@wjarka/cezarion 0.14.7-pr488.741 → 0.14.8-dev.817

package/dist/workflows/run.js

@@ -1,5 +1,6 @@
 import { ciWaitRequestSchema, ciWaitResultSchema } from '../contract/index.js';
 import { acquireCiResources } from '../ci-wait/resources.js';
+import { artifactInstructions, provisionArtifactDirectory } from '../artifacts/lifecycle.js';
 import { workerContextHash, workerWorkflowHash, workerStepIdentity, captureWorkerAccount, boundWorkerAccountEnv, WorkerIdentityError } from '../delegation/execution-identity.js';
 import { buildChildEnv } from '../core/agent-env.js';
 import { randomUUID } from 'node:crypto';
@@ -19,7 +20,8 @@ import { todosPath } from '../todos.js';
 // Contract VALUES, like `workspaceUiStateSchema` in workspace/migrations.ts: the attachment
 // vocabulary the routes validate with is the same one the engine stores and re-reads by, so the
 // wire and the disk can never disagree about what counts as an image (#950).
-import { requestWaitRequestSchema, workerWaitRequestSchema, attachmentExtension, delegationStateSchema, pendingHumanAsk, isImageAttachmentName, isImageMediaType, } from '../contract/index.js';
+import { requestWaitRequestSchema, workerWaitRequestSchema, attachmentExtension, delegationStateSchema, pendingHumanAsk, askRequestSchema, isImageAttachmentName, isImageMediaType, } from '../contract/index.js';
+import { inputDeliveryOf } from '../core/agent-runner.js';
 import { discoverSkills } from '../skills.js';
 import { materializeSkillDir } from '../skills-remote.js';
 import { seedAgentConfigLocalLayer } from '../agent-config/seed.js';
@@ -35,6 +37,7 @@ import { DelegationPolicyError } from '../delegation/policy.js';
 import { reconcileWorkerWait } from '../delegation/wait.js';
 import { reconcileConversationState, projectConversationEvents } from '../delegation/conversations.js';
 import { parentReadiness } from '../delegation/readiness.js';
+import { answersQuestion, openQuestions, questionMessage } from '../delegation/questions.js';
 import { workerOutcome } from '../runs/delegation-state.js';
 import { loadWorkflows } from './load.js';
 import { reclaimWorktrees, rematerializeReclaimedWorktree } from '../runs/retention.js';
@@ -122,6 +125,8 @@ function stripDoneMarker(text) {
 function stripMonitoringMarker(text) {
     return text.replace(/\s*CEZ:MONITORING\s*$/, '');
 }
+/** #505: a worker question routed to its parent is answered there until it falls back. */
+const ROUTED_QUESTION_REFUSAL = 'This question was sent to the parent task; answer it there.';
 /** Emit the v2 `ask.requested` event for a parsed marker (the cockpit renders
  *  it as an ask card, #473). Returns the minted request id. */
 function emitAskRequested(sink, ask) {
@@ -213,6 +218,9 @@ export function repositoryRootLockDisabled(env = process.env) {
 }
 const REPOSITORY_ROOT_LOCK_DISABLED_NOTE = 'repository-root lock disabled by CEZ_DISABLE_REPO_LOCK=1 (shared checkout is unsafe)';
 /** Safety cap on autonomous auto-continues per run — stops a stuck agent from nudging forever. */
+/** #505: a real steer is read at the harness's next model step; a quiet boundary this long
+ * with input still unread means the harness will not read it without help. */
+export const UNREAD_INPUT_GRACE_MS = 30_000;
 const MAX_AUTO_CONTINUES = 40;
 const AUTONOMOUS_NUDGE = 'Continue working autonomously until the task is fully complete. Do not ask me for confirmation or clarification — make reasonable assumptions and proceed. When everything is done, end the session with your done signal.';
 const MONITORING_WAKE_NUDGE = 'Re-check the downstream work you were monitoring. Continue toward the task goal; emit CEZ:MONITORING again only if it is still pending.';
@@ -596,6 +604,8 @@ export class RunManager {
     inboxClaimTimers = new Map();
     reconcilingWorkers = false;
     recovering = false;
+    /** Quiet window before unread input is resubmitted or left unconfirmed (#505). */
+    unreadInputGraceMs;
     disposed = false;
     onDelegationRun = (run) => {
         if (!this.disposed && !['queued', 'running', 'waiting'].includes(run.status))
@@ -666,6 +676,7 @@ export class RunManager {
         this.store = store;
         this.repoRoot = repoRoot;
         this.dataDir = join(repoRoot, '.ai/cezar');
+        this.unreadInputGraceMs = options.unreadInputGraceMs ?? UNREAD_INPUT_GRACE_MS;
         this.semaphore = options.semaphore ?? new WorkspaceSemaphore();
         this.ciResources = acquireCiResources(this.semaphore);
         this.ciSupervisor = this.ciResources.supervisor;
@@ -809,6 +820,7 @@ export class RunManager {
      *  turning into empty command output inside a running agent. */
     agentEnv(runId, generateFollowups = true) {
         return {
+            CEZ_ARTIFACTS_DIR: provisionArtifactDirectory(this.dataDir, runId),
             CEZ_HANDOFF_FILE: handoffPath(this.dataDir, runId),
             CEZ_TASK_ID: runId,
             CEZ_TODOS_FILE: generateFollowups ? todosPath(this.dataDir) : '',
@@ -1194,7 +1206,19 @@ export class RunManager {
             throw new DelegationPolicyError('invalid_input', error instanceof Error ? error.message : 'Worker execution selection is unavailable');
         }
     }
-    startRun(workflow, input, group) {
+    /**
+     * Idempotent start (#504, spec 2026-09-24-cez-task-cli). Lookup and create share one
+     * synchronous path, so the event loop serialises concurrent retries: the first creates, every
+     * later one with the same hash gets that run back, and a different hash is a conflict.
+     */
+    startRunIdempotent(workflow, input, request) {
+        const existing = this.store.findRunByClientRequestId(request.id);
+        if (existing) {
+            return existing.clientRequestHash === request.hash ? { run: existing, created: false } : { conflict: true };
+        }
+        return { run: this.startRun(workflow, input, undefined, request), created: true };
+    }
+    startRun(workflow, input, group, clientRequest) {
         // Sanitize at the manager boundary so CLI runs, workflows, variants, and
         // direct callers cannot bypass the HTTP policy.
         const effectiveInput = agentModelsLocked(this.repoRoot)
@@ -1225,6 +1249,8 @@ export class RunManager {
             worktree: !group && input.worktree === false ? false : undefined,
             groupId: group?.groupId,
             variant: group?.variant,
+            clientRequestId: clientRequest?.id,
+            clientRequestHash: clientRequest?.hash,
             steps: workflow.steps.map((s) => ({ id: s.id, name: s.name ?? s.id, kind: stepKind(s) })),
         });
         // Persist the full definition so a queued run survives a restart (#367) —
@@ -1485,6 +1511,11 @@ export class RunManager {
                             this.workerWakeAdmitted.add(runId);
                             this.flushAgentInputs(runId);
                         }
+                        else if (state.pendingHumanAsk && this.routedAsk(runId) && this.workerWaiting.delete(runId)) {
+                            // A parent's answer to the worker's routed question (#505).
+                            this.workerWakeAdmitted.add(runId);
+                            this.answerRoutedQuestion(runId, true);
+                        }
                         continue;
                     }
                     if (this.workerWakeQueuedAt.delete(runId))
@@ -1682,6 +1713,13 @@ export class RunManager {
             for (const run of this.store.listRuns()) {
                 this.store.clearExpiredInboxClaims(run.id, new Date().toISOString());
                 this.armInboxClaimExpiry(run.id);
+                // #505: the session that accepted this input died before the model read it.
+                // Delivery is at-least-once: the replay keeps the input's ID in its text.
+                if (['queued', 'running', 'waiting'].includes(run.status) && !this.isActive(run.id)) {
+                    const replayed = this.store.requeueAwaitingReadInputs(run.id);
+                    if (replayed.length)
+                        this.store.appendEvent(run.id, { type: 'note', message: `replaying ${replayed.length} message${replayed.length === 1 ? '' : 's'} accepted before the restart but not read` });
+                }
             }
             this.reconcileWorkerWaits();
             const live = this.store
@@ -1837,7 +1875,15 @@ export class RunManager {
         finally {
             this.recovering = false;
         }
+        // A question a crash caught before or after its commit to the parent still gets routed (#505).
