@ordewell/core 0.9.0 → 0.10.0

package/dist/plan-utils-B6yJdpgi.d.ts

@@ -0,0 +1,2902 @@
+import { $ as RunnerId, c as DiscoveredModel, ac as Task, a9 as SkillsService, a4 as SkillInfo, U as RepoGroupLayout, aj as TaskSkillSnapshot, ai as TaskSkillNotice, aa as SubagentOutcome, ao as UsageRecord, ak as TaskSnapshot, a as AwaitingReason, I as IWorktreeIsolation, v as IsolationRun, j as IsolationHandoff, H as PlanIsolation, w as IsolationTaskRecord, af as TaskIsolation, F as IsolationView, r as IsolationOutcome, T as RepairEvidence, am as TreeSnapshot, ad as TaskDiffRead, ae as TaskDiffResult, q as IsolationMergeResult, aq as Verdict, _ as RunSettings, L as LegacyPlanState, C as ConversationMessage, a6 as SkillLoadNotice, P as PendingPlanTurn, A as AttemptUsage, M as ModelUsage, ap as UsageTotals, N as PlanUsage, e as ExecutionRecord, X as ResearchStep, J as PlanState, ab as SupervisorLevel, Y as ResearchStepOutcome, V as ResearchLogEntry, O as PlannerUsage, ag as TaskIsolationState, an as UsageLine } from './Task-CxwnCJLi.js';
+import { R as RunnerModeInfo } from './ModeResolver-u5ZhRC8x.js';
+import { B as IRunnerSession, aB as TaskMessageFrom, ah as RunnerCommand, am as RunnerMcpServer, au as StructuredTurnEnd, j as ApprovalDecision, at as StructuredEvent, y as IConfig, z as IRunner, ap as RunnerRegistry, aa as QueuedTaskMessage, k as ApprovalKind, q as ApprovalSource } from './IRunner-C7_SSpzG.js';
+
+interface LiveTailOptions {
+    maxLines: number;
+    /** A previous {@link LiveTail.nextOffset}: only output after it is rendered. */
+    sinceOffset?: number;
+}
+interface LiveTail {
+    /** Plain text, escapes and control characters removed. */
+    text: string;
+    /** Total output received so far; pass it back as `sinceOffset` to read only what follows. */
+    nextOffset: number;
+    running: boolean;
+}
+/**
+ * The one owner of a task attempt's output: what it printed while running
+ * and what it answered once it ended.
+ */
+interface TaskOutputSource {
+    /** Start capturing a session; replaces any earlier capture of the task. */
+    attach(taskId: string, session: IRunnerSession): void;
+    /** Stop capturing the task's session; what was captured stays readable. */
+    detach(taskId: string): void;
+    /** Drop every capture (a new plan reuses task ids). */
+    reset(): void;
+    /** The task's final answer: the summary its runner reported through `task_complete`, else what its last turn said. */
+    finalText(taskId: string): string;
+    /** The summary the runner reported through `task_complete` in its latest turn, if it made that call. */
+    report(taskId: string): string | undefined;
+    /** Recent output of the task's latest capture, or null if it never had one. */
+    liveTail(taskId: string, opts: LiveTailOptions): LiveTail | null;
+}
+
+/**
+ * The catalog a model/task-mode edit is checked against — the same discovered
+ * models and manifest modes the planner was shown in the per-turn catalog
+ * block (`PlannerConversation.catalogBlock`), so a refusal here can never name something
+ * as invalid that the planner was never told about, or vice versa.
+ */
+interface EditCatalog {
+    modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>;
+    runnerModes: Partial<Record<RunnerId, RunnerModeInfo[]>>;
+    /** Raw (unfiltered) allowlist, keyed by runner — the same shape `coerceAssignments` takes. */
+    perRunnerAllowlist?: Partial<Record<RunnerId, string[]>>;
+    /** Full (true) or Guarded: the mode a task the planner writes lands on unless it is read-only (ADR-0031). Full when absent. */
+    autonomousDefault?: boolean;
+}
+
+/**
+ * Targeted task edits emitted by the planner conversation (the 'task_ops'
+ * ConversationTurn). Task references accept a task id, a "#<order>" ref, or a
+ * bare order number — cheap models rarely echo UUIDs correctly.
+ */
+/**
+ * A task as the planner writes it: its fields, less the mode, plus whether it
+ * must not change files (ADR-0031), and `thinkingEffort` as a name for its
+ * model's effort, so an effort can change without restating the model.
+ */
+type PlannerTaskSpec = Partial<Task> & {
+    readOnly?: boolean;
+    thinkingEffort?: string | null;
+};
+type TaskOp = {
+    op: 'update';
+    taskId: string;
+    changes: PlannerTaskSpec;
+} | {
+    op: 'add';
+    task: PlannerTaskSpec;
+    handle?: string;
+} | {
+    op: 'remove';
+    taskId: string;
+} | {
+    op: 'reorder';
+    taskIds: string[];
+} | {
+    op: 'merge';
+    taskIds: string[];
+    merged: PlannerTaskSpec;
+    handle?: string;
+} | {
+    op: 'split';
+    taskId: string;
+    parts: PlannerTaskSpec[];
+    handle?: string;
+} | {
+    op: 'rearm';
+    taskId: string;
+    changes?: PlannerTaskSpec;
+};
+declare function textHasTaskOps(text: string): boolean;
+/** Parse a `{"taskOps":[...]}` reply. Throws PlanParseError when the JSON is unusable. */
+declare function parseTaskOpsJson(text: string): TaskOp[];
+interface ApplyTaskOpsResult {
+    ok: boolean;
+    tasks: readonly Task[];
+    errors: string[];
+    /** Human-readable summary of what changed, for the chat transcript. */
+    summary: string[];
+}
+/**
+ * Pre-flight check for a merge: would collapsing the selected tasks into one
+ * (rewiring every dependent of any selected task to the survivor) keep the
+ * dependency graph valid? Rejects locked tasks and merges whose rewiring would
+ * introduce a cycle. Display order is NOT checked here — neither
+ * consecutiveness (a UI concern) nor a dependency the merge pulls out of order,
+ * which {@link applyTaskOps} repairs; refusing on order would make this
+ * pre-flight stricter than the applier it stands in for.
+ */
+declare function canMergeTasks(tasks: readonly Task[], selectedIds: string[]): {
+    ok: boolean;
+    error?: string;
+};
+/**
+ * The shape the dependency helpers below read. Structural rather than `Task`,
+ * because the TUI projects tasks into its own `TaskView`: a surface's
+ * dependency picker and the API's validation must agree on which dependencies
+ * are legal, and a signature only core can satisfy would have forced the TUI
+ * to keep a second copy of the rule.
+ */
+interface TaskRef {
+    id: string;
+    order: number;
+    title: string;
+    dependencies: string[];
+}
+/** The tasks listing `taskId` as a dependency — exactly what removing it detaches. */
+declare function dependentsOf<T extends Pick<TaskRef, 'id' | 'dependencies'>>(tasks: T[], taskId: string): T[];
+/**
+ * The tasks that may become dependencies of `taskId`: those displayed before it.
+ *
+ * Offering only earlier tasks is what keeps a hand-edited graph valid without a
+ * cycle check — dependencies then only ever point backwards in display order,
+ * the same invariant `applyTaskOps` enforces. Omit `taskId` for a task that does
+ * not exist yet: it lands last, so every current task is a candidate.
+ */
+declare function dependencyCandidates<T extends Pick<TaskRef, 'id' | 'order'>>(tasks: readonly T[], taskId?: string): T[];
+/** Pre-flight check for a hand-edited dependency list: every id exists and comes earlier. */
+declare function canSetDependencies<T extends TaskRef>(tasks: readonly T[], taskId: string, dependencies: string[]): {
+    ok: boolean;
+    error?: string;
+};
+/** Pre-flight check for a split: the task exists and is not locked by execution. */
+declare function canSplitTask(tasks: readonly Task[], taskId: string): {
+    ok: boolean;
+    error?: string;
+};
+/**
+ * Apply task ops to a snapshot of the plan, atomically: either every op
+ * applies and the result validates (deps resolve, no cycles, running and
+ * completed tasks untouched), or nothing is returned and `errors` explains
+ * why. The caller commits `tasks` on ok.
+ */
+declare function applyTaskOps(currentTasks: readonly Task[], newOps: TaskOp[], runners: RunnerId[], catalog?: EditCatalog, held?: readonly TaskOp[]): ApplyTaskOpsResult;
+
+/**
+ * Task skills end to end (ADR-0024): a skill reaches a runner only by being
+ * attached to its task in the plan, and Ordewell puts its body in the task's
+ * prompt — so it works the same on every runner, and nothing is written to a
+ * harness's own skills directory.
+ */
+/** Where a task's skill names are looked up: global first, then the workspace folders it reads. */
+interface SkillLookup extends Pick<SkillsService, 'findSkill' | 'searchedDirs'> {
+    /**
+     * Set when tasks get worktrees: of `skills`, the workspace ones git will not
+     * carry into them, each SKILL.md path mapped to the folder to commit,
+     * relative to the workspace root.
+     */
+    uncommitted?(skills: readonly SkillInfo[]): Promise<Map<string, string>>;
+}
+/**
+ * Where a workspace's skills are read, known without asking git: the repos
+ * of its group in layout order (`['.']` for one repository), and whether
+ * tasks will get worktrees, which only a committed skill reaches.
+ */
+interface SkillLayout {
+    repos: readonly string[];
+    worktrees: boolean;
+}
+
+/**
+ * Where the run's tasks will work: `false` in the shared workspace root;
+ * otherwise each in its own worktree of every repo of the group (ADR-0013,
+ * ADR-0014), which is what decides if tasks on the same file must be ordered.
+ */
+type IsolatedExecution = false | RepoGroupLayout;
+interface PlannerModes {
+    autonomousDefault: boolean;
+    /** Not a toggle: a fact about the run. */
+    isolatedExecution: IsolatedExecution;
+    /**
+     * Where the run's tasks will look their skills up (ADR-0024), also a fact
+     * about the run. A plan attaching a planner skill is refused against it,
+     * and a coding agent's submit_plan call is refused in its turn rather than
+     * accepted and then failed. Absent: the plan is not checked.
+     */
+    taskSkills?: SkillLookup;
+}
+
+/**
+ * One entry of a structured task's log (ADR-0018, P1): what a runner did,
+ * normalized and serializable, streamed live as `task_log` and appended to
+ * the attempt's `.jsonl` file. The live view and the reload fold the same
+ * events through `reduceTaskLog`, so the two cannot disagree.
+ *
+ * Readers skip a type they do not know, which is how later events join
+ * without a format version.
+ */
+type TaskLogEvent = 
+/**
+ * The task skills this attempt's prompt carried, as read at its spawn
+ * (ADR-0024): first in its log. The file keeps their bodies; a surface is
+ * sent notices ({@link taskLogForSurface}).
+ */
+{
+    type: 'task_skills';
+    skills: TaskSkillSnapshot[] | TaskSkillNotice[];
+}
+/**
+ * A turn began by delivering `message`; `messageId` names it when it had been
+ * queued, `forced` when it was force sent. `from` on this and the other
+ * message events marks one Ordewell sent rather than the user.
+ */
+ | {
+    type: 'turn_start';
+    message: string;
+    messageId?: string;
+    forced?: boolean;
+    from?: TaskMessageFrom;
+}
+/**
+ * A turn began by running the runner's own command `/name args` (#66): the
+ * `turn_start` of a command turn. `messageId` names it when it had been queued.
+ */
+ | {
+    type: 'command';
+    name: string;
+    args?: string;
+    messageId?: string;
+}
+/** What the running command printed, for one that runs without the model. */
+ | {
+    type: 'command_output';
+    text: string;
+}
+/** The runner compacted its own context, asked to or on its own. */
+ | {
+    type: 'compaction';
+    trigger: 'manual' | 'auto';
+    preTokens?: number;
+    postTokens?: number;
+}
+/** What the runner loaded from the user's and the project's setup, as its process started. */
+ | {
+    type: 'runner_loaded';
+    commands: RunnerCommand[];
+    mcpServers: RunnerMcpServer[];
+} | {
+    type: 'turn_end';
+    reason: StructuredTurnEnd;
+} | {
+    type: 'text_delta';
+    text: string;
+}
+/** A complete run of the agent's reply, authoritative over the deltas streamed for it. */
+ | {
+    type: 'text';
+    text: string;
+} | {
+    type: 'thinking_delta';
+    text: string;
+    subagentId?: string;
+} | {
+    type: 'thinking';
+    text: string;
+    subagentId?: string;
+}
+/** `args` is the call's arguments as JSON, exactly as the runner announced them. */
+ | {
+    type: 'tool_call';
+    id: string;
+    name: string;
+    args: string;
+    subagentId?: string;
+}
+/** `omittedLines` is set when {@link trimToolOutput} cut the middle of `output`. */
+ | {
+    type: 'tool_result';
+    id: string;
+    output: string;
+    success: boolean;
+    omittedLines?: number;
+    subagentId?: string;
+} | {
+    type: 'subagent_started';
+    subagentId: string;
+    brief: string;
+    model?: string;
+} | {
+    type: 'subagent_finished';
+    subagentId: string;
+    outcome: SubagentOutcome;
+    digest: string;
+} | {
+    type: 'usage';
+    record: UsageRecord;
+}
+/**
+ * Waiting in Ordewell's queue — again, for a message the runner was handed
+ * and let go of (ADR-0023, D4). `forced` moves it ahead of the rest (F2).
+ */
+ | {
+    type: 'message_queued';
+    messageId: string;
+    text: string;
+    forced?: boolean;
+    from?: TaskMessageFrom;
+} | {
+    type: 'message_removed';
+    messageId: string;
+} | {
+    type: 'message_undelivered';
+    messageId: string;
+    text: string;
+    from?: TaskMessageFrom;
+}
+/** The runner accepted a queued message into its running turn; it can no longer be taken back. */
+ | {
+    type: 'message_handed_over';
+    messageId: string;
+}
+/**
+ * The model read a message inside its running turn (ADR-0023, Q2), logged
+ * where it read it. A message that opened a turn is that turn's `turn_start`.
+ */
+ | {
+    type: 'message_delivered';
+    messageId: string;
+    text: string;
+    from?: TaskMessageFrom;
+}
+/** The agent's own words for a failed turn. */
+ | {
+    type: 'error';
+    message: string;
+}
+/**
+ * The runner asked to use a tool its mode does not cover (ADR-0018, A1).
+ * `approvalId` is what the answer is given under; `args` is the call's
+ * arguments as JSON; `allowForTask` says the runner offered its own
+ * session-scoped grant. `decided` is set when the request was never left
+ * open — an Ordewell tool or an auto-approving mode — so a surface does not
+ * offer to answer what is already answered (it is still followed by the
+ * matching `approval_decided`, which a reader may rely on).
+ */
+ | {
+    type: 'approval_requested';
+    approvalId: string;
+    tool: string;
+    args: string;
+    allowForTask: boolean;
+    toolCallId?: string;
+    decided?: ApprovalDecision['decision'];
+} | {
+    type: 'approval_decided';
+    approvalId: string;
+    decision: ApprovalDecision['decision'];
+    note?: string;
+}
+/** The request went unanswered: the runner withdrew it, or its process ended. */
+ | {
+    type: 'approval_withdrawn';
+    approvalId: string;
+}
+/**
+ * The runner's process ended. A call it had not reported back on is not
+ * running any more: a task's runner is ended the moment its `task_complete`
+ * lands, often before it reports that call's result.
+ */
+ | {
+    type: 'runner_ended';
+};
+/**
+ * Keep a tool result's head and tail. A build log or a whole file read can
+ * run to megabytes, and every attempt's file keeps it for good; the ends are
+ * where a reader looks — the command's start, and how it finished.
+ */
+declare function trimToolOutput(output: string): {
+    output: string;
+    omittedLines?: number;
+};
+/**
+ * The log entry for one structured event, or null for what the log does not
+ * keep: background-agent launches, which the subagent's own events already show.
