@wjarka/cezarion 0.14.8 → 0.14.9-dev.1004

package/dist/task-cli/watch.js

@@ -0,0 +1,336 @@
+import { apiRunSchema, runHistoryPageSchema, runRecordSchema, } from '../contract/index.js';
+import { invalidResponse, refuse, request, TaskCliError } from './http.js';
+import { SUCCESS_STATUSES, TERMINAL_STATUSES } from './projections.js';
+/**
+ * Watching a task from a terminal (#504, spec 2026-09-24-cez-task-cli). Every loop here ends —
+ * on a terminal status or at the caller's deadline — because a bot's tool call that never
+ * returns is the failure this command family exists to prevent.
+ */
+export const DEFAULT_POLL_MS = 1_500;
+const MAX_FIELD_CHARS = 2_000;
+function entryFor(id, run) {
+    if (!run)
+        return { id, status: 'missing' };
+    return {
+        id,
+        status: run.status,
+        ...(run.activity === undefined ? {} : { activity: run.activity }),
+        hasPendingHumanAsk: run.hasPendingHumanAsk ?? false,
+    };
+}
+/** Settled = nothing more will happen without a human; `missing` counts, it will never change. */
+function isSettled(entry, until) {
+    if (entry.status === 'unknown')
+        return false;
+    if (entry.status === 'missing' || TERMINAL_STATUSES.includes(entry.status))
+        return true;
+    return until === 'attention' && (entry.status === 'waiting' || entry.hasPendingHumanAsk === true);
+}
+/** A failure is only a terminal non-success; stopping for attention is not one. */
+function isFailure(entry) {
+    return entry.status === 'missing' || entry.status === 'failed' || entry.status === 'cancelled';
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Grace for the millisecond race between a budget-bounded poll's abort and the
+ * deadline check (#538): `AbortSignal.timeout(budget)` can fire while
+ * `Date.now()` still reads just under the deadline, turning a timeout into an
+ * `unavailable` error (exit 2 instead of 3). A poll whose own abort consumed
+ * (almost) all of its budget failed *at* the deadline, so it answers "timed
+ * out". The grace never applies to other errors: a genuine failure stays
+ * `unavailable` even when it lands inside the grace window.
+ */
+export const TIMEOUT_GRACE_MS = 250;
+export function pollHitDeadline(startedAt, budgetMs, now = Date.now()) {
+    return now - startedAt >= budgetMs - TIMEOUT_GRACE_MS;
+}
+/**
+ * True when the wrapped cockpit error came from the poll's own abort (its
+ * budget running out) rather than a fast failure such as a refused
+ * connection. `fetchJson` folds every fetch failure into `unavailable`, so the
+ * abort surfaces only through the original message it preserves (`TimeoutError:
+ * The operation was aborted due to timeout`).
+ */
+export function abortedPoll(error) {
+    if (!(error instanceof TaskCliError))
+        return false;
+    const body = error.body;
+    return /abort|timeout/i.test(String(body.error ?? ''));
+}
+/**
+ * Polls `GET /runs`: one call covers any number of runs and holds no socket open. Each poll is
+ * bounded by what is left of the deadline, so a slow cockpit answers "timed out" on time rather
+ * than holding the caller for a full request timeout.