+        for (const run of this.store.listRuns())
+            if (run.delegation?.role === 'worker')
+                this.routeWorkerQuestion(run.id);
         this.reconcileWorkerWaits();
+        // A parent reply accepted just before the crash still answers its worker (#505).
+        for (const run of this.store.listRuns())
+            if (run.delegation?.role === 'worker')
+                this.answerRoutedQuestion(run.id);
         for (const run of this.store.listRuns()) {
             if (run.ciWait && !['running', 'waiting', 'queued'].includes(run.status))
                 this.withdrawCiWait(run.id);
@@ -2719,6 +2765,9 @@ export class RunManager {
             return undefined;
         if (this.hasPendingHumanAsk(runId) || this.active.get(runId)?.pendingHumanAsk)
             return 'Answer the pending human question before finishing.';
+        const questions = this.unansweredQuestions(runId);
+        if (questions.length)
+            return `Answer your workers' questions before finishing: ${questions.map(q => q.workerId).join(', ')}`;
         const blockers = this.parentCompletionBlockers(runId);
         return blockers.length ? `Workers must finish or be stopped, prove termination, and have their latest results collected before finishing: ${blockers.map(b => `${b.workerId} (${b.reason})`).join(', ')}` : undefined;
     }
@@ -2759,6 +2808,8 @@ export class RunManager {
         const state = this.active.get(runId);
         const blockers = this.parentCompletionBlockers(runId);
         const pendingAsk = this.hasPendingHumanAsk(runId) || state?.pendingHumanAsk;
+        // A worker waiting on this parent's answer (#505): waiting on that worker would deadlock.
+        const questions = pendingAsk ? [] : this.unansweredQuestions(runId);
         if (!blockers.length && !pendingAsk) {
             this.resetParentCompletion(runId);
             return false;
@@ -2771,7 +2822,7 @@ export class RunManager {
         }
         if (parent.delegation?.role !== 'root')
             return false;
-        if (parent.delegation.wait && !pendingAsk) {
+        if (parent.delegation.wait && !pendingAsk && !questions.length) {
             if (state?.session?.open)
                 this.parkWorkerWait(runId, state);
             else
@@ -2779,11 +2830,12 @@ export class RunManager {
             this.store.flush();
             return true;
         }
-        const message = pendingAsk ? 'Completion blocked: answer the pending human question.' :
+        const message = pendingAsk ? 'Completion blocked: answer the pending human question.' : questions.length
+            ? `Completion blocked: answer your workers' questions first: ${questions.map(q => `${q.workerId} (request ${q.messageId})`).join(', ')}.` :
             `Completion blocked: finish or explicitly stop outstanding workers, then collect their latest settled results: ${blockers.map(b => `${b.workerId} (${b.reason})`).join(', ')}.`;
         this.store.appendEvent(runId, { type: 'note', tone: 'warning', message });
         const workerIds = blockers.map(b => b.workerId).filter(id => this.store.getRun(id)?.delegation?.role === 'worker');
-        if (!pendingAsk && !parent.delegation.completion && workerIds.length) {
+        if (!pendingAsk && !questions.length && !parent.delegation.completion && workerIds.length) {
             const wait = { id: randomUUID(), mode: 'all', workerIds,
                 revisions: workerIds.map(workerId => { const d = this.store.getRun(workerId).delegation; return { workerId, revision: d?.role === 'worker' ? d.executionRevision ?? 0 : 0 }; }),
                 deadline: new Date(Date.now() + 600_000).toISOString(), phase: 'parked', outcomes: [] };
@@ -2796,7 +2848,7 @@ export class RunManager {
                 this.reconcileWorkerWaits();
         }
         else {
-            const monitoring = !pendingAsk && !!state?.session?.open && this.hasLiveWorkers(runId);
+            const monitoring = !pendingAsk && !questions.length && !!state?.session?.open && this.hasLiveWorkers(runId);
             this.store.commitDelegation([{ id: runId, delegation: { ...parent.delegation, completion: { ...parent.delegation.completion, phase: 'attention' } } }]);
             this.store.updateRun(runId, { status: monitoring ? 'running' : 'waiting', activity: monitoring ? 'monitoring' : undefined, finishedAt: undefined });
             this.store.flush();
@@ -2991,8 +3043,14 @@ export class RunManager {
         const run = this.store.getRun(runId);
         if (!run?.delegation || run.delegation.role === 'invalid' || this.historyDeletionPending(runId) ||
             this.executionBlockedByRootFinish(run) || !['queued', 'running', 'waiting'].includes(run.status) ||
-            this.workerExecutionStopped(runId) || this.hasPendingHumanAsk(runId))
+            this.workerExecutionStopped(runId))
+            return;
+        // A pending question holds every other input; only the parent's reply to a routed one
+        // answers it (#505), and the held inputs follow right behind that answer.
+        if (this.hasPendingHumanAsk(runId)) {
+            this.answerRoutedQuestion(runId);
             return;
+        }
         // Retain conversation input until the registered CI wait receives scheduler admission.
         // Converting this monitor into a worker wake would strand both admission paths.
         if (run.ciWait) {
@@ -3024,6 +3082,231 @@ export class RunManager {
         else if (!this.recovering)
             this.flushAgentInputs(runId);
     }
+    /** A worker's pending question goes to its owning parent as a conversation request
+     * (#505). The worker still parks on its ask; only the parent's reply, or a human after
+     * fallback, answers it. Routing is idempotent: the message ID derives from the ask seq. */
+    routeWorkerQuestion(workerId) {
+        const worker = this.store.getRun(workerId);
+        if (worker?.delegation?.role !== 'worker')
+            return;
+        const events = this.store.readEvents(workerId);
+        const ask = pendingHumanAsk(events);
+        if (!ask)
+            return;
+        if (events.some(event => (event.type === 'worker-question-routed' || event.type === 'worker-question-fallback') && event.askSeq === ask.seq))
+            return;
+        const fallback = (reason) => { this.store.appendEvent(workerId, { type: 'worker-question-fallback', askSeq: ask.seq, reason }); };
+        const request = askRequestSchema.safeParse({ questions: ask.questions });
+        if (!request.success) {
+            fallback('the question cannot be carried to the parent');
+            return;
+        }
+        const parentId = worker.delegation.parentRunId;
+        const root = this.store.getRun(parentId);
+        const now = new Date().toISOString();
+        const message = questionMessage({ workerRunId: workerId, parentRunId: parentId, askSeq: ask.seq, request: request.data, now });
+        // Already committed (a crash before the routing event): the question did reach the parent,
+        // whatever its capacity or state is now. Record the routing; fallback sweeps follow.
+        const committed = root?.delegation?.role === 'root' && !!root.delegation.conversation?.messages.some(m => m.id === message.id);
+        if (committed) {
+            this.store.appendEvent(workerId, { type: 'worker-question-routed', askSeq: ask.seq, messageId: message.id, parentRunId: parentId });
+            return;
+        }
+        // Recovery can find a question that never left a worker which has since stopped.
+        if (!['queued', 'running', 'waiting'].includes(worker.status)) {
+            fallback('worker-stopped');
+            return;
+        }
+        if (root?.delegation?.role !== 'root' || !this.parentCanReceive(root)) {
+            fallback('the parent can no longer receive messages');
+            return;
+        }
+        const state = root.delegation.conversation ?? { messages: [], outcomes: [] };
+        // Room in the ledger for the question AND its reply, beside the replies other open questions
+        // reserve. The reply itself is always admitted to this worker's inbox (service.send).
