHandler, bz as UsageRecord, bo as TaskSnapshot, r as AwaitingReason, T as IsolationHandoff, a2 as IsolationRun, a3 as IsolationTaskRecord, be as TaskIsolation, a6 as IsolationView, $ as IsolationOutcome, aP as RepairEvidence, bx as TreeSnapshot, bG as Verdict, a_ as RunnerRegistry, aO as QueuedTaskMessage, aN as QueuedMessage, b as ActiveTaskSession, ao as OrchestratorOption, bh as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aV as ResearchToolType, az as PlannerUsage, n as ApprovalPolicy, au as PlanState, bd as TaskCompleteArgs, t as CheckpointAnswer, aY as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, b1 as RunnerVersionProbe, b6 as StructuredSessionCapability, bp as TaskStartOptions, br as TaskTokenScope, b7 as StructuredTurnEnd, b5 as StructuredEvent, a$ as RunnerSpawnOptions, N as IPluginStore, aZ as RunnerPluginManifest, aW as ResolveContext, bn as TaskRunnerFlags } from './Task-CoKhvBa1.js';
-export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, u as CheckpointArgs, v as CommandLineTooLongError, D as DENY_ALL, x as DiscoveredMode, z as DiscoveryCommand, E as EditPlanArgs, F as EmbeddedNewlineError, G as ExecutableNotFoundError, H as FetchAllProviderModelsOptions, I as HeadlessRunner, J as HeadlessRunnerDeps, K as HeadlessSession, R as IntegrationDisposal, S as IsolationAvailability, U as IsolationHandoffRepo, V as IsolationInactiveReason, X as IsolationLanding, Y as IsolationMergeBlock, Z as IsolationMergeBlockReason, a0 as IsolationPruneResult, a1 as IsolationRepo, a4 as IsolationTaskRepo, a7 as LaunchDeps, a8 as LaunchPlan, aa as LineBuffer, ab as ListModelsArgs, ac as ListRunnersArgs, ad as McpClientConfig, ae as McpCredential, af as McpTool, ag as McpToolContext, ah as McpToolReply, ai as Message, aj as ModelCatalog, ak as ModelShortcut, al as ORCHESTRATOR_SHORTCUTS, am as ORDEWELL_MCP_PATH, an as ORDEWELL_MCP_SERVER_NAME, aq as OwnerOnlyFile, ar as PLANNER_TOOLS, at as PlanModificationWarnings, aw as PlannerStartOptions, ax as PlannerTokenScope, aA as PluginCloneFn, aB as PluginEntry, aC as PluginFeatures, aD as PluginMode, aE as PluginModelDiscovery, aF as PluginRunnerDef, aG as PreparedLaunch, aH as PreparedTask, aI as ProviderCredentialSource, aK as ProviderModelsResult, aL as PtySize, aM as PtyWrapOptions, aT as ResearchStep, aU as ResearchStepOutcome, b2 as StreamEvent, b3 as StreamStepEvent, b4 as StreamThinkingEvent, b8 as SubagentLogEntry, b9 as SubagentOutcome, ba as SubmitPlanArgs, bb as TASK_TOOLS, bf as TaskIsolationState, bg as TaskMode, bi as TaskModeUnsupportedError, bj as TaskModelAssignment, bk as TaskOutputArgs, bl as TaskOutputSummary, bm as TaskQueryArgs, bq as TaskStatus, bs as TaskToolHandler, bt as TaskTransport, bu as TaskType, bv as TaskWithParent, bw as ThinkingBlock, by as UsageLine, bA as UsageTotals, bB as UserPromptEntry, bC as UserStep, bD as ValidationCheck, bE as ValidationContext, bF as ValidationResult, bH as VerificationCheck, bI as WINDOWS_MAX_COMMAND_LINE, bJ as addPlannerUsage, bK as addTaskToPlan, bL as addUsage, bM as approvalScopes, bN as buildShellInvocation, bO as collectProviderCredentials, bP as createEmptyPlan, bQ as createTask, bR as emptyWarnings, bS as enabledRunners, bT as fetchAllProviderModels, bU as flattenTasks, bV as flattenTasksWithParents, bW as isAwaitingReason, bX as isExecutableResolved, bY as isGranted, bZ as isMeasured, b_ as isReservedRunnerName, b$ as isRunnerApproval, c0 as isRunnerTransport, c1 as isStructuredSession, c2 as keepExecutionState, c3 as knownModelId, c4 as mcpClientConfig, c5 as migrateLegacyPlan, c6 as migratePlanState, c7 as migrateTask, c8 as ownerOnlyConfigFile, c9 as partedPromptUsage, ca as planDirectLaunch, cb as planShellLaunch, cc as plannerContextFill, cd as posixShellQuote, ce as removeTaskFromPlan, cf as renumberTasks, cg as resolveModelShortcut, ch as resolveProvider, ci as sharedMcpServer, cj as stripAnsi, ck as toApprovalDecision, cl as toOrchestratorOptions, cm as updateTaskInPlan, cn as usageLine, co as validateModifiedPlan, cp as warningsText, cq as windowsCommandLine, cr as wrapWithPty } from './Task-CoKhvBa1.js';
-import { x as TaskOp, M as MergeGateView, p as SessionBroadcaster, A as ApplyTaskOpsResult, q as SessionMessage, r as SessionNotice, v as TaskLogEvent } from './plan-utils-BdYPRBno.js';
-export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, j as MessageBlock, k as MessageRole, N as NO_TURN, O as OutputPreview, P as PlanBlock, l as PlanMarkerStatus, m as PromptHold, S as SerializedPlan, n as SerializedTask, o as SerializedTaskStatus, s as SubagentBlock, t as SubagentChild, u as SubagentStatus, T as TakenPrompt, w as TaskLogView, y as TaskRef, z as ThinkingDisplayBlock, B as ToolBlock, F as ToolHeadline, H as ToolStatus, I as TurnGate, U as UsageBlock, J as aheadOfDraft, K as applyTaskOps, Q as canMergeTasks, R as canSetDependencies, V as canSplitTask, W as capConflictFiles, X as classifyOutcome, Y as coalesceTaskLog, Z as dependencyCandidates, _ as dependentsOf, $ as diffRows, a0 as diffStat, a1 as diffSummary, a2 as digestTaskLog, a3 as drainNext, a4 as executionSummary, a5 as followTurn, a6 as fromTranscript, a7 as hasHiddenDetail, a8 as holdPrompt, a9 as outputLines, aa as outputPreview, ab as parseTaskOpsJson, ac as reduceConversation, ad as reduceTaskLog, ae as replayTaskLog, af as runnerToolSubject, ag as serializePlan, ah as serializeTask, ai as serializeTaskStatus, aj as stopTurn, ak as summarizeToolCall, al as taskStartedNotice, am as textHasTaskOps, an as toTaskLogEvent, ao as toolHeadline, ap as trimToolOutput, aq as truncateCheckpointSummary, ar as unsendAll, as as unsendLatest } from './plan-utils-BdYPRBno.js';
-import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-D4ADfTrX.js';
-export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-D4ADfTrX.js';
-import { R as RunnerModeInfo } from './ModeResolver-BEcRAz1c.js';
-export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-BEcRAz1c.js';
+import { b0 as RunnerId, ay as PlanStatus, ac as LegacyPlanState, M as IApproval, p as ApprovalRequest, k as ApprovalDecision, j as ApprovalAnswer, P as ITerminalRunner, N as IConfig, h as AiProvider, aN as ProviderModelLists, m as ApprovalMode, $ as IsolationMergeResult, X as IsolationLandedTask, R as IWorktreeIsolation, a8 as IsolationTaskStatus, av as PlanIsolation, b5 as RunnerTransport, aV as RepoGroupLayout, Q as ITerminalSession, z as DiscoveredModel, bi as Task, f as AgentProcessDeps, c as AgentAdapter, as as OrdewellMcpServer, aX as ResearchProgress, aW as ResearchLogEntry, w as ConversationMessage, aB as PlannerToolHandler, bF as UsageRecord, bu as TaskSnapshot, r as AwaitingReason, U as IsolationHandoff, a4 as IsolationRun, a5 as IsolationTaskRecord, bk as TaskIsolation, a9 as IsolationView, a0 as IsolationOutcome, aU as RepairEvidence, bD as TreeSnapshot, bM as Verdict, b3 as RunnerRegistry, aS as QueuedTaskMessage, aR as QueuedMessage, b as ActiveTaskSession, ar as OrchestratorOption, bn as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, a_ as ResearchToolType, aC as PlannerUsage, n as ApprovalPolicy, ax as PlanState, bj as TaskCompleteArgs, t as CheckpointAnswer, b1 as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, b6 as RunnerVersionProbe, bb as StructuredSessionCapability, bv as TaskStartOptions, bx as TaskTokenScope, bc as StructuredTurnEnd, ba as StructuredEvent, b4 as RunnerSpawnOptions, O as IPluginStore, b2 as RunnerPluginManifest, a$ as ResolveContext, bt as TaskRunnerFlags } from './Task-BpzIbunq.js';
+export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, u as CheckpointArgs, v as CommandLineTooLongError, D as DEFAULT_RUNNERS, x as DENY_ALL, y as DiscoveredMode, E as DiscoveryCommand, F as EditPlanArgs, G as EmbeddedNewlineError, H as ExecutableNotFoundError, I as FetchAllProviderModelsOptions, J as HeadlessRunner, K as HeadlessRunnerDeps, L as HeadlessSession, S as IntegrationDisposal, T as IsolationAvailability, V as IsolationHandoffRepo, W as IsolationInactiveReason, Y as IsolationLanding, Z as IsolationMergeBlock, _ as IsolationMergeBlockReason, a1 as IsolationPruneResult, a2 as IsolationRemoval, a3 as IsolationRepo, a6 as IsolationTaskRef, a7 as IsolationTaskRepo, aa as LaunchDeps, ab as LaunchPlan, ad as LineBuffer, ae as ListModelsArgs, af as ListRunnersArgs, ag as McpClientConfig, ah as McpCredential, ai as McpTool, aj as McpToolContext, ak as McpToolReply, al as Message, am as ModelCatalog, an as ModelShortcut, ao as ORCHESTRATOR_SHORTCUTS, ap as ORDEWELL_MCP_PATH, aq as ORDEWELL_MCP_SERVER_NAME, at as OwnerOnlyFile, au as PLANNER_TOOLS, aw as PlanModificationWarnings, az as PlannerStartOptions, aA as PlannerTokenScope, aD as PluginCloneFn, aE as PluginEntry, aF as PluginFeatures, aG as PluginMode, aH as PluginModelDiscovery, aI as PluginRunnerDef, aJ as PreparedLaunch, aK as PreparedTask, aL as PreservedWork, aM as ProviderCredentialSource, aO as ProviderModelsResult, aP as PtySize, aQ as PtyWrapOptions, aT as RefusedRemoval, aY as ResearchStep, aZ as ResearchStepOutcome, b7 as StreamEvent, b8 as StreamStepEvent, b9 as StreamThinkingEvent, bd as SubagentLogEntry, be as SubagentOutcome, bf as SubmitPlanArgs, bg as TASK_COMPLETE_TOOL, bh as TASK_TOOLS, bl as TaskIsolationState, bm as TaskMode, bo as TaskModeUnsupportedError, bp as TaskModelAssignment, bq as TaskOutputArgs, br as TaskOutputSummary, bs as TaskQueryArgs, bw as TaskStatus, by as TaskToolHandler, bz as TaskTransport, bA as TaskType, bB as TaskWithParent, bC as ThinkingBlock, bE as UsageLine, bG as UsageTotals, bH as UserPromptEntry, bI as UserStep, bJ as ValidationCheck, bK as ValidationContext, bL as ValidationResult, bN as VerificationCheck, bO as WINDOWS_MAX_COMMAND_LINE, bP as addPlannerUsage, bQ as addTaskToPlan, bR as addUsage, bS as approvalScopes, bT as buildShellInvocation, bU as collectProviderCredentials, bV as createEmptyPlan, bW as createTask, bX as emptyWarnings, bY as enabledRunners, bZ as fetchAllProviderModels, b_ as flattenTasks, b$ as flattenTasksWithParents, c0 as inheritedOps, c1 as isAwaitingReason, c2 as isExecutableResolved, c3 as isGranted, c4 as isMeasured, c5 as isReservedRunnerName, c6 as isRunnerApproval, c7 as isRunnerTransport, c8 as isStructuredSession, c9 as keepExecutionState, ca as knownModelId, cb as mcpClientConfig, cc as migrateLegacyPlan, cd as migratePlanState, ce as migrateTask, cf as opsFlag, cg as ownerOnlyConfigFile, ch as partedPromptUsage, ci as planDirectLaunch, cj as planShellLaunch, ck as plannerContextFill, cl as posixShellQuote, cm as removeTaskFromPlan, cn as renumberTasks, co as resolveModelShortcut, cp as resolveProvider, cq as sharedMcpServer, cr as stripAnsi, cs as toApprovalDecision, ct as toOrchestratorOptions, cu as updateTaskInPlan, cv as usageLine, cw as validateModifiedPlan, cx as warningsText, cy as windowsCommandLine, cz as wrapWithPty } from './Task-BpzIbunq.js';
+import { B as TaskOp, M as MergeGateView, j as EditCatalog, s as SessionBroadcaster, A as ApplyTaskOpsResult, t as SessionMessage, u as SessionNotice, y as TaskLogEvent } from './plan-utils-D4Z8UyLL.js';
+export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, k as MessageBlock, l as MessageRole, N as NOT_STARTED, m as NO_TURN, n as NewTaskFields, O as OutputPreview, P as PlanBlock, o as PlanMarkerStatus, p as PromptHold, S as SerializedPlan, q as SerializedTask, r as SerializedTaskStatus, v as SubagentBlock, w as SubagentChild, x as SubagentStatus, T as TakenPrompt, z as TaskLogView, F as TaskRef, H as TaskRowAction, I as TaskRowContext, J as TaskRowIsolation, K as TaskRowKind, Q as TaskRowPlacement, R as TaskRowSubject, U as TaskRowView, V as TaskStatusKind, W as ThinkingDisplayBlock, X as ToolBlock, Y as ToolHeadline, Z as ToolStatus, _ as TurnGate, $ as UsageBlock, a0 as aheadOfDraft, a1 as applyTaskOps, a2 as approvalLabel, a3 as awaitingLabel, a4 as canMergeTasks, a5 as canSetDependencies, a6 as canSplitTask, a7 as capConflictFiles, a8 as classifyOutcome, a9 as coalesceTaskLog, aa as dependencyCandidates, ab as dependentsNotice, ac as dependentsOf, ad as diffRows, ae as diffStat, af as diffSummary, ag as digestTaskLog, ah as drainNext, ai as executionSummary, aj as followTurn, ak as fromTranscript, al as hasHiddenDetail, am as holdPrompt, an as isTaskRunning, ao as markAction, ap as markRequestFor, aq as namedRepos, ar as newTaskFields, as as opsEditable, at as outputLines, au as outputPreview, av as parseTaskOpsJson, aw as pastGateConfirmation, ax as reduceConversation, ay as reduceTaskLog, az as replayTaskLog, aA as runnerToolSubject, aB as serializePlan, aC as serializeTask, aD as serializeTaskStatus, aE as stopTurn, aF as summarizeToolCall, aG as taskRowActions, aH as taskRowView, aI as taskStartedNotice, aJ as taskStatusKind, aK as textHasTaskOps, aL as titledRefs, aM as toTaskLogEvent, aN as toolHeadline, aO as trimToolOutput, aP as truncateCheckpointSummary, aQ as unsendAll, aR as unsendLatest } from './plan-utils-D4Z8UyLL.js';
+import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-CbCmUDBn.js';
+export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-CbCmUDBn.js';
+import { R as RunnerModeInfo } from './ModeResolver-DtfhWeVL.js';
+export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-DtfhWeVL.js';
 import { ChildProcess } from 'child_process';
-import { b as PlanParseError } from './parsing-DMdOq-BV.js';
-export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, c as PlanTaskError, d as PlanTasksResult, T as TASK_OPS_ENVELOPE_KEY, e as TASK_QUERY_ENVELOPE_KEY, f as checkDepsResolve, g as checkImmutableLog, h as checkInProgress, i as checkNoCycles, j as checkUniqueIds, k as escapeControlCharsInStrings, l as extractJsonObject, m as extractObjectWithBalance, n as extractObjectsWithKey, o as looksLikePlanAttempt, p as opensWithJsonObject, q as parsePartialPlan, r as parsePlanJson, s as stripModelNoise, t as stripTrailingCommas, v as validatePlanModification, u as validatePlanTasks } from './parsing-DMdOq-BV.js';
-export { resolveOrderLabel, taskOrderLabel } from './order-labels.js';
+import { b as PlanParseError } from './parsing-COFGUEWx.js';
+export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, c as PlanTaskError, d as PlanTasksResult, T as TASK_OPS_ENVELOPE_KEY, e as TASK_QUERY_ENVELOPE_KEY, f as checkDepsResolve, g as checkImmutableLog, h as checkInProgress, i as checkNoCycles, j as checkUniqueIds, k as escapeControlCharsInStrings, l as extractJsonObject, m as extractObjectWithBalance, n as extractObjectsWithKey, o as looksLikePlanAttempt, p as opensWithJsonObject, q as parsePartialPlan, r as parsePlanJson, s as stripModelNoise, t as stripTrailingCommas, v as validatePlanModification, u as validatePlanTasks } from './parsing-COFGUEWx.js';
+export { resolveOrderLabel, taskOrderLabel, taskRef, titledTaskRef } from './order-labels.js';
 import 'events';
 import 'zod/v4';
 
@@ -650,6 +650,7 @@ type GitExecFn = (file: string, args: string[], opts: {
     stdout: string;
     stderr: string;
 }>;
+
 interface WorktreeIsolationDeps {
     config: Pick<IConfig, 'worktreeIsolation' | 'worktreeSetupCommand' | 'workspaceRepos' | 'worktreeLinks'>;
     /** Test seam: every git invocation goes through this. */
@@ -1106,10 +1107,13 @@ interface ConversationRequest {
  * atomically and answers queries out of its own state; the AI service only
  * parses them.