+ */
+export async function waitForRuns(cockpit, ids, options) {
+    const deadline = Date.now() + options.timeoutMs;
+    let entries = ids.map((id) => ({ id, status: 'unknown' }));
+    for (;;) {
+        const budget = deadline - Date.now();
+        if (budget <= 0)
+            return { exitCode: 3, runs: entries, timedOut: true };
+        const pollStart = Date.now();
+        let result;
+        try {
+            result = await request(cockpit, '/runs', { timeoutMs: budget });
+        }
+        catch (error) {
+            if (Date.now() >= deadline)
+                return { exitCode: 3, runs: entries, timedOut: true };
+            if (abortedPoll(error) && pollHitDeadline(pollStart, budget))
+                return { exitCode: 3, runs: entries, timedOut: true };
+            throw error;
+        }
+        if (result.status !== 200)
+            refuse(result);
+        const runs = apiRunSchema.array().safeParse(result.data);
+        if (!runs.success)
+            invalidResponse('run list');
+        const byId = new Map(runs.data.map((run) => [run.id, run]));
+        entries = ids.map((id) => entryFor(id, byId.get(id)));
+        const settled = entries.filter((entry) => isSettled(entry, options.until));
+        const done = options.mode === 'any' ? settled.length > 0 : settled.length === entries.length;
+        if (done) {
+            const judged = options.mode === 'any' ? settled : entries;
+            return { exitCode: judged.some(isFailure) && (options.mode === 'all' || judged.every(isFailure)) ? 1 : 0, runs: entries, timedOut: false };
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            return { exitCode: 3, runs: entries, timedOut: true };
+        await sleep(Math.min(options.pollMs ?? DEFAULT_POLL_MS, remaining));
+    }
+}
+const LOG_TYPES = new Set(['text', 'tool-call', 'tool-result', 'step-start', 'error', 'user-message']);
+function clip(value) {
+    if (value === undefined)
+        return undefined;
+    const text = typeof value === 'string' ? value : JSON.stringify(value);
+    return text.length > MAX_FIELD_CHARS ? `${text.slice(0, MAX_FIELD_CHARS - 1)}…` : text;
+}
+/** One printable line per event the log keeps, or undefined for the rest. */
+export function logLine(event) {
+    if (!LOG_TYPES.has(event.type))
+        return undefined;
+    const fields = {
+        seq: event.seq,
+        ts: event.ts,
+        type: event.type,
+        ...(event.stepId === undefined ? {} : { stepId: event.stepId }),
+    };
+    switch (event.type) {
+        case 'text':
+        case 'user-message':
+            fields.text = clip(event.text);
+            break;
+        case 'tool-call':
+            fields.tool = event.tool;
+            fields.input = clip(event.input);
+            break;
+        case 'tool-result':
+            fields.result = clip(event.result);
+            break;
+        case 'step-start':
+            fields.name = event.name;
+            if (event.iteration !== undefined)
+                fields.iteration = event.iteration;
+            break;
+        case 'error':
+            fields.message = clip(event.message);
+            break;
+    }
+    return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
+}
+/** Keeps the newest lines within `maxChars` (counting the newline between lines). */
+class LineTail {
+    maxChars;
+    lines = [];
+    size = 0;
+    constructor(maxChars) {
+        this.maxChars = maxChars;
+    }
+    push(line) {
+        this.lines.push(line);
+        this.size += line.length + (this.lines.length > 1 ? 1 : 0);
+        while (this.size > this.maxChars && this.lines.length) {
+            const dropped = this.lines.shift();
+            this.size -= dropped.length + (this.lines.length ? 1 : 0);
+        }
+    }
+    drain() {
+        const lines = this.lines;
+        this.lines = [];
+        this.size = 0;
+        return lines;
+    }
+}
+/** Minimal SSE framing: `event:` / `data:` fields, blank-line separated. */
+async function* sseFrames(body) {
+    const decoder = new TextDecoder();
+    let buffer = '';
+    for await (const chunk of body) {
+        buffer += decoder.decode(chunk, { stream: true }).replace(/\r\n/g, '\n');
+        let boundary;
+        while ((boundary = buffer.indexOf('\n\n')) >= 0) {
+            const block = buffer.slice(0, boundary);
+            buffer = buffer.slice(boundary + 2);
+            let event = 'message';
+            const data = [];
+            for (const line of block.split('\n')) {
+                if (line.startsWith('event:'))
+                    event = line.slice(6).trim();
+                else if (line.startsWith('data:'))
+                    data.push(line.slice(5).replace(/^ /, ''));
+            }
+            yield { event, data: data.join('\n') };
+        }
+    }
+}
+/**
+ * `log`, read from the run's SSE stream, which replays every event after `afterSeq` and then
+ * streams live. The route subscribes to live `run` updates BEFORE it replays, so a `run` frame
+ * says nothing about where the replay is; the only reliable boundary is a `seq`. So:
+ *
+ * - the replay ends at `asOfSeq`, the event file's high-water mark read from `GET /history` just
+ *   before connecting — everything up to it is the tail, bounded to `maxChars`, and without
+ *   `follow` the command ends there;
+ * - with `follow`, a terminal status ends the command only once the stream has caught up with a
+ *   SECOND high-water read taken after that status arrived, so events the engine wrote just
+ *   before finishing are not dropped when the status frame overtakes them (exit 0/1, final line
+ *   is the status).
