@wjarka/cezarion 0.14.8 → 0.14.9-dev.1009

package/dist/workflows/run.js

@@ -1,5 +1,6 @@
 import { ciWaitRequestSchema, ciWaitResultSchema } from '../contract/index.js';
 import { acquireCiResources } from '../ci-wait/resources.js';
+import { artifactInstructions, provisionArtifactDirectory } from '../artifacts/lifecycle.js';
 import { workerContextHash, workerWorkflowHash, workerStepIdentity, captureWorkerAccount, boundWorkerAccountEnv, WorkerIdentityError } from '../delegation/execution-identity.js';
 import { buildChildEnv } from '../core/agent-env.js';
 import { randomUUID } from 'node:crypto';
@@ -8,6 +9,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync
 import { dirname, join } from 'node:path';
 import { parseAskMarkerResult, stripAskMarker, } from '../core/ask.js';
 import { hasRegisteredRunProcess, onUsage, registerRunProcess, unregisterRunProcess } from '../core/process-usage.js';
+import { inspectGeneration, isCurrentProcess, processStartToken, recordedProcessLive } from '../delegation/process-liveness.js';
 import { parseUsageLimit } from '../core/usage-limit.js';
 import { createRunner } from '../core/runner-factory.js';
 import { modelConflictsWithRunner } from '../core/model-presets.js';
@@ -19,7 +21,8 @@ import { todosPath } from '../todos.js';
 // Contract VALUES, like `workspaceUiStateSchema` in workspace/migrations.ts: the attachment
 // vocabulary the routes validate with is the same one the engine stores and re-reads by, so the
 // wire and the disk can never disagree about what counts as an image (#950).
-import { requestWaitRequestSchema, workerWaitRequestSchema, attachmentExtension, delegationStateSchema, pendingHumanAsk, isImageAttachmentName, isImageMediaType, } from '../contract/index.js';
+import { requestWaitRequestSchema, workerWaitRequestSchema, attachmentExtension, delegationStateSchema, pendingHumanAsk, askRequestSchema, isImageAttachmentName, isImageMediaType, } from '../contract/index.js';
+import { inputDeliveryOf } from '../core/agent-runner.js';
 import { discoverSkills } from '../skills.js';
 import { materializeSkillDir } from '../skills-remote.js';
 import { seedAgentConfigLocalLayer } from '../agent-config/seed.js';
@@ -29,16 +32,17 @@ import { autosaveCommit, createWorktree, resolveBaseRef, worktreeDiff, worktreeS
 import { getHeadCommit, getRepoInfo } from '../server/git.js';
 import { ensureOwnedWorkspace, verifyOwnedWorkspace } from '../delegation/workspace.js';
 import { verifyWorkerContext } from '../delegation/context.js';
-import { enqueueAgentInput, agentInputBatch } from '../delegation/input.js';
+import { enqueueAgentInput, agentInputBatch, hasLiveInboxClaim } from '../delegation/input.js';
 import { parseDelegationEffort } from '../delegation/effort.js';
 import { DelegationPolicyError } from '../delegation/policy.js';
 import { reconcileWorkerWait } from '../delegation/wait.js';
 import { reconcileConversationState, projectConversationEvents } from '../delegation/conversations.js';
 import { parentReadiness } from '../delegation/readiness.js';
+import { answersQuestion, openQuestions, questionMessage } from '../delegation/questions.js';
 import { workerOutcome } from '../runs/delegation-state.js';
 import { loadWorkflows } from './load.js';
 import { reclaimWorktrees, rematerializeReclaimedWorktree } from '../runs/retention.js';
-import { AgentTempDirError, agentTmpEnv, removeAgentTmpDir, sweepAgentTmpDirs, } from '../runs/agent-tmpdir.js';
+import { AgentTempDirError, agentTmpEnv, agentTmpDirLocations, removeAgentTmpDir, sweepAgentTmpDirs, } from '../runs/agent-tmpdir.js';
 import { extractTaskRefs, refineTaskRefs, titleRefNumber } from '../runs/task-refs.js';
 import { parseTaskMarkers, stripTaskMarkers } from '../runs/task-markers.js';
 import { autoNamingActive, generateRunName, liveTitleUpdatesEnabled, postValidateTitle } from '../runs/auto-name.js';
@@ -122,6 +126,8 @@ function stripDoneMarker(text) {
 function stripMonitoringMarker(text) {
     return text.replace(/\s*CEZ:MONITORING\s*$/, '');
 }
+/** #505: a worker question routed to its parent is answered there until it falls back. */
+const ROUTED_QUESTION_REFUSAL = 'This question was sent to the parent task; answer it there.';
 /** Emit the v2 `ask.requested` event for a parsed marker (the cockpit renders
  *  it as an ask card, #473). Returns the minted request id. */
 function emitAskRequested(sink, ask) {
@@ -213,6 +219,9 @@ export function repositoryRootLockDisabled(env = process.env) {
 }
 const REPOSITORY_ROOT_LOCK_DISABLED_NOTE = 'repository-root lock disabled by CEZ_DISABLE_REPO_LOCK=1 (shared checkout is unsafe)';
 /** Safety cap on autonomous auto-continues per run — stops a stuck agent from nudging forever. */
+/** #505: a real steer is read at the harness's next model step; a quiet boundary this long
+ * with input still unread means the harness will not read it without help. */
+export const UNREAD_INPUT_GRACE_MS = 30_000;
 const MAX_AUTO_CONTINUES = 40;
 const AUTONOMOUS_NUDGE = 'Continue working autonomously until the task is fully complete. Do not ask me for confirmation or clarification — make reasonable assumptions and proceed. When everything is done, end the session with your done signal.';
 const MONITORING_WAKE_NUDGE = 'Re-check the downstream work you were monitoring. Continue toward the task goal; emit CEZ:MONITORING again only if it is still pending.';
@@ -418,6 +427,12 @@ export function isUntouchedCancelledRun(run) {
     return run.status === 'cancelled' && !run.startedAt && !!run.workflowDef &&
         run.steps.every(step => step.status === 'pending' && !step.startedAt && !step.sessionId);
 }
+/** #469: how long a non-gone orphan probe stands before the next scan. */
+const ORPHAN_PROBE_CACHE_MS = 2_000;
+/** #469: admission refused because a process of the previous generation still runs. */
+class WorkerOrphanAliveError extends Error {
+}
+const admissionError = (error, fallback) => error instanceof WorkerOrphanAliveError ? error.message : fallback;
 /**
  * The mini workflow engine: executes a `WorkflowDef` against a repo, one step
  * at a time, persisting every event to the RunStore (which the SSE endpoints
@@ -447,6 +462,13 @@ export class RunManager {
     beginWorkerExecution(runId, admitted = true) {
         if (this.store.getRun(runId)?.delegation?.role !== 'worker')
             return;
+        // #469: one site for Continue, --resume, parent replies and queued revival after a crash.
+        // Fresh: admission is one-shot, so a cached "alive" must not refuse an orphan that has since died.
+        if (!this.executions.has(runId))
+            this.settleOrphanedWorkerExecution(runId, { admitting: true, fresh: true });
+        const refusal = this.executions.has(runId) ? undefined : this.orphanAdmissionRefusal(runId);
+        if (refusal)
+            throw new WorkerOrphanAliveError(refusal);
         const existing = this.executions.get(runId);
         if (existing) {
             const proof = this.store.readWorkerExecution(runId);
@@ -461,6 +483,9 @@ export class RunManager {
         const promise = new Promise(done => { resolve = done; });
         this.executions.set(runId, { generation, admitted, promise, resolve, sessions: new Set(), turns: new Set(), deliveries: new Set() });
         this.finalizedWorkers.delete(runId);
+        // #469: an earlier generation's destroy blocker never describes this one.
+        this.orphanBlockers.delete(runId);
+        this.reportedOrphanBlockers.delete(runId);
         this.stoppedWorkers.delete(runId);
     }
     async finishWorkerExecution(runId) {
@@ -510,6 +535,196 @@ export class RunManager {
         }
         catch { /* Finalized in this process; preserve exact generation for an explicit retry. */ }
     }
+    /** #469: the generation a dead controller left `starting`, if this manager may judge it. A
+     * generation this process controls is never judged here: the in-memory execution map owns it,
+     * and a disposed manager's still-running sessions look like orphans. `busy` is transient (this
+     * manager holds the run); `unknown` is a present record that proves nothing. */
+    orphanState(runId, admitting = false) {
+        const run = this.store.getRun(runId);
+        if (run?.delegation?.role !== 'worker' || this.disposed)
+            return { state: 'none' };
+        if (this.executions.has(runId) || this.active.has(runId) || this.starting.has(runId) || (!admitting && this.queue.includes(runId)))
+            return { state: 'busy' };
+        const proof = this.store.readWorkerExecution(runId);
+        if (proof?.phase !== 'starting')
+            return { state: 'none' };
+        const record = this.store.readWorkerProcesses(runId, proof.generation);
+        // A present record that proves nothing (unreadable, malformed, another generation) blocks both
+        // finalization and reaping; only an absent one is legacy, scan-only evidence.
+        if (record === 'unknown')
+            return { state: 'unknown' };
+        if (record !== 'absent' && isCurrentProcess(record.controller))
+            return { state: 'none' };
+        // Finalization deletes the scratch too, so a process working there keeps the generation alive.
+        return { state: 'orphan', generation: proof.generation, ...(record === 'absent' ? {} : { record }),
+            paths: [run.delegation.workspace.path, ...agentTmpDirLocations(this.dataDir, runId)],
+            // No process of this worker can predate its record (1 s slack for tick rounding).
+            ...(Number.isFinite(Date.parse(run.createdAt)) ? { since: Date.parse(run.createdAt) - 1_000 } : {}) };
+    }
+    orphanedWorkerGeneration(runId, admitting = false) {
+        const orphan = this.orphanState(runId, admitting);
+        return orphan.state === 'orphan' ? orphan : undefined;
+    }
+    /** Completes a crashed generation's proof once every one of its processes is proven gone (#469).
+     * Sync and signal-free; recovery, resume, delivery, collect and destroy then take their normal paths.
+     * A non-gone probe is cached briefly: on darwin the scan is a synchronous `lsof` on the event loop. */
+    settleOrphanedWorkerExecution(runId, opts = {}) {
+        const orphan = this.orphanedWorkerGeneration(runId, opts.admitting);
+        if (!orphan)
+            return false;
+        const cached = this.orphanProbes.get(runId);
+        if (!opts.fresh && cached?.generation === orphan.generation && Date.now() - cached.at < ORPHAN_PROBE_CACHE_MS)
+            return false;
+        const probe = inspectGeneration(orphan);
+        if (probe.liveness !== 'gone') {
+            this.orphanProbes.set(runId, { generation: orphan.generation, at: Date.now(), probe });
+            return false;
+        }
+        // A stale `alive` must not outlive a `gone` probe, even when the commit below fails.
+        this.orphanProbes.delete(runId);
+        try {
+            if (!this.store.commitWorkerExecutionComplete(runId, orphan.generation))
+                return false;
+        }
+        catch {
+            return false;
+        }
+        this.orphanProbes.delete(runId);
+        this.orphanBlockers.delete(runId);
+        this.reportedOrphanBlockers.delete(runId);
+        this.clearOrphanReprobe(runId);
+        this.store.appendEvent(runId, { type: 'lifecycle', message: "the interrupted worker's processes are gone; its execution was finalized" });
+        removeAgentTmpDir(this.dataDir, runId);
+        return true;
+    }
+    orphanProbes = new Map();
+    orphanReprobes = new Map();
+    orphanBlockers = new Map();
+    reportedOrphanBlockers = new Map();
+    // Private and overridable so tests need not wait out production cadence.
