@ordewell/core 0.7.1 → 0.8.0

package/dist/index.d.ts

@@ -1,16 +1,18 @@
-import { a$ as RunnerId, ax as PlanStatus, ab as LegacyPlanState, L as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, O as ITerminalRunner, M as IConfig, h as AiProvider, aM as ProviderModelLists, m as ApprovalMode, _ as IsolationMergeResult, W as IsolationLandedTask, Q as IWorktreeIsolation, a7 as IsolationTaskStatus, au as PlanIsolation, b4 as RunnerTransport, aU as RepoGroupLayout, P as ITerminalSession, y as DiscoveredModel, bh as Task, f as AgentProcessDeps, c as AgentAdapter, ar as OrdewellMcpServer, aW as ResearchProgress, aV as ResearchLogEntry, w as ConversationMessage, aA as PlannerToolHandler, bE as UsageRecord, bt as TaskSnapshot, r as AwaitingReason, T as IsolationHandoff, a3 as IsolationRun, a4 as IsolationTaskRecord, bj as TaskIsolation, a8 as IsolationView, $ as IsolationOutcome, aT as RepairEvidence, bC as TreeSnapshot, bL as Verdict, b2 as RunnerRegistry, aR as QueuedTaskMessage, aQ as QueuedMessage, b as ActiveTaskSession, aq as OrchestratorOption, bm as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aZ as ResearchToolType, aB as PlannerUsage, n as ApprovalPolicy, aw as PlanState, bi as TaskCompleteArgs, t as CheckpointAnswer, b0 as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, b5 as RunnerVersionProbe, ba as StructuredSessionCapability, bu as TaskStartOptions, bw as TaskTokenScope, bb as StructuredTurnEnd, b9 as StructuredEvent, b3 as RunnerSpawnOptions, N as IPluginStore, b1 as RunnerPluginManifest, a_ as ResolveContext, bs as TaskRunnerFlags } from './Task-BnLxkVQF.js';
-export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, u as CheckpointArgs, v as CommandLineTooLongError, D as DENY_ALL, x as DiscoveredMode, z as DiscoveryCommand, E as EditPlanArgs, F as EmbeddedNewlineError, G as ExecutableNotFoundError, H as FetchAllProviderModelsOptions, I as HeadlessRunner, J as HeadlessRunnerDeps, K as HeadlessSession, R as IntegrationDisposal, S as IsolationAvailability, U as IsolationHandoffRepo, V as IsolationInactiveReason, X as IsolationLanding, Y as IsolationMergeBlock, Z as IsolationMergeBlockReason, a0 as IsolationPruneResult, a1 as IsolationRemoval, a2 as IsolationRepo, a5 as IsolationTaskRef, a6 as IsolationTaskRepo, a9 as LaunchDeps, aa as LaunchPlan, ac as LineBuffer, ad as ListModelsArgs, ae as ListRunnersArgs, af as McpClientConfig, ag as McpCredential, ah as McpTool, ai as McpToolContext, aj as McpToolReply, ak as Message, al as ModelCatalog, am as ModelShortcut, an as ORCHESTRATOR_SHORTCUTS, ao as ORDEWELL_MCP_PATH, ap as ORDEWELL_MCP_SERVER_NAME, as as OwnerOnlyFile, at as PLANNER_TOOLS, av as PlanModificationWarnings, ay as PlannerStartOptions, az as PlannerTokenScope, aC as PluginCloneFn, aD as PluginEntry, aE as PluginFeatures, aF as PluginMode, aG as PluginModelDiscovery, aH as PluginRunnerDef, aI as PreparedLaunch, aJ as PreparedTask, aK as PreservedWork, aL as ProviderCredentialSource, aN as ProviderModelsResult, aO as PtySize, aP as PtyWrapOptions, aS as RefusedRemoval, aX as ResearchStep, aY as ResearchStepOutcome, b6 as StreamEvent, b7 as StreamStepEvent, b8 as StreamThinkingEvent, bc as SubagentLogEntry, bd as SubagentOutcome, be as SubmitPlanArgs, bf as TASK_COMPLETE_TOOL, bg as TASK_TOOLS, bk as TaskIsolationState, bl as TaskMode, bn as TaskModeUnsupportedError, bo as TaskModelAssignment, bp as TaskOutputArgs, bq as TaskOutputSummary, br as TaskQueryArgs, bv as TaskStatus, bx as TaskToolHandler, by as TaskTransport, bz as TaskType, bA as TaskWithParent, bB as ThinkingBlock, bD as UsageLine, bF as UsageTotals, bG as UserPromptEntry, bH as UserStep, bI as ValidationCheck, bJ as ValidationContext, bK as ValidationResult, bM as VerificationCheck, bN as WINDOWS_MAX_COMMAND_LINE, bO as addPlannerUsage, bP as addTaskToPlan, bQ as addUsage, bR as approvalScopes, bS as buildShellInvocation, bT as collectProviderCredentials, bU as createEmptyPlan, bV as createTask, bW as emptyWarnings, bX as enabledRunners, bY as fetchAllProviderModels, bZ as flattenTasks, b_ as flattenTasksWithParents, b$ as inheritedOps, c0 as isAwaitingReason, c1 as isExecutableResolved, c2 as isGranted, c3 as isMeasured, c4 as isReservedRunnerName, c5 as isRunnerApproval, c6 as isRunnerTransport, c7 as isStructuredSession, c8 as keepExecutionState, c9 as knownModelId, ca as mcpClientConfig, cb as migrateLegacyPlan, cc as migratePlanState, cd as migrateTask, ce as opsFlag, cf as ownerOnlyConfigFile, cg as partedPromptUsage, ch as planDirectLaunch, ci as planShellLaunch, cj as plannerContextFill, ck as posixShellQuote, cl as removeTaskFromPlan, cm as renumberTasks, cn as resolveModelShortcut, co as resolveProvider, cp as sharedMcpServer, cq as stripAnsi, cr as toApprovalDecision, cs as toOrchestratorOptions, ct as updateTaskInPlan, cu as usageLine, cv as validateModifiedPlan, cw as warningsText, cx as windowsCommandLine, cy as wrapWithPty } from './Task-BnLxkVQF.js';
-import { z as TaskOp, M as MergeGateView, r as SessionBroadcaster, A as ApplyTaskOpsResult, s as SessionMessage, t as SessionNotice, x as TaskLogEvent } from './plan-utils--kQRzSE-.js';
-export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, j as MessageBlock, k as MessageRole, N as NOT_STARTED, l as NO_TURN, m as NewTaskFields, O as OutputPreview, P as PlanBlock, n as PlanMarkerStatus, o as PromptHold, S as SerializedPlan, p as SerializedTask, q as SerializedTaskStatus, u as SubagentBlock, v as SubagentChild, w as SubagentStatus, T as TakenPrompt, y as TaskLogView, B as TaskRef, F as TaskRowAction, H as TaskRowContext, I as TaskRowIsolation, J as TaskRowKind, K as TaskRowPlacement, Q as TaskRowSubject, R as TaskRowView, U as TaskStatusKind, V as ThinkingDisplayBlock, W as ToolBlock, X as ToolHeadline, Y as ToolStatus, Z as TurnGate, _ as UsageBlock, $ as aheadOfDraft, a0 as applyTaskOps, a1 as approvalLabel, a2 as awaitingLabel, a3 as canMergeTasks, a4 as canSetDependencies, a5 as canSplitTask, a6 as capConflictFiles, a7 as classifyOutcome, a8 as coalesceTaskLog, a9 as dependencyCandidates, aa as dependentsNotice, ab as dependentsOf, ac as diffRows, ad as diffStat, ae as diffSummary, af as digestTaskLog, ag as drainNext, ah as executionSummary, ai as followTurn, aj as fromTranscript, ak as hasHiddenDetail, al as holdPrompt, am as isTaskRunning, an as markAction, ao as markRequestFor, ap as namedRepos, aq as newTaskFields, ar as opsEditable, as as outputLines, at as outputPreview, au as parseTaskOpsJson, av as pastGateConfirmation, aw as reduceConversation, ax as reduceTaskLog, ay as replayTaskLog, az as runnerToolSubject, aA as serializePlan, aB as serializeTask, aC as serializeTaskStatus, aD as stopTurn, aE as summarizeToolCall, aF as taskRowActions, aG as taskRowView, aH as taskStartedNotice, aI as taskStatusKind, aJ as textHasTaskOps, aK as titledRefs, aL as toTaskLogEvent, aM as toolHeadline, aN as trimToolOutput, aO as truncateCheckpointSummary, aP as unsendAll, aQ as unsendLatest } from './plan-utils--kQRzSE-.js';
-import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-DofiRcCo.js';
-export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-DofiRcCo.js';
-import { R as RunnerModeInfo } from './ModeResolver-DkMYf4uS.js';
-export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-DkMYf4uS.js';
+import { W as RunnerId, E as PlanStatus, L as LegacyPlanState, n as IsolationMergeResult, j as IsolationLandedTask, I as IWorktreeIsolation, w as IsolationTaskStatus, P as PlanIsolation, a3 as SkillsService, _ as SkillInfo, N as RepoGroupLayout, c as DiscoveredModel, a9 as Task, S as ResearchProgress, O as ResearchLogEntry, C as ConversationMessage, ao as UsageRecord, ah as TaskSnapshot, a as AwaitingReason, g as IsolationHandoff, s as IsolationRun, t as IsolationTaskRecord, aa as TaskIsolation, x as IsolationView, o as IsolationOutcome, K as RepairEvidence, am as TreeSnapshot, av as Verdict, ag as TaskSkillSnapshot, $ as SkillLoad, Q as QueuedMessage, A as ActiveTaskSession, V as ResearchToolType, G as PlannerUsage, z as PlanState } from './Task-1Q19y7sZ.js';
+export { B as BUILTIN_SKILL_NAMES, D as DEFAULT_RUNNERS, b as DiscoveredMode, d as IntegrationDisposal, e as InvalidSkill, f as IsolationAvailability, h as IsolationHandoffRepo, i as IsolationInactiveReason, k as IsolationLanding, l as IsolationMergeBlock, m as IsolationMergeBlockReason, p as IsolationPruneResult, q as IsolationRemoval, r as IsolationRepo, u as IsolationTaskRef, v as IsolationTaskRepo, M as Message, y as PlanModificationWarnings, F as PlannerTaskView, H as PreparedTask, J as PreservedWork, R as RefusedRemoval, T as ResearchStep, U as ResearchStepOutcome, X as ShadowedSkill, Y as SkillAppliesTo, Z as SkillCatalog, a0 as SkillLoadNotice, a1 as SkillMetadata, a2 as SkillSource, a4 as StreamEvent, a5 as StreamStepEvent, a6 as StreamThinkingEvent, a7 as SubagentLogEntry, a8 as SubagentOutcome, ab as TaskIsolationState, ac as TaskMode, ad as TaskModelAssignment, ae as TaskOutputSummary, af as TaskSkillNotice, ai as TaskStatus, aj as TaskType, ak as TaskWithParent, al as ThinkingBlock, an as UsageLine, ap as UsageTotals, aq as UserPromptEntry, ar as UserStep, as as ValidationCheck, at as ValidationContext, au as ValidationResult, aw as VerificationCheck, ax as addPlannerUsage, ay as addTaskToPlan, az as addUsage, aA as createEmptyPlan, aB as createSkillsService, aC as createTask, aD as emptyWarnings, aE as flattenTasks, aF as flattenTasksWithParents, aG as inheritedOps, aH as inheritedSkills, aI as isAwaitingReason, aJ as isMeasured, aK as isSkillName, aL as isUserMessage, aM as keepExecutionState, aN as migrateLegacyPlan, aO as migrateLoadedTasks, aP as migratePlanState, aQ as migrateTask, aR as opsFlag, aS as partedPromptUsage, aT as plannerContextFill, aU as plannerTaskView, aV as removeTaskFromPlan, aW as renumberTasks, aX as skillNames, aY as updateTaskInPlan, aZ as usageLine, a_ as validateModifiedPlan, a$ as warningsText } from './Task-1Q19y7sZ.js';
+import { R as TaskOp, M as MergeGateView, j as EditCatalog, u as SessionBroadcaster, A as ApplyTaskOpsResult, w as SessionNotice, v as SessionMessage, K as TaskLogEvent, H as SurfacePlan, I as SurfacePlanState } from './plan-utils-Cv48fe7r.js';
+export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, k as MessageBlock, l as MessageRole, N as NOT_STARTED, m as NO_TURN, n as NewTaskFields, O as OutputPreview, P as PlanBlock, o as PlanMarkerStatus, p as PromptHold, S as SerializedConversationMessage, q as SerializedPlan, r as SerializedQueuedMessage, s as SerializedTask, t as SerializedTaskStatus, x as SkillLoadBlock, y as SkillToken, z as SubagentBlock, B as SubagentChild, F as SubagentStatus, J as SurfaceTask, T as TakenPrompt, Q as TaskLogView, U as TaskRef, V as TaskRowAction, W as TaskRowContext, X as TaskRowIsolation, Y as TaskRowKind, Z as TaskRowPlacement, _ as TaskRowSubject, $ as TaskRowView, a0 as TaskStatusKind, a1 as ThinkingDisplayBlock, a2 as ToolBlock, a3 as ToolHeadline, a4 as ToolStatus, a5 as TurnGate, a6 as UsageBlock, a7 as aheadOfDraft, a8 as applyTaskOps, a9 as approvalLabel, aa as awaitingLabel, ab as canMergeTasks, ac as canSetDependencies, ad as canSplitTask, ae as capConflictFiles, af as classifyOutcome, ag as coalesceTaskLog, ah as dependencyCandidates, ai as dependentsNotice, aj as dependentsOf, ak as diffRows, al as diffStat, am as diffSummary, an as digestTaskLog, ao as drainNext, ap as executionSummary, aq as followTurn, ar as fromTranscript, as as hasHiddenDetail, at as holdPrompt, au as isTaskRunning, av as loadedSkillTokens, aw as markAction, ax as markRequestFor, ay as namedRepos, az as newTaskFields, aA as opsEditable, aB as outputLines, aC as outputPreview, aD as parseTaskOpsJson, aE as pastGateConfirmation, aF as reduceConversation, aG as reduceTaskLog, aH as replayTaskLog, aI as runnerToolSubject, aJ as serializePlan, aK as serializeTask, aL as serializeTaskStatus, aM as skillTokens, aN as stopTurn, aO as summarizeToolCall, aP as surfacePlan, aQ as surfacePlanState, aR as taskLogForSurface, aS as taskRowActions, aT as taskRowView, aU as taskStartedNotice, aV as taskStatusKind, aW as textHasTaskOps, aX as titledRefs, aY as toTaskLogEvent, aZ as toolHeadline, a_ as trimToolOutput, a$ as truncateCheckpointSummary, b0 as unsendAll, b1 as unsendLatest } from './plan-utils-Cv48fe7r.js';
+import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-D96mT-bm.js';
+export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-D96mT-bm.js';
+import { I as IApproval, m as ApprovalRequest, h as ApprovalDecision, g as ApprovalAnswer, s as IRunner, r as IConfig, e as AiProvider, W as ProviderModelLists, j as ApprovalMode, t as IRunnerSession, c as AgentProcessDeps, A as AgentAdapter, P as OrdewellMcpServer, U as PlannerToolHandler, a2 as RunnerRegistry, Y as QueuedTaskMessage, N as OrchestratorOption, aa as TaskModeAgentAdapter, d as AgentStartOptions, b as AgentEvent, k as ApprovalPolicy, a9 as TaskCompleteArgs, o as CheckpointAnswer, a5 as StructuredTurnEnd, a4 as StructuredEvent, af as TaskStartOptions, ag as TaskTokenScope, $ as RunnerManifest, ae as TaskRunnerFlags } from './IRunner-CGCihlGQ.js';
+export { a as AgentAdapterFactory, f as AllProviderModels, i as ApprovalKind, l as ApprovalPolicyOptions, n as ApprovalSource, C as CatalogModel, p as CheckpointArgs, D as DENY_ALL, q as DiscoveryCommand, E as EditPlanArgs, F as FetchAllProviderModelsOptions, L as LineBuffer, u as ListModelsArgs, v as ListRunnersArgs, w as LoadSkillArgs, M as McpClientConfig, x as McpCredential, y as McpTool, z as McpToolContext, B as McpToolReply, G as ModelCatalog, H as ModelShortcut, O as ORCHESTRATOR_SHORTCUTS, J as ORDEWELL_MCP_PATH, K as ORDEWELL_MCP_SERVER_NAME, Q as OwnerOnlyFile, R as PLANNER_TOOLS, S as PlannerStartOptions, T as PlannerTokenScope, V as ProviderCredentialSource, X as ProviderModelsResult, Z as RunnerEntry, _ as RunnerFeatures, a0 as RunnerMode, a1 as RunnerModelDiscovery, a3 as SpawnFn, a6 as SubmitPlanArgs, a7 as TASK_COMPLETE_TOOL, a8 as TASK_TOOLS, ab as TaskModeUnsupportedError, ac as TaskOutputArgs, ad as TaskQueryArgs, ah as TaskToolHandler, ai as approvalScopes, aj as collectProviderCredentials, ak as enabledRunners, al as fetchAllProviderModels, am as isGranted, an as isRunnerApproval, ao as knownModelId, ap as mcpClientConfig, aq as ownerOnlyConfigFile, ar as resolveModelShortcut, as as resolveProvider, at as sharedMcpServer, au as toApprovalDecision, av as toOrchestratorOptions } from './IRunner-CGCihlGQ.js';
+import { R as RunnerModeInfo } from './ModeResolver-EWlpmVAy.js';
+export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-EWlpmVAy.js';
 import { ChildProcess } from 'child_process';
-import { b as PlanParseError } from './parsing-ddZXZFP4.js';
-export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, c as PlanTaskError, d as PlanTasksResult, T as TASK_OPS_ENVELOPE_KEY, e as TASK_QUERY_ENVELOPE_KEY, f as checkDepsResolve, g as checkImmutableLog, h as checkInProgress, i as checkNoCycles, j as checkUniqueIds, k as escapeControlCharsInStrings, l as extractJsonObject, m as extractObjectWithBalance, n as extractObjectsWithKey, o as looksLikePlanAttempt, p as opensWithJsonObject, q as parsePartialPlan, r as parsePlanJson, s as stripModelNoise, t as stripTrailingCommas, v as validatePlanModification, u as validatePlanTasks } from './parsing-ddZXZFP4.js';
+import { b as PlanParseError } from './parsing-CZdp2p_n.js';
+export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, c as PlanTaskError, d as PlanTasksResult, T as TASK_OPS_ENVELOPE_KEY, e as TASK_QUERY_ENVELOPE_KEY, f as checkDepsResolve, g as checkImmutableLog, h as checkInProgress, i as checkNoCycles, j as checkUniqueIds, k as escapeControlCharsInStrings, l as extractJsonObject, m as extractObjectWithBalance, n as extractObjectsWithKey, o as looksLikePlanAttempt, p as opensWithJsonObject, q as parsePartialPlan, r as parsePlanJson, s as requestedSkills, t as stripModelNoise, u as stripTrailingCommas, v as validatePlanModification, w as validatePlanTasks } from './parsing-CZdp2p_n.js';
+import { EventEmitter } from 'events';
 export { resolveOrderLabel, taskOrderLabel, taskRef, titledTaskRef } from './order-labels.js';
-import 'events';
 import 'zod/v4';
 
 interface SessionMeta {
@@ -410,7 +412,7 @@ declare class RunnerApprovals {
     /** The open request ids of each live structured session. */
     private readonly open;
     constructor(approvals: PendingApprovals);
-    wrap(runner: ITerminalRunner): ITerminalRunner;
+    wrap(runner: IRunner): IRunner;
     /** How many of a task's runner requests wait for an answer — what "waiting for approval" is derived from. */
     waiting(taskId: string): number;
     private watch;
@@ -650,6 +652,7 @@ type GitExecFn = (file: string, args: string[], opts: {
     stdout: string;
     stderr: string;
 }>;
+
 interface WorktreeIsolationDeps {
     config: Pick<IConfig, 'worktreeIsolation' | 'worktreeSetupCommand' | 'workspaceRepos' | 'worktreeLinks'>;
     /** Test seam: every git invocation goes through this. */
@@ -699,86 +702,31 @@ declare class ConsoleLogger implements ILogger {
 }
 declare const defaultLogger: ILogger;
 