  */
-type ConversationTurn = {
+type ConversationTurn = 
+/** `aborted`: the call was stopped, and `text` is only what it had by then. */
+{
     kind: 'message';
     text: string;
     researchLog: ResearchLogEntry[];
+    aborted?: boolean;
 } | {
     kind: 'plan';
     tasks: Task[];
@@ -1464,15 +1468,6 @@ declare class PlanStore {
     setTaskVerdict(id: string, verdict: Task['verdict']): void;
     setTaskOutputSummary(id: string, summary: Task['outputSummary']): void;
     setTaskTransport(id: string, transport: Task['transport']): void;
-    getPlanVisualization(): {
-        tasks: {
-            id: string;
-            title: string;
-            dependencies: string[];
-            parallelGroups: number[][];
-        }[];
-        parallelGroups: number[][];
-    };
     /**
      * Widen the plan's runner set. Retargeting a task onto a runner the plan has
      * not used before has to land here as well as on the plan state, or
@@ -1517,6 +1512,12 @@ interface IsolationRunControllerDeps {
     notifications: INotification;
     workspaceRoot: () => string;
     listener: IsolationRunListener;
+    /**
+     * The tasks no clean-up of the whole run may take a worktree from: an
+     * attempt is running them, or the plan has them in progress or waiting on
+     * the user mid-attempt.
+     */
+    liveTasks: () => ReadonlySet<string>;
 }
 /**
  * The lifecycle of a plan's isolation run (ADR-0013, ADR-0014, ADR-0020),
@@ -1533,6 +1534,7 @@ declare class IsolationRunController {
     private readonly notifications;
     private readonly workspaceRoot;
     private readonly listener;
+    private readonly liveTasks;
     private run;
     /** Copied paths already reported for the current run: every task gets the same copies. */
     private reportedCopies;
@@ -1545,6 +1547,8 @@ declare class IsolationRunController {
     /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
     private resolvers;
     private opening;
+    /** Bumped by an interrupt, so an activation in flight across it does not open the run it ended. */
+    private activations;
     /** The start a dirty tree turned away, handed back once the user chooses how to go on. */
     private blockedStart;
     /** The dirty repos behind {@link blockedStart}, for the stash notice. */
@@ -1561,6 +1565,7 @@ declare class IsolationRunController {
     get blocked(): boolean;
     /** What the plan persists of isolated execution; null when no run ever isolated. */
     get planIsolation(): PlanIsolation | null;
+    /** The one guard of every action on the run: a plan that never isolated is a request refused, not a fault. */
     requireRun(): IsolationRun;
     /** A task's record in the open run, only while that run isolates. */
     openRecord(taskId: string): IsolationTaskRecord | undefined;
@@ -1604,20 +1609,27 @@ declare class IsolationRunController {
      */
     continueBlocked(how: 'stash' | 'shared'): Promise<(() => Promise<void>) | null>;
     /**
-     * The one place an attempt's working directory is decided: the worktree
-     * prepared for it in an isolated run, the kept one for a conflict repair,
-     * else the workspace root. `worktree` says which. Does not itself report a
-     * worktree it creates as a change — the caller does once the attempt is
-     * committed as running, so a spawn abandoned or failed after this settles
-     * is not misreported as a change that stuck.
+     * The working directory of an attempt that may run in a worktree — which
+     * attempts do is the attempt kind's to say (see `attemptKind.attemptCwd`):
+     * the worktree prepared for it in an isolated run, the kept one for a
+     * conflict repair, else the workspace root. `worktree` says which. Does not
+     * itself report a worktree it creates as a change — the caller does once
+     * the attempt is committed as running, so a spawn abandoned or failed after
+     * this settles is not misreported as a change that stuck.
      */
     attemptCwd(task: Task, opts: {
         repair: boolean;
-        ops?: boolean;
     }): Promise<{
         cwd: string;
         worktree: boolean;
     }>;
+    /** The workspace root, for an attempt that runs outside any worktree. */
+    workspaceCwd(task: Task): Promise<{
+        cwd: string;
+        worktree: boolean;
+    }>;
+    private reopenCwd;
+    private prepareCwd;
     /**
      * Land a task's work on the run's integration branches. The record is
      * reported changed once the landing is set and before the first merge, so
@@ -1654,10 +1666,11 @@ declare class IsolationRunController {
      */
     refreshInHead(): Promise<boolean>;
     /**
-     * The tracked state of the workspace as an ops task starts, for
-     * {@link filesChangedSince} (ADR-0020). Null where the check does not run:
-     * a run that shares the workspace root, where every task's edits land in
-     * it, or a workspace git cannot isolate at all.
+     * The tracked state of the workspace as an attempt whose tree is checked
+     * starts (see `attemptKind.checksTree`), for {@link filesChangedSince}
+     * (ADR-0020). Null where the check does not run: a run that shares the
+     * workspace root, where every task's edits land in it, or a workspace git
+     * cannot isolate at all.
      */
     snapshotWorkspace(): Promise<TreeSnapshot | null>;
     /** Tracked files changed since `snapshot`; none when the run has since gone on in the workspace root. */
@@ -1672,7 +1685,9 @@ declare class IsolationRunController {
     /**
      * Mark which added task resolves which conflict. The resolver merges the
      * conflicted task's branch by hand in its own worktree; once that lands, the
-     * conflicted task can land in turn.
+     * conflicted task can land in turn — through the same merge, so a resolver
+     * that did not really bring it along conflicts again instead of being taken
+     * at its word.
      */
     linkResolver(resolverId: string, conflictedId: string): void;
     /** The conflicted task a landed resolver was added for, forgotten as it is returned. */
@@ -1687,11 +1702,28 @@ declare class IsolationRunController {
      * HEAD somehow does not contain stays for the next run's sweep.
      */
     merge(): Promise<IsolationMergeResult>;
-    /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
+    /**
+     * Worktrees and task branches go; the integration branch and the record stay
+     * for review and merge. Refused while a task of the run is still live.
+     */
     cleanup(): Promise<void>;
-    /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
+    /**
+     * The run and everything it made go, and the plan forgets it; the next run
+     * starts afresh. Refused while a task of the run is still live.
+     */
     discard(): Promise<void>;
+    /** The records of tasks still live, whose worktrees no clean-up of the whole run may take. */
+    private liveRecords;
+    private refuseWhileLive;
+    /**
+     * Clear a settled run up once everything it landed is merged — and only
+     * when nothing else is left in it: a live task, or a worktree holding work
+     * that never landed, keeps the whole run, worktrees and branches, rather
+     * than leaving that work to a deletion.
+     */
     private clearMerged;
+    /** Say what a removal kept back instead of deleting: where the work went, or which worktree stayed. */
+    private report;
     private forget;
     private assess;
     private activate;
@@ -1711,6 +1743,10 @@ declare class IsolationRunController {
      * whole. One that cannot be continued for another reason — it ran from a
      * different workspace path — keeps its integration branch in each repo that
      * has not merged it: only the user gives landed work up.
+     *
+     * False when `interrupted` came while git was minting: a newer activation
+     * may be minting its own run, so this one is never installed over it, and
+     * is discarded rather than left as branches no record names.
      */
     private mint;
     private reportCopies;
@@ -1862,7 +1898,7 @@ interface OrchestratorObserver {
     }): void;
     onTick?(): void;
     onExecutionComplete?(): void;
-    /** Queued user messages are ready to be processed by the planner. */
+    /** The run is parked behind queued user messages, with nothing live, until they are drained. */
     onQueueReady?(): void;
     onReviewNeeded?(data: {
         tasks: Task[];
@@ -1916,9 +1952,9 @@ interface TaskAttemptSnapshot {
 }
 /**
  * The wiring a {@link TaskOrchestrator} runs on, every collaborator resolved.
- * {@link createTaskOrchestrator} is the only production caller; tests build one
- * through that factory too. The constructor makes nothing itself, so there is
- * exactly one place defaults live.
+ * {@link TaskOrchestrator.compose} is the only production caller; tests build
+ * one through it too. The constructor makes nothing itself, so there is exactly
+ * one place defaults live.
  */
 interface TaskOrchestratorDeps {
     config: IConfig;
@@ -1943,9 +1979,9 @@ interface TaskOrchestratorDeps {
     previousAttemptFromLog: (taskId: string) => string | null;
 }
 /**
- * What a caller supplies to {@link createTaskOrchestrator}; every optional one
- * gets its default there. This is what a host or test chooses, not the resolved
- * wiring the orchestrator itself runs on.
+ * What a caller supplies to {@link TaskOrchestrator.compose}; every optional
+ * one gets its default there. This is what a host or test chooses, not the
+ * resolved wiring the orchestrator itself runs on.
  */
 interface TaskOrchestratorOptions {
     config: IConfig;
@@ -2008,8 +2044,18 @@ declare class TaskOrchestrator {
      * task whose spawn always throws.
      */
     private onHold;
-    /** The plan's isolation run and the open run's lifecycle (ADR-0013); see {@link IsolationRunController}. */
-    private runs;
+    /**
+     * Tasks Mark complete is landing after it ended their attempt: in progress
+     * with no attempt for as long as that takes, and not orphans for it.
+     */
+    private completing;
+    /**
+     * The plan's isolation run and the open run's lifecycle (ADR-0013); see
+     * {@link IsolationRunController}. Read and acted on there directly, except
+     * Merge all: that goes through {@link mergeRun}, which keeps it apart from
+     * ops tasks and starts the tasks its merge lets through.
+     */
+    readonly runs: IsolationRunController;
     /** A passed attempt's work onto the integration branch, and the conflict repair a landing may need. */
     private landing;
     private registry;
@@ -2054,13 +2100,24 @@ declare class TaskOrchestrator {
     private envForTask;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason?: string): void;
-    private atCheckpoint;
+    /** What the task's waiting checkpoint asks, whole; undefined once it settles or when none waits. */
+    getCheckpointQuestion(taskId: string): string | undefined;
+    awaitsCheckpoint(taskId: string): boolean;
     /**
      * Send a structured task a user message (ADR-0018, M1). Mid-turn it queues
      * behind the turn; a task waiting for input takes it at once and is back in
      * progress. Returns the message's id, for {@link removeQueuedTaskMessage}.