+    orphanReprobeMs = 15_000;
+    orphanReprobeLimitMs = 15 * 60_000;
+    orphanReprobeSlowMs = 60_000;
+    orphanTermGraceMs = 10_000;
+    /** #469: a survivor that dies after recovery has no other wake source (no exit callback for a
+     * process another cezar spawned). Unref'd; finalization's `run` event then lets worker waits and
+     * outcomes observe it. Fast for the first window, then slow but uncapped, so a long-lived
+     * survivor is still noticed when it exits. A tick while this manager holds the run is skipped;
+     * only terminal reasons (proof settled, generation changed, run gone, unknown record, dispose)
+     * stop it. */
+    armOrphanReprobe(runId) {
+        const armed = this.orphanedWorkerGeneration(runId);
+        if (this.disposed || this.orphanReprobes.has(runId) || !armed)
+            return;
+        const slowAfter = Date.now() + this.orphanReprobeLimitMs;
+        const schedule = () => {
+            const timer = setTimeout(() => {
+                const orphan = this.orphanState(runId);
+                if (orphan.state === 'busy')
+                    return schedule();
+                if (orphan.state !== 'orphan' || orphan.generation !== armed.generation || this.settleOrphanedWorkerExecution(runId))
+                    this.clearOrphanReprobe(runId);
+                else
+                    schedule();
+            }, Date.now() < slowAfter ? this.orphanReprobeMs : this.orphanReprobeSlowMs);
+            timer.unref?.();
+            this.orphanReprobes.set(runId, timer);
+        };
+        schedule();
+    }
+    clearOrphanReprobe(runId) {
+        const timer = this.orphanReprobes.get(runId);
+        if (timer)
+            clearTimeout(timer);
+        this.orphanReprobes.delete(runId);
+    }
+    /** Why the last destroy could not prove termination (#469), and whether that differs from the
+     * reason last reported, so a retry loop appends one lifecycle event per distinct blocker set. */
+    takeWorkerTerminationBlocker(runId) {
+        const blocker = this.orphanBlockers.get(runId);
+        if (!blocker)
+            return undefined;
+        const key = JSON.stringify(blocker);
+        const changed = this.reportedOrphanBlockers.get(runId) !== key;
+        this.reportedOrphanBlockers.set(runId, key);
+        return { blocker, changed };
+    }
+    /** Continue over a live orphan names what still runs; other refusals keep the generic text. */
+    orphanAdmissionRefusal(runId) {
+        const orphan = this.orphanedWorkerGeneration(runId, true);
+        const probe = orphan && this.orphanProbes.get(runId);
+        if (!probe || probe.generation !== orphan.generation)
+            return undefined;
+        if (probe.probe.controller !== undefined)
+            return `the worker is still controlled by a live cezar (pid ${probe.probe.controller})`;
+        const pid = probe.probe.pids[0];
+        return pid === undefined ? undefined : `a process of the previous execution is still running (pid ${pid})`;
+    }
+    /** Destroy only (#469): signal the recorded, token-verified survivors of a generation whose
+     * controller is proven dead, then finalize on `gone`. Scan-only processes are never signalled. */
+    async reapOrphanedWorker(runId, timeoutMs) {
+        const deadline = Date.now() + Math.min(30_000, Math.max(0, Number.isFinite(timeoutMs) ? timeoutMs : 0));
+        this.orphanBlockers.delete(runId);
+        const initial = this.orphanState(runId);
+        if (initial.state === 'unknown') {
+            this.orphanBlockers.set(runId, { kind: 'unreadable' });
+            return;
+        }
+        const orphan = this.orphanedWorkerGeneration(runId);
+        if (!orphan || this.settleOrphanedWorkerExecution(runId, { fresh: true }))
+            return;
+        const same = () => this.orphanedWorkerGeneration(runId)?.generation === orphan.generation;
+        // >= 500 ms: every probe may be a synchronous darwin `lsof`.
+        const pause = () => new Promise(resolve => setTimeout(resolve, Math.max(0, Math.min(500, deadline - Date.now()))));
+        // A live controller is another cezar's: nothing to signal or wait for. Otherwise signal only
+        // recorded, token-verified survivors (none for a legacy record-less generation), then wait
+        // out every other holder until the deadline; the scan's processes are never signalled.
+        if (!orphan.record || !recordedProcessLive(orphan.record.controller)) {
+            if (orphan.record) {
+                const targets = orphan.record.processes.filter(entry => entry.startToken !== undefined && recordedProcessLive(entry));
+                const signal = (name) => {
+                    for (const entry of targets) {
+                        if (!same())
+                            return;
+                        // Re-verified immediately before every signal, exactly: a reused PID is never touched.
+                        if (processStartToken(entry.pid) === entry.startToken)
+                            try {
+                                process.kill(entry.pid, name);
+                            }
+                            catch { /* already gone */ }
+                    }
+                };
+                signal('SIGTERM');
+                const killAt = Math.min(deadline, Date.now() + this.orphanTermGraceMs);
+                while (Date.now() < killAt && targets.some(recordedProcessLive))
+                    await pause();
+                if (targets.some(recordedProcessLive))
+                    signal('SIGKILL');
+            }
+            while (!this.settleOrphanedWorkerExecution(runId, { fresh: true }) && Date.now() < deadline && same())
+                await pause();
+        }
+        if (!same())
+            return;
+        const probe = this.orphanProbes.get(runId)?.probe;
+        if (probe?.controller !== undefined)
+            this.orphanBlockers.set(runId, { kind: 'controller', pid: probe.controller });
+        else if (probe?.pids.length)
+            this.orphanBlockers.set(runId, { kind: 'processes', pids: probe.pids });
+    }
+    /** Best effort: a failed write leaves the working-directory scan as this process's evidence. */
+    recordWorkerProcess(runId, pid) {
+        const generation = this.executions.get(runId)?.generation;
+        if (!generation)
+            return;
+        try {
+            if (!this.store.appendWorkerProcess(runId, generation, pid))
+                console.warn(`[cez] worker ${runId} process record unavailable; relying on the working-directory scan`);
+        }
+        catch {
+            console.warn(`[cez] worker ${runId} process record write failed; relying on the working-directory scan`);
+        }
+    }
     trackTurnEnd(runId, text) {
         const task = this.recordTurnEnd(runId, text);
         const turns = this.executions.get(runId)?.turns;
@@ -524,12 +739,16 @@ export class RunManager {
         this.cancel(runId);
         return { workerId: runId, state: !this.executions.has(runId) && this.store.readWorkerExecution(runId)?.phase === 'complete' ? 'terminated' : 'stopping' };
     }
-    async awaitRunTermination(runId, timeoutMs) {
+    async awaitRunTermination(runId, timeoutMs, opts = {}) {
         const execution = this.executions.get(runId);
         if (!execution) {
             const generation = this.finalizedWorkers.get(runId);
             if (!this.disposed && generation)
                 this.persistWorkerCompletion(runId, generation);
+            else if (!generation && opts.reapOrphans)
+                await this.reapOrphanedWorker(runId, timeoutMs);
+            else if (!generation)
+                this.settleOrphanedWorkerExecution(runId);
             return this.store.readWorkerExecution(runId)?.phase === 'complete';
         }
         if (this.disposed)
@@ -593,8 +812,11 @@ export class RunManager {
     workerWakeAdmitted = new Set();
     workerWakeQueuedAt = new Map();
     workerWaitTimers = new Map();
+    inboxClaimTimers = new Map();
     reconcilingWorkers = false;
     recovering = false;
+    /** Quiet window before unread input is resubmitted or left unconfirmed (#505). */
+    unreadInputGraceMs;
     disposed = false;
     onDelegationRun = (run) => {
         if (!this.disposed && !['queued', 'running', 'waiting'].includes(run.status))
@@ -665,6 +887,7 @@ export class RunManager {
         this.store = store;
         this.repoRoot = repoRoot;
         this.dataDir = join(repoRoot, '.ai/cezar');
+        this.unreadInputGraceMs = options.unreadInputGraceMs ?? UNREAD_INPUT_GRACE_MS;
         this.semaphore = options.semaphore ?? new WorkspaceSemaphore();
         this.ciResources = acquireCiResources(this.semaphore);
         this.ciSupervisor = this.ciResources.supervisor;
@@ -705,12 +928,20 @@ export class RunManager {
         this.ciResources.release();
         this.delegationProvisioner = undefined;
         this.finalizedWorkers.clear();
+        for (const runId of [...this.orphanReprobes.keys()])
+            this.clearOrphanReprobe(runId);
+        this.orphanProbes.clear();
+        this.orphanBlockers.clear();
+        this.reportedOrphanBlockers.clear();
         for (const settle of this.terminationWaiters)
             settle();
         this.store.off('run', this.onDelegationRun);
         for (const timer of this.workerWaitTimers.values())
             clearTimeout(timer);
         this.workerWaitTimers.clear();
+        for (const timer of this.inboxClaimTimers.values())
+            clearTimeout(timer);
+        this.inboxClaimTimers.clear();
         this.workerWaiting.clear();
         this.workerWakeAdmitted.clear();
         this.workerWakeQueuedAt.clear();
@@ -805,6 +1036,7 @@ export class RunManager {
      *  turning into empty command output inside a running agent. */
     agentEnv(runId, generateFollowups = true) {
         return {
+            CEZ_ARTIFACTS_DIR: provisionArtifactDirectory(this.dataDir, runId),
             CEZ_HANDOFF_FILE: handoffPath(this.dataDir, runId),
             CEZ_TASK_ID: runId,
             CEZ_TODOS_FILE: generateFollowups ? todosPath(this.dataDir) : '',
@@ -1155,7 +1387,7 @@ export class RunManager {
      * does not know is refused rather than degraded to the default, because a worker silently
      * running on another login is a billing boundary crossed without anyone choosing it.
      */
-    async selectDelegationExecutionSettings(runId, selection) {
+    async selectDelegationExecutionSettings(runId, selection, validateModel) {
         const parent = this.delegationExecutionSettings(runId);
         const runner = selection.backend ?? parent.runner;
         const sameBackend = runner === parent.runner;
@@ -1180,17 +1412,34 @@ export class RunManager {
             env = { ...env, ...boundWorkerAccountEnv(accountBinding, env) };
             const native = await readAgentModelSettings(runner, this.repoRoot, env);
             const chosen = selection.model ?? (sameBackend ? parent.model : locked ? undefined : native.model);
+            const normalized = normalizeModelForBackend(runner, chosen, { configuredProvider: native.provider });
+            const settings = { ...parent, runner, model: normalized?.backendModel, modelIdentity: normalized ? formatModelIdentity(normalized.identity) : undefined, effort: effortPin ?? (sameBackend ? parent.effort : undefined),
+                agentProfile: accountBinding.profileId, accountBinding };
+            // A populated catalog gives a useful choice list before the legacy preset fallback rejects.
+            await validateModel?.(settings);
             if (chosen && modelConflictsWithRunner(chosen, runner))
                 throw new Error('Model is incompatible with the selected backend');
-            const model = normalizeModelForBackend(runner, chosen, { configuredProvider: native.provider })?.backendModel;
-            return { ...parent, runner, model, effort: effortPin ?? (sameBackend ? parent.effort : undefined),
-                agentProfile: accountBinding.profileId, accountBinding };
+            return settings;
         }
         catch (error) {
+            if (error instanceof DelegationPolicyError)
+                throw error;
             throw new DelegationPolicyError('invalid_input', error instanceof Error ? error.message : 'Worker execution selection is unavailable');
         }
     }
-    startRun(workflow, input, group) {
+    /**
+     * Idempotent start (#504, spec 2026-09-24-cez-task-cli). Lookup and create share one
+     * synchronous path, so the event loop serialises concurrent retries: the first creates, every
+     * later one with the same hash gets that run back, and a different hash is a conflict.
+     */
+    startRunIdempotent(workflow, input, request) {
+        const existing = this.store.findRunByClientRequestId(request.id);
+        if (existing) {
+            return existing.clientRequestHash === request.hash ? { run: existing, created: false } : { conflict: true };
+        }
+        return { run: this.startRun(workflow, input, undefined, request), created: true };
+    }
+    startRun(workflow, input, group, clientRequest) {
         // Sanitize at the manager boundary so CLI runs, workflows, variants, and
         // direct callers cannot bypass the HTTP policy.
         const effectiveInput = agentModelsLocked(this.repoRoot)
@@ -1216,11 +1465,14 @@ export class RunManager {
             // auto-nudge reads `input.autonomous` (`execute`), but the record is the
             // only source those after-the-fact consumers have.
             autonomous: input.autonomous === true,
+            notify: input.notify === true,
             // Persist the explicit opt-out so queued-run restart recovery and the
             // session Git routes can distinguish it from a removed isolated worktree.
             worktree: !group && input.worktree === false ? false : undefined,
             groupId: group?.groupId,
             variant: group?.variant,
+            clientRequestId: clientRequest?.id,
+            clientRequestHash: clientRequest?.hash,
             steps: workflow.steps.map((s) => ({ id: s.id, name: s.name ?? s.id, kind: stepKind(s) })),
         });
         // Persist the full definition so a queued run survives a restart (#367) —
@@ -1427,6 +1679,14 @@ export class RunManager {
                     // than being dequeued and re-queued (which would churn its position and its record).
                     const next = this.queue.findIndex((id) => {
                         const queued = this.store.getRun(id);
+                        // An inbox claim may arrive after a wake was queued but before admission.
+                        // Preserve its place and slot exemption until ACK/release/expiry re-pumps.
+                        if (this.workerWakeQueuedAt.has(id)) {
+                            const first = queued?.agentInputs?.find(input => !input.deliveredAt);
+                            const wake = queued?.agentInputs?.find(input => input.id === this.workerWait(id)?.wakeId);
+                            if ((first && hasLiveInboxClaim(first)) || (wake && hasLiveInboxClaim(wake)))
+                                return false;
+                        }
                         return (capacity() || chargedCiWake(id)) && (!queued || this.historyDeletionPending(id) || ((!this.executions.get(id)?.admitted || this.active.has(id)) && !this.executionBlockedByRootFinish(queued) &&
                             (!anyHold || !accountHeldFor(queued, holds, defaultRunner ?? 'claude'))));
                     });
@@ -1441,11 +1701,11 @@ export class RunManager {
                         try {
                             this.beginWorkerExecution(candidate);
                         }
-                        catch {
+                        catch (error) {
                             this.queue.splice(next, 1);
                             this.pendingJobs.delete(candidate);
                             this.pendingContinuations.delete(candidate);
-                            this.store.updateRun(candidate, { status: 'failed', error: 'worker execution checkpoint unavailable', finishedAt: new Date().toISOString() });
+                            this.store.updateRun(candidate, { status: 'failed', error: admissionError(error, 'worker execution checkpoint unavailable'), finishedAt: new Date().toISOString() });
                             continue;
                         }
                     }
@@ -1473,6 +1733,11 @@ export class RunManager {
                             this.workerWakeAdmitted.add(runId);
                             this.flushAgentInputs(runId);
                         }
+                        else if (state.pendingHumanAsk && this.routedAsk(runId) && this.workerWaiting.delete(runId)) {
+                            // A parent's answer to the worker's routed question (#505).
