@wjarka/cezarion 0.15.1 → 0.16.0

package/dist/server/server.js

@@ -1,26 +1,33 @@
+import { sidebarLimitsSchema } from '../contract/index.js';
+import { worktreeSetupConfigSchema } from '../contract/index.js';
+import { ARCHIVED_RUNS_PAGE_DEFAULT, RUNS_SEARCH_PER_PROJECT_MAX, archivedRunsQuerySchema, runSummariesQuerySchema, runsSearchQuerySchema } from '../contract/index.js';
+import { automationKindSchema, automationScheduleSchema, localTimeZone, nextOccurrence } from '../contract/index.js';
 import { DelegationService } from '../delegation/service.js';
+import { workerCapacity } from '../delegation/capacity.js';
 import { delegationFailure } from '../delegation/routes.js';
-import { githubItemParamsSchema, CLIENT_REQUEST_VARIANTS_ERROR, workerEmptyRequestSchema, runRelationshipsSchema, runDelegationSummarySchema } from '../contract/index.js';
+import { githubItemParamsSchema, CLIENT_REQUEST_VARIANTS_ERROR, workerEmptyRequestSchema, runRelationshipsSchema } from '../contract/index.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { AutomationStore } from '../automations/store.js';
 import { AutomationCoordinator } from '../automations/coordinator.js';
 import { GithubPoller } from '../automations/github-poller.js';
 import { ProjectAutomationScheduler, WorkspaceAutomationScheduler } from '../automations/scheduler.js';
-import { launchAutomationRun, reconcileAutomationReceipts, validateAutomationPrompt } from '../automations/task-template.js';
-import { automationEventSchema, automationFiltersSchema, automationLogResultSchema, automationTaskSchema, } from '../automations/types.js';
+import { AutomationProjectUnavailableError, SCHEDULE_LEASE_HELD_REASON, ScheduleRunner } from '../automations/schedule-runner.js';
+import { launchAutomationRun, launchScheduledRun, rebaselineIdleAutomations, reconcileAutomationReceipts, validateAutomationPrompt, } from '../automations/task-template.js';
+import { automationEventSchema, automationFiltersSchema, automationLogResultSchema, automationTaskSchema, isGithubAutomation, isScheduleAutomation, } from '../automations/types.js';
 import { access, constants as fsConstants, mkdir, readFile, realpath, stat, unlink, writeFile } from 'node:fs/promises';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Hono } from 'hono';
-import { serve } from '@hono/node-server';
+import { getRequestListener, serve } from '@hono/node-server';
 import { bodyLimit } from 'hono/body-limit';
 import { streamSSE } from 'hono/streaming';
+import { matchedRoutes } from 'hono/route';
 import { jsonZodValidator, paramZodValidator, queryZodValidator } from './validators.js';
 import { deliverOnce, TaskWebhooks } from '../runs/webhook.js';
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
 import { z } from 'zod';
-import { repoPullInputSchema, deleteBranchesInputSchema, pinRunInputSchema, notifyRunInputSchema, githubSearchQuerySchema, githubProjectsQuerySchema, setWorkspaceUiStateInputSchema, } from '../contract/index.js';
+import { repoPullInputSchema, deleteBranchesInputSchema, pinRunInputSchema, archiveFinishedRequestSchema, notifyRunInputSchema, githubSearchQuerySchema, githubProjectsQuerySchema, setWorkspaceUiStateInputSchema, } from '../contract/index.js';
 // A contract VALUE, like `workspaceUiStateSchema` in workspace/migrations.ts — the request
 // schema this route validates with is the same one the client compiles against.