+        if (state.messages.length + openQuestions(state).length + 2 > 1024 || (root.agentInputs ?? []).filter(input => !input.deliveredAt).length >= 32 ||
+            state.messages.filter(m => m.kind === 'request' && m.state === 'accepted' && !state.outcomes.some(o => o.requestId === m.id)).length >= 32) {
+            fallback('the parent conversation is at capacity');
+            return;
+        }
+        const input = { id: message.id, source: 'agent', parentRunId: parentId, text: message.text, createdAt: now,
+            conversation: { senderRunId: workerId, recipientRunId: parentId, kind: 'request' } };
+        this.store.commitConversation(parentId, { ...state, messages: [...state.messages, message] }, { recipientRunId: parentId, input });
+        projectConversationEvents(this.store, this.store.getRun(parentId));
+        this.store.appendEvent(workerId, { type: 'worker-question-routed', askSeq: ask.seq, messageId: message.id, parentRunId: parentId });
+        this.deliverConversationInput(parentId);
+    }
+    /** A human answering a worker question its parent handed back (#505): the reviewing parent
+     * can no longer answer it, so it must not also block the human. */
+    answersFallenBackAsk(runId, opts, deferred) {
+        if (deferred || !(opts.text?.trim() || opts.images?.length))
+            return false;
+        const events = this.store.readEvents(runId);
+        const ask = pendingHumanAsk(events);
+        return !!ask && events.some(event => event.type === 'worker-question-fallback' && event.askSeq === ask.seq);
+    }
+    /** The worker's pending ask when it went to the parent and has not fallen back to a human. */
+    routedAsk(runId) {
+        const run = this.store.getRun(runId);
+        if (run?.delegation?.role !== 'worker')
+            return undefined;
+        const events = this.store.readEvents(runId);
+        const ask = pendingHumanAsk(events);
+        if (!ask || events.some(event => event.type === 'worker-question-fallback' && event.askSeq === ask.seq))
+            return undefined;
+        const routed = events.find(event => event.type === 'worker-question-routed' && event.askSeq === ask.seq);
+        const root = this.store.getRun(run.delegation.parentRunId);
+        const message = routed && root?.delegation?.role === 'root'
+            ? root.delegation.conversation?.messages.find(entry => entry.id === routed.messageId) : undefined;
+        return message ? { askSeq: ask.seq, message } : undefined;
+    }
+    /** The parent's reply answers the routed question like a human answer would: through the
+     * live session's native answer seam, or by reopening a session that is gone (#505). */
+    answerRoutedQuestion(runId, admitted = false) {
+        const routed = this.routedAsk(runId);
+        const run = this.store.getRun(runId);
+        const reply = routed && run?.agentInputs?.find(input => !input.deliveredAt && answersQuestion(routed.message, input));
+        // A stopped worker is the human's to continue; a parent answer never revives it.
+        if (!routed || !reply || run?.delegation?.role !== 'worker' || !['queued', 'running', 'waiting'].includes(run.status))
+            return;
+        // Verbatim: a native answer seam parses `Header: label` lines, exactly as a human's.
+        const text = reply.text;
+        const state = this.active.get(runId);
+        if (!state) {
+            // An automated answer is not a human override: the reopened session waits for capacity.
+            if (this.isActive(runId))
+                return;
+            // As on the live path, the answer supersedes a wait registered before the question.
+            if (this.workerWait(runId)) {
+                try {
+                    this.withdrawWorkerWait(runId);
+                }
+                catch {
+                    return;
+                }
+            }
+            const result = this.continueRun(runId, { text, answerInputId: reply.id }, true);
+            if (!result.ok)
+                this.store.appendEvent(runId, { type: 'note', tone: 'warning', message: `parent answer not delivered: ${result.error}` });
+            return;
+        }
+        if (!state.session?.open || state.cancelled || state.openingAgentInputId === reply.id)
+            return;
+        // Already waiting for admission: only the admission itself may deliver it.
+        if (!admitted && (this.workerWaiting.has(runId) || this.workerWakeQueuedAt.has(runId)))
+            return;
+        if (!admitted && (this.waiting.has(runId) || this.monitoring.has(runId))) {
+            // The parked worker released its slot: the answer rides the ordinary message wake,
+            // which delivers it here once the scheduler admits the worker.
+            const existing = this.workerWait(runId);
+            if (existing?.wakeId !== reply.id) {
+                // An answer supersedes a wait the worker registered before asking, exactly as a
+                // human answer withdraws it; a failed checkpoint leaves both for a later retry.
+                if (existing) {
+                    try {
+                        this.withdrawWorkerWait(runId);
+                    }
+                    catch {
+                        return;
+                    }
+                }
+                const wait = { id: randomUUID(), workerIds: [], outcomes: [],
+                    deadline: new Date().toISOString(), phase: 'wake-pending', reason: 'message', wakeId: reply.id };
+                const current = this.store.getRun(runId)?.delegation;
+                if (current?.role !== 'worker')
+                    return;
+                this.store.commitDelegation([{ id: runId, delegation: { ...current, wait } }]);
+            }
+            this.clearIdleTimer(state);
+            this.clearMonitoringWakeTimer(state, runId);
+            this.waiting.delete(runId);
+            this.monitoring.delete(runId);
+            this.workerWaiting.add(runId);
+            this.queueWorkerWake(runId);
+            return;
+        }
+        const bundle = state.atTurnBoundary === state.session ? this.pendingConversationBatch(runId, state, reply.id) : undefined;
+        if (!state.session.sendMessage([{ type: 'text', text }, ...(bundle ? [{ type: 'text', text: bundle.text }] : [])]))
+            return;
+        this.store.appendEvent(runId, { type: 'human-input-delivered', askSeq: routed.askSeq, source: 'parent' });
+        const delivered = [reply.id, ...(bundle?.inputs.map(input => input.id) ?? [])];
+        this.commitBundledDelivery(runId, state, delivered);
+        // As in submitAgentInput: the wake that admitted this answer is spent, and a stale one
+        // would hold back every later message until the answer's turn ends.
+        if (delivered.includes(this.workerWait(runId)?.wakeId ?? '')) {
+            state.workerWakeTurn = state.session;
+            try {
+                this.withdrawWorkerWait(runId);
+            }
+            catch { /* reconcileWorkerWaits retires it at the turn end */ }
+        }
+        state.pendingHumanAsk = this.hasPendingHumanAsk(runId);
+        if (!state.pendingHumanAsk)
+            this.flushAgentInputs(runId);
+        this.resumeParkedRun(runId, state);
+    }
+    /** A routed question settled without a reply (its worker stopped, a deadline, fallback) can
+     * never be answered by the parent any more: hand it to the human on the worker (#505). */
+    retireSettledQuestions(parentId) {
+        const root = this.store.getRun(parentId);
+        const conversation = root?.delegation?.role === 'root' ? root.delegation.conversation : undefined;
+        if (!conversation)
+            return;
+        for (const message of conversation.messages) {
+            const outcome = message.question && conversation.outcomes.find(entry => entry.requestId === message.id);
+            // A reply still waiting for a live worker answers it; one a stopped worker never took does not.
+            const worker = this.store.getRun(message.senderRunId);
+            const live = !!worker && ['queued', 'running', 'waiting'].includes(worker.status) && !worker.stopping;
+            if (!outcome || (outcome.status === 'replied' && live))
+                continue;
+            const routed = this.routedAsk(message.senderRunId);
+            if (routed?.message.id === message.id) {
+                this.store.appendEvent(message.senderRunId, { type: 'worker-question-fallback', askSeq: routed.askSeq, reason: outcome.status === 'human-fallback' ? `parent-${root.status}` : outcome.status === 'replied' ? 'worker-stopped' : `question-${outcome.status}` });
+            }
+        }
+    }
+    /** Routed questions this parent has not answered yet, by asking worker. */
+    unansweredQuestions(parentId) {
+        return this.store.listRuns().flatMap(run => {
+            if (run.delegation?.role !== 'worker' || run.delegation.parentRunId !== parentId)
+                return [];
+            const routed = this.routedAsk(run.id);
+            const root = this.store.getRun(parentId);
+            const answered = root?.delegation?.role === 'root' && root.delegation.conversation?.outcomes.some(outcome => outcome.requestId === routed?.message.id);
+            return routed && !answered ? [{ workerId: run.id, messageId: routed.message.id }] : [];
+        });
+    }
+    /** The parent can no longer answer: its workers' routed questions go back to the human
+     * (#505). The outcome lands first, so a crash before the worker's event repeats this. */
+    fallbackRoutedQuestions(parentId, reason) {
+        const parent = this.store.getRun(parentId);
+        if (parent?.delegation?.role !== 'root')
+            return;
+        const state = parent.delegation.conversation ?? { messages: [], outcomes: [] };
+        const routed = this.store.listRuns().flatMap(run => {
+            const ask = run.delegation?.role === 'worker' && run.delegation.parentRunId === parentId ? this.routedAsk(run.id) : undefined;
+            // An accepted reply still on its way to a live worker answers it; no human card beside it.