+                            this.workerWakeAdmitted.add(runId);
+                            this.answerRoutedQuestion(runId, true);
+                        }
                         continue;
                     }
                     if (this.workerWakeQueuedAt.delete(runId))
@@ -1579,7 +1844,7 @@ export class RunManager {
             const sameAccount = agentProfile === undefined || agentProfile === sessionAccount;
             this.pendingContinuations.set(run.id, {
                 stepId: queuedContinuation.id,
-                sessionId: sessionBackend === backend && sameAccount ? sessionStep.sessionId : undefined,
+                sessionId: sessionBackend === backend && sameAccount ? this.resumableSessionId(run.id, sessionStep) : undefined,
                 backend,
                 prompt: run.continuationMessage?.text ?? RESTART_CONTINUATION_PROMPT,
                 images: [],
@@ -1667,6 +1932,22 @@ export class RunManager {
             return;
         this.recovering = true;
         try {
+            for (const run of this.store.listRuns()) {
+                this.store.clearExpiredInboxClaims(run.id, new Date().toISOString());
+                this.armInboxClaimExpiry(run.id);
+                // #505: the session that accepted this input died before the model read it.
+                // Delivery is at-least-once: the replay keeps the input's ID in its text.
+                if (['queued', 'running', 'waiting'].includes(run.status) && !this.isActive(run.id)) {
+                    const replayed = this.store.requeueAwaitingReadInputs(run.id);
+                    if (replayed.length)
+                        this.store.appendEvent(run.id, { type: 'note', message: `replaying ${replayed.length} message${replayed.length === 1 ? '' : 's'} accepted before the restart but not read` });
+                }
+            }
+            // #469: a generation whose processes died with the old controller is finalized first, so it
+            // re-launches through the ordinary Continue path and its scratch is not retained.
+            for (const run of this.store.listRuns())
+                if (run.delegation?.role === 'worker' && !this.settleOrphanedWorkerExecution(run.id))
+                    this.armOrphanReprobe(run.id);
             this.reconcileWorkerWaits();
             const live = this.store
                 .listRuns()
@@ -1743,7 +2024,8 @@ export class RunManager {
                 // runs. A worker reaches here only when it has neither a recoverable ask
                 // nor a worker wait; preserving that record would strand both it and its
                 // parent because workers cannot accept an ordinary inactive Continue.
-                if (run.status === 'waiting' && run.delegation?.role !== 'worker')
+                if (run.status === 'waiting' && (run.delegation?.role !== 'worker' ||
+                    run.agentInputs?.some(input => !input.deliveredAt && hasLiveInboxClaim(input))))
                     continue;
                 if (run.status === 'waiting') {
                     const finishedAt = new Date().toISOString();
@@ -1820,7 +2102,15 @@ export class RunManager {
         finally {
             this.recovering = false;
         }
+        // A question a crash caught before or after its commit to the parent still gets routed (#505).
+        for (const run of this.store.listRuns())
+            if (run.delegation?.role === 'worker')
+                this.routeWorkerQuestion(run.id);
         this.reconcileWorkerWaits();
+        // A parent reply accepted just before the crash still answers its worker (#505).
+        for (const run of this.store.listRuns())
+            if (run.delegation?.role === 'worker')
+                this.answerRoutedQuestion(run.id);
         for (const run of this.store.listRuns()) {
             if (run.ciWait && !['running', 'waiting', 'queued'].includes(run.status))
                 this.withdrawCiWait(run.id);
@@ -2702,6 +2992,9 @@ export class RunManager {
             return undefined;
         if (this.hasPendingHumanAsk(runId) || this.active.get(runId)?.pendingHumanAsk)
             return 'Answer the pending human question before finishing.';
+        const questions = this.unansweredQuestions(runId);
+        if (questions.length)
+            return `Answer your workers' questions before finishing: ${questions.map(q => q.workerId).join(', ')}`;
         const blockers = this.parentCompletionBlockers(runId);
         return blockers.length ? `Workers must finish or be stopped, prove termination, and have their latest results collected before finishing: ${blockers.map(b => `${b.workerId} (${b.reason})`).join(', ')}` : undefined;
     }
@@ -2742,6 +3035,8 @@ export class RunManager {
         const state = this.active.get(runId);
         const blockers = this.parentCompletionBlockers(runId);
         const pendingAsk = this.hasPendingHumanAsk(runId) || state?.pendingHumanAsk;
+        // A worker waiting on this parent's answer (#505): waiting on that worker would deadlock.
+        const questions = pendingAsk ? [] : this.unansweredQuestions(runId);
         if (!blockers.length && !pendingAsk) {
             this.resetParentCompletion(runId);
             return false;
@@ -2754,7 +3049,7 @@ export class RunManager {
         }
         if (parent.delegation?.role !== 'root')
             return false;
-        if (parent.delegation.wait && !pendingAsk) {
+        if (parent.delegation.wait && !pendingAsk && !questions.length) {
             if (state?.session?.open)
                 this.parkWorkerWait(runId, state);
             else
@@ -2762,11 +3057,12 @@ export class RunManager {
             this.store.flush();
             return true;
         }
-        const message = pendingAsk ? 'Completion blocked: answer the pending human question.' :
+        const message = pendingAsk ? 'Completion blocked: answer the pending human question.' : questions.length
+            ? `Completion blocked: answer your workers' questions first: ${questions.map(q => `${q.workerId} (request ${q.messageId})`).join(', ')}.` :
             `Completion blocked: finish or explicitly stop outstanding workers, then collect their latest settled results: ${blockers.map(b => `${b.workerId} (${b.reason})`).join(', ')}.`;
         this.store.appendEvent(runId, { type: 'note', tone: 'warning', message });
         const workerIds = blockers.map(b => b.workerId).filter(id => this.store.getRun(id)?.delegation?.role === 'worker');
-        if (!pendingAsk && !parent.delegation.completion && workerIds.length) {
+        if (!pendingAsk && !questions.length && !parent.delegation.completion && workerIds.length) {
             const wait = { id: randomUUID(), mode: 'all', workerIds,
                 revisions: workerIds.map(workerId => { const d = this.store.getRun(workerId).delegation; return { workerId, revision: d?.role === 'worker' ? d.executionRevision ?? 0 : 0 }; }),
                 deadline: new Date(Date.now() + 600_000).toISOString(), phase: 'parked', outcomes: [] };
@@ -2779,7 +3075,7 @@ export class RunManager {
                 this.reconcileWorkerWaits();
         }
         else {
-            const monitoring = !pendingAsk && !!state?.session?.open && this.hasLiveWorkers(runId);
+            const monitoring = !pendingAsk && !questions.length && !!state?.session?.open && this.hasLiveWorkers(runId);
             this.store.commitDelegation([{ id: runId, delegation: { ...parent.delegation, completion: { ...parent.delegation.completion, phase: 'attention' } } }]);
             this.store.updateRun(runId, { status: monitoring ? 'running' : 'waiting', activity: monitoring ? 'monitoring' : undefined, finishedAt: undefined });
             this.store.flush();
@@ -2883,6 +3179,90 @@ export class RunManager {
             this.parkWorkerWait(runId, state);
         return registered;
     }
+    /** A wait wake is only a pointer. Only provider submission/opening prompts own delivery. */
+    providerOwnsInboxInput(runId, id) {
+        const state = this.active.get(runId);
+        return !!state?.agentInputFlight?.inputIds.includes(id) || state?.openingAgentInputId === id ||
+            this.store.getRun(runId)?.continuationMessage?.agentInputId === id;
+    }
+    canClaimInboxInput(runId, id) {
+        const run = this.store.getRun(runId);
+        const input = run?.agentInputs?.find(entry => entry.id === id);
+        return !this.disposed && !!run && ['queued', 'running', 'waiting'].includes(run.status) &&
+            !this.historyDeletionPending(runId) && !this.executionBlockedByRootFinish(run) && !this.workerExecutionStopped(runId) &&
+            !!input && input.source === 'agent' && !!input.conversation && !input.deliveredAt &&
+            !hasLiveInboxClaim(input) && !this.providerOwnsInboxInput(runId, id);
+    }
+    /** The service supplies authorized, bounded IDs; claim and flight reservations are synchronous. */
+    reserveInboxInputs(runId, generation, ids) {
+        if (!ids.length || ids.some(id => !this.canClaimInboxInput(runId, id)) ||
+            this.store.getRun(runId)?.agentInputs?.some(input => !input.deliveredAt && hasLiveInboxClaim(input)))
+            return undefined;
+        const claim = { receiptId: randomUUID(), generation, expiresAt: new Date(Date.now() + 120_000).toISOString() };
+        this.store.claimInboxInputs(runId, ids, claim);
+        this.armInboxClaimExpiry(runId);
+        return { receiptId: claim.receiptId, expiresAt: claim.expiresAt, inputIds: [...ids] };
+    }
+    acknowledgeInbox(runId, generation, receiptId) {
+        if (this.disposed || this.store.getRun(runId)?.agentInputs?.some(input => input.inboxClaim?.receiptId === receiptId &&
+            !input.deliveredAt && this.providerOwnsInboxInput(runId, input.id)))
+            throw new Error('inbox receipt displaced');
+        const result = this.store.ackInboxInputs(runId, receiptId, generation, new Date().toISOString());
+        this.armInboxClaimExpiry(runId);
+        this.reconcileWorkerWaits();
+        this.deliverConversationInput(runId);
+        this.active.get(runId)?.resumeInboxAutoEnd?.();
+        this.releaseSlot();
+        return result;
+    }
+    releaseInbox(runId, generation, receiptId) {
+        if (this.disposed)
+            throw new Error('inbox manager disposed');
+        const result = this.store.releaseInboxInputs(runId, receiptId, generation);
+        this.armInboxClaimExpiry(runId);
+        this.reconcileWorkerWaits();
+        this.deliverConversationInput(runId);
+        this.releaseSlot();
+        return result;
+    }
+    /** Expiry is an independent wake source, including after the provider's last turn. */
+    armInboxClaimExpiry(runId) {
+        const previous = this.inboxClaimTimers.get(runId);
+        if (previous)
+            clearTimeout(previous);
+        this.inboxClaimTimers.delete(runId);
+        if (this.disposed)
+            return;
+        const deadlines = (this.store.getRun(runId)?.agentInputs ?? []).flatMap(input => input.inboxClaim && !input.inboxClaim.acknowledgedAt ? [Date.parse(input.inboxClaim.expiresAt)] : []);
+        if (!deadlines.length)
+            return;
+        let warned = false;
+        const expire = () => {
+            this.inboxClaimTimers.delete(runId);
+            if (this.disposed || !this.store.getRun(runId))
+                return;
+            try {
+                this.store.clearExpiredInboxClaims(runId, new Date().toISOString());
+                this.reconcileWorkerWaits();
+                this.deliverConversationInput(runId);
+                this.armInboxClaimExpiry(runId);
+                this.releaseSlot();
+            }
+            catch {
+                if (!warned)
+                    console.warn('[cez] inbox expiry checkpoint failed; retrying in 1 second');
+                warned = true;
+                if (!this.disposed)
+                    arm(1_000);
+            }
+        };
+        const arm = (delay) => {
+            const timer = setTimeout(expire, delay);
+            timer.unref?.();
+            this.inboxClaimTimers.set(runId, timer);
+        };
+        arm(Math.max(0, Math.min(...deadlines) - Date.now()));
+    }
     /** Accepted conversation input uses the existing scheduler admission for idle recipients. */
     deliverConversationInput(runId) {
         if (this.disposed)
@@ -2890,15 +3270,21 @@ export class RunManager {
         const run = this.store.getRun(runId);
         if (!run?.delegation || run.delegation.role === 'invalid' || this.historyDeletionPending(runId) ||
             this.executionBlockedByRootFinish(run) || !['queued', 'running', 'waiting'].includes(run.status) ||
-            this.workerExecutionStopped(runId) || this.hasPendingHumanAsk(runId))
+            this.workerExecutionStopped(runId))
+            return;
+        // A pending question holds every other input; only the parent's reply to a routed one
+        // answers it (#505), and the held inputs follow right behind that answer.
+        if (this.hasPendingHumanAsk(runId)) {
+            this.answerRoutedQuestion(runId);
             return;
+        }
         // Retain conversation input until the registered CI wait receives scheduler admission.
         // Converting this monitor into a worker wake would strand both admission paths.
         if (run.ciWait) {
             this.queueCiWake(runId);
             return;
         }
-        const input = run.agentInputs?.find(entry => entry.conversation && !entry.deliveredAt);
+        const input = run.agentInputs?.find(entry => entry.conversation && !entry.deliveredAt && !hasLiveInboxClaim(entry));
         if (!input)
             return;
         const state = this.active.get(runId);
@@ -2923,6 +3309,231 @@ export class RunManager {
         else if (!this.recovering)
             this.flushAgentInputs(runId);
     }
+    /** A worker's pending question goes to its owning parent as a conversation request
+     * (#505). The worker still parks on its ask; only the parent's reply, or a human after
+     * fallback, answers it. Routing is idempotent: the message ID derives from the ask seq. */
+    routeWorkerQuestion(workerId) {
+        const worker = this.store.getRun(workerId);
+        if (worker?.delegation?.role !== 'worker')
+            return;
+        const events = this.store.readEvents(workerId);
+        const ask = pendingHumanAsk(events);
+        if (!ask)
+            return;
+        if (events.some(event => (event.type === 'worker-question-routed' || event.type === 'worker-question-fallback') && event.askSeq === ask.seq))
+            return;
+        const fallback = (reason) => { this.store.appendEvent(workerId, { type: 'worker-question-fallback', askSeq: ask.seq, reason }); };
+        const request = askRequestSchema.safeParse({ questions: ask.questions });
+        if (!request.success) {
+            fallback('the question cannot be carried to the parent');
+            return;
+        }
+        const parentId = worker.delegation.parentRunId;
+        const root = this.store.getRun(parentId);
+        const now = new Date().toISOString();
+        const message = questionMessage({ workerRunId: workerId, parentRunId: parentId, askSeq: ask.seq, request: request.data, now });
+        // Already committed (a crash before the routing event): the question did reach the parent,
+        // whatever its capacity or state is now. Record the routing; fallback sweeps follow.