-interface UserSettings {
-    tdd: {
-        enabled: boolean;
-    };
-    verification: {
-        enabled: boolean;
-    };
-    modelAllowlist?: Record<string, string[]>;
-    /** Last model (and its thinking effort) the user chose for each planner backend, keyed by AiProvider id. */
-    plannerModels?: Record<string, {
-        model: string;
-        effort?: string;
-    }>;
-    /**
-     * Runners the user picked for planning. Absent — not empty — is what falls
-     * back to the environment's defaults; `[]` is a deliberate "none of them".
-     */
-    enabledRunners?: string[];
-    /**
-     * How tasks' runners are driven (ADR-0018). A run copies it onto its plan
-     * when it starts, so a change applies from the next run.
-     */
-    runnerTransport: RunnerTransport;
-}
 /**
- * Where the user's toggles live. `ORDEWELL_SETTINGS_PATH` overrides it so several
- * Ordewell processes on one machine can hold *different* settings at the same
- * time. Without it the file is a single shared mutable global: the benchmark
- * harness runs parallel lanes that each pin the mode toggles, and because
- * `getAll()` re-reads whenever the mtime moves, a lane needing a toggle
- * `true` would silently plan with `false` the moment another lane pinned its
- * own — turning an A/B of that toggle into a comparison of one condition
- * against itself.
+ * Task skills end to end (ADR-0024): a skill reaches a runner only by being
+ * attached to its task in the plan, and Ordewell puts its body in the task's
+ * prompt — so it works the same on every runner, and nothing is written to a
+ * harness's own skills directory.
  */
-declare function getSettingsPath(): string;
-declare class SettingsService {
-    private filePath;
-    private cache;
-    private cachedMtimeMs;
+/** Where a task's skill names are looked up: global first, then the workspace folders it reads. */
+interface SkillLookup extends Pick<SkillsService, 'findSkill' | 'searchedDirs'> {
     /**
-     * Whether the transport on disk (or just set) is the user's own choice.
-     * Writing the default back out would turn it into one, and a later change of
-     * default would then never reach this user.
+     * Set when tasks get worktrees: of `skills`, the workspace ones git will not
+     * carry into them, each SKILL.md path mapped to the folder to commit,
+     * relative to the workspace root.
      */
-    private transportChosen;
-    constructor(filePath?: string);
-    getAll(): UserSettings;
-    private fileMtimeMs;
-    getTdd(): boolean;
-    setTdd(enabled: boolean): void;
-    getVerification(): boolean;
-    setVerification(enabled: boolean): void;
-    getRunnerTransport(): RunnerTransport;
-    setRunnerTransport(transport: RunnerTransport): void;
-    getModelAllowlist(runner: string): string[] | undefined;
-    setModelAllowlist(runner: string, ids: string[] | undefined): void;
-    getPlannerModel(provider: string): {
-        model: string;
-        effort?: string;
-    } | undefined;
-    setPlannerModel(provider: string, entry: {
-        model: string;
-        effort?: string;
-    } | undefined): void;
-    getEnabledRunners(): string[] | undefined;
-    setEnabledRunners(ids: string[]): void;
-    private load;
-    private persist;
-}
-
-/** How the same toggle is named once a host has read it off disk. */
-interface PlannerRuntimeToggles {
-    tddEnabled: boolean;
-    verificationEnabled: boolean;
+    uncommitted?(skills: readonly SkillInfo[]): Promise<Map<string, string>>;
 }
 /**
- * The planner-facing mode set for one operation. Replaces the boolean tail that
- * every planner signature used to carry positionally — where a thirteenth
- * parameter was the only place left to put a new toggle.
+ * Where a workspace's skills are read, known without asking git: the repos
+ * of its group in layout order (`['.']` for one repository), and whether
+ * tasks will get worktrees, which only a committed skill reaches.
  */
+interface SkillLayout {
+    repos: readonly string[];
+    worktrees: boolean;
+}
+
 /**
  * Where the run's tasks will work: `false` in the shared workspace root;
  * otherwise each in its own worktree of every repo of the group (ADR-0013,
@@ -787,47 +735,24 @@ interface PlannerRuntimeToggles {
 type IsolatedExecution = false | RepoGroupLayout;
 interface PlannerModes {
     autonomousDefault: boolean;
-    verification: boolean;
     /** Not a toggle: a fact about the run. */
     isolatedExecution: IsolatedExecution;
+    /**
+     * Where the run's tasks will look their skills up (ADR-0024), also a fact
+     * about the run. A plan attaching a planner skill is refused against it,
+     * and a coding agent's submit_plan call is refused in its turn rather than
+     * accepted and then failed. Absent: the plan is not checked.
+     */
+    taskSkills?: SkillLookup;
 }
 
-/** Context of one task attempt, enough to locate its transcript. */
-interface TranscriptQuery {
-    runner: string;
-    /** The task's working directory (the agent's cwd at spawn). */
-    cwd: string;
-    /** When the agent process started, ISO — used to reject older sessions. */
-    startedAt?: string;
-    /**
-     * The task's completion marker UUID. The prompt carries it, so a transcript
-     * that does not contain it belongs to some other task — parallel attempts in
-     * one cwd are otherwise indistinguishable by directory and recency.
-     */
-    marker: string;
-}
-/** Reads the agent's own session transcript for a task's final answer. */
-interface TranscriptReader {
-    /** Last assistant-authored prose, clamped to `maxChars` from the end, or null. */
-    finalAssistantText(query: TranscriptQuery, maxChars?: number): Promise<string | null>;
-}
-/** The part of a task attempt its output is looked up by. */
-interface TaskOutputAttempt {
-    readonly taskId: string;
-    readonly runner: string;
-    /** Null when the attempt ended before its working directory was settled. */
-    readonly cwd: string | null;
-    readonly startedAt: string;
-    /** The completion marker UUID the attempt's prompt carried. */
-    readonly completionMarker: string;
-}
 interface LiveTailOptions {
     maxLines: number;
     /** A previous {@link LiveTail.nextOffset}: only output after it is rendered. */
     sinceOffset?: number;
 }
 interface LiveTail {
-    /** Clean terminal render, not raw ANSI. */
+    /** Plain text, escapes and control characters removed. */
     text: string;
     /** Total output received so far; pass it back as `sinceOffset` to read only what follows. */
     nextOffset: number;
@@ -839,13 +764,13 @@ interface LiveTail {
  */
 interface TaskOutputSource {
     /** Start capturing a session; replaces any earlier capture of the task. */
-    attach(taskId: string, session: ITerminalSession): void;
+    attach(taskId: string, session: IRunnerSession): void;
     /** Stop capturing the task's session; what was captured stays readable. */
     detach(taskId: string): void;
     /** Drop every capture (a new plan reuses task ids). */
     reset(): void;
-    /** The attempt's final answer: its transcript first, the clean terminal render otherwise. */
-    finalText(attempt: TaskOutputAttempt, doneToken: string): Promise<string>;
+    /** The task's final answer: the summary its runner reported through `task_complete`, else what its last turn said. */
+    finalText(taskId: string): string;
     /** Recent output of the task's latest capture, or null if it never had one. */
     liveTail(taskId: string, opts: LiveTailOptions): LiveTail | null;
 }
@@ -865,7 +790,7 @@ interface TaskOutputSource {
  * lives in PlanRepair alongside the plan and task-ops envelopes.
  */
 /** The long fields a query may ask for. Everything else is already in the plan block. */
-declare const TASK_QUERY_FIELDS: readonly ["description", "prompt", "userSteps", "verdict", "outputSummary", "userStoriesCovered", "output"];
+declare const TASK_QUERY_FIELDS: readonly ["description", "prompt", "userSteps", "verdict", "outputSummary", "userStoriesCovered", "skills", "output"];
 type TaskQueryField = typeof TASK_QUERY_FIELDS[number];
 /** Lines a `output` read returns when the query sets no count. */
 declare const OUTPUT_LINES_DEFAULT = 80;
@@ -936,7 +861,7 @@ interface CliAgentAiServiceDeps extends Partial<AgentProcessDeps> {
     createAdapter?: (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
     /** Workspace root the agent explores. Defaults to the host process's cwd. */
     workspaceRoot?: () => string;
-    /** Where a conversation's planner tools are served (ADR-0022). Absent: every planner gets the envelopes. */
+    /** Where a conversation's planner tools are served (ADR-0022). Absent: no conversation can start. */
     mcpServer?: OrdewellMcpServer;
 }
 /**
@@ -946,8 +871,8 @@ interface CliAgentAiServiceDeps extends Partial<AgentProcessDeps> {
  * `GeminiService`. It deliberately does **not** extend {@link BaseAiService}:
  * that class's body is Ordewell executing research tools on a model's behalf,
  * which is precisely the part a coding agent replaces. What it reuses instead
- * is everything above the transport — `settleReply` (reply classification
- * and the bounded corrective retries), `parsePlanJson`, the `ResearchProgress` events the
+ * is everything above the transport — `settleReply` (the empty-reply nudge
+ * and the turn's settling), the plan validator, the `ResearchProgress` events the
  * four surfaces already render. That is why this backend reaches VS Code, the
  * web UI, the CLI and the TUI without any of them learning a coding agent is
  * on the other end.
@@ -969,8 +894,6 @@ declare class CliAgentAiService implements IAiService {
     private readonly mcpServer;
     /** The planner token the running process was spawned with; revoked with the process (ADR-0022, A3). */
     private plannerToken;
-    /** Whether the running planner was spawned with its tools and the CLI reported them connected. */
-    private toolsAttached;
     private activeAbort;
     /**
      * Every subagent this conversation has reported starting, and finishing.
@@ -989,7 +912,7 @@ declare class CliAgentAiService implements IAiService {
      * on the old model. No conversation yet is vacuously "current".
      */
     conversationMatchesConfig(): boolean;
-    /** Whether this conversation's planner submits through the Ordewell MCP server rather than the envelopes. */
+    /** Always: a conversation whose planner cannot reach the Ordewell MCP server fails to start rather than falling back to the envelopes. */
     plannerToolsAttached(): boolean;
     /** The agent's own session id, a resumption hint only — Ordewell's transcript is authoritative (T4). */
     nativeSessionId(): string | null;
@@ -1018,7 +941,8 @@ declare class CliAgentAiService implements IAiService {
      * mode from here without changing this signature.
      */
     private startAdapter;
-    /** Spawn with the Ordewell server injected. False, with nothing left running, when it did not connect. */
+    private newAdapter;
+    /** One spawn with the Ordewell server injected: the adapter once the runner reports it connected, otherwise why not, with nothing left running. */
     private startWithTools;
     /** Kill the planner process, and with it the token it was spawned with. */
     private disposeAdapter;
@@ -1030,12 +954,18 @@ declare class CliAgentAiService implements IAiService {
      */
     private ensureAdapter;
     private plannerModel;
+    /**
+     * A plan from one-shot agent sessions: only what a submit_plan call
+     * accepted, never the reply text, so a plan the tool refused cannot come
+     * back in as the JSON the agent echoed. A session that ends without an
+     * accepted call is followed by one corrective session, then fails.
+     */
+    private submittedPlan;
     /**
      * A single agent session that answers one prompt and exits. Used by every
-     * non-conversational entry point; the plan is parsed from the reply text by
-     * the same extractor the conversational path uses. Its envelope streams to
-     * the plan display, as a vendor planner's one-shot does, and the prose
-     * around it is not streamed at all, since no turn is open to show it in.
+     * non-conversational entry point. A plan-shaped envelope in its text
+     * streams to the plan display, as a vendor planner's one-shot does, and the
+     * prose around it is not streamed at all, since no turn is open to show it in.
      */
     private oneShot;
     researchAndPlan(userDescription: string, runners: RunnerId[], modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, fs: IFileSystem, onProgress: (progress: ResearchProgress) => void, _fetcher?: IWebFetcher, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, signal?: AbortSignal): Promise<{
@@ -1073,7 +1003,6 @@ interface ConversationRequest {
     fetcher?: IWebFetcher;
     runnerModes?: Record<RunnerId, RunnerModeInfo[]>;
     autonomousDefault?: boolean;
-    verificationEnabled?: boolean;
     /**
      * The planner model's context window when the catalog knows it. Threaded here
      * so a usage record can carry it (and the UI can show context fill); absent
@@ -1096,6 +1025,12 @@ interface ConversationRequest {
      */
     initialMessage?: string;
     plannerTools?: PlannerToolsOffer;
+    /**
+     * The workspace's skill catalog. Every planner is shown the task skills it
+     * may attach; only one with tools is shown the planner skills, which load
+     * through `load_skill` alone (ADR-0024).
+     */
+    skills?: readonly SkillInfo[];
 }
 /**
  * One planner turn's outcome. The planner talks to the user (`message`),
@@ -1106,10 +1041,13 @@ interface ConversationRequest {
  * atomically and answers queries out of its own state; the AI service only
  * parses them.
  */
-type ConversationTurn = {
+type ConversationTurn = 
+/** `aborted`: the call was stopped, and `text` is only what it had by then. */
+{
     kind: 'message';
     text: string;
     researchLog: ResearchLogEntry[];
+    aborted?: boolean;
 } | {
     kind: 'plan';
     tasks: Task[];
@@ -1191,6 +1129,11 @@ interface IAiService {
      * and cheap in every implementation, so callers never gate it.
      */
     reset(): void;
+    /**
+     * A one-shot plan from a prompt the caller built, so built for this
+     * planner's transport: one with {@link plannerToolsAttached} is asked for a
+     * submit_plan call, never JSON in its reply.
+     */
     sendPlanningPrompt(prompt: string, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean): Promise<Task[]>;
 }
 /**
@@ -1463,16 +1406,8 @@ declare class PlanStore {
     unblockDependents(id: string): void;
     setTaskVerdict(id: string, verdict: Task['verdict']): void;
     setTaskOutputSummary(id: string, summary: Task['outputSummary']): void;
-    setTaskTransport(id: string, transport: Task['transport']): void;
-    getPlanVisualization(): {
-        tasks: {
-            id: string;
-            title: string;
-            dependencies: string[];
-            parallelGroups: number[][];
-        }[];
-        parallelGroups: number[][];
-    };
+    setTaskRunnerSessionId(id: string, runnerSessionId: string | undefined): void;
+    setTaskAttemptSkills(id: string, skills: Task['attemptSkills']): void;
     /**
      * Widen the plan's runner set. Retargeting a task onto a runner the plan has
      * not used before has to land here as well as on the plan state, or
@@ -1493,23 +1428,12 @@ type IsolationNoticeLevel = 'info' | 'warn' | 'error';
 interface IsolationRunListener {
     /** The run record changed and should be persisted with the plan. */
     changed(): void;
-    /**
-     * A run opened — the one moment shared by Execute, a manual task run and
-     * a force start, so whatever a run pins for its whole length is read here.
-     * Whether it isolates is decided later, at its first change task.
-     */
-    opened(): void;
     /** A run did not start: `repos` of the group have tracked changes. */
     blocked(repos: string[]): void;
     /** An isolated run closed and handed its integration branches over. */
     handoff(handoff: IsolationHandoff): void;
     /** Already said through the notifications; also for a surface that shows no toasts. */
     notice(level: IsolationNoticeLevel, message: string): void;
-    /**
-     * These tasks' worktrees are about to be removed. An agent left running in
-     * one would sit in a deleted directory, so it has to go first.
-     */
-    releasing(taskIds: string[]): void;
 }
 interface IsolationRunControllerDeps {
     isolation: IWorktreeIsolation;
@@ -1552,6 +1476,8 @@ declare class IsolationRunController {
     /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
     private resolvers;
     private opening;
+    /** Bumped by an interrupt, so an activation in flight across it does not open the run it ended. */
+    private activations;
     /** The start a dirty tree turned away, handed back once the user chooses how to go on. */
     private blockedStart;
     /** The dirty repos behind {@link blockedStart}, for the stash notice. */
@@ -1604,6 +1530,15 @@ declare class IsolationRunController {
      * the safe rule then.
      */
     plannerLayout(): Promise<IsolatedExecution>;
+    /**
+     * Where the workspace's skills are read, and whether tasks get worktrees.
+     * Read synchronously inside a planner turn or a chip edit, so it comes from
+     * the files, not git or the planner's last layout: a restored session is
+     * right from its first edit. The run's repos while it isolates; otherwise
+     * the group the workspace holds, in worktrees unless isolation is off or
+     * this run chose to share the root.
+     */
+    skillLayout(): SkillLayout;
     /**
      * Go on with the start a dirty tree turned away. `stash` puts the user's
      * tracked changes on the git stash first, so the run isolates; `shared` runs
@@ -1746,6 +1681,10 @@ declare class IsolationRunController {
      * whole. One that cannot be continued for another reason — it ran from a
      * different workspace path — keeps its integration branch in each repo that
      * has not merged it: only the user gives landed work up.
+     *
+     * False when `interrupted` came while git was minting: a newer activation
+     * may be minting its own run, so this one is never installed over it, and
+     * is discarded rather than left as branches no record names.
      */
     private mint;
     private reportCopies;
@@ -1897,7 +1836,7 @@ interface OrchestratorObserver {
     }): void;
     onTick?(): void;
     onExecutionComplete?(): void;
-    /** Queued user messages are ready to be processed by the planner. */
+    /** The run is parked behind queued user messages, with nothing live, until they are drained. */
     onQueueReady?(): void;
     onReviewNeeded?(data: {
         tasks: Task[];
@@ -1931,8 +1870,8 @@ interface OrchestratorObserver {
     }): void;
 }
 /**
- * A message or interrupt a task cannot take: it is not running, it runs on the
- * terminal transport, or it is waiting on something a message does not answer.
+ * A message or interrupt a task cannot take: it is not running, or it is
+ * waiting on something a message does not answer.
  * The request is wrong, not the orchestrator, so a surface says why.
  */
 declare class TaskControlError extends Error {
@@ -1948,17 +1887,18 @@ interface TaskAttemptSnapshot {
     runner: string;
     cwd: string | null;
     startedAt: string;
+    skills: readonly TaskSkillSnapshot[];
 }
 /**
  * The wiring a {@link TaskOrchestrator} runs on, every collaborator resolved.
- * {@link createTaskOrchestrator} is the only production caller; tests build one
- * through that factory too. The constructor makes nothing itself, so there is
- * exactly one place defaults live.
+ * {@link TaskOrchestrator.compose} is the only production caller; tests build
+ * one through it too. The constructor makes nothing itself, so there is exactly
+ * one place defaults live.
  */
 interface TaskOrchestratorDeps {
     config: IConfig;
     notifications: INotification;
-    terminalRunner: ITerminalRunner;
+    runner: IRunner;
     store: PlanStore;
     output: TaskOutputSource;
     /** The plan's isolation run and the open run's lifecycle (ADR-0013). */
@@ -1970,30 +1910,27 @@ interface TaskOrchestratorDeps {
     workspaceRoot: () => string;
     /** The workspace's own variables for a task's cwd (ADR-0016). */
     workspaceEnv: (cwd: string) => Promise<WorkspaceEnv>;
-    /** Read live at each spawn, so a toggle takes effect on the next task. */
-    tddEnabled: () => boolean;
-    /** Read once as a run opens, never per spawn (ADR-0018, S1). */
-    runnerTransport: () => RunnerTransport;
+    /** The skill catalog over workspace roots, as {@link workspaceSkillRoots} orders them — read at each spawn. */
+    skillsAt: (roots: readonly string[]) => SkillLookup;
     /** What the task's last saved attempt did, or null when it left no log (ADR-0020). */
     previousAttemptFromLog: (taskId: string) => string | null;
 }
 /**
- * What a caller supplies to {@link createTaskOrchestrator}; every optional one
- * gets its default there. This is what a host or test chooses, not the resolved
- * wiring the orchestrator itself runs on.
+ * What a caller supplies to {@link TaskOrchestrator.compose}; every optional
+ * one gets its default there. This is what a host or test chooses, not the
+ * resolved wiring the orchestrator itself runs on.
  */
 interface TaskOrchestratorOptions {
     config: IConfig;
     notifications: INotification;
-    terminalRunner: ITerminalRunner;
+    runner: IRunner;
     store?: PlanStore;
     output?: TaskOutputSource;
     isolation?: IWorktreeIsolation;
     registry?: RunnerRegistry | null;
     workspaceRoot?: () => string;
     workspaceEnv?: (cwd: string) => Promise<WorkspaceEnv>;
-    tddEnabled?: () => boolean;
-    runnerTransport?: () => RunnerTransport;
+    skillsAt?: (roots: readonly string[]) => SkillLookup;
     previousAttemptFromLog?: (taskId: string) => string | null;
 }
 /**
@@ -2002,14 +1939,14 @@ interface TaskOrchestratorOptions {
  * All task-shaped state — the plan tree, the flat index, the completed set
  * — lives in {@link PlanStore}, injected at construction. The orchestrator
  * calls `store.markCompleted(id)` / `store.markFailed(id)` instead of mutating
- * task state directly. A task completes only after the runner emits its
- * per-task completion marker; process exit without that evidence is a visible
- * failure and does not unblock dependent work.
+ * task state directly. A task completes only after the runner reports it done
+ * through `task_complete` on its attempt's token; process exit without that
+ * evidence is a visible failure and does not unblock dependent work.
  */
 declare class TaskOrchestrator {
     private config;
     private notifications;
-    private terminalRunner;
+    private runner;
     private store;
     private output;
     private attempts;
@@ -2020,8 +1957,6 @@ declare class TaskOrchestrator {
     private reviewApproved;
     private retryCounts;
     private spawnCounts;
-    /** The terminal a verdict left open, by task; see {@link LingeringRunners}. */
-    private lingering;
     /**
      * A full-plan run a failure paused. Retrying the failed task is the explicit
      * resume the pause waits for — without this a retry only reset the task to
@@ -2060,20 +1995,13 @@ declare class TaskOrchestrator {
     private registry;
     private workspaceRootFn;
     private observers;
-    private tddEnabled;
-    private readRunnerTransport;
+    private skillsAt;
     private previousAttemptFromLog;
-    /**
-     * The setting as the latest run copied it when it opened. Every spawn of
-     * that run uses this, so flipping the setting mid-run changes the next run
-     * only — the plan, not a live setting, says what runs (ADR-0001).
-     */
-    private planTransport;
     constructor(deps: TaskOrchestratorDeps);
     /**
      * The composition root: resolves every optional collaborator and wires the
      * isolation listener that the constructor cannot, because it needs the
-     * instance's own (private) emit and lingering seams. Nothing else in the
+     * instance's own (private) emit seam. Nothing else in the
      * codebase constructs an orchestrator, so this is the one place defaults
      * live — a host or test supplies what it cares about and gets the rest.
      */
@@ -2082,7 +2010,7 @@ declare class TaskOrchestrator {
     getIdleSince(taskId: string): string | null;
     /**
      * What an ops retry is told about the attempt before. The saved log is read
-     * whether or not the session was reloaded, so both behave alike; the terminal
+     * whether or not the session was reloaded, so both behave alike; the output
      * buffer is the fallback for a runner that has no log. A reload clears the
      * attempt count along with the buffer, so a retry made since is what says
      * there was an attempt to report on.
@@ -2119,13 +2047,13 @@ declare class TaskOrchestrator {
     forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
     /** Take back a message still queued behind a turn; false once it was delivered. */
     removeQueuedTaskMessage(taskId: string, id: string): boolean;
-    /** Stop a structured task's running turn; it then waits for input like any turn that ends without its marker. */
+    /** Stop a structured task's running turn; it then waits for input like any turn that ends without a `task_complete` call. */
     interruptTask(taskId: string): Promise<void>;
     /** What is waiting for a structured task's turn to end; empty for any other task. */
     getQueuedTaskMessages(taskId: string): QueuedTaskMessage[];
-    private structuredSession;
+    private runnerSession;
     /**
-     * A structured turn that ended without the done marker (ADR-0018, W1). No
+     * A structured turn that ended without a `task_complete` call (ADR-0018, W1). No
      * verdict is guessed: the task waits for input, unless a checkpoint in the
      * same turn already has it waiting, or a queued message went straight out —
      * the session never passes through idle then, so nothing flickers.
@@ -2151,7 +2079,6 @@ declare class TaskOrchestrator {
     /** Task id → session id of every attempt whose runner is up; a spawn in flight has no session yet. */
     get activeSessionMap(): Map<string, string>;
     getAttempt(taskId: string): TaskAttemptSnapshot | undefined;
-    getAttemptSession(taskId: string): ITerminalSession | undefined;
     get queuedCount(): number;
     /**
      * "Merge all"; a settled run that merged everything is cleared up and
@@ -2172,18 +2099,12 @@ declare class TaskOrchestrator {
      * the task has started, and for every other task.
      */
     getMergeGate(taskId: string): string[];
-    private watchBlockingPrompts;
-    /** The transport the plan's latest run copied from the setting; null before its first run. */
-    get runnerTransport(): RunnerTransport | null;
-    /** Take over a saved plan's copied transport. The next run copies the setting afresh. */
-    adoptRunnerTransport(transport: RunnerTransport | null): void;
-    queueMessage(text: string): void;
+    queueMessage(text: string, skills?: readonly SkillLoad[]): void;
     getQueuedMessages(): QueuedMessage[];
     /** Take one unsent message back out of the queue; false when it was never there (or already drained). */
     removeQueuedMessage(id: string): boolean;
     setQueuedMessages(messages: QueuedMessage[]): void;
     clearQueuedMessages(): void;
-    processNextQueuedMessage(): QueuedMessage | null;
     loadPlan(tasks: readonly Task[], planRunners?: RunnerId[]): void;
     /**
      * Adopt an edited plan without letting go of the run in progress. Everything
@@ -2224,7 +2145,16 @@ declare class TaskOrchestrator {
      * run up, so neither may happen under a task the plan still shows at work.
      */
     private get settled();
-    onUserTaskComplete(taskId: string): Promise<void>;
+    /**
+     * The boundary a verdict crosses: nothing awaits the verifier's listener, so
+     * a throw from reading the output, landing, releasing a worktree or the tick
+     * after would be an unhandled rejection — and an attempt left integrating is
+     * live work forever. One that never settled fails (a repair waits on the
+     * user, as its conflict did); either way the run halts and says why.
+     */
+    private deliverVerdict;
+    /** Work nothing awaits: a rejection is said, not left unhandled. */
+    private unawaited;
     private onVerdict;
     private afterVerdict;
     /**
@@ -2281,7 +2211,6 @@ declare class TaskOrchestrator {
      */
     releaseTask(taskId: string): Promise<void>;
     markTaskComplete(taskId: string): Promise<void>;
-    markAiTaskComplete(taskId: string): Promise<void>;
     /**
      * Undo a completion: return the task to "not executed" — pending, verdict and
      * summary dropped, archive entry removed. It is put on hold like a cancel, so
@@ -2328,16 +2257,9 @@ declare class TaskOrchestrator {
     isAllComplete(): boolean;
     isAnyFailed(): boolean;
     approveReview(): Promise<void>;
-    getPlanVisualization(): {
-        tasks: {
-            id: string;
-            title: string;
-            dependencies: string[];
-            parallelGroups: number[][];
-        }[];
-        parallelGroups: number[][];
-    };
     tick(): Promise<void>;
+    /** Whether the scheduler may start `id` now: it passes every readiness gate and a slot is free. */
+    private stillReady;
     /**
      * A run paused at merge gates says so, as plainly as a task that waits on
      * the user: which tasks wait, and that Merge all lets them go on (ADR-0020).
@@ -2351,13 +2273,14 @@ declare class TaskOrchestrator {
      * unwound (both leave `startTask` with nothing further to announce).
      */
     private spawnAttempt;
+    /** For a skill the main checkout has, the folder a worktree only gets once it is committed. */
+    private uncommittedSkillFolder;
     /**
-     * Say on the task how this attempt is driven, when its plan asked for the
-     * structured transport; a terminal plan's tasks record nothing. A structured
-     * request that came back a terminal session is a fallback, and says why —
-     * a host without a router included — never a silent downgrade.
+     * The roots whose `.ordewell/skills/` an attempt at `cwd` reads: in a repo
+     * group, `cwd` holds each repo — a worktree of it when isolated, the
+     * workspace's own checkout when not — and no folder of its own (ADR-0014).
      */
-    private recordTransport;
+    private skillRoots;
     /**
      * A continue whose runner never announced the session it was told to
      * resume. Nothing was continued, and nothing fresh was started in its place.
@@ -2383,24 +2306,17 @@ declare class TaskOrchestrator {
      * it receives for an attempt that is no longer current).
      *
      * A user interruption also bumps the verifier's generation *before* stopping
-     * the runner: some runners (e.g. tmux) fire onExit synchronously from
+     * the runner: a runner may fire onExit synchronously from
      * stop(), and if that exit reaches VerdictEngine under the still-valid
      * generation it delivers a verdict that marks the task 'completed' for one
-     * tick — long enough for the scheduler to start a dependent task. A verdict
-     * leaves a terminal runner up so its screen stays readable (a structured one
-     * ends), and stop/load reset the whole verifier themselves.
+     * tick — long enough for the scheduler to start a dependent task. Stop and
+     * load reset the whole verifier themselves.
      */
     private endAttempt;
     /** Kept on the task once the attempt ends, so a continue can resume it after a reload (ADR-0018, K1). */
     private saveNativeSession;
     private endAllAttempts;
 }
-/**
- * Build a {@link TaskOrchestrator}, filling in every collaborator a caller did
- * not inject. The one entry point for hosts, bench harnesses and tests alike;
- * {@link TaskOrchestrator} itself constructs nothing.
- */
-declare function createTaskOrchestrator(options: TaskOrchestratorOptions): TaskOrchestrator;
 