+            const replied = ask && state.outcomes.some(outcome => outcome.requestId === ask.message.id && outcome.status === 'replied');
+            return ask && !(replied && ['queued', 'running', 'waiting'].includes(run.status) && !run.stopping) ? [{ workerId: run.id, ...ask }] : [];
+        });
+        if (!routed.length)
+            return;
+        const observedAt = new Date().toISOString();
+        const missing = routed.filter(entry => !state.outcomes.some(outcome => outcome.requestId === entry.message.id));
+        if (missing.length) {
+            this.store.commitConversation(parentId, { ...state, outcomes: [...state.outcomes,
+                    ...missing.map(entry => ({ requestId: entry.message.id, status: 'human-fallback', observedAt }))] });
+            projectConversationEvents(this.store, this.store.getRun(parentId));
+        }
+        for (const entry of routed)
+            this.store.appendEvent(entry.workerId, { type: 'worker-question-fallback', askSeq: entry.askSeq, reason });
+    }
+    /** The parent can still read and answer a routed question; answering needs its steer grant. */
+    parentCanReceive(parent) {
+        return parent.delegation?.role === 'root' && parent.delegation.permissions.includes('steer') &&
+            ['queued', 'running', 'waiting'].includes(parent.status) && !parent.stopping &&
+            !this.rootFinishRequested(parent.id) && !this.historyDeletionPending(parent.id);
+    }
     /** Cancel only the wait; persist its settlement before ordinary wake admission. */
     cancelWorkerWait(parentId, waitId) {
         const run = this.store.getRun(parentId);
@@ -3093,6 +3376,7 @@ export class RunManager {
             if (next && next !== root.delegation.conversation)
                 this.store.commitConversation(root.id, next);
             projectConversationEvents(this.store, this.store.getRun(root.id));
+            this.retireSettledQuestions(root.id);
             const key = `conversation:${root.id}`;
             const timer = this.workerWaitTimers.get(key);
             if (timer) {
@@ -3138,6 +3422,7 @@ export class RunManager {
                 if (!['queued', 'running', 'waiting'].includes(parent.status)) {
                     if (!this.recovering) {
                         this.withdrawWorkerWait(parent.id);
+                        this.fallbackRoutedQuestions(parent.id, `parent-${parent.status}`);
                         for (const child of this.store.listRuns().filter(child => parent.delegation?.role === 'root' && parent.status !== 'review' && child.delegation?.role === 'worker' && child.delegation.parentRunId === parent.id)) {
                             if (['queued', 'running', 'waiting'].includes(child.status))
                                 this.cancel(child.id);
@@ -3318,7 +3603,9 @@ export class RunManager {
         if (this.recovering)
             return;
         const state = this.active.get(parentId);
-        if (this.hasPendingHumanAsk(parentId) || state?.pendingHumanAsk || this.workerWakeQueuedAt.has(parentId))
+        // A parent's reply to a routed question (#505) is the one message a pending ask admits.
+        const parentAnswer = wait.reason === 'message' && this.routedAsk(parentId) !== undefined;
+        if ((!parentAnswer && (this.hasPendingHumanAsk(parentId) || state?.pendingHumanAsk)) || this.workerWakeQueuedAt.has(parentId))
             return;
         if (state) {
             // Expiring a registered intent NEVER exempts a still-executing turn.
@@ -3408,7 +3695,227 @@ export class RunManager {
         const run = this.store.getRun(runId);
         return !!run && ['queued', 'running', 'waiting'].includes(run.status) &&
             !(run.delegation?.role === 'worker' && run.delegation.destroy) &&
-            !!run.agentInputs?.some(input => !input.deliveredAt);
+            (!!run.agentInputs?.some(input => !input.deliveredAt) || this.harnessOwesInput(this.active.get(runId)));
+    }
+    /** Only the current session's observation writes consumedAt (#505). An ID reported
+     * before its acceptance checkpoint lands is applied when that checkpoint commits. */
+    handleAgentInputConsumed(runId, state, session, ids) {
+        if (!session || this.active.get(runId) !== state || state.session !== session)
+            return;
+        const inFlight = state.agentInputFlight?.inputIds ?? [];
+        for (const id of ids)
+            if (inFlight.includes(id))
+                state.consumedBeforeAck?.add(id);
+        const read = ids.filter(id => !inFlight.includes(id));
+        for (const id of read)
+            state.unreadInputIds?.delete(id);
+        if (!this.harnessOwesInput(state))
+            this.clearUnreadInputTimer(state);
+        try {
+            if (!read.length)
+                return;
+            this.store.commitAgentInputsConsumed(runId, read, new Date().toISOString());
+            this.reconcileWorkerWaits(); // projects the consumed receipt
+        }
+        catch (error) {
+            console.warn(`[cez] agent input consumption checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** #505: input the harness accepted but will never read returns to the queue, so
+     * DONE, auto-end and park see queued work. Out of a turn (an OpenCode lost wake)
+     * it is submitted right away; at a turn-end the handler's own flush submits it. */
+    retireUnreadInputs(runId, state, ids, outOfTurn) {
+        if (!ids.length || state.cancelled || this.active.get(runId) !== state)
+            return;
+        // Durable first: a failed checkpoint must never let this boundary finish (DONE, park)
+        // over input that is still marked delivered but was never read.
+        try {
+            this.store.requeueUnconsumedAgentInputs(runId, ids);
+        }
+        catch (error) {
+            if (state.agentInputError)
+                return;
+            state.agentInputError = `agent input requeue checkpoint failed: ${error instanceof Error ? error.message : String(error)}`;
+            try {
+                state.session?.interrupt();
+            }
+            finally {
+                try {
+                    this.store.appendEvent(runId, { type: 'error', message: state.agentInputError });
+                }
+                catch {
+                    console.error(`[cez] ${state.agentInputError}`);
+                }
+            }
+            return;
+        }
+        for (const id of ids)
+            state.unreadInputIds?.delete(id);
+        // Reported before its own acknowledgement landed: that acknowledgement must not
+        // mark it delivered again.
+        for (const id of ids)
+            if (state.agentInputFlight?.inputIds.includes(id))
+                (state.retiredInFlight ??= new Set()).add(id);
+        this.store.appendEvent(runId, { type: 'note', message: `resubmitting ${ids.length} message${ids.length === 1 ? '' : 's'} the agent did not read` });
+        if (outOfTurn)
+            this.flushAgentInputs(runId);
+    }
+    /** #505: the harness started the opening turn, so the opening input was accepted.
+     * Its replay-prompt retirement still waits for that turn's successful end. */
+    recordOpeningAccepted(runId, state) {
+        const id = state.openingAgentInputId;
+        if (!id || state.cancelled || this.active.get(runId) !== state)
+            return;
+        const inputs = this.store.getRun(runId)?.agentInputs ?? [];
+        if (!inputs.some(input => input.id === id && !input.deliveredAt))
+            return;
+        const deliveredAt = new Date().toISOString();
+        try {
+            this.store.commitAgentInputs(runId, inputs.map(input => input.id === id ? { ...input, deliveredAt } : input));
+        }
+        catch (error) {
+            console.warn(`[cez] opening input acceptance checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** The conversation messages the next submission would carry, if nothing but
+     * conversation input leads the queue (lifecycle input stays a barrier). */
+    pendingConversationBatch(runId, state, answerId) {
+        const run = this.store.getRun(runId);
+        if (!run || run.ciWait || state.agentInputFlight || this.workerWait(runId))
+            return undefined;
+        const batch = agentInputBatch((run.agentInputs ?? []).filter(input => input.id !== state.openingAgentInputId && input.id !== answerId), input => this.formatAgentInput(runId, input));
+        return batch?.inputs.every(input => input.conversation) ? batch : undefined;
+    }
+    /** Bundled messages rode the answer's own write: delivered now, read when that turn ends. */
+    commitBundledDelivery(runId, state, ids) {
+        const deliveredAt = new Date().toISOString();
+        const awaiting = state.inputDelivery?.consumption === 'observable' ? { awaitingRead: true } : {};
+        try {
+            this.store.commitAgentInputs(runId, (this.store.getRun(runId)?.agentInputs ?? []).map(input => ids.includes(input.id) && !input.deliveredAt ? { ...input, deliveredAt, ...awaiting } : input));
+            state.bundledInputIds = [...(state.bundledInputIds ?? []), ...ids];
+        }
+        catch (error) {
+            console.warn(`[cez] bundled delivery checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** The turn that carried bundled messages has ended: the model read them. */
+    readBundledInputs(runId, state) {
+        const ids = state.bundledInputIds ?? [];
+        state.bundledInputIds = undefined;
+        if (!ids.length || state.cancelled)
+            return;
+        try {
+            this.store.commitAgentInputsConsumed(runId, ids, new Date().toISOString());
+            this.reconcileWorkerWaits();
+        }
+        catch (error) {
+            console.warn(`[cez] bundled read checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** #505: the session closed without reporting it read (failure, stop, exit): the input
+     * goes back to the queue so a later session delivers it; never shown as delivered. */
+    requeueUnreadAtClose(runId, state, session) {
+        this.clearUnreadInputTimer(state);
+        // Everything this session accepted but never saw read: steered input, messages bundled
+        // behind a human answer, and an opening instruction whose turn never succeeded.