+        const committed = root?.delegation?.role === 'root' && !!root.delegation.conversation?.messages.some(m => m.id === message.id);
+        if (committed) {
+            this.store.appendEvent(workerId, { type: 'worker-question-routed', askSeq: ask.seq, messageId: message.id, parentRunId: parentId });
+            return;
+        }
+        // Recovery can find a question that never left a worker which has since stopped.
+        if (!['queued', 'running', 'waiting'].includes(worker.status)) {
+            fallback('worker-stopped');
+            return;
+        }
+        if (root?.delegation?.role !== 'root' || !this.parentCanReceive(root)) {
+            fallback('the parent can no longer receive messages');
+            return;
+        }
+        const state = root.delegation.conversation ?? { messages: [], outcomes: [] };
+        // Room in the ledger for the question AND its reply, beside the replies other open questions
+        // reserve. The reply itself is always admitted to this worker's inbox (service.send).
+        if (state.messages.length + openQuestions(state).length + 2 > 1024 || (root.agentInputs ?? []).filter(input => !input.deliveredAt).length >= 32 ||
+            state.messages.filter(m => m.kind === 'request' && m.state === 'accepted' && !state.outcomes.some(o => o.requestId === m.id)).length >= 32) {
+            fallback('the parent conversation is at capacity');
+            return;
+        }
+        const input = { id: message.id, source: 'agent', parentRunId: parentId, text: message.text, createdAt: now,
+            conversation: { senderRunId: workerId, recipientRunId: parentId, kind: 'request' } };
+        this.store.commitConversation(parentId, { ...state, messages: [...state.messages, message] }, { recipientRunId: parentId, input });
+        projectConversationEvents(this.store, this.store.getRun(parentId));
+        this.store.appendEvent(workerId, { type: 'worker-question-routed', askSeq: ask.seq, messageId: message.id, parentRunId: parentId });
+        this.deliverConversationInput(parentId);
+    }
+    /** A human answering a worker question its parent handed back (#505): the reviewing parent
+     * can no longer answer it, so it must not also block the human. */
+    answersFallenBackAsk(runId, opts, deferred) {
+        if (deferred || !(opts.text?.trim() || opts.images?.length))
+            return false;
+        const events = this.store.readEvents(runId);
+        const ask = pendingHumanAsk(events);
+        return !!ask && events.some(event => event.type === 'worker-question-fallback' && event.askSeq === ask.seq);
+    }
+    /** The worker's pending ask when it went to the parent and has not fallen back to a human. */
+    routedAsk(runId) {
+        const run = this.store.getRun(runId);
+        if (run?.delegation?.role !== 'worker')
+            return undefined;
+        const events = this.store.readEvents(runId);
+        const ask = pendingHumanAsk(events);
+        if (!ask || events.some(event => event.type === 'worker-question-fallback' && event.askSeq === ask.seq))
+            return undefined;
+        const routed = events.find(event => event.type === 'worker-question-routed' && event.askSeq === ask.seq);
+        const root = this.store.getRun(run.delegation.parentRunId);
+        const message = routed && root?.delegation?.role === 'root'
+            ? root.delegation.conversation?.messages.find(entry => entry.id === routed.messageId) : undefined;
+        return message ? { askSeq: ask.seq, message } : undefined;
+    }
+    /** The parent's reply answers the routed question like a human answer would: through the
+     * live session's native answer seam, or by reopening a session that is gone (#505). */
+    answerRoutedQuestion(runId, admitted = false) {
+        const routed = this.routedAsk(runId);
+        const run = this.store.getRun(runId);
+        const reply = routed && run?.agentInputs?.find(input => !input.deliveredAt && answersQuestion(routed.message, input));
+        // A stopped worker is the human's to continue; a parent answer never revives it.
+        if (!routed || !reply || run?.delegation?.role !== 'worker' || !['queued', 'running', 'waiting'].includes(run.status))
+            return;
+        // Verbatim: a native answer seam parses `Header: label` lines, exactly as a human's.
+        const text = reply.text;
+        const state = this.active.get(runId);
+        if (!state) {
+            // An automated answer is not a human override: the reopened session waits for capacity.
+            if (this.isActive(runId))
+                return;
+            // As on the live path, the answer supersedes a wait registered before the question.
+            if (this.workerWait(runId)) {
+                try {
+                    this.withdrawWorkerWait(runId);
+                }
+                catch {
+                    return;
+                }
+            }
+            const result = this.continueRun(runId, { text, answerInputId: reply.id }, true);
+            if (!result.ok)
+                this.store.appendEvent(runId, { type: 'note', tone: 'warning', message: `parent answer not delivered: ${result.error}` });
+            return;
+        }
+        if (!state.session?.open || state.cancelled || state.openingAgentInputId === reply.id)
+            return;
+        // Already waiting for admission: only the admission itself may deliver it.
+        if (!admitted && (this.workerWaiting.has(runId) || this.workerWakeQueuedAt.has(runId)))
+            return;
+        if (!admitted && (this.waiting.has(runId) || this.monitoring.has(runId))) {
+            // The parked worker released its slot: the answer rides the ordinary message wake,
+            // which delivers it here once the scheduler admits the worker.
+            const existing = this.workerWait(runId);
+            if (existing?.wakeId !== reply.id) {
+                // An answer supersedes a wait the worker registered before asking, exactly as a
+                // human answer withdraws it; a failed checkpoint leaves both for a later retry.
+                if (existing) {
+                    try {
+                        this.withdrawWorkerWait(runId);
+                    }
+                    catch {
+                        return;
+                    }
+                }
+                const wait = { id: randomUUID(), workerIds: [], outcomes: [],
+                    deadline: new Date().toISOString(), phase: 'wake-pending', reason: 'message', wakeId: reply.id };
+                const current = this.store.getRun(runId)?.delegation;
+                if (current?.role !== 'worker')
+                    return;
+                this.store.commitDelegation([{ id: runId, delegation: { ...current, wait } }]);
+            }
+            this.clearIdleTimer(state);
+            this.clearMonitoringWakeTimer(state, runId);
+            this.waiting.delete(runId);
+            this.monitoring.delete(runId);
+            this.workerWaiting.add(runId);
+            this.queueWorkerWake(runId);
+            return;
+        }
+        const bundle = state.atTurnBoundary === state.session ? this.pendingConversationBatch(runId, state, reply.id) : undefined;
+        if (!state.session.sendMessage([{ type: 'text', text }, ...(bundle ? [{ type: 'text', text: bundle.text }] : [])]))
+            return;
+        this.store.appendEvent(runId, { type: 'human-input-delivered', askSeq: routed.askSeq, source: 'parent' });
+        const delivered = [reply.id, ...(bundle?.inputs.map(input => input.id) ?? [])];
+        this.commitBundledDelivery(runId, state, delivered);
+        // As in submitAgentInput: the wake that admitted this answer is spent, and a stale one
+        // would hold back every later message until the answer's turn ends.
+        if (delivered.includes(this.workerWait(runId)?.wakeId ?? '')) {
+            state.workerWakeTurn = state.session;
+            try {
+                this.withdrawWorkerWait(runId);
+            }
+            catch { /* reconcileWorkerWaits retires it at the turn end */ }
+        }
+        state.pendingHumanAsk = this.hasPendingHumanAsk(runId);
+        if (!state.pendingHumanAsk)
+            this.flushAgentInputs(runId);
+        this.resumeParkedRun(runId, state);
+    }
+    /** A routed question settled without a reply (its worker stopped, a deadline, fallback) can
+     * never be answered by the parent any more: hand it to the human on the worker (#505). */
+    retireSettledQuestions(parentId) {
+        const root = this.store.getRun(parentId);
+        const conversation = root?.delegation?.role === 'root' ? root.delegation.conversation : undefined;
+        if (!conversation)
+            return;
+        for (const message of conversation.messages) {
+            const outcome = message.question && conversation.outcomes.find(entry => entry.requestId === message.id);
+            // A reply still waiting for a live worker answers it; one a stopped worker never took does not.
+            const worker = this.store.getRun(message.senderRunId);
+            const live = !!worker && ['queued', 'running', 'waiting'].includes(worker.status) && !worker.stopping;
+            if (!outcome || (outcome.status === 'replied' && live))
+                continue;
+            const routed = this.routedAsk(message.senderRunId);
+            if (routed?.message.id === message.id) {
+                this.store.appendEvent(message.senderRunId, { type: 'worker-question-fallback', askSeq: routed.askSeq, reason: outcome.status === 'human-fallback' ? `parent-${root.status}` : outcome.status === 'replied' ? 'worker-stopped' : `question-${outcome.status}` });
+            }
+        }
+    }
+    /** Routed questions this parent has not answered yet, by asking worker. */
+    unansweredQuestions(parentId) {
+        return this.store.listRuns().flatMap(run => {
+            if (run.delegation?.role !== 'worker' || run.delegation.parentRunId !== parentId)
+                return [];
+            const routed = this.routedAsk(run.id);
+            const root = this.store.getRun(parentId);
+            const answered = root?.delegation?.role === 'root' && root.delegation.conversation?.outcomes.some(outcome => outcome.requestId === routed?.message.id);
+            return routed && !answered ? [{ workerId: run.id, messageId: routed.message.id }] : [];
+        });
+    }
+    /** The parent can no longer answer: its workers' routed questions go back to the human
+     * (#505). The outcome lands first, so a crash before the worker's event repeats this. */
+    fallbackRoutedQuestions(parentId, reason) {
+        const parent = this.store.getRun(parentId);
+        if (parent?.delegation?.role !== 'root')
+            return;
+        const state = parent.delegation.conversation ?? { messages: [], outcomes: [] };
+        const routed = this.store.listRuns().flatMap(run => {
+            const ask = run.delegation?.role === 'worker' && run.delegation.parentRunId === parentId ? this.routedAsk(run.id) : undefined;
+            // An accepted reply still on its way to a live worker answers it; no human card beside it.
+            const replied = ask && state.outcomes.some(outcome => outcome.requestId === ask.message.id && outcome.status === 'replied');
+            return ask && !(replied && ['queued', 'running', 'waiting'].includes(run.status) && !run.stopping) ? [{ workerId: run.id, ...ask }] : [];
+        });
+        if (!routed.length)
+            return;
+        const observedAt = new Date().toISOString();
+        const missing = routed.filter(entry => !state.outcomes.some(outcome => outcome.requestId === entry.message.id));
+        if (missing.length) {
+            this.store.commitConversation(parentId, { ...state, outcomes: [...state.outcomes,
+                    ...missing.map(entry => ({ requestId: entry.message.id, status: 'human-fallback', observedAt }))] });
+            projectConversationEvents(this.store, this.store.getRun(parentId));
+        }
+        for (const entry of routed)
+            this.store.appendEvent(entry.workerId, { type: 'worker-question-fallback', askSeq: entry.askSeq, reason });
+    }
+    /** The parent can still read and answer a routed question; answering needs its steer grant. */
+    parentCanReceive(parent) {
+        return parent.delegation?.role === 'root' && parent.delegation.permissions.includes('steer') &&
+            ['queued', 'running', 'waiting'].includes(parent.status) && !parent.stopping &&
+            !this.rootFinishRequested(parent.id) && !this.historyDeletionPending(parent.id);
+    }
     /** Cancel only the wait; persist its settlement before ordinary wake admission. */
     cancelWorkerWait(parentId, waitId) {
         const run = this.store.getRun(parentId);
@@ -2992,6 +3603,7 @@ export class RunManager {
             if (next && next !== root.delegation.conversation)
                 this.store.commitConversation(root.id, next);
             projectConversationEvents(this.store, this.store.getRun(root.id));
+            this.retireSettledQuestions(root.id);
             const key = `conversation:${root.id}`;
             const timer = this.workerWaitTimers.get(key);
             if (timer) {
@@ -3037,6 +3649,7 @@ export class RunManager {
                 if (!['queued', 'running', 'waiting'].includes(parent.status)) {
                     if (!this.recovering) {
                         this.withdrawWorkerWait(parent.id);
+                        this.fallbackRoutedQuestions(parent.id, `parent-${parent.status}`);
                         for (const child of this.store.listRuns().filter(child => parent.delegation?.role === 'root' && parent.status !== 'review' && child.delegation?.role === 'worker' && child.delegation.parentRunId === parent.id)) {
                             if (['queued', 'running', 'waiting'].includes(child.status))
                                 this.cancel(child.id);
@@ -3049,14 +3662,24 @@ export class RunManager {
                 const wait = parent.delegation.wait;
                 if (!wait)
                     continue;
-                const delivered = wait.wakeId && parent.agentInputs?.find(input => input.id === wait.wakeId)?.deliveredAt;
+                const delivered = parent.agentInputs?.find(input => input.id === wait.wakeId && input.deliveredAt);
                 if (delivered) {
                     // Receipt persistence precedes the live status update. After a crash
                     // this is interrupted execution, not generic waiting-run success.