 import { MODEL_DISCOVERY_RUNNERS, attachmentInputSchema, attachmentFileParamSchema, modelDiscoveryRunnerSchema, openProjectInSchema, runnerDiscoversModels, updateProjectInputSchema, } from '../contract/index.js';
@@ -33,15 +40,18 @@ import { applyProviderEnablement } from '../core/provider-availability.js';
 import { RunnerModelCatalog } from '../core/runner-model-catalog.js';
 import { currentUsage, onUsage } from '../core/process-usage.js';
 import { WORKFLOWS_DIR, loadWorkflows } from '../workflows/load.js';
-import { QUICK_TASK_WORKFLOW, normalizeWorkflowDoc, skillStackOf, skillsToSteps, stepsIssue, workflowFileSchema, workflowStepSchema, } from '../workflows/types.js';
+import { QUICK_TASK_WORKFLOW, normalizeWorkflowDoc, plannedWorkflow, skillStackOf, skillsToSteps, stepsIssue, workflowFileSchema, workflowStepSchema, } from '../workflows/types.js';
 import { planChain, slugify } from '../planner.js';
 import { discoverSkills } from '../skills.js';
 import { SkillsUpdateConflictError, SkillsUpdateCoordinator, SkillsUpdateService } from '../skills-update.js';
 import { getTeamSkillsCached, refreshTeamSkills, waitForTeamSkills } from '../skills-remote.js';
 import { appendHandoffHeartbeat, handoffProgressExcerpt, readHandoff } from '../handoff.js';
 import { markStarted, onTodosChanged, readTodos, removeTodo, todoTaskText } from '../todos.js';
+import { ARCHIVED_WINDOW } from '../runs/store.js';
 import { HistoryCursorError, deriveRunContextEvents, readEventsAfterLiveCursor, readRunHistoryPage, validateLiveCursor, } from '../runs/event-history.js';
-import { readRunIndexFromDisk } from '../runs/run-index.js';
+import { readRunIndexFromDisk, searchRunIndexFromDisk } from '../runs/run-index.js';
+import { workerDestroyView } from '../runs/delegation-state.js';
+import { searchTokens } from '../runs/run-search.js';
 import { clientRequestHash } from '../runs/client-request.js';
 import { ColdRepoHandles } from './cold-repo-handles.js';
 import { isV2WireEventType } from '../runs/ui-event-sink.js';
@@ -51,13 +61,15 @@ import { artifactParamsSchema, fileLinkQuerySchema } from '../contract/index.js'
 import { artifactDirectory, listArtifacts, readArtifact } from '../artifacts/store.js';
 import { artifactPreview, loadFileLink, rasterMime } from '../artifacts/resolve.js';
 import { isUntouchedCancelledRun, toPastedContent } from '../workflows/run.js';
-import { removeWorktree, worktreeDiff, worktreeDiffStat, worktreeSizeBytes } from '../git-worktree.js';
+import { worktreeDiff, worktreeDiffStat, worktreeSizeBytes } from '../git-worktree.js';
+import { releaseThenRemoveWorktree } from '../git-worktree-release.js';
 import { isReclaimable, reclaimWorktree, reclaimWorktrees, rematerializeReclaimedWorktree, selectReclaimableWorktrees } from '../runs/retention.js';
 import { getBranches, getCommit, getDiff, getLogWithParents, getRepoInfo, getStatus, getTracking } from './git.js';
 import { attributeLog, deleteBranches, forgetRepoBranches, githubBranchForge, readRepoBranches } from './repo-branches.js';
 import { claimRepoGitMutation, localPullBranches, pullRepoCheckout } from './repo-pull.js';
 import { collectChanges, collectCommitChanges, collectRunCommits, commitAll, createOrSwitchBranch, imageMimeType, isOsOpenableImage, pushCurrentBranch, readWorktreePath, } from './git-changes.js';
 import { gatedSkillsRepos, loadConfig, resolveWorktreeRetention } from '../config.js';
+import { resolveWorktreeSetup } from '../worktree-setup.js';
 import { findConfigFile } from '../agent-config/catalog.js';
 import { readConfigFile, statConfigPath, writeConfigFile } from '../agent-config/files.js';
 import { readAgentModelDefaults } from '../agent-config/models.js';
@@ -70,22 +82,26 @@ import { defaultAgentProfile, listAgentProfiles, profileDirState, resolveProfile
 import { PROFILE_CAPABLE_PROVIDERS, profileEnv, supportsProfiles } from '../core/agent-profiles.js';
 import { quoteExecutable, withEnvPrefix } from '../core/shell-env.js';
 import { resolveCursorExecutable } from '../core/cursor-model-catalog.js';
+import { resolveOmpExecutable } from '../core/omp-model-catalog.js';
 import { allocateProjectSlug, listProjects, normalizeProjectTags, probeProjectStatus, toProjectListEntry, registerProject, removeProject, shouldRegisterProject, } from '../workspace/projects.js';
 import { mergeWriteWorkspaceUiState, readWorkspaceUiState } from '../workspace/ui-state.js';
 import { checkoutRepo } from './checkout.js';
-import { ProjectContextError, ProjectContexts } from './project-context.js';