 /**
  * Everything needed to produce a plan from a goal. Carries the planning context
@@ -2417,9 +2333,13 @@ interface PlanRequest {
     autonomousDefault?: boolean;
     signal?: AbortSignal;
     perRunnerAllowlist?: Partial<Record<RunnerId, string[]>>;
-    /** The mode toggles this run honours. `modesFor('one-shot', …)` decides which apply. */
     modes?: PlannerModes;
 }
+/** A generated plan, and what its skill check warned about. */
+interface GeneratedPlan extends LegacyPlanState {
+    /** Names not found yet, or no skill could have; the plan still lands. Absent means none, or not checked. */
+    skillWarnings?: string[];
+}
 interface ModifyPlanRequest {
     existingPlan: LegacyPlanState;
     userRequest: string;
@@ -2444,10 +2364,14 @@ interface ModifyDuringExecutionRequest {
     perRunnerAllowlist?: Partial<Record<RunnerId, string[]>>;
     /** Where the run in force puts each task (ADR-0013, ADR-0014). */
     isolatedExecution?: IsolatedExecution;
+    /** The workspace's skill catalog under its repo group's layout, which the rewritten tasks' skills are checked against. */
+    skills: SkillLookup;
 }
 interface ModifyDuringExecutionResult {
     pendingTasks: Task[];
     message: string;
+    /** Skill names not found yet; the edit still lands, as a submitted plan's does. Absent means none. */
+    skillWarnings?: string[];
 }
 /**
  * Owns one-shot plan generation and plan modification — the "planning is a
@@ -2466,8 +2390,12 @@ declare class Planner {
     private readonly resolveAiService;
     constructor(config: IConfig, aiService: IAiService | (() => IAiService));
     private get aiService();
-    /** One-shot plan generation for non-conversational surfaces. Never asks questions. */
-    generate(req: PlanRequest): Promise<LegacyPlanState>;
+    /**
+     * One-shot plan generation for non-conversational surfaces. Never asks
+     * questions. A plan attaching a planner skill to a task is refused, not
+     * returned: there is no conversation to send it back through.
+     */
+    generate(req: PlanRequest): Promise<GeneratedPlan>;
     modify(req: ModifyPlanRequest): Promise<{
         tasks: Task[];
     }>;
@@ -2563,9 +2491,7 @@ declare class RunnerInstallation {
      * typing a real goal is the failure this exists to prevent.
      *
      * "Usable" is deliberately shallow: the binary answers `--version`, and the
-     * runner has a connector to plan over. Plugin runners have none yet: a
-     * manifest-level planner capability, so a plugin can declare itself
-     * plannable, is a follow-up. Whether the user's subscription is
+     * runner has a connector to plan over. Whether the user's subscription is
      * live cannot be known without spending a turn on it, so an expired login
      * surfaces where it actually bites — as the agent's own error text on the
      * first turn.
@@ -2641,6 +2567,37 @@ declare function isCliProvider(id: AiProvider): boolean;
 declare function runnerForProvider(id: AiProvider): string | null;
 /** The harness planner that wraps a given runner, or null when none does. */
 declare function providerForRunner(runner: string): AiProvider | null;
+/** One runner's planner usability, as `RunnerInstallation.plannerUsability` reports it. */
+interface PlannerUsability {
+    usable: boolean;
+    reason?: string;
+}
+/**
+ * One entry of the planner backend list (ADR-0009). `id` is the `AiProvider`
+ * either way; `runner` is set only for a harness planner, whose model catalog
+ * comes from that runner, and `reason` is the second line a surface renders —
+ * the block detail for a harness planner, the API-key variable for a vendor.
+ */
+interface PlannerBackendEntry {
+    id: AiProvider;
+    label: string;
+    kind: 'harness' | 'vendor';
+    runner?: string;
+    usable: boolean;
+    reason?: string;
+}
+/** The detail a usable harness planner is always shown with. */
+declare const HARNESS_PLANNER_REASON = "coding agent \u00B7 no API key needed";
+/**
+ * The planner backends every surface offers, in order: the harness planners
+ * first, always listed so a missing CLI is greyed with its reason rather than
+ * hidden, then the configured vendors in `PROVIDER_PRIORITY` order. Pure: the
+ * caller supplies what it knows of each runner (VS Code its `plannerUsability`
+ * results, the TUI its installed set) and maps the entries to its own item
+ * type, keeping surface-specific affordances — e.g. the CLI's empty-vendor
+ * placeholder — to itself.
+ */
+declare function plannerBackendEntries(usability: Readonly<Record<string, PlannerUsability>>, configured: readonly AiProvider[]): PlannerBackendEntry[];
 /**
  * The single definition of which providers count as "configured" — one API
  * key each, or (for `openai_compatible`) an explicit base URL. Every surface
@@ -2719,7 +2676,7 @@ interface EnvAdmission {
  */
 declare function admitSettingsEnv(env: Record<string, unknown>): EnvAdmission;
 
-/** Whether a runner's tasks can run on the structured transport (ADR-0018, S3). */
+/** Whether Ordewell can run a runner's tasks (ADR-0018, S3). */
 declare function supportsTaskMode(runner: string): boolean;
 /** The adapter that drives one task. Throws {@link TaskModeUnsupportedError} for a runner without a connector. */
 declare function createTaskAdapter(runner: string, deps: AgentProcessDeps): TaskModeAgentAdapter;
@@ -2740,8 +2697,8 @@ interface SpawnSpec {
  *
  * Subclasses own their agent's protocol: what to spawn, how to phrase a user
  * turn, and how to read one protocol line. Everything below — line framing,
- * turn lifecycle, abort, stderr capture, premature-exit detection — is the
- * same for all of them.
+ * turn lifecycle, abort — is the same for all of them, and the process itself
+ * is a {@link RunnerProcess}.
  */
 declare abstract class StdioAgentAdapter implements AgentAdapter {
     protected deps: AgentProcessDeps;
@@ -2749,8 +2706,7 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     protected process: ChildProcess | null;
     protected sessionId: string | null;
     private readonly stdout;
-    private stderrTail;
-    private exited;
+    private readonly runner;
     /** Set for the duration of a turn. Outside one, events are buffered rather than dropped. */
     private turnEmit;
     /** Set for the duration of a turn. Pinged on every raw line, whether or not `handleLine` turns it into an event. */
@@ -2772,11 +2728,6 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     /** A task's session, which wants what the agent says on its own after a turn closed; a planner registers none and drops it. */
     private outOfTurnListener;
     private disposed;
-    /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
-    protected processEnded: Promise<void>;
-    /** The environment the agent was spawned under, for any side process a handshake needs. */
-    protected spawnEnv: NodeJS.ProcessEnv;
-    private markEnded;
     /** What this process is to the user — a planner or a task's runner — for the words a failure is reported in. */
     protected role: 'planner' | 'task';
     constructor(deps: AgentProcessDeps);
@@ -2792,6 +2743,17 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     /** Protocol handshake, if the agent needs one before it accepts a turn. */
     protected handshake(_opts: AgentStartOptions): Promise<void>;
     start(opts: AgentStartOptions): Promise<void>;
+    /**
+     * Every protocol line goes to `handleLine`, turn or no turn: an agent's
+     * handshake and its session-id announcement both arrive before the first
+     * message is sent, and dropping them left the handshake waiting on a reply
+     * that had already come and gone.
+     */
+    private readProtocol;
+    /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
+    protected get processEnded(): Promise<void>;
+    /** The environment the agent was spawned under, for any side process a handshake needs. */
+    protected get spawnEnv(): NodeJS.ProcessEnv;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
     onOutOfTurn(listener: (event: AgentEvent) => void): void;
     nativeSessionId(): string | null;
@@ -2839,7 +2801,7 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * A task's turn whose `result` arrived while background work was still open.
      * The CLI reports that result when the model stops talking, then opens a turn
      * of its own when the work finishes; a turn ended at the first result would
-     * lose everything said after it, the completion marker included.
+     * lose everything done after it, the `task_complete` call included.
      */
     private resultHeld;
     private followOnTimer;
@@ -2859,8 +2821,7 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     /**
      * A task's run: the manifest decides what its mode and effort mean
      * (ADR-0001), and this adds only the protocol around them. No tool list and
-     * no system prompt — the task's prompt is its first turn, as on the terminal
-     * transport. `--permission-prompt-tool stdio` routes the questions the mode
+     * no system prompt — the task's prompt is its first turn. `--permission-prompt-tool stdio` routes the questions the mode
      * leaves open to the control channel, where the adapter must answer them;
      * without it `-p` refuses them silently and nothing can ever surface one.
      */
@@ -2868,7 +2829,6 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     /** The file holding the token lives exactly as long as the process that reads it. */
     private ordewellServerArgs;
     private removeMcpConfig;
-    start(opts: AgentStartOptions): Promise<void>;
     /** Asks the CLI itself, which reports `pending` until its connection attempt settles. */
     mcpAttached(): Promise<boolean>;
     /**
@@ -2974,16 +2934,12 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private threadId;
     /** The model Codex opened the thread with — usage records name it. */
     private threadModel;
-    private nextRequestId;
-    private settleHandshake;
-    private handshakeError;
+    private readonly rpc;
     private startOpts;
     /** Whether this turn has already emitted prose — see the `agentMessage` case. */
     private turnHasText;
     /** The turn in flight. `turn/interrupt` and `turn/steer` cannot be sent before it has an id. */
     private turn;
-    /** The JSON-RPC id of the `turn/start` that opened {@link turn}. */
-    private turnRequestId;
     /** The last turn this adapter ended — so its second end signal, landing late, ends nothing. */
     private endedTurnId;
     /** An interrupt was asked for during this turn, so however it ends, it was cut short. */
@@ -2994,8 +2950,6 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * that belongs to no turn of the agent's any more (ADR-0023, F4).
      */
     private readonly interruptedTurnIds;
-    /** An interrupt asked for before Codex named the turn, sent once it does. */
-    private interruptOnStart;
     /** A task's approval requests still waiting for an answer, by the request id as a string. */
     private readonly openPermissions;
     /**
@@ -3005,10 +2959,6 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private readonly fileChangePaths;
     /** The row each announced file of an in-flight `fileChange` item is shown under, by the file's shown path. */
     private readonly fileChangeRows;
-    /** Requests this adapter sent and awaits an answer to, by JSON-RPC id. */
-    private readonly pendingRequests;
-    private resumeAttempted;
-    private resumeFallbackSent;
     private sandbox;
     /** The Ordewell server's startup state, as Codex last reported it for this thread. */
     private mcpStartup;
@@ -3019,6 +2969,7 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * one stream; the thread id is what tells them apart (see {@link subagentOf}).
      */
     private readonly subagents;
+    constructor(deps: AgentProcessDeps);
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
     /**
      * `initialize`, then `thread/start`, both before the first user message. A
@@ -3028,16 +2979,18 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * construction. A task's runs as its mode says (see {@link threadParams}).
      */
     protected handshake(opts: AgentStartOptions): Promise<void>;
+    private handshakeIncomplete;
     /**
      * Open this session's thread. A resume id means the previous
      * process died mid-session: `thread/resume` puts the agent back in front of
      * the context it already paid to read. A planner's failed resume is not an
-     * error — the response handler falls back to a fresh thread, which is the
-     * same degradation `restoreChat` performs on every surface (T4). A task's
-     * is: Continue (K1) offers the session that did the work, and a fresh thread
-     * in its place would pretend it was resumed.
+     * error — it falls back to a fresh thread, which is the same degradation
+     * `restoreChat` performs on every surface (T4). A task's is: Continue (K1)
+     * offers the session that did the work, and a fresh thread in its place
+     * would pretend it was resumed.
      */
-    private startThread;
+    private openThread;
+    private requestThread;
     private threadParams;
     /**
      * Codex's own startup report for the server, which it sends once the thread
@@ -3048,10 +3001,12 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private effort;
     /**
      * `turn/interrupt` names the turn as well as the thread, so an interrupt
-     * asked for before Codex has named the turn waits for it. Codex acknowledges
-     * with an empty result, then ends the turn as `interrupted`.
+     * asked for before Codex has named the turn waits for it, as a steer does.
+     * Codex acknowledges with an empty result, then ends the turn as `interrupted`.
      */
     interrupt(timeoutMs: number): Promise<boolean>;
+    /** Run `send` now if Codex has named the turn, and once it does if not. */
+    private whenNamed;
     /**
      * `turn/steer` into the running turn (ADR-0023). Codex answers with the
      * turn's id at once — acceptance, not delivery — and shows the input to the
@@ -3070,6 +3025,8 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      */
     answerPermission(id: string, decision: ApprovalDecision): boolean;
     protected turnPayload(message: string): string;
+    /** `turn/start`'s answer. One for a turn that has since closed or been replaced names and closes nothing. */
+    private turnAnswered;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
     private turnStarted;
     /**
@@ -3148,8 +3105,8 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
  * (ADR-0009, ADR-0018).
  *
  * The odd one out: `opencode serve` is a real server rather than a stdio
- * protocol, so this adapter owns both halves of the boundary — it spawns the
- * process through the same injected `spawn` every other adapter uses, then
+ * protocol, so this adapter owns both halves of the boundary — it starts the
+ * process as the same {@link RunnerProcess} every other adapter uses, then
  * talks to it through the injected `fetch`. Both are part of the one seam the
  * tests drive.
  *
@@ -3169,12 +3126,8 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     /** Sent on every request to a task's server, which a per-task password secures. */
     private authorization;
     private sessionId;
-    private stderrTail;
-    private exited;
-    private exitCode;
+    private readonly runner;
     private disposed;
-    private markEnded;
-    private readonly processEnded;
     private planner;
     private task;
     /** The last assistant message already settled — the baseline {@link recoverReply} measures a new reply against. */
@@ -3190,7 +3143,19 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     /** The Ordewell server this process was configured with; null when none was given or its config could not be merged. */
     private ordewell;
     constructor(deps: AgentProcessDeps);
+    private get processEnded();
+    private get exited();
     start(opts: AgentStartOptions): Promise<void>;
+    private launch;
+    /**
+     * Where `serve` listens, or null once it ends or gives up. Stdout only: that
+     * is where `serve` prints its address, and stderr can carry another URL — a
+     * warning about a provider it could not reach. Read a line at a time, and
+     * only until the address is known.
+     */
+    private serverAddress;
+    /** From the server's address to an open session — the 2.x API's, or a 1.x one created or resumed. */
+    private connect;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
     /**
      * One task turn. `prompt_async` only queues the work, so the turn is over
@@ -3219,8 +3184,8 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     /**
      * Whatever of the turn's own messages the stream missed. Each part is
      * emitted once, so a turn the stream saw whole adds nothing here; one that
-     * lost its last text part still reaches the plain-text channel, where the
-     * done marker is looked for.
+     * lost its last text part still reaches the plain-text channel, which a
+     * summary falls back to.
      */
     private readBack;
     /**
@@ -3340,12 +3305,191 @@ declare function mapAgentTool(name: string): MappedTool;
  */
 declare function normalizeAgentArgs(tool: ResearchToolType, args: Record<string, unknown>): Record<string, unknown>;
 