      */
     sendTaskMessage(taskId: string, text: string): string;
+    /**
+     * Force send (ADR-0023, F1–F3): interrupt the running turn and deliver the
+     * message as the next one, ahead of anything queued, without the task
+     * waiting for input in between. A task already waiting for input just takes it.
+     */
+    forceSendTaskMessage(taskId: string, text: string): string;
+    private messageTask;
+    /** Force send a message still queued behind the running turn; false once the runner has it. */
+    forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
     /** Take back a message still queued behind a turn; false once it was delivered. */
     removeQueuedTaskMessage(taskId: string, id: string): boolean;
     /** Stop a structured task's running turn; it then waits for input like any turn that ends without its marker. */
@@ -2095,30 +2152,12 @@ declare class TaskOrchestrator {
     /** Task id → session id of every attempt whose runner is up; a spawn in flight has no session yet. */
     get activeSessionMap(): Map<string, string>;
     getAttempt(taskId: string): TaskAttemptSnapshot | undefined;
-    /** Where a task's isolated work stands; null when the plan has no isolation run to speak of. */
-    getTaskIsolation(taskId: string): TaskIsolation | null;
-    /**
-     * The plan's isolation as a surface shows it, for one with no stream to have
-     * told it — a reconnected webview, a session just loaded. Null without a run.
-     */
-    isolationView(): IsolationView | null;
-    getAttemptSession(taskId: string): ITerminalSession | undefined;
     get queuedCount(): number;
-    /** A run is waiting on the user to stash or to go on without isolation. */
-    get awaitingIsolationChoice(): boolean;
-    /**
-     * Take over a plan's persisted isolation, or none for a plan that has not
-     * isolated yet, pruning what a crashed process left behind. Silent on the
-     * observer: adopting is not a change to persist.
-     */
-    adoptIsolation(state: PlanIsolation | null): Promise<void>;
-    reviewRunDiff(): Promise<string>;
     /**
      * "Merge all"; a settled run that merged everything is cleared up and
      * forgotten. During a run it merges what has landed and the run goes on:
      * the tasks waiting at a merge gate for that work then start (ADR-0020).
-     * Never while an ops task runs, and no ops task starts until it ends — the
-     * one overlap the plan cannot order, because the merge is the user's.
+     * Never alongside ops work, either way round ({@link mergeExcludes}).
      */
     mergeRun(): Promise<IsolationMergeResult>;
     /**
@@ -2133,13 +2172,7 @@ declare class TaskOrchestrator {
      * the task has started, and for every other task.
      */
     getMergeGate(taskId: string): string[];
-    /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
-    cleanupRun(): Promise<void>;
-    /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
-    discardRun(): Promise<void>;
     private watchBlockingPrompts;
-    /** What the plan persists of isolated execution; null when no run ever isolated. */
-    get isolationRecord(): PlanIsolation | null;
     /** The transport the plan's latest run copied from the setting; null before its first run. */
     get runnerTransport(): RunnerTransport | null;
     /** Take over a saved plan's copied transport. The next run copies the setting afresh. */
@@ -2150,7 +2183,6 @@ declare class TaskOrchestrator {
     removeQueuedMessage(id: string): boolean;
     setQueuedMessages(messages: QueuedMessage[]): void;
     clearQueuedMessages(): void;
-    processNextQueuedMessage(): QueuedMessage | null;
     loadPlan(tasks: readonly Task[], planRunners?: RunnerId[]): void;
     /**
      * Adopt an edited plan without letting go of the run in progress. Everything
@@ -2167,7 +2199,40 @@ declare class TaskOrchestrator {
     start(): Promise<void>;
     private haltOnFailure;
     stop(): void;
-    onUserTaskComplete(taskId: string): Promise<void>;
+    /** Name the tasks a stop took down, so none is mistaken for one still at work. */
+    private sayStopped;
+    /**
+     * A task in progress with no attempt has nothing running it: a stop, a plan
+     * load or anything else that ended its attempt left its status behind. It
+     * is put back to not started, and said, so it can be retried rather than
+     * read as running — or, in an isolated run, count as live work forever.
+     */
+    private recoverOrphans;
+    /**
+     * Task ids still live, whose worktrees no clean-up of the whole run may
+     * take: an attempt is running them, or the plan has them in progress or
+     * waiting on the user mid-attempt — at a checkpoint, or for input. One
+     * waiting on the user's decision instead (a conflict, a usage limit, files
+     * an ops task changed) is not: no runner is at work on it, and a clean-up
+     * keeps what it holds on a branch before its worktree goes.
+     */
+    private liveTaskIds;
+    /**
+     * Whether the run may close with its handoff: no task is live. A handoff
+     * tells the user the run has finished, and a Merge all after it clears the
+     * run up, so neither may happen under a task the plan still shows at work.
+     */
+    private get settled();
+    /**
+     * The boundary a verdict crosses: nothing awaits the verifier's listener, so
+     * a throw from reading the output, landing, releasing a worktree or the tick
+     * after would be an unhandled rejection — and an attempt left integrating is
+     * live work forever. One that never settled fails (a repair waits on the
+     * user, as its conflict did); either way the run halts and says why.
+     */
+    private deliverVerdict;
+    /** Work nothing awaits: a rejection is said, not left unhandled. */
+    private unawaited;
     private onVerdict;
     private afterVerdict;
     /**
@@ -2192,24 +2257,17 @@ declare class TaskOrchestrator {
      * the ending attempt freed and never one more than the run allows.
      */
     private settleUnlanded;
-    /**
-     * Mark which added task resolves which conflict. The resolver merges the
-     * conflicted task's branch by hand in its own worktree; once that lands, the
-     * conflicted task's branch is already on the integration branch and it can
-     * land in turn — through the same merge, so a resolver that did not really
-     * bring it along conflicts again instead of being taken at its word.
-     */
-    linkConflictResolver(resolverId: string, conflictedId: string): void;
     private landResolved;
     getReadyTasks(): Task[];
     private readiness;
     /**
-     * Open the run a task starts in, and for a change task decide whether it
-     * isolates (ADR-0020): an ops task needs no worktree, so it never waits on
-     * that choice. False while a dirty tree waits on the user; `resume` is what
-     * their choice replays.
+     * Open the run a task starts in, and decide whether it isolates if the
+     * task's next attempt needs that ({@link decidesIsolation}). False while a
+     * dirty tree waits on the user; `resume` is what their choice replays.
      */
     private openFor;
+    /** The kind a task's next attempt starts as, short of a repair or a continue: what is weighed before one exists. */
+    private nextAttemptKind;
     /**
      * Cancel a running (or scheduled) task: kill its session and return it to
      * 'pending' — "not executed". The task is put on hold so the scheduler
@@ -2231,7 +2289,6 @@ declare class TaskOrchestrator {
      */
     releaseTask(taskId: string): Promise<void>;
     markTaskComplete(taskId: string): Promise<void>;
-    markAiTaskComplete(taskId: string): Promise<void>;
     /**
      * Undo a completion: return the task to "not executed" — pending, verdict and
      * summary dropped, archive entry removed. It is put on hold like a cancel, so
@@ -2278,16 +2335,9 @@ declare class TaskOrchestrator {
     isAllComplete(): boolean;
     isAnyFailed(): boolean;
     approveReview(): Promise<void>;
-    getPlanVisualization(): {
-        tasks: {
-            id: string;
-            title: string;
-            dependencies: string[];
-            parallelGroups: number[][];
-        }[];
-        parallelGroups: number[][];
-    };
     tick(): Promise<void>;
+    /** Whether the scheduler may start `id` now: it passes every readiness gate and a slot is free. */
+    private stillReady;
     /**
      * A run paused at merge gates says so, as plainly as a task that waits on
      * the user: which tasks wait, and that Merge all lets them go on (ADR-0020).
@@ -2321,11 +2371,6 @@ declare class TaskOrchestrator {
     private abandonSpawn;
     private tell;
     private say;
-    /**
-     * Whether the run in force, or else the next one, gives each task its own
-     * worktrees, and of which repo group — what the planner is told.
-     */
-    plannerIsolation(): Promise<IsolatedExecution>;
     /**
      * Replay the start a dirty tree turned away. `stash` puts the user's tracked
      * changes on the git stash first, so the run isolates; `shared` runs this one
@@ -2350,12 +2395,6 @@ declare class TaskOrchestrator {
     private saveNativeSession;
     private endAllAttempts;
 }
-/**
- * Build a {@link TaskOrchestrator}, filling in every collaborator a caller did
- * not inject. The one entry point for hosts, bench harnesses and tests alike;
- * {@link TaskOrchestrator} itself constructs nothing.
- */
-declare function createTaskOrchestrator(options: TaskOrchestratorOptions): TaskOrchestrator;
 
 /**
  * Everything needed to produce a plan from a goal. Carries the planning context
@@ -2518,7 +2557,9 @@ declare class RunnerInstallation {
      * typing a real goal is the failure this exists to prevent.
      *
      * "Usable" is deliberately shallow: the binary answers `--version`, and the
-     * runner declares a planner transport. Whether the user's subscription is
+     * runner has a connector to plan over. Plugin runners have none yet: a
+     * manifest-level planner capability, so a plugin can declare itself
+     * plannable, is a follow-up. Whether the user's subscription is
      * live cannot be known without spending a turn on it, so an expired login
      * surfaces where it actually bites — as the agent's own error text on the
      * first turn.
@@ -2594,6 +2635,37 @@ declare function isCliProvider(id: AiProvider): boolean;
 declare function runnerForProvider(id: AiProvider): string | null;
 /** The harness planner that wraps a given runner, or null when none does. */
 declare function providerForRunner(runner: string): AiProvider | null;
+/** One runner's planner usability, as `RunnerInstallation.plannerUsability` reports it. */
+interface PlannerUsability {
+    usable: boolean;
+    reason?: string;
+}
+/**
+ * One entry of the planner backend list (ADR-0009). `id` is the `AiProvider`
+ * either way; `runner` is set only for a harness planner, whose model catalog
+ * comes from that runner, and `reason` is the second line a surface renders —
+ * the block detail for a harness planner, the API-key variable for a vendor.
+ */
+interface PlannerBackendEntry {
+    id: AiProvider;
+    label: string;
+    kind: 'harness' | 'vendor';
+    runner?: string;
+    usable: boolean;
+    reason?: string;
+}
+/** The detail a usable harness planner is always shown with. */
+declare const HARNESS_PLANNER_REASON = "coding agent \u00B7 no API key needed";
+/**
+ * The planner backends every surface offers, in order: the harness planners
+ * first, always listed so a missing CLI is greyed with its reason rather than
+ * hidden, then the configured vendors in `PROVIDER_PRIORITY` order. Pure: the
+ * caller supplies what it knows of each runner (VS Code its `plannerUsability`
+ * results, the TUI its installed set) and maps the entries to its own item
+ * type, keeping surface-specific affordances — e.g. the CLI's empty-vendor
+ * placeholder — to itself.
+ */
+declare function plannerBackendEntries(usability: Readonly<Record<string, PlannerUsability>>, configured: readonly AiProvider[]): PlannerBackendEntry[];
 /**
  * The single definition of which providers count as "configured" — one API
  * key each, or (for `openai_compatible`) an explicit base URL. Every surface
@@ -2672,7 +2744,7 @@ interface EnvAdmission {
  */
 declare function admitSettingsEnv(env: Record<string, unknown>): EnvAdmission;
 
-/** Whether a runner's tasks can run on the structured transport. */
+/** Whether a runner's tasks can run on the structured transport (ADR-0018, S3). */
 declare function supportsTaskMode(runner: string): boolean;
 /** The adapter that drives one task. Throws {@link TaskModeUnsupportedError} for a runner without a connector. */
 declare function createTaskAdapter(runner: string, deps: AgentProcessDeps): TaskModeAgentAdapter;
@@ -2693,8 +2765,8 @@ interface SpawnSpec {
  *
  * Subclasses own their agent's protocol: what to spawn, how to phrase a user
  * turn, and how to read one protocol line. Everything below — line framing,
- * turn lifecycle, abort, stderr capture, premature-exit detection — is the
- * same for all of them.
+ * turn lifecycle, abort — is the same for all of them, and the process itself
+ * is a {@link RunnerProcess}.
  */
 declare abstract class StdioAgentAdapter implements AgentAdapter {
     protected deps: AgentProcessDeps;
@@ -2702,8 +2774,7 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     protected process: ChildProcess | null;
     protected sessionId: string | null;
     private readonly stdout;
-    private stderrTail;
-    private exited;
+    private readonly runner;
     /** Set for the duration of a turn. Outside one, events are buffered rather than dropped. */
     private turnEmit;
     /** Set for the duration of a turn. Pinged on every raw line, whether or not `handleLine` turns it into an event. */
@@ -2725,11 +2796,6 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     /** A task's session, which wants what the agent says on its own after a turn closed; a planner registers none and drops it. */
     private outOfTurnListener;
     private disposed;
-    /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
-    protected processEnded: Promise<void>;
-    /** The environment the agent was spawned under, for any side process a handshake needs. */
-    protected spawnEnv: NodeJS.ProcessEnv;
-    private markEnded;
     /** What this process is to the user — a planner or a task's runner — for the words a failure is reported in. */
     protected role: 'planner' | 'task';
     constructor(deps: AgentProcessDeps);
@@ -2745,6 +2811,17 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     /** Protocol handshake, if the agent needs one before it accepts a turn. */
     protected handshake(_opts: AgentStartOptions): Promise<void>;
     start(opts: AgentStartOptions): Promise<void>;
+    /**
+     * Every protocol line goes to `handleLine`, turn or no turn: an agent's
+     * handshake and its session-id announcement both arrive before the first
+     * message is sent, and dropping them left the handshake waiting on a reply
+     * that had already come and gone.