-                    if (this.recovering && parent.status === 'waiting' && !this.hasPendingHumanAsk(parent.id)) {
+                    if (this.recovering && !delivered.inboxClaim?.acknowledgedAt && parent.status === 'waiting' && !this.hasPendingHumanAsk(parent.id)) {
                         this.store.updateRun(parent.id, { status: 'running', activity: undefined });
                     }
+                    const state = this.active.get(parent.id);
+                    const inboxParked = delivered.inboxClaim?.acknowledgedAt &&
+                        (this.workerWaiting.has(parent.id) || this.workerWakeAdmitted.has(parent.id)) &&
+                        state?.session?.open && state.atTurnBoundary === state.session;
                     this.withdrawWorkerWait(parent.id);
+                    // Inbox ACK starts no provider turn. Retain the completed turn's slot
+                    // exemption if its registered wait parked while that ACK was in transit.
+                    if (inboxParked && state) {
+                        this.waiting.add(parent.id);
+                        this.armIdleTimer(parent.id, state);
+                    }
                     continue;
                 }
                 const now = new Date().toISOString();
@@ -3098,8 +3721,8 @@ export class RunManager {
                 // already being processed. Their delayed receipts cannot interrupt a wait
                 // registered by that very turn. Only inputs still awaiting a turn can.
                 const flight = this.active.get(parent.id)?.agentInputFlight;
-                const pendingInputs = parent.agentInputs?.filter(input => !input.deliveredAt &&
-                    input.id !== parent.continuationMessage?.agentInputId && !flight?.inputIds.includes(input.id)) ?? [];
+                const pendingInputs = parent.agentInputs?.filter(input => !input.deliveredAt && !hasLiveInboxClaim(input) &&
+                    input.id !== this.active.get(parent.id)?.openingAgentInputId && input.id !== parent.continuationMessage?.agentInputId && !flight?.inputIds.includes(input.id)) ?? [];
                 const incoming = pendingInputs.find(input => input.conversation &&
                     !(input.conversation.kind === 'reply' && input.conversation.requestId && wait.requestIds?.includes(input.conversation.requestId)));
                 if (incoming && next.phase !== 'wake-pending')
@@ -3107,7 +3730,8 @@ export class RunManager {
                 // A full queue of selected replies still needs admission. Use the last
                 // already accepted input as the checkpoint rather than adding a 33rd input.
                 // Its content is preserved; delivery includes the wait receipt separately.
-                if (next.phase === 'wake-pending' && pendingInputs.length >= 32 &&
+                if (next.phase === 'wake-pending' && pendingInputs.length &&
+                    (parent.agentInputs ?? []).filter(input => !input.deliveredAt).length >= 32 &&
                     !parent.agentInputs?.some(input => input.id === next.wakeId)) {
                     next = { ...next, wakeId: pendingInputs.at(-1).id };
                 }
@@ -3172,7 +3796,7 @@ export class RunManager {
             !['queued', 'running', 'waiting'].includes(run.status))
             return;
         const existing = run.agentInputs?.find(input => input.id === wait.wakeId);
-        if (existing?.deliveredAt)
+        if (existing?.deliveredAt || (existing && hasLiveInboxClaim(existing)))
             return;
         // 32 summaries, including worst-case JSON escaping, must fit the ordinary
         // input bound. Full 4k summaries remain in durable outcomes and events.
@@ -3192,6 +3816,10 @@ export class RunManager {
                 return;
         }
         else if (!existing) {
+            // A full inbox snapshot can temporarily own every reply. ACK/expiry will
+            // reconcile again when a lifecycle input can fit or adopt an unread reply.
+            if ((run.agentInputs ?? []).filter(input => !input.deliveredAt).length >= 32)
+                return;
             this.store.commitAgentInputs(parentId, enqueueAgentInput(run, input));
             this.store.appendEvent(parentId, { type: 'agent-input', input });
         }
@@ -3202,7 +3830,9 @@ export class RunManager {
         if (this.recovering)
             return;
         const state = this.active.get(parentId);
-        if (this.hasPendingHumanAsk(parentId) || state?.pendingHumanAsk || this.workerWakeQueuedAt.has(parentId))
+        // A parent's reply to a routed question (#505) is the one message a pending ask admits.
+        const parentAnswer = wait.reason === 'message' && this.routedAsk(parentId) !== undefined;
+        if ((!parentAnswer && (this.hasPendingHumanAsk(parentId) || state?.pendingHumanAsk)) || this.workerWakeQueuedAt.has(parentId))
             return;
         if (state) {
             // Expiring a registered intent NEVER exempts a still-executing turn.
@@ -3292,7 +3922,227 @@ export class RunManager {
         const run = this.store.getRun(runId);
         return !!run && ['queued', 'running', 'waiting'].includes(run.status) &&
             !(run.delegation?.role === 'worker' && run.delegation.destroy) &&
-            !!run.agentInputs?.some(input => !input.deliveredAt);
+            (!!run.agentInputs?.some(input => !input.deliveredAt) || this.harnessOwesInput(this.active.get(runId)));
+    }
+    /** Only the current session's observation writes consumedAt (#505). An ID reported
+     * before its acceptance checkpoint lands is applied when that checkpoint commits. */
+    handleAgentInputConsumed(runId, state, session, ids) {
+        if (!session || this.active.get(runId) !== state || state.session !== session)
+            return;
+        const inFlight = state.agentInputFlight?.inputIds ?? [];
+        for (const id of ids)
+            if (inFlight.includes(id))
+                state.consumedBeforeAck?.add(id);
+        const read = ids.filter(id => !inFlight.includes(id));
+        for (const id of read)
+            state.unreadInputIds?.delete(id);
+        if (!this.harnessOwesInput(state))
+            this.clearUnreadInputTimer(state);
+        try {
+            if (!read.length)
+                return;
+            this.store.commitAgentInputsConsumed(runId, read, new Date().toISOString());
+            this.reconcileWorkerWaits(); // projects the consumed receipt
+        }
+        catch (error) {
+            console.warn(`[cez] agent input consumption checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** #505: input the harness accepted but will never read returns to the queue, so
+     * DONE, auto-end and park see queued work. Out of a turn (an OpenCode lost wake)
+     * it is submitted right away; at a turn-end the handler's own flush submits it. */
+    retireUnreadInputs(runId, state, ids, outOfTurn) {
+        if (!ids.length || state.cancelled || this.active.get(runId) !== state)
+            return;
+        // Durable first: a failed checkpoint must never let this boundary finish (DONE, park)
+        // over input that is still marked delivered but was never read.
+        try {
+            this.store.requeueUnconsumedAgentInputs(runId, ids);
+        }
+        catch (error) {
+            if (state.agentInputError)
+                return;
+            state.agentInputError = `agent input requeue checkpoint failed: ${error instanceof Error ? error.message : String(error)}`;
+            try {
+                state.session?.interrupt();
+            }
+            finally {
+                try {
+                    this.store.appendEvent(runId, { type: 'error', message: state.agentInputError });
+                }
+                catch {
+                    console.error(`[cez] ${state.agentInputError}`);
+                }
+            }
+            return;
+        }
+        for (const id of ids)
+            state.unreadInputIds?.delete(id);
+        // Reported before its own acknowledgement landed: that acknowledgement must not
+        // mark it delivered again.
+        for (const id of ids)
+            if (state.agentInputFlight?.inputIds.includes(id))
+                (state.retiredInFlight ??= new Set()).add(id);
+        this.store.appendEvent(runId, { type: 'note', message: `resubmitting ${ids.length} message${ids.length === 1 ? '' : 's'} the agent did not read` });
+        if (outOfTurn)
+            this.flushAgentInputs(runId);
+    }
+    /** #505: the harness started the opening turn, so the opening input was accepted.
+     * Its replay-prompt retirement still waits for that turn's successful end. */
+    recordOpeningAccepted(runId, state) {
+        const id = state.openingAgentInputId;
+        if (!id || state.cancelled || this.active.get(runId) !== state)
+            return;
+        const inputs = this.store.getRun(runId)?.agentInputs ?? [];
+        if (!inputs.some(input => input.id === id && !input.deliveredAt))
+            return;
+        const deliveredAt = new Date().toISOString();
+        try {
+            this.store.commitAgentInputs(runId, inputs.map(input => input.id === id ? { ...input, deliveredAt } : input));
+        }
+        catch (error) {
+            console.warn(`[cez] opening input acceptance checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** The conversation messages the next submission would carry, if nothing but
+     * conversation input leads the queue (lifecycle input stays a barrier). */
+    pendingConversationBatch(runId, state, answerId) {
+        const run = this.store.getRun(runId);
+        if (!run || run.ciWait || state.agentInputFlight || this.workerWait(runId))
+            return undefined;
+        const batch = agentInputBatch((run.agentInputs ?? []).filter(input => input.id !== state.openingAgentInputId && input.id !== answerId), input => this.formatAgentInput(runId, input));
+        return batch?.inputs.every(input => input.conversation) ? batch : undefined;
+    }
+    /** Bundled messages rode the answer's own write: delivered now, read when that turn ends. */
+    commitBundledDelivery(runId, state, ids) {
+        const deliveredAt = new Date().toISOString();
+        const awaiting = state.inputDelivery?.consumption === 'observable' ? { awaitingRead: true } : {};
+        try {
+            this.store.commitAgentInputs(runId, (this.store.getRun(runId)?.agentInputs ?? []).map(input => ids.includes(input.id) && !input.deliveredAt ? { ...input, deliveredAt, ...awaiting } : input));
+            state.bundledInputIds = [...(state.bundledInputIds ?? []), ...ids];
+        }
+        catch (error) {
+            console.warn(`[cez] bundled delivery checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** The turn that carried bundled messages has ended: the model read them. */
+    readBundledInputs(runId, state) {
+        const ids = state.bundledInputIds ?? [];
+        state.bundledInputIds = undefined;
+        if (!ids.length || state.cancelled)
+            return;
+        try {
+            this.store.commitAgentInputsConsumed(runId, ids, new Date().toISOString());
+            this.reconcileWorkerWaits();
+        }
+        catch (error) {
+            console.warn(`[cez] bundled read checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** #505: the session closed without reporting it read (failure, stop, exit): the input
+     * goes back to the queue so a later session delivers it; never shown as delivered. */
+    requeueUnreadAtClose(runId, state, session) {
+        this.clearUnreadInputTimer(state);
+        // Everything this session accepted but never saw read: steered input, messages bundled
+        // behind a human answer, and an opening instruction whose turn never succeeded.
+        const opening = state.openingAgentInputId && this.store.getRun(runId)?.agentInputs?.some(input => input.id === state.openingAgentInputId && input.deliveredAt && !input.consumedAt) ? [state.openingAgentInputId] : [];
+        const ids = [...new Set([...(state.unreadInputIds ?? []), ...(state.bundledInputIds ?? []), ...opening])];
+        if (!session || !ids.length || this.active.get(runId) !== state || state.session !== session)
+            return;
+        state.unreadInputIds?.clear();
+        state.bundledInputIds = undefined;
+        try {
+            this.store.requeueUnconsumedAgentInputs(runId, ids);
+        }
+        catch (error) {
+            console.warn(`[cez] agent input requeue failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** An idle, open boundary with nothing left to deliver: DONE closes, otherwise the
+     * run parks as waiting or monitoring. Shared by acknowledgements that land after a
+     * turn ended and by the unread-input grace timer (#505). */
+    settleIdleBoundary(runId, state, session) {
+        if (state.atTurnBoundary !== session || state.pendingHumanAsk || this.workerWait(runId) || this.store.getRun(runId)?.ciWait || this.hasQueuedAgentInputs(runId))
+            return;
+        if (state.doneAtBoundary === session) {
+            if (this.deferParentCompletion(runId))
+                return;
+            this.store.appendEvent(runId, { type: 'lifecycle', message: 'goal achieved — session closed' });
+            appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — goal achieved, session closed');
+            session.end();
+        }
+        else if (state.parkAfterAck?.session === session && !this.waiting.has(runId) && !this.monitoring.has(runId)) {
+            // A wake turn can finish before its HTTP/RPC acknowledgement. Retiring
+            // that wait must release its completed turn, not invent another turn.
+            if ((state.parkAfterAck.monitoring || this.hasLiveWorkers(runId)) && !this.parentCompletionAttention(runId)) {
+                this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
+                if (state.currentStepId)
+                    this.store.updateStep(runId, state.currentStepId, { status: 'running' });
+                this.monitoring.add(runId);
+                this.clearIdleTimer(state);
+                this.armMonitoringWakeTimer(runId, state);
+            }
+            else {
+                this.store.updateRun(runId, { status: 'waiting', activity: undefined });
+                if (state.currentStepId)
+                    this.store.updateStep(runId, state.currentStepId, { status: 'waiting' });
+                this.store.flush(); // Match ordinary turn-end durability before releasing capacity.