+/** What a runner offers a task: the models discovered for it and the modes its manifest declares. */
+interface RunnerCatalog {
+    models: DiscoveredModel[];
+    modes: RunnerModeInfo[];
+    /**
+     * The mode a task lands on when it carries none this runner offers: the
+     * manifest's `autonomous`/`safe`-tagged mode under the user's toggle
+     * (ADR-0001). Absent, `modes[0]` stands in — which for Codex is its
+     * workspace-write sandbox, not the full access an unattended run needs.
+     */
+    defaultMode?: string;
+}
+/**
+ * The model, thinking effort and mode a runner offers for a task.
+ *
+ * A task's model, effort and mode are all scoped to its runner:
+ * `claude-sonnet-4-5` on Codex, or `acceptEdits` on OpenCode, are not degraded
+ * choices but unspawnable ones. So this is where any task acquires a runnable
+ * assignment — a runner change (below) and a hand-added task derive it the same
+ * way. Each field in `current` is preserved when the runner also offers it, and
+ * otherwise snapped to that runner's preferred entry (discovery already sorts
+ * models by the manifest's `preferredPatterns`; the mode is the catalog's
+ * `defaultMode`).
+ *
+ * An empty catalog means discovery failed — not that the runner offers nothing. That field is left out of the
+ * patch and the runner validates last, matching `coerceAssignments`.
+ */
+declare function runnerAssignment(catalog: RunnerCatalog, current?: Pick<Task, 'assignedModel' | 'taskMode'>): Partial<Task>;
+/**
+ * Move a task onto a different runner, carrying its model, thinking effort and
+ * mode over to values that runner actually offers. A runner change is never a
+ * single-field edit — it either brings the other three with it or leaves the
+ * task unrunnable.
+ *
+ * Returns the patch to apply, or `{}` when there is nothing to change.
+ */
+declare function retargetTaskRunner(task: Task, runner: RunnerId, catalog: RunnerCatalog): Partial<Task>;
+
+type ModelsByRunner = Partial<Record<RunnerId, DiscoveredModel[]>>;
+interface SessionCatalogDeps {
+    config: Pick<IConfig, 'enabledRunners' | 'autonomousMode'>;
+    registry: Pick<RunnerRegistry, 'getManifest'>;
+    modelResolver: Pick<ModelResolver, 'modelsForRunners' | 'getCachedRunnerModels'>;
+    /** Read at each call: a toggle or allowlist edit made since the session was built counts (#69). */
+    settings: () => {
+        enabledRunners?: RunnerId[];
+        modelAllowlist?: Record<string, string[]>;
+    };
+    /** The runners of the plan being edited; empty while the session has none. */
+    planRunners: () => RunnerId[];
+}
+/**
+ * What a session may assign: the enabled runners, their modes, the models
+ * discovery found for them and the allowlist narrowing those. Every view of
+ * it — the planner's per-turn block, its tools, a user's direct edit — reads
+ * it here, so none can be shown or checked against something the others are not.
+ *
+ * The discovered models are remembered per runner and only ever merged into:
+ * discovering one runner must not forget another's, since coercion later clamps
+ * thinking efforts against whatever was last found.
+ */
+declare class SessionCatalog {
+    private readonly deps;
+    private discovered;
+    constructor(deps: SessionCatalogDeps);
+    /** The runners enabled right now. */
+    enabledRunners(): RunnerId[];
+    /**
+     * The allowlist in force right now. Unset means no restriction — falling
+     * back to the one planning started under would keep a restriction the user
+     * has since cleared.
+     */
+    allowlist(): Record<string, string[]>;
+    /** The models the user allows on one runner; unset means no restriction. */
+    allowlistFor(runner: RunnerId): string[] | undefined;
+    /**
+     * The discovered catalog as the resolver holds it now, per runner, with this
+     * session's own discovery as the fallback where the resolver has nothing
+     * cached. The resolver's cache outlives this session's snapshot in both
+     * directions — an allowlist picker re-discovers into it mid-session — and a
+     * model allowed after that must reach the planner with its real label and
+     * variants, not as an id-only stub. Never triggers discovery itself.
+     */
+    models(): ModelsByRunner;
+    /** What this session's own discovery found for a runner; empty when it never ran there. */
+    known(runner: RunnerId): DiscoveredModel[];
+    /** Discover the runners' models, spawning their CLIs where the resolver has none cached, and remember them. */
+    discover(runners: RunnerId[]): Promise<ModelsByRunner>;
+    /**
+     * Keep what an admitted runner was found to offer, for the next coercion's
+     * effort clamping. An empty list is discovery having found nothing, not a
+     * runner offering nothing, so it never displaces what is known.
+     */
+    admit(runner: RunnerId, models: DiscoveredModel[]): void;
+    /** Session boundaries are hard: nothing discovered for one goal informs the next. */
+    reset(): void;
+    modes(runners: RunnerId[]): Record<RunnerId, RunnerModeInfo[]>;
+    /**
+     * What a planner may assign right now: every enabled runner, its modes, and
+     * its allowlisted models. Discovers a runner's models the first time it is
+     * asked for.
+     */
+    live(): Promise<TaskQueryCatalog>;
+    queryCatalog(runners: RunnerId[]): TaskQueryCatalog;
+    /**
+     * The catalog a model/task-mode edit is checked against — the same
+     * discovered models and manifest modes the per-turn catalog block shows the
+     * planner, so a refusal here can never name something invalid that the
+     * planner was never told about. The catalog is not filtered by the
+     * allowlist here — `checkModelAndModeValidity` narrows by allowlist itself,
+     * the same way `coerceAssignments` does.
+     */
+    edit(runners?: RunnerId[]): EditCatalog;
+    /** What a runner offers, as `runnerAssignment` needs it. Spawns the runner's CLI to list models. */
+    runner(runner: RunnerId): Promise<RunnerCatalog>;
+    /**
+     * The one place planning discovers what it may draw from: the runners'
+     * models and their modes. `filteredModels` is the allowlisted view a prompt
+     * may show; `modelsByRunner` stays whole because coercion needs real labels
+     * and variants.
+     */
+    planning(runners: RunnerId[]): Promise<{
+        modelsByRunner: Partial<Record<string, DiscoveredModel[]>>;
+        filteredModels: Partial<Record<string, DiscoveredModel[]>>;
+        runnerModes: Record<string, RunnerModeInfo[]>;
+    }>;
+}
+
 /** The dialogue record a fork carries — what {@link PlannerConversation.clone} returns. */
 interface ForkedDialogue {
     conversationHistory: ConversationMessage[];
     researchLog: ResearchLogEntry[];
 }
 
+/** A user's message as sent, and the skills its `/name` tokens load. */
+interface SkillInvocation {
+    text: string;
+    skills: SkillLoad[];
+}
+/**
+ * A path with the home directory written `~`, for a notice or listing. On
+ * Windows the drive letter's case is not significant and the separators are
+ * rendered `/`, so the same skill reads alike wherever the session reloads.
+ */
+declare function abbreviateHome(file: string, home?: string, platform?: NodeJS.Platform): string;
+/**
+ * Resolve the `/skill-name` tokens in a message to snapshots of the skills they
+ * name. Pure and exported so surfaces can resolve without a full Session. The text itself is never rewritten.
+ *
+ * Every distinct skill named loads, once, in the order first named. A token
+ * naming no skill is plain text, wherever it stands — a whole message of
+ * `/unknown` included: embedded in a sentence it is as likely to be incidental
+ * text (a path, an example command) as a typo'd invocation. So is one naming
+ * a skill with `user-invocable: false`, which only the model may invoke.
+ */
+declare function resolveSkillInvocation(text: string, skillsService: Pick<SkillsService, 'findSkill'>, home?: string): SkillInvocation;
+/**
+ * What the planner receives for a user message: the bodies of the skills it
+ * loaded, then the message as the user wrote it. The one composition for a
+ * live send and for a replay of the transcript, so a resumed conversation
+ * hands the planner what the live one did.
+ */
+declare function plannerMessage(text: string, loads: readonly SkillLoad[]): string;
+/**
+ * The transcript as the planner is to see it on a replay: each user message
+ * carries the skills loaded after it, composed by {@link plannerMessage}, and
+ * the load entries themselves are folded away. Sessions saved before skill
+ * loads existed hold the expanded text in the message and replay unchanged.
+ */
+declare function plannerTranscript(history: readonly ConversationMessage[]): ConversationMessage[];
+
+/**
+ * The planner turn (see CONTEXT.md): the one piece of planner work that holds
+ * the conversation, from its claim to its settled outcome. Its signal is what a
+ * stop aborts.
+ */
+declare class PlannerTurn {
+    private readonly controller;
+    private dropped;
+    get signal(): AbortSignal;
+    /** The plan it was answering was dropped under it, so nothing it settles may land. */
+    get abandoned(): boolean;
+    stop(): void;
+    abandon(): void;
+}
 /** A read made through a planner tool: refused once the turn's budget is gone, else answered, told to land when the budget asks it to. */
 type ToolRead<T> = {
     status: 'refused';
@@ -3386,7 +3530,7 @@ interface PlannerConversationHost {
      * conversation never reaches into execution state directly.
      */
     liveOutput: LiveOutputLookup;
-    hasLiveWork(): boolean;
+    isExecuting(): boolean;
     /** The session's single mutation ritual: op → persist → notify (default: the plan). */
     mutate(op: () => boolean, notify?: () => void): LegacyPlanState | null;
     broadcast: SessionBroadcaster;
@@ -3394,13 +3538,19 @@ interface PlannerConversationHost {
     broadcastPlan(turnId?: string): void;
     /** Validate a batch against live state. Pure — nothing is applied. */
     validateOps(ops: TaskOp[]): ApplyTaskOpsResult;
+    /** The workspace's skill catalog under its repo group's layout, which the skills a plan or edit attaches are checked against. */
+    taskSkills(): SkillLookup;
+    /** Tell the user something the transcript does not carry. */
+    notice(level: SessionNotice['level'], message: string): void;
     /** Load planner-produced tasks: an edit keeps run state, a commit starts over. Returns how many landed. */
     adoptTasks(tasks: readonly Task[], how: 'edit' | 'commit'): number;
     capturePrd(text: string): void;
     /** Park a structural edit until the next batch boundary. Returns the queue length. */
-    queueEdit(userMessage: string): number;
+    queueEdit(message: SkillInvocation): number;
     /** Wake a scheduler an applied edit may have unblocked. */
     afterEdit(): Promise<void>;
+    /** The planner turn was stopped or abandoned: whatever it is waiting on (a parked approval) will never be answered. */
+    turnAborted(): void;
 }
 /**
  * A conversation edit (rewind, fork) the conversation refused because the
@@ -3419,6 +3569,25 @@ declare class ConversationEditError extends Error {
 declare class ConversationBusyError extends ConversationEditError {
     constructor(operation: string);
 }
+/**
+ * A planner turn that settled after the plan it was answering was dropped (a
+ * new plan, another session adopted, the session closed), or after its call
+ * was cut off by something other than its own stop. Nothing it produced was
+ * committed: landing it would write one session's reply into another's
+ * transcript.
+ */
+declare class PlannerTurnDiscardedError extends Error {
+    constructor(options?: ErrorOptions);
+}
+/**
+ * The user stopped the turn and the backend reported that as a thrown error
+ * rather than a settled reply. Typed so a surface can stay quiet for it without
+ * reading the message: some SDKs' abort errors are plain `Error`s by name, and
+ * a real failure can mention "aborted" too.
+ */
+declare class PlannerTurnStoppedError extends Error {
+    constructor(options?: ErrorOptions);
+}
 /** A user message a rewind can fork the conversation from just before. */
 interface RewindTarget {
     /** Position in the transcript — what {@link PlannerConversation.cloneBefore} takes. */
@@ -3449,8 +3618,6 @@ interface TranscriptSnapshot {
 }
 interface ReplyOptions {
     signal?: AbortSignal;
-    /** The user's words before skill expansion — what a mid-run queue replays later. */
-    verbatim?: string;
 }
 /**
  * The planner conversation (ADR-0002), end to end: the persisted dialogue
@@ -3474,15 +3641,35 @@ declare class PlannerConversation {
     private persisted;
     /** Saves an execution event made while a turn may be in flight; see {@link restore}. */
     private savedInBackground;
-    private turnsInFlight;
-    private compacting;
+    private live;
     private openTurn;
     constructor(host: PlannerConversationHost);
     get transcript(): readonly ConversationMessage[];
-    /** Whether a user turn is between its transcript append and its settled outcome. */
+    /** Whether a planner turn holds the conversation. */
     get isTurnInFlight(): boolean;
+    /** Stop the planner turn in flight; it settles as stopped. False when none is. */
+    stopTurn(): boolean;
+    /**
+     * Drop the planner turn in flight together with the plan it was answering:
+     * it is stopped, whatever it settles is discarded, and the conversation is
+     * free at once rather than when the abandoned turn finishes unwinding.
+     */
+    abandonTurn(): void;
+    /**
+     * Run planner work that is not a conversation turn — one-shot plan
+     * generation — as the planner turn, so it is stopped, refused and superseded
+     * like one. It starts a fresh plan, so it supersedes the turn in flight.
+     */
+    hold<T>(signal: AbortSignal | undefined, body: (turn: PlannerTurn) => Promise<T>): Promise<T>;
+    /**
+     * Take the conversation for a new planner turn. A caller's own signal stops
+     * the turn too; the relay is detached on release because a caller may reuse
+     * that signal, and a stale listener would stop the next turn with it.
+     */
+    private claim;
     /** The user turn being answered, for what the host raises during it — an approval the turn's research asks for. */
     get currentTurnId(): string | undefined;
+    recordPlannerSkill(skill: SkillLoad): boolean;
     /**
      * Hand the open turn a plan (already validated) or a task edit. The turn
      * settles with it exactly as with the same plan or ops parsed out of its
@@ -3512,6 +3699,7 @@ declare class PlannerConversation {
         timestamp?: string;
         kind?: ConversationMessage['kind'];
     }): void;
+    private appendEntries;
     /** Swap the whole transcript. The live context no longer matches it, so pair with {@link reset}. */
     replace(messages: readonly ConversationMessage[]): void;
     snapshot(): TranscriptSnapshot | null;
@@ -3583,20 +3771,30 @@ declare class PlannerConversation {
      * Call inside the host's mutation ritual.
      */
     recordQueuedEdits(messages: string[], taskCount: number): void;
+    /**
+     * What the skill check of a landed plan or edit warned about, kept in the
+     * transcript so every surface shows it, on reload too, and not only the
+     * planner that may have read it in a tool result. Call inside the host's
+     * mutation ritual, so the broadcast plan carries it.
+     */
+    recordSkillWarnings(warnings: readonly string[], timestamp?: string): void;
     /**
      * Queued edits the between-batches drain could not apply. Recorded so the
      * transcript does not go on promising a change that never landed. Call
      * inside the host's mutation ritual.
      */
     recordQueuedEditsFailed(messages: string[], reason: string): void;
-    /** Open the conversation on a fresh plan: the goal is its first message. */
-    start(goal: string, opening: ConversationOpening, signal?: AbortSignal): Promise<LegacyPlanState>;
+    /**
+     * Open the conversation on the host's fresh plan: the goal is its first
+     * message. `prepare` (discovery) runs inside the turn, so a stop reaches it.
+     */
+    start(goal: SkillInvocation, prepare: () => Promise<ConversationOpening>, signal?: AbortSignal): Promise<LegacyPlanState>;
     /**
      * Every later user message, from the transcript append to a persisted
      * outcome. A turn that throws before anything was persisted takes its own
      * writes back out, so session memory never drifts from disk and the UI.
      */
-    reply(message: string, options?: ReplyOptions): Promise<LegacyPlanState>;
+    reply(message: string | SkillInvocation, options?: ReplyOptions): Promise<LegacyPlanState>;
     private replyTurn;
     /**
      * Whether a settled structural edit reaches work a runner is executing. Only
@@ -3607,7 +3805,28 @@ declare class PlannerConversation {
      */
     private editTouchesLiveWork;
     private assertIdle;
-    private inTurn;
+    /**
+     * Refuse to land a turn that no longer belongs here: it was abandoned, its
+     * plan is no longer the host's, or its call was cut off by something other
+     * than its own stop (`IAiService.reset` under a plan change) — what such a
+     * call hands back is a fragment of an answer to a dialogue that is gone.
+     */
+    private assertCurrent;
+    /**
+     * {@link assertCurrent} on the far side of an await that precedes a plan
+     * mutation: the skill check waits on git, and a stop, rewind or session
+     * switch in that window drops the edit instead of landing it on whatever
+     * plan is current by then. A stop counts here because nothing has landed
+     * yet — the user asked for the turn to end before it changed the plan.
+     */
+    private assertStillCurrent;
+    /**
+     * A live conversation is only safe to continue in-place when it also
+     * matches the model/effort configured right now — a harness planner's
+     * running process was spawned with the old one baked in and cannot pick up
+     * a switch (ADR-0009). Otherwise the turn resumes from the transcript.
+     */
+    private canContinueLive;
     /**
      * Bracket one user turn with its start and end, under an id minted here:
      * the turn is where the stream a surface draws begins and ends, and only the
@@ -3615,6 +3834,7 @@ declare class PlannerConversation {
      */
     private userTurn;
     private requirePlan;
+    /** The message as typed, then one entry per skill it loaded, sharing its timestamp so a reload keeps them together. */
     private recordUser;
     private recordResearch;
     /**
@@ -3652,12 +3872,15 @@ declare class PlannerConversation {
      */
     private taskQueryAnswer;
     /**
-     * Drive a planner turn to a persisted, broadcast outcome. Task edits apply
-     * atomically; validation failures are fed back to the model for up to 2
-     * silent retries, then surfaced as a message with the plan untouched. The
-     * first turn and every later turn route through here — one path, not two.
+     * Drive a planner turn, its reads already drained, to a persisted, broadcast
+     * outcome. Task edits apply atomically; validation failures are fed back to
+     * the model for up to 2 silent retries, then surfaced as a message with the
+     * plan untouched. The first turn and every later turn route through here —
+     * one path, not two.
      */
     private settle;
+    /** A name not found at submit only warns: a task the attaching one depends on may create it. */
+    private warnSkills;
     /** Validate + commit a task_ops turn atomically. Returns the errors on rejection (plan untouched). */
     private applyTaskOps;
     /** Commit a settled (non-task_ops) turn through the host's mutation ritual. */
@@ -3686,42 +3909,48 @@ declare class PlannerConversation {
     private currentPlanLines;
 }
 