+ *
+ * One `deadline` bounds every request, the history reads included (exit 3). Deduped by `seq`.
+ * The stream rather than `GET /history` pages: a history page starts at its first transcript
+ * item, so it drops lifecycle events such as the opening `step-start`.
+ */
+export async function readLog(cockpit, id, options) {
+    const tail = new LineTail(options.maxChars);
+    const remaining = () => options.deadline - Date.now();
+    let lastSeq = options.afterSeq;
+    let seenSeq = options.afterSeq;
+    let status;
+    let drainSeq;
+    /** The event file's high-water mark, or undefined once the deadline has passed. */
+    const highWater = async () => {
+        const budget = remaining();
+        if (budget <= 0)
+            return undefined;
+        const startedAt = Date.now();
+        let history;
+        try {
+            history = await request(cockpit, `/runs/${encodeURIComponent(id)}/history`, { timeoutMs: budget });
+        }
+        catch (error) {
+            if (remaining() <= 0)
+                return undefined;
+            if (abortedPoll(error) && pollHitDeadline(startedAt, budget))
+                return undefined;
+            throw error;
+        }
+        if (history.status !== 200)
+            refuse(history);
+        const page = runHistoryPageSchema.safeParse(history.data);
+        return page.success ? page.data.asOfSeq : invalidResponse('history');
+    };
+    const boundarySeq = await highWater();
+    if (boundarySeq === undefined)
+        return timedOut();
+    let replaying = boundarySeq > options.afterSeq;
+    if (!replaying && !options.follow)
+        return 0;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), Math.max(remaining(), 0));
+    try {
+        let response;
+        try {
+            response = await fetch(`${cockpit.api}/runs/${encodeURIComponent(id)}/events?afterSeq=${lastSeq}`, {
+                redirect: 'error', signal: controller.signal, headers: { accept: 'text/event-stream' },
+            });
+        }
+        catch (error) {
+            if (controller.signal.aborted)
+                return timedOut();
+            throw new TaskCliError(2, { code: 'unavailable', error: `cockpit request failed: ${error instanceof Error ? error.message : String(error)}` });
+        }
+        if (!response.ok || !response.body) {
+            const text = await response.text().catch(() => '');
+            let data = text;
+            try {
+                data = JSON.parse(text);
+            }
+            catch { /* not JSON */ }
+            refuse({ status: response.status, data });
+        }
+        try {
+            for await (const frame of sseFrames(response.body)) {
+                if (frame.event === 'run-event' || frame.event === 'ui-event') {
+                    const event = JSON.parse(frame.data);
+                    if (typeof event.seq !== 'number')
+                        continue;
+                    // Both streams share the file's seq space, so either one can reach a boundary;
+                    // only v1 lines are printed, deduped by seq.