+import { armPreview, ProjectContextError, ProjectContexts, sweepRegisteredPreviewLeftovers } from './project-context.js';
 import { reviewGateEnabled } from '../runs/review-gate.js';
 import { readUiState, uiStatePath } from '../ui-state.js';
 import { agentHomePaths, expandTilde } from '../paths.js';
 import { isLoopbackHostHeader, normalizeHostname, resolveCapabilities } from './capabilities.js';
 import { applicationUpdateInputSchema } from '../contract/index.js';
 import { ApplicationUpdateConflictError, ApplicationUpdateFailureError } from '../application-update/service.js';
-import { createSocketHub } from './ws.js';
+import { createSocketHub, socketHubRoute } from './ws.js';
+import { attachUpgradeRouter } from './upgrade-router.js';
+import { createPreviewSocket } from './preview-socket.js';
 import { browseDirectory, isInsideBrowseRoot, isLexicallyInsideBrowseRoot, resolveBrowseRoot } from './fs-browse.js';
 import { parseRemote, resolveForge } from './forge/index.js';
 import { fetchGithub, fetchGithubProjects, fetchGithubChecks, fetchGithubComments, fetchGithubItem, forgetGithubItem, fetchGithubPrDiff, fetchGithubRefStatus, forgetRefStatus, readCachedRefStatuses, refNumberFromUrl, searchGithubItems, GithubPrNotFoundError, GH_CHECKS_MAX, GH_REF_STATUS_MAX } from './github.js';
 import { ensureLaunchKey } from './launch-key.js';
 import { CockpitAlreadyRunningError } from './cockpit-ownership.js';
+import { RunStoreOpenError } from '../runs/store-open-error.js';
 import { openInTerminal } from './open-in-terminal.js';
 import { agentCliRunner, detectOpenTargets, openFileInDefaultApp, openInApp } from './open-in-app.js';
 import { createDraftPr } from './pr.js';
@@ -150,14 +166,21 @@ const providerEnabledSchema = z.object({ enabled: z.boolean() }).strict();
 const providerRetrySchema = z.object({
     authFailureId: z.string().min(1).max(128),
 }).strict();
+/**
+ * The editable body of both kinds. Every kind-specific key is optional here because which ones a
+ * body must (or must not) carry depends on the kind, and on `PUT` the kind is the STORED one when
+ * the body omits it — `resolveAutomationKind` below owns those rules.
+ */
 const automationEditableSchema = z
     .object({
     name: z.string().trim().min(1).max(200),
     description: z.string().max(2_000).optional(),
     enabled: z.boolean().optional(),
-    events: z.array(automationEventSchema).min(1).max(4),
-    intervalSeconds: z.number().int().min(60).max(86_400),
-    filters: automationFiltersSchema,
+    kind: automationKindSchema.optional(),
+    events: z.array(automationEventSchema).min(1).max(4).optional(),
+    intervalSeconds: z.number().int().min(60).max(86_400).optional(),
+    filters: automationFiltersSchema.optional(),
+    schedule: automationScheduleSchema.optional(),
     task: automationTaskSchema,
 })
     .strict();
@@ -177,17 +200,68 @@ const automationLogQuerySchema = z.object({
     // never needed.
     limit: z.coerce.number().int().min(1).max(100).optional(),
 });
+/** enable/pause carry no client revision, so a conflict is a race inside the write: 409, never 500. */
+function toggleFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message === 'automation not found')
+        return { error: 'not found', status: 404 };
+    if (message === 'automation revision conflict')
+        return { error: 'the automation changed elsewhere; reload and try again', status: 409 };
+    throw error;
+}
 function editableAutomation(definition) {
     return {
         name: definition.name,
         description: definition.description,
         enabled: definition.enabled,
-        events: definition.events,
-        intervalSeconds: definition.intervalSeconds,
-        filters: definition.filters,
+        kind: definition.kind,
+        ...(definition.events ? { events: definition.events } : {}),
+        ...(definition.intervalSeconds !== undefined ? { intervalSeconds: definition.intervalSeconds } : {}),
+        ...(definition.filters ? { filters: definition.filters } : {}),
+        ...(definition.schedule ? { schedule: definition.schedule } : {}),
         task: definition.task,
     };
 }
+/**
+ * Which kind a create/update body is, and whether its keys fit it (spec
+ * 2026-10-02-scheduled-automations § Data model). A body without `kind` is `github` on create —
+ * every pre-schedule client — and the STORED kind on update, so an old client editing a schedule
+ * edits a schedule. Changing the kind is refused: receipts and cursors are kind-specific.