+     */
+    private readProtocol;
+    /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
+    protected get processEnded(): Promise<void>;
+    /** The environment the agent was spawned under, for any side process a handshake needs. */
+    protected get spawnEnv(): NodeJS.ProcessEnv;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
     onOutOfTurn(listener: (event: AgentEvent) => void): void;
     nativeSessionId(): string | null;
@@ -2802,8 +2879,12 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     private pendingResume;
     /** The `--mcp-config` file of the running process, which holds its token; removed with the process. */
     private mcpConfig;
-    /** `mcp__ordewell__`, once this process was given the server. */
-    private ordewellToolPrefix;
+    /** Whether this process was given the server, so its tools' requests are Ordewell's own. */
+    private givenOrdewell;
+    /** Messages written into a running task turn, by the `uuid` their echo will carry, until it does (ADR-0023). */
+    private readonly steers;
+    /** The last turn's `result` ended it, so a steer's echo now opens a turn the CLI started for that message. */
+    private turnClosed;
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
     /**
      * A task's run: the manifest decides what its mode and effort mean
@@ -2814,16 +2895,9 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * without it `-p` refuses them silently and nothing can ever surface one.
      */
     private taskSpawnSpec;
-    /**
-     * `--mcp-config` takes a path as well as inline JSON; the path keeps the
-     * token out of the argv every local user can list (ADR-0022, A5). The file
-     * lives exactly as long as the process that reads it. `alwaysLoad` because
-     * the CLI otherwise defers MCP tools behind its tool search, and a model
-     * that has to look an Ordewell tool up first tends to go on without it.
-     */
+    /** The file holding the token lives exactly as long as the process that reads it. */
     private ordewellServerArgs;
     private removeMcpConfig;
-    start(opts: AgentStartOptions): Promise<void>;
     /** Asks the CLI itself, which reports `pending` until its connection attempt settles. */
     mcpAttached(): Promise<boolean>;
     /**
@@ -2833,6 +2907,15 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * as an interrupted `turn_end`.
      */
     interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * A `user` line written mid-turn is Claude Code's own queue (ADR-0023): the
+     * CLI attaches it to the next tool result, or runs it as a turn of its own
+     * after `result` — an interrupted one included — so it never lets go of one,
+     * and nothing is ever reported dropped. Refused while an interrupt is in
+     * flight, and before a `--resume` is taken up: a refused resume closes stdin
+     * with the message unread.
+     */
+    steer(id: string, text: string): Promise<boolean>;
     /** Send a control request and wait for its answer; null when none came in time or the process ended. */
     private control;
     /**
@@ -2852,6 +2935,13 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     dispose(): void;
     private clearFollowOnTimer;
     protected turnPayload(message: string): string;
+    private openTurnState;
+    /**
+     * The echo of a steered message: the model has it. After a closed turn it
+     * opens the CLI's own turn for the message, which then runs like one Ordewell
+     * sent. The first prompt is echoed too, and is no steer.
+     */
+    private steerDelivered;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
     /**
      * `--permission-mode auto` on a model or account without auto mode is not
@@ -2913,25 +3003,22 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private threadId;
     /** The model Codex opened the thread with — usage records name it. */
     private threadModel;
-    private nextRequestId;
-    private settleHandshake;
-    private handshakeError;
+    private readonly rpc;
     private startOpts;
     /** Whether this turn has already emitted prose — see the `agentMessage` case. */
     private turnHasText;
-    /**
-     * The turn in flight. Its id arrives with `turn/started` or the `turn/start`
-     * response, whichever lands first; `turn/interrupt` cannot be sent without it.
-     */
+    /** The turn in flight. `turn/interrupt` and `turn/steer` cannot be sent before it has an id. */
     private turn;
-    /** The JSON-RPC id of the `turn/start` that opened {@link turn}. */
-    private turnRequestId;
     /** The last turn this adapter ended — so its second end signal, landing late, ends nothing. */
     private endedTurnId;
     /** An interrupt was asked for during this turn, so however it ends, it was cut short. */
     private interruptRequested;
-    /** An interrupt asked for before Codex named the turn, sent once it does. */
-    private interruptOnStart;
+    /**
+     * Turns an interrupt cut short. Codex leaves their command running and
+     * reports it when it ends, inside whatever turn is live by then — a report
+     * that belongs to no turn of the agent's any more (ADR-0023, F4).
+     */
+    private readonly interruptedTurnIds;
     /** A task's approval requests still waiting for an answer, by the request id as a string. */
     private readonly openPermissions;
     /**
@@ -2941,10 +3028,6 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private readonly fileChangePaths;
     /** The row each announced file of an in-flight `fileChange` item is shown under, by the file's shown path. */
     private readonly fileChangeRows;
-    /** Requests this adapter sent and awaits an answer to, by JSON-RPC id. */
-    private readonly pendingRequests;
-    private resumeAttempted;
-    private resumeFallbackSent;
     private sandbox;
     /** The Ordewell server's startup state, as Codex last reported it for this thread. */
     private mcpStartup;
@@ -2955,6 +3038,7 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * one stream; the thread id is what tells them apart (see {@link subagentOf}).
      */
     private readonly subagents;
+    constructor(deps: AgentProcessDeps);
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
     /**
      * `initialize`, then `thread/start`, both before the first user message. A
@@ -2964,16 +3048,18 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * construction. A task's runs as its mode says (see {@link threadParams}).
      */
     protected handshake(opts: AgentStartOptions): Promise<void>;
+    private handshakeIncomplete;
     /**
      * Open this session's thread. A resume id means the previous
      * process died mid-session: `thread/resume` puts the agent back in front of
      * the context it already paid to read. A planner's failed resume is not an
-     * error — the response handler falls back to a fresh thread, which is the
-     * same degradation `restoreChat` performs on every surface (T4). A task's
-     * is: Continue (K1) offers the session that did the work, and a fresh thread
-     * in its place would pretend it was resumed.
+     * error — it falls back to a fresh thread, which is the same degradation
+     * `restoreChat` performs on every surface (T4). A task's is: Continue (K1)
+     * offers the session that did the work, and a fresh thread in its place
+     * would pretend it was resumed.
      */
-    private startThread;
+    private openThread;
+    private requestThread;
     private threadParams;
     /**
      * Codex's own startup report for the server, which it sends once the thread
@@ -2984,10 +3070,23 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private effort;
     /**
      * `turn/interrupt` names the turn as well as the thread, so an interrupt
-     * asked for before Codex has named the turn waits for it. Codex acknowledges
-     * with an empty result, then ends the turn as `interrupted`.
+     * asked for before Codex has named the turn waits for it, as a steer does.
+     * Codex acknowledges with an empty result, then ends the turn as `interrupted`.
      */
     interrupt(timeoutMs: number): Promise<boolean>;
+    /** Run `send` now if Codex has named the turn, and once it does if not. */
+    private whenNamed;
+    /**
+     * `turn/steer` into the running turn (ADR-0023). Codex answers with the
+     * turn's id at once — acceptance, not delivery — and shows the input to the
+     * model after the item in flight, as a `userMessage` item carrying the
+     * `clientUserMessageId` sent; that item is the delivery. The request needs
+     * the turn's id, so a steer asked for before Codex named the turn waits for
+     * it, as an interrupt does. Refused when the turn has ended or is another one.
+     */
+    steer(id: string, text: string): Promise<boolean>;
+    /** The one way input reaches a running turn: a task message, or a deny note. */
+    private requestSteer;
     /**
      * Answer an open approval in its own result schema. Codex's decline carries
      * no message, so a deny note reaches the agent as input steered into the
@@ -2995,9 +3094,19 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      */
     answerPermission(id: string, decision: ApprovalDecision): boolean;
     protected turnPayload(message: string): string;
+    /** `turn/start`'s answer. One for a turn that has since closed or been replaced names and closes nothing. */
+    private turnAnswered;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
     private turnStarted;
+    /**
+     * Ahead of the event that ends the turn: a steer Codex accepted and the turn
+     * never consumed is gone — Codex keeps no queue across turns — and one not
+     * yet accepted never will be (ADR-0023, D4).
+     */
     private closeTurn;
+    private fromInterruptedTurn;
+    /** The `userMessage` item a steer turns into once the item before it completes: the model has it. */
+    private steerDelivered;
     /**
      * The child thread id when `threadId` names a subagent's thread, or undefined
      * for the planner's own. Codex replays both threads on one stream and only
@@ -3065,8 +3174,8 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
  * (ADR-0009, ADR-0018).
  *
  * The odd one out: `opencode serve` is a real server rather than a stdio
- * protocol, so this adapter owns both halves of the boundary — it spawns the
- * process through the same injected `spawn` every other adapter uses, then
+ * protocol, so this adapter owns both halves of the boundary — it starts the
+ * process as the same {@link RunnerProcess} every other adapter uses, then
  * talks to it through the injected `fetch`. Both are part of the one seam the
  * tests drive.
  *
@@ -3086,29 +3195,36 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     /** Sent on every request to a task's server, which a per-task password secures. */
     private authorization;
     private sessionId;
-    private stderrTail;
-    private exited;
-    private exitCode;
+    private readonly runner;
     private disposed;
-    private markEnded;
-    private readonly processEnded;
     private planner;
     private task;
-    /** Whether this turn has already emitted reply text — see {@link emitPart}. */
-    private turnHasText;
     /** The last assistant message already settled — the baseline {@link recoverReply} measures a new reply against. */
     private lastAssistantId;
     private taskTurn;
     /** An abort was posted during the current task turn, so the idle that follows ends it as interrupted. */
     private interruptRequested;
-    /** A task's requests waiting for an answer, by request id, with the session that asked. */
-    private readonly openPermissions;
+    private readonly permissions;
+    /** Messages handed into the running task turn, until the model reads them (ADR-0023). Kept across turns: the server keeps the message too. */
+    private readonly steers;
     /** Set once the server turns out to speak the 2.x API, which then owns the session. */
     private v2;
     /** The Ordewell server this process was configured with; null when none was given or its config could not be merged. */
     private ordewell;
     constructor(deps: AgentProcessDeps);
+    private get processEnded();
+    private get exited();
     start(opts: AgentStartOptions): Promise<void>;
+    private launch;
+    /**
+     * Where `serve` listens, or null once it ends or gives up. Stdout only: that
+     * is where `serve` prints its address, and stderr can carry another URL — a
+     * warning about a provider it could not reach. Read a line at a time, and
+     * only until the address is known.
+     */
+    private serverAddress;
+    /** From the server's address to an open session — the 2.x API's, or a 1.x one created or resumed. */
+    private connect;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
     /**
      * One task turn. `prompt_async` only queues the work, so the turn is over
@@ -3120,6 +3236,20 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * {@link recoverReply}, never applies.
      */
     private sendTask;
+    /**
+     * The prompt that carries a task message: the mode as the agent, the task
+     * model and effort, and only `question` withheld. A steer names its own
+     * `messageID` so the frames can be told apart from the first prompt's.
+     */
+    private taskPromptBody;
+    /** Hand a message into the running task turn (ADR-0023, D2), naming it so its delivery is observable. */
+    steer(id: string, text: string): Promise<boolean>;
+    /**
+     * Messages handed over but unread when the turn ended. Each is deleted from
+     * the session — so the next turn's re-send is not a duplicate — and reported
+     * dropped, which is what puts it back in Ordewell's queue.
+     */
+    private dropUnreadSteers;
     /**
      * Whatever of the turn's own messages the stream missed. Each part is
      * emitted once, so a turn the stream saw whole adds nothing here; one that
@@ -3207,48 +3337,15 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * none of this turn's business.
      */
     private onFrame;
-    /**
-     * Stream one piece of a reply text part. The part's paragraph break goes out
-     * with its first visible delta, so the deltas add up to exactly the text the
-     * completed part then re-sends; a part that is only whitespace so far is
-     * held back, for the reason {@link emitPart} drops one.
-     */
-    private onTextDelta;
-    /**
-     * Deny one permission request (T1). OpenCode blocks the turn until the
-     * request is answered, so this must answer — `reject` rather than a silent
-     * drop, which is the same "absent answer is a denial" invariant ADR-0008
-     * states for Ordewell's own tools. The refusal is announced so the timeline
-     * shows the planner reaching for something it may not have.
-     */
-    private denyPermission;
-    /**
-     * A task's request. Under a mode whose manifest sets `approvals: auto` —
-     * `build`, which the terminal transport runs with `--auto` — it is answered
-     * at once with what `run --auto` answers, so the same plan behaves the same
-     * on both transports (ADR-0001), and announced already decided so the log
-     * still shows it. Any other mode leaves it open for an approval card.
-     */
-    private askPermission;
+    /** A planner's request is refused (T1); a task's is answered at once or left open for a card. */
+    private onPermissionAsked;
     /**
      * `POST /permission/:id/reply` is the current answer. The per-session path
      * it replaced is tried only when a server too old to know the new one 404s.
      */
     private replyPermission;
-    /**
-     * Open `/event` for one turn and wait until it is connected. The stream
-     * stopped being best-effort the moment permission answers moved onto it: a
-     * request raised before we connect is one nobody answers, and the turn
-     * hangs on it. Waiting is bounded so a server that never opens `/event`
-     * still gets its turn.
-     */
+    /** `/event` for one turn — see {@link openEventStream}. Load-bearing for {@link onPermissionAsked}. */
     private openStream;
-    /**
-     * Server-sent events from `/event`: the turn's live text, reasoning, tool
-     * activity and usage, and the only channel permission requests arrive on —
-     * so the stream is load-bearing for {@link denyPermission}.
-     */
-    private streamEvents;
     private json;
     private request;
     private headers;
@@ -3277,12 +3374,155 @@ declare function mapAgentTool(name: string): MappedTool;
  */
 declare function normalizeAgentArgs(tool: ResearchToolType, args: Record<string, unknown>): Record<string, unknown>;
 
+/** What a runner offers a task: the models discovered for it and the modes its manifest declares. */
+interface RunnerCatalog {
+    models: DiscoveredModel[];
+    modes: RunnerModeInfo[];
+    /**
+     * The mode a task lands on when it carries none this runner offers: the
+     * manifest's `autonomous`/`safe`-tagged mode under the user's toggle
+     * (ADR-0001). Absent, `modes[0]` stands in — which for Codex is its
+     * workspace-write sandbox, not the full access an unattended run needs.