+ */
+declare function toTaskLogEvent(event: StructuredEvent): TaskLogEvent | null;
+/** A log as a surface is sent it, live or read back: everything but the skills' bodies. */
+declare function taskLogForSurface(events: readonly TaskLogEvent[]): TaskLogEvent[];
+/**
+ * Merge runs of deltas into one event each. Deltas arrive a few characters at
+ * a time; merged, a batch is one message on the wire and one line on disk,
+ * and the view folds to the same blocks either way.
+ */
+declare function coalesceTaskLog(events: readonly TaskLogEvent[]): TaskLogEvent[];
+/**
+ * What an attempt did to the world, for the retry of a task whose effects
+ * outlive it (ADR-0020): one line per tool call and how it ended.
+ */
+declare function digestTaskLog(events: readonly TaskLogEvent[], maxCalls: number): string;
+
+type NotificationAction = {
+    label: string;
+    value: string;
+};
+interface INotification {
+    info(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string): void;
+    confirm(msg: string, options: string[]): Promise<string | undefined>;
+}
+
+/**
+ * The deep module owning all plan-shaped state. Holds `planTasks` (the ordered
+ * tree the user edits), the flattened `allTasks` view and the `taskMap` index.
+ * The orchestrator calls `markCompleted`/`markFailed`/`markInProgress`/`retry`
+ * to update task status — it never mutates task state directly.
+ *
+ * Completion and failure are read from `task.status` and nothing else, so
+ * `isCompleted`, `completedCount`, `isAllComplete` and the scheduler's
+ * dependency checks cannot disagree. The store owns its task objects: `load`
+ * copies what it is given, the getters hand out readonly views, and
+ * `snapshot` is the copy a caller may keep or write to disk.
+ *
+ * `rebuild` is the internal seam that keeps the flat views in sync with the
+ * tree.
+ *
+ * `planRunners` lives here because it's part of the plan's identity (the runner
+ * set, carried on the plan). `validateAssignedRunners` is pure store logic.
+ */
+declare class PlanStore {
+    private _planTasks;
+    private _allTasks;
+    private _taskMap;
+    /** Task id → the top-level task it hangs under, itself for a top-level task. */
+    private _rootMap;
+    private _planRunners;
+    private _onMutate;
+    private _executionLog;
+    /** Hook called after every structural mutation (add/remove/update/resetForRun). */
+    set onMutate(cb: (() => void) | null);
+    get planTasks(): ReadonlyArray<Readonly<Task>>;
+    get allTasks(): ReadonlyArray<Readonly<Task>>;
+    get planRunners(): RunnerId[];
+    get completedCount(): number;
+    get failedCount(): number;
+    isAllComplete(): boolean;
+    isAnyFailed(): boolean;
+    isCompleted(id: string): boolean;
+    isSkipped(id: string): boolean;
+    /** Nothing is left to do: every task completed or was skipped. */
+    isFinished(): boolean;
+    isFailed(id: string): boolean;
+    get(taskId: string): Readonly<Task> | undefined;
+    /**
+     * Whether a task runs as an ops task (ADR-0020). Only a top-level AI task
+     * can be one; a subtask runs with the top-level task it hangs under.
+     */
+    isOps(taskId: string): boolean;
+    /** A copy of the task tree, detached from the store: later status changes do not reach it. */
+    snapshot(): Task[];
+    getExecutionLog(): ReadonlyArray<TaskSnapshot>;
+    appendToLog(snapshot: TaskSnapshot): void;
+    /**
+     * Drop a task's archived snapshot. Un-marking a completion has to erase the
+     * "finished" record too — dependent tasks are prompted from the log, so a
+     * left-behind snapshot would keep feeding them a result that no longer exists.
+     */
+    removeFromLog(taskId: string): void;
+    clearLog(): void;
+    private notifyMutate;
+    private countStatus;
+    load(tasks: ReadonlyArray<Readonly<Task>>, runners: readonly RunnerId[]): void;
+    add(partial: Partial<Task>): Task;
+    remove(taskId: string): void;
+    update(taskId: string, changes: Partial<Task>): Task | undefined;
+    /**
+     * Run preparation as one named op: flip every AI task to 'approved'. By
+     * default completed tasks keep their status so a reloaded half-finished plan
+     * resumes the remainder instead of re-running work that already succeeded,
+     * and skipped ones stay skipped: a new run is not a retry of them.
+     * `preserveCompleted: false` is for a freshly committed plan, where
+     * everything starts over. `keepScheduledResumes` leaves a task waiting on
+     * its runner's usage-limit reset waiting: an edit adopted between runs is
+     * not the user starting over.
+     */
+    resetForRun(opts?: {
+        preserveCompleted?: boolean;
+        keepScheduledResumes?: boolean;
+    }): void;
+    markCompleted(id: string): void;
+    markFailed(id: string): void;
+    markSkipped(id: string, reason?: string): void;
+    markInProgress(id: string): void;
+    markAwaitingUser(id: string, reason?: AwaitingReason): void;
+    /** When a task paused on a usage limit resumes on its own; undefined leaves it to a manual retry. */
+    setTaskResumeAt(id: string, resumeAt: string | undefined): void;
+    markPending(id: string): void;
+    retry(id: string): void;
+    /** Kept on the task: it was force-started past its merge gate, before these dependencies' work was merged (ADR-0020). */
+    setForcedPastGate(id: string, dependencies: string[]): void;
+    /** A reason outlives nothing: any status but `awaiting_user` drops it, and the resume time with it; any status drops a skip's reason. */
+    private setStatus;
+    blockDependents(id: string): void;
+    unblockDependents(id: string): void;
+    setTaskVerdict(id: string, verdict: Task['verdict']): void;
+    setTaskOutputSummary(id: string, summary: Task['outputSummary']): void;
+    setTaskRunnerSessionId(id: string, runnerSessionId: string | undefined): void;
+    startAttemptUsage(id: string, attempt: number, runner: string, startedAt: string): void;
+    recordAttemptUsage(id: string, attempt: number, record: UsageRecord, now: string): void;
+    endAttemptUsage(id: string, attempt: number, now: string): void;
+    setTaskAttemptSkills(id: string, skills: Task['attemptSkills']): void;
+    /**
+     * Widen the plan's runner set. Retargeting a task onto a runner the plan has
+     * not used before has to land here as well as on the plan state, or
+     * {@link resolveTaskRunner} reads the new runner as foreign and spawns the
+     * plan's first one instead.
+     */
+    admitRunner(runner: RunnerId): void;
+    resolveTaskRunner(task: Readonly<Task>): RunnerId;
+    private rebuild;
+    private validateAssignedRunners;
+}
+
+type IsolationNoticeLevel = 'info' | 'warn' | 'error';
+interface AttemptWorkspace {
+    cwd: string;
+    worktree: boolean;
+    continuationMessage?: string;
+}
+/**
+ * What the controller reports. It never schedules or emits on its own: the
+ * orchestrator turns these into observer events and decides what runs next.
+ */
+interface IsolationRunListener {
+    /**
+     * The run record changed and should be persisted with the plan. `detached`
+     * is set instead when the record that changed is no longer the plan's own —
+     * a release that outlived the plan load that replaced its run — and belongs
+     * to the session that was left.
+     */
+    changed(detached?: IsolationRun): void;
+    /** A run did not start: `repos` of the group have tracked changes. */
+    blocked(repos: string[]): void;
+    /** An isolated run closed and handed its integration branches over. */
+    handoff(handoff: IsolationHandoff): void;
+    /** Already said through the notifications; also for a surface that shows no toasts. */
+    notice(level: IsolationNoticeLevel, message: string): void;
+}
+interface IsolationRunControllerDeps {
+    isolation: IWorktreeIsolation;
+    config: IConfig;
+    notifications: INotification;
+    workspaceRoot: () => string;
+    listener: IsolationRunListener;
+    /**
+     * The tasks no clean-up of the whole run may take a worktree from: an
+     * attempt is running them, or the plan has them in progress or waiting on
+     * the user mid-attempt.
+     */
+    liveTasks: () => ReadonlySet<string>;
+}
+/**
+ * The lifecycle of a plan's isolation run (ADR-0013, ADR-0014, ADR-0020),
+ * between the scheduler and the git layer: deciding, at a run's first change
+ * task, whether it executes in worktrees, a blocked run and how it goes on,
+ * each attempt's working directory, releasing worktrees, which landed work the
+ * user has merged, the tree check of an ops task, the handoff when the run
+ * closes, and what the user does with it afterwards. The record it keeps
+ * outlives one run — a resumed plan continues it.
+ */
+declare class IsolationRunController {
+    private readonly isolation;
+    private readonly config;
+    private readonly notifications;
+    private readonly workspaceRoot;
+    private readonly listener;
+    private readonly liveTasks;
+    private run;
+    /** Copied paths already reported for the current run: every task gets the same copies. */
+    private reportedCopies;
+    private reportedSetupFailures;
+    /**
+     * How the open run executes; null while no run is open, `undecided` until
+     * its first change task asks. A run is one Execute-Plan or one manual task
+     * run, from its start until it settles or is stopped.
+     */
+    private mode;
+    /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
+    private resolvers;
+    private opening;
+    /** Bumped by an interrupt, so an activation in flight across it does not open the run it ended. */
+    private activations;
+    /** The start a dirty tree turned away, handed back once the user chooses how to go on. */
+    private blockedStart;
+    /** The dirty repos behind {@link blockedStart}, for the stash notice. */
+    private blockedRepos;
+    constructor(deps: IsolationRunControllerDeps);
+    /** The plan's run record, open or not; null when the plan has not isolated. */
+    get current(): IsolationRun | null;
+    get isOpen(): boolean;
+    /** The open run has decided whether it isolates. */
+    get decided(): boolean;
+    /** The open run executes in worktrees. */
+    get isolating(): boolean;
+    /** A run is waiting on the user to stash or to go on without isolation. */
+    get blocked(): boolean;
+    /** What the plan persists of isolated execution; null when no run ever isolated. */
+    get planIsolation(): PlanIsolation | null;
+    /** The one guard of every action on the run: a plan that never isolated is a request refused, not a fault. */
+    requireRun(): IsolationRun;
+    /** A task's record in the open run, only while that run isolates. */
+    openRecord(taskId: string): IsolationTaskRecord | undefined;
+    /** Where a task's isolated work stands; null when the plan has no isolation run to speak of. */
+    taskIsolation(taskId: string): TaskIsolation | null;
+    view(): IsolationView | null;
+    /**
+     * Take over a plan's persisted isolation, or none for a plan that has not
+     * isolated yet. Whatever a crashed process left behind for the run — a
+     * worktree still marked active, a directory no record owns — is pruned,
+     * while kept, failed and conflicted worktrees stay for the user.
+     *
+     * Deliberately not reported as a change: adopting is not a change to
+     * persist, and a host that adopts without persisting (VS Code's restore)
+     * would otherwise write a new session file on every reload.
+     */
+    adopt(state: PlanIsolation | null): Promise<void>;
+    /** Open a run if none is, leaving whether it isolates to its first change task. */
+    open(): void;
+    /**
+     * Decide once per run, as its first change task starts, whether it executes
+     * in worktrees (ADR-0020): an ops task needs none, so a run of only ops
+     * tasks never asks. `resume` is what a dirty tree parks until the user
+     * chooses how to go on. Resolves false while the run waits on that choice.
+     */
+    decide(resume: () => Promise<void>): Promise<boolean>;
+    /**
+     * Whether the run in force, or else the next one, gives each task its own
+     * worktrees, and of which repo group — what the planner is told, since it
+     * decides whether tasks on the same file have to be ordered and which shared
+     * paths two tasks must not edit at once. A tree that would block counts as
+     * not isolating: the user may yet run without isolation, and ordering is
+     * the safe rule then.
+     */
+    plannerLayout(): Promise<IsolatedExecution>;
+    /**
+     * Where the workspace's skills are read, and whether tasks get worktrees.
+     * Read synchronously inside a planner turn or a chip edit, so it comes from
+     * the files, not git or the planner's last layout: a restored session is
+     * right from its first edit. The run's repos while it isolates; otherwise
+     * the group the workspace holds, in worktrees unless isolation is off or
+     * this run chose to share the root.
+     */
+    skillLayout(): SkillLayout;
+    /**
+     * Go on with the start a dirty tree turned away. `stash` puts the user's
+     * tracked changes on the git stash first, so the run isolates; `shared` runs
+     * this one run in the workspace root, knowingly. Returns the parked start for
+     * the caller to replay; null when nothing was parked.
+     */
+    continueBlocked(how: 'stash' | 'shared'): Promise<(() => Promise<void>) | null>;
+    /**
+     * The working directory of an attempt that may run in a worktree — which
+     * attempts do is the attempt kind's to say (see `attemptKind.attemptCwd`):
+     * the worktree prepared for it in an isolated run, the kept one for a
+     * conflict repair, else the workspace root. `worktree` says which. Does not
+     * itself report a worktree it creates as a change — the caller does once
+     * the attempt is committed as running, so a spawn abandoned or failed after
+     * this settles is not misreported as a change that stuck.
+     */
+    attemptCwd(task: Task, intent: 'fresh' | 'repair' | 'continuation'): Promise<AttemptWorkspace>;
+    /** The workspace root, for an attempt that runs outside any worktree. */
+    workspaceCwd(task: Task): Promise<{
+        cwd: string;
+        worktree: boolean;
+    }>;
+    private reopenCwd;
+    private prepareCwd;
+    /**
+     * Land a task's work on the run's integration branches. The record is
+     * reported changed once the landing is set and before the first merge, so
+     * a crash mid-landing leaves the tips to roll back to, and again once it
+     * settles. A git error is `failed`, never a throw.
+     */
+    integrate(task: Task): Promise<IsolationOutcome>;
+    /** What a conflict repair's work shows (ADR-0015); git that cannot tell counts against it. */
+    verifyRepair(task: Task): Promise<RepairEvidence>;
+    /**
+     * Let go of a task's worktree. `keep` leaves it and its branch for
+     * inspection; otherwise both go. A landing still in flight settles first, so
+     * the worktree is never torn down underneath its merge. Bound to the run
+     * the call was made in: a plan loaded meanwhile adopts its own run, whose
+     * records share these task ids and are not this release's to touch.
+     */
+    release(taskId: string, opts: {
+        keep: boolean;
+    }, landing?: Promise<unknown> | null): Promise<void>;
+    /**
+     * Close the open run. An isolated one hands its integration branch over for
+     * review — unless everything it landed is merged already, at merge gates or
+     * by the run's automatic Merge all, which leaves nothing to hand over, so it
+     * is cleared up as a Merge all would have.
+     */
+    close(): Promise<void>;
+    /**
+     * Whether a task's landed work still waits to be merged into the user's
+     * branch — what holds an ops or user task at its merge gate (ADR-0020). A
+     * task with no record never landed anything to wait for.
+     */
+    awaitsMerge(taskId: string): boolean;
+    /**
+     * Look again for landed work the user has merged — by Merge all, or by hand
+     * with git. Resolves true when some was found.
+     */
+    refreshInHead(): Promise<boolean>;
+    /**
+     * The tracked state of the workspace as an attempt whose tree is checked
+     * starts (see `attemptKind.checksTree`), for {@link filesChangedSince}
+     * (ADR-0020). Null where the check does not run: a run that shares the
+     * workspace root, where every task's edits land in it, or a workspace git
+     * cannot isolate at all.
+     */
+    snapshotWorkspace(): Promise<TreeSnapshot | null>;
+    /** Tracked files changed since `snapshot`; none when the run has since gone on in the workspace root. */
+    filesChangedSince(snapshot: TreeSnapshot | null): Promise<string[]>;
+    /**
+     * A stop or a plan load: the open run ends without a handoff and a parked
+     * start is dropped. `keepOpen` spares a run the scheduler is still driving.
+     */
+    interrupt(opts?: {
+        keepOpen?: boolean;
+    }): void;
+    /**
+     * Mark which added task resolves which conflict. The resolver merges the
+     * conflicted task's branch by hand in its own worktree; once that lands, the
+     * conflicted task can land in turn — through the same merge, so a resolver
+     * that did not really bring it along conflicts again instead of being taken
+     * at its word.