+ */
+function resolveAutomationKind(body, stored) {
+    const kind = body.kind ?? stored?.kind ?? 'github';
+    if (stored && kind !== stored.kind)
+        return { error: 'change the kind by creating a new automation', status: 409 };
+    if (kind === 'schedule') {
+        if (body.events !== undefined || body.intervalSeconds !== undefined || body.filters !== undefined) {
+            return { error: 'a scheduled automation has no GitHub filter', status: 400 };
+        }
+        if (!body.schedule)
+            return { error: 'a scheduled automation needs a schedule', status: 400 };
+    }
+    else {
+        if (body.schedule !== undefined)
+            return { error: 'a GitHub automation has no schedule', status: 400 };
+        if (!body.events || body.intervalSeconds === undefined || !body.filters) {
+            return { error: 'a GitHub automation needs events, intervalSeconds and filters', status: 400 };
+        }
+    }
+    return { kind };
+}
+function sameSchedule(a, b) {
+    return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+}
+/**
+ * The `nextRunAt` a schedule definition arms with: its next occurrence from now when enabled,
+ * cleared when paused. Passed to the store's `create`/`update` as `arm`, which writes it BEFORE
+ * the definition, so another cockpit's timer never pairs the new definition with the old instant.
+ */
+function armScheduleFromNow(definition) {
+    if (!isScheduleAutomation(definition))
+        return undefined;
+    const next = definition.enabled ? nextOccurrence(definition.schedule, Date.now(), localTimeZone()) : null;
+    return { nextRunAt: next === null ? undefined : new Date(next).toISOString() };
+}
 /**
  * The public API surface (spec 2026-07-23-independent-server-web-packages).
  *
@@ -225,7 +299,9 @@ export function projectRouteManifest(app) {
 /** 409 body for the inbox mutators while the follow-up inbox is off (#471). */
 const FOLLOWUPS_OFF = 'the follow-up inbox is disabled — set CEZ_FOLLOWUPS=1 to enable it';
 /** 409 body for every automations route while GitHub automations are off (#801). */
-const AUTOMATIONS_OFF = 'GitHub automations are disabled — set CEZ_AUTOMATIONS=1 to enable them';
+const AUTOMATIONS_OFF = 'Automations are disabled — set CEZ_AUTOMATIONS=1 to enable them';
+/** 404 body for a run whose row is in runs.db but whose record this cezar cannot decode (#779). */
+const UNREADABLE_RUN_ERROR = 'this run could not be read by this cezar: its record in runs.db does not fit this version (a newer cezar may have written it). It is left in the database untouched.';
 /**
  * The in-process bus for workspace-level SSE events. The registry-mutating
  * routes (`POST /api/projects` — step 4.2, emits `project-added` for a
@@ -383,6 +459,7 @@ const appearanceSchema = z.object({
 });
 const uiStateSchema = z
     .object({
+    sidebarLimits: sidebarLimitsSchema.optional(),
     // `null` clears the recorded choice — the composer's "no skill, no workflow" state,
     // which is a plain quick-task run. Written through to the file like any other value, so an
     // older cockpit reading it falls back to its own default instead of restoring a stale skill.
@@ -842,6 +919,8 @@ export function createApp(deps) {
             return listProjects(selector);
         },
         semaphore: deps.semaphore,
+        preview: deps.previewHost,
+        cezarPort: deps.cezarPort,
         prepareManager: (project) => {
             taskWebhooks.attach(project);
             return deps.delegation?.attachProject(project);
@@ -987,34 +1066,52 @@ export function createApp(deps) {
     // `ProjectContextError` mapped to 404 (unknown) / 409 (missing root).
     // Named rather than inlined because both mounts share it — one function, so
     // the two spellings can never disagree about what `default` means.