+        const opening = state.openingAgentInputId && this.store.getRun(runId)?.agentInputs?.some(input => input.id === state.openingAgentInputId && input.deliveredAt && !input.consumedAt) ? [state.openingAgentInputId] : [];
+        const ids = [...new Set([...(state.unreadInputIds ?? []), ...(state.bundledInputIds ?? []), ...opening])];
+        if (!session || !ids.length || this.active.get(runId) !== state || state.session !== session)
+            return;
+        state.unreadInputIds?.clear();
+        state.bundledInputIds = undefined;
+        try {
+            this.store.requeueUnconsumedAgentInputs(runId, ids);
+        }
+        catch (error) {
+            console.warn(`[cez] agent input requeue failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** An idle, open boundary with nothing left to deliver: DONE closes, otherwise the
+     * run parks as waiting or monitoring. Shared by acknowledgements that land after a
+     * turn ended and by the unread-input grace timer (#505). */
+    settleIdleBoundary(runId, state, session) {
+        if (state.atTurnBoundary !== session || state.pendingHumanAsk || this.workerWait(runId) || this.store.getRun(runId)?.ciWait || this.hasQueuedAgentInputs(runId))
+            return;
+        if (state.doneAtBoundary === session) {
+            if (this.deferParentCompletion(runId))
+                return;
+            this.store.appendEvent(runId, { type: 'lifecycle', message: 'goal achieved — session closed' });
+            appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — goal achieved, session closed');
+            session.end();
+        }
+        else if (state.parkAfterAck?.session === session && !this.waiting.has(runId) && !this.monitoring.has(runId)) {
+            // A wake turn can finish before its HTTP/RPC acknowledgement. Retiring
+            // that wait must release its completed turn, not invent another turn.
+            if ((state.parkAfterAck.monitoring || this.hasLiveWorkers(runId)) && !this.parentCompletionAttention(runId)) {
+                this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
+                if (state.currentStepId)
+                    this.store.updateStep(runId, state.currentStepId, { status: 'running' });
+                this.monitoring.add(runId);
+                this.clearIdleTimer(state);
+                this.armMonitoringWakeTimer(runId, state);
+            }
+            else {
+                this.store.updateRun(runId, { status: 'waiting', activity: undefined });
+                if (state.currentStepId)
+                    this.store.updateStep(runId, state.currentStepId, { status: 'waiting' });
+                this.store.flush(); // Match ordinary turn-end durability before releasing capacity.
+                this.armIdleTimer(runId, state);
+            }
+            this.waiting.add(runId);
+            this.releaseSlot();
+        }
+    }
+    /** #505 liveness bound: a harness that accepted input and then neither read it nor ran
+     * another turn must not hold the run and its slot forever. After a quiet grace window the
+     * input is resubmitted once; after a second it is left delivered but unconfirmed. */
+    armUnreadInputTimer(runId, state) {
+        this.clearUnreadInputTimer(state);
+        const session = state.session;
+        if (!session?.open || !this.harnessOwesInput(state) || state.agentInputFlight)
+            return;
+        const timer = setTimeout(() => {
+            state.unreadInputTimer = undefined;
+            if (this.disposed || this.active.get(runId) !== state || state.session !== session || !session.open || state.cancelled ||
+                state.agentInputFlight || !this.harnessOwesInput(state))
+                return;
+            const ids = [...state.unreadInputIds];
+            const retried = ids.filter(id => state.unreadRetried?.has(id));
+            const fresh = ids.filter(id => !state.unreadRetried?.has(id));
+            if (retried.length) {
+                for (const id of retried)
+                    state.unreadInputIds?.delete(id);
+                try {
+                    this.store.commitAgentInputsUnconfirmed(runId, retried);
+                }
+                catch { /* receipt stays awaiting; a restart replays it */ }
+                this.store.appendEvent(runId, { type: 'note', message: `delivered ${retried.length} message${retried.length === 1 ? '' : 's'}; the agent did not confirm reading ${retried.length === 1 ? 'it' : 'them'}` });
+            }
+            if (fresh.length) {
+                state.unreadRetried ??= new Set();
+                for (const id of fresh)
+                    state.unreadRetried.add(id);
+                this.retireUnreadInputs(runId, state, fresh, true);
+            }
+            // No content since the last turn ended: the harness is idle, whatever turn it announced.
+            if (!this.harnessOwesInput(state) && !state.agentInputFlight) {
+                state.atTurnBoundary = session;
+                if (state.parkAfterAck?.session !== session)
+                    state.parkAfterAck = { session, monitoring: false };
+                this.settleIdleBoundary(runId, state, session);
+            }
+        }, this.unreadInputGraceMs);
+        timer.unref?.();
+        state.unreadInputTimer = timer;
+    }
+    clearUnreadInputTimer(state) {
+        if (state.unreadInputTimer)
+            clearTimeout(state.unreadInputTimer);
+        state.unreadInputTimer = undefined;
+    }
+    /** #505: the harness accepted input this session has not reported reading yet. */
+    harnessOwesInput(state) {
+        return !!state?.unreadInputIds?.size;
     }
     /** A callback from an old/replaced/disposed session carries no authority. */
     handleAgentInputReady(runId, state, session) {
@@ -3444,7 +3951,7 @@ export class RunManager {
         };
         let acknowledgement;
         try {
-            acknowledgement = session.sendAgentMessage(content);
+            acknowledgement = session.sendAgentMessage(content, inputIds);
         }
         catch (error) {
             fail(error, false);
@@ -3477,8 +3984,25 @@ export class RunManager {
                     }
                     else {
                         const deliveredAt = new Date().toISOString();
-                        this.store.commitAgentInputs(runId, queue.map(input => inputIds.includes(input.id) && !input.deliveredAt
-                            ? { ...input, deliveredAt } : input));
+                        // An observable harness still owes a read: mark it so a restart replays it (#505).
+                        const awaiting = state.inputDelivery?.consumption === 'observable' ? { awaitingRead: true } : {};
+                        // Input the harness reported unread while this very POST was pending stays queued:
+                        // the flush after this acknowledgement resubmits it (#505 review).
+                        const accepted = inputIds.filter(id => !state.retiredInFlight?.has(id));
+                        for (const id of inputIds)
+                            state.retiredInFlight?.delete(id);
+                        this.store.commitAgentInputs(runId, queue.map(input => accepted.includes(input.id) && !input.deliveredAt
+                            ? { ...input, deliveredAt, ...awaiting } : input));
+                        if (state.inputDelivery?.consumption === 'observable') {
+                            const early = accepted.filter(id => state.consumedBeforeAck?.has(id));
+                            for (const id of accepted)
+                                if (!early.includes(id))
+                                    state.unreadInputIds?.add(id);
+                            for (const id of early)
+                                state.consumedBeforeAck?.delete(id);
+                            if (early.length)
+                                this.store.commitAgentInputsConsumed(runId, early, deliveredAt);
+                        }
                     }
                     if (inputIds.includes(this.workerWait(runId)?.wakeId ?? ''))
                         this.withdrawWorkerWait(runId);
@@ -3495,38 +4019,13 @@ export class RunManager {
             state.agentInputFlight = undefined;
             if (!authorized || !session.open || state.agentSessionError || state.agentInputError)
                 return;
+            // A liveness resubmission gets its own quiet window, and so does input acknowledged
+            // after its turn already ended: no later turn-end would arm one (#505 review).