+                    seenSeq = Math.max(seenSeq, event.seq);
+                    if (frame.event === 'run-event' && event.seq > lastSeq) {
+                        lastSeq = event.seq;
+                        const line = logLine(event);
+                        if (line) {
+                            if (replaying)
+                                tail.push(JSON.stringify(line));
+                            else
+                                options.print(JSON.stringify(line));
+                        }
+                    }
+                }
+                else if (frame.event === 'run') {
+                    const run = runRecordSchema.safeParse(JSON.parse(frame.data));
+                    if (run.success)
+                        status = run.data.status;
+                }
+                let exit = step();
+                if (exit === 'drain') {
+                    drainSeq = await highWater();
+                    if (drainSeq === undefined)
+                        return timedOut();
+                    exit = step();
+                }
+                if (typeof exit === 'number')
+                    return exit;
+            }
+        }
+        catch (error) {
+            if (!controller.signal.aborted)
+                throw error;
+        }
+        if (controller.signal.aborted)
+            return timedOut();
+        throw new TaskCliError(2, { code: 'unavailable', error: 'the cockpit closed the event stream' });
+    }
+    finally {
+        clearTimeout(timer);
+        controller.abort();
+    }
+    /** Ends the replay at its boundary; then a terminal status ends the command once drained. */
+    function step() {
+        if (replaying && seenSeq >= boundarySeq) {
+            replaying = false;
+            for (const line of tail.drain())
+                options.print(line);
+            if (!options.follow)
+                return 0;
+        }
+        if (replaying || status === undefined || !TERMINAL_STATUSES.includes(status))
+            return undefined;
+        if (drainSeq === undefined)
+            return 'drain';
+        if (seenSeq < drainSeq)
+            return undefined;
+        options.print(JSON.stringify({ id, status, timedOut: false }));
+        return SUCCESS_STATUSES.includes(status) ? 0 : 1;
+    }
+    function timedOut() {
+        for (const line of tail.drain())
+            options.print(line);
+        options.print(JSON.stringify({ id, ...(status === undefined ? {} : { status }), timedOut: true }));
+        return 3;
+    }
+}
+//# sourceMappingURL=watch.js.map

package/dist/task-cli/watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../src/task-cli/watch.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAIhB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAgB,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEvE;;;;GAIG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,eAAe,GAAG,KAAK,CAAC;AAmB9B,SAAS,QAAQ,CAAC,EAAU,EAAE,GAAuB;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC3C,OAAO;QACL,EAAE;QACF,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,KAAK;KACpD,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,SAAS,CAAC,KAAgB,EAAE,KAAgB;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,KAAK,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,KAAgB;IACjC,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC;AACjG,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,QAAgB,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IAC3F,OAAO,GAAG,GAAG,SAAS,IAAI,QAAQ,GAAG,gBAAgB,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAA2B,CAAC;IAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,GAAa,EACb,OAAiF;IAEjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAChD,IAAI,OAAO,GAAgB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACxE,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,MAAM,IAAI,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAClF,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;QAC7F,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7I,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;AAEvG,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CAAC,KAAsB;IAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;IACF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC;QACZ,KAAK,cAAc;YACjB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM;QACR,KAAK,WAAW;YACd,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACzB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM;QACR,KAAK,aAAa;YAChB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM;QACR,KAAK,YAAY;YACf,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACzB,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACtE,MAAM;QACR,KAAK,OAAO;YACV,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,qFAAqF;AACrF,MAAM,QAAQ;IAGiB,QAAQ;IAF7B,KAAK,GAAa,EAAE,CAAC;IACrB,IAAI,GAAG,CAAC,CAAC;IACjB,YAA6B,QAAgB;wBAAhB,QAAQ;IAAW,CAAC;IACjD,IAAI,CAAC,IAAY;QACf,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAG,CAAC;YACpC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,KAAK;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAID,4EAA4E;AAC5E,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAgC;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,QAAgB,CAAC;QACrB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,KAAK,GAAG,SAAS,CAAC;YACtB,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACvD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAgB,EAChB,EAAU,EACV,OAAiH;IAEjH,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtD,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC/B,