-declare const BUILTIN_SKILL_NAMES: readonly ["grilling", "to-spec", "improve-codebase-architecture"];
-interface SkillMetadata {
-    name: string;
-    description: string;
-    disableModelInvocation?: boolean;
+interface UserSettings {
+    modelAllowlist?: Record<string, string[]>;
+    /** Last model (and its thinking effort) the user chose for each planner backend, keyed by AiProvider id. */
+    plannerModels?: Record<string, {
+        model: string;
+        effort?: string;
+    }>;
+    /**
+     * Runners the user picked for planning. Absent — not empty — is what falls
+     * back to the environment's defaults; `[]` is a deliberate "none of them".
+     */
+    enabledRunners?: string[];
+}
+/**
+ * The model allowlist, remembered planner models and enabled runners are shared
+ * across processes by default. `ORDEWELL_SETTINGS_PATH` lets independent runs
+ * use separate files: otherwise a write in one run would change another's
+ * settings when `getAll()` detects the new mtime.
+ */
+declare function getSettingsPath(): string;
+declare class SettingsService {
+    private filePath;
+    private cache;
+    private cachedMtimeMs;
+    constructor(filePath?: string);
+    getAll(): UserSettings;
+    private fileMtimeMs;
+    getModelAllowlist(runner: string): string[] | undefined;
+    setModelAllowlist(runner: string, ids: string[] | undefined): void;
+    getPlannerModel(provider: string): {
+        model: string;
+        effort?: string;
+    } | undefined;
+    setPlannerModel(provider: string, entry: {
+        model: string;
+        effort?: string;
+    } | undefined): void;
+    getEnabledRunners(): string[] | undefined;
+    setEnabledRunners(ids: string[]): void;
+    private load;
+    private persist;
 }
-interface SkillInfo {
-    name: string;
-    description: string;
-    metadata: SkillMetadata;
-    /** Full content of SKILL.md with frontmatter stripped */
-    content: string;
-    /** Absolute path to the SKILL.md file */
-    path: string;
-    /** Whether this came from global (~/.ordewell/skills/) or local (.ordewell/skills/) */
-    source: 'global' | 'local';
-}
-declare class SkillsService {
-    private workspaceRoot?;
-    constructor(workspaceRoot?: string | undefined);
-    private localDir;
-    private globalDir;
-    private readSeedManifest;
-    private recordSeed;
-    /** A seed the user never edited: safe to replace with a newer built-in. */
-    private isUntouchedSeed;
-    private seed;
-    seedBuiltinSkill(name: string): boolean;
-    /** Removes a retired built-in's seed from the global dir, but only if it's untouched by the user. */
-    private isUnmodifiedRetiredSeed;
-    private pruneRetired;
-    findSkill(name: string): SkillInfo | undefined;
-    listSkills(): SkillInfo[];
-    getSkillContent(name: string): string | undefined;
-}
-declare function createSkillsService(workspaceRoot?: string): SkillsService;
 
 /** The `planner_usage` member of the session broadcast union. */
 type PlannerUsageMessage = Extract<SessionMessage, {
@@ -3766,8 +3995,12 @@ interface SessionEventRelayDeps {
     /** What a task's waiting checkpoint asks, whole. */
     checkpointQuestion?: (taskId: string) => string | undefined;
 }
-/** Every orchestrator event the relay announces; `onTaskSettled` is persistence only, so it is the Session's. */
-type RelayObserver = Required<Omit<OrchestratorObserver, 'onTaskSettled'>>;
+/**
+ * Every orchestrator event the relay announces. `onTaskSettled` is persistence
+ * only and `onQueueReady` is the Session's cue to drain its queue, so both are
+ * the Session's alone.
+ */
+type RelayObserver = Required<Omit<OrchestratorObserver, 'onTaskSettled' | 'onQueueReady'>>;
 /**
  * Turns orchestrator and planner events into {@link SessionMessage}
  * broadcasts — the one place a surface's view of a Session is produced. It
@@ -3860,31 +4093,11 @@ interface GeneratePlanOptions {
 type SessionPlanner = Pick<Planner, 'generate' | 'modifyDuringExecution'>;
 /** Runtime prefs read live — may toggle between operations. */
 interface SessionRuntimeSettings {
-    tddEnabled: boolean;
-    verificationEnabled?: boolean;
     modelAllowlist?: Record<string, string[]>;
-    /** Read once as a run starts, never per spawn (ADR-0018, S1). Absent means terminal. */
-    runnerTransport?: RunnerTransport;
     /** Absent means the user never chose, and `config.enabledRunners` (the host's defaults) decides. */
     enabledRunners?: RunnerId[];
 }
 declare function sessionRuntimeSettings(settings: UserSettings): SessionRuntimeSettings;
-/**
- * Resolve `/skill-name` invocations to their skill's markdown content. Pure
- * and exported so surfaces and verification can drive substitution without a
- * full Session.
- *
- * A message that is *only* `/skill-name` keeps the legacy whole-message
- * behaviour: an unknown skill becomes a notice naming what IS available,
- * instead of a bare slash token a runner would mis-resolve in its own skills
- * directory. Anywhere else in a message, a matching token is spliced in place
- * (surrounding text is untouched); a token that doesn't name a real skill is
- * left as plain text rather than raising a notice, since embedded in a
- * sentence it's as likely to be incidental text (a path, an example command)
- * as a typo'd invocation. The same skill name repeated only expands its first
- * occurrence — later repeats stay literal.
- */
-declare function resolveSkillInvocation(text: string, skillsService: Pick<SkillsService, 'findSkill' | 'listSkills'>): string;
 /** Where a fork landed: the new session's id, and what adopting it needs. */
 interface ConversationFork {
     sessionId: string;
@@ -3900,14 +4113,14 @@ type SaveSession = (plan: LegacyPlanState, goal: string, workspace: string, sess
 /**
  * Everything a delivery surface constructs to host a session. Structural config
  * (orchestratorModel, providerModelLists) is snapshotted inside `config` at
- * construction and never re-read from the environment. Runtime settings (tdd,
- * verification, enabled runners) are read live via the `settings` callback so a
+ * construction and never re-read from the environment. Runtime settings
+ * (enabled runners) are read live via the `settings` callback so a
  * toggle between operations takes effect.
  */
 interface SessionDeps {
     config: IConfig;
     notifications: INotification;
-    runner: ITerminalRunner;
+    runner: IRunner;
     registry: RunnerRegistry;
     /** Resolves the workspace root for the orchestrator (lazy — VS Code can change it). */
     workspaceRoot: () => string;
@@ -3919,7 +4132,7 @@ interface SessionDeps {
     onNotice?: (notice: SessionNotice) => void;
     /** Shared across sessions — sole producer of model catalogs and routing lists. */
     modelResolver: ModelResolver;
-    /** Live runtime settings (tdd, verification, enabled runners). Read at each operation that needs them. */
+    /** Live runtime settings (enabled runners). Read at each operation that needs them. */
     settings: () => SessionRuntimeSettings;
     /**
      * Host-assigned session id. When set, every persist writes under this id so
@@ -3940,11 +4153,7 @@ interface SessionDeps {
      * over the session's workspace root.
      */
     skillsService?: SkillsService;
-    /**
-     * Where a task's output and final answer are read. Defaults to the agents'
-     * own transcripts under the user's home; tests inject one that never
-     * touches the disk.
-     */
+    /** Where a task's output and final answer are read. */
     taskOutput?: TaskOutputSource;
     /**
      * Git worktree isolation (ADR-0013). Defaults to git itself, gated by
@@ -3967,10 +4176,11 @@ declare function createSession(deps: SessionDeps): Session;
 /** What {@link createSession} hands a Session: every collaborator, already built and wired. */
 interface SessionParts {
     config: IConfig;
-    registry: RunnerRegistry;
+    catalog: SessionCatalog;
     workspace: string;
     fsAdapter: IFileSystem;
     broadcast: SessionBroadcaster;
+    notifications: INotification;
     onNotice?: (notice: SessionNotice) => void;
     modelResolver: ModelResolver;
     settings: () => SessionRuntimeSettings;
@@ -3986,7 +4196,7 @@ interface SessionParts {
     approvals: PendingApprovals;
     approvalPolicy: ApprovalPolicy;
     fetcher: IWebFetcher;
-    skillsService: Pick<SkillsService, 'findSkill' | 'listSkills'>;
+    skillsService: Pick<SkillsService, 'findSkill' | 'listSkills' | 'searchedDirs' | 'forRoot'>;
     saveSession: SaveSession;
     /** The conversation's host is the Session itself, so only the Session can make it. */
     conversation: (host: PlannerConversationHost) => PlannerConversation;
@@ -4012,11 +4222,12 @@ declare class Session {
     private readonly runs;
     private readonly store;
     private readonly config;
-    private readonly registry;
+    private readonly catalog;
     private plan;
     private goal;
     private workspace;
     private readonly broadcast;
+    private readonly notifications;
     private readonly onNotice?;
     private readonly modelResolver;
     private readonly fsAdapter;
@@ -4025,8 +4236,12 @@ declare class Session {
     private readonly fetcher;
     private readonly settingsFn;
     private readonly save;
-    /** Last discovered model catalog — lets sync plan commits clamp thinking efforts to real variants. */
-    private modelsCache;
+    /** The queue drain in flight, which a second call joins; see {@link processQueuedMessages}. */
+    private queueDrain;
+    /** The queued messages the planner has been given, no longer the user's to take back. */
+    private drainingIds;
+    /** User controls in flight; see {@link withSave}. */
+    private controlsInFlight;
     private unsubObserver;
     private readonly hostSessionId?;
     private currentSessionId;
@@ -4059,7 +4274,7 @@ declare class Session {
     /**
      * The relay announces every orchestrator event; this adds the saves some of
      * them owe, each made before the announcement so no surface sees state the
-     * disk lacks.
+     * disk lacks, and drains the queue the scheduler parked behind.
      */
     private observer;
     /**
@@ -4094,43 +4309,8 @@ declare class Session {
      * session.
      */
     reset(): void;
-    /**
-     * What a planner may assign right now: every enabled runner, its modes, and
-     * its allowlisted models — read as of this call, so a runner enabled or an
-     * allowlist edited since planning started is in it (#69). Discovers a
-     * runner's models the first time it is asked for.
-     */
+    /** What a planner may assign right now; see {@link SessionCatalog.live}. */
     liveCatalog(): Promise<TaskQueryCatalog>;
-    private catalogOf;
-    private runnerModesFor;
-    /**
-     * The catalog a model/task-mode edit is checked against — the same
-     * discovered models and manifest modes the per-turn catalog block shows the
-     * planner, so a refusal here can never name something invalid that the
-     * planner was never told about. The catalog is not filtered by the
-     * allowlist here — {@link checkModelAndModeValidity} narrows by
-     * allowlist itself, the same way `coerceAssignments` does.
-     */
-    private editCatalog;
-    /** The runners enabled right now — a toggle made since the session was built counts (#69). */
-    private enabledRunners;
-    /**
-     * The allowlist in force right now. Unset means no restriction — falling
-     * back to the one planning started under would keep a restriction the user
-     * has since cleared.
-     */
-    private allowlist;
-    /**
-     * The discovered catalog as the resolver holds it now, per runner, with this
-     * session's own discovery as the fallback where the resolver has nothing
-     * cached. The resolver's cache outlives this session's snapshot in both
-     * directions — an allowlist picker re-discovers into it mid-session — and a
-     * model allowed after that must reach the planner with its real label and
-     * variants, not as an id-only stub. Never triggers discovery itself.
-     */
-    private models;
-    /** What a runner offers, as `runnerAssignment` needs it. Spawns the runner's CLI to list models. */
-    private catalogFor;
     get planState(): LegacyPlanState | null;
     /**
      * The live plan in the shape a saved session is read back as. The disk
@@ -4146,24 +4326,16 @@ declare class Session {
      * nothing executing, and reporting it as executing is what left the plan
      * unstartable after its last live task was cancelled.
      */
-    get isExecuting(): boolean;
     /** See {@link TaskOrchestrator.hasLiveWork} — a spawned runner, not merely an armed scheduler. */
-    get hasLiveWork(): boolean;
+    get isExecuting(): boolean;
     get status(): 'approved' | 'running' | 'completed';
+    /** Whether a planner turn — a reply, a compaction, plan generation — holds the conversation. */
+    get isPlannerBusy(): boolean;
     /**
-     * Deny every parked approval as soon as a planning turn is aborted, for the
-     * same reason `beginFreshPlan` does it: a prompt raised by a turn nobody is
-     * waiting on has no one left to serve, and denying it unblocks the research
-     * loop instead of stranding it. Without this the request sat out its
-     * five-minute timeout and the loop then carried on as if nothing had
-     * happened — the abort was real, but invisible until long after the user
-     * pressed stop.
-     *
-     * The listener is returned as a disposer rather than left attached: callers
-     * own the signal and may reuse it, and a leaked listener would deny the
-     * *next* turn's prompts the moment that stale signal aborted.
+     * Stop the planner turn in flight. It still settles — a backend hands back
+     * what it had — and ends as stopped. False when no turn is in flight.
      */
-    private denyApprovalsOnAbort;
+    abortPlannerTurn(): boolean;
     generatePlan(goal: string, runners: RunnerId[], options?: GeneratePlanOptions): Promise<LegacyPlanState>;
     /**
      * Kick off the planner conversation (ADR-0002): research + the first planner
@@ -4225,21 +4397,20 @@ declare class Session {
     /** Whether the planner conversation is live (started and not yet committed to a plan). */
     get isConversationActive(): boolean;
     /**
-     * Intercept a skill invocation (/skill-name) and substitute the skill's
-     * markdown content BEFORE the message reaches the planner. Prevents runners
-     * (Claude Code, OpenCode) from trying to resolve the skill in their own
-     * directory instead of .ordewell/skills/. An unknown skill is surfaced to
-     * the planner as a notice naming what IS available, rather than passing a
-     * bare /unknown through to be mis-resolved.
+     * The skills a message's `/skill-name` tokens load, snapshotted here so the
+     * planner gets Ordewell's skill rather than a runner (Claude Code, OpenCode)
+     * resolving the token in its own skills directory. The message stays as
+     * typed.
      */
     private resolveSkillInvocation;
     /**
-     * The one place planning discovers what it may draw from: the runners'
-     * models (cached for later effort clamping), their modes, and the settings
-     * in force. `filteredModels` is the allowlisted view a prompt may show;
-     * `modelsByRunner` stays whole because coercion needs real labels and variants.
+     * The one catalog every planner path reads — its skill catalogs, `/name`,
+     * and the check of what a plan or an edit attaches — over the folders the
+     * workspace's tasks will read at spawn.
      */
-    private plannerCatalog;
+    private workspaceSkills;
+    /** The catalog over workspace `roots`; the workspace root alone is the session's own. */
+    private skillsAt;
     private conversationOpening;
     /**
      * Load planner-produced tasks, coerced to the allowlist read live — it may
@@ -4276,7 +4447,19 @@ declare class Session {
     cancelTask(taskId: string): Promise<void>;
     markTaskComplete(taskId: string): Promise<void>;
     markTaskIncomplete(taskId: string): Promise<void>;
+    /**
+     * Hand the queued edits to the planner. The Session does this itself each
+     * time the scheduler parks behind the queue, so no surface has to; a caller
+     * only needs it to await the drain. The messages stay queued until the
+     * planner's answer is applied, so the scheduler stays paused behind them
+     * meanwhile; one drain runs at a time, and a call made during it joins it.
+     * Whatever was queued while it ran is drained after, before the run goes on.
+     */
     processQueuedMessages(): Promise<void>;
+    private drainQueue;
+    /** Said through both channels: a host shows one or the other, never both (the daemon's toasts are no-ops). */
+    private notice;
+    private applyQueuedEdits;
     /**
      * Every finished task as the log records it: this run's own entries, plus
      * the tasks earlier runs completed, which the log dropped when this run
@@ -4295,15 +4478,14 @@ declare class Session {
     sendTaskMessage(taskId: string, text: string): string;
     /**
      * Force send (ADR-0023, F1): interrupt the task's running turn and deliver
-     * this message next. Throws `TaskControlError` where a plain message would,
-     * and for a task on the terminal transport.
+     * this message next. Throws `TaskControlError` where a plain message would.
      */
     forceSendTaskMessage(taskId: string, text: string): string;
     forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
     removeQueuedTaskMessage(taskId: string, id: string): boolean;
     interruptTask(taskId: string): Promise<void>;
     getQueuedMessages(): QueuedMessage[];
-    /** Take back one unsent message; the plan's persisted queue follows so a reload cannot resurrect it. */
+    /** Take back one unsent message — false once the planner has it; the plan's persisted queue follows so a reload cannot resurrect it. */
     removeQueuedMessage(id: string): boolean;
     setQueuedMessages(msgs: QueuedMessage[]): void;
     /** Replay a run a dirty tree blocked, after stashing the tracked changes. */
@@ -4343,6 +4525,21 @@ declare class Session {
     /** Add the task that merges a conflicted task's branch by hand; see {@link PlanEditor.addConflictResolver}. */
     resolveConflictAsTask(taskId: string): Promise<LegacyPlanState | null>;
     stopExecution(): void;
+    /**
+     * Run a user control and save what it changed before any surface hears of
+     * it. Not a status hold, as {@link saved} is: these await spawns and git, so
+     * a hold would stall every task's status for as long, and an
+     * `execution_complete` the control triggers would overtake the status held
+     * back — which a surface treats as the end of the stream. Instead each status
+     * announced while one runs is saved first (see {@link observer}), as the
+     * background save of an execution event: it may land mid planner turn. So
+     * is the last one where the control is itself execution, not the user's
+     * word on the plan (`background`).
+     */
+    private withSave;
+    private saveForControl;
+    /** A control that finishes synchronously: its status is held until it is saved. */
+    private saved;
     /**
      * The one mutation seam: every structural plan mutation runs the same
      * ritual — store op → persist (which snapshots tasks from PlanStore) →
@@ -4399,9 +4596,261 @@ declare class PlanEditError extends Error {
     constructor(message: string);
 }
 