+     */
+    linkResolver(resolverId: string, conflictedId: string): void;
+    /** The conflicted task a landed resolver was added for, forgotten as it is returned. */
+    takeResolver(resolverId: string): string | undefined;
+    taskDiff(taskId: string, options: TaskDiffRead): Promise<TaskDiffResult>;
+    reviewDiff(): Promise<string>;
+    /**
+     * "Merge all": the run's integration branches into whatever the user has
+     * checked out, in every repo or none. During a run it merges what has
+     * landed so far and the run goes on (ADR-0020): its branches stay for the
+     * tasks still to land. Once a settled run merged everything, it has nothing
+     * left to hand over, so it is cleared up and forgotten; a branch the user's
+     * HEAD somehow does not contain stays for the next run's sweep.
+     */
+    merge(): Promise<IsolationMergeResult>;
+    /**
+     * Worktrees and task branches go; the integration branch and the record stay
+     * for review and merge. Refused while a task of the run is still live.
+     */
+    cleanup(): Promise<void>;
+    /**
+     * The run and everything it made go, and the plan forgets it; the next run
+     * starts afresh. Refused while a task of the run is still live.
+     */
+    discard(): Promise<void>;
+    /** The records of tasks still live, whose worktrees no clean-up of the whole run may take. */
+    private liveRecords;
+    private refuseWhileLive;
+    /**
+     * Clear a settled run up once everything it landed is merged — and only
+     * when nothing else is left in it: a live task, or a worktree holding work
+     * that never landed, keeps the whole run, worktrees and branches, rather
+     * than leaving that work to a deletion.
+     */
+    private clearMerged;
+    /** Say what a removal kept back instead of deleting: where the work went, or which worktree stayed. */
+    private report;
+    private forget;
+    private assess;
+    private activate;
+    private begin;
+    /** What earlier runs left merged in the group goes; a failure here is worth a word, never a stopped run. */
+    private sweep;
+    /**
+     * The plan's run carries on while it still has any record: anything landed
+     * means a resumed plan's dependents must start from a tip that holds their
+     * predecessors' work, and anything held — a kept attempt, a conflict, a
+     * repair — is work the user may still want, which a fresh run's mint would
+     * delete. Only a run with no records at all is superseded.
+     */
+    private continuableRun;
+    /**
+     * A run with no records at all holds only superseded attempts, so it goes
+     * whole. One that cannot be continued for another reason — it ran from a
+     * different workspace path — keeps its integration branch in each repo that
+     * has not merged it: only the user gives landed work up.
+     *
+     * False when `interrupted` came while git was minting: a newer activation
+     * may be minting its own run, so this one is never installed over it, and
+     * is discarded rather than left as branches no record names.
+     */
+    private mint;
+    private reportCopies;
+    private reportSetupFailures;
+    private tell;
+}
+
+/** Which repair of a task an attempt is, of the most `conflictRepairAttempts` allows. */
+interface RepairAttempt {
+    n: number;
+    limit: number;
+}
+/** One thing the user is told about a landing. */
+interface LandingMessage {
+    level: 'info' | 'warn' | 'error';
+    text: string;
+    /** Also handed to a surface that shows no toasts: ADR-0015 logs every conflict repair as a notice. */
+    repairLog?: true;
+}
+/**
+ * How a landing settled, for the orchestrator to apply — it marks the task,
+ * starts the repair and says the messages. By the time one is returned the
+ * merge has happened or not, and the run record says so.
+ *
+ * - `landed`: the work is on the integration branch of every repo it changed.
+ * - `nothing-to-land`: the attempt ran in the workspace root, or the task
+ *   holds no unlanded work; it is done as it stands.
+ * - `repair-needed`: the landing conflicted and the task is owed `repair`
+ *   (ADR-0015), in the worktree kept for it.
+ * - `awaiting_user`: the work did not land and waits on the user, worktree
+ *   kept — a conflict with no repair left (`conflict`), a merge git refused
+ *   (`landing-failed`), or a repair that did not land (`repair-failed`). None
+ *   of them fails the task, so none blocks its dependents.
+ */
+type LandingOutcome = {
+    kind: 'landed';
+    messages: LandingMessage[];
+} | {
+    kind: 'nothing-to-land';
+    messages: LandingMessage[];
+} | {
+    kind: 'repair-needed';
+    repair: RepairAttempt;
+    messages: LandingMessage[];
+} | {
+    kind: 'awaiting_user';
+    reason: 'conflict' | 'landing-failed' | 'repair-failed';
+    messages: LandingMessage[];
+};
+interface LandingDeps {
+    runs: IsolationRunController;
+    config: Pick<IConfig, 'conflictRepairAttempts'>;
+    /** Read-only: only the orchestrator changes a task. `planTasks` labels a subtask by its dotted reference. */
+    tasks: Pick<PlanStore, 'get' | 'planTasks'>;
+}
+/**
+ * Landing and Conflict repair (ADR-0013, ADR-0014, ADR-0015): a passed
+ * attempt's work onto the run's integration branches through the
+ * {@link IsolationRunController}, and what a landing that did not go through
+ * leads to. It answers with a {@link LandingOutcome} rather than acting on it —
+ * it never marks a task, starts an attempt or emits — so the scheduler stays
+ * the one place that decides what runs. A repair is spent when it starts: the
+ * controller's `reopen` counts it before the runner spawns, and nothing here
+ * hands one back.
+ */
+declare class Landing {
+    private readonly runs;
+    private readonly config;
+    private readonly tasks;
+    constructor(deps: LandingDeps);
+    /**
+     * Land a passed attempt's work. One whose worktree has no unlanded record
+     * behind it any more — the run was discarded under it — cannot land.
+     */
+    landPassed(task: Task, attempt: {
+        worktree: boolean;
+    }): Promise<LandingOutcome>;
+    /** Mark complete is a passed verdict the user vouches for: what the task holds unlanded lands the same way. */
+    landVouched(task: Task): Promise<LandingOutcome>;
+    /**
+     * A repair's verdict decides only whether its work may try to land; the
+     * task keeps the verdict its own work earned. Evidence comes before the
+     * queue, and the landing after it is the one every task goes through, so a
+     * repair the tip has moved past again is a fresh conflict, not a pass.
+     * `current` says whether the attempt is still the task's: a stop that comes
+     * while the evidence is read has already cancelled the work, and the merge
+     * must not bring it in anyway.
+     */
+    settleRepair(task: Task, verdict: Verdict, current: () => boolean): Promise<LandingOutcome>;
+    /** A repair that ended without landing leaves the task as its conflict did: waiting on the user, worktree and refs kept. */
+    unrepaired(task: Task, why: string): Promise<Extract<LandingOutcome, {
+        kind: 'awaiting_user';
+    }>>;
+    /**
+     * Land the conflicted task a resolver was added for, now that the resolver
+     * has landed. Its branch is on the integration branch by then, so it merges
+     * clean — and one the resolver did not really bring along conflicts again
+     * instead of being taken at its word. Null when there is nothing to land.
+     */
+    landResolved(resolverId: string): Promise<{
+        task: Readonly<Task>;
+        outcome: LandingOutcome;
+    } | null>;
+    /** The repair a conflicted task is owed next; null when repair is off, used up, or there is no isolated run to repair it in. */
+    nextRepair(taskId: string): RepairAttempt | null;
+    /** What a repair is asked to do; read once `reopen` has recorded the tips it must bring in. */
+    repairPrompt(task: Task): string;
+    private hasUnlandedWork;
+    private unmerged;
+    private noRepairReason;
+    private describeEvidence;
+    private isGroup;
+}
+
+/**
+ * The variables one workspace's planner and agents run with, on top of the
+ * daemon's own environment (ADR-0016).
+ *
+ * The daemon and the VS Code host inherit whatever environment they were
+ * started from, once. Started anywhere but the project's shell — a desktop
+ * launcher, another directory, a daemon already up for another project — they
+ * miss what the project sets for itself, like a `CLAUDE_CONFIG_DIR` choosing
+ * the account the agents run under. So each spawn asks for it by its own cwd:
+ * a task worktree lives under the workspace, so walking up finds the same
+ * `.envrc` and `.ordewell/env` the workspace root does.
+ */
+interface WorkspaceEnv {
+    env: Record<string, string>;
+    /** An `.envrc` direnv refuses to load until the user allows it. */
+    blockedEnvrc: string | null;
+    /** Keys dropped because they would change how processes load or where Ordewell's own settings live. */
+    refused: string[];
+    /** An `.ordewell/env` ignored because git tracks it — a cloned repository must not choose these. */
+    trackedEnvFile: string | null;
+}
+
+/** What ran an automatic Merge all: a task reaching its merge gate, or the run settling with landed work unmerged. */
+type AutoMergeTrigger = {
+    kind: 'gate';
+    taskId: string;
+} | {
+    kind: 'run_end';
+};
+/**
+ * Who opened a run (ADR-0029): a call the user made, or one made for them; a
+ * call of the supervisor's own; or a usage-limit reset resuming what it paused.
+ * Only the user's starts a run's supervision afresh.
+ */
+type RunOrigin = 'user' | 'supervisor' | 'limit-reset';
+/** What the scheduler reads of the open run's settings, at each decision it makes from them. */
+type SchedulerRunSettings = Pick<RunSettings, 'mergeAtGatesAutomatically'>;
+/**
+ * The one notification channel out of the orchestrator. Everything that used
+ * to travel over a separate callback (onRefresh) is an observer event; the
+ * Session subscribes once and turns these into SessionMessages.
+ */
+interface OrchestratorObserver {
+    /** Any task-shaped state changed (store mutation, checkpoint, retry, …). */
+    onTaskChanged?(): void;
+    /**
+     * A run reached an outcome that stands until the user acts — completed,
+     * failed, or awaiting the user — on its own, not as the answer to a call.
+     * Emitted before the `onTaskChanged` that announces it, so a listener can
+     * save the outcome before any surface is told.
+     */
+    onTaskSettled?(data: {
+        taskId: string;
+    }): void;
+    onRunStarted?(data: {
+        origin: RunOrigin;
+    }): void;
+    /** An automatic Merge all settled, at a gate or at the run's end; failures are attention events for a supervisor. */
+    onAutoMerge?(data: {
+        trigger: AutoMergeTrigger;
+        result: IsolationMergeResult;
+    }): void;
+    onTick?(): void;
+    onUsageChanged?(): void;
+    onExecutionComplete?(): void;
+    /**
+     * A task paused on its runner's usage limit, or its resume changed:
+     * `resumeAt` is when it resumes on its own (ISO time), null when it waits
+     * for a manual retry — the reset could not be read, the resume was
+     * cancelled, or the resumed attempt hit the limit again at once.
+     * `cancelled` marks the resume being cancelled, which is no new pause.
+     */
+    onUsageLimitWait?(data: {
+        taskId: string;
+        runner: string;
+        resumeAt: string | null;
+        cancelled?: true;
+    }): void;
+    /** A live task's runner went silent (ADR-0018's idle timer); paused while it waits on input, a checkpoint or an approval. */
+    onTaskIdle?(data: {
+        taskId: string;
+        idleSince: string;
+    }): void;
+    onReviewNeeded?(data: {
+        tasks: Task[];
+        planRunners: RunnerId[];
+    }): void;
+    onReviewApproved?(data: {
+        tasks: Task[];
+    }): void;
+    onCheckpoint?(data: {
+        taskId: string;
+        taskTitle: string;
+        summary: string;
+    }): void;
+    /**
+     * The isolation run record changed and should be persisted with the plan.
+     * `detached` is the record of a run another plan has replaced since — a
+     * release that outlived a plan load — for the session it belongs to.
+     */
+    onIsolationChanged?(detached?: IsolationRun): void;
+    /** A run did not start: the tree is dirty, and the user picks stash or no isolation. `repos` names the dirty repos of a group. */
+    onIsolationBlocked?(data: {
+        reason: 'dirty';
+        repos: string[];
+    }): void;
+    /** An isolated run settled; emitted before `onExecutionComplete`, which surfaces treat as terminal. */
+    onIsolationHandoff?(handoff: IsolationHandoff): void;
+    /**
+     * What a run says about how it isolates — the fallback to the workspace root,
+     * shared paths, copies, a stash. Beside the notification channel, which a
+     * daemon may leave unwired, so a surface without toasts can still show it.
+     */
+    onIsolationNotice?(data: {
+        level: 'info' | 'warn' | 'error';
+        message: string;
+    }): void;
+}
+/**
+ * A message or interrupt a task cannot take: it is not running, or it is
+ * waiting on something a message does not answer.
+ * The request is wrong, not the orchestrator, so a surface says why.
+ */
+declare class TaskControlError extends Error {
+    constructor(message: string);
+}
+type AttemptPhase = 'starting' | 'running' | 'integrating';
+/** Read-only view of a task's live attempt. */
+interface TaskAttemptSnapshot {
+    taskId: string;
+    attempt: number;
+    phase: AttemptPhase;
+    sessionId: string | null;
+    runner: string;
+    cwd: string | null;
+    startedAt: string;
+    skills: readonly TaskSkillSnapshot[];
+}
+/**
+ * The wiring a {@link TaskOrchestrator} runs on, every collaborator resolved.
+ * {@link TaskOrchestrator.compose} is the only production caller; tests build
+ * one through it too. The constructor makes nothing itself, so there is exactly
+ * one place defaults live.
+ */
+interface TaskOrchestratorDeps {
+    config: IConfig;
+    notifications: INotification;
+    runner: IRunner;
+    store: PlanStore;
+    output: TaskOutputSource;
+    /** The plan's isolation run and the open run's lifecycle (ADR-0013). */
+    runs: IsolationRunController;
+    /** A passed attempt's work onto the integration branch, and any conflict repair. */
+    landing: Landing;
+    registry: RunnerRegistry | null;
+    /** The workspace root, read at call time — VS Code can change it. */
+    workspaceRoot: () => string;
+    /** The workspace's own variables for a task's cwd (ADR-0016). */
+    workspaceEnv: (cwd: string) => Promise<WorkspaceEnv>;
+    /** The skill catalog over workspace roots, as {@link workspaceSkillRoots} orders them — read at each spawn. */
+    skillsAt: (roots: readonly string[]) => SkillLookup;
+    /** What the task's last saved attempt did, or null when it left no log (ADR-0020). */
+    previousAttemptFromLog: (taskId: string) => string | null;
+    /**
+     * The open run's settings, read as each automatic merge is decided rather
+     * than copied when the run opens, so a change to the run under way applies
+     * at once (ADR-0030); absent before any run.
+     */
+    runSettings: () => SchedulerRunSettings | undefined;
+}
+/**
+ * What a caller supplies to {@link TaskOrchestrator.compose}; every optional
+ * one gets its default there. This is what a host or test chooses, not the
+ * resolved wiring the orchestrator itself runs on.
+ */
+interface TaskOrchestratorOptions {
+    config: IConfig;
+    notifications: INotification;
+    runner: IRunner;
+    store?: PlanStore;
+    output?: TaskOutputSource;
+    isolation?: IWorktreeIsolation;
+    registry?: RunnerRegistry | null;
+    workspaceRoot?: () => string;
+    workspaceEnv?: (cwd: string) => Promise<WorkspaceEnv>;
+    skillsAt?: (roots: readonly string[]) => SkillLookup;
+    previousAttemptFromLog?: (taskId: string) => string | null;
+    runSettings?: () => SchedulerRunSettings | undefined;
+}
+/**
+ * The pure scheduler. Owns execution state (`running`, `planStatus`,
+ * `reviewApproved`, the live task attempts, the start hold) and the verifier.
+ * All task-shaped state — the plan tree, the flat index, the completed set
+ * — lives in {@link PlanStore}, injected at construction. The orchestrator
+ * calls `store.markCompleted(id)` / `store.markFailed(id)` instead of mutating
+ * task state directly. A task completes only after the runner reports it done
+ * through `task_complete` on its attempt's token; process exit without that
+ * evidence is a visible failure and does not unblock dependent work.