+    if (deps.projectLookup) {
+        deps.projectLookup.resolve = async (raw) => {
+            if (raw === undefined || raw === 'default' || raw === (await resolveBootProject()))
+                return bootContext;
+            if (!projectIdSchema.safeParse(raw).success)
+                return undefined;
+            return contexts.context(raw).catch(() => undefined);
+        };
+    }
     const resolveProjectScope = async (c, next) => {
         const raw = c.req.param('projectId');
-        if (raw === undefined) {
-            c.set('project', bootContext);
-            return next();
-        }
-        if (!projectIdSchema.safeParse(raw).success) {
-            return c.json({ error: `unknown project: ${raw}` }, 404);
-        }
-        if (raw === 'default' || raw === (await resolveBootProject())) {
-            c.set('project', bootContext);
-            return next();
-        }
-        try {
-            c.set('project', await contexts.context(raw));
-        }
-        catch (err) {
-            if (err instanceof CockpitAlreadyRunningError)
-                return c.json({ error: err.message }, 409);
-            if (err instanceof ProjectContextError) {
-                return err.reason === 'missing-root'
-                    ? c.json({ error: `project folder not found: ${err.projectId}` }, 409)
-                    : c.json({ error: err.message }, 404);
+        let project = bootContext;
+        if (raw !== undefined) {
+            if (!projectIdSchema.safeParse(raw).success) {
+                return c.json({ error: `unknown project: ${raw}` }, 404);
+            }
+            if (raw !== 'default' && raw !== (await resolveBootProject())) {
+                try {
+                    project = await contexts.context(raw);
+                }
+                catch (err) {
+                    if (err instanceof CockpitAlreadyRunningError)
+                        return c.json({ error: err.message }, 409);
+                    // Nothing is cached for a failed build, so the next request opens the store again.
+                    if (err instanceof RunStoreOpenError)
+                        return c.json({ error: err.message }, 409);
+                    if (err instanceof ProjectContextError) {
+                        return err.reason === 'missing-root'
+                            ? c.json({ error: `project folder not found: ${err.projectId}` }, 409)
+                            : c.json({ error: err.message }, 404);
+                    }
+                    throw err;
+                }
             }
-            throw err;
         }
+        // The boot project's store could not open (#779): its runs are unknown, not absent, so its
+        // routes answer with why rather than as an empty project. Only its routes: this resolver also
+        // runs in front of every workspace route (`/health` above all), which must keep answering.
+        if (project.store.unavailable && servesProjectRoute(c))
+            return c.json({ error: project.store.unavailable.message }, 409);
+        c.set('project', project);
         return next();
     };
+    /** Every method+path of the project table, under both prefixes; filled once `v1` is built. */
+    let projectRoutePaths = new Set();
+    const servesProjectRoute = (c) => matchedRoutes(c).some((route) => route.method !== 'ALL' && projectRoutePaths.has(`${route.method} ${route.path}`));
     // ---- static GUI ----------------------------------------------------------
     const webDir = resolveWebDir();
     const distDir = join(webDir, 'dist');
@@ -1462,7 +1559,7 @@ export function createApp(deps) {
             workspaceEvents.emit('provider-status', row);
         return c.json(result);
     })
-        .post('/providers/connect', jsonZodValidator(providerConnectSchema, { message: 'provider must be claude, codex, opencode, pi, or cursor' }), async (c) => {
+        .post('/providers/connect', jsonZodValidator(providerConnectSchema, { message: 'provider must be claude, codex, opencode, pi, cursor, or omp' }), async (c) => {
         const body = { data: c.req.valid('json') };
         const provider = body.data.provider;
         // A NAMED account is refused in hosted mode before anything is resolved, exactly like every
@@ -2727,6 +2824,7 @@ export function createApp(deps) {
                 codex: z.string().trim().min(1).max(200).nullable().optional(),
                 opencode: z.string().trim().min(1).max(200).nullable().optional(),
                 pi: z.string().trim().min(1).max(200).nullable().optional(),
+                omp: z.string().trim().min(1).max(200).nullable().optional(),
                 cursor: z.string().trim().min(1).max(200).nullable().optional(),
             })
                 .optional(),