+     */
+    defaultMode?: string;
+}
+/**
+ * The model, thinking effort and mode a runner offers for a task.
+ *
+ * A task's model, effort and mode are all scoped to its runner:
+ * `claude-sonnet-4-5` on Codex, or `acceptEdits` on OpenCode, are not degraded
+ * choices but unspawnable ones. So this is where any task acquires a runnable
+ * assignment — a runner change (below) and a hand-added task derive it the same
+ * way. Each field in `current` is preserved when the runner also offers it, and
+ * otherwise snapped to that runner's preferred entry (discovery already sorts
+ * models by the manifest's `preferredPatterns`; the mode is the catalog's
+ * `defaultMode`).
+ *
+ * An empty catalog means discovery failed or the runner is a plugin we have no
+ * list for — not that the runner offers nothing. That field is left out of the
+ * patch and the runner validates last, matching `coerceAssignments`.
+ */
+declare function runnerAssignment(catalog: RunnerCatalog, current?: Pick<Task, 'assignedModel' | 'taskMode'>): Partial<Task>;
+/**
+ * Move a task onto a different runner, carrying its model, thinking effort and
+ * mode over to values that runner actually offers. A runner change is never a
+ * single-field edit — it either brings the other three with it or leaves the
+ * task unrunnable.
+ *
+ * Returns the patch to apply, or `{}` when there is nothing to change.
+ */
+declare function retargetTaskRunner(task: Task, runner: RunnerId, catalog: RunnerCatalog): Partial<Task>;
+
+type ModelsByRunner = Partial<Record<RunnerId, DiscoveredModel[]>>;
+interface SessionCatalogDeps {
+    config: Pick<IConfig, 'enabledRunners' | 'autonomousMode'>;
+    registry: Pick<RunnerRegistry, 'getManifest'>;
+    modelResolver: Pick<ModelResolver, 'modelsForRunners' | 'getCachedRunnerModels'>;
+    /** Read at each call: a toggle or allowlist edit made since the session was built counts (#69). */
+    settings: () => {
+        enabledRunners?: RunnerId[];
+        modelAllowlist?: Record<string, string[]>;
+    };
+    /** The runners of the plan being edited; empty while the session has none. */
+    planRunners: () => RunnerId[];
+}
+/**
+ * What a session may assign: the enabled runners, their modes, the models
+ * discovery found for them and the allowlist narrowing those. Every view of
+ * it — the planner's per-turn block, its tools, a user's direct edit — reads
+ * it here, so none can be shown or checked against something the others are not.
+ *
+ * The discovered models are remembered per runner and only ever merged into:
+ * discovering one runner must not forget another's, since coercion later clamps
+ * thinking efforts against whatever was last found.
+ */
+declare class SessionCatalog {
+    private readonly deps;
+    private discovered;
+    constructor(deps: SessionCatalogDeps);
+    /** The runners enabled right now. */
+    enabledRunners(): RunnerId[];
+    /**
+     * The allowlist in force right now. Unset means no restriction — falling
+     * back to the one planning started under would keep a restriction the user
+     * has since cleared.
+     */
+    allowlist(): Record<string, string[]>;
+    /** The models the user allows on one runner; unset means no restriction. */
+    allowlistFor(runner: RunnerId): string[] | undefined;
+    /**
+     * The discovered catalog as the resolver holds it now, per runner, with this
+     * session's own discovery as the fallback where the resolver has nothing
+     * cached. The resolver's cache outlives this session's snapshot in both
+     * directions — an allowlist picker re-discovers into it mid-session — and a
+     * model allowed after that must reach the planner with its real label and
+     * variants, not as an id-only stub. Never triggers discovery itself.
+     */
+    models(): ModelsByRunner;
+    /** What this session's own discovery found for a runner; empty when it never ran there. */
+    known(runner: RunnerId): DiscoveredModel[];
+    /** Discover the runners' models, spawning their CLIs where the resolver has none cached, and remember them. */
+    discover(runners: RunnerId[]): Promise<ModelsByRunner>;
+    /**
+     * Keep what an admitted runner was found to offer, for the next coercion's
+     * effort clamping. An empty list is discovery having found nothing, not a
+     * runner offering nothing, so it never displaces what is known.
+     */
+    admit(runner: RunnerId, models: DiscoveredModel[]): void;
+    /** Session boundaries are hard: nothing discovered for one goal informs the next. */
+    reset(): void;
+    modes(runners: RunnerId[]): Record<RunnerId, RunnerModeInfo[]>;
+    /**
+     * What a planner may assign right now: every enabled runner, its modes, and
+     * its allowlisted models. Discovers a runner's models the first time it is
+     * asked for.
+     */
+    live(): Promise<TaskQueryCatalog>;
+    queryCatalog(runners: RunnerId[]): TaskQueryCatalog;
+    /**
+     * The catalog a model/task-mode edit is checked against — the same
+     * discovered models and manifest modes the per-turn catalog block shows the
+     * planner, so a refusal here can never name something invalid that the
+     * planner was never told about. The catalog is not filtered by the
+     * allowlist here — `checkModelAndModeValidity` narrows by allowlist itself,
+     * the same way `coerceAssignments` does.
+     */
+    edit(runners?: RunnerId[]): EditCatalog;
+    /** What a runner offers, as `runnerAssignment` needs it. Spawns the runner's CLI to list models. */
+    runner(runner: RunnerId): Promise<RunnerCatalog>;
+    /**
+     * The one place planning discovers what it may draw from: the runners'
+     * models and their modes. `filteredModels` is the allowlisted view a prompt
+     * may show; `modelsByRunner` stays whole because coercion needs real labels
+     * and variants.
+     */
+    planning(runners: RunnerId[]): Promise<{
+        modelsByRunner: Partial<Record<string, DiscoveredModel[]>>;
+        filteredModels: Partial<Record<string, DiscoveredModel[]>>;
+        runnerModes: Record<string, RunnerModeInfo[]>;
+    }>;
+}
+
 /** The dialogue record a fork carries — what {@link PlannerConversation.clone} returns. */
 interface ForkedDialogue {
     conversationHistory: ConversationMessage[];
     researchLog: ResearchLogEntry[];
 }
 
+/**
+ * The planner turn (see CONTEXT.md): the one piece of planner work that holds
+ * the conversation, from its claim to its settled outcome. Its signal is what a
+ * stop aborts.
+ */
+declare class PlannerTurn {
+    private readonly controller;
+    private dropped;
+    get signal(): AbortSignal;
+    /** The plan it was answering was dropped under it, so nothing it settles may land. */
+    get abandoned(): boolean;
+    stop(): void;
+    abandon(): void;
+}
 /** A read made through a planner tool: refused once the turn's budget is gone, else answered, told to land when the budget asks it to. */
 type ToolRead<T> = {
     status: 'refused';
@@ -3323,7 +3563,7 @@ interface PlannerConversationHost {
      * conversation never reaches into execution state directly.
      */
     liveOutput: LiveOutputLookup;
-    hasLiveWork(): boolean;
+    isExecuting(): boolean;
     /** The session's single mutation ritual: op → persist → notify (default: the plan). */
     mutate(op: () => boolean, notify?: () => void): LegacyPlanState | null;
     broadcast: SessionBroadcaster;
@@ -3338,6 +3578,8 @@ interface PlannerConversationHost {
     queueEdit(userMessage: string): number;
     /** Wake a scheduler an applied edit may have unblocked. */
     afterEdit(): Promise<void>;
+    /** The planner turn was stopped or abandoned: whatever it is waiting on (a parked approval) will never be answered. */
+    turnAborted(): void;
 }
 /**
  * A conversation edit (rewind, fork) the conversation refused because the
@@ -3356,6 +3598,25 @@ declare class ConversationEditError extends Error {
 declare class ConversationBusyError extends ConversationEditError {
     constructor(operation: string);
 }
+/**
+ * A planner turn that settled after the plan it was answering was dropped (a
+ * new plan, another session adopted, the session closed), or after its call
+ * was cut off by something other than its own stop. Nothing it produced was
+ * committed: landing it would write one session's reply into another's
+ * transcript.
+ */
+declare class PlannerTurnDiscardedError extends Error {
+    constructor(options?: ErrorOptions);
+}
+/**
+ * The user stopped the turn and the backend reported that as a thrown error
+ * rather than a settled reply. Typed so a surface can stay quiet for it without
+ * reading the message: some SDKs' abort errors are plain `Error`s by name, and
+ * a real failure can mention "aborted" too.
+ */
+declare class PlannerTurnStoppedError extends Error {
+    constructor(options?: ErrorOptions);
+}
 /** A user message a rewind can fork the conversation from just before. */
 interface RewindTarget {
     /** Position in the transcript — what {@link PlannerConversation.cloneBefore} takes. */
@@ -3411,13 +3672,32 @@ declare class PlannerConversation {
     private persisted;
     /** Saves an execution event made while a turn may be in flight; see {@link restore}. */
     private savedInBackground;
-    private turnsInFlight;
-    private compacting;
+    private live;
     private openTurn;
     constructor(host: PlannerConversationHost);
     get transcript(): readonly ConversationMessage[];
-    /** Whether a user turn is between its transcript append and its settled outcome. */
+    /** Whether a planner turn holds the conversation. */
     get isTurnInFlight(): boolean;
+    /** Stop the planner turn in flight; it settles as stopped. False when none is. */
+    stopTurn(): boolean;
+    /**
+     * Drop the planner turn in flight together with the plan it was answering:
+     * it is stopped, whatever it settles is discarded, and the conversation is
+     * free at once rather than when the abandoned turn finishes unwinding.
+     */
+    abandonTurn(): void;
+    /**
+     * Run planner work that is not a conversation turn — one-shot plan
+     * generation — as the planner turn, so it is stopped, refused and superseded
+     * like one. It starts a fresh plan, so it supersedes the turn in flight.
+     */
+    hold<T>(signal: AbortSignal | undefined, body: (turn: PlannerTurn) => Promise<T>): Promise<T>;
+    /**
+     * Take the conversation for a new planner turn. A caller's own signal stops
+     * the turn too; the relay is detached on release because a caller may reuse
+     * that signal, and a stale listener would stop the next turn with it.
+     */
+    private claim;
     /** The user turn being answered, for what the host raises during it — an approval the turn's research asks for. */
     get currentTurnId(): string | undefined;
     /**
@@ -3526,8 +3806,11 @@ declare class PlannerConversation {
      * inside the host's mutation ritual.
      */
     recordQueuedEditsFailed(messages: string[], reason: string): void;
-    /** Open the conversation on a fresh plan: the goal is its first message. */
-    start(goal: string, opening: ConversationOpening, signal?: AbortSignal): Promise<LegacyPlanState>;
+    /**
+     * Open the conversation on the host's fresh plan: the goal is its first
+     * message. `prepare` (discovery) runs inside the turn, so a stop reaches it.
+     */
+    start(goal: string, prepare: () => Promise<ConversationOpening>, signal?: AbortSignal): Promise<LegacyPlanState>;
     /**
      * Every later user message, from the transcript append to a persisted
      * outcome. A turn that throws before anything was persisted takes its own
@@ -3544,7 +3827,20 @@ declare class PlannerConversation {
      */
     private editTouchesLiveWork;
     private assertIdle;
-    private inTurn;
+    /**
+     * Refuse to land a turn that no longer belongs here: it was abandoned, its
+     * plan is no longer the host's, or its call was cut off by something other
+     * than its own stop (`IAiService.reset` under a plan change) — what such a
+     * call hands back is a fragment of an answer to a dialogue that is gone.
+     */
+    private assertCurrent;
+    /**
+     * A live conversation is only safe to continue in-place when it also
+     * matches the model/effort configured right now — a harness planner's
+     * running process was spawned with the old one baked in and cannot pick up
+     * a switch (ADR-0009). Otherwise the turn resumes from the transcript.
+     */
+    private canContinueLive;
     /**
      * Bracket one user turn with its start and end, under an id minted here:
      * the turn is where the stream a surface draws begins and ends, and only the
@@ -3589,10 +3885,11 @@ declare class PlannerConversation {
      */
     private taskQueryAnswer;
     /**
-     * Drive a planner turn to a persisted, broadcast outcome. Task edits apply
-     * atomically; validation failures are fed back to the model for up to 2
-     * silent retries, then surfaced as a message with the plan untouched. The
-     * first turn and every later turn route through here — one path, not two.
+     * Drive a planner turn, its reads already drained, to a persisted, broadcast
+     * outcome. Task edits apply atomically; validation failures are fed back to
+     * the model for up to 2 silent retries, then surfaced as a message with the
+     * plan untouched. The first turn and every later turn route through here —
+     * one path, not two.
      */
     private settle;
     /** Validate + commit a task_ops turn atomically. Returns the errors on rejection (plan untouched). */
@@ -3694,14 +3991,21 @@ interface SessionEventRelayDeps {
     /** Where isolation notices go, for a host whose notifications are not seen by the user. */
     onNotice?: (notice: SessionNotice) => void;
     store: Pick<PlanStore, 'allTasks' | 'snapshot'>;
-    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getTaskIsolation' | 'getQueuedTaskMessages' | 'getMergeGate' | 'mergeGateView'>;
+    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getQueuedTaskMessages' | 'getMergeGate' | 'mergeGateView'>;
+    runs: Pick<IsolationRunController, 'taskIsolation'>;
     /** Shared with the Session, which snapshots, restores and clears it. */
     usage: PlannerUsageLedger;
     /** How many of a task's runner requests wait for an answer (ADR-0018, A1). */
     awaitingApproval?: (taskId: string) => number;
+    /** What a task's waiting checkpoint asks, whole. */
+    checkpointQuestion?: (taskId: string) => string | undefined;
 }
-/** Every orchestrator event the relay announces; `onTaskSettled` is persistence only, so it is the Session's. */
-type RelayObserver = Required<Omit<OrchestratorObserver, 'onTaskSettled'>>;
+/**
+ * Every orchestrator event the relay announces. `onTaskSettled` is persistence
+ * only and `onQueueReady` is the Session's cue to drain its queue, so both are
+ * the Session's alone.