+ */
+declare class TaskOrchestrator {
+    private config;
+    private notifications;
+    private runner;
+    private store;
+    private output;
+    private attempts;
+    private verifier;
+    private running;
+    private planStatus;
+    /** Planner turns in flight that new starts wait for (ADR-0029); running attempts carry on. */
+    private startHolds;
+    private reviewApproved;
+    private autoMergeBlocked;
+    private mergesInFlight;
+    private retryCounts;
+    private spawnCounts;
+    /** A full-plan run a usage-limit pause holds: no new start until the reset resumes it. */
+    private heldOnLimit;
+    /**
+     * A full-plan run that ended with failed tasks and the tasks they block
+     * (ADR-0034). A retry of a failed task continues it, so what it blocked
+     * starts once it passes — without this the retried task ran alone.
+     */
+    private endedOnFailure;
+    /** A Merge all is under way: no ops task starts until it ends (ADR-0020). */
+    private merging;
+    /** The last "waiting for Merge all" notice, so a run paused at a gate says it once, not on every tick. */
+    private gateNotice;
+    /** The workspace's own variables for a task's cwd (ADR-0016); swapped out in tests. */
+    private workspaceEnv;
+    /** What the workspace env has already warned about, so a run says it once, not per task. */
+    private envWarnings;
+    /**
+     * Tasks pulled out of auto-scheduling (user-cancelled or failed to spawn).
+     * They stay 'pending' — "not executed" — but the scheduler skips them until
+     * the user retries or force-starts, which would otherwise loop forever on a
+     * task whose spawn always throws.
+     */
+    private onHold;
+    /**
+     * Tasks Mark complete is landing after it ended their attempt: in progress
+     * with no attempt for as long as that takes, and not orphans for it.
+     */
+    private completing;
+    /** One wait per runner for its usage limit to reset; the tasks it resumes, and when, are on the plan (#84). */
+    private limitWaits;
+    /**
+     * The plan's isolation run and the open run's lifecycle (ADR-0013); see
+     * {@link IsolationRunController}. Read and acted on there directly, except
+     * Merge all: that goes through {@link mergeRun}, which keeps it apart from
+     * ops tasks and starts the tasks its merge lets through.
+     */
+    readonly runs: IsolationRunController;
+    /** A passed attempt's work onto the integration branch, and the conflict repair a landing may need. */
+    private landing;
+    private registry;
+    private workspaceRootFn;
+    private observers;
+    private skillsAt;
+    private previousAttemptFromLog;
+    private runSettings;
+    constructor(deps: TaskOrchestratorDeps);
+    /**
+     * The composition root: resolves every optional collaborator and wires the
+     * isolation listener that the constructor cannot, because it needs the
+     * instance's own (private) emit seam. Nothing else in the
+     * codebase constructs an orchestrator, so this is the one place defaults
+     * live — a host or test supplies what it cares about and gets the rest.
+     */
+    static compose(options: TaskOrchestratorOptions): TaskOrchestrator;
+    /** Advisory silence timestamp for a task's live runner, or null if not idle. */
+    getIdleSince(taskId: string): string | null;
+    /**
+     * What an ops retry is told about the attempt before. The saved log is read
+     * whether or not the session was reloaded, so both behave alike; the output
+     * buffer is the fallback for a runner that has no log. A reload clears the
+     * attempt count along with the buffer, so a retry made since is what says
+     * there was an attempt to report on.
+     */
+    private opsPreviousAttempt;
+    /** Recent clean output of a task's latest attempt, running or ended; null if it never ran. */
+    getLiveOutput(taskId: string, opts: LiveTailOptions): LiveTail | null;
+    get storeInstance(): PlanStore;
+    /**
+     * The variables a task's agent gets from its workspace. What cannot be
+     * applied is said once — silently starting without them is how agents ran
+     * under the wrong account when an edited `.envrc` was left unallowed.
+     */
+    private envForTask;
+    approveCheckpoint(taskId: string): void;
+    rejectCheckpoint(taskId: string, reason?: string): void;
+    /** What the task's waiting checkpoint asks, whole; undefined once it settles or when none waits. */
+    getCheckpointQuestion(taskId: string): string | undefined;
+    awaitsCheckpoint(taskId: string): boolean;
+    /**
+     * Send a structured task a user message (ADR-0018, M1). Mid-turn it queues
+     * behind the turn; a task waiting for input takes it at once and is back in
+     * progress. Returns the message's id, for {@link removeQueuedTaskMessage}.
+     */
+    sendTaskMessage(taskId: string, text: string): string;
+    /**
+     * Force send (ADR-0023, F1–F3): interrupt the running turn and deliver the
+     * message as the next one, ahead of anything queued, without the task
+     * waiting for input in between. A task already waiting for input just takes it.
+     */
+    forceSendTaskMessage(taskId: string, text: string): string;
+    /**
+     * Run the task runner's own command `/name args` (#66) as a turn of its
+     * own, waiting behind a running turn as a message would. Ordewell carries
+     * it; what it does is the runner's business (#24).
+     */
+    invokeTaskCommand(taskId: string, name: string, args?: string): string;
+    private messageTask;
+    /** Force send a message not yet delivered, queued or handed over; false once it was delivered. */
+    forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
+    /** Take back a message still queued behind a turn; false once it was delivered. */
+    removeQueuedTaskMessage(taskId: string, id: string): boolean;
+    /** Stop a structured task's running turn; it then waits for input like any turn that ends without a `task_complete` call. */
+    interruptTask(taskId: string): Promise<void>;
+    /** What is waiting for a structured task's turn to end; empty for any other task. */
+    getQueuedTaskMessages(taskId: string): QueuedTaskMessage[];
+    private runnerSession;
+    /**
+     * A structured turn that ended without a `task_complete` call (ADR-0018, W1). No
+     * verdict is guessed: the task waits for input, unless a checkpoint in the
+     * same turn already has it waiting, or a queued message went straight out —
+     * the session never passes through idle then, so nothing flickers. The first
+     * turn of an attempt to end that way, cleanly, gets the completion reminder
+     * instead: weaker models often finish the work and report in prose.
+     */
+    private onTurnEnd;
+    subscribe(observer: OrchestratorObserver): () => void;
+    /**
+     * Isolated per observer: one that throws must not take down the scheduler
+     * or stop the remaining observers from hearing the event.
+     */
+    private emit;
+    get isRunning(): boolean;
+    /**
+     * A runner is executing *right now*. Narrower than {@link isRunning}, which
+     * also covers the armed-but-idle scheduler `tick()` deliberately leaves
+     * behind when a plan is paused on a user task, a checkpoint or a hold —
+     * nothing is executing then, so nothing is reading the plan mid-mutation.
+     */
+    get hasLiveWork(): boolean;
+    get isReviewApproved(): boolean;
+    /** The scheduler is driving the plan: ready tasks start on their own as slots free. Narrower than {@link isRunning}. */
+    get isScheduling(): boolean;
+    /**
+     * A full-plan run with nothing starting that something still resumes: a
+     * usage limit's reset, or a retry of a failed task its blocked tasks wait on.
+     */
+    get awaitsResume(): boolean;
+    get status(): 'approved' | 'running' | 'completed';
+    get activeTaskIds(): string[];
+    /** Task id → session id of every attempt whose runner is up; a spawn in flight has no session yet. */
+    get activeSessionMap(): Map<string, string>;
+    getAttempt(taskId: string): TaskAttemptSnapshot | undefined;
+    /** A planner turn holds new starts: what is ready starts when it releases them. */
+    get startsHeld(): boolean;
+    /**
+     * Hold the scheduler's new starts while a planner turn decides what runs
+     * next, so its edits do not race a task that would otherwise start under
+     * it. Running attempts are untouched. The release is idempotent and starts
+     * nothing itself: whoever releases ticks, which starts what became ready.
+     */
+    holdStarts(): () => void;
+    /**
+     * "Merge all"; a settled run that merged everything is cleared up and
+     * forgotten. During a run it merges what has landed and the run goes on:
+     * the tasks waiting at a merge gate for that work then start (ADR-0020).
+     * Never alongside ops work, either way round ({@link mergeExcludes}).
+     */
+    mergeRun(): Promise<IsolationMergeResult>;
+    private mergeLanded;
+    /**
+     * Close the settled run. With merge at gates automatically on, landed work
+     * not merged yet is merged first, through the gate's path, so no surface
+     * hears of a handoff for a run about to merge; one that stopped is handed
+     * over as before.
+     */
+    private closeRun;
+    /**
+     * The run as a surface offers Merge all mid-run (ADR-0020): what has landed
+     * and is not merged, and whether the run is paused at its gates with nothing
+     * else running. Null once everything landed is merged.
+     */
+    runMergeView(): RunMergeView | null;
+    /**
+     * The dependencies an ops or user task waits on at its merge gate: those
+     * whose landed work is not in the user's branch yet (ADR-0020). Empty once
+     * the task has started, and for every other task.
+     */
+    getMergeGate(taskId: string): string[];
+    /** The failed tasks a task not started yet waits on, through its dependencies (ADR-0034); empty when it is not blocked. */
+    getBlockedBy(taskId: string): string[];
+    loadPlan(tasks: readonly Task[], planRunners?: RunnerId[]): void;
+    /**
+     * Adopt an edited plan without letting go of the run in progress. Everything
+     * the scheduler owns — live sessions, holds, retry counts, the verifier and
+     * the review approval — survives, because `loadPlan` clears all of it and a
+     * mid-run edit is not a new run. Only the tasks change.
+     *
+     * The ids with live sessions are defended: one dropped from the edited plan is
+     * carried over (its verdict still has to land somewhere), and one whose status
+     * the snapshot predates is put back to `in_progress` — adopting the snapshot's
+     * "pending" would offer the scheduler work a runner is already doing.
+     *
+     * A failed task stays failed, unlike a plan load's fresh chance: an edit is
+     * not a retry, and the tasks it blocks wait for that retry (ADR-0034).
+     */
+    reconcilePlan(newTasks: Task[], planRunners?: RunnerId[]): void;
+    start(origin?: RunOrigin): Promise<void>;
+    /** A usage-limit pause holds the run: spawning more would spend the same exhausted limit. */
+    private holdOnLimit;
+    stop(): void;
+    /** Name the tasks a stop took down, so none is mistaken for one still at work. */
+    private sayStopped;
+    /**
+     * A task in progress with no attempt has nothing running it: a stop, a plan
+     * load or anything else that ended its attempt left its status behind. It
+     * is put back to not started, and said, so it can be retried rather than
+     * read as running — or, in an isolated run, count as live work forever.
+     */
+    private recoverOrphans;
+    /**
+     * Task ids still live, whose worktrees no clean-up of the whole run may
+     * take: an attempt is running them, or the plan has them in progress or
+     * waiting on the user mid-attempt — at a checkpoint, or for input. One
+     * waiting on the user's decision instead (a conflict, a usage limit, files
+     * an ops task changed) is not: no runner is at work on it, and a clean-up
+     * keeps what it holds on a branch before its worktree goes.
+     */
+    private liveTaskIds;
+    /**
+     * Whether the run may close with its handoff: no task is live. A handoff
+     * tells the user the run has finished, and a Merge all after it clears the
+     * run up, so neither may happen under a task the plan still shows at work.
+     */
+    private get settled();
+    /**
+     * The boundary a verdict crosses: nothing awaits the verifier's listener, so
+     * a throw from reading the output, landing, releasing a worktree or the tick
+     * after would be an unhandled rejection — and an attempt left integrating is
+     * live work forever. One that never settled fails (a repair waits on the
+     * user, as its conflict did) and blocks only its dependents; either way the
+     * run says why and goes on.
+     */
+    private deliverVerdict;
+    /** Work nothing awaits: a rejection is said, not left unhandled. */
+    private unawaited;
+    private onVerdict;
+    private afterVerdict;
+    /**
+     * A repair's verdict never replaces the verdict the task's own work earned,
+     * and a repair that does not land leaves the task waiting on the user —
+     * never a failed task, so never one that blocks its dependents.
+     */
+    private settleRepair;
+    /**
+     * Hand an attempt's verdict to Landing. The attempt stays live while that
+     * settles — it may wait on the module's merge queue — so a cancel, retry or
+     * stop in that window still wins, and waits for the merge before tearing the
+     * worktree down; nothing counts the task as done before its work is on the
+     * integration branch.
+     */
+    private land;
+    /** Settle a task by how its landing went; `onLanded` is what the path that landed it adds to completing it. */
+    private applyLanding;
+    /**
+     * Work that did not land waits on the user — it never fails the task or
+     * blocks its dependents — unless its conflict is owed a repair, which takes
+     * the slot the ending attempt freed and never one more than the run allows.
+     */
+    private settleUnlanded;
+    private landResolved;
+    getReadyTasks(): Task[];
+    private readiness;
+    private mergesAutomatically;
+    /**
+     * The user changed the run settings under an open run (ADR-0030). The
+     * scheduler reads them at each decision it makes from them, so a merge gate
+     * already reached is merged now rather than at the next event. Fire-and-forget
+     * — no caller waits on the change — and its failure is said through
+     * {@link unawaited}, never left unhandled.
+     */
+    runSettingsChanged(): void;
+    private openRun;
+    /**
+     * Open the run a task starts in, and decide whether it isolates if the
+     * task's next attempt needs that ({@link decidesIsolation}). False while a
+     * dirty tree waits on the user; `resume` is what their choice replays.
+     */
+    private openFor;
+    /** The kind a task's next attempt starts as, short of a repair or a continue: what is weighed before one exists. */
+    private nextAttemptKind;
+    /**
+     * Cancel a running (or scheduled) task: kill its session and return it to
+     * 'pending' — "not executed". The task is put on hold so the scheduler
+     * doesn't immediately restart it; Retry / Force Start release the hold.
+     *
+     * The attempt's worktree is kept, as a stopped or failed one is: a runner is
+     * often cancelled because it looked stuck after doing the work, and Mark
+     * complete can still land that work. The next attempt replaces it.
+     */
+    cancelTask(taskId: string): Promise<void>;
+    private cancelAttempt;
+    /**
+     * Let go of a task that is leaving the plan. A live runner is cancelled
+     * as {@link cancelTask} does, but its worktree goes: no task is left to land
+     * it into. A spawn still in flight just loses its attempt,
+     * which is what makes {@link startTask} kill the session it is about to
+     * receive. The id's cross-attempt bookkeeping goes too — a hold or retry
+     * count kept for a task that no longer exists would be inherited by nothing.
+     */
+    releaseTask(taskId: string): Promise<void>;
+    markTaskComplete(taskId: string): Promise<void>;
+    /**
+     * Undo a completion: return the task to "not executed" — pending, verdict and
+     * summary dropped, archive entry removed. It is put on hold like a cancel, so
+     * a running plan does not immediately re-spawn the work the user just
+     * un-marked; Retry / Force Start / Run release the hold. Dependents fall back
+     * to waiting on their own, because the scheduler gates on `isCompleted`.
+     */
+    markTaskIncomplete(taskId: string): Promise<void>;
+    /**
+     * Skip: end a task as `skipped`, with no verdict and nothing of its work
+     * landed. Its worktree is kept, as a failed attempt's is, so the user can
+     * still look at it or Mark complete it later. Its dependents go ahead
+     * without it, and a run that ended on a failure continues for them, as a
+     * retry would continue it. A running task is stopped before it is skipped.
+     */
+    skipTask(taskId: string, reason?: string, origin?: RunOrigin): Promise<void>;
+    private logAndArchive;
+    retryTask(taskId: string, origin?: RunOrigin): Promise<void>;
+    /**
+     * Continue a finished structured task in its saved runner session (ADR-0018,
+     * K1): a retry whose first turn is the user's message, sent to the session
+     * the task ended in rather than a fresh one given its prompt again. The
+     * worktree keeps the same path, where the runner keeps its sessions, and
+     * restores the previous work so that session's memory matches its files.