+            if (inputIds.some(id => state.unreadRetried?.has(id)) || state.atTurnBoundary === session)
+                this.armUnreadInputTimer(runId, state);
             if (this.flushAgentInputs(runId))
                 return;
-            if (state.atTurnBoundary !== session || state.pendingHumanAsk || this.workerWait(runId) || this.store.getRun(runId)?.ciWait || this.hasQueuedAgentInputs(runId))
-                return;
-            if (state.doneAtBoundary === session) {
-                if (this.deferParentCompletion(runId))
-                    return;
-                this.store.appendEvent(runId, { type: 'lifecycle', message: 'goal achieved — session closed' });
-                appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — goal achieved, session closed');
-                session.end();
-            }
-            else if (state.parkAfterAck?.session === session && !this.waiting.has(runId) && !this.monitoring.has(runId)) {
-                // A wake turn can finish before its HTTP/RPC acknowledgement. Retiring
-                // that wait must release its completed turn, not invent another turn.
-                if ((state.parkAfterAck.monitoring || this.hasLiveWorkers(runId)) && !this.parentCompletionAttention(runId)) {
-                    this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
-                    if (state.currentStepId)
-                        this.store.updateStep(runId, state.currentStepId, { status: 'running' });
-                    this.monitoring.add(runId);
-                    this.clearIdleTimer(state);
-                    this.armMonitoringWakeTimer(runId, state);
-                }
-                else {
-                    this.store.updateRun(runId, { status: 'waiting', activity: undefined });
-                    if (state.currentStepId)
-                        this.store.updateStep(runId, state.currentStepId, { status: 'waiting' });
-                    this.store.flush(); // Match ordinary turn-end durability before releasing capacity.
-                    this.armIdleTimer(runId, state);
-                }
-                this.waiting.add(runId);
-                this.releaseSlot();
-            }
+            this.settleIdleBoundary(runId, state, session);
         }).catch(error => {
             // Bookkeeping failures cannot become unhandled promise rejections.
             if (state.agentInputFlight === undefined)
@@ -3561,10 +4060,9 @@ export class RunManager {
             return false;
         if (state.pendingHumanAsk || this.hasUnansweredHumanAsk(runId))
             return false;
-        // The opening prompt already carries this input. It must not be resubmitted
-        // by a readiness callback before the first successful turn checkpoints it.
-        if (state.openingAgentInputId)
-            return false;
+        // The opening prompt already carries its own input; later input steers the
+        // opening turn instead of waiting for it to end (#505).
+        const queue = (run.agentInputs ?? []).filter(input => input.id !== state.openingAgentInputId);
         if (run.ciWait) {
             if (!this.ciWakeAdmitted.has(runId) || state.atTurnBoundary !== state.session)
                 return false;
@@ -3572,7 +4070,7 @@ export class RunManager {
             const input = run.agentInputs?.find(entry => entry.id === run.ciWait?.wakeId && !entry.deliveredAt);
             return !!input && this.submitAgentInput(runId, state, [{ type: 'text', text: this.formatAgentInput(runId, input) }], [input.id]);
         }
-        const batch = agentInputBatch(run.agentInputs ?? [], input => this.formatAgentInput(runId, input));
+        const batch = agentInputBatch(queue, input => this.formatAgentInput(runId, input));
         return !!batch && this.submitAgentInput(runId, state, [{ type: 'text', text: batch.text }], batch.inputs.map(input => input.id));
     }
     formatAgentInput(runId, input) {
@@ -3669,6 +4167,10 @@ export class RunManager {
             return false;
         if (!userAuthored && run.ciWait)
             return false;
+        if (userAuthored && this.routedAsk(runId)) {
+            this.store.appendEvent(runId, { type: 'note', tone: 'warning', message: ROUTED_QUESTION_REFUSAL });
+            return false;
+        }
         const text = content
             .filter((b) => b.type === 'text')
             .map((b) => b.text)
@@ -3700,7 +4202,11 @@ export class RunManager {
             ? [...expanded, pastedAttachmentsNote(persisted)]
             : expanded.length ? expanded : [{ type: 'text', text: 'The user attached a document, but it could not be saved. Ask them to attach it again before discussing its contents.' }];
         const answeringAskSeq = userAuthored ? this.pendingHumanAskSeq(runId) : undefined;
-        const delivered = userAuthored ? state.session.sendMessage(deliverable)
+        // #505: an answer that opens a new turn (a CEZ:ASK answer at a boundary) carries the
+        // held conversation messages in the same submission, after the answer.
+        const bundle = userAuthored && answeringAskSeq !== undefined && state.atTurnBoundary === state.session
+            ? this.pendingConversationBatch(runId, state) : undefined;
+        const delivered = userAuthored ? state.session.sendMessage(bundle ? [...deliverable, { type: 'text', text: bundle.text }] : deliverable)
             : this.submitAgentInput(runId, state, deliverable);
         if (delivered) {
             if (userAuthored) {
@@ -3710,6 +4216,12 @@ export class RunManager {
                     this.store.appendEvent(runId, { type: 'human-input-delivered', askSeq: answeringAskSeq });
                 }
                 state.pendingHumanAsk = this.hasPendingHumanAsk(runId);
+                if (bundle)
+                    this.commitBundledDelivery(runId, state, bundle.inputs.map(input => input.id));
+                // A native answer continues the turn, and a bundle can leave messages that did not
+                // fit its batch: either way the rest steer right behind the answer.
+                if (answeringAskSeq !== undefined && !state.pendingHumanAsk)
+                    this.flushAgentInputs(runId);
             }
             this.resumeParkedRun(runId, state);
         }
@@ -3831,7 +4343,7 @@ export class RunManager {
             return { ok: false, error: 'run is still stopping' };
         if (this.historyDeletionPending(runId))
             return { ok: false, error: 'Parent history deletion is pending; retry deletion' };
-        if (run.delegation?.role === 'worker' && this.store.getRun(run.delegation.parentRunId)?.status === 'review') {
+        if (run.delegation?.role === 'worker' && this.store.getRun(run.delegation.parentRunId)?.status === 'review' && !opts.answerInputId && !this.answersFallenBackAsk(runId, opts, deferForCapacity)) {
             return { ok: false, error: 'Continue the reviewing parent before continuing its worker' };
         }
         // Held against the identity of the step this continuation extends (#452), which for a mixed
@@ -3866,8 +4378,10 @@ export class RunManager {
             return { ok: false, error: 'worker cannot continue' };
         if (this.executionBlockedByRootFinish(run))
             return { ok: false, error: 'parent finish is pending' };
+        if (pendingHumanAsk && !deferForCapacity && !opts.answerInputId && this.routedAsk(runId))
+            return { ok: false, error: ROUTED_QUESTION_REFUSAL };
         const answers = deferForCapacity ? [run.continuationMessage, ...(run.queuedMessages ?? [])] : [opts];
-        if (pendingHumanAsk && (conversation || (deferForCapacity && run.continuationMessage?.origin !== 'human') ||
+        if (pendingHumanAsk && !opts.answerInputId && (conversation || (deferForCapacity && run.continuationMessage?.origin !== 'human') ||
             !answers.some(answer => answer?.text?.trim() || answer?.images?.length))) {
             return { ok: false, error: 'pending human question requires an explicit answer' };
         }
@@ -4015,7 +4529,7 @@ export class RunManager {
         const continuationStep = { id: stepId, name: 'Continue', kind: 'agent', synthetic: 'continuation' };
         if (run.delegation?.role !== 'worker')
             this.store.addStep(runId, continuationStep);
-        const recovered = deferForCapacity && !conversation ? run.continuationMessage : undefined;
+        const recovered = deferForCapacity && !conversation && !opts.answerInputId ? run.continuationMessage : undefined;
         const message = recovered ?? this.toQueuedMessage(runId, [
             ...(opts.text?.trim() ? [{ type: 'text', text: opts.text.trim() }] : []),
             ...(opts.images ?? []),
@@ -4025,8 +4539,9 @@ export class RunManager {
         // and the original prompt/URLs must reach disk before the first startup await.
         const acceptedPatch = {
             continuationMessage: { ...message, id: stepId, text: prompt,
-                ...(conversation ? { agentInputId: conversation.input.id } : {}),
-                origin: recovered ? recovered.origin : deferForCapacity ? 'lifecycle' : 'human' },
+                ...(conversation ? { agentInputId: conversation.input.id } : opts.answerInputId ? { agentInputId: opts.answerInputId } : {}),
+                // A parent's answer (#505) answers the ask exactly like a human's.