@@ -2939,6 +3037,26 @@ export function createApp(deps) {
             return c.json({ error: AUTOMATIONS_OFF }, 409);
         await next();
     };
+    /** The schedule runner for a route's project: launches into that project's own run manager. */
+    const scheduleHandle = (project) => {
+        const timeZone = localTimeZone();
+        return {
+            projectId: project.id,
+            store: project.automationStore,
+            timeZone,
+            launch: (definition, occurrence, receiptId) => launchScheduledRun({
+                root: project.root,
+                manager: project.manager,
+                store: project.store,
+                definition,
+                occurrence,
+                receiptId,
+                projectName: basename(project.root),
+                timeZone,
+            }),
+            onChange: (automationId, revision) => emitAutomationChange(project, automationId, revision),
+        };
+    };
     // ---- chained family: GitHub automations (project-scoped) ----
     // Every handler below reads `c.get('project')` — the definitions, their runtime state and the
     // execution log are per-project files — so the family is project-scoped and mounted with the
@@ -2952,17 +3070,22 @@ export function createApp(deps) {
         .get('/automations', async (c) => {
         const { root, automationStore } = c.get('project');
         const forge = resolveForge(await getRepoInfo(root));
-        // Annotated, so the two branches are ONE shape rather than a union of two: the fallback
-        // literal always carries `reason`, the cached answer only sometimes does, and the route
-        // type is what `contract/src/automations.ts` has to describe.
-        const availability = forge?.detectCached() ?? {
-            available: false,
-            reason: forge ? 'GitHub availability is still being checked' : 'No GitHub remote is configured',
-        };
+        // Awaits the driver's settled probe (per-repo cache + in-flight dedupe, 5 s timeout, never
+        // throws): a "still being checked" answer would leave the cockpit's GitHub option disabled
+        // because it does not refetch when the probe completes. `/health` keeps `detectCached`.
+        // Annotated, so both branches are ONE shape: the route type is what
+        // `contract/src/automations.ts` has to describe.
+        const availability = forge
+            ? await forge.detect()
+            : { available: false, reason: 'No GitHub remote is configured' };
         const automations = automationStore.list().map((automation) => {
             const logs = automationStore.logs({ automationId: automation.id, limit: 100 });
             const state = automationStore.state(automation.id);
             const latestLog = logs[0];
+            // Enabled only: a paused definition's stored instant is stale, not a next run.
+            const nextRunAt = automation.enabled
+                ? (automation.kind === 'schedule' ? state?.nextRunAt : state?.nextCheckAt)
+                : undefined;
             return {
                 ...automation,
                 // Spread conditionally, never `state: maybeUndefined`: the latter types the key as
@@ -2970,17 +3093,19 @@ export function createApp(deps) {
                 // have to describe a key consumers never receive.
                 ...(state ? { state } : {}),
                 ...(latestLog ? { latestLog } : {}),
+                ...(nextRunAt ? { nextRunAt } : {}),
                 counts: {
                     matches: logs.filter((row) => row.result === 'launched' || row.result === 'duplicate').length,
-                    launched: logs.filter((row) => row.result === 'launched').length,
+                    launched: logs.filter((row) => row.result === 'launched' || row.result === 'manual' || row.result === 'catch-up').length,
                     duplicates: logs.filter((row) => row.result === 'duplicate').length,
-                    errors: logs.filter((row) => row.result === 'error' || row.result === 'rate-limited').length,
+                    errors: logs.filter((row) => row.result === 'error' || row.result === 'rate-limited' || row.result === 'failed').length,
                 },
             };
         });
-        const nextDue = automations.map((item) => item.state?.nextCheckAt).filter(Boolean).sort()[0];
+        const nextDue = automations.map((item) => item.nextRunAt).filter(Boolean).sort()[0];
         return c.json({
             ...availability,
+            timeZone: localTimeZone(),
             scheduler: {
                 // `as const` on both arms: in an object literal a conditional of two string literals
                 // widens to `string`, which would erase the two states this key can hold.