+     */
+    continueTask(taskId: string, message: string, origin?: RunOrigin): Promise<void>;
+    /**
+     * Keep a task paused on its runner's usage limit from resuming on its own:
+     * it waits for a manual retry, as one whose reset time could not be read
+     * does. What a surface's cancel calls, and what moving the task to another
+     * runner has to call first. False when no resume was scheduled for it.
+     */
+    cancelScheduledResume(taskId: string): boolean;
+    /** Run before writing assignments so cancellation sees the old runner's shared wait. */
+    releaseMovedResume(taskId: string, changes: Partial<Task>): Partial<Task>;
+    /**
+     * A task's attempt stopped on its runner's usage limit, without a
+     * completion call. Failing would paint a red X on a task that only has to
+     * wait, and spawning more tasks would spend the same exhausted limit, so the
+     * task pauses and the run holds. When the runner said when its limit
+     * resets, the task joins its runner's wait and resumes on its own then
+     * (#84); otherwise, or when it was resumed a moment ago and hit the limit
+     * again, it waits for the user to retry it.
+     */
+    private pauseOnLimit;
+    /**
+     * The limit arrived as the turn's error with the runner still up: the
+     * attempt ends here, as its verdict would have ended it, so a resume is a
+     * continue in a fresh process (ADR-0018, L1/K1).
+     */
+    private stopOnLimit;
+    /** The tasks waiting on `runner`'s reset to resume on their own. */
+    private waitingOn;
+    /**
+     * Arm `runner`'s one wait for the latest resume time among its tasks, and
+     * put that time on each of them, so they resume together.
+     */
+    private armLimitWait;
+    /**
+     * The waits a loaded plan still owes. A resume time that passed while
+     * nothing was running — the daemon was down, say — resumes at once.
+     */
+    private rearmLimitWaits;
+    /**
+     * Resume a task paused on its runner's usage limit now, in its saved
+     * session, once the user says the limit has reset early. The limit is the
+     * runner's account's, so every task waiting on that runner's reset resumes
+     * with it, as at the reset itself. `message` follows the reset notice in the
+     * same continuation. A resumed attempt that hits the limit again at once
+     * waits for the user, as an automatic resume's does: that is what keeps a
+     * caller from resuming it round and round.
+     */
+    resumeNow(taskId: string, origin?: RunOrigin, message?: string): Promise<void>;
+    private resumeAfterLimit;
+    /**
+     * Retry a task paused on a usage limit, continuing its saved session where
+     * it left one (ADR-0018, K1), then release the hold the pause put on the
+     * run once nothing else waits on a reset.
+     */
+    private resumeTask;
+    /**
+     * Manually start a single AI task right now, bypassing dependency/readiness
+     * gating (the "force start" affordance on a task card). Reuses the scheduler's
+     * own startTask so a force-started task gets the same augmented prompt, session
+     * tracking, and exit handling — callers must not re-spawn the runner themselves.
+     * No-op if the task is unknown, not an AI task, or already running.
+     */
+    forceStartTask(taskId: string, origin?: RunOrigin): Promise<void>;
+    private refuseOpsDuringMerge;
+    /**
+     * A force start passes a merge gate (ADR-0020), and the surface confirmed it
+     * first; the choice is kept on the task and said, because the work it acts
+     * on is not in the user's branch.
+     */
+    private notePastGate;
+    /**
+     * Run exactly one task outside full-plan scheduling. The active/starting
+     * session still contributes to {@link hasLiveWork} so every surface exposes
+     * Stop and disables Execute Plan, but onVerdict cannot auto-schedule other
+     * tasks because the plan scheduler's `running` flag remains false.
+     */
+    runTask(taskId: string): Promise<void>;
+    getCompletedCount(): number;
+    getTotalCount(): number;
+    isAllComplete(): boolean;
+    isAnyFailed(): boolean;
+    approveReview(origin?: RunOrigin): Promise<void>;
+    tick(): Promise<void>;
+    /** How a run that ended on failures ends: what it finished, what failed, and what that blocks. */
+    /** Skipped work is not completed work, so a run with any says so rather than that everything completed. */
+    private sayFinished;
+    private sayEndedOnFailure;
+    /** Whether the scheduler may start `id` now: it passes every readiness gate and a slot is free. */
+    private stillReady;
+    /**
+     * A run paused at merge gates says so, as plainly as a task that waits on
+     * the user: which tasks wait, and that Merge all lets them go on (ADR-0020).
+     */
+    private sayGate;
+    private startTask;
+    /**
+     * The fallible half of starting a task: resolving its cwd/worktree and
+     * spawning the runner. Resolves false when the attempt never committed —
+     * abandoned because it was ended from under it, or a failed spawn already
+     * unwound (both leave `startTask` with nothing further to announce).
+     */
+    private spawnAttempt;
+    /** For a skill the main checkout has, the folder a worktree only gets once it is committed. */
+    private uncommittedSkillFolder;
+    /**
+     * The roots whose `.ordewell/skills/` an attempt at `cwd` reads: in a repo
+     * group, `cwd` holds each repo — a worktree of it when isolated, the
+     * workspace's own checkout when not — and no folder of its own (ADR-0014).
+     */
+    private skillRoots;
+    /**
+     * A continue whose runner never announced the session it was told to
+     * resume. Nothing was continued, and nothing fresh was started in its place.
+     */
+    private unresumed;
+    /**
+     * A spawn whose attempt ended while it was in flight: kill what it produced
+     * and take back the claim it made. Only the claim — whatever ended the
+     * attempt may have decided the task since (mark complete, cancel, retry).
+     */
+    private abandonSpawn;
+    private tell;
+    private say;
+    /**
+     * Replay the start a dirty tree turned away. `stash` puts the user's tracked
+     * changes on the git stash first, so the run isolates; `shared` runs this one
+     * run in the workspace root, knowingly.
+     */
+    continueBlockedRun(how: 'stash' | 'shared'): Promise<void>;
+    /**
+     * The one way an attempt ends. Dropping the record is itself what
+     * invalidates a spawn still in flight ({@link startTask} kills the session
+     * it receives for an attempt that is no longer current).
+     *
+     * A user interruption also bumps the verifier's generation *before* stopping
+     * the runner: a runner may fire onExit synchronously from
+     * stop(), and if that exit reaches VerdictEngine under the still-valid
+     * generation it delivers a verdict that marks the task 'completed' for one
+     * tick — long enough for the scheduler to start a dependent task. Stop and
+     * load reset the whole verifier themselves.
+     */
+    private endAttempt;
+    /** Kept on the task once the attempt ends, so a continue can resume it after a reload (ADR-0018, K1). */
+    private saveNativeSession;
+    private endAllAttempts;
+}
+
+type SerializedTaskStatus = {
+    id: string;
+    status: Task['status'];
+    verdict: {
+        outcome: 'pass' | 'fail';
+        reason: string;
+        checks: Verdict['checks'];
+    } | null;
+    /** Advisory silence timestamp from VerdictEngine — not part of task status semantics. */
+    idleSince?: string | null;
+    /** Absent unless the plan has an isolation run, so a shared-root plan's updates are unchanged. */
+    isolation?: TaskIsolation;
+    /** What an `awaiting_user` task waits on, when it was saved (ADR-0018, W1). */
+    awaitingReason?: AwaitingReason;
+    /** When a task paused on a usage limit resumes on its own (ISO time); absent when it waits for a manual retry. */
+    resumeAt?: string;
+    /** Why a `skipped` task was skipped; absent when no reason was given, and on any other status. */
+    skipReason?: string;
+    /** The whole question of the checkpoint the task waits at; absent when it waits at none. */
+    checkpoint?: string;
+    /** Messages waiting for a structured task's turn to end, oldest first; absent when there are none. */
+    queued?: QueuedTaskMessage[];
+    /** Set when the task can be continued in its saved runner session (ADR-0018, K1); the id itself stays in the daemon. */
+    continuable?: true;
+    /**
+     * How many of a structured task's runner requests wait for an answer
+     * (ADR-0018, A1) — "waiting for approval", which leaves `status` alone.
+     * Absent when none do.
+     */
+    awaitingApproval?: number;
+    /**
+     * The dependencies an ops or user task waits on at its merge gate: their
+     * work has landed but is not merged into the user's branch (ADR-0020).
+     * Absent when it waits for no Merge all.
+     */
+    mergeGate?: string[];
+    /** The dependencies, by title, a force start went past the merge gate of (ADR-0020). */
+    forcedPastGate?: string[];
+    attemptUsage?: AttemptUsage[];
+};
+/**
+ * Landed work not yet in the user's branch. `paused` means the running plan
+ * waits at a merge gate with no attempts active.
+ */
+interface RunMergeView {
+    waitingAtGate: boolean;
+    paused: boolean;
+    repos: IsolationHandoff['repos'];
+    landed: IsolationHandoff['landed'];
+}
+type SerializedTask = {
+    id: string;
+    order: number;
+    title: string;
+    type: string;
+    /** Without it a plan broadcast after a run reads as every task pending. */
+    status: Task['status'];
+    description: string;
+    dependencies: string[];
+    assignedRunner: RunnerId;
+    assignedModel: Task['assignedModel'] | null;
+    taskMode: string;
+    prompt: string | null;
+    subtasks: SerializedTask[];
+    userSteps: Task['userSteps'];
+    autonomy: Task['autonomy'];
+    sliceType: Task['sliceType'];
+    userStoriesCovered: Task['userStoriesCovered'];
+    /** As on {@link SerializedTaskStatus}: only while the task is `awaiting_user`. */
+    awaitingReason?: AwaitingReason;
+    resumeAt?: string;
+    /** As on {@link SerializedTaskStatus}: only while the task is `skipped`. */
+    skipReason?: string;
+    /** Set only on an ops task (ADR-0020). */
+    ops?: true;
+    /** Task skills attached by name; absent when none. */
+    skills?: string[];
+    /** Set only on a task an Act supervisor added (ADR-0029). */
+    addedBy?: 'supervisor';
+    attemptUsage?: AttemptUsage[];
+};
+/** Skill loads go out as notices: their bodies are for the planner, and stay in the session. */
+type SerializedConversationMessage = Omit<ConversationMessage, 'skill'> & {
+    skill?: SkillLoadNotice;
+};
+type SerializedPendingTurn = Omit<PendingPlanTurn, 'skills'> & {
+    skills?: SkillLoadNotice[];
+};
+/**
+ * A task as a surface is sent it: its attempt's skills are notices, whole in
+ * the session only, and its runner session id stays there too — no surface shows it,
+ * and only a continue reads the runner's own session id.
+ */
+type SurfaceTask<T extends Task = Task> = Omit<T, 'attemptSkills' | 'subtasks' | 'runnerSessionId'> & {
+    attemptSkills?: TaskSkillNotice[];
+    subtasks: SurfaceTask[];
+};
+/** A plan as the daemon and the VS Code webview are sent it: the session's own state, minus every skill body. */
+type SurfacePlan = Omit<LegacyPlanState, 'tasks' | 'conversationHistory' | 'pendingTurns' | 'queuedMessages'> & {
+    tasks: SurfaceTask[];
+    conversationHistory?: SerializedConversationMessage[];
+    pendingTurns?: SerializedPendingTurn[];
+};
+/** The phase-tagged shape of {@link SurfacePlan}. */
+type SurfacePlanState = (Omit<Extract<PlanState, {
+    phase: 'planning';
+}>, 'pendingTasks'> & {
+    pendingTasks: SurfaceTask[];
+}) | (Omit<Extract<PlanState, {
+    phase: 'executing';
+}>, 'pendingTasks' | 'executionLog'> & {
+    pendingTasks: SurfaceTask[];
+    executionLog: SurfaceTask<TaskSnapshot>[];
+});
+type SerializedPlan = {
+    runSettings?: LegacyPlanState['runSettings'];
+    tasks: SerializedTask[];
+    runners: RunnerId[];
+    generatedAt: string;
+    conversationHistory?: SerializedConversationMessage[];
+    prdMarkdown?: string;
+};
+/** How a planner turn ended: the reply kind it settled on, a user stop, or a failure. */
+type PlannerTurnOutcome = 'message' | 'plan' | 'task_ops' | 'stopped' | 'error';
+/**
+ * Everything a session tells its surfaces, over one broadcast seam.
+ *
+ * A planner turn (#47) streams between `planner_turn_started` and
+ * `planner_turn_ended` with the same `turnId`; every turn-scoped message in
+ * between carries it. The stream is provisional and the settled messages are
+ * authoritative:
+ * - `planner_message` replaces the streamed text of the turn's final segment —
+ *   a surface drops what it accumulated and shows the message instead.
+ * - A reply that is a JSON envelope (plan, taskOps, taskQuery) never arrives
+ *   as `planner_text_delta`; it streams as `plan_token`, the "building plan"
+ *   display.
+ * - A subagent's own text never appears in the reply; its activity arrives
+ *   tagged with its `subagentId`.
+ */
+type SessionMessage = 
+/**
+ * The plan, whole. `turnId` names the planner turn whose commit this
+ * broadcast carries, so the turn's building plan becomes the marker; it is
+ * absent on every other broadcast of the plan.
+ */
+{
+    type: 'plan_generated';
+    plan: SerializedPlan;
+    goal: string;
+    runners: RunnerId[];
+    turnId?: string;
+}
+/**
+ * The settled reply of a planner turn, emitted by the session once the turn
+ * is classified. Authoritative over any `planner_text_delta` of its turn's
+ * final segment. `turnId` is absent for replies sent outside a streamed turn.
+ * `supervisor`: the supervisor said it in a wake-up turn (ADR-0029).
+ */
+ | {
+    type: 'planner_message';
+    content: string;
+    timestamp: string;
+    turnId?: string;
+    supervisor?: true;
+}
+/**
+ * A planner turn began. Emitted once per turn by whoever runs the turn,
+ * before any other message carrying its `turnId`. `prompt` is the user's
+ * message, as typed, when the turn answers one; `skills` are what its
+ * `/name` tokens loaded, absent when none did. `wakeUps` are the wake-up
+ * digests the turn delivers, shown ahead of the prompt; `supervisor` marks a
+ * wake-up turn, which no user message opened (ADR-0029). `forced`: the
+ * prompt was force sent, and this turn replaces the one it stopped.
+ */
+ | {
+    type: 'planner_turn_started';
+    turnId: string;
+    prompt?: string;
+    skills?: SkillLoadNotice[];
+    wakeUps?: string[];
+    supervisor?: true;
+    forced?: true;
+} | {
+    type: 'planner_skill_loaded';
+    turnId: string;
+    skill: SkillLoadNotice;
+}
+/**
+ * A planner turn is over; nothing more carries its `turnId`. Emitted exactly
+ * once per `planner_turn_started`, stop and failure included, after the
+ * turn's `planner_message` when it has one. `forceSent`: a force send
+ * stopped it, and the forced turn follows — the user did not stop the
+ * conversation, so a surface keeps the prompts it holds (ADR-0023, F2).
+ */
+ | {
+    type: 'planner_turn_ended';
+    turnId: string;
+    outcome: PlannerTurnOutcome;
+    forceSent?: true;
+}
+/**
+ * Reply prose as it streams, appended in order within its segment. A segment
+ * is one continuous run of model text; text before a tool call is its own
+ * segment, and a later segment never rewrites an earlier one. Never carries
+ * a JSON envelope or a subagent's text (see the union's invariants).
+ */
+ | {
+    type: 'planner_text_delta';
+    turnId: string;
+    segmentId: string;
+    text: string;
+}
+/**
+ * Exposed reasoning as it streams, from the planner or — tagged with
+ * `subagentId` — from one of its subagents. Never part of the reply. The one
+ * thinking message for every backend: `segmentId` is set only where the
+ * backend streams thinking in segments (the API loops; harness planners do
+ * not), and `turnId` is absent for thinking outside a turn (one-shot plans).
+ */
+ | {
+    type: 'planner_thinking_delta';
+    turnId?: string;
+    segmentId?: string;
+    subagentId?: string;
+    text: string;
+}
+/**
+ * Text streamed for an attempt the turn discarded (a corrective retry) is
+ * taken back: a surface removes it. With `segmentId`, only that segment;
+ * without, all of the turn's text not yet settled by a `planner_message`.