+                this.armIdleTimer(runId, state);
+            }
+            this.waiting.add(runId);
+            this.releaseSlot();
+        }
+    }
+    /** #505 liveness bound: a harness that accepted input and then neither read it nor ran
+     * another turn must not hold the run and its slot forever. After a quiet grace window the
+     * input is resubmitted once; after a second it is left delivered but unconfirmed. */
+    armUnreadInputTimer(runId, state) {
+        this.clearUnreadInputTimer(state);
+        const session = state.session;
+        if (!session?.open || !this.harnessOwesInput(state) || state.agentInputFlight)
+            return;
+        const timer = setTimeout(() => {
+            state.unreadInputTimer = undefined;
+            if (this.disposed || this.active.get(runId) !== state || state.session !== session || !session.open || state.cancelled ||
+                state.agentInputFlight || !this.harnessOwesInput(state))
+                return;
+            const ids = [...state.unreadInputIds];
+            const retried = ids.filter(id => state.unreadRetried?.has(id));
+            const fresh = ids.filter(id => !state.unreadRetried?.has(id));
+            if (retried.length) {
+                for (const id of retried)
+                    state.unreadInputIds?.delete(id);
+                try {
+                    this.store.commitAgentInputsUnconfirmed(runId, retried);
+                }
+                catch { /* receipt stays awaiting; a restart replays it */ }
+                this.store.appendEvent(runId, { type: 'note', message: `delivered ${retried.length} message${retried.length === 1 ? '' : 's'}; the agent did not confirm reading ${retried.length === 1 ? 'it' : 'them'}` });
+            }
+            if (fresh.length) {
+                state.unreadRetried ??= new Set();
+                for (const id of fresh)
+                    state.unreadRetried.add(id);
+                this.retireUnreadInputs(runId, state, fresh, true);
+            }
+            // No content since the last turn ended: the harness is idle, whatever turn it announced.
+            if (!this.harnessOwesInput(state) && !state.agentInputFlight) {
+                state.atTurnBoundary = session;
+                if (state.parkAfterAck?.session !== session)
+                    state.parkAfterAck = { session, monitoring: false };
+                this.settleIdleBoundary(runId, state, session);
+            }
+        }, this.unreadInputGraceMs);
+        timer.unref?.();
+        state.unreadInputTimer = timer;
+    }
+    clearUnreadInputTimer(state) {
+        if (state.unreadInputTimer)
+            clearTimeout(state.unreadInputTimer);
+        state.unreadInputTimer = undefined;
+    }
+    /** #505: the harness accepted input this session has not reported reading yet. */
+    harnessOwesInput(state) {
+        return !!state?.unreadInputIds?.size;
     }
     /** A callback from an old/replaced/disposed session carries no authority. */
     handleAgentInputReady(runId, state, session) {
@@ -3328,7 +4178,7 @@ export class RunManager {
         };
         let acknowledgement;
         try {
-            acknowledgement = session.sendAgentMessage(content);
+            acknowledgement = session.sendAgentMessage(content, inputIds);
         }
         catch (error) {
             fail(error, false);
@@ -3361,8 +4211,25 @@ export class RunManager {
                     }
                     else {
                         const deliveredAt = new Date().toISOString();
-                        this.store.commitAgentInputs(runId, queue.map(input => inputIds.includes(input.id) && !input.deliveredAt
-                            ? { ...input, deliveredAt } : input));
+                        // An observable harness still owes a read: mark it so a restart replays it (#505).
+                        const awaiting = state.inputDelivery?.consumption === 'observable' ? { awaitingRead: true } : {};
+                        // Input the harness reported unread while this very POST was pending stays queued:
+                        // the flush after this acknowledgement resubmits it (#505 review).
+                        const accepted = inputIds.filter(id => !state.retiredInFlight?.has(id));
+                        for (const id of inputIds)
+                            state.retiredInFlight?.delete(id);
+                        this.store.commitAgentInputs(runId, queue.map(input => accepted.includes(input.id) && !input.deliveredAt
+                            ? { ...input, deliveredAt, ...awaiting } : input));
+                        if (state.inputDelivery?.consumption === 'observable') {
+                            const early = accepted.filter(id => state.consumedBeforeAck?.has(id));
+                            for (const id of accepted)
+                                if (!early.includes(id))
+                                    state.unreadInputIds?.add(id);
+                            for (const id of early)
+                                state.consumedBeforeAck?.delete(id);
+                            if (early.length)
+                                this.store.commitAgentInputsConsumed(runId, early, deliveredAt);
+                        }
                     }
                     if (inputIds.includes(this.workerWait(runId)?.wakeId ?? ''))
                         this.withdrawWorkerWait(runId);
@@ -3379,38 +4246,13 @@ export class RunManager {
             state.agentInputFlight = undefined;
             if (!authorized || !session.open || state.agentSessionError || state.agentInputError)
                 return;
+            // A liveness resubmission gets its own quiet window, and so does input acknowledged
+            // after its turn already ended: no later turn-end would arm one (#505 review).
+            if (inputIds.some(id => state.unreadRetried?.has(id)) || state.atTurnBoundary === session)
+                this.armUnreadInputTimer(runId, state);
             if (this.flushAgentInputs(runId))
                 return;
-            if (state.atTurnBoundary !== session || state.pendingHumanAsk || this.workerWait(runId) || this.store.getRun(runId)?.ciWait || this.hasQueuedAgentInputs(runId))
-                return;
-            if (state.doneAtBoundary === session) {
-                if (this.deferParentCompletion(runId))
-                    return;
-                this.store.appendEvent(runId, { type: 'lifecycle', message: 'goal achieved — session closed' });
-                appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — goal achieved, session closed');
-                session.end();
-            }
-            else if (state.parkAfterAck?.session === session && !this.waiting.has(runId) && !this.monitoring.has(runId)) {
-                // A wake turn can finish before its HTTP/RPC acknowledgement. Retiring
-                // that wait must release its completed turn, not invent another turn.
-                if ((state.parkAfterAck.monitoring || this.hasLiveWorkers(runId)) && !this.parentCompletionAttention(runId)) {
-                    this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
-                    if (state.currentStepId)
-                        this.store.updateStep(runId, state.currentStepId, { status: 'running' });
-                    this.monitoring.add(runId);
-                    this.clearIdleTimer(state);
-                    this.armMonitoringWakeTimer(runId, state);
-                }
-                else {
-                    this.store.updateRun(runId, { status: 'waiting', activity: undefined });
-                    if (state.currentStepId)
-                        this.store.updateStep(runId, state.currentStepId, { status: 'waiting' });
-                    this.store.flush(); // Match ordinary turn-end durability before releasing capacity.
-                    this.armIdleTimer(runId, state);
-                }
-                this.waiting.add(runId);
-                this.releaseSlot();
-            }
+            this.settleIdleBoundary(runId, state, session);
         }).catch(error => {
             // Bookkeeping failures cannot become unhandled promise rejections.
             if (state.agentInputFlight === undefined)
@@ -3445,10 +4287,9 @@ export class RunManager {
             return false;
         if (state.pendingHumanAsk || this.hasUnansweredHumanAsk(runId))
             return false;
-        // The opening prompt already carries this input. It must not be resubmitted
-        // by a readiness callback before the first successful turn checkpoints it.
-        if (state.openingAgentInputId)
-            return false;
+        // The opening prompt already carries its own input; later input steers the
+        // opening turn instead of waiting for it to end (#505).
+        const queue = (run.agentInputs ?? []).filter(input => input.id !== state.openingAgentInputId);
         if (run.ciWait) {
             if (!this.ciWakeAdmitted.has(runId) || state.atTurnBoundary !== state.session)
                 return false;
@@ -3456,7 +4297,7 @@ export class RunManager {
             const input = run.agentInputs?.find(entry => entry.id === run.ciWait?.wakeId && !entry.deliveredAt);
             return !!input && this.submitAgentInput(runId, state, [{ type: 'text', text: this.formatAgentInput(runId, input) }], [input.id]);
         }
-        const batch = agentInputBatch(run.agentInputs ?? [], input => this.formatAgentInput(runId, input));
+        const batch = agentInputBatch(queue, input => this.formatAgentInput(runId, input));
         return !!batch && this.submitAgentInput(runId, state, [{ type: 'text', text: batch.text }], batch.inputs.map(input => input.id));
     }
     formatAgentInput(runId, input) {
@@ -3553,6 +4394,10 @@ export class RunManager {
             return false;
         if (!userAuthored && run.ciWait)
             return false;
+        if (userAuthored && this.routedAsk(runId)) {
+            this.store.appendEvent(runId, { type: 'note', tone: 'warning', message: ROUTED_QUESTION_REFUSAL });
+            return false;
+        }
         const text = content
             .filter((b) => b.type === 'text')
             .map((b) => b.text)
@@ -3584,7 +4429,11 @@ export class RunManager {
             ? [...expanded, pastedAttachmentsNote(persisted)]
             : expanded.length ? expanded : [{ type: 'text', text: 'The user attached a document, but it could not be saved. Ask them to attach it again before discussing its contents.' }];
         const answeringAskSeq = userAuthored ? this.pendingHumanAskSeq(runId) : undefined;
-        const delivered = userAuthored ? state.session.sendMessage(deliverable)
+        // #505: an answer that opens a new turn (a CEZ:ASK answer at a boundary) carries the
+        // held conversation messages in the same submission, after the answer.
+        const bundle = userAuthored && answeringAskSeq !== undefined && state.atTurnBoundary === state.session
+            ? this.pendingConversationBatch(runId, state) : undefined;
+        const delivered = userAuthored ? state.session.sendMessage(bundle ? [...deliverable, { type: 'text', text: bundle.text }] : deliverable)
             : this.submitAgentInput(runId, state, deliverable);
         if (delivered) {
             if (userAuthored) {
@@ -3594,6 +4443,12 @@ export class RunManager {
                     this.store.appendEvent(runId, { type: 'human-input-delivered', askSeq: answeringAskSeq });
                 }
                 state.pendingHumanAsk = this.hasPendingHumanAsk(runId);
+                if (bundle)
+                    this.commitBundledDelivery(runId, state, bundle.inputs.map(input => input.id));
+                // A native answer continues the turn, and a bundle can leave messages that did not
+                // fit its batch: either way the rest steer right behind the answer.
+                if (answeringAskSeq !== undefined && !state.pendingHumanAsk)
+                    this.flushAgentInputs(runId);
             }
             this.resumeParkedRun(runId, state);
         }
@@ -3690,6 +4545,20 @@ export class RunManager {
         }
         return -1;
     }
+    /**
+     * Session ids Cursor will accept on `session/load`. A launch UUID written
+     * before `session.started` is only for the step rail (#583).
+     */
+    resumableSessionId(runId, sessionStep) {
+        if (!sessionStep?.sessionId)
+            return undefined;
+        if ((sessionStep.backend ?? this.store.getRun(runId)?.runner) === 'cursor') {
+            const confirmed = this.store.readEvents(runId).some((event) => event.type === 'session' && event.sessionId === sessionStep.sessionId);
+            if (!confirmed)
+                return undefined;
+        }
+        return sessionStep.sessionId;
+    }
     /**
      * "Continue" (spec 003): reopen a finished run's claude session in-process
      * (`claude --resume <sessionId>`) as a new synthetic step. The session then
@@ -3715,7 +4584,7 @@ export class RunManager {
             return { ok: false, error: 'run is still stopping' };
         if (this.historyDeletionPending(runId))
             return { ok: false, error: 'Parent history deletion is pending; retry deletion' };
-        if (run.delegation?.role === 'worker' && this.store.getRun(run.delegation.parentRunId)?.status === 'review') {
+        if (run.delegation?.role === 'worker' && this.store.getRun(run.delegation.parentRunId)?.status === 'review' && !opts.answerInputId && !this.answersFallenBackAsk(runId, opts, deferForCapacity)) {
             return { ok: false, error: 'Continue the reviewing parent before continuing its worker' };
         }
         // Held against the identity of the step this continuation extends (#452), which for a mixed
@@ -3750,8 +4619,10 @@ export class RunManager {
             return { ok: false, error: 'worker cannot continue' };
         if (this.executionBlockedByRootFinish(run))
             return { ok: false, error: 'parent finish is pending' };
+        if (pendingHumanAsk && !deferForCapacity && !opts.answerInputId && this.routedAsk(runId))
+            return { ok: false, error: ROUTED_QUESTION_REFUSAL };
         const answers = deferForCapacity ? [run.continuationMessage, ...(run.queuedMessages ?? [])] : [opts];
-        if (pendingHumanAsk && (conversation || (deferForCapacity && run.continuationMessage?.origin !== 'human') ||
+        if (pendingHumanAsk && !opts.answerInputId && (conversation || (deferForCapacity && run.continuationMessage?.origin !== 'human') ||
             !answers.some(answer => answer?.text?.trim() || answer?.images?.length))) {
             return { ok: false, error: 'pending human question requires an explicit answer' };
         }
@@ -3788,6 +4659,7 @@ export class RunManager {
         // account is what decides whether the session can be reattached (#452).
         const accountSwitched = (opts.agentProfile ?? resumeIdentity?.account.profileId ?? run.agentProfile ?? sessionAccount) !== sessionAccount;
         const resume = sessionBackend === targetRunner && !accountSwitched;
+        const resumeSessionId = resume ? this.resumableSessionId(runId, sessionStep) : undefined;
         // Follow-up runner/model/account override (#401, spec 2026-07-29-agent-profiles): the composer
         // lets the user pick which backend, model and login handle this continuation — the same flat
         // pill the /new composer offers. Omitted → the run's current backend/model/account is kept
@@ -3857,8 +4729,8 @@ export class RunManager {
                         } };
                 this.beginWorkerExecution(runId, false);
             }
-            catch {
-                return { ok: false, error: 'original execution checkpoint unavailable' };
+            catch (error) {
+                return { ok: false, error: admissionError(error, 'original execution checkpoint unavailable') };
             }
             const content = [
                 ...(opts.text?.trim() ? [{ type: 'text', text: opts.text.trim() }] : []), ...(opts.images ?? []),
@@ -3879,8 +4751,8 @@ export class RunManager {
         try {
             this.beginWorkerExecution(runId, !deferForCapacity);
         }
-        catch {
-            return { ok: false, error: 'worker execution checkpoint unavailable' };
+        catch (error) {
+            return { ok: false, error: admissionError(error, 'worker execution checkpoint unavailable') };
         }
         // Everything that could refuse this continuation has now passed, so a pending usage-limit
         // resume is superseded either way: this IS that resume (it re-stamps its own counter), or a
@@ -3899,7 +4771,7 @@ export class RunManager {
         const continuationStep = { id: stepId, name: 'Continue', kind: 'agent', synthetic: 'continuation' };
         if (run.delegation?.role !== 'worker')
             this.store.addStep(runId, continuationStep);
-        const recovered = deferForCapacity && !conversation ? run.continuationMessage : undefined;
+        const recovered = deferForCapacity && !conversation && !opts.answerInputId ? run.continuationMessage : undefined;
         const message = recovered ?? this.toQueuedMessage(runId, [
             ...(opts.text?.trim() ? [{ type: 'text', text: opts.text.trim() }] : []),
             ...(opts.images ?? []),
@@ -3909,8 +4781,9 @@ export class RunManager {
         // and the original prompt/URLs must reach disk before the first startup await.
         const acceptedPatch = {
             continuationMessage: { ...message, id: stepId, text: prompt,
-                ...(conversation ? { agentInputId: conversation.input.id } : {}),
-                origin: recovered ? recovered.origin : deferForCapacity ? 'lifecycle' : 'human' },
+                ...(conversation ? { agentInputId: conversation.input.id } : opts.answerInputId ? { agentInputId: opts.answerInputId } : {}),
+                // A parent's answer (#505) answers the ask exactly like a human's.