+ */
+type RelayObserver = Required<Omit<OrchestratorObserver, 'onTaskSettled' | 'onQueueReady'>>;
 /**
  * Turns orchestrator and planner events into {@link SessionMessage}
  * broadcasts — the one place a surface's view of a Session is produced. It
@@ -3713,8 +4017,10 @@ declare class SessionEventRelay {
     private readonly onNotice?;
     private readonly store;
     private readonly orchestrator;
+    private readonly runs;
     private readonly usage;
     private readonly awaitingApproval;
+    private readonly checkpointQuestion;
     /**
      * The in-flight turn's subagent activity, grouped one run per subagent so a
      * replay nests each step under its own brief/result. Folded into the plan's
@@ -3780,16 +4086,6 @@ declare function openTaskLog(location: TaskLogLocation, taskId: string): TaskLog
  */
 declare function readTaskLog(location: TaskLogLocation, taskId: string, attempt: number): TaskLogEvent[];
 
-/**
- * A direct (non-planner) plan edit the session refused. Distinct from a plain
- * Error so a surface can tell "you asked for something invalid" from "something
- * broke" and say which — the HTTP routes used to collapse both into 404/500,
- * which read to the TUI and VS Code as the edit silently doing nothing. Carries
- * no status code: core is transport-agnostic, the route maps it.
- */
-declare class PlanEditError extends Error {
-    constructor(message: string);
-}
 /**
  * Options for plan generation. Progress is not overridable: every planner
  * progress event is translated to a SessionMessage inside the Session and
@@ -3909,7 +4205,7 @@ declare function createSession(deps: SessionDeps): Session;
 /** What {@link createSession} hands a Session: every collaborator, already built and wired. */
 interface SessionParts {
     config: IConfig;
-    registry: RunnerRegistry;
+    catalog: SessionCatalog;
     workspace: string;
     fsAdapter: IFileSystem;
     broadcast: SessionBroadcaster;
@@ -3921,6 +4217,8 @@ interface SessionParts {
     planner: SessionPlanner;
     store: PlanStore;
     orchestrator: TaskOrchestrator;
+    /** The orchestrator's own: Session reads the run and acts on it there, Merge all aside. */
+    runs: IsolationRunController;
     events: SessionEventRelay;
     usage: PlannerUsageLedger;
     approvals: PendingApprovals;
@@ -3949,9 +4247,10 @@ declare class Session {
     private readonly events;
     private readonly planner;
     private readonly orchestrator;
+    private readonly runs;
     private readonly store;
     private readonly config;
-    private readonly registry;
+    private readonly catalog;
     private plan;
     private goal;
     private workspace;
@@ -3964,13 +4263,18 @@ declare class Session {
     private readonly fetcher;
     private readonly settingsFn;
     private readonly save;
-    /** Last discovered model catalog — lets sync plan commits clamp thinking efforts to real variants. */
-    private modelsCache;
+    /** The queue drain in flight, which a second call joins; see {@link processQueuedMessages}. */
+    private queueDrain;
+    /** The queued messages the planner has been given, no longer the user's to take back. */
+    private drainingIds;
+    /** User controls in flight; see {@link withSave}. */
+    private controlsInFlight;
     private unsubObserver;
     private readonly hostSessionId?;
     private currentSessionId;
     private readonly skillsService;
     private readonly conversation;
+    private readonly editor;
     private readonly plannerTools;
     constructor(parts: SessionParts);
     /**
@@ -3997,7 +4301,7 @@ declare class Session {
     /**
      * The relay announces every orchestrator event; this adds the saves some of
      * them owe, each made before the announcement so no surface sees state the
-     * disk lacks.
+     * disk lacks, and drains the queue the scheduler parked behind.
      */
     private observer;
     /**
@@ -4032,41 +4336,8 @@ declare class Session {
      * session.
      */
     reset(): void;
-    /**
-     * What a planner may assign right now: every enabled runner, its modes, and
-     * its allowlisted models — read as of this call, so a runner enabled or an
-     * allowlist edited since planning started is in it (#69). Discovers a
-     * runner's models the first time it is asked for.
-     */
+    /** What a planner may assign right now; see {@link SessionCatalog.live}. */
     liveCatalog(): Promise<TaskQueryCatalog>;
-    private catalogOf;
-    private runnerModesFor;
-    /**
-     * The catalog a model/task-mode edit is checked against — the same
-     * discovered models and manifest modes the per-turn catalog block shows the
-     * planner, so a refusal here can never name something invalid that the
-     * planner was never told about. The catalog is not filtered by the
-     * allowlist here — {@link checkModelAndModeValidity} narrows by
-     * allowlist itself, the same way `coerceAssignments` does.
-     */
-    private editCatalog;
-    /** The runners enabled right now — a toggle made since the session was built counts (#69). */
-    private enabledRunners;
-    /**
-     * The allowlist in force right now. Unset means no restriction — falling
-     * back to the one planning started under would keep a restriction the user
-     * has since cleared.
-     */
-    private allowlist;
-    /**
-     * The discovered catalog as the resolver holds it now, per runner, with this
-     * session's own discovery as the fallback where the resolver has nothing
-     * cached. The resolver's cache outlives this session's snapshot in both
-     * directions — an allowlist picker re-discovers into it mid-session — and a
-     * model allowed after that must reach the planner with its real label and
-     * variants, not as an id-only stub. Never triggers discovery itself.
-     */
-    private models;
     get planState(): LegacyPlanState | null;
     /**
      * The live plan in the shape a saved session is read back as. The disk
@@ -4082,24 +4353,16 @@ declare class Session {
      * nothing executing, and reporting it as executing is what left the plan
      * unstartable after its last live task was cancelled.
      */
-    get isExecuting(): boolean;
     /** See {@link TaskOrchestrator.hasLiveWork} — a spawned runner, not merely an armed scheduler. */
-    get hasLiveWork(): boolean;
+    get isExecuting(): boolean;
     get status(): 'approved' | 'running' | 'completed';
+    /** Whether a planner turn — a reply, a compaction, plan generation — holds the conversation. */
+    get isPlannerBusy(): boolean;
     /**
-     * Deny every parked approval as soon as a planning turn is aborted, for the
-     * same reason `beginFreshPlan` does it: a prompt raised by a turn nobody is
-     * waiting on has no one left to serve, and denying it unblocks the research
-     * loop instead of stranding it. Without this the request sat out its
-     * five-minute timeout and the loop then carried on as if nothing had
-     * happened — the abort was real, but invisible until long after the user
-     * pressed stop.
-     *
-     * The listener is returned as a disposer rather than left attached: callers
-     * own the signal and may reuse it, and a leaked listener would deny the
-     * *next* turn's prompts the moment that stale signal aborted.
+     * Stop the planner turn in flight. It still settles — a backend hands back
+     * what it had — and ends as stopped. False when no turn is in flight.
      */
-    private denyApprovalsOnAbort;
+    abortPlannerTurn(): boolean;
     generatePlan(goal: string, runners: RunnerId[], options?: GeneratePlanOptions): Promise<LegacyPlanState>;
     /**
      * Kick off the planner conversation (ADR-0002): research + the first planner
@@ -4169,13 +4432,6 @@ declare class Session {
      * bare /unknown through to be mis-resolved.
      */
     private resolveSkillInvocation;
-    /**
-     * The one place planning discovers what it may draw from: the runners'
-     * models (cached for later effort clamping), their modes, and the settings
-     * in force. `filteredModels` is the allowlisted view a prompt may show;
-     * `modelsByRunner` stays whole because coercion needs real labels and variants.
-     */
-    private plannerCatalog;
     private conversationOpening;
     /**
      * Load planner-produced tasks, coerced to the allowlist read live — it may
@@ -4212,7 +4468,17 @@ declare class Session {
     cancelTask(taskId: string): Promise<void>;
     markTaskComplete(taskId: string): Promise<void>;
     markTaskIncomplete(taskId: string): Promise<void>;
+    /**
+     * Hand the queued edits to the planner. The Session does this itself each
+     * time the scheduler parks behind the queue, so no surface has to; a caller
+     * only needs it to await the drain. The messages stay queued until the
+     * planner's answer is applied, so the scheduler stays paused behind them
+     * meanwhile; one drain runs at a time, and a call made during it joins it.
+     * Whatever was queued while it ran is drained after, before the run goes on.
+     */
     processQueuedMessages(): Promise<void>;
+    private drainQueue;
+    private applyQueuedEdits;
     /**
      * Every finished task as the log records it: this run's own entries, plus
      * the tasks earlier runs completed, which the log dropped when this run
@@ -4221,16 +4487,25 @@ declare class Session {
     private finishedWork;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason?: string): void;
+    /** Whether an answer would reach the task: it waits at a checkpoint and a runner is left to hear it. */
+    awaitsCheckpoint(taskId: string): boolean;
     /**
      * A user message to a structured task (ADR-0018, M1); throws
      * `TaskControlError` for one that cannot take it. A task waiting for input
      * is back in progress, and saved so before any surface is told.
      */
     sendTaskMessage(taskId: string, text: string): string;
+    /**
+     * Force send (ADR-0023, F1): interrupt the task's running turn and deliver
+     * this message next. Throws `TaskControlError` where a plain message would,
+     * and for a task on the terminal transport.
+     */
+    forceSendTaskMessage(taskId: string, text: string): string;
+    forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
     removeQueuedTaskMessage(taskId: string, id: string): boolean;
     interruptTask(taskId: string): Promise<void>;
     getQueuedMessages(): QueuedMessage[];
-    /** Take back one unsent message; the plan's persisted queue follows so a reload cannot resurrect it. */
+    /** Take back one unsent message — false once the planner has it; the plan's persisted queue follows so a reload cannot resurrect it. */
     removeQueuedMessage(id: string): boolean;
     setQueuedMessages(msgs: QueuedMessage[]): void;
     /** Replay a run a dirty tree blocked, after stashing the tracked changes. */
@@ -4267,104 +4542,43 @@ declare class Session {
      */
     discardRun(): Promise<void>;
     private requireSettledRun;
-    /**
-     * The opt-in way through a merge conflict: add an AI task, on the conflicted
-     * task's own runner and model, that merges its branch by hand in a worktree
-     * of its own. When that task lands, the conflicted one lands through it (see
-     * {@link TaskOrchestrator.linkConflictResolver}). The automatic answer to a
-     * conflict is a repair, a new attempt of the same task (ADR-0015); a task is
-     * only ever added to the plan by this call.
-     */
+    /** Add the task that merges a conflicted task's branch by hand; see {@link PlanEditor.addConflictResolver}. */
     resolveConflictAsTask(taskId: string): Promise<LegacyPlanState | null>;
     stopExecution(): void;
+    /**
+     * Run a user control and save what it changed before any surface hears of
+     * it. Not a status hold, as {@link saved} is: these await spawns and git, so
+     * a hold would stall every task's status for as long, and an
+     * `execution_complete` the control triggers would overtake the status held
+     * back — which a surface treats as the end of the stream. Instead each status
+     * announced while one runs is saved first (see {@link observer}), as the
+     * background save of an execution event: it may land mid planner turn. So
+     * is the last one where the control is itself execution, not the user's
+     * word on the plan (`background`).
+     */
+    private withSave;
+    private saveForControl;
+    /** A control that finishes synchronously: its status is held until it is saved. */
+    private saved;
     /**
      * The one mutation seam: every structural plan mutation runs the same
      * ritual — store op → persist (which snapshots tasks from PlanStore) →
      * broadcast — in that order, once. A store op returning false aborts
      * before anything is persisted. PlanStore is the single authority for
      * task state; LegacyPlanState.tasks is populated only at persist time.
+     * Direct edits reach it through the {@link PlanEditor}, which adds the
+     * reschedule they owe.
      */
     private mutatePlan;
-    /**
-     * The direct-edit seam: {@link mutatePlan} plus the reschedule every
-     * structural edit owes an armed scheduler. Nothing else wakes one after a
-     * hand edit — the queue-drain path never runs, because a direct edit never
-     * queues — so a task the edit just unblocked would sit ready and never
-     * start. `tick()` no-ops while the scheduler is idle, so this costs nothing
-     * during plain planning. The planner-driven path re-ticks in
-     * {@link PlannerConversation} instead (`afterEdit`); it must not tick twice.
-     */
-    private editPlan;
-    /**
-     * Patch one task's fields. A hand-set dependency list, or a type flip
-     * between AI and MAN, are the patches that can leave a task incoherent
-     * (unschedulable, or carrying fields that mean nothing for its new type),
-     * so both go through the same {@link validateTaskEdit} guard the planner's
-     * task-ops applier uses (as the 'direct' actor, which skips the lock rule)
-     * rather than a second copy of the rules — and throws, so the surface can
-     * say why. Gated on the task existing so an edit to an unknown id still
-     * falls through to the no-op `store.update` below instead of throwing.
-     */
+    /** Patch one task's fields, checked as the planner's task ops are; see {@link PlanEditor.updateTask}. */
     updateTask(taskId: string, changes: Partial<Task>): Promise<LegacyPlanState | null>;
-    /**
-     * Move one task onto a different runner. Distinct from {@link updateTask}
-     * because a runner change is never a single-field edit: the task's model,
-     * thinking effort and mode are all scoped to its runner, so they are
-     * re-derived from the new runner's catalog (see {@link retargetTaskRunner}).
-     * That needs discovery, which is why it is not a branch inside `updateTask`.
-     *
-     * The runner is also admitted into `plan.runners` — see {@link admitRunner}.
-     */
+    /** Move one task onto a different runner, re-deriving what is scoped to it; see {@link PlanEditor.setTaskRunner}. */
     setTaskRunner(taskId: string, runner: RunnerId): Promise<LegacyPlanState | null>;
-    /** What a runner offers, as {@link runnerAssignment} needs it. Spawns the runner's CLI to list models. */
-    private catalogFor;
-    /**
-     * What a *derived* assignment may draw from: the runner's catalog narrowed to
-     * the user's allowlist. Deriving from the full catalog would hand a task the
-     * runner's first model regardless of a restriction the user set — the next
-     * planner turn's `coerceAssignments` would snap it back anyway, so the user
-     * would see their pick silently change instead of never being offered.