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC/B,IAAI,MAA6B,CAAC;IAClC,IAAI,QAA4B,CAAC;IAEjC,mFAAmF;IACnF,MAAM,SAAS,GAAG,KAAK,IAAiC,EAAE;QACxD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,MAAM,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,SAAS,kBAAkB,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,EAAE,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACvC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/E,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,SAAS,EAAE,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,QAAQ,EAAE,CAAC;IACjD,IAAI,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC/C,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,SAAS,kBAAkB,CAAC,EAAE,CAAC,oBAAoB,OAAO,EAAE,EAAE;gBACjG,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;aACvF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,YAAY,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACjJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,GAAY,IAAI,CAAC;YACzB,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YACzD,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;oBACxD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;wBAAE,SAAS;oBAC5C,+EAA+E;oBAC/E,6CAA6C;oBAC7C,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;oBACvC,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;wBACvD,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;wBACpB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;wBAC5B,IAAI,IAAI,EAAE,CAAC;4BACT,IAAI,SAAS;gCAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;;gCAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;wBAC3C,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBACjC,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC9D,IAAI,GAAG,CAAC,OAAO;wBAAE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC5C,CAAC;gBACD,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;gBAClB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBACrB,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC;oBAC7B,IAAI,QAAQ,KAAK,SAAS;wBAAE,OAAO,QAAQ,EAAE,CAAC;oBAC9C,IAAI,GAAG,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,KAAK,CAAC;QAC9C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,YAAY,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;IACnG,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,6FAA6F;IAC7F,SAAS,IAAI;QACX,IAAI,SAAS,IAAI,OAAO,IAAI,WAAY,EAAE,CAAC;YACzC,SAAS,GAAG,KAAK,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/F,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC3C,IAAI,OAAO,GAAG,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/D,OAAO,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,SAAS,QAAQ;QACf,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnG,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/workflows/run.d.ts

@@ -37,6 +37,7 @@ export type DelegationExecutionSettings = {
     cwd: string;
     runner: RunnerId;
     model?: string;
+    modelIdentity?: string;
     effort?: string;
     agentProfile: string;
     accountBinding?: WorkerAccountBinding;
@@ -44,6 +45,10 @@ export type DelegationExecutionSettings = {
     allowedTools?: string[];
     bashAllowlist?: string[];
 };
+/** Safety cap on autonomous auto-continues per run — stops a stuck agent from nudging forever. */
+/** #505: a real steer is read at the harness's next model step; a quiet boundary this long
+ * with input still unread means the harness will not read it without help. */
+export declare const UNREAD_INPUT_GRACE_MS = 30000;
 /**
  * Auto-resume after a provider usage limit (spec 2026-08-03-auto-resume-after-usage-limit).
  *
@@ -114,6 +119,8 @@ export interface StartRunInput {
      *  user — turn-ends auto-continue until the agent signals done or the safety
      *  cap is hit. No "needs you" is ever raised. */
     autonomous?: boolean;
+    /** Task webhook opt-in (#589). Persisted on the record at creation; read from there after. */
+    notify?: boolean;
     /** Follow-up inbox generation (spec 007, #444). Omitted means enabled for
      *  compatibility; the handoff journal runs either way. */
     generateFollowups?: boolean;
@@ -213,6 +220,16 @@ export declare function pastedAttachmentsNote(attachments: PersistedAttachment[]
 export declare const VARIANT_LETTERS: readonly ['A', 'B', 'C'];
 /** Only an original workflow that has never executed may return to its queue. */
 export declare function isUntouchedCancelledRun(run: RunRecord): boolean;
+/** #469: why destroy could not prove a crashed generation's termination. */
+export type WorkerTerminationBlocker = {
+    kind: 'unreadable';
+} | {
+    kind: 'controller';
+    pid: number;
+} | {
+    kind: 'processes';
+    pids: number[];
+};
 /**
  * The mini workflow engine: executes a `WorkflowDef` against a repo, one step
  * at a time, persisting every event to the RunStore (which the SSE endpoints
@@ -242,9 +259,53 @@ export declare class RunManager {
      * exception or an interrupt request cannot stand in for session termination. */
     private trackWorkerSessionResult;
     private persistWorkerCompletion;
+    /** #469: the generation a dead controller left `starting`, if this manager may judge it. A
+     * generation this process controls is never judged here: the in-memory execution map owns it,
+     * and a disposed manager's still-running sessions look like orphans. `busy` is transient (this
+     * manager holds the run); `unknown` is a present record that proves nothing. */
+    private orphanState;
+    private orphanedWorkerGeneration;
+    /** Completes a crashed generation's proof once every one of its processes is proven gone (#469).