+                origin: recovered ? recovered.origin : deferForCapacity && !opts.answerInputId ? 'lifecycle' : 'human' },
             status: deferForCapacity ? 'queued' : 'running',
             error: undefined,
             finishedAt: undefined,
@@ -3939,7 +4812,7 @@ export class RunManager {
         if (deferForCapacity) {
             this.pendingContinuations.set(runId, {
                 stepId,
-                sessionId: resume ? sessionStep?.sessionId : undefined,
+                sessionId: resumeSessionId,
                 backend: targetRunner,
                 prompt,
                 images,
@@ -3957,7 +4830,7 @@ export class RunManager {
             return { ok: true };
         }
         this.starting.add(runId);
-        void this.runContinuation(runId, stepId, resume ? sessionStep?.sessionId : undefined, targetRunner, prompt, images).catch((err) => {
+        void this.runContinuation(runId, stepId, resumeSessionId, targetRunner, prompt, images).catch((err) => {
             const message = err instanceof Error ? err.message : String(err);
             this.store.updateRun(runId, {
                 status: 'failed',
@@ -4087,12 +4960,15 @@ export class RunManager {
         const openingInput = record?.agentInputs?.find(input => input.id === checkpoint?.agentInputId);
         // Hydration has already included later human updates and task edits. Append
         // the current obligation outcome without replacing that composed prompt.
-        if (openingInput)
+        // A parent's answer to a routed question (#505) is shown as its conversation reply, not
+        // as a human message, and its own reply outcome is not news to the worker.
+        const parentAnswer = openingInput?.conversation?.kind === 'reply' && this.routedAsk(runId) !== undefined;
+        if (openingInput && !parentAnswer)
             prompt += this.agentInputOutcomeText(openingInput);
         const saved = this.readPersistedAttachments(runId, checkpoint?.id === stepId ? checkpoint.images ?? [] : [], 'continuation');
         const openingImages = [...(images.length ? contentBlocksOf(images) : saved.blocks), ...persistedImages];
         const attachments = [...saved.attachments, ...persistedAttachments];
-        if (checkpoint?.origin !== 'lifecycle')
+        if (checkpoint?.origin !== 'lifecycle' && !parentAnswer)
             this.store.appendEvent(runId, {
                 type: 'user-message',
                 stepId,
@@ -4103,7 +4979,6 @@ export class RunManager {
         let openingAnswerAskSeq = checkpoint?.origin === 'human' ? this.pendingHumanAskSeq(runId) : undefined;
         state.openingAnswerAskSeq = openingAnswerAskSeq;
         state.pendingHumanAsk = openingAnswerAskSeq === undefined && this.hasPendingHumanAsk(runId);
-        let stepCost = 0;
         let turnText = '';
         let completedAssistantText = '';
         let sawClaudeScheduleWakeup = false;
@@ -4122,13 +4997,22 @@ export class RunManager {
                 return;
             }
             if (event.type === 'text') {
+                this.clearUnreadInputTimer(state); // real content: the harness is working
                 turnText = appendTurnText(turnText, event.text);
                 const text = stripAskMarker(stripTaskMarkers(stripMonitoringMarker(stripDoneMarker(event.text))), false);
                 if (text)
                     this.store.appendEvent(runId, { type: 'text', text, stepId });
                 return;
             }
+            if (event.type === 'input-unconsumed') {
+                this.retireUnreadInputs(runId, state, event.inputIds, true);
+                return;
+            }
+            if (event.type === 'tool-call' || event.type === 'tool-result')
+                this.clearUnreadInputTimer(state);
             this.store.appendEvent(runId, { ...event, stepId });
+            if (event.type === 'cost')
+                this.recordReportedCost(runId, stepId, state, backend, event.usd);
             if (event.type === 'error') {
                 // Preserve the initiating fault: interrupt may fail an in-flight HTTP request.
                 sessionError ??= state.agentInputError ?? event.message;
@@ -4144,13 +5028,11 @@ export class RunManager {
             if (event.type === 'token-usage') {
                 this.store.updateStep(runId, stepId, { tokensUsed: event.tokensUsed });
             }
-            if (event.type === 'cost') {
-                stepCost += event.usd;
-                this.store.updateStep(runId, stepId, { costUsd: stepCost });
-            }
             if (isClaudeScheduleWakeup(event, backend))
                 sawClaudeScheduleWakeup = true;
             if (event.type === 'turn-end') {
+                this.retireUnreadInputs(runId, state, event.unconsumedInputIds ?? [], false);
+                this.readBundledInputs(runId, state);
                 state.workerWakeTurn = undefined;
                 state.ciWakeTurn = undefined;
                 state.atTurnBoundary = state.session;
@@ -4162,7 +5044,13 @@ export class RunManager {
                         const id = state.openingAgentInputId;
                         const deliveredAt = new Date().toISOString();
                         try {
-                            this.store.commitAgentInputs(runId, (this.store.getRun(runId)?.agentInputs ?? []).map(input => input.id === id && !input.deliveredAt ? { ...input, deliveredAt } : input), id);
+                            // The successful opening turn handled its instruction: delivered and read (#505).
+                            this.store.commitAgentInputs(runId, (this.store.getRun(runId)?.agentInputs ?? []).map(input => {
+                                if (input.id !== id)
+                                    return input;
+                                const { awaitingRead: _awaiting, ...handled } = input;
+                                return { ...handled, deliveredAt: input.deliveredAt ?? deliveredAt, consumedAt: input.consumedAt ?? deliveredAt };
+                            }), id);
                         }
                         catch (error) {
                             state.agentInputError = `agent input delivery checkpoint failed: ${error instanceof Error ? error.message : String(error)}`;
@@ -4183,7 +5071,7 @@ export class RunManager {
                         this.reconcileWorkerWaits();
                     }
                     if (openingAnswerAskSeq !== undefined && state.session?.open) {
-                        this.store.appendEvent(runId, { type: 'human-input-delivered', askSeq: openingAnswerAskSeq });
+                        this.store.appendEvent(runId, { type: 'human-input-delivered', askSeq: openingAnswerAskSeq, ...(parentAnswer ? { source: 'parent' } : {}) });
                         openingAnswerAskSeq = undefined;
                         state.openingAnswerAskSeq = undefined;
                     }
@@ -4221,7 +5109,11 @@ export class RunManager {
                 const workerWaitParked = ciWaitParked || completionBlocked || (!!sessionOpen && this.parkWorkerWait(runId, state));
                 state.doneAtBoundary = done ? state.session : undefined;
                 state.parkAfterAck = sessionOpen && state.session ? { session: state.session, monitoring: !!monitoring } : undefined;
-                const agentInputDelivered = !ask && !workerWaitParked && this.flushAgentInputs(runId);
+                // #505: input the harness accepted but has not read yet runs as its next turn.
+                // An in-flight submission is settled by its acknowledgement (parkAfterAck), not here.
+                const agentInputDelivered = !ask && !workerWaitParked && (this.flushAgentInputs(runId) || this.harnessOwesInput(state) || !!state.agentInputFlight);
+                if (!ask && !workerWaitParked)
+                    this.armUnreadInputTimer(runId, state);
                 if (state.agentInputError)
                     return;
                 if (done && !workerWaitParked && !state.pendingHumanAsk && !agentInputDelivered && !state.agentInputFlight && !this.hasQueuedAgentInputs(runId)) {
@@ -4257,8 +5149,10 @@ export class RunManager {
                         // `ScheduleWakeup` → non-attention `running`/`activity:'monitoring'`
                         // (#490, #46). Both free the slot; only genuine user waits keep the
                         // idle timer. The autonomous nudge above still wins over either.
-                        if (ask)
+                        if (ask) {
                             emitAskRequested(sink, ask);
+                            this.routeWorkerQuestion(runId);
+                        }
                         if (monitoring) {
                             this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
                             this.store.updateStep(runId, stepId, { status: 'running' });
@@ -4395,11 +5289,14 @@ export class RunManager {
             failBeforeSpawn(err.message);
             return;
         }
-        if (state.cancelled) {
+        const settlePrelaunchCancellation = () => {
             this.store.updateStep(runId, stepId, { status: 'cancelled' });
             this.store.updateRun(runId, { status: 'cancelled', finishedAt: new Date().toISOString(), currentStepId: undefined });
             this.clearAutosaveTimer(state);
             this.dropActive(runId);
+        };
+        if (state.cancelled) {
+            settlePrelaunchCancellation();
             return;
         }
         if (this.holdContinuationForRootFinish(runId, { stepId, sessionId, backend, prompt, images }, state))
@@ -4424,12 +5321,36 @@ export class RunManager {
         }
         const delegation = this.provisionSession(runId, state);
         const ciTools = await this.provisionCiSession(runId, state);
+        // Stop/Finish can arrive while the local tool controller is starting.
+        const launchRun = this.store.getRun(runId);
+        if (state.cancelled || this.workerExecutionStopped(runId) || this.active.get(runId) !== state ||
+            (launchRun && this.executionBlockedByRootFinish(launchRun))) {
+            ciTools?.revoke();
+            if (state.revokeCiTools === ciTools?.revoke)
+                state.revokeCiTools = undefined;
+            delegation?.revoke();
+            if (state.revokeDelegation === delegation?.revoke)
+                state.revokeDelegation = undefined;
+            if (this.active.get(runId) !== state)
+                return;
+            if (state.cancelled || this.workerExecutionStopped(runId)) {
+                state.cancelled = true;
+                settlePrelaunchCancellation();
+            }
+            else {
+                this.holdContinuationForRootFinish(runId, { stepId, sessionId, backend, prompt, images }, state);
+            }
+            return;
+        }
+        state.inputDelivery = inputDeliveryOf(runner);
+        state.unreadInputIds = new Set();
+        state.consumedBeforeAck = new Set();
         try {
             session = runner.startSession({
                 // The Continue step is a fresh agent session on the same run — the
                 // run's extra system prompt (already resolved at execute time and
                 // echoed on the record) rides along with the handoff contract.
-                systemPrompt: composeSystemPrompt(record?.systemPrompt, delegation?.instructions, generateFollowups ? HANDOFF_INSTRUCTIONS : HANDOFF_ONLY_INSTRUCTIONS),
+                systemPrompt: composeSystemPrompt(record?.systemPrompt, delegation?.instructions, artifactInstructions(continueProfile.env.CEZ_ARTIFACTS_DIR), generateFollowups ? HANDOFF_INSTRUCTIONS : HANDOFF_ONLY_INSTRUCTIONS),
                 userPrompt: attachments.length
                     ? `${openingPrompt}\n\n${pastedAttachmentsText(attachments)}`
                     : openingPrompt,
@@ -4449,9 +5370,12 @@ export class RunManager {
             }, onEvent, {
                 onUiEvent: (event) => {
                     completedAssistantText = appendCompletedAssistantText(completedAssistantText, event);
+                    if (event.type === 'turn.started')
+                        this.recordOpeningAccepted(runId, state);
                     this.handleRunnerUiEvent(runId, state, sink, event);
                 },
                 onAgentInputReady: () => this.handleAgentInputReady(runId, state, session),
+                onAgentInputConsumed: (ids) => this.handleAgentInputConsumed(runId, state, session, ids),
             });
         }
         catch (error) {
@@ -4470,10 +5394,12 @@ export class RunManager {
         try {
             this.flushDeferred(runId);
             this.flushAgentInputs(runId);
-            if (session.pid !== undefined)
+            if (session.pid !== undefined) {
                 registerRunProcess(runId, session.pid);
+                this.recordWorkerProcess(runId, session.pid);
+            }
             setupComplete = true;
-            const result = await session.result.finally(() => state.agentInputFlight?.settled);
+            const result = await session.result.finally(() => state.agentInputFlight?.settled).finally(() => this.requeueUnreadAtClose(runId, state, session));
             if (this.preserveRunAfterDisposal(runId, state))
                 return;
             this.persistWorkerAssistantResult(runId, stepId, result.text);
@@ -4862,6 +5788,11 @@ export class RunManager {
                 startImages = undefined;
                 startAttachments = [];
                 checkFailure = null;
+                // Stale setup cannot finalize a replacement owner. Disposal also clears
+                // active, but must still honor a previously accepted Stop/Finish intent.