+/** What the user last picked for one planner backend. */
+interface PlannerModelChoice {
+    model: string;
+    effort?: string;
+}
+/**
+ * A candidate model as this planner's catalog lists it. Deliberately plain
+ * data: a harness planner's catalog is its runner's own model list and a
+ * vendor's is a picker list (ADR-0009), and the rule below is the same for
+ * both — so the caller normalizes, and this module never reaches for a
+ * ModelResolver, a config or the network.
+ */
+interface PlannerModelCandidate {
+    id: string;
+    variants?: {
+        id: string;
+    }[];
+}
+interface PlannerModelRecall {
+    model: string;
+    effort: string;
+    source: 'remembered' | 'catalog-default' | 'none';
+}
+/** The slice of `SettingsService` this needs, so tests can pass a plain object. */
+interface PlannerModelStore {
+    getPlannerModel(provider: string): PlannerModelChoice | undefined;
+    setPlannerModel(provider: string, entry: PlannerModelChoice | undefined): void;
+}
+/**
+ * Remembers, per planner backend, the model the user last chose for it.
+ *
+ * Switching the planner has to clear the model — an id is scoped to the agent
+ * that listed it, so an OpenRouter slug handed to Claude Code points it at
+ * something it cannot spawn. That clear is correct and stays; what was missing
+ * is that switching *back* then forced a re-pick of a model the user had
+ * already chosen. Both surfaces' clears and the restore now read one rule from
+ * here rather than three copies drifting apart.
+ */
+declare class PlannerModelMemory {
+    private store;
+    constructor(store: PlannerModelStore);
+    /** Record what the user picked for `provider`; a blank model forgets it instead. */
+    remember(provider: string, model: string, effort?: string): void;
+    /**
+     * What the model and effort should become when `provider` takes over the
+     * planner, given the models it actually serves. The `source` is what the
+     * three surfaces word their notice from — restored, defaulted, or nothing.
+     */
+    recall(provider: string, catalog: PlannerModelCandidate[]): PlannerModelRecall;
+}
+
+/**
+ * The daemon contract: every HTTP body the local daemon sends, in one place.
+ *
+ * The daemon's routes build their bodies against these types and the CLI's
+ * `ApiClient` reads them back, so a field added on one side is a compile error
+ * on the other. Before this there were three hand-written copies — the routes'
+ * inline `c.json`, the client's per-method generics, and the TUI's slice of the
+ * client — and they had drifted (the client declared a `headless` field the
+ * daemon never sent, and typed `GET /sessions/:id`'s plan as the wrong shape).
+ *
+ * Types only. Core is the one package both the daemon and its clients already
+ * depend on; importing from the daemon would pull its runtime into the CLI.
+ */
+/**
+ * Why a request was refused, as a stable code a client switches on instead of
+ * reading the message. Absent on a refusal nobody needs to tell apart — a
+ * missing field, say — where the message is all there is.
+ */
+type DaemonErrorCode = 'session_not_found' | 'task_not_found' | 'no_plan' | 'already_executing' | 'workspace_not_found' | 'workspace_not_a_project' | 'conversation_busy'
+/** The user stopped the planner turn: the turn ended as asked, so a client stays quiet. */
+ | 'planner_turn_stopped'
+/** The planner turn settled after its plan was dropped; nothing it produced was kept. */
+ | 'planner_turn_discarded'
+/** The request asked for something the plan, task or conversation does not allow. */
+ | 'refused' | 'checkpoint_not_waiting' | 'approval_not_outstanding';
+/** The body of every non-2xx answer a route gives. */
+interface ErrorBody {
+    error: string;
+    code?: DaemonErrorCode;
+    /** Set with `workspace_not_a_project`: the directory the daemon refused, so a client can offer to initialize it. */
+    workspace?: string;
+}
+interface OkResponse {
+    ok: boolean;
+}
+/**
+ * A plan as the planner routes return it: the session's plan state, not the
+ * `SerializedPlan` a websocket `plan_generated` carries. The two differ —
+ * this one holds raw tasks and the dialogue's bookkeeping — and a client that
+ * reads either reads only the fields it needs. Skill bodies stay in the
+ * session: loads and attempt snapshots arrive as notices.
+ */
+interface PlanResponse {
+    plan: SurfacePlan;
+}
+/** `POST /plans/:id/resolve-conflict`: `null` when the session had no conflict to hand a resolver task. */
+interface ResolveConflictResponse {
+    plan: SurfacePlan | null;
+}
+/** What `GET /api/models` returns, and what the pool's provider discovery produces. */
+interface ModelsResponse {
+    models: DiscoveredModel[];
+    modelsByRunner: Record<string, DiscoveredModel[]>;
+    /** Each runner's manifest modes, so a surface can offer a per-task mode picker. */
+    modesByRunner: Record<string, RunnerModeInfo[]>;
+    orchestratorModel: string;
+    providers: AiProvider[];
+    /** Full cross-provider catalog for the orchestrator (planner) model picker. */
+    orchestratorModels: OrchestratorOption[];
+    /** Per-provider catalog-fetch failures, keyed by provider id. */
+    providerErrors: Record<string, string>;
+}
+/** One-shot planning answers in the phase-tagged shape a saved session is read back in. */
+interface GeneratePlanResponse extends Pick<ModelsResponse, 'models' | 'modelsByRunner'> {
+    plan: SurfacePlanState;
+    /** The host notes the plan's transcript records, a skill check's warnings among them, which the phase-tagged plan does not carry. */
+    notes?: string[];
+}
+interface ExecuteResponse {
+    status: 'running';
+}
+interface StopResponse {
+    status: 'stopped';
+}
+interface CancelPlanningResponse {
+    cancelled: boolean;
+}
+interface TaskMessageResponse {
+    id: string;
+}
+interface ForceSendResponse {
+    sent: boolean;
+}
+interface RemoveMessageResponse {
+    removed: boolean;
+}
+interface MergeGateEntry {
+    id: string;
+    order: number;
+    title: string;
+}
+interface MergeGateResponse {
+    mergeGate: MergeGateEntry[];
+}
+interface IsolationDiffResponse {
+    diff: string;
+}
+/** A merge that conflicts or is blocked is an outcome, not a refusal, so it answers 200 with the result. */
+type IsolationMergeResponse = IsolationMergeResult;
+/** A fork the daemon has already adopted. */
+interface ConversationForkResponse {
+    sessionId: string;
+    goal: string;
+    plan: SurfacePlan;
+}
+/** A fork made by a rewind, with the full text of the message it was made just before. */
+interface ConversationRewindResponse extends ConversationForkResponse {
+    rewoundMessage: string;
+}
+interface RewindTargetsResponse {
+    targets: RewindTarget[];
+}
+interface ConversationCompactResponse extends ConversationCompaction, PlanResponse {
+}
+interface PrdResponse {
+    prdMarkdown: string;
+}
+interface RunnerEntry {
+    id: string;
+    name: string;
+    enabled: boolean;
+}
+interface RunnersResponse {
+    runners: RunnerEntry[];
+    orchestratorModel: string;
+}
+/** Sessions: a saved one comes off its file, a live one from the pool's store. */
+interface SessionResponse {
+    meta: SessionMeta;
+    plan: SurfacePlanState;
+}
+interface AdoptSessionResponse extends OkResponse {
+    plan: SurfacePlan;
+    goal: string;
+}
+interface TaskLogAttemptsResponse {
+    attempts: number[];
+}
+interface TaskLogResponse {
+    attempt: number;
+    events: TaskLogEvent[];
+}
+type SessionListResponse = SessionMeta[];
+interface SettingsResponse {
+    orchestratorModel: string;
+    /** Who plans (ADR-0009) — a vendor id, or one of the three harness planners. */
+    aiProvider: AiProvider;
+    plannerThinkingEffort: string;
+    maxParallel: number;
+    modelAllowlist: UserSettings['modelAllowlist'];
+    plannerModels: UserSettings['plannerModels'];
+}
+/** What `PATCH /api/settings` answers: the settings as they now stand, plus what the write itself decided. */
+interface SettingsUpdateResponse extends SettingsResponse {
+    /**
+     * Which model a planner switch landed on and why — remembered for that
+     * backend, its catalog default, or none. Present only when the write changed
+     * the planner; absent for every other write, where nothing was recalled.
+     */
+    switchRecall?: PlannerModelRecall;
+    /** Env keys the daemon refused to apply, so a client does not persist what the daemon would not. */
+    rejectedEnvKeys?: string[];
+}
+interface CommandDescriptor {
+    name: string;
+    description: string;
+}
+interface CommandsResponse {
+    commands: CommandDescriptor[];
+}
+interface WorkspacesResponse {
+    workspaces: string[];
+}
+interface ApprovalsResponse {
+    pending: PendingApproval[];
+    approvedScopes: string[];
+}
+interface ApprovalAnswerResponse extends OkResponse {
+    granted: boolean;
+    decision: ApprovalDecision['decision'];
+}
+
+/**
+ * Why a call on a session could not be made. Each is a class rather than a
+ * message so the daemon can map it to a status and a stable code in one place,
+ * and a client can switch on that code instead of reading the wording. Like
+ * `PlanEditError`, none carries a status: core is transport-agnostic.
+ */
+/** No session with that id is held — never planned in this process, or dropped by a restart. */
+declare class SessionNotFoundError extends Error {
+    constructor();
+}
+/** The session holds no plan (or an empty one) for the operation to act on. */
+declare class NoPlanError extends Error {
+    constructor(operation: 'execute' | 'review');
+}
+/** A run is already live, and starting another would reset the one in flight. */
+declare class AlreadyExecutingError extends Error {
+    constructor();
+}
+
 /**
  * Where Ordewell keeps machine-global data (settings, daemon tokens, caches,
- * user plugins). A single home for everything not tied to a project directory,
+ * credentials). A single home for everything not tied to a project directory,
  * so per-project state in `.ordewell/` and global state never collide.
  */
 declare function globalDataDir(): string;
@@ -4428,22 +4877,14 @@ type CheckpointWithdrawnListener = (taskId: string) => void;
 /** Fires on every idleSince transition (null→timestamp on silence, timestamp→null on resume/teardown). */
 type IdleListener = (taskId: string, idleSince: string | null) => void;
 declare class VerdictEngine {
-    private markerSeen;
     private pendingVerdicts;
-    private structuredSessions;
-    private markerTails;
-    private checkpointCarry;
-    private pausedSessions;
+    private sessions;
     private listeners;
     private checkpointListeners;
     private withdrawnListeners;
-    /**
-     * The open `checkpoint` tool call per task (ADR-0022, V5): settling it is how
-     * an answer reaches a runner that asked through the tool, where the marker's
-     * answer is typed into the session instead.
-     */
+    /** The open `checkpoint` tool call per task (ADR-0022, V5): settling it is how an answer reaches the runner. */
     private toolCheckpoints;
-    /** The question a task's checkpoint asks, whole, for as long as it waits — by either route. */
+    /** The question a task's checkpoint asks, whole, for as long as it waits. */
     private checkpointQuestions;
     private idleListeners;
     /**
@@ -4485,32 +4926,22 @@ declare class VerdictEngine {
     private touchIdle;
     /** Tear down idle tracking for a task; broadcasts the null transition if it was idle. */
     private clearIdle;
-    /**
-     * Submit a synchronized resume token to the paused session. An interactive
-     * TUI only accepts the Enter keystroke (`\r`) — a `\n` types the token into
-     * its composer without sending it, leaving the agent paused until a human
-     * presses Enter. A line-oriented piped session has no composer; it reads a
-     * `\n`-terminated line, and the leading newline flushes a partial line.
-     */
-    private resumeToken;
     /** What a task's waiting checkpoint asks, untruncated; undefined when none waits. */
     getCheckpointQuestion(taskId: string): string | undefined;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason: string): void;
     /**
-     * Attach to a spawned session: scan the output tail for the task's completion
-     * marker (delivering a verdict immediately while leaving interactive sessions
-     * open), scan for checkpoint markers, and on exit produce a failed verdict
-     * when the marker was never observed. A structured session's `task_complete`
-     * call is evidence too (ADR-0022, V2): whichever signal comes first decides.
+     * Attach to a spawned session. The runner's `task_complete` call on the
+     * attempt's token is the only completion evidence (ADR-0022, V2); a session
+     * that exits before one gets a failed verdict.
      *
      * Returns the attempt's generation, what {@link signalComplete} is checked against.
      */
-    watch(task: Task, session: ITerminalSession): number;
+    watch(task: Task, session: IRunnerSession): number;
     /**
      * The runner's own `task_complete` call (ADR-0022, V1/V3): settles the
-     * attempt exactly as the marker does, unless that attempt is no longer the
-     * task's current one or another signal already settled it.
+     * attempt, unless that attempt is no longer the task's current one or an
+     * earlier call already settled it.
      */
     signalComplete(taskId: string, generation: number, report: TaskCompleteArgs): void;
     /** The runner was told something after its evidence so far, so only what it reports from here counts. */
@@ -4518,9 +4949,8 @@ declare class VerdictEngine {
     private acceptVerdict;
     private publishVerdict;
     /**
-     * The runner's `checkpoint` call (ADR-0022, V5): raised through the same
-     * listeners as the marker, so the task waits on the user the same way, and
-     * settled by {@link approveCheckpoint} or {@link rejectCheckpoint}. It is
+     * The runner's `checkpoint` call (ADR-0022, V5): the task waits on the
+     * user until it is settled by {@link approveCheckpoint} or {@link rejectCheckpoint}. It is
      * withdrawn, never left hanging, once the attempt is over or the call goes.
      */
     raiseCheckpoint(taskId: string, generation: number, question: string, signal: AbortSignal): Promise<CheckpointAnswer>;
@@ -4529,64 +4959,33 @@ declare class VerdictEngine {
     private withdrawToolCheckpoint;
     private approvalOpened;
     private approvalClosed;
-    /** Scan only the new text plus the unmatched carry, so a long run stays linear. */
-    private scanCheckpoints;
     private bumpGeneration;
     private forget;
     /** Manual "Mark complete" override: a pass verdict that bypasses evidence. */
     markComplete(task: Task): Verdict;
     /** Clear verification state for a task (used on retry). */
     clear(task: Task): void;
+    /** Drop a task's verification state and invalidate any callbacks still holding its generation. */
+    private ceaseTracking;
     /** Drop all tracking state (used on stop / loadPlan). */
     reset(): void;
-    private decide;
 }
 
-/**
- * Owns one bounded raw buffer per task attempt, fed from the attempt's
- * session, and reads final answers from the agent's transcript through an
- * injected {@link TranscriptReader}.
- */
+/** Owns one bounded output buffer per task attempt, fed from the attempt's session. */
 declare class BufferedTaskOutputSource implements TaskOutputSource {
     private captures;
-    private transcripts;
     private maxBufferChars;
     constructor(opts?: {
-        transcripts?: TranscriptReader;
         maxBufferChars?: number;
     });
-    attach(taskId: string, session: ITerminalSession): void;
+    attach(taskId: string, session: IRunnerSession): void;
     detach(taskId: string): void;
     reset(): void;
-    finalText(attempt: TaskOutputAttempt, doneToken: string): Promise<string>;
+    finalText(taskId: string): string;
     liveTail(taskId: string, opts: LiveTailOptions): LiveTail | null;
     private append;
 }
 
-/**
- * Read a task's final answer from the agent's own session transcript — the
- * clean, structured record the agent writes about itself — instead of
- * reconstructing what a TUI painted (issue #16, built on #14's render).
- *
- * These stores are private and undocumented and DO rotate (OpenCode migrated
- * from files to SQLite mid-2026). Every reader is therefore defensive: any
- * missing file, unparseable line, or shape drift returns null and the caller
- * falls back to the terminal capture. Nothing here is a hard dependency.
- *
- * Directory and recency only narrow the candidates: with several attempts in
- * one cwd the newest session is whichever task finished last. A transcript is
- * accepted only when its content carries the task's completion marker.
- */
-declare class HomeTranscriptReader implements TranscriptReader {
-    private readonly home;
-    private readonly claudeConfigDirs;
-    constructor(opts?: {
-        homeDir?: string;
-        workspaceEnv?: (cwd: string) => Promise<Record<string, string>>;
-    });
-    finalAssistantText(query: TranscriptQuery, maxChars?: number): Promise<string | null>;
-}
-
 /**
  * The ids a runner may actually run: the user's allowlist with the ids that
  * provably belong to a *different* runner dropped. `undefined` means no
@@ -4596,7 +4995,7 @@ declare class HomeTranscriptReader implements TranscriptReader {
  * allowlisted for Claude Code does not limit it — it points it at something it
  * cannot spawn, and the plan only dies once a task is already running. But
  * "this runner didn't list it" is not enough to call an id wrong: discovery can
- * be stale, and a plugin runner may have no list at all. What settles it is
+ * be stale or return no list at all. What settles it is
  * whether *another* runner listed the id. So:
  *
  * - listed for this runner → keep;
@@ -4623,45 +5022,6 @@ declare function clampThinkingEffort(effort: string | undefined, variants: {
 }[]): string | undefined;
 declare function coerceAssignments(tasks: readonly Task[], perRunnerAllowlist: Partial<Record<RunnerId, string[]>>, allowedRunners?: RunnerId[], modelsByRunner?: Partial<Record<RunnerId, DiscoveredModel[]>>): Task[];
 