-     *
-     * `catalogFor` stays unnarrowed because {@link admitRunner} caches it as what
-     * the runner really offers, which is what effort clamping needs.
-     */
-    private allowedCatalog;
-    /**
-     * Make a runner a first-class member of this plan. Without this, the next
-     * planner turn's `coerceAssignments` would treat it as disallowed and snap
-     * every task on it back, silently undoing the user's choice; and that same
-     * pass clamps efforts against `modelsCache`, so a catalog missing from there
-     * makes the effort we just derived read as unverifiable.
-     */
-    private admitRunner;
-    /**
-     * Replace one task's dependency list — the named entry point the surfaces'
-     * dependency pickers call. The guard itself lives in {@link updateTask}, so
-     * a dependency list arriving as a plain field patch is rejected by the same
-     * rule instead of slipping past it.
-     */
+    /** Replace one task's dependency list, under the same guard as a field patch; see {@link PlanEditor.setTaskDependencies}. */
     setTaskDependencies(taskId: string, dependencies: string[]): Promise<LegacyPlanState | null>;
-    /**
-     * Delete one task. A running task is cancelled first: the plan can drop it
-     * either way, but nothing can reach its runner afterwards — the tmux session
-     * outlives the plan and the orchestrator keeps counting it as active. The
-     * planner-driven path refuses instead (see {@link applyTaskOps}); a user
-     * deleting their own task means it.
-     */
+    /** Delete one task, cancelling its runner first if it runs; see {@link PlanEditor.removeTask}. */
     removeTask(taskId: string): Promise<LegacyPlanState | null>;
-    /**
-     * Add one task, filling in whatever the caller left unset. A task with no
-     * runnable assignment is not a lighter task but an unspawnable one, so the
-     * runner falls back to the plan's first and the model, effort and mode are
-     * derived from that runner's catalog — the same derivation a runner change
-     * uses ({@link runnerAssignment}), which is why this is async like
-     * {@link setTaskRunner}. Anything the caller did choose survives when the
-     * runner offers it.
-     *
-     * Dependencies naming tasks that don't exist are dropped rather than rejected:
-     * the caller is a picker over the current plan, so a stale id means the plan
-     * moved on, not that the whole task should be refused.
-     */
+    /** Add one task, deriving what the caller left unset; see {@link PlanEditor.addTask}. */
     addTask(draft: Partial<Task>): Promise<LegacyPlanState | null>;
     /**
      * Planner-driven merge: validate compatibility up front, then ask the planner
@@ -4389,6 +4603,274 @@ declare class Session {
     get aiServiceInstance(): IAiService;
 }
 
+/**
+ * A request on the plan the session refused: a direct (non-planner) edit that
+ * is not valid, or an isolation action on a plan with no isolated run to act
+ * on. Distinct from a plain Error so a surface can tell "you asked for
+ * something invalid" from "something broke" and say which — the HTTP routes
+ * used to collapse both into 404/500, which read to the TUI and VS Code as the
+ * edit silently doing nothing. Carries no status code: core is
+ * transport-agnostic, the route maps it.
+ */
+declare class PlanEditError extends Error {
+    constructor(message: string);
+}
+
+/** What the user last picked for one planner backend. */
+interface PlannerModelChoice {
+    model: string;
+    effort?: string;
+}
+/**
+ * A candidate model as this planner's catalog lists it. Deliberately plain
+ * data: a harness planner's catalog is its runner's own model list and a
+ * vendor's is a picker list (ADR-0009), and the rule below is the same for
+ * both — so the caller normalizes, and this module never reaches for a
+ * ModelResolver, a config or the network.
+ */
+interface PlannerModelCandidate {
+    id: string;
+    variants?: {
+        id: string;
+    }[];
+}
+interface PlannerModelRecall {
+    model: string;
+    effort: string;
+    source: 'remembered' | 'catalog-default' | 'none';
+}
+/** The slice of `SettingsService` this needs, so tests can pass a plain object. */
+interface PlannerModelStore {
+    getPlannerModel(provider: string): PlannerModelChoice | undefined;
+    setPlannerModel(provider: string, entry: PlannerModelChoice | undefined): void;
+}
+/**
+ * Remembers, per planner backend, the model the user last chose for it.
+ *
+ * Switching the planner has to clear the model — an id is scoped to the agent
+ * that listed it, so an OpenRouter slug handed to Claude Code points it at
+ * something it cannot spawn. That clear is correct and stays; what was missing
+ * is that switching *back* then forced a re-pick of a model the user had
+ * already chosen. Both surfaces' clears and the restore now read one rule from
+ * here rather than three copies drifting apart.
+ */
+declare class PlannerModelMemory {
+    private store;
+    constructor(store: PlannerModelStore);
+    /** Record what the user picked for `provider`; a blank model forgets it instead. */
+    remember(provider: string, model: string, effort?: string): void;
+    /**
+     * What the model and effort should become when `provider` takes over the
+     * planner, given the models it actually serves. The `source` is what the
+     * three surfaces word their notice from — restored, defaulted, or nothing.
+     */
+    recall(provider: string, catalog: PlannerModelCandidate[]): PlannerModelRecall;
+}
+
+/**
+ * The daemon contract: every HTTP body the local daemon sends, in one place.
+ *
+ * The daemon's routes build their bodies against these types and the CLI's
+ * `ApiClient` reads them back, so a field added on one side is a compile error
+ * on the other. Before this there were three hand-written copies — the routes'
+ * inline `c.json`, the client's per-method generics, and the TUI's slice of the
+ * client — and they had drifted (the client declared a `headless` field the
+ * daemon never sent, and typed `GET /sessions/:id`'s plan as the wrong shape).
+ *
+ * Types only. Core is the one package both the daemon and its clients already
+ * depend on; importing from the daemon would pull its runtime into the CLI.
+ */
+/**
+ * Why a request was refused, as a stable code a client switches on instead of
+ * reading the message. Absent on a refusal nobody needs to tell apart — a
+ * missing field, say — where the message is all there is.
+ */
+type DaemonErrorCode = 'session_not_found' | 'task_not_found' | 'no_plan' | 'already_executing' | 'workspace_not_found' | 'workspace_not_a_project' | 'conversation_busy'
+/** The user stopped the planner turn: the turn ended as asked, so a client stays quiet. */
+ | 'planner_turn_stopped'
+/** The planner turn settled after its plan was dropped; nothing it produced was kept. */
+ | 'planner_turn_discarded'
+/** The request asked for something the plan, task or conversation does not allow. */
+ | 'refused' | 'checkpoint_not_waiting' | 'approval_not_outstanding';
+/** The body of every non-2xx answer a route gives. */
+interface ErrorBody {
+    error: string;
+    code?: DaemonErrorCode;
+    /** Set with `workspace_not_a_project`: the directory the daemon refused, so a client can offer to initialize it. */
+    workspace?: string;
+}
+interface OkResponse {
+    ok: boolean;
+}
+/**
+ * A plan as the planner routes return it: the session's plan state itself, not
+ * the `SerializedPlan` a websocket `plan_generated` carries. The two differ —
+ * this one holds raw tasks and the dialogue's bookkeeping — and a client that
+ * reads either reads only the fields it needs.
+ */
+interface PlanResponse {
+    plan: LegacyPlanState;
+}
+/** `POST /plans/:id/resolve-conflict`: `null` when the session had no conflict to hand a resolver task. */
+interface ResolveConflictResponse {
+    plan: LegacyPlanState | null;
+}
+/** What `GET /api/models` returns, and what the pool's provider discovery produces. */
+interface ModelsResponse {
+    models: DiscoveredModel[];
+    modelsByRunner: Record<string, DiscoveredModel[]>;
+    /** Each runner's manifest modes, so a surface can offer a per-task mode picker. */
+    modesByRunner: Record<string, RunnerModeInfo[]>;
+    orchestratorModel: string;
+    providers: AiProvider[];
+    /** Full cross-provider catalog for the orchestrator (planner) model picker. */
+    orchestratorModels: OrchestratorOption[];
+    /** Per-provider catalog-fetch failures, keyed by provider id. */
+    providerErrors: Record<string, string>;
+}
+/** One-shot planning answers in the phase-tagged shape a saved session is read back in. */
+interface GeneratePlanResponse extends Pick<ModelsResponse, 'models' | 'modelsByRunner'> {
+    plan: PlanState;
+}
+interface ExecuteResponse {
+    status: 'running';
+}
+interface StopResponse {
+    status: 'stopped';
+}
+interface CancelPlanningResponse {
+    cancelled: boolean;
+}
+interface TaskMessageResponse {
+    id: string;
+}
+interface ForceSendResponse {
+    sent: boolean;
+}
+interface RemoveMessageResponse {
+    removed: boolean;
+}
+interface MergeGateEntry {
+    id: string;
+    order: number;
+    title: string;
+}
+interface MergeGateResponse {
+    mergeGate: MergeGateEntry[];
+}
+interface IsolationDiffResponse {
+    diff: string;
+}
+/** A merge that conflicts or is blocked is an outcome, not a refusal, so it answers 200 with the result. */
+type IsolationMergeResponse = IsolationMergeResult;
+/** A fork the daemon has already adopted. */
+interface ConversationForkResponse {
+    sessionId: string;
+    goal: string;
+    plan: LegacyPlanState;
+}
+/** A fork made by a rewind, with the full text of the message it was made just before. */
+interface ConversationRewindResponse extends ConversationForkResponse {
+    rewoundMessage: string;
+}
+interface RewindTargetsResponse {
+    targets: RewindTarget[];
+}
+interface ConversationCompactResponse extends ConversationCompaction, PlanResponse {
+}
+interface PrdResponse {
+    prdMarkdown: string;
+}
+interface RunnerEntry {
+    id: string;
+    name: string;
+    enabled: boolean;
+}
+interface RunnersResponse {
+    runners: RunnerEntry[];
+    orchestratorModel: string;
+}
+/** Sessions: a saved one comes off its file, a live one from the pool's store. */
+interface SessionResponse {
+    meta: SessionMeta;
+    plan: PlanState;
+}
+interface AdoptSessionResponse extends OkResponse {
+    plan: LegacyPlanState;
+    goal: string;
+}
+interface TaskLogAttemptsResponse {
+    attempts: number[];
+}
+interface TaskLogResponse {
+    attempt: number;
+    events: TaskLogEvent[];
+}
+type SessionListResponse = SessionMeta[];
+interface SettingsResponse {
+    orchestratorModel: string;
+    /** Who plans (ADR-0009) — a vendor id, or one of the three harness planners. */
+    aiProvider: AiProvider;
+    plannerThinkingEffort: string;
+    maxParallel: number;
+    tdd: UserSettings['tdd'];
+    verification: UserSettings['verification'];
+    modelAllowlist: UserSettings['modelAllowlist'];
+    plannerModels: UserSettings['plannerModels'];
+    runnerTransport: RunnerTransport;
+}
+/** What `PATCH /api/settings` answers: the settings as they now stand, plus what the write itself decided. */
+interface SettingsUpdateResponse extends SettingsResponse {
+    /**
+     * Which model a planner switch landed on and why — remembered for that
+     * backend, its catalog default, or none. Present only when the write changed
+     * the planner; absent for every other write, where nothing was recalled.
+     */
+    switchRecall?: PlannerModelRecall;
+    /** Env keys the daemon refused to apply, so a client does not persist what the daemon would not. */
+    rejectedEnvKeys?: string[];
+}
+interface CommandDescriptor {
+    name: string;
+    description: string;
+}
+interface CommandsResponse {
+    commands: CommandDescriptor[];
+}
+interface CommandResponse extends OkResponse {
+    settings: SettingsResponse;
+}
+interface WorkspacesResponse {
+    workspaces: string[];
+}
+interface ApprovalsResponse {
+    pending: PendingApproval[];
+    approvedScopes: string[];
+}
+interface ApprovalAnswerResponse extends OkResponse {
+    granted: boolean;
+    decision: ApprovalDecision['decision'];
+}
+
+/**
+ * Why a call on a session could not be made. Each is a class rather than a
+ * message so the daemon can map it to a status and a stable code in one place,
+ * and a client can switch on that code instead of reading the wording. Like
+ * `PlanEditError`, none carries a status: core is transport-agnostic.
+ */
+/** No session with that id is held — never planned in this process, or dropped by a restart. */
+declare class SessionNotFoundError extends Error {
+    constructor();
+}
+/** The session holds no plan (or an empty one) for the operation to act on. */
+declare class NoPlanError extends Error {
+    constructor(operation: 'execute' | 'review');
+}
+/** A run is already live, and starting another would reset the one in flight. */
+declare class AlreadyExecutingError extends Error {
+    constructor();
+}
+
 /**
  * Where Ordewell keeps machine-global data (settings, daemon tokens, caches,
  * user plugins). A single home for everything not tied to a project directory,
@@ -4419,6 +4901,8 @@ type CheckpointWithdrawnListener = (taskId: string) => void;
 type IdleListener = (taskId: string, idleSince: string | null) => void;
 declare class VerdictEngine {
     private markerSeen;
+    private pendingVerdicts;
+    private structuredSessions;
     private markerTails;
     private checkpointCarry;
     private pausedSessions;
@@ -4431,6 +4915,8 @@ declare class VerdictEngine {
      * answer is typed into the session instead.
      */
     private toolCheckpoints;
+    /** The question a task's checkpoint asks, whole, for as long as it waits — by either route. */
+    private checkpointQuestions;
     private idleListeners;
     /**
      * Per-task generation. Replaced on every watch(), clear() and verdict.
@@ -4479,6 +4965,8 @@ declare class VerdictEngine {
      * `\n`-terminated line, and the leading newline flushes a partial line.
      */
     private resumeToken;
+    /** What a task's waiting checkpoint asks, untruncated; undefined when none waits. */
+    getCheckpointQuestion(taskId: string): string | undefined;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason: string): void;
     /**
@@ -4497,6 +4985,10 @@ declare class VerdictEngine {
      * task's current one or another signal already settled it.