+     * Sync and signal-free; recovery, resume, delivery, collect and destroy then take their normal paths.
+     * A non-gone probe is cached briefly: on darwin the scan is a synchronous `lsof` on the event loop. */
+    settleOrphanedWorkerExecution(runId: string, opts?: {
+        admitting?: boolean;
+        fresh?: boolean;
+    }): boolean;
+    private readonly orphanProbes;
+    private readonly orphanReprobes;
+    private readonly orphanBlockers;
+    private readonly reportedOrphanBlockers;
+    private orphanReprobeMs;
+    private orphanReprobeLimitMs;
+    private orphanReprobeSlowMs;
+    private orphanTermGraceMs;
+    /** #469: a survivor that dies after recovery has no other wake source (no exit callback for a
+     * process another cezar spawned). Unref'd; finalization's `run` event then lets worker waits and
+     * outcomes observe it. Fast for the first window, then slow but uncapped, so a long-lived
+     * survivor is still noticed when it exits. A tick while this manager holds the run is skipped;
+     * only terminal reasons (proof settled, generation changed, run gone, unknown record, dispose)
+     * stop it. */
+    private armOrphanReprobe;
+    private clearOrphanReprobe;
+    /** Why the last destroy could not prove termination (#469), and whether that differs from the
+     * reason last reported, so a retry loop appends one lifecycle event per distinct blocker set. */
+    takeWorkerTerminationBlocker(runId: string): {
+        blocker: WorkerTerminationBlocker;
+        changed: boolean;
+    } | undefined;
+    /** Continue over a live orphan names what still runs; other refusals keep the generic text. */
+    private orphanAdmissionRefusal;
+    /** Destroy only (#469): signal the recorded, token-verified survivors of a generation whose
+     * controller is proven dead, then finalize on `gone`. Scan-only processes are never signalled. */
+    private reapOrphanedWorker;
+    /** Best effort: a failed write leaves the working-directory scan as this process's evidence. */
+    private recordWorkerProcess;
     private trackTurnEnd;
     requestWorkerStop(runId: string): WorkerStopResult;
-    awaitRunTermination(runId: string, timeoutMs: number): Promise<boolean>;
+    awaitRunTermination(runId: string, timeoutMs: number, opts?: {
+        reapOrphans?: boolean;
+    }): Promise<boolean>;
     /** Private cleanup capability, never serialized. Obtain after stop/termination
      * under the service's destroy lock; each invocation rechecks the same generation. */
     getWorkerNoMaterializationProof(runId: string): WorkerNoMaterializationProof | undefined;
@@ -267,8 +328,11 @@ export declare class RunManager {
     private readonly workerWakeAdmitted;
     private readonly workerWakeQueuedAt;
     private readonly workerWaitTimers;
+    private readonly inboxClaimTimers;
     private reconcilingWorkers;
     private recovering;
+    /** Quiet window before unread input is resubmitted or left unconfirmed (#505). */
+    private readonly unreadInputGraceMs;
     private disposed;
     private readonly onDelegationRun;
     private readonly pendingJobs;
@@ -328,6 +392,7 @@ export declare class RunManager {
     private readonly offSemaphore;
     constructor(store: RunStore, repoRoot: string, options?: {
         semaphore?: WorkspaceSemaphore;
+        unreadInputGraceMs?: number;
     });
     /**
      * Release everything this manager owns without touching run records
@@ -432,10 +497,27 @@ export declare class RunManager {
         model?: string;
         effort?: string;
         agentProfile?: string;
-    }): Promise<DelegationExecutionSettings>;
+    }, validateModel?: (settings: DelegationExecutionSettings) => Promise<void>): Promise<DelegationExecutionSettings>;
+    /**
+     * Idempotent start (#504, spec 2026-09-24-cez-task-cli). Lookup and create share one
+     * synchronous path, so the event loop serialises concurrent retries: the first creates, every
+     * later one with the same hash gets that run back, and a different hash is a conflict.