-/** What a runner offers a task: the models discovered for it and the modes its manifest declares. */
-interface RunnerCatalog {
-    models: DiscoveredModel[];
-    modes: RunnerModeInfo[];
-    /**
-     * The mode a task lands on when it carries none this runner offers: the
-     * manifest's `autonomous`/`safe`-tagged mode under the user's toggle
-     * (ADR-0001). Absent, `modes[0]` stands in — which for Codex is its
-     * workspace-write sandbox, not the full access an unattended run needs.
-     */
-    defaultMode?: string;
-}
-/**
- * The model, thinking effort and mode a runner offers for a task.
- *
- * A task's model, effort and mode are all scoped to its runner:
- * `claude-sonnet-4-5` on Codex, or `acceptEdits` on OpenCode, are not degraded
- * choices but unspawnable ones. So this is where any task acquires a runnable
- * assignment — a runner change (below) and a hand-added task derive it the same
- * way. Each field in `current` is preserved when the runner also offers it, and
- * otherwise snapped to that runner's preferred entry (discovery already sorts
- * models by the manifest's `preferredPatterns`; the mode is the catalog's
- * `defaultMode`).
- *
- * An empty catalog means discovery failed or the runner is a plugin we have no
- * list for — not that the runner offers nothing. That field is left out of the
- * patch and the runner validates last, matching `coerceAssignments`.
- */
-declare function runnerAssignment(catalog: RunnerCatalog, current?: Pick<Task, 'assignedModel' | 'taskMode'>): Partial<Task>;
-/**
- * Move a task onto a different runner, carrying its model, thinking effort and
- * mode over to values that runner actually offers. A runner change is never a
- * single-field edit — it either brings the other three with it or leaves the
- * task unrunnable.
- *
- * Returns the patch to apply, or `{}` when there is nothing to change.
- */
-declare function retargetTaskRunner(task: Task, runner: RunnerId, catalog: RunnerCatalog): Partial<Task>;
-
 declare function buildResearchToolsPrompt(): string;
 /**
  * System prompt for one read-only research subagent (issue #34). The digest
@@ -4672,26 +5032,30 @@ declare function buildResearchToolsPrompt(): string;
 declare function buildSubagentSystemPrompt(): string;
 /**
  * Facts about who plans and where tasks will run, as opposed to the user's
- * mode toggles: they change what the prompt can promise, not what it asks for.
+ * choices: they change what the prompt can promise, not what it asks for.
  */
 interface ConversationVariant {
-    /** Harness planner (ADR-0009): the agent owns its own tools and research budget. */
+    /**
+     * Harness planner (ADR-0009): the agent owns its own tools and research
+     * budget, and reads the catalog and submits the plan through Ordewell's MCP
+     * tools (ADR-0022). An API planner speaks the JSON envelopes instead.
+     */
     harness?: boolean;
-    /** The planner reads the catalog and submits the plan through Ordewell's MCP tools (ADR-0022), not the JSON envelope. */
-    plannerTools?: boolean;
+    /** The skill catalog: task skills it can attach on every path, planner skills it can load only with tools. */
+    skills?: readonly SkillInfo[];
     /** Every AI task gets its own worktree (ADR-0013), so file overlap no longer forces an order; of every repo of a group (ADR-0014). */
     isolatedExecution?: IsolatedExecution;
 }
-declare function buildConversationSystemPrompt(goal: string, context: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean, verificationEnabled?: boolean, variant?: ConversationVariant): string;
+declare function buildConversationSystemPrompt(goal: string, context: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean, variant?: ConversationVariant): string;
 /** The one-shot planner's core rules for tasks that share the workspace root. */
 declare const CORE_PLANNER_PROMPT: string;
 declare function buildResearchPrompt(userGoal: string, context: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes): string;
-declare function buildPlanWithResults(userGoal: string, context: string, researchResults: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes): string;
-declare function buildModifyPlanPrompt(existingPlan: LegacyPlanState, userRequest: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, aiflowContext?: string, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean): string;
+declare function buildPlanWithResults(userGoal: string, context: string, researchResults: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, tools?: boolean): string;
+declare function buildModifyPlanPrompt(existingPlan: LegacyPlanState, userRequest: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, aiflowContext?: string, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean, tools?: boolean): string;
 declare function modelContextBlock(modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean): string;
 declare function executionLogBlock(executionLog: TaskSnapshot[]): string;
 declare function pendingEditRulesBlock(): string;
-declare function buildModifyDuringExecutionPrompt(executionLog: TaskSnapshot[], pendingTasks: string, userMessage: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: Pick<PlannerModes, 'autonomousDefault' | 'isolatedExecution'>): string;
+declare function buildModifyDuringExecutionPrompt(executionLog: TaskSnapshot[], pendingTasks: string, userMessage: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: Pick<PlannerModes, 'autonomousDefault' | 'isolatedExecution'>, tools?: boolean): string;
 /**
  * User-message prompt for a planner-driven merge: asks the model to combine the
  * selected tasks into one. Routed through the conversation loop, so the
@@ -4795,6 +5159,14 @@ declare const JSON_REPAIR_INSTRUCTION: string;
 declare const TRUNCATED_PLAN_REPAIR_INSTRUCTION: string;
 /** A plan attempt was botched (invalid or truncated JSON): re-emit the whole plan. */
 declare function reEmitPlanPrompt(detail: string): string;
+/**
+ * A planner that submits through Ordewell's tools ended without an accepted
+ * plan, or one it submitted was refused: call the tool again. A plan written
+ * in its reply is never read (ADR-0025), so asking for JSON would be ignored.
+ */
+declare function resubmitPlanPrompt(errors: string[]): string;
+/** A tool planner's task edit was refused as its turn settled: correct it through edit_plan. */
+declare function resubmitEditPrompt(errors: string[]): string;
 /** A plan emission was truncated mid-JSON; the caller may also have compacted the history to free input context. */
 declare function truncatedPlanReEmitPrompt(historyCompacted: boolean): string;
 /** A task-ops attempt was botched (unparseable JSON): re-emit the ops object. */
@@ -4803,8 +5175,8 @@ declare function reEmitTaskOpsPrompt(detail: string): string;
 declare function reEmitTaskQueryPrompt(detail: string): string;
 /** Task ops parsed but failed semantic validation (cycles, unknown refs, locked tasks). */
 declare function taskOpsRejectedPrompt(errors: string[]): string;
-/** A modified plan failed validation during execution: full re-prompt feedback block. */
-declare function modifyValidationFeedback(errors: string[]): string;
+/** A modified plan failed validation during execution: full re-prompt feedback block, asking for the planner's own transport. */
+declare function modifyValidationFeedback(errors: string[], tools?: boolean): string;
 type PlannerReplyClassification = {
     kind: 'plan';
     tasks: Task[];
@@ -4854,23 +5226,6 @@ declare function classifyPlannerReply(text: string, opts: {
  */
 declare function generatePlanWithRepair(generate: (repairHint?: string) => Promise<string>, runners: RunnerId[], maxAttempts?: number, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean): Promise<Task[]>;
 
-type RunnerMode = string;
-
-declare function buildRunnerInvocation(opts: {
-    runner: string;
-    prompt: string;
-    modelId?: string;
-    thinkingEffort?: string;
-    modelVariants?: string[];
-    mode?: RunnerMode;
-    headless?: boolean;
-    interactive?: boolean;
-    cwd?: string;
-    /** The installed runner's `--version`, for a manifest whose command line differs by major version. */
-    runnerVersion?: string;
-    registry: RunnerRegistry;
-}): RunnerInvocation;
-
 interface PriorOutput {
     order: number;
     title: string;
@@ -4883,18 +5238,6 @@ declare function summarizeOutput(reviewReason: string | undefined, output: strin
     capturedAt: string;
 };
 declare function collectDirectDependencyOutputs(task: Task, allTasks: readonly Task[]): PriorOutput[];
-/**
- * Break marker tokens carried in a predecessor's captured output. Interactive
- * runners echo the prompt they are given, and the watcher scans that terminal
- * output — a quoted marker would settle this task on the previous one's
- * evidence. Hyphenated rather than spaced: the scanner also reads a
- * whitespace-flattened view of the terminal, which would rejoin a space.
- *
- * A completion marker also loses its id: transcripts are bound to a task by
- * that id, and a dependent's transcript quoting it would answer for the
- * predecessor the next time the predecessor runs.
- */
-declare function defuseMarkers(text: string): string;
 declare function renderPriorOutputs(outputs: PriorOutput[]): string;
 declare function augmentPromptWithPriorOutputs(task: Task, allTasks: readonly Task[]): string;
 /**
@@ -4909,11 +5252,10 @@ declare function renderPlanMap(planTasks: readonly Task[], currentTaskId: string
 interface ComposeOptions {
     planMapEnabled?: boolean;
     planMapMaxEntries?: number;
-    tddEnabled?: boolean;
+    /** The task's skills as resolved where this attempt runs. */
+    skills?: readonly TaskSkillSnapshot[];
     /** An ops task's last attempt, as its output ended (ADR-0020); absent on a first attempt. */
     previousAttempt?: string;
-    /** The runner is given the `task_complete` and `checkpoint` tools (ADR-0022); the markers stay as their fallback. */
-    completionTool?: boolean;
 }
 declare function composeAugmentedPrompt(task: Task, allTasks: readonly Task[], opts?: ComposeOptions): string;
 /**
@@ -4924,143 +5266,44 @@ declare function composeAugmentedPrompt(task: Task, allTasks: readonly Task[], o
  */
 declare function composeContinuationPrompt(task: Task, message: string, opts?: {
     ops?: boolean;
-    completionTool?: boolean;
 }): string;
 
-type ExecFileFn = (command: string, args: string[]) => Promise<{
-    stdout: string;
-    stderr: string;
-}>;
-/** Test seam: every OS touchpoint is injectable; production uses the defaults. */
-interface TmuxRunnerDeps {
-    port: number;
-    execFileImpl?: ExecFileFn;
-    resolvePath?: () => Promise<string>;
-    pollIntervalMs?: number;
-    logDir?: string;
-    clipboardCommand?: () => string | null;
-    /** Reads the runner's version, for a manifest whose command line differs by major version. */
-    runnerVersion?: RunnerVersionProbe;
-}
-declare class TmuxSession extends AbstractTerminalSession {
-    private tmuxSession;
-    private windowName;
-    private execFileImpl;
-    private pollIntervalMs;
-    private logPath;
-    private socket;
-    /** A tmux window is a real TTY running the agent's TUI, so it submits on Enter. */
-    readonly interactive = true;
-    private outputBuffer;
-    private offset;
-    private timer;
-    private quietPolls;
-    private misses;
-    private looking;
-    constructor(id: string, taskId: string, tmuxSession: string, windowName: string, execFileImpl: ExecFileFn, pollIntervalMs: number, logPath: string, socket: string);
-    private get target();
-    /** Every tmux call must name the daemon's own socket; an unprefixed one
-     * silently targets the shared default server (see `tmuxSocketName`). */
-    private tmux;
-    /**
-     * Runs the invocation in a fresh tmux window, tailed via `pipe-pane` into a
-     * log file rather than polling `capture-pane` snapshots — a byte-exact
-     * stream needs no diff/resync heuristics. The command is wrapped so the
-     * window survives its own exit (an `exec`'d login shell), which is what
-     * lets the user keep poking at a finished task's terminal.
-     */
-    start(command: string, args: string[], cwd: string, env?: Record<string, string>): Promise<void>;
-    private poll;
-    /** Emit what the log gained since the last read; false when it gained nothing. */
-    private readLog;
-    /**
-     * The sentinel is printed by the wrapper shell, so a window closed from
-     * outside — killed by the user, or with the whole tmux server — never prints
-     * it, and the session would count as running forever. A silent window is
-     * therefore looked up by exact name (a `-t` target falls back to another
-     * window once its own is gone), and once it is confirmed missing the session
-     * ends as a kill does. Whatever the log still held is read first, so a
-     * completion marker printed just before the close still counts.
-     */
-    private checkWindow;
-    /**
-     * A task finishing (or being killed) stops observation, but never the
-     * window itself on the sentinel path — only `kill()` closes the window.
-     * Piping is turned off and the log file removed either way, so a finished
-     * task doesn't leave a `cat` process appending to it for the rest of the
-     * daemon's life.
-     */
-    private finish;
-    kill(): void;
-    getOutput(): string;
-    write(text: string): void;
-}
-/**
- * Runs tasks in a real tmux window instead of a piped subprocess, so a user
- * can open a genuine, interactive terminal on any task (running or
- * finished) from outside Ordewell's own process. `ITerminalSession` hides the
- * transport from `VerdictEngine`/`PoolAwareRunner`, so orchestration is
- * unchanged — this is a drop-in replacement for `HeadlessRunner`.
- */
-declare class TmuxRunner extends AbstractRunner<TmuxSession> {
-    private sessionName;
-    private socket;
-    private execFileImpl;
-    private resolvePath;
-    private pollIntervalMs;
-    private logDir;
-    private clipboardCommand;
-    private runnerVersion;
-    /** Retries get a freshly named window so a failed attempt's output stays inspectable. */
-    private attempts;
-    private ready;
-    constructor(deps: TmuxRunnerDeps);
-    /**
-     * Reaps a session orphaned by a crashed prior daemon on the same port, then
-     * creates a fresh one. Memoized: `spawn` awaits it too, so a task spawned
-     * before startup's own call has settled never lands in a missing session —
-     * and a settled failure clears the memo so the next spawn can retry.
-     */
-    ensureSession(): Promise<void>;
-    /** Every tmux call must name this daemon's socket; see `tmuxSocketName`. */
-    private tmux;
-    private createFreshSession;
-    /**
-     * Gives an attached runner terminal wheel/PageUp scrolling over a deep
-     * scrollback, and a mouse selection that reaches the system clipboard — none
-     * of which a default tmux session does. Server-wide scoping is harmless: the
-     * daemon owns a private socket (`tmuxSocketName`).
-     *
-     * `mouse on` is what costs the emulator's own drag-select, so tmux must hand
-     * the selection back out itself: via a clipboard binary when there is one,
-     * and via OSC 52 (`set-clipboard`) for what that cannot cover, such as
-     * viewing over SSH. Naming the binary on the binding as well as in
-     * `copy-command` keeps drag-to-copy working on tmux older than 3.2, which has
-     * no `copy-command`.
-     */
-    private configureScrolling;
-    /**
-     * Called on daemon shutdown — the one guarantee against leaked tmux
-     * processes. Kills the whole server, not just the session: the socket
-     * belongs to this daemon alone, so nothing else can be on it, and a runner
-     * that somehow escaped its session would otherwise keep running (and keep
-     * billing) unattached for as long as the server lived.
-     */
-    killSession(): Promise<void>;
-    spawn(opts: {
-        taskId: string;
-        runner: string;
-        prompt: string;
-        modelId?: string;
-        thinkingEffort?: string;
-        modelVariants?: string[];
-        mode?: string;
-        headless?: boolean;
-        cwd: string;
-        registry?: RunnerRegistry;
-        planSessionId?: string;
-        env?: Record<string, string>;
-    }): Promise<ITerminalSession>;
+/** One source for the spawn options, so a runner built on this base cannot drift from the interface. */
+type RunnerSpawnOptions = Parameters<IRunner['spawn']>[0];
+declare abstract class AbstractRunnerSession implements IRunnerSession {
+    id: string;
+    taskId: string;
+    protected exited: boolean;
+    protected outputEmitter: EventEmitter<any>;
+    protected exitEmitter: EventEmitter<any>;
+    constructor(id: string, taskId: string);
+    protected baseHandleExit(code: number): void;
+    onOutput(callback: (text: string) => void): void;
+    onExit(callback: (code: number) => void): void;
+    abstract kill(): void;
+    abstract getOutput(): string;
+    abstract write(text: string): void;
+    abstract turnState(): 'working' | 'idle';
+    abstract onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
+    abstract onEvent(listener: (event: StructuredEvent) => void): void;
+    abstract sendMessage(text: string): string;
+    abstract forceSend(text: string): string;
+    abstract forceSendQueued(id: string): boolean;
+    abstract removeQueued(id: string): boolean;
+    abstract queued(): QueuedTaskMessage[];
+    abstract interrupt(): Promise<void>;
+    abstract nativeSessionId(): string | null;
+    abstract answerPermission(id: string, decision: ApprovalDecision): boolean;
+    abstract onTaskComplete(listener: (report: TaskCompleteArgs) => void): void;
+    abstract onToolCheckpoint(handler: (question: string, signal: AbortSignal) => Promise<CheckpointAnswer>): void;
+}
+declare abstract class AbstractRunner<S extends IRunnerSession> implements IRunner {
+    protected sessions: Map<string, S>;
+    get activeCount(): number;
+    stop(sessionId: string): void;
+    stopAll(): void;
+    protected registerSession(id: string, session: S): void;
+    abstract spawn(opts: RunnerSpawnOptions): Promise<IRunnerSession>;
 }
 
 interface StructuredRunnerDeps {
@@ -5078,26 +5321,27 @@ interface SessionLaunch {
     createAdapter: (runner: string, deps: AgentProcessDeps) => TaskModeAgentAdapter;
     startOptions: TaskStartOptions;
     interruptGraceMs: number;
-    /** Where this attempt's task tools are served, when its runner takes them (ADR-0022). */
-    tools?: {
+    /** Where this attempt's task tools are served (ADR-0022). */
+    tools: {
         server: OrdewellMcpServer;
         scope: TaskTokenScope;
     };
+    onNotice?: (message: string) => void;
 }
 /**
  * One task driven over its runner's programmatic protocol (ADR-0018). It *is*
- * an `ITerminalSession`, so everything downstream of `onOutput` is unchanged;
- * what a terminal cannot do sits on {@link StructuredSessionCapability}.
+ * an `IRunnerSession`, with plain output and structured events.
  *
  * Ordewell owns the message queue (M1). A message sent mid-turn is handed to a
  * runner that can take one at its next step (ADR-0023); otherwise it waits for
  * the turn to end rather than being typed into a runner that is busy.
  */
-declare class StructuredSession extends AbstractTerminalSession implements StructuredSessionCapability {
+declare class StructuredSession extends AbstractRunnerSession {
     private readonly launch;
-    readonly transport: "structured";
     private adapter;
     private adapterStarted;
+    private adapterAttached;
+    private startupExit;
     /** Bumped whenever the adapter is replaced, so the old one's late events and exit are ignored. */
     private generation;
     private output;
@@ -5123,16 +5367,25 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     private toolToken;
     private checkpointHandler;
     constructor(id: string, taskId: string, launch: SessionLaunch);
-    /** Start the runner and send the task's prompt as its first turn. */
+    /**
+     * Start the runner with the attempt's tools attached and send the task's
+     * prompt as its first turn. `task_complete` is the only way a task reports
+     * it is done, so a runner without the tools is never sent the task: it is
+     * killed and respawned once, and a second failure fails the start.
+     */
     start(prompt: string): Promise<void>;
     getOutput(): string;
     onTaskComplete(listener: (report: TaskCompleteArgs) => void): void;
     onToolCheckpoint(handler: (question: string, signal: AbortSignal) => Promise<CheckpointAnswer>): void;
     /**
-     * A server that cannot start costs the task its tools, not its run: the
-     * prompt still teaches the marker (ADR-0022, S2).
+     * One spawn of the runner on a fresh token. Null once the runner reports
+     * the server connected — or once the session ended meanwhile, which leaves
+     * nothing to start; otherwise why not, with the process killed and the
+     * token revoked. A runner that cannot be spawned at all throws instead:
+     * spawning it again would fail the same way.
      */
-    private issueTools;
+    private startAttached;
+    private startWithTools;
     private revokeTools;
     protected baseHandleExit(code: number): void;
     /**
@@ -5222,8 +5475,7 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
 /**
  * The structured transport (ADR-0018): a task's runner as a plain child
  * process speaking its protocol — no tmux, no `script` (W2). Only runners
- * with a task-mode connector can be spawned here; routing the rest to the
- * terminal transport is the caller's decision, not a silent downgrade here.
+ * with a task-mode connector can be spawned here.
  */
 declare class StructuredRunner extends AbstractRunner<StructuredSession> {
     private spawnCount;
@@ -5232,44 +5484,7 @@ declare class StructuredRunner extends AbstractRunner<StructuredSession> {
     private readonly interruptGraceMs;
     private readonly mcp;
     constructor(deps?: StructuredRunnerDeps);
-    spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
-}
-
-interface TransportRoute {
-    transport: RunnerTransport;
-    /** Why a structured request runs on the terminal instead, in words a surface shows as is. */
-    fallback?: string;
-}
-/**
- * Where one task runs (ADR-0018, S3): structured only when the plan asks for
- * it and the task's runner has a task-mode connector. Anything else runs on
- * the terminal, and a structured request says why.
- */
-declare function routeTransport(requested: RunnerTransport | undefined, runner: string, registry?: RunnerRegistry | null): TransportRoute;
-/**
- * The runner a host hands the orchestrator: its own terminal runner (tmux,
- * headless, the VS Code terminal) and the structured one behind a single
- * `ITerminalRunner`, picking per spawn by {@link routeTransport}.
- *
- * `stopAll` and `activeCount` reach both inner runners, so a host that shares
- * one across plans (the daemon's tmux) keeps its per-plan wrapper above this.
- */
-declare class TransportRouter implements ITerminalRunner {
-    private readonly runners;
-    /**
-     * Session ids the structured runner owns; every other id is the terminal's.
-     * Kept past exit, so a stop that arrives late never reaches the terminal
-     * runner with an id it does not know.
-     */
-    private readonly structuredIds;
-    constructor(runners: {
-        terminal: ITerminalRunner;
-        structured: ITerminalRunner;
-    });
-    get activeCount(): number;
-    spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
-    stop(sessionId: string): void;
-    stopAll(): void;
+    spawn(opts: RunnerSpawnOptions): Promise<IRunnerSession>;
 }
 