      */
     signalComplete(taskId: string, generation: number, report: TaskCompleteArgs): void;
+    /** The runner was told something after its evidence so far, so only what it reports from here counts. */
+    private supersede;
+    private acceptVerdict;
+    private publishVerdict;
     /**
      * The runner's `checkpoint` call (ADR-0022, V5): raised through the same
      * listeners as the marker, so the task waits on the user the same way, and
@@ -4504,6 +4996,8 @@ declare class VerdictEngine {
      * withdrawn, never left hanging, once the attempt is over or the call goes.
      */
     raiseCheckpoint(taskId: string, generation: number, question: string, signal: AbortSignal): Promise<CheckpointAnswer>;
+    /** The open `checkpoint` call can no longer be answered: refuse it, and let the task out of the wait. */
+    private callWentAway;
     private withdrawToolCheckpoint;
     private approvalOpened;
     private approvalClosed;
@@ -4515,6 +5009,8 @@ declare class VerdictEngine {
     markComplete(task: Task): Verdict;
     /** Clear verification state for a task (used on retry). */
     clear(task: Task): void;
+    /** Drop a task's verification state and invalidate any callbacks still holding its generation. */
+    private ceaseTracking;
     /** Drop all tracking state (used on stop / loadPlan). */
     reset(): void;
     private decide;
@@ -4601,45 +5097,6 @@ declare function clampThinkingEffort(effort: string | undefined, variants: {
 }[]): string | undefined;
 declare function coerceAssignments(tasks: readonly Task[], perRunnerAllowlist: Partial<Record<RunnerId, string[]>>, allowedRunners?: RunnerId[], modelsByRunner?: Partial<Record<RunnerId, DiscoveredModel[]>>): Task[];
 
-/** What a runner offers a task: the models discovered for it and the modes its manifest declares. */
-interface RunnerCatalog {
-    models: DiscoveredModel[];
-    modes: RunnerModeInfo[];
-    /**
-     * The mode a task lands on when it carries none this runner offers: the
-     * manifest's `autonomous`/`safe`-tagged mode under the user's toggle
-     * (ADR-0001). Absent, `modes[0]` stands in — which for Codex is its
-     * workspace-write sandbox, not the full access an unattended run needs.
-     */
-    defaultMode?: string;
-}
-/**
- * The model, thinking effort and mode a runner offers for a task.
- *
- * A task's model, effort and mode are all scoped to its runner:
- * `claude-sonnet-4-5` on Codex, or `acceptEdits` on OpenCode, are not degraded
- * choices but unspawnable ones. So this is where any task acquires a runnable
- * assignment — a runner change (below) and a hand-added task derive it the same
- * way. Each field in `current` is preserved when the runner also offers it, and
- * otherwise snapped to that runner's preferred entry (discovery already sorts
- * models by the manifest's `preferredPatterns`; the mode is the catalog's
- * `defaultMode`).
- *
- * An empty catalog means discovery failed or the runner is a plugin we have no
- * list for — not that the runner offers nothing. That field is left out of the
- * patch and the runner validates last, matching `coerceAssignments`.
- */
-declare function runnerAssignment(catalog: RunnerCatalog, current?: Pick<Task, 'assignedModel' | 'taskMode'>): Partial<Task>;
-/**
- * Move a task onto a different runner, carrying its model, thinking effort and
- * mode over to values that runner actually offers. A runner change is never a
- * single-field edit — it either brings the other three with it or leaves the
- * task unrunnable.
- *
- * Returns the patch to apply, or `{}` when there is nothing to change.
- */
-declare function retargetTaskRunner(task: Task, runner: RunnerId, catalog: RunnerCatalog): Partial<Task>;
-
 declare function buildResearchToolsPrompt(): string;
 /**
  * System prompt for one read-only research subagent (issue #34). The digest
@@ -5067,8 +5524,9 @@ interface SessionLaunch {
  * an `ITerminalSession`, so everything downstream of `onOutput` is unchanged;
  * what a terminal cannot do sits on {@link StructuredSessionCapability}.
  *
- * Ordewell owns the message queue (M1): a message sent mid-turn waits for the
- * turn to end rather than being typed into a runner that is busy.
+ * Ordewell owns the message queue (M1). A message sent mid-turn is handed to a
+ * runner that can take one at its next step (ADR-0023); otherwise it waits for
+ * the turn to end rather than being typed into a runner that is busy.
  */
 declare class StructuredSession extends AbstractTerminalSession implements StructuredSessionCapability {
     private readonly launch;
@@ -5112,13 +5570,36 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     private issueTools;
     private revokeTools;
     protected baseHandleExit(code: number): void;
-    /** A reply typed at the task — a checkpoint answer, most often — is a user message. */
+    /**
+     * A reply typed at the task — a checkpoint answer, most often — is a user
+     * message like any other: into the running turn where the runner takes one,
+     * else the next turn. A runner that stopped to ask reads it at once either way.
+     */
     write(text: string): void;
     kill(): void;
     turnState(): 'working' | 'idle';
     onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
     onEvent(listener: (event: StructuredEvent) => void): void;
     sendMessage(text: string): string;
+    /**
+     * Force send (ADR-0023, F1–F3): interrupt the running turn — and the tool
+     * call in flight — then deliver this message as the turn that replaces it,
+     * ahead of everything still queued. With no turn to interrupt it is a plain
+     * {@link sendMessage}.
+     */
+    forceSend(text: string): string;
+    /** Force send a message still waiting in the queue. False once the runner has it, or it is gone. */
+    forceSendQueued(id: string): boolean;
+    /**
+     * Behind earlier forced messages and ahead of the rest, handed-over ones
+     * included: what the runner already has is the runner's to order (F2). Held
+     * back from steering while the interrupt runs, it opens the next turn — and
+     * a queue that is not empty when the turn ends is what keeps the task out of
+     * "waiting for input" between the two (F3).
+     */
+    private force;
+    private runningTurn;
+    /** No runner can recall a message once offered to it, so only a queued one comes back. */
     removeQueued(id: string): boolean;
     queued(): QueuedTaskMessage[];
     nativeSessionId(): string | null;
@@ -5136,6 +5617,16 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     private startAdapter;
     private openTurn;
     private deliver;
+    /**
+     * Offer the oldest queued message to the running turn (ADR-0023, D2), one at
+     * a time so the runner takes them in the order they were sent. A refusal
+     * leaves it, and everything behind it, for the turn's end.
+     */
+    private offerNext;
+    private steered;
+    private delivered;
+    /** Back to waiting in Ordewell's queue, removable again; the log hears of it only if it had shown as handed over. */
+    private requeue;
     private route;
     /**
      * The runner spoke with no message of ours in flight. When it is working — a
@@ -5150,9 +5641,17 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     /**
      * A queued message goes out as the turn closes, and the state never passes
      * through `idle` on the way, so a listener told the turn ended can already
-     * see the task is not waiting.
+     * see the task is not waiting. Nor does a message the runner owes, or one
+     * still being offered: the runner is about to read it, or Ordewell to send
+     * it (ADR-0023, D5).
      */
     private endTurn;
+    /**
+     * Between turns the oldest message opens the next one — but only once it is
+     * back in Ordewell's hands: while it is on offer or owed, nothing overtakes it.
+     */
+    private deliverNext;
+    private undeliverQueued;
     private emitEvent;
 }
 /**
@@ -5371,6 +5870,8 @@ interface KillTreeDeps {
         unref?: () => void;
     };
     clearTimeoutImpl?: (handle: unknown) => void;
+    /** Signals a pid, or a process group as its negated id. Injected so the group path needs no real processes. */
+    killImpl?: (pid: number, signal: NodeJS.Signals | 0) => void;
 }
 /**
  * Terminate `proc` and everything it started.
@@ -5600,57 +6101,6 @@ declare function sanitizeSlug(raw: string): string;
 /** Save the PRD to `<workspace>/.scratch/<slug>/PRD.md` (to-prd native convention). */
 declare function savePrdMarkdown(workspace: string, slug: string, markdown: string): string;
 
-/** What the user last picked for one planner backend. */
-interface PlannerModelChoice {
-    model: string;
-    effort?: string;
-}
-/**
- * A candidate model as this planner's catalog lists it. Deliberately plain
- * data: a harness planner's catalog is its runner's own model list and a
- * vendor's is a picker list (ADR-0009), and the rule below is the same for
- * both — so the caller normalizes, and this module never reaches for a
- * ModelResolver, a config or the network.
- */
-interface PlannerModelCandidate {
-    id: string;
-    variants?: {
-        id: string;
-    }[];
-}
-interface PlannerModelRecall {
-    model: string;
-    effort: string;
-    source: 'remembered' | 'catalog-default' | 'none';
-}
-/** The slice of `SettingsService` this needs, so tests can pass a plain object. */
-interface PlannerModelStore {
-    getPlannerModel(provider: string): PlannerModelChoice | undefined;
-    setPlannerModel(provider: string, entry: PlannerModelChoice | undefined): void;
-}
-/**
- * Remembers, per planner backend, the model the user last chose for it.
- *
- * Switching the planner has to clear the model — an id is scoped to the agent
- * that listed it, so an OpenRouter slug handed to Claude Code points it at
- * something it cannot spawn. That clear is correct and stays; what was missing
- * is that switching *back* then forced a re-pick of a model the user had
- * already chosen. Both surfaces' clears and the restore now read one rule from
- * here rather than three copies drifting apart.
- */
-declare class PlannerModelMemory {
-    private store;
-    constructor(store: PlannerModelStore);
-    /** Record what the user picked for `provider`; a blank model forgets it instead. */
-    remember(provider: string, model: string, effort?: string): void;
-    /**
-     * What the model and effort should become when `provider` takes over the
-     * planner, given the models it actually serves. The `source` is what the
-     * three surfaces word their notice from — restored, defaulted, or nothing.
-     */
-    recall(provider: string, catalog: PlannerModelCandidate[]): PlannerModelRecall;
-}
-
 /** How many AI tasks may run at once: `ORDEWELL_MAX_PARALLEL`, `/parallel`, `ordewell.maxParallelSessions`. */
 declare const DEFAULT_MAX_PARALLEL = 3;
 /**
@@ -5661,4 +6111,4 @@ declare const DEFAULT_MAX_PARALLEL = 3;
  */
 declare function parseMaxParallel(value: unknown): number | null;
 
-export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, ApplyTaskOpsResult, ApprovalAnswer, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type AskOptions, AwaitingReason, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CORE_PLANNER_PROMPT, type CappedRows, CheckpointAnswer, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompaction, ConversationEditError, type ConversationFork, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DiscoveredModel, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GREP_PCRE_PROBE_ARGS, GeminiService, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type GrepRegex, type HasBinFn, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, IsolationHandoff, IsolationLandedTask, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, MergeGateView, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PlannerSubmission, PlannerToolHandler, PlannerUsage, type PluginSource, type PrdBlock, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, ResolveContext, type RewindTarget, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, RunnerSpawnOptions, RunnerTransport, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, SessionMessage, type SessionMeta, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredSessionCapability, StructuredTurnEnd, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskCompleteArgs, TaskControlError, TaskIsolation, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSnapshot, TaskStartOptions, TaskTokenScope, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, type TransportRoute, TransportRouter, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createSkillsService, createTaskAdapter, createTaskOrchestrator, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, defuseMarkers, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, hasTmux, idSegment, includeGlobFor, isCliProvider, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, retargetTaskRunner, routeTransport, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, withPath, writePrivateFile };
+export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type AdoptSessionResponse, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, AlreadyExecutingError, ApplyTaskOpsResult, ApprovalAnswer, type ApprovalAnswerResponse, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type ApprovalsResponse, type AskOptions, AwaitingReason, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CORE_PLANNER_PROMPT, type CancelPlanningResponse, type CappedRows, CheckpointAnswer, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandDescriptor, type CommandResponse, type CommandTier, type CommandsResponse, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompactResponse, type ConversationCompaction, ConversationEditError, type ConversationFork, type ConversationForkResponse, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationRewindResponse, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, type DaemonErrorCode, DiscoveredModel, type EnvAdmission, EnvConfig, type ErrorBody, type ExecFileFn, type ExecImpl, type ExecuteResponse, FindSymbolOptions, type ForceSendResponse, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GREP_PCRE_PROBE_ARGS, GeminiService, type GeneratePlanResponse, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type GrepRegex, HARNESS_PLANNER_REASON, type HasBinFn, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, type IsolationDiffResponse, IsolationHandoff, IsolationLandedTask, type IsolationMergeResponse, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, type MergeGateEntry, type MergeGateResponse, MergeGateView, ModelResolver, type ModelResolverDeps, type ModelsResponse, type ModifyPlanRequest, NoPlanError, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, type OkResponse, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, type PlanResponse, PlanState, PlanStatus, PlanStore, Planner, type PlannerBackendEntry, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PlannerSubmission, PlannerToolHandler, PlannerTurnDiscardedError, PlannerTurnStoppedError, type PlannerUsability, PlannerUsage, type PluginSource, type PrdBlock, type PrdResponse, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, type RemoveMessageResponse, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, type ResolveConflictResponse, ResolveContext, type RewindTarget, type RewindTargetsResponse, RunnerApprovals, type RunnerCatalog, type RunnerEntry, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, RunnerSpawnOptions, RunnerTransport, type RunnersResponse, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, type SessionListResponse, SessionMessage, type SessionMeta, SessionNotFoundError, SessionNotice, type SessionPlanner, type SessionResponse, type SessionRuntimeSettings, type SettingsResponse, SettingsService, type SettingsUpdateResponse, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, type StopResponse, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredSessionCapability, StructuredTurnEnd, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskCompleteArgs, TaskControlError, TaskIsolation, type TaskLogAttemptsResponse, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, type TaskLogResponse, type TaskMessageResponse, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSnapshot, TaskStartOptions, TaskTokenScope, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, type TransportRoute, TransportRouter, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorkspacesResponse, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createSkillsService, createTaskAdapter, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, defuseMarkers, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, hasTmux, idSegment, includeGlobFor, isCliProvider, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, plannerBackendEntries, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, retargetTaskRunner, routeTransport, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, withPath, writePrivateFile };