+                if (this.active.get(runId) !== state &&
+                    !(this.disposed && (state.cancelled || state.finishRequested)))
+                    return;
                 if (state.cancelled || this.preserveRunAfterDisposal(runId, state))
                     break;
                 const current = this.store.getRun(runId);
@@ -5033,7 +5964,6 @@ export class RunManager {
         this.store.updateStep(runId, step.id, { sessionId, backend });
         const stepRecord = this.store.getRun(runId)?.steps.find((s) => s.id === step.id);
         const startTokens = stepRecord?.tokensUsed ?? 0;
-        let stepCost = stepRecord?.costUsd ?? 0;
         let turnText = '';
         let completedAssistantText = '';
         let sawClaudeScheduleWakeup = false;
@@ -5052,13 +5982,22 @@ export class RunManager {
                 return;
             }
             if (event.type === 'text') {
+                this.clearUnreadInputTimer(state); // real content: the harness is working
                 turnText = appendTurnText(turnText, event.text);
                 const text = stripAskMarker(stripTaskMarkers(stripMonitoringMarker(stripDoneMarker(event.text))), false);
                 if (text)
                     emit({ type: 'text', text, stepId: step.id });
                 return;
             }
+            if (event.type === 'input-unconsumed') {
+                this.retireUnreadInputs(runId, state, event.inputIds, true);
+                return;
+            }
+            if (event.type === 'tool-call' || event.type === 'tool-result')
+                this.clearUnreadInputTimer(state);
             emit({ ...event, stepId: step.id });
+            if (event.type === 'cost')
+                this.recordReportedCost(runId, step.id, state, backend, event.usd);
             if (event.type === 'error') {
                 // Preserve the initiating fault: interrupt may fail an in-flight HTTP request.
                 sessionError ??= state.agentInputError ?? event.message;
@@ -5075,13 +6014,11 @@ export class RunManager {
             if (event.type === 'token-usage') {
                 this.store.updateStep(runId, step.id, { tokensUsed: startTokens + event.tokensUsed });
             }
-            if (event.type === 'cost') {
-                stepCost += event.usd;
-                this.store.updateStep(runId, step.id, { costUsd: stepCost });
-            }
             if (isClaudeScheduleWakeup(event, backend))
                 sawClaudeScheduleWakeup = true;
             if (event.type === 'turn-end') {
+                this.retireUnreadInputs(runId, state, event.unconsumedInputIds ?? [], false);
+                this.readBundledInputs(runId, state);
                 state.workerWakeTurn = undefined;
                 state.ciWakeTurn = undefined;
                 state.atTurnBoundary = state.session;
@@ -5117,7 +6054,11 @@ export class RunManager {
                 const workerWaitParked = ciWaitParked || completionBlocked || (!!sessionOpen && this.parkWorkerWait(runId, state));
                 state.doneAtBoundary = done ? state.session : undefined;
                 state.parkAfterAck = interactive && sessionOpen && state.session ? { session: state.session, monitoring: !!monitoring } : undefined;
-                const agentInputDelivered = !ask && !workerWaitParked && this.flushAgentInputs(runId);
+                // #505: input the harness accepted but has not read yet runs as its next turn.
+                // An in-flight submission is settled by its acknowledgement (parkAfterAck), not here.
+                const agentInputDelivered = !ask && !workerWaitParked && (this.flushAgentInputs(runId) || this.harnessOwesInput(state) || !!state.agentInputFlight);
+                if (!ask && !workerWaitParked)
+                    this.armUnreadInputTimer(runId, state);
                 if (state.agentInputError)
                     return;
                 if (done && !workerWaitParked && !state.pendingHumanAsk && !agentInputDelivered && !state.agentInputFlight && !this.hasQueuedAgentInputs(runId)) {
@@ -5136,8 +6077,10 @@ export class RunManager {
                     // still working through `CEZ:MONITORING` or Claude's native
                     // `ScheduleWakeup`. Monitoring parks as `running` with no user-wait
                     // idle timer, so the cockpit stays non-attention (#490, #46).
-                    if (ask)
+                    if (ask) {
                         emitAskRequested(sink, ask);
+                        this.routeWorkerQuestion(runId);
+                    }
                     if (monitoring) {
                         this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
                         this.store.updateStep(runId, step.id, { status: 'running' });
@@ -5232,19 +6175,38 @@ export class RunManager {
         const runner = createRunner(stepBackend);
         state.agentSessionError = undefined;
         let session;
+        const shouldAutoEnd = () => this.active.get(runId) !== state || state.session !== session ||
+            (!this.workerWait(runId) && !this.store.getRun(runId)?.ciWait && !this.parentCompletionPending(runId) &&
+                state.workerWakeTurn !== session && state.ciWakeTurn !== session && !state.agentInputFlight &&
+                !this.hasQueuedAgentInputs(runId));
         state.currentStepId = step.id;
         this.beginUsageInvocation(runId, state, step.id);
         const delegation = this.provisionSession(runId, state);
         const ciTools = await this.provisionCiSession(runId, state);
-        try {
-            if (this.workerExecutionStopped(runId)) {
+        // Revalidate after provisioning, then let execute settle cancellation or
+        // requeue a Finish-held step through its existing no-session paths.
+        const launchRun = this.store.getRun(runId);
+        if (state.cancelled || this.workerExecutionStopped(runId) || this.active.get(runId) !== state ||
+            (launchRun && this.executionBlockedByRootFinish(launchRun))) {
+            ciTools?.revoke();
+            if (state.revokeCiTools === ciTools?.revoke)
+                state.revokeCiTools = undefined;
+            delegation?.revoke();
+            if (state.revokeDelegation === delegation?.revoke)
+                state.revokeDelegation = undefined;
+            if (this.workerExecutionStopped(runId))
                 state.cancelled = true;
-                throw new Error('Worker stopped before launch');
-            }
+            state.currentStepId = undefined;
+            return null;
+        }
+        state.inputDelivery = inputDeliveryOf(runner);
+        state.unreadInputIds = new Set();
+        state.consumedBeforeAck = new Set();
+        try {
             session = runner.startSession({
                 // Skill body, then the run's extra prompt (POST override or config
                 // default), then the handoff/todos contract — every agent step.
-                systemPrompt: composeSystemPrompt(systemPrompt, extraSystemPrompt, delegation?.instructions, followupsEnabled() && input.generateFollowups !== false
+                systemPrompt: composeSystemPrompt(systemPrompt, extraSystemPrompt, delegation?.instructions, artifactInstructions(stepProfile.env.CEZ_ARTIFACTS_DIR), followupsEnabled() && input.generateFollowups !== false
                     ? HANDOFF_INSTRUCTIONS
                     : HANDOFF_ONLY_INSTRUCTIONS),
                 userPrompt,
@@ -5264,13 +6226,14 @@ export class RunManager {
                 timeoutMs: interactive ? 0 : undefined,
             }, onEvent, {
                 autoEndAfterFirstTurn: !interactive,
-                shouldAutoEnd: () => this.active.get(runId) !== state || state.session !== session ||
-                    (!this.workerWait(runId) && !this.store.getRun(runId)?.ciWait && !this.parentCompletionPending(runId) && state.workerWakeTurn !== session && state.ciWakeTurn !== session && !state.agentInputFlight),
+                // Unread inbox claims must survive this window so release/expiry can replay them.
+                shouldAutoEnd,
                 onUiEvent: (event) => {
                     completedAssistantText = appendCompletedAssistantText(completedAssistantText, event);
                     this.handleRunnerUiEvent(runId, state, sink, event);
                 },
                 onAgentInputReady: () => this.handleAgentInputReady(runId, state, session),
+                onAgentInputConsumed: (ids) => this.handleAgentInputConsumed(runId, state, session, ids),
             });
         }
         catch (err) {
@@ -5283,6 +6246,14 @@ export class RunManager {
         }
         const sessionClosed = this.trackWorkerSessionResult(runId, session);
         state.session = session;
+        state.resumeInboxAutoEnd = interactive ? undefined : () => {
+            // ACK may consume the last input after the runner's one-shot close timer fired.
+            // Release/expiry instead submit a provider turn through normal admission.
+            if (this.active.get(runId) === state && state.session === session && session?.open &&
+                state.atTurnBoundary === session && !state.cancelled && !state.pendingHumanAsk &&
+                !this.hasPendingHumanAsk(runId) && shouldAutoEnd())
+                session.end();
+        };
         state.sessionEverOpened = true;
         state.currentStepId = step.id;
         state.interrupt = () => session?.interrupt();
@@ -5290,10 +6261,12 @@ export class RunManager {
         try {
             this.flushDeferred(runId);
             this.flushAgentInputs(runId);
-            if (session.pid !== undefined)
+            if (session.pid !== undefined) {
                 registerRunProcess(runId, session.pid);
+                this.recordWorkerProcess(runId, session.pid);
+            }
             setupComplete = true;
-            const result = await session.result.finally(() => state.agentInputFlight?.settled);
+            const result = await session.result.finally(() => state.agentInputFlight?.settled).finally(() => this.requeueUnreadAtClose(runId, state, session));
             if (this.isDisposedDelegatedRun(runId))
                 return null;
             this.persistWorkerAssistantResult(runId, step.id, result.text);
@@ -5341,6 +6314,7 @@ export class RunManager {
                 if (at >= 0)
                     this.queue.splice(at, 1);
             }
+            state.resumeInboxAutoEnd = undefined;
             state.workerWakeTurn = undefined;
             state.ciWakeTurn = undefined;
             state.atTurnBoundary = undefined;
@@ -5418,6 +6392,7 @@ export class RunManager {
             if (state.currentStepId)
                 this.store.updateStep(runId, state.currentStepId, { status: 'waiting' });
             this.releaseSlot();
+            this.routeWorkerQuestion(runId);
             return;
         }
         // Pi can resume autonomously when an async subagent completes — the mapper
@@ -5446,6 +6421,64 @@ export class RunManager {
             recordedTurns: new Set(),
         };
     }
+    /** Claude's `total_cost_usd` is cumulative for the conversation, including
+     * turns in Continue steps. Other runners emit per-message cost deltas. */
+    recordReportedCost(runId, stepId, state, backend, reportedUsd) {
+        if (!Number.isFinite(reportedUsd) || reportedUsd < 0)
+            return;
+        const run = this.store.getRun(runId);
+        const step = run?.steps.find((candidate) => candidate.id === stepId);
+        if (!run || !step)
+            return;
+        let delta = reportedUsd;
+        if (backend === 'claude') {
+            const sessionKey = step.sessionId ?? step.id;
+            state.reportedClaudeCost ??= new Map();
+            let previous = state.reportedClaudeCost.get(sessionKey);
+            if (previous === undefined) {
+                // The current cost event was appended immediately before this call. Rebuild
+                // the checkpoint from raw reports, since older records summed cumulative
+                // reports into costUsd and cannot be used as the baseline on Continue.
+                const events = this.store.readEvents(runId);
+                let currentReportIndex = -1;
+                for (let index = events.length - 1; index >= 0; index--) {
+                    const event = events[index];
+                    if (event.type === 'cost' && event.stepId === stepId && event.usd === reportedUsd) {
+                        currentReportIndex = index;
+                        break;
+                    }
+                }
+                const sessionStepIds = new Set(run.steps.filter((candidate) => (candidate.backend === 'claude' || candidate.backend === undefined) && (step.sessionId
+                    ? candidate.sessionId === step.sessionId
+                    : candidate.id === step.id)).map((candidate) => candidate.id));
+                previous = 0;
+                const priorCostByStep = new Map();
+                for (let index = 0; index < events.length; index++) {
+                    if (index === currentReportIndex)
+                        continue;
+                    const event = events[index];
+                    if (event.type === 'cost' && event.stepId && sessionStepIds.has(event.stepId) &&
+                        typeof event.usd === 'number' && Number.isFinite(event.usd) && event.usd >= 0) {
+                        priorCostByStep.set(event.stepId, (priorCostByStep.get(event.stepId) ?? 0) + Math.max(0, event.usd - previous));
+                        previous = Math.max(previous, event.usd);
+                    }
+                }
+                // The event log is appended before the step total. A process exit between
+                // those writes leaves a report whose USD never reached the run record.
+                // Restore missing amounts, while preserving older inflated totals rather
+                // than silently migrating historical run state.
+                for (const [priorStepId, expectedCost] of priorCostByStep) {
+                    const priorStep = run.steps.find((candidate) => candidate.id === priorStepId);
+                    if (priorStep && (priorStep.costUsd === undefined || priorStep.costUsd < expectedCost)) {
+                        this.store.updateStep(runId, priorStepId, { costUsd: expectedCost });
+                    }
+                }
+            }
+            delta = Math.max(0, reportedUsd - previous);
+            state.reportedClaudeCost.set(sessionKey, Math.max(previous, reportedUsd));
+        }
+        this.store.updateStep(runId, stepId, { costUsd: (step.costUsd ?? 0) + delta });
+    }
     /** Fold backend-neutral completed-turn usage into the current step exactly
      * once. Invocation/turn counters are written before the event reaches the
      * NDJSON sink so crashes cannot preserve a falsely complete subtotal. */