+     */
+    startRunIdempotent(workflow: WorkflowDef, input: StartRunInput, request: {
+        id: string;
+        hash: string;
+    }): {
+        run: RunRecord;
+        created: boolean;
+    } | {
+        conflict: true;
+    };
     startRun(workflow: WorkflowDef, input: StartRunInput, group?: {
         groupId: string;
         variant: string;
+    }, clientRequest?: {
+        id: string;
+        hash: string;
     }): RunRecord;
     /** Accept only the store's already-durable owned creation, never caller-supplied paths/workflows. */
     enqueueOwnedRun(runId: string): void;
@@ -749,8 +831,43 @@ export declare class RunManager {
     private hasUnansweredHumanAsk;
     /** Both roles can select their own requests without acquiring worker-management authority. */
     registerRequestWait(runId: string, request: RequestWaitRequest): WorkerWait;
+    /** A wait wake is only a pointer. Only provider submission/opening prompts own delivery. */
+    private providerOwnsInboxInput;
+    canClaimInboxInput(runId: string, id: string): boolean;
+    /** The service supplies authorized, bounded IDs; claim and flight reservations are synchronous. */
+    reserveInboxInputs(runId: string, generation: string, ids: readonly string[]): {
+        receiptId: string;
+        expiresAt: string;
+        inputIds: string[];
+    } | undefined;
+    acknowledgeInbox(runId: string, generation: string, receiptId: string): 'acknowledged' | 'already-acknowledged';
+    releaseInbox(runId: string, generation: string, receiptId: string): 'released';
+    /** Expiry is an independent wake source, including after the provider's last turn. */
+    private armInboxClaimExpiry;
     /** Accepted conversation input uses the existing scheduler admission for idle recipients. */
     deliverConversationInput(runId: string): void;
+    /** A worker's pending question goes to its owning parent as a conversation request
+     * (#505). The worker still parks on its ask; only the parent's reply, or a human after
+     * fallback, answers it. Routing is idempotent: the message ID derives from the ask seq. */
+    private routeWorkerQuestion;
+    /** A human answering a worker question its parent handed back (#505): the reviewing parent
+     * can no longer answer it, so it must not also block the human. */
+    private answersFallenBackAsk;
+    /** The worker's pending ask when it went to the parent and has not fallen back to a human. */
+    private routedAsk;
+    /** The parent's reply answers the routed question like a human answer would: through the
+     * live session's native answer seam, or by reopening a session that is gone (#505). */
+    private answerRoutedQuestion;
+    /** A routed question settled without a reply (its worker stopped, a deadline, fallback) can
+     * never be answered by the parent any more: hand it to the human on the worker (#505). */
+    private retireSettledQuestions;
+    /** Routed questions this parent has not answered yet, by asking worker. */
+    private unansweredQuestions;
+    /** The parent can no longer answer: its workers' routed questions go back to the human
+     * (#505). The outcome lands first, so a crash before the worker's event repeats this. */
+    private fallbackRoutedQuestions;
+    /** The parent can still read and answer a routed question; answering needs its steer grant. */
+    private parentCanReceive;
     /** Cancel only the wait; persist its settlement before ordinary wake admission. */
     cancelWorkerWait(parentId: string, waitId: string): WorkerWait;
     private workerWait;
@@ -777,6 +894,37 @@ export declare class RunManager {
     /** Accepted input may be temporarily refused while a backend HTTP ack is
      * outstanding. That is not an empty queue and must not trigger automatic DONE. */
     private hasQueuedAgentInputs;
+    /** Only the current session's observation writes consumedAt (#505). An ID reported
+     * before its acceptance checkpoint lands is applied when that checkpoint commits. */
+    private handleAgentInputConsumed;
+    /** #505: input the harness accepted but will never read returns to the queue, so
+     * DONE, auto-end and park see queued work. Out of a turn (an OpenCode lost wake)
+     * it is submitted right away; at a turn-end the handler's own flush submits it. */
+    private retireUnreadInputs;
+    /** #505: the harness started the opening turn, so the opening input was accepted.