+ * A segment that streamed to the plan display (`plan_token`) takes the
+ * turn's building plan with it.
+ */
+ | {
+    type: 'planner_text_retracted';
+    turnId: string;
+    segmentId?: string;
+}
+/**
+ * The planner's running usage for the session, subagents included, emitted
+ * after a model call reports usage. `totals` already contains every
+ * `bySubagent` entry. `contextFill` is the last planner prompt against the
+ * model's window, omitted when the window is unknown. Cost appears only as
+ * reported by a provider or runner (see `UsageRecord`).
+ */
+ | {
+    type: 'planner_usage';
+    byModel?: ModelUsage[];
+    model?: string;
+    turnId?: string;
+    totals: UsageTotals;
+    bySubagent?: Record<string, UsageTotals>;
+    contextFill?: {
+        usedTokens: number;
+        windowTokens: number;
+    };
+}
+/**
+ * A subagent began work on `brief`. Emitted by the planner backend that
+ * spawned it (ADR-0005 research agents, or a harness planner's own), before
+ * any message tagged with its `subagentId`.
+ */
+ | {
+    type: 'subagent_started';
+    turnId?: string;
+    subagentId: string;
+    brief: string;
+    model?: string;
+}
+/**
+ * A subagent is done; nothing more is tagged with its `subagentId`. Emitted
+ * once per `subagent_started`. `digest` is what it handed back to the
+ * planner; `usage` is its own share, already counted in `planner_usage`.
+ */
+ | {
+    type: 'subagent_finished';
+    turnId?: string;
+    subagentId: string;
+    outcome: SubagentOutcome;
+    digest: string;
+    usage?: UsageTotals;
+} | {
+    type: 'status_update';
+    tasks: SerializedTaskStatus[];
+    runMerge?: RunMergeView;
+    usage?: PlanUsage;
+} | {
+    type: 'review_needed';
+    tasks: SerializedTask[];
+} | {
+    type: 'review_approved';
+} | {
+    type: 'checkpoint';
+    taskId: string;
+    taskTitle: string;
+    summary: string;
+} | {
+    type: 'execution_complete';
+    summary: ExecutionSummary;
+} | {
+    type: 'execution_stopped';
+} | {
+    type: 'execution_action';
+    record: ExecutionRecord;
+    text: string;
+} | {
+    type: 'task_updated';
+    taskId: string;
+    changes: Record<string, unknown>;
+} | {
+    type: 'task_started';
+    taskId: string;
+    order: number;
+    title: string;
+    runner: RunnerId;
+    modelId?: string;
+} | {
+    type: 'task_output';
+    taskId: string;
+    text: string;
+}
+/**
+ * A structured task's log as it happens (ADR-0018, P1): the next events of
+ * the task's attempt `attempt`, in order — the same ones appended to that
+ * attempt's file, so a surface folding these and one replaying the file
+ * draw the same blocks.
+ */
+ | {
+    type: 'task_log';
+    taskId: string;
+    attempt: number;
+    events: TaskLogEvent[];
+} | {
+    type: 'isolation_blocked';
+    reason: 'dirty';
+    repos?: string[];
+    message: string;
+} | {
+    type: 'isolation_handoff';
+    repos: IsolationHandoff['repos'];
+    landed: IsolationHandoff['landed'];
+    deferredTo?: IsolationHandoff['deferredTo'];
+} | {
+    type: 'isolation_merge';
+    result: IsolationMergeResult;
+    trigger?: AutoMergeTrigger;
+} | {
+    type: 'planner_liveness';
+} | {
+    type: 'research_step';
+    tool: string;
+    toolLabel?: string;
+    args: string;
+    subagentId?: string;
+    toolCallId?: string;
+    turnId?: string;
+} | {
+    type: 'plan_token';
+    token: string;
+    turnId?: string;
+    segmentId?: string;
+} | {
+    type: 'research_step_done';
+    step: ResearchStep;
+    subagentId?: string;
+    turnId?: string;
+} | {
+    type: 'approval_request';
+    id: string;
+    kind: ApprovalKind;
+    subject: string;
+    scope: string;
+    detail?: string;
+    turnId?: string;
+} | {
+    type: 'approval_settled';
+    id: string;
+    granted: boolean;
+} | {
+    type: 'approval_decided';
+    kind: ApprovalKind;
+    subject: string;
+    scope: string;
+    detail?: string;
+    granted: boolean;
+    source: Exclude<ApprovalSource, 'asked'>;
+};
+/**
+ * A plan a surface read whole rather than off the message stream: a route's
+ * answer, a loaded session. Folds into a {@link RunView} as a plan refresh.
+ */
+type PlanSnapshot = {
+    type: 'plan_snapshot';
+    plan: SurfacePlan | SurfacePlanState;
+};
+/** What only the status stream says about a task; a plan refresh keeps these as they were. */
+type RunTaskStatus = Partial<Pick<SerializedTaskStatus, 'verdict' | 'idleSince' | 'isolation' | 'checkpoint' | 'queued' | 'continuable' | 'awaitingApproval' | 'mergeGate' | 'forcedPastGate'>>;
+/** A task in the run view: the plan's fields, then the status stream's. */
+type RunTask = Omit<SerializedTask, 'subtasks'> & RunTaskStatus & {
+    subtasks: RunTask[];
+};
+/**
+ * A session's run as every surface draws it (the [run view](../../../../CONTEXT.md)):
+ * folded from {@link SessionMessage}s and plan snapshots by `reduceRun`, or
+ * taken whole from `Session.runSnapshot()` by a surface that joins late.
+ */
+interface RunView {
+    /** In plan order, subtasks nested under their parent. */
+    tasks: RunTask[];
+    runSettings?: RunSettings;
+    runMerge: RunMergeView | null;
+    usage?: PlanUsage;
+    handoff: IsolationHandoff | null;
+    mergeResult: IsolationMergeResult | null;
+}
+type RunInput = SessionMessage | PlanSnapshot;
+/**
+ * A line a run wants the user to read — how it isolates, what it shares. Not a
+ * {@link SessionMessage}: hosts that show notices as toasts already do, and
+ * widening the union would break every exhaustive switch over it. A host with
+ * no toast channel (the daemon) hands these to its clients by its own means.
+ */
+type SessionNotice = {
+    type: 'notice';
+    level: 'info' | 'warn' | 'error';
+    message: string;
+};
+type SessionBroadcaster = (msg: SessionMessage) => void;
+declare function serializeTask(t: SurfaceTask): SerializedTask;
+declare function serializeTaskStatus(t: Task, idleSince?: string | null, isolation?: TaskIsolation | null, queued?: readonly QueuedTaskMessage[], awaitingApproval?: number, mergeGate?: readonly string[], checkpoint?: string): SerializedTaskStatus;
+/** The one place a plan's skill bodies come off before it leaves the session: every wire path that carries plan state goes through here. */
+declare function surfacePlan({ queuedMessages: _carriedOverAtLoad, ...plan }: LegacyPlanState): SurfacePlan;
+declare function surfacePlanState(state: PlanState): SurfacePlanState;
+declare function serializePlan(plan: LegacyPlanState): SerializedPlan;
+/**
+ * What a finished run did, task by task: `blocked` are those a failure kept
+ * from starting (ADR-0034); `skipped` ended without a verdict and landed
+ * nothing, so they are neither completed nor failed.
+ */
+interface ExecutionSummary {
+    total: number;
+    completed: number;
+    failed: number;
+    blocked: number;
+    skipped: number;
+}
+declare function executionSummary(tasks: readonly Task[]): ExecutionSummary;
+declare const CHECKPOINT_TRUNCATE_LENGTH = 120;
+/** Truncate a checkpoint summary to a single line of at most CHECKPOINT_TRUNCATE_LENGTH chars. */
+declare function truncateCheckpointSummary(summary: string): string;
+
+/**
+ * Task references: the one grammar for naming a task in a plan, both ways.
+ * A label is rendered from a task's order under its parent ("2", "2.1"), and
+ * a reference written by anyone — the planner, a tool call, a command — is
+ * resolved back against the plan tree. Pure and import-free so a
+ * browser-bundled surface can use it through `@ordewell/core/plan-utils`.
+ */
+/** The shape a reference resolves over: the plan's task tree, or a surface's projection of it. */
+interface RefTask<T> {
+    id: string;
+    order: number;
+    title: string;
+    subtasks?: readonly T[];
+}
+/**
+ * The parent a label extends. A label is the full path ("3.2.1"), so a parent
+ * below the top level carries the label it was itself reached by; without one
+ * the parent's order stands for it, which is right for a top-level parent.
+ */
+interface RefParent {
+    order: number;
+    label?: string;
+}
+/** Dotted path label for a task, e.g. "2.1" for the first subtask of task 2, "2.1.3" one level down. */
+declare function taskOrderLabel(task: {
+    order: number;
+}, parent?: RefParent): string;
+/** How a surface refers to a task in prose: "#2", or "#2.1" for a subtask. */
+declare function taskRef(task: {
+    order: number;
+}, parent?: RefParent): string;
+/** A task named in full, as a confirmation or a picker title does: "#2 Deploy". */
+declare function titledTaskRef(task: {
+    order: number;
+    title: string;
+}, parent?: RefParent): string;
+/**
+ * The reference {@link taskRef} renders for the task a plan tree holds, by id
+ * — its full path, dotted, for a subtask. Undefined when the tree holds no such task.
+ */
+declare function taskRefOf<T extends RefTask<T>>(tasks: readonly T[], id: string): string | undefined;
+/**
+ * The reference and title {@link titledTaskRef} renders for the task a plan
+ * tree holds, by id — its full path, dotted, for a subtask. Undefined when the
+ * tree holds no such task.
+ */
+declare function titledTaskRefOf<T extends RefTask<T>>(tasks: readonly T[], id: string): string | undefined;
+/**
+ * Resolve a written reference to a task at any depth: an id, then an order
+ * label with or without "#" ("#2", "2", "#2.1"), then an exact title.
+ *
+ * An order label is read against the tree, never a flattened list: subtask
+ * orders restart at 1 under each parent, so "#2" always means top-level task 2
+ * and a subtask is reachable only by its dotted path ("#2.1", "#2.1.3").
+ */
+declare function resolveTaskRef<T extends RefTask<T>>(tasks: readonly T[], ref: string | number): T | undefined;
+
+/**
+ * Pure, no-imports helper so a browser surface can format a conflict's files
+ * without pulling `isolationRecord` — and its `path` import — into a webview
+ * bundle. Kept out of `isolationRecord.ts` for exactly that reason.
+ */
+declare function capConflictFiles(files: string[], max?: number): string;
+
+/** How a run is started, watched and merged: the user's, not a plan's (ADR-0030). */
+interface GlobalRunSettings {
+    supervisorLevel: SupervisorLevel;
+    mergeAtGatesAutomatically: boolean;
+    /** Start a plan when the planner submits it, approved as if the user had pressed Execute. */
+    autorun: boolean;
+    /** Retries an Act supervisor may make of one task in a run (a loop guard). */
+    supervisorRetryLimit: number;
+    /** Reads a wake-up turn may make, in place of a user message's caps. */
+    wakeUpReadBudget: number;
+}
+declare const RUN_SETTINGS_DEFAULTS: Readonly<GlobalRunSettings>;
+declare class RunSettingsError extends Error {
+    constructor(message: string);
+}
+interface UserSettings {
+    modelAllowlist?: Record<string, string[]>;
+    /** Last model (and its thinking effort) the user chose for each planner backend, keyed by AiProvider id. */
+    plannerModels?: Record<string, {
+        model: string;
+        effort?: string;
+    }>;
+    /**
+     * Runners the user picked for planning. Absent — not empty — is what falls
+     * back to the environment's defaults; `[]` is a deliberate "none of them".
+     */
+    enabledRunners?: string[];
+    /** Full (true) or Guarded (false), ADR-0001; Full until the user chooses. */
+    autonomousMode?: boolean;
+    supervisorLevel?: SupervisorLevel;
+    mergeAtGatesAutomatically?: boolean;
+    autorun?: boolean;
+    supervisorRetryLimit?: number;
+    wakeUpReadBudget?: number;
+}
+/**
+ * The model allowlist, remembered planner models and enabled runners are shared
+ * across processes by default. `ORDEWELL_SETTINGS_PATH` lets independent runs
+ * use separate files: otherwise a write in one run would change another's
+ * settings when `getAll()` detects the new mtime.
+ */
+declare function getSettingsPath(): string;
+/** The run settings `settings` holds, each one it leaves out at its default. */
+declare function runSettingsOf(settings: UserSettings): GlobalRunSettings;
+declare class SettingsService {
+    private filePath;
+    private cache;
+    private cachedMtimeMs;
+    constructor(filePath?: string);
+    getAll(): UserSettings;
+    private fileMtimeMs;
+    getModelAllowlist(runner: string): string[] | undefined;
+    setModelAllowlist(runner: string, ids: string[] | undefined): void;
+    getPlannerModel(provider: string): {
+        model: string;
+        effort?: string;
+    } | undefined;
+    setPlannerModel(provider: string, entry: {
+        model: string;
+        effort?: string;
+    } | undefined): void;
+    getEnabledRunners(): string[] | undefined;
+    setEnabledRunners(ids: string[]): void;
+    /**
+     * Full or Guarded (ADR-0001), as saved here (ADR-0030). A value set in the
+     * environment wins, so a script or CI run can fix its own without touching
+     * the user's file.
+     */
+    autonomousMode(): boolean;
+    /** Whether `ORDEWELL_AUTONOMOUS_MODE` decides the level, whatever this file says. */
+    autonomousModeOverridden(): boolean;
+    setAutonomousMode(enabled: boolean): void;
+    getRunSettings(): GlobalRunSettings;
+    /** Checks every value before writing any, so a refused change saves nothing. */
+    updateRunSettings(changes: Partial<GlobalRunSettings>): GlobalRunSettings;
+    private load;
+    private persist;
+}
+
+declare const EMPTY_RUN: RunView;
+declare function reduceRun(view: RunView, input: RunInput): RunView;
+
+/** What the blocked rule reads of a task; structural, so a surface's own task shape answers it too. */
+interface BlockingSubject {
+    id: string;
+    status: string;
+    dependencies: readonly string[];
+    subtasks?: readonly BlockingSubject[];
+}
+/**
+ * The blocked rule (ADR-0034): a task not started yet is blocked while a
+ * dependency failed or is itself blocked. One already at work — force-started,
+ * or waiting on the user — is not, and does not pass a block on. Each
+ * blocked task maps to the failed tasks it waits on, in dependency order and
+ * named once; an unblocked task is absent. Nothing is stored, so a retry that
+ * passes is all it takes to lift a block.
+ *
+ * Takes the plan tree or a flat list; a subtask follows the same rule.
+ */
+declare function blockingFailures(tasks: readonly BlockingSubject[]): Map<string, string[]>;
+
+/**
+ * @param toolLabel The agent's own name for the tool, when a harness planner
+ * produced the call (ADR-0009). It replaces the member name in the summary, so
+ * the timeline says `Edit` rather than the catch-all `agent_tool` — and says
+ * `WebFetch` rather than claiming a shell command ran.
+ */
+declare function summarizeToolCall(tool: string, argsJson: string, toolLabel?: string): string;
+/**
+ * Classify a tool outcome from its result text and success flag, so a surface
+ * can render a refused `rm` or a denied `npm test` distinctly from a
+ * successful run without re-deriving the refusal signatures per surface. The
+ * refusal/denial strings come from `commandPolicy.ts`, `BaseFileSystem.ts`,
+ * `webReadPolicy.ts` and the research-subagent wrapper — keeping the matching
+ * here means the signatures stay in one place alongside the human summary.
+ */
+declare function classifyOutcome(success: boolean, output: string): ResearchStepOutcome;
+
+/**
+ * What a surface draws for one planner conversation (#51): an ordered list of
+ * display blocks, built once in core from the `SessionMessage` stream and drawn
+ * per surface. Every block carries an `id` that stays the same for as long as
+ * the block exists, so a surface can key its own UI state on it — whether a
+ * block is expanded is that UI state, and deliberately not part of a block.