 /** Whether a task can be continued in its saved runner session (ADR-0018, K1), and in which. */
@@ -5282,9 +5497,8 @@ type Continuability = {
 };
 /**
  * The rule every surface offers Continue by and the orchestrator enforces: a
- * completed or failed task whose last attempt ran structured and left a
- * session id behind. A conflict is resolved by its repair, not a new turn, and
- * a terminal task has no session Ordewell can reach — Retry covers both.
+ * completed or failed task whose last attempt left a session id behind. A
+ * conflict is resolved by its repair, not a new turn — Retry covers it.
  */
 declare function continuability(task: Task): Continuability;
 declare function canContinue(task: Task): boolean;
@@ -5304,8 +5518,7 @@ interface TaskLogRecorderDeps {
  * batches, so what a surface saw live and what it reloads are one sequence.
  *
  * It sits around the runner rather than inside the orchestrator, which stays
- * unaware of logs; a terminal-transport session has no event stream and is
- * passed through untouched.
+ * unaware of logs.
  */
 declare class TaskLogRecorder {
     private readonly deps;
@@ -5313,10 +5526,130 @@ declare class TaskLogRecorder {
     private readonly flushMs;
     private readonly logger;
     constructor(deps: TaskLogRecorderDeps);
-    wrap(runner: ITerminalRunner): ITerminalRunner;
-    /** Start a new attempt's log for `session` and keep it until the session exits. */
-    record(taskId: string, session: ITerminalSession & StructuredSessionCapability): void;
+    wrap(runner: IRunner): IRunner;
+    /** Start a new attempt's log for `session`, opening with the skills it was given, and keep it until the session exits. */
+    record(taskId: string, session: IRunnerSession, skills?: readonly TaskSkillSnapshot[]): void;
+}
+
+declare function stripAnsi(text: string): string;
+
+/**
+ * cmd.exe's command-line buffer. A longer line is truncated rather than
+ * rejected, which would corrupt a planner's system prompt or a task's prompt
+ * mid-sentence and produce a confident answer to half a question — so the
+ * batch route refuses instead. See {@link CommandLineTooLongError}.
+ */
+declare const CMD_EXE_MAX_COMMAND_LINE = 8191;
+/**
+ * CreateProcess's own ceiling, which the native and PowerShell routes are
+ * bounded by instead. Windows truncates here too, so the same refusal applies —
+ * it is simply four times further away.
+ */
+declare const WINDOWS_MAX_COMMAND_LINE = 32767;
+interface LaunchPlan {
+    /** The executable handed to `spawn()`. */
+    file: string;
+    /** Arguments for `file`. Pass verbatim when {@link verbatim} is set. */
+    args: string[];
+    /**
+     * Windows batch route only: `args` is already a quoted command line and must
+     * not be re-quoted. Maps to `windowsVerbatimArguments` for `spawn`.
+     */
+    verbatim?: boolean;
 }
+/** Test seam: every OS touchpoint is injectable, and production uses the defaults. */
+interface LaunchDeps {
+    platform?: NodeJS.Platform;
+    /** The PATH executables are looked up on. Defaults to the augmented PATH. */
+    resolvePath?: () => Promise<string>;
+    /** True when `candidate` names an existing file. */
+    exists?: (candidate: string) => boolean;
+    /** Absolute path to the Windows command interpreter. */
+    comSpec?: () => string;
+    /** Absolute path to Windows PowerShell. */
+    powerShell?: () => string;
+    /** PATHEXT, as the environment reports it. */
+    pathExt?: () => string;
+}
+/**
+ * Thrown when a command's arguments do not fit the buffer of the only
+ * interpreter that can start it. Windows truncates rather than rejecting, and a
+ * system prompt cut off mid-sentence makes the planner answer half a question
+ * confidently — the silent success this repo refuses — so this is raised
+ * instead. `TaskOrchestrator.startTask` catches it and holds the task, so the
+ * message is what the user reads: it names the fix, because they cannot infer
+ * it from a truncated prompt.
+ */
+declare class CommandLineTooLongError extends Error {
+    readonly command: string;
+    readonly length: number;
+    readonly limit: number;
+    constructor(command: string, length: number, limit?: number);
+}
+/**
+ * Thrown when only a batch shim resolved for a multi-line argument. cmd.exe
+ * reads up to the first CR/LF and discards the rest with no error and exit code
+ * 0 — quoting does not help — so the agent would get the first paragraph of its
+ * prompt without the instruction to report through `task_complete`, then exit looking successful.
+ */
+declare class EmbeddedNewlineError extends Error {
+    readonly command: string;
+    constructor(command: string);
+}
+/**
+ * Thrown when `command` cannot be resolved to a real file. Kept distinguishable
+ * from `WorkspaceNotFoundError` (utils/workspace) even though both a missing
+ * cwd and a missing binary surface as the same `spawn` ENOENT to Node — the two
+ * are checked, and named, separately so the failure names the actual cause.
+ */
+declare class ExecutableNotFoundError extends Error {
+    readonly command: string;
+    readonly searchedPath: string;
+    constructor(command: string, searchedPath: string);
+}
+/**
+ * Whether `command` actually resolves to a file, given the plan
+ * {@link planDirectLaunch} produced for it and the PATH it was resolved
+ * against.
+ *
+ * POSIX is deliberately identity in `planDirectLaunch` (execvp does its own
+ * PATH search), so the search is repeated here instead. Windows already did
+ * the search inside `planDirectLaunch` — signalled by the returned file
+ * differing from the bare command name it was given; an unresolved command
+ * comes back unchanged.
+ */
+declare function isExecutableResolved(command: string, plan: LaunchPlan, PATH: string, deps?: LaunchDeps): boolean;
+/** The verbatim command line cmd.exe receives after `/d /s /c`, before wrapping. */
+declare function windowsCommandLine(file: string, args: string[]): string;
+/**
+ * How to start `command` with `args` through `spawn()`, with no shell.
+ *
+ * POSIX returns its input unchanged — execvp already searches PATH, and adding
+ * a resolution step there would be a new way for a working setup to break.
+ *
+ * Windows resolves the command against PATH × PATHEXT, preferring a native
+ * executable (spawned directly) over a batch shim (through cmd.exe) over a
+ * PowerShell script shim (through `powershell.exe -File`). A command that
+ * resolves to nothing is returned unchanged, so the caller's existing ENOENT —
+ * which names what the user typed — is what surfaces rather than a second,
+ * vaguer error from here.
+ *
+ * The tiers are tried in preference order and the first that *fits* wins, with
+ * one deliberate exception: an overflowing batch shim does not fall through to
+ * PowerShell. Overflow means a very large prompt, which is precisely where
+ * `-File` argument fidelity is least worth betting on, and where a clear held
+ * task beats a plausibly-mangled one. So capacity does not reorder the tiers —
+ * a `.ps1` beside a too-long `.cmd` still raises.
+ *
+ * A line break does reorder them: cmd.exe cannot carry one at any length, so a
+ * `.ps1` beside a `.cmd` wins, and a lone `.cmd` raises.
+ *
+ * @throws {CommandLineTooLongError} when the selected route's buffer cannot
+ * carry the arguments.
+ * @throws {EmbeddedNewlineError} when the arguments span lines and only the
+ * batch route resolved.
+ */
+declare function planDirectLaunch(command: string, args: string[], deps?: LaunchDeps): Promise<LaunchPlan>;
 
 /**
  * A workspace path that does not exist, or exists but is not a directory.
@@ -5435,6 +5768,8 @@ interface KillTreeDeps {
         unref?: () => void;
     };
     clearTimeoutImpl?: (handle: unknown) => void;
+    /** Signals a pid, or a process group as its negated id. Injected so the group path needs no real processes. */
+    killImpl?: (pid: number, signal: NodeJS.Signals | 0) => void;
 }
 /**
  * Terminate `proc` and everything it started.
@@ -5481,137 +5816,42 @@ declare function clearAugmentedPathCache(): void;
  */
 declare function withPath(base: NodeJS.ProcessEnv, resolvedPath: string, overrides?: Record<string, string>): NodeJS.ProcessEnv;
 
-/** One shared tmux session per daemon, scoped by port so multiple daemons never collide. */
-declare function tmuxSessionName(port: number): string;
-/**
- * Each daemon gets its own tmux *server*, not just its own session name.
- *
- * A plain `tmux new-session` attaches to whatever server already owns the
- * default socket, and a session created on an existing server inherits that
- * **server's** environment — not the environment of the process that asked for
- * it (tmux only refreshes `update-environment` vars, and only on attach). So a
- * daemon started with, say, a particular provider API key would silently hand
- * its runners a stale key left behind by whoever started the server first,
- * possibly hours earlier under a different configuration entirely.
- *
- * A private socket makes the server a child of this daemon, so the runner
- * inherits the daemon's environment the way any child process would, and
- * `kill-server` at shutdown is authoritative — a runner cannot outlive the
- * daemon by hiding on a shared server. Users attaching by hand need the same
- * flag: `tmux -L ordewell-<port> attach -t ordewell-<port>`.
- */
-declare function tmuxSocketName(port: number): string;
-/**
- * tmux window targeting breaks on `:` and other punctuation, so ids are
- * slugged. Task ids are only unique within one plan ("task-1" is every
- * planner's favourite), so the window is also scoped by the plan session id —
- * without it, the second plan run in a daemon's lifetime would collide with
- * the first plan's still-open windows and pipe its output into the wrong one.
- */
-declare function tmuxWindowName(taskId: string, planSessionId?: string): string;
-type ProbeFn = () => void;
-/** Feature-detects tmux the same way `HeadlessRunner` detects `script`. */
-declare function hasTmux(probe?: ProbeFn): boolean;
 type HasBinFn = (bin: string) => boolean;
 /**
  * Shell command tmux should pipe a copy-mode selection into, so selecting text
- * in a task's terminal puts it on the *system* clipboard rather than in a tmux
+ * in a tmux pane puts it on the *system* clipboard rather than in a tmux
  * paste buffer no other application can read. Preferred over tmux's OSC 52
  * bridge, which plenty of emulators (VTE before 0.76, xterm without
  * `allowWindowOps`) drop on the floor.
  */
 declare function clipboardCopyCommand(hasBin?: HasBinFn, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): string | null;
 
-declare class FsPluginStore implements IPluginStore {
-    getUserPluginsDir(): string;
-    listUserPluginDirs(): string[];
-    listDir(dir: string): string[];
-    loadManifest(pluginDir: string): RunnerPluginManifest | null;
-    copyDir(sourceDir: string, destDir: string): void;
-    removeDir(dir: string): void;
-    ensureDir(dir: string): void;
-    writeFile(filePath: string, content: string): void;
-    readFile(filePath: string): string | null;
-    dirExists(path: string): boolean;
-    exists(path: string): boolean;
-}
-
-/**
- * Shape check for a manifest read off disk or out of a cloned repository. The
- * name is constrained here rather than at each install route, so every store
- * implementation gets the same guarantee that a manifest name is a plain
- * segment and never a traversal sequence.
- */
-declare function isValidManifest(obj: unknown): obj is RunnerPluginManifest;
+declare function removedPluginNotice(dataDir?: string): string | undefined;
 
-/**
- * A plugin name is a single plain path segment: alphanumeric at both ends,
- * dots/dashes/underscores in between. This is what keeps a manifest name from
- * being a traversal sequence (`..`, `../../etc`), an absolute path, or a
- * dash-prefixed string that a downstream tool reads as a flag.
- */
-declare const PLUGIN_NAME_PATTERN: RegExp;
-declare function isPlainPluginName(name: unknown): name is string;
-declare function assertPlainPluginName(name: unknown): asserts name is string;
-/**
- * Resolve where a plugin of this name installs, and assert the result is still
- * a direct child of the plugins directory. Validation and use share this one
- * call so they cannot disagree about the path being checked.
- */
-declare function resolvePluginInstallDir(pluginsDir: string, name: unknown): string;
-
-/** Hosts a plugin may be cloned from. Exact hostname match, case-insensitive. */
-declare const ALLOWED_PLUGIN_HOSTS: readonly string[];
-type PluginSource = {
-    kind: 'git';
-    url: string;
-} | {
-    kind: 'path';
-    path: string;
-};
-/**
- * Validate a plugin repository URL. Requires an ordinary HTTPS repository on an
- * allowed host, which is also what rejects git's transport helpers (`ext::`,
- * `git://`, `ssh://`, `file://`) — they never reach the clone because they are
- * not the https scheme.
- *
- * Returns the parsed URL so callers clone the normalised form they validated.
- */
-declare function assertInstallablePluginUrl(url: unknown): URL;
-/**
- * Decide whether an install source names a remote repository or a local
- * directory. Anything that carries a scheme or looks like an scp-style remote
- * goes down the URL route so it is rejected as a bad URL rather than silently
- * retried as a (nonexistent) directory.
- */
-declare function classifyPluginSource(source: string): PluginSource;
-
-declare function resolveArgs(manifest: RunnerPluginManifest, ctx: ResolveContext): RunnerInvocation;
-/**
- * The manifest's meaning of a task's mode and effort, for a runner driven over
- * its programmatic protocol rather than a command line built from
- * `argsTemplate` (ADR-0018, C1). The effort stays a raw id behind the same
- * `{{if thinking}}` gate as the template path: how an effort reaches the
- * runner is protocol, which each adapter owns.
- */
-declare function resolveTaskRunnerFlags(manifest: RunnerPluginManifest, ctx: Pick<ResolveContext, 'mode' | 'model' | 'thinkingEffort'>): TaskRunnerFlags;
+declare function resolveTaskRunnerFlags(manifest: RunnerManifest, ctx: {
+    mode: string;
+    model?: string;
+    thinkingEffort?: string;
+}): TaskRunnerFlags;
 
-declare const CLAUDE_CODE_MANIFEST: RunnerPluginManifest;
+declare const CLAUDE_CODE_MANIFEST: RunnerManifest;
 
-declare const OPENCODE_MANIFEST: RunnerPluginManifest;
+declare const OPENCODE_MANIFEST: RunnerManifest;
 
 declare const STATE_DIR = ".ordewell";
 declare function ensureDir(dir: string): void;
 declare function getStateDir(baseDir?: string): string;
 /**
- * A match-everything ignore rule, written *inside* the state directory. A
- * `.gitignore` containing `*` inside a directory excludes that directory's
- * whole contents, itself included, so plans and sessions stop being
- * accidentally committable — without ever touching a file the developer wrote.
- * Editing their root `.gitignore` would be the intrusive version of this.
- *
- * Idempotent, and never overwrites an existing file: a developer who has
- * customised these rules (to commit their plans deliberately, say) keeps them.
+ * Ignores the state directory's contents except this file and `skills/`, so a
+ * project's skills are committed and reach every task worktree through git —
+ * the bootstrap never links `.ordewell/` (ADR-0013). Plans and sessions stay
+ * uncommittable without touching a file the developer wrote; editing their
+ * root `.gitignore` would be the intrusive version of this.
+ */
+declare const STATE_DIR_IGNORE = "*\n!.gitignore\n!skills/\n!skills/**\n";
+/**
+ * Idempotent, and never overwrites a file the developer customised (to commit
+ * their plans deliberately, say). Only the exact legacy rule is upgraded.
  */
 declare function ensureStateDirIgnored(baseDir?: string): void;
 
@@ -5664,57 +5904,6 @@ declare function sanitizeSlug(raw: string): string;
 /** Save the PRD to `<workspace>/.scratch/<slug>/PRD.md` (to-prd native convention). */
 declare function savePrdMarkdown(workspace: string, slug: string, markdown: string): string;
 
-/** What the user last picked for one planner backend. */
-interface PlannerModelChoice {
-    model: string;
-    effort?: string;
-}
-/**
- * A candidate model as this planner's catalog lists it. Deliberately plain
- * data: a harness planner's catalog is its runner's own model list and a
- * vendor's is a picker list (ADR-0009), and the rule below is the same for
- * both — so the caller normalizes, and this module never reaches for a
- * ModelResolver, a config or the network.
- */
-interface PlannerModelCandidate {
-    id: string;
-    variants?: {
-        id: string;
-    }[];
-}
-interface PlannerModelRecall {
-    model: string;
-    effort: string;
-    source: 'remembered' | 'catalog-default' | 'none';
-}
-/** The slice of `SettingsService` this needs, so tests can pass a plain object. */
-interface PlannerModelStore {
-    getPlannerModel(provider: string): PlannerModelChoice | undefined;
-    setPlannerModel(provider: string, entry: PlannerModelChoice | undefined): void;
-}
-/**
- * Remembers, per planner backend, the model the user last chose for it.
- *
- * Switching the planner has to clear the model — an id is scoped to the agent
- * that listed it, so an OpenRouter slug handed to Claude Code points it at
- * something it cannot spawn. That clear is correct and stays; what was missing
- * is that switching *back* then forced a re-pick of a model the user had
- * already chosen. Both surfaces' clears and the restore now read one rule from
- * here rather than three copies drifting apart.
- */
-declare class PlannerModelMemory {
-    private store;
-    constructor(store: PlannerModelStore);
-    /** Record what the user picked for `provider`; a blank model forgets it instead. */
-    remember(provider: string, model: string, effort?: string): void;
-    /**
-     * What the model and effort should become when `provider` takes over the
-     * planner, given the models it actually serves. The `source` is what the
-     * three surfaces word their notice from — restored, defaulted, or nothing.
-     */
-    recall(provider: string, catalog: PlannerModelCandidate[]): PlannerModelRecall;
-}
-
 /** How many AI tasks may run at once: `ORDEWELL_MAX_PARALLEL`, `/parallel`, `ordewell.maxParallelSessions`. */
 declare const DEFAULT_MAX_PARALLEL = 3;
 /**
@@ -5725,4 +5914,4 @@ declare const DEFAULT_MAX_PARALLEL = 3;
  */
 declare function parseMaxParallel(value: unknown): number | null;
 
-export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, ApplyTaskOpsResult, ApprovalAnswer, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type AskOptions, AwaitingReason, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CORE_PLANNER_PROMPT, type CappedRows, CheckpointAnswer, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompaction, ConversationEditError, type ConversationFork, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DiscoveredModel, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GREP_PCRE_PROBE_ARGS, GeminiService, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type GrepRegex, type HasBinFn, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, IsolationHandoff, IsolationLandedTask, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, MergeGateView, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PlannerSubmission, PlannerToolHandler, PlannerUsage, type PluginSource, type PrdBlock, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, ResolveContext, type RewindTarget, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, RunnerSpawnOptions, RunnerTransport, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, SessionMessage, type SessionMeta, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredSessionCapability, StructuredTurnEnd, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskCompleteArgs, TaskControlError, TaskIsolation, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSnapshot, TaskStartOptions, TaskTokenScope, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, type TransportRoute, TransportRouter, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createSkillsService, createTaskAdapter, createTaskOrchestrator, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, defuseMarkers, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, hasTmux, idSegment, includeGlobFor, isCliProvider, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, retargetTaskRunner, routeTransport, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, withPath, writePrivateFile };
+export { ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractRunnerSession, ActiveTaskSession, type AdoptSessionResponse, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, AlreadyExecutingError, ApplyTaskOpsResult, ApprovalAnswer, type ApprovalAnswerResponse, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type ApprovalsResponse, type AskOptions, AwaitingReason, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CORE_PLANNER_PROMPT, type CancelPlanningResponse, type CappedRows, CheckpointAnswer, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandDescriptor, CommandLineTooLongError, type CommandTier, type CommandsResponse, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompactResponse, type ConversationCompaction, ConversationEditError, type ConversationFork, type ConversationForkResponse, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationRewindResponse, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, type DaemonErrorCode, DiscoveredModel, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ErrorBody, type ExecImpl, ExecutableNotFoundError, type ExecuteResponse, FindSymbolOptions, type ForceSendResponse, GIT_READONLY_SUBCOMMANDS, GREP_PCRE_PROBE_ARGS, GeminiService, type GeneratePlanResponse, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type GrepRegex, HARNESS_PLANNER_REASON, type HasBinFn, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IRunner, IRunnerSession, IWorktreeIsolation, type IsolationDiffResponse, IsolationHandoff, IsolationLandedTask, type IsolationMergeResponse, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, type MergeGateEntry, type MergeGateResponse, MergeGateView, ModelResolver, type ModelResolverDeps, type ModelsResponse, type ModifyPlanRequest, NoPlanError, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, type OkResponse, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, type PlanResponse, PlanState, PlanStatus, PlanStore, Planner, type PlannerBackendEntry, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerSubmission, PlannerToolHandler, PlannerTurnDiscardedError, PlannerTurnStoppedError, type PlannerUsability, PlannerUsage, type PrdBlock, type PrdResponse, type PriorOutput, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, type RemoveMessageResponse, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, type ResolveConflictResponse, type RewindTarget, type RewindTargetsResponse, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerManifest, RunnerModeInfo, RunnerRegistry, type RunnerSpawnOptions, type RunnersResponse, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STATE_DIR_IGNORE, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, type SessionListResponse, SessionMessage, type SessionMeta, SessionNotFoundError, SessionNotice, type SessionPlanner, type SessionResponse, type SessionRuntimeSettings, type SettingsResponse, SettingsService, type SettingsUpdateResponse, type ShellDialect, SkillInfo, type SkillInvocation, SkillLoad, SkillsService, type SpawnSpec, StdioAgentAdapter, type StopResponse, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredTurnEnd, SurfacePlan, SurfacePlanState, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskCompleteArgs, TaskControlError, TaskIsolation, type TaskLogAttemptsResponse, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, type TaskLogResponse, type TaskMessageResponse, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSkillSnapshot, TaskSnapshot, TaskStartOptions, TaskTokenScope, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorkspacesResponse, type WorktreeIsolationDeps, abbreviateHome, admitSettingsEnv, applyHeadLimit, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createTaskAdapter, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, idSegment, includeGlobFor, isCliProvider, isExecutableResolved, isOpenAiProvider, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, planDirectLaunch, plannerBackendEntries, plannerMessage, plannerTranscript, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, removedPluginNotice, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, resubmitEditPrompt, resubmitPlanPrompt, retargetTaskRunner, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripAnsi, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, windowsCommandLine, withPath, writePrivateFile };