+                origin: recovered ? recovered.origin : deferForCapacity && !opts.answerInputId ? 'lifecycle' : 'human' },
             status: deferForCapacity ? 'queued' : 'running',
             error: undefined,
             finishedAt: undefined,
@@ -4203,12 +4718,15 @@ export class RunManager {
         const openingInput = record?.agentInputs?.find(input => input.id === checkpoint?.agentInputId);
         // Hydration has already included later human updates and task edits. Append
         // the current obligation outcome without replacing that composed prompt.
-        if (openingInput)
+        // A parent's answer to a routed question (#505) is shown as its conversation reply, not
+        // as a human message, and its own reply outcome is not news to the worker.
+        const parentAnswer = openingInput?.conversation?.kind === 'reply' && this.routedAsk(runId) !== undefined;
+        if (openingInput && !parentAnswer)
             prompt += this.agentInputOutcomeText(openingInput);
         const saved = this.readPersistedAttachments(runId, checkpoint?.id === stepId ? checkpoint.images ?? [] : [], 'continuation');
         const openingImages = [...(images.length ? contentBlocksOf(images) : saved.blocks), ...persistedImages];
         const attachments = [...saved.attachments, ...persistedAttachments];
-        if (checkpoint?.origin !== 'lifecycle')
+        if (checkpoint?.origin !== 'lifecycle' && !parentAnswer)
             this.store.appendEvent(runId, {
                 type: 'user-message',
                 stepId,
@@ -4238,12 +4756,19 @@ export class RunManager {
                 return;
             }
             if (event.type === 'text') {
+                this.clearUnreadInputTimer(state); // real content: the harness is working
                 turnText = appendTurnText(turnText, event.text);
                 const text = stripAskMarker(stripTaskMarkers(stripMonitoringMarker(stripDoneMarker(event.text))), false);
                 if (text)
                     this.store.appendEvent(runId, { type: 'text', text, stepId });
                 return;
             }
+            if (event.type === 'input-unconsumed') {
+                this.retireUnreadInputs(runId, state, event.inputIds, true);
+                return;
+            }
+            if (event.type === 'tool-call' || event.type === 'tool-result')
+                this.clearUnreadInputTimer(state);
             this.store.appendEvent(runId, { ...event, stepId });
             if (event.type === 'error') {
                 // Preserve the initiating fault: interrupt may fail an in-flight HTTP request.
@@ -4267,6 +4792,8 @@ export class RunManager {
             if (isClaudeScheduleWakeup(event, backend))
                 sawClaudeScheduleWakeup = true;
             if (event.type === 'turn-end') {
+                this.retireUnreadInputs(runId, state, event.unconsumedInputIds ?? [], false);
+                this.readBundledInputs(runId, state);
                 state.workerWakeTurn = undefined;
                 state.ciWakeTurn = undefined;
                 state.atTurnBoundary = state.session;
@@ -4278,7 +4805,13 @@ export class RunManager {
                         const id = state.openingAgentInputId;
                         const deliveredAt = new Date().toISOString();
                         try {
-                            this.store.commitAgentInputs(runId, (this.store.getRun(runId)?.agentInputs ?? []).map(input => input.id === id && !input.deliveredAt ? { ...input, deliveredAt } : input), id);
+                            // The successful opening turn handled its instruction: delivered and read (#505).
+                            this.store.commitAgentInputs(runId, (this.store.getRun(runId)?.agentInputs ?? []).map(input => {
+                                if (input.id !== id)
+                                    return input;
+                                const { awaitingRead: _awaiting, ...handled } = input;
+                                return { ...handled, deliveredAt: input.deliveredAt ?? deliveredAt, consumedAt: input.consumedAt ?? deliveredAt };
+                            }), id);
                         }
                         catch (error) {
                             state.agentInputError = `agent input delivery checkpoint failed: ${error instanceof Error ? error.message : String(error)}`;
@@ -4299,7 +4832,7 @@ export class RunManager {
                         this.reconcileWorkerWaits();
                     }
                     if (openingAnswerAskSeq !== undefined && state.session?.open) {
-                        this.store.appendEvent(runId, { type: 'human-input-delivered', askSeq: openingAnswerAskSeq });
+                        this.store.appendEvent(runId, { type: 'human-input-delivered', askSeq: openingAnswerAskSeq, ...(parentAnswer ? { source: 'parent' } : {}) });
                         openingAnswerAskSeq = undefined;
                         state.openingAnswerAskSeq = undefined;
                     }
@@ -4337,7 +4870,11 @@ export class RunManager {
                 const workerWaitParked = ciWaitParked || completionBlocked || (!!sessionOpen && this.parkWorkerWait(runId, state));
                 state.doneAtBoundary = done ? state.session : undefined;
                 state.parkAfterAck = sessionOpen && state.session ? { session: state.session, monitoring: !!monitoring } : undefined;
-                const agentInputDelivered = !ask && !workerWaitParked && this.flushAgentInputs(runId);
+                // #505: input the harness accepted but has not read yet runs as its next turn.
+                // An in-flight submission is settled by its acknowledgement (parkAfterAck), not here.
+                const agentInputDelivered = !ask && !workerWaitParked && (this.flushAgentInputs(runId) || this.harnessOwesInput(state) || !!state.agentInputFlight);
+                if (!ask && !workerWaitParked)
+                    this.armUnreadInputTimer(runId, state);
                 if (state.agentInputError)
                     return;
                 if (done && !workerWaitParked && !state.pendingHumanAsk && !agentInputDelivered && !state.agentInputFlight && !this.hasQueuedAgentInputs(runId)) {
@@ -4373,8 +4910,10 @@ export class RunManager {
                         // `ScheduleWakeup` → non-attention `running`/`activity:'monitoring'`
                         // (#490, #46). Both free the slot; only genuine user waits keep the
                         // idle timer. The autonomous nudge above still wins over either.
-                        if (ask)
+                        if (ask) {
                             emitAskRequested(sink, ask);
+                            this.routeWorkerQuestion(runId);
+                        }
                         if (monitoring) {
                             this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
                             this.store.updateStep(runId, stepId, { status: 'running' });
@@ -4511,11 +5050,14 @@ export class RunManager {
             failBeforeSpawn(err.message);
             return;
         }
-        if (state.cancelled) {
+        const settlePrelaunchCancellation = () => {
             this.store.updateStep(runId, stepId, { status: 'cancelled' });
             this.store.updateRun(runId, { status: 'cancelled', finishedAt: new Date().toISOString(), currentStepId: undefined });
             this.clearAutosaveTimer(state);
             this.dropActive(runId);
+        };
+        if (state.cancelled) {
+            settlePrelaunchCancellation();
             return;
         }
         if (this.holdContinuationForRootFinish(runId, { stepId, sessionId, backend, prompt, images }, state))
@@ -4540,12 +5082,36 @@ export class RunManager {
         }
         const delegation = this.provisionSession(runId, state);
         const ciTools = await this.provisionCiSession(runId, state);
+        // Stop/Finish can arrive while the local tool controller is starting.
+        const launchRun = this.store.getRun(runId);
+        if (state.cancelled || this.workerExecutionStopped(runId) || this.active.get(runId) !== state ||
+            (launchRun && this.executionBlockedByRootFinish(launchRun))) {
+            ciTools?.revoke();
+            if (state.revokeCiTools === ciTools?.revoke)
+                state.revokeCiTools = undefined;
+            delegation?.revoke();
+            if (state.revokeDelegation === delegation?.revoke)
+                state.revokeDelegation = undefined;
+            if (this.active.get(runId) !== state)
+                return;
+            if (state.cancelled || this.workerExecutionStopped(runId)) {
+                state.cancelled = true;
+                settlePrelaunchCancellation();
+            }
+            else {
+                this.holdContinuationForRootFinish(runId, { stepId, sessionId, backend, prompt, images }, state);
+            }
+            return;
+        }
+        state.inputDelivery = inputDeliveryOf(runner);
+        state.unreadInputIds = new Set();
+        state.consumedBeforeAck = new Set();
         try {
             session = runner.startSession({
                 // The Continue step is a fresh agent session on the same run — the
                 // run's extra system prompt (already resolved at execute time and
                 // echoed on the record) rides along with the handoff contract.