+     * Its replay-prompt retirement still waits for that turn's successful end. */
+    private recordOpeningAccepted;
+    /** The conversation messages the next submission would carry, if nothing but
+     * conversation input leads the queue (lifecycle input stays a barrier). */
+    private pendingConversationBatch;
+    /** Bundled messages rode the answer's own write: delivered now, read when that turn ends. */
+    private commitBundledDelivery;
+    /** The turn that carried bundled messages has ended: the model read them. */
+    private readBundledInputs;
+    /** #505: the session closed without reporting it read (failure, stop, exit): the input
+     * goes back to the queue so a later session delivers it; never shown as delivered. */
+    private requeueUnreadAtClose;
+    /** An idle, open boundary with nothing left to deliver: DONE closes, otherwise the
+     * run parks as waiting or monitoring. Shared by acknowledgements that land after a
+     * turn ended and by the unread-input grace timer (#505). */
+    private settleIdleBoundary;
+    /** #505 liveness bound: a harness that accepted input and then neither read it nor ran
+     * another turn must not hold the run and its slot forever. After a quiet grace window the
+     * input is resubmitted once; after a second it is left delivered but unconfirmed. */
+    private armUnreadInputTimer;
+    private clearUnreadInputTimer;
+    /** #505: the harness accepted input this session has not reported reading yet. */
+    private harnessOwesInput;
     /** A callback from an old/replaced/disposed session carries no authority. */
     private handleAgentInputReady;
     /** Reservation is synchronous; only an acknowledged transport may checkpoint delivery. */
@@ -811,6 +959,11 @@ export declare class RunManager {
     private waitingBeforeFinalWorkflowStep;
     /** Locate the original workflow step whose closed session a synthetic Continue is resuming. */
     private waitingWorkflowStepIndex;
+    /**
+     * Session ids Cursor will accept on `session/load`. A launch UUID written
+     * before `session.started` is only for the step rail (#583).
+     */
+    private resumableSessionId;
     /**
      * "Continue" (spec 003): reopen a finished run's claude session in-process
      * (`claude --resume <sessionId>`) as a new synthetic step. The session then
@@ -829,6 +982,8 @@ export declare class RunManager {
         /** Agent account for the reopened session (spec 2026-07-29-agent-profiles). Omitted = the
          *  account the run is already on. */
         agentProfile?: string;
+        /** #505: the parent reply this continuation delivers as the answer to a routed question. */
+        answerInputId?: string;
     }, 
     /** Restart recovery may discover several interrupted tasks at once. Those
      *  continuations are queued; an explicit user Continue remains immediate. */
@@ -862,6 +1017,9 @@ export declare class RunManager {
     /** Persist the invocation checkpoint before launching a runner. A throw or
      * process exit before `turn.started` therefore leaves a durable mismatch. */
     private beginUsageInvocation;
+    /** Claude's `total_cost_usd` is cumulative for the conversation, including
+     * turns in Continue steps. Other runners emit per-message cost deltas. */
+    private recordReportedCost;
     /** Fold backend-neutral completed-turn usage into the current step exactly
      * once. Invocation/turn counters are written before the event reaches the
      * NDJSON sink so crashes cannot preserve a falsely complete subtotal. */