+ */
+type DisplayBlock = MessageBlock | ThinkingDisplayBlock | ToolBlock | SubagentBlock | ApprovalBlock | PlanBlock | SkillLoadBlock | UsageBlock | CommandBlock | CompactionBlock | RunnerLoadedBlock;
+/**
+ * `agent` is a task runner speaking in a structured task's log (ADR-0018); the
+ * planner is `planner`. In a wake-up turn (ADR-0029) the planner speaks as
+ * `supervisor`, and `wake_up` is the run update that woke it.
+ */
+type MessageRole = 'user' | 'planner' | 'agent' | 'supervisor' | 'wake_up' | 'system' | 'error';
+interface MessageBlock {
+    type: 'message';
+    id: string;
+    role: MessageRole;
+    text: string;
+    /** Deltas are still arriving. */
+    streaming: boolean;
+    turnId?: string;
+    /**
+     * Present while the text is the streamed segment of a reply rather than a
+     * settled message: provisional, replaced by the turn's `planner_message` when
+     * it is the final segment, and never saved to the transcript.
+     */
+    segmentId?: string;
+    /** A user's message: the skills its `/name` tokens loaded, for a surface to mark those tokens (see `loadedSkillTokens`). */
+    skills?: readonly string[];
+    /** A user's message that was force sent ("Send now"), stopping the turn before it (ADR-0023). */
+    forced?: true;
+}
+interface ThinkingDisplayBlock {
+    type: 'thinking';
+    id: string;
+    text: string;
+    streaming: boolean;
+    turnId?: string;
+    segmentId?: string;
+    /** Set when a subagent thought it; the block then sits among that subagent's children. */
+    subagentId?: string;
+}
+/** The two halves of a Claude Code-style command row: `Name(keyArg)`. */
+interface ToolHeadline {
+    name: string;
+    keyArg: string;
+}
+type ToolStatus = 'pending' | 'ok' | 'error' | 'denied' | 'interrupted';
+/** What a file edit changed, counted from its diff. */
+interface DiffStat {
+    added: number;
+    removed: number;
+}
+interface ToolBlock {
+    type: 'tool';
+    id: string;
+    toolCallId?: string;
+    tool: string;
+    toolLabel?: string;
+    headline: ToolHeadline;
+    /** The arguments exactly as announced (JSON), for the expanded view. */
+    args: string;
+    status: ToolStatus;
+    /** How the call ended, finer than `status`: a refused command and a denied path both read `denied`. */
+    outcome?: ResearchStepOutcome;
+    output: string;
+    /** Every line of `output`, counted as {@link outputPreview} counts them. */
+    outputLineCount: number;
+    /** Present when the call edited a file and `output` is its diff: a surface draws it as one. */
+    diff?: DiffStat;
+    turnId?: string;
+    /**
+     * The subagent this call starts. The call becomes that subagent's block once
+     * the subagent announces itself, so the two never show as separate rows.
+     */
+    spawns?: string;
+}
+type SubagentStatus = 'running' | SubagentOutcome;
+type SubagentChild = ToolBlock | ThinkingDisplayBlock | MessageBlock;
+interface SubagentBlock {
+    type: 'subagent';
+    id: string;
+    subagentId: string;
+    /** The planner's call that started it, when one was announced. */
+    toolCallId?: string;
+    brief: string;
+    model?: string;
+    status: SubagentStatus;
+    children: readonly SubagentChild[];
+    /** What it handed back to the planner. */
+    digest: string;
+    /** Its own share, already counted in the usage line. */
+    usage?: UsageTotals;
+    turnId?: string;
+}
+/** `withdrawn`: a runner's request that went unanswered — the runner cancelled it, or its process ended. */
+type ApprovalStatus = 'pending' | 'granted' | 'denied' | 'withdrawn';
+interface ApprovalBlock {
+    type: 'approval';
+    id: string;
+    /** The request's id, which a surface answers through. Absent for a decision nobody was asked about. */
+    approvalId?: string;
+    kind: ApprovalKind;
+    subject: string;
+    scope: string;
+    detail?: string;
+    status: ApprovalStatus;
+    /** Absent while pending. */
+    decidedBy?: ApprovalSource;
+    turnId?: string;
+    /** A runner's request (`runner_tool`) that can also be allowed for the rest of its task. */
+    allowForTask?: boolean;
+    /** Granted for the rest of the task, not this call alone. */
+    forTask?: boolean;
+    /** What a denial told the agent. */
+    note?: string;
+    /** The runner's tool call the request is about. */
+    toolCallId?: string;
+}
+type PlanMarkerStatus = 'building' | 'generated' | 'updated';
+interface PlanBlock {
+    type: 'plan';
+    id: string;
+    status: PlanMarkerStatus;
+    /** The plan envelope streamed so far — `parsePartialPlan` reads rows from it. Empty once settled. */
+    text: string;
+    taskCount?: number;
+    turnId?: string;
+    /** While building: the segment whose envelope is streaming, which a retraction of that segment takes back. */
+    segmentId?: string;
+}
+/** A skill loaded into the conversation: one line naming it and the SKILL.md that won. Its body is never shown. */
+interface SkillLoadBlock extends SkillLoadNotice {
+    type: 'skill_load';
+    id: string;
+    turnId?: string;
+}
+/** How the turn a runner command opened ended, or `running` while it runs. */
+type CommandStatus = 'running' | 'done' | 'failed' | 'stopped';
+/** A runner's own command a user ran in a task (#66): `/name args`, and what it printed. */
+interface CommandBlock {
+    type: 'command';
+    id: string;
+    name: string;
+    args?: string;
+    status: CommandStatus;
+    /** What a command that runs without the model printed; its other outcomes are the turn's own blocks. */
+    output: string;
+}
+/** The runner compacted its own context: asked to (`/compact`) or on its own. */
+interface CompactionBlock {
+    type: 'compaction';
+    id: string;
+    trigger: 'manual' | 'auto';
+    preTokens?: number;
+    postTokens?: number;
+}
+/**
+ * What a task's runner loaded from the user's and the project's own setup, as
+ * its process started: its commands and skills, and its MCP servers. Drawn
+ * collapsed unless the surface shows detail.
+ */
+interface RunnerLoadedBlock {
+    type: 'runner_loaded';
+    id: string;
+    commands: readonly RunnerCommand[];
+    mcpServers: readonly RunnerMcpServer[];
+}
+/** The token line. There is at most one, and it is always the last block. */
+interface UsageBlock {
+    byModel?: ModelUsage[];
+    model?: string;
+    type: 'usage';
+    id: string;
+    totals: UsageTotals;
+    contextFill?: {
+        usedTokens: number;
+        windowTokens: number;
+    };
+    bySubagent?: Record<string, UsageTotals>;
+}
+
+/** What every view over display blocks holds; each view adds its own state beside it. */
+interface BlockList {
+    readonly blocks: readonly DisplayBlock[];
+    readonly nextId: number;
+}
+
+/**
+ * A line a surface adds to the conversation itself rather than receiving from
+ * the session: the user's prompt as it is sent, a notice, an error.
+ */
+interface LocalEntry {
+    type: 'local_entry';
+    role: 'user' | 'system' | 'error';
+    text: string;
+}
+type ConversationInput = SessionMessage | LocalEntry;
+interface ConversationView extends BlockList {
+    /**
+     * The newest transcript entry the view accounts for. Plan markers and system
+     * notes reach a surface only inside the transcript a `plan_generated`
+     * carries, so entries after this one are what is new in it.
+     */
+    readonly transcriptAt?: string;
+    /** Reloaded arrivals, keyed by pending turn id until the live turn or transcript accounts for them. */
+    readonly pendingInputs?: readonly {
+        input: SerializedPendingTurn;
+        blockIds: readonly string[];
+    }[];
+}
+declare const EMPTY_CONVERSATION: ConversationView;
+/**
+ * Fold one input into the view. Pure and incremental: blocks the input does
+ * not touch keep their identity, and an input that changes nothing returns
+ * `view` itself — surfaces memoize their drawing on that, and text deltas
+ * arrive quickly.
+ */
+declare function reduceConversation(view: ConversationView, input: ConversationInput): ConversationView;
+
+/**
+ * The view a saved session reopens with: what its transcript and research log
+ * kept, in the order it happened — messages, notices and the compaction
+ * summary, plan markers, tool calls with each subagent's calls nested under
+ * it, and the token line. Reasoning and streamed text were never saved, so a
+ * reload has none.
+ *
+ * The research log interleaves with the transcript by time. Entries older than
+ * a compaction's first kept message went with the turns it condensed.
+ * Pending inputs follow the landed records in arrival order; they are not
+ * transcript entries until their turn lands.
+ */
+declare function fromTranscript(conversationHistory: readonly SerializedConversationMessage[] | undefined, researchLog: readonly ResearchLogEntry[] | undefined, plannerUsage?: PlannerUsage, pendingTurns?: readonly SerializedPendingTurn[]): ConversationView;
+
+/**
+ * What a surface draws for one attempt of a structured task (ADR-0018, O1b):
+ * the same display blocks as the planner conversation, built from the task's
+ * {@link TaskLogEvent}s. No planner turn ids — a task's turns are its own,
+ * one at a time.
+ */
+interface TaskLogView extends BlockList {
+    /** Messages not yet delivered, oldest first; `handedOver` marks the ones the runner already has. */
+    readonly queued: readonly QueuedTaskMessage[];
+    /** A turn is running. */
+    readonly working: boolean;
+    /** How the last turn ended; absent before the first one does. */
+    readonly lastTurnEnd?: StructuredTurnEnd;
+    /** What the runner reported over the attempt, subagents included. */
+    readonly usage?: PlannerUsage;
+    /**
+     * The block each run of deltas streams into, keyed by stream, so the run's
+     * authoritative copy replaces it instead of repeating it below.
+     */
+    readonly streams: Readonly<Record<string, string>>;
+    /** The turn's latest agent text block, which a failure that repeats it takes the place of. */
+    readonly latestText?: string;
+}
+declare const EMPTY_TASK_LOG: TaskLogView;
+/** A runner's tool request, read the way its call's row reads: `Bash(npm test)`. */
+declare function runnerToolSubject(tool: string, args: string): string;
+/**
+ * Fold one task-log event into the view. Pure and incremental, like
+ * `reduceConversation`: an event that changes nothing returns `view` itself,
+ * and an event of a type this build does not know is skipped — a log written
+ * by a newer Ordewell still reads.
+ */
+declare function reduceTaskLog(view: TaskLogView, event: TaskLogEvent): TaskLogView;
+/** A whole attempt's events, folded from the start — what a reload shows. */
+declare function replayTaskLog(events: readonly TaskLogEvent[], from?: TaskLogView): TaskLogView;
+
+/**
+ * The one-line head of a command row, shared by every surface: the tool's name
+ * and the argument that says what the call is about.
+ *
+ * @param args The call's arguments as announced (JSON). Anything that is not a
+ * JSON object is shown as it came, on one line.
+ * @param toolLabel A harness planner's own name for the tool (ADR-0009).
+ */
+declare function toolHeadline(tool: string, args: string, toolLabel?: string): ToolHeadline;
+interface OutputPreview {
+    lines: string[];
+    hiddenLineCount: number;
+}
+/** The lines of a tool's output as a reader sees them — what {@link outputPreview} shows and counts. */
+declare function outputLines(output: string): string[];
+/** The head of a tool's output for a collapsed row, and how many lines it leaves out. */
+declare function outputPreview(output: string, maxLines: number): OutputPreview;
+/**
+ * The lines a diff adds and removes, or null when `output` is not one: every
+ * line a hunk header, context, an addition or a removal, and at least one of
+ * the last two.
+ */
+declare function diffStat(output: string): DiffStat | null;
+/** `gap` stands between two hunks, for the lines a diff leaves out. */
+type DiffRowKind = 'added' | 'removed' | 'context' | 'gap';
+interface DiffRow {
+    kind: DiffRowKind;
+    /** The line in the file: the old file's for a removal, the new file's otherwise. */
+    line?: number;
+    text: string;
+}
+/** A diff as the rows a surface draws, numbered as an editor would number them. */
+declare function diffRows(output: string): DiffRow[];
+/** "Added 2 lines, removed 1 line": the summary every surface puts on an edit's row. */
+declare function diffSummary({ added, removed }: DiffStat): string;
+
+/**
+ * Prompts the user sent while a planner turn was in flight, waiting to be the
+ * next turn's input. The hold is a plain immutable list, oldest first, so a
+ * pure reducer can keep it in state and a host can keep it in a field — and
+ * either can draw it as is.
+ */
+type PromptHold = readonly string[];
+declare const EMPTY_HOLD: PromptHold;
+/** One prompt taken out of the hold, and what is left behind. */
+interface TakenPrompt {
+    text: string;
+    rest: PromptHold;
+}
+declare function holdPrompt(hold: PromptHold, text: string): PromptHold;
+/** The prompt a settled turn sends next: the oldest, so they go in the order typed. */
+declare function drainNext(hold: PromptHold): TakenPrompt | undefined;
+/**
+ * Takes back the newest prompt — the one the user most likely just regretted —
+ * while the older ones stay queued behind the turn.
+ */
+declare function unsendLatest(hold: PromptHold): TakenPrompt | undefined;
+/**
+ * Takes one prompt out by position — a "Send now" on that held row — leaving
+ * every other prompt in the order it was typed.
+ */
+declare function takeAt(hold: PromptHold, index: number): TakenPrompt | undefined;
+/**
+ * A stopped turn takes its queue with it: the prompts were written against a
+ * turn that no longer exists, so they come back as one draft to edit and
+ * resend rather than firing off after the stop.
+ */
+declare function unsendAll(hold: PromptHold): TakenPrompt | undefined;
+/** Where an unsent prompt lands in the drafting input: above what is being typed, never replacing it. */
+declare function aheadOfDraft(text: string, draft: string): string;
+
+/**
+ * The planner turn a surface has open, and the one its user stopped. Kept
+ * beside the view rather than in it: the view is what a turn drew, this is
+ * whether the surface still wants to hear from it.
+ */
+interface TurnGate {
+    readonly open: string | null;
+    readonly stopped: string | null;
+}
+declare const NO_TURN: TurnGate;
+interface GatedConversation {
+    view: ConversationView;
+    gate: TurnGate;
+}
+/**
+ * One input into the view, the stop rule applied: a turn the user stopped is
+ * over on screen, and whatever it streams until the backend notices is
+ * dropped. An input that changes nothing hands back the same view and gate.
+ */
+declare function followTurn(view: ConversationView, gate: TurnGate, input: ConversationInput): GatedConversation;
+/**
+ * The user stopped the planner. The turn ends on screen now rather than when
+ * the backend notices the abort, so the surface is free at once and the
+ * turn's late output never lands. Nothing changes when no turn is open.
+ */
+declare function stopTurn(view: ConversationView, gate: TurnGate): GatedConversation;
+
+/**
+ * Whether the conversation holds anything the collapsed view hides — thinking,
+ * a command row's arguments and output, a subagent's children and digest,
+ * what a task's runner loaded. The
+ * detail toggle is the only expansion control (ADR-0017, X1), so a surface
+ * offers it only when it would do something.
+ */
+declare function hasHiddenDetail(blocks: readonly DisplayBlock[]): boolean;
+
+/** The conversation line for a task starting, worded the same on every surface. */
+declare function taskStartedNotice(title: string, runner?: string): string;
+
+/** Where a skill name is invoked: `start` is its `/`, `end` is just past the name, before any punctuation. */
+interface SkillToken {
+    name: string;
+    start: number;
+    end: number;
+}
+/**
+ * The first `/name` token for each name in `text`, names lower-cased. Only
+ * the first counts because a skill loads once per message however often it is
+ * named, so a later repeat is plain text.
+ */
+declare function skillTokens(text: string): SkillToken[];
+/** The tokens in a sent message that loaded one of `loaded` — what a surface highlights in the user's bubble. */
+declare function loadedSkillTokens(text: string, loaded: readonly string[]): SkillToken[];
+
+/**
+ * What a row's status means to a reader, before any surface picks a word,
+ * icon or colour for it. `quiet` is a running task whose runner has printed
+ * nothing for a while — the status is still `in_progress`, so only the row,
+ * never the store, tells the two apart.