-                systemPrompt: composeSystemPrompt(record?.systemPrompt, delegation?.instructions, generateFollowups ? HANDOFF_INSTRUCTIONS : HANDOFF_ONLY_INSTRUCTIONS),
+                systemPrompt: composeSystemPrompt(record?.systemPrompt, delegation?.instructions, artifactInstructions(continueProfile.env.CEZ_ARTIFACTS_DIR), generateFollowups ? HANDOFF_INSTRUCTIONS : HANDOFF_ONLY_INSTRUCTIONS),
                 userPrompt: attachments.length
                     ? `${openingPrompt}\n\n${pastedAttachmentsText(attachments)}`
                     : openingPrompt,
@@ -4565,9 +5131,12 @@ export class RunManager {
             }, onEvent, {
                 onUiEvent: (event) => {
                     completedAssistantText = appendCompletedAssistantText(completedAssistantText, event);
+                    if (event.type === 'turn.started')
+                        this.recordOpeningAccepted(runId, state);
                     this.handleRunnerUiEvent(runId, state, sink, event);
                 },
                 onAgentInputReady: () => this.handleAgentInputReady(runId, state, session),
+                onAgentInputConsumed: (ids) => this.handleAgentInputConsumed(runId, state, session, ids),
             });
         }
         catch (error) {
@@ -4589,7 +5158,7 @@ export class RunManager {
             if (session.pid !== undefined)
                 registerRunProcess(runId, session.pid);
             setupComplete = true;
-            const result = await session.result.finally(() => state.agentInputFlight?.settled);
+            const result = await session.result.finally(() => state.agentInputFlight?.settled).finally(() => this.requeueUnreadAtClose(runId, state, session));
             if (this.preserveRunAfterDisposal(runId, state))
                 return;
             this.persistWorkerAssistantResult(runId, stepId, result.text);
@@ -4978,6 +5547,11 @@ export class RunManager {
                 startImages = undefined;
                 startAttachments = [];
                 checkFailure = null;
+                // Stale setup cannot finalize a replacement owner. Disposal also clears
+                // active, but must still honor a previously accepted Stop/Finish intent.
+                if (this.active.get(runId) !== state &&
+                    !(this.disposed && (state.cancelled || state.finishRequested)))
+                    return;
                 if (state.cancelled || this.preserveRunAfterDisposal(runId, state))
                     break;
                 const current = this.store.getRun(runId);
@@ -5168,12 +5742,19 @@ export class RunManager {
                 return;
             }
             if (event.type === 'text') {
+                this.clearUnreadInputTimer(state); // real content: the harness is working
                 turnText = appendTurnText(turnText, event.text);
                 const text = stripAskMarker(stripTaskMarkers(stripMonitoringMarker(stripDoneMarker(event.text))), false);
                 if (text)
                     emit({ type: 'text', text, stepId: step.id });
                 return;
             }
+            if (event.type === 'input-unconsumed') {
+                this.retireUnreadInputs(runId, state, event.inputIds, true);
+                return;
+            }
+            if (event.type === 'tool-call' || event.type === 'tool-result')
+                this.clearUnreadInputTimer(state);
             emit({ ...event, stepId: step.id });
             if (event.type === 'error') {
                 // Preserve the initiating fault: interrupt may fail an in-flight HTTP request.
@@ -5198,6 +5779,8 @@ export class RunManager {
             if (isClaudeScheduleWakeup(event, backend))
                 sawClaudeScheduleWakeup = true;
             if (event.type === 'turn-end') {
+                this.retireUnreadInputs(runId, state, event.unconsumedInputIds ?? [], false);
+                this.readBundledInputs(runId, state);
                 state.workerWakeTurn = undefined;
                 state.ciWakeTurn = undefined;
                 state.atTurnBoundary = state.session;
@@ -5233,7 +5816,11 @@ export class RunManager {
                 const workerWaitParked = ciWaitParked || completionBlocked || (!!sessionOpen && this.parkWorkerWait(runId, state));
                 state.doneAtBoundary = done ? state.session : undefined;
                 state.parkAfterAck = interactive && sessionOpen && state.session ? { session: state.session, monitoring: !!monitoring } : undefined;
-                const agentInputDelivered = !ask && !workerWaitParked && this.flushAgentInputs(runId);
+                // #505: input the harness accepted but has not read yet runs as its next turn.
+                // An in-flight submission is settled by its acknowledgement (parkAfterAck), not here.
+                const agentInputDelivered = !ask && !workerWaitParked && (this.flushAgentInputs(runId) || this.harnessOwesInput(state) || !!state.agentInputFlight);
+                if (!ask && !workerWaitParked)
+                    this.armUnreadInputTimer(runId, state);
                 if (state.agentInputError)
                     return;
                 if (done && !workerWaitParked && !state.pendingHumanAsk && !agentInputDelivered && !state.agentInputFlight && !this.hasQueuedAgentInputs(runId)) {
@@ -5252,8 +5839,10 @@ export class RunManager {
                     // still working through `CEZ:MONITORING` or Claude's native
                     // `ScheduleWakeup`. Monitoring parks as `running` with no user-wait
                     // idle timer, so the cockpit stays non-attention (#490, #46).
-                    if (ask)
+                    if (ask) {
                         emitAskRequested(sink, ask);
+                        this.routeWorkerQuestion(runId);
+                    }
                     if (monitoring) {
                         this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
                         this.store.updateStep(runId, step.id, { status: 'running' });
@@ -5356,15 +5945,30 @@ export class RunManager {
         this.beginUsageInvocation(runId, state, step.id);
         const delegation = this.provisionSession(runId, state);
         const ciTools = await this.provisionCiSession(runId, state);
-        try {
-            if (this.workerExecutionStopped(runId)) {
+        // Revalidate after provisioning, then let execute settle cancellation or
+        // requeue a Finish-held step through its existing no-session paths.
+        const launchRun = this.store.getRun(runId);
+        if (state.cancelled || this.workerExecutionStopped(runId) || this.active.get(runId) !== state ||
+            (launchRun && this.executionBlockedByRootFinish(launchRun))) {
+            ciTools?.revoke();
+            if (state.revokeCiTools === ciTools?.revoke)
+                state.revokeCiTools = undefined;
+            delegation?.revoke();
+            if (state.revokeDelegation === delegation?.revoke)
+                state.revokeDelegation = undefined;
+            if (this.workerExecutionStopped(runId))
                 state.cancelled = true;
-                throw new Error('Worker stopped before launch');
-            }
+            state.currentStepId = undefined;
+            return null;
+        }
+        state.inputDelivery = inputDeliveryOf(runner);
+        state.unreadInputIds = new Set();
+        state.consumedBeforeAck = new Set();
+        try {
             session = runner.startSession({
                 // Skill body, then the run's extra prompt (POST override or config
                 // default), then the handoff/todos contract — every agent step.
-                systemPrompt: composeSystemPrompt(systemPrompt, extraSystemPrompt, delegation?.instructions, followupsEnabled() && input.generateFollowups !== false
+                systemPrompt: composeSystemPrompt(systemPrompt, extraSystemPrompt, delegation?.instructions, artifactInstructions(stepProfile.env.CEZ_ARTIFACTS_DIR), followupsEnabled() && input.generateFollowups !== false
                     ? HANDOFF_INSTRUCTIONS
                     : HANDOFF_ONLY_INSTRUCTIONS),
                 userPrompt,
@@ -5391,6 +5995,7 @@ export class RunManager {
                     this.handleRunnerUiEvent(runId, state, sink, event);
                 },
                 onAgentInputReady: () => this.handleAgentInputReady(runId, state, session),
+                onAgentInputConsumed: (ids) => this.handleAgentInputConsumed(runId, state, session, ids),
             });
         }
         catch (err) {
@@ -5421,7 +6026,7 @@ export class RunManager {
             if (session.pid !== undefined)
                 registerRunProcess(runId, session.pid);
             setupComplete = true;
-            const result = await session.result.finally(() => state.agentInputFlight?.settled);
+            const result = await session.result.finally(() => state.agentInputFlight?.settled).finally(() => this.requeueUnreadAtClose(runId, state, session));
             if (this.isDisposedDelegatedRun(runId))
                 return null;
             this.persistWorkerAssistantResult(runId, step.id, result.text);
@@ -5547,6 +6152,7 @@ export class RunManager {
             if (state.currentStepId)
                 this.store.updateStep(runId, state.currentStepId, { status: 'waiting' });
             this.releaseSlot();
+            this.routeWorkerQuestion(runId);
             return;
         }
         // Pi can resume autonomously when an async subagent completes — the mapper