@@ -2991,22 +3116,30 @@ export function createApp(deps) {
         });
     })
         .post('/automations', jsonZodValidator(() => automationCreateSchema), async (c) => {
-        const { automationStore } = c.get('project');
+        const { root, automationStore } = c.get('project');
         const parsed = { data: c.req.valid('json') };
-        const promptIssue = validateAutomationPrompt(parsed.data.task.prompt);
+        const resolved = resolveAutomationKind(parsed.data);
+        if ('error' in resolved)
+            return c.json({ error: resolved.error }, resolved.status);
+        const promptIssue = validateAutomationPrompt(parsed.data.task.prompt, resolved.kind);
         if (promptIssue)
             return c.json({ error: promptIssue }, 400);
+        // A poll needs a GitHub remote to poll; a schedule needs nothing but this project.
+        if (resolved.kind === 'github' && !resolveForge(await getRepoInfo(root))) {
+            return c.json({ error: 'No GitHub remote is configured' }, 400);
+        }
         const { enable, ...input } = parsed.data;
         try {
-            const automation = automationStore.create({ ...input, enabled: enable === true });
-            if (enable) {
+            const automation = automationStore.create({ ...input, kind: resolved.kind, enabled: enable === true }, undefined, enable ? armScheduleFromNow : undefined);
+            if (enable && isGithubAutomation(automation)) {
                 const baselineAt = new Date().toISOString();
-                automationStore.setState(automation.id, {
+                automationStore.setState(automation.id, (current) => ({
+                    ...current,
                     revision: automation.revision,
                     baselineAt,
                     cursor: { timestamp: baselineAt },
                     nextCheckAt: new Date(Date.now() + automation.intervalSeconds * 1_000).toISOString(),
-                });
+                }));
             }
             emitAutomationChange(c.get('project'), automation.id, automation.revision);
             automationsChanged();
@@ -3032,14 +3165,24 @@ export function createApp(deps) {
         .put('/automations/:id', jsonZodValidator(() => automationUpdateSchema), async (c) => {
         const { automationStore } = c.get('project');
         const parsed = { data: c.req.valid('json') };
-        const promptIssue = validateAutomationPrompt(parsed.data.task.prompt);
-        if (promptIssue)
-            return c.json({ error: promptIssue }, 400);
         const { expectedRevision, ...input } = parsed.data;
-        if (!automationStore.get(c.req.param('id')))
+        const stored = automationStore.get(c.req.param('id'));
+        if (!stored)
             return c.json({ error: 'not found' }, 404);
+        const resolved = resolveAutomationKind(input, stored);
+        if ('error' in resolved)
+            return c.json({ error: resolved.error }, resolved.status);
+        const promptIssue = validateAutomationPrompt(input.task.prompt, resolved.kind);
+        if (promptIssue)
+            return c.json({ error: promptIssue }, 400);
         try {
-            const automation = automationStore.update(c.req.param('id'), expectedRevision, { ...input, enabled: input.enabled ?? false });
+            // The armed instant belongs to the schedule it was computed from, and to an enabled
+            // definition: a new schedule, or a resume through PUT, re-arms from now — never a catch-up
+            // of an occurrence that passed while it was paused. Pausing clears it in the same write, so
+            // another cockpit never reads the still-enabled definition beside a due instant. Armed in
+            // the request, as `enable` does, rather than left to the timer: the list refetched on the
+            // change event must already see it. Compared with the definition on disk, not the one read above.
+            const automation = automationStore.update(c.req.param('id'), expectedRevision, { ...input, kind: resolved.kind, enabled: input.enabled ?? false }, (next, previous) => previous && (!sameSchedule(previous.schedule, next.schedule) || previous.enabled !== next.enabled) ? armScheduleFromNow(next) : undefined);
             emitAutomationChange(c.get('project'), automation.id, automation.revision);
             automationsChanged();
             return c.json({ automation });
@@ -3061,32 +3204,79 @@ export function createApp(deps) {
     })
         .post('/automations/:id/enable', async (c) => {
         const store = c.get('project').automationStore;
+        // No client revision: the toggle applies to what is on disk now, not to this store's last read.
+        store.reload();
         const current = store.get(c.req.param('id'));
         if (!current)
             return c.json({ error: 'not found' }, 404);
-        const automation = store.update(current.id, current.revision, { ...editableAutomation(current), enabled: true });
-        const baselineAt = new Date().toISOString();
-        store.setState(automation.id, {
-            ...store.state(automation.id),
-            revision: automation.revision,
-            baselineAt,
-            cursor: { timestamp: baselineAt },
-            nextCheckAt: new Date(Date.now() + automation.intervalSeconds * 1_000).toISOString(),
-        });
-        await store.appendLog({ automationId: automation.id, revision: automation.revision, result: 'baseline', reason: 'Enabled from a current-time baseline; existing records were not launched.' });
-        emitAutomationChange(c.get('project'), automation.id, automation.revision);
-        automationsChanged();
-        return c.json({ automation });
+        try {
+            if (isScheduleAutomation(current)) {
+                // A schedule has no backlog to baseline against: it arms its next occurrence from now.