+ */
+type TaskStatusKind = 'todo' | 'running' | 'quiet' | 'awaiting' | 'blocked' | 'failed' | 'skipped' | 'done';
+/** A task with a runner live behind it. `in_progress` is the store's own status. */
+declare const isTaskRunning: (task: {
+    status: string;
+}) => boolean;
+/** Statuses of a task that has not started: what can still be started by hand, or flipped between change and ops (ADR-0020). */
+declare const NOT_STARTED: ReadonlySet<string>;
+declare function taskStatusKind(task: {
+    status: string;
+    idleSince?: string | null;
+}): TaskStatusKind;
+/** What an awaiting_user task waits on (ADR-0018, W1); null when no reason was saved. */
+declare function awaitingLabel(task: {
+    status: string;
+    awaitingReason?: AwaitingReason;
+}): string | null;
+/** "Blocked by #1, #2.1": the failed tasks a blocked task waits on, by reference (ADR-0034). */
+declare function blockedByLabel(refs: readonly string[]): string;
+/** "Skipped: no GPU on this host", or "Skipped" when no reason was given. */
+declare function skippedLabel(reason: string | null): string;
+/** Runner requests a task waits on (ADR-0018, A1); null when none do. */
+declare function approvalLabel(count: number | undefined): string | null;
+/**
+ * When a paused task resumes, as a reader's clock shows it: "8:10pm", or
+ * "Oct 14, 8:10pm" when it is not today. Read in the local time zone of
+ * whoever formats it.
+ */
+declare function resumeTime(at: Date, now?: Date): string;
+/** "Resumes at 8:10pm" for a task paused on a usage limit that resumes on its own; null for any other. */
+declare function resumeLabel(task: {
+    status: string;
+    awaitingReason?: AwaitingReason;
+    resumeAt?: string | null;
+}, now?: Date): string | null;
+
+/**
+ * What a user can do to one task from its row. For a task paused on a usage
+ * limit, `resume-now` resumes it in its saved session once the user says the
+ * limit has reset, and `cancel-resume` keeps it from resuming on its own.
+ */
+type TaskRowAction = 'cancel' | 'resume-now' | 'cancel-resume' | 'skip' | 'force-start' | 'complete' | 'uncomplete';
+/** A subtask runs with its parent, so its row offers a different set than a top-level task's. */
+type TaskRowPlacement = 'task' | 'subtask';
+interface ActionSubject {
+    status: string;
+    type: 'ai' | 'user';
+    awaitingReason?: string;
+    resumeAt?: string | null;
+    /** Its last attempt left a runner session to continue (ADR-0018, K1). */
+    continuable?: boolean;
+}
+/** The actions a task's row offers while a plan runs, in the order they are laid out. */
+declare function taskRowActions(task: ActionSubject, placement?: TaskRowPlacement): TaskRowAction[];
+/**
+ * One toggle in both directions: a done task is taken back, anything else is
+ * marked done. A second control for the reverse is one nobody remembers.
+ */
+declare function markAction(task: {
+    status: string;
+}): 'complete' | 'uncomplete';
+/**
+ * The mark an action asks the session for, or null when it is not a mark.
+ * Skip is not one: it ends the task without vouching for its work, which
+ * only Mark complete does.
+ */
+declare function markRequestFor(action: string): 'complete' | 'uncomplete' | null;
+/** Change versus ops can still be flipped (ADR-0020): an AI task that has not started. */
+declare function opsEditable(task: ActionSubject): boolean;
+
+/**
+ * A task as both surfaces hold it, with the live state each tracks beside it
+ * (silence, approvals, isolation, the merge gate). Structural, because the TUI
+ * projects tasks into its own shape.
+ */
+interface TaskRowSubject {
+    id: string;
+    order: number;
+    type: 'ai' | 'user';
+    status: string;
+    dependencies: readonly string[];
+    taskMode?: string;
+    ops?: boolean;
+    idleSince?: string | null;
+    awaitingReason?: AwaitingReason;
+    skipReason?: string;
+    /** When a task paused on a usage limit resumes on its own (ISO time). */
+    resumeAt?: string | null;
+    /** Its last attempt left a runner session to continue (ADR-0018, K1). */
+    continuable?: boolean;
+    awaitingApproval?: number;
+    isolation?: TaskRowIsolation | null;
+    mergeGate?: readonly string[];
+    forcedPastGate?: readonly string[];
+    attemptUsage?: readonly AttemptUsage[];
+}
+interface TaskRowIsolation {
+    state: TaskIsolationState;
+    repos?: string[];
+    conflictRepo?: string;
+    conflictFiles?: string[];
+    repair?: {
+        attempt: number;
+        limit: number;
+    };
+    repairedFiles?: string[];
+}
+/**
+ * The plan a row labels its references against: the tree, so a subtask's
+ * dependency reads dotted ("#2.1") rather than by its parent-scoped order.
+ * With statuses and dependencies it also tells which tasks a failure blocks.
+ */
+interface PlanRefTask {
+    id: string;
+    order: number;
+    title: string;
+    status?: string;
+    dependencies?: readonly string[];
+    subtasks?: readonly PlanRefTask[];
+}
+interface TaskRowContext {
+    /** Set for a subtask: it is labelled by its dotted order. */
+    parent?: {
+        order: number;
+    } | null;
+    /** Which action set the row offers; a row with a parent is a subtask's unless told otherwise. */
+    placement?: TaskRowPlacement;
+    /** The plan tree a dependency, gate or block is labelled against; one it does not hold is shown by id. */
+    tasks?: readonly PlanRefTask[];
+    /** The modes the task's runner declares; autonomy is a tag on one of them (ADR-0001). */
+    modes?: readonly {
+        id: string;
+        autonomous?: boolean;
+    }[];
+    /** What a resume time is read against; the clock when absent. */
+    now?: Date;
+}
+/** Whether the row stands for an AI task, a manual one, or an ops task (ADR-0020). */
+type TaskRowKind = 'ai' | 'user' | 'ops';
+interface TaskRowUsage extends UsageLine {
+    attempt: number;
+    wallTimeMs?: number;
+}
+interface TaskRowView {
+    usage: TaskRowUsage | null;
+    /** "2", or "2.1" for a subtask. */
+    orderLabel: string;
+    kind: TaskRowKind;
+    status: TaskStatusKind;
+    /** A runner is live behind it — `quiet` included. */
+    running: boolean;
+    /** What an awaiting task waits on, in sentence case; null when nothing was saved. */
+    awaiting: string | null;
+    /** "Resumes at 8:10pm" while a task paused on a usage limit resumes on its own; null otherwise. */
+    resumes: string | null;
+    /** Runner requests waiting on the user, in sentence case; null when none do. */
+    approvals: string | null;
+    /** The task's mode is tagged autonomous: it runs without permission prompts. */
+    autonomous: boolean;
+    /** The repos its isolated work changed, by path; empty for a group of one. */
+    repos: string[];
+    /** Integration stopped on a conflict: the one isolation state that needs the user. */
+    conflict: {
+        repo: string | null;
+        files: string | null;
+    } | null;
+    /** A conflict repair in flight (ADR-0015) — progress, not a blocker. */
+    repairing: {
+        files: string | null;
+        attempt: {
+            attempt: number;
+            limit: number;
+        } | null;
+    } | null;
+    /** The files a conflict repair was started for; `landed` once the task is integrated. */
+    repaired: {
+        files: string;
+        landed: boolean;
+    } | null;
+    /** The dependencies, by reference, whose work is not merged into the user's branch yet. */
+    mergeGate: string[] | null;
+    /** The failed tasks, by reference, a task not started waits on through its dependencies (ADR-0034); null when none. */
+    blockedBy: string[] | null;
+    /** Why a skipped task was skipped, as whoever skipped it put it; null for any other, or one skipped without a reason. */
+    skipReason: string | null;
+    /** An ops task changed tracked files in the user's checkout and nothing was committed. */
+    opsChangedFiles: boolean;
+    /** The dependencies, by title, a force start went past the merge gate of. */
+    forcedPastGate: readonly string[] | null;
+    /** The task's dependencies, by reference. */
+    dependencies: string[];
+    /** What the row offers while a plan runs. */
+    actions: TaskRowAction[];
+    /** The one mark its toggle sets. */
+    mark: 'complete' | 'uncomplete';
+    opsEditable: boolean;
+}
+/** The repos a task changed, for a row that names them; none for a group of one. */
+declare const namedRepos: (repos: readonly string[] | undefined) => string[];
+/**
+ * Everything a plan row says about one task, decided once: each surface picks
+ * its own words, glyphs and casing for these facts, and derives none of them.
+ */
+declare function taskRowView(task: TaskRowSubject, context?: TaskRowContext): TaskRowView;
+
+interface Named {
+    id: string;
+    order: number;
+    title: string;
+    subtasks?: readonly Named[];
+}
+/** Each id as "#N title", subtasks dotted, by the plan's tree; one it no longer holds stays a bare id. */
+declare function titledRefs(ids: readonly string[], tasks: readonly Named[]): string[];
+/**
+ * What removing a task does to the tasks that depend on it, or null when none
+ * do. Named rather than counted: the removal rewrites their dependency lists,
+ * and a bare "Remove task?" would hide that.
+ */
+declare function dependentsNotice(dependents: readonly {
+    order: number;
+    title: string;
+}[]): string | null;
+/**
+ * What a start past a merge gate is asked with (ADR-0020): the work the task
+ * would act without, named. `subject` is how the asking surface refers to the
+ * task — "It" under a title that already names it.
+ */
+declare function pastGateConfirmation(unmerged: readonly string[], subject?: string): string;
+interface NewTaskFields {
+    title: string;
+    description: string;
+    prompt: string;
+    type: 'ai';
+}
+/**
+ * What a hand-added task starts as: an AI task whose description is its title
+ * and whose prompt, unless one was typed, is too. Null for a title with nothing
+ * in it, rather than a nameless task. Assignments are left for the session to
+ * derive from the runner's catalog.
+ */
+declare function newTaskFields(title: string, prompt?: string): NewTaskFields | null;
+
+/** How every surface words the run settings (ADR-0030), so they all say the same thing. */
+declare const SUPERVISOR_LEVEL_LABEL: Record<SupervisorLevel, string>;
+declare const supervisorSummary: (run: GlobalRunSettings) => string;
+declare const automergeSummary: (run: GlobalRunSettings) => string;
+declare const autorunSummary: (run: GlobalRunSettings) => string;
+declare const ACT_RISK = "Tasks it adds run too, ops tasks included, which can act on real systems unattended.";
+declare const AUTORUN_RISK = "Plans start without review, ops tasks included, which can act on real systems unattended. In Full, the planner may also start tasks it adds later.";
+/** `on`/`off` as a switch's value; null for anything else. */
+declare function parseSwitch(arg: string): boolean | null;
+/** A whole number at least `min`, as typed; null for anything else. */
+declare function parseCount(arg: string | undefined, min: number): number | null;
+
+export { type RunnerLoadedBlock as $, ACT_RISK as A, type BlockingSubject as B, CHECKPOINT_TRUNCATE_LENGTH as C, type DiffRow as D, EMPTY_CONVERSATION as E, type NotificationAction as F, type GatedConversation as G, type OutputPreview as H, type INotification as I, type PlanMarkerStatus as J, type PlanSnapshot as K, type LiveTail as L, type MessageBlock as M, NOT_STARTED as N, type OrchestratorObserver as O, type PlanBlock as P, PlanStore as Q, type PlannerModes as R, type PromptHold as S, RUN_SETTINGS_DEFAULTS as T, type RefTask as U, type RunInput as V, type RunMergeView as W, RunSettingsError as X, type RunTask as Y, type RunTaskStatus as Z, type RunView as _, AUTORUN_RISK as a, diffRows as a$, SUPERVISOR_LEVEL_LABEL as a0, type SerializedConversationMessage as a1, type SerializedPendingTurn as a2, type SerializedPlan as a3, type SerializedTask as a4, type SerializedTaskStatus as a5, type SessionBroadcaster as a6, type SessionMessage as a7, type SessionNotice as a8, SettingsService as a9, type TaskRowUsage as aA, type TaskRowView as aB, type TaskStatusKind as aC, type ThinkingDisplayBlock as aD, type ToolBlock as aE, type ToolHeadline as aF, type ToolStatus as aG, type TurnGate as aH, type UsageBlock as aI, type UserSettings as aJ, aheadOfDraft as aK, applyTaskOps as aL, approvalLabel as aM, automergeSummary as aN, autorunSummary as aO, awaitingLabel as aP, blockedByLabel as aQ, blockingFailures as aR, canMergeTasks as aS, canSetDependencies as aT, canSplitTask as aU, capConflictFiles as aV, classifyOutcome as aW, coalesceTaskLog as aX, dependencyCandidates as aY, dependentsNotice as aZ, dependentsOf as a_, type SkillLoadBlock as aa, type SkillLookup as ab, type SkillToken as ac, type SubagentBlock as ad, type SubagentChild as ae, type SubagentStatus as af, type SurfacePlan as ag, type SurfacePlanState as ah, type SurfaceTask as ai, type TakenPrompt as aj, type TaskAttemptSnapshot as ak, TaskControlError as al, type TaskLogEvent as am, type TaskLogView as an, type TaskOp as ao, TaskOrchestrator as ap, type TaskOrchestratorDeps as aq, type TaskOrchestratorOptions as ar, type TaskOutputSource as as, type TaskRef as at, type TaskRowAction as au, type TaskRowContext as av, type TaskRowIsolation as aw, type TaskRowKind as ax, type TaskRowPlacement as ay, type TaskRowSubject as az, type ApplyTaskOpsResult as b, diffStat as b0, diffSummary as b1, digestTaskLog as b2, drainNext as b3, executionSummary as b4, followTurn as b5, fromTranscript as b6, getSettingsPath as b7, hasHiddenDetail as b8, holdPrompt as b9, skippedLabel as bA, stopTurn as bB, summarizeToolCall as bC, supervisorSummary as bD, surfacePlan as bE, surfacePlanState as bF, takeAt as bG, taskLogForSurface as bH, taskOrderLabel as bI, taskRef as bJ, taskRefOf as bK, taskRowActions as bL, taskRowView as bM, taskStartedNotice as bN, taskStatusKind as bO, textHasTaskOps as bP, titledRefs as bQ, titledTaskRef as bR, titledTaskRefOf as bS, toTaskLogEvent as bT, toolHeadline as bU, trimToolOutput as bV, truncateCheckpointSummary as bW, unsendAll as bX, unsendLatest as bY, isTaskRunning as ba, loadedSkillTokens as bb, markAction as bc, markRequestFor as bd, namedRepos as be, newTaskFields as bf, opsEditable as bg, outputLines as bh, outputPreview as bi, parseCount as bj, parseSwitch as bk, parseTaskOpsJson as bl, pastGateConfirmation as bm, reduceConversation as bn, reduceRun as bo, reduceTaskLog as bp, replayTaskLog as bq, resolveTaskRef as br, resumeLabel as bs, resumeTime as bt, runSettingsOf as bu, runnerToolSubject as bv, serializePlan as bw, serializeTask as bx, serializeTaskStatus as by, skillTokens as bz, type ApprovalBlock as c, type ApprovalStatus as d, type AutoMergeTrigger as e, type CommandBlock as f, type CommandStatus as g, type CompactionBlock as h, type ConversationInput as i, type ConversationView as j, type DiffRowKind as k, type DiffStat as l, type DisplayBlock as m, EMPTY_HOLD as n, EMPTY_RUN as o, EMPTY_TASK_LOG as p, type EditCatalog as q, type ExecutionSummary as r, type GlobalRunSettings as s, type IsolatedExecution as t, IsolationRunController as u, type LiveTailOptions as v, type LocalEntry as w, type MessageRole as x, NO_TURN as y, type NewTaskFields as z };