+                const automation = store.update(current.id, current.revision, { ...editableAutomation(current), enabled: true }, armScheduleFromNow);
+                emitAutomationChange(c.get('project'), automation.id, automation.revision);
+                automationsChanged();
+                return c.json({ automation });
+            }
+            if (!isGithubAutomation(current))
+                return c.json({ error: 'automation definition is incomplete' }, 409);
+            const automation = store.update(current.id, current.revision, { ...editableAutomation(current), enabled: true });
+            const baselineAt = new Date().toISOString();
+            store.setState(automation.id, (state) => ({
+                ...state,
+                revision: automation.revision,
+                baselineAt,
+                cursor: { timestamp: baselineAt },
+                nextCheckAt: new Date(Date.now() + current.intervalSeconds * 1_000).toISOString(),
+            }));
+            await store.appendLog({ automationId: automation.id, revision: automation.revision, result: 'baseline', reason: 'Enabled from a current-time baseline; existing records were not launched.' });
+            emitAutomationChange(c.get('project'), automation.id, automation.revision);
+            automationsChanged();
+            return c.json({ automation });
+        }
+        catch (error) {
+            const { status, ...body } = toggleFailure(error);
+            return c.json(body, status);
+        }
     })
         .post('/automations/:id/pause', (c) => {
         const store = c.get('project').automationStore;
+        store.reload();
         const current = store.get(c.req.param('id'));
         if (!current)
             return c.json({ error: 'not found' }, 404);
-        const automation = store.update(current.id, current.revision, { ...editableAutomation(current), enabled: false });
-        emitAutomationChange(c.get('project'), automation.id, automation.revision);
-        automationsChanged();
-        return c.json({ automation });
+        try {
+            const automation = store.update(current.id, current.revision, { ...editableAutomation(current), enabled: false }, armScheduleFromNow);
+            emitAutomationChange(c.get('project'), automation.id, automation.revision);
+            automationsChanged();
+            return c.json({ automation });
+        }
+        catch (error) {
+            const { status, ...body } = toggleFailure(error);
+            return c.json(body, status);
+        }
+    })
+        // Run now: a schedule fired once by hand, paused or not, outside the timer and under the same
+        // lease. `nextRunAt` and `enabled` are untouched; a GitHub automation's equivalent is `check`.
+        .post('/automations/:id/run', async (c) => {
+        const project = c.get('project');
+        const store = project.automationStore;
+        const automation = store.get(c.req.param('id'));
+        if (!automation)
+            return c.json({ error: 'not found' }, 404);
+        if (!isScheduleAutomation(automation))
+            return c.json({ error: 'a GitHub automation runs on its events; use check with mode execute' }, 409);
+        const outcome = await new ScheduleRunner(scheduleHandle(project)).runNow(automation);
+        // Gone, or no longer a schedule, once re-read under the lease: nothing was launched.
+        if (outcome.result === 'skipped')
+            return c.json({ error: 'not found' }, 404);
+        if (outcome.result === 'manual') {
+            emitAutomationChange(project, automation.id, store.get(automation.id)?.revision ?? automation.revision);
+            return c.json({ runId: outcome.runId }, 202);
+        }
+        if (outcome.result === 'lease-held')
+            return c.json({ error: SCHEDULE_LEASE_HELD_REASON }, 409);
+        const reason = store.logs({ automationId: automation.id, limit: 1 })[0]?.reason;
+        return c.json({ error: reason ?? 'the run could not be launched' }, 409);
     })
         // The body is validated as MIDDLEWARE, which is what puts it in the route type — and moves
         // the 400 ahead of this route's 404: `POST /automations/<unknown>/check` with a malformed
@@ -3097,6 +3287,8 @@ export function createApp(deps) {
         const automation = store.get(c.req.param('id'));
         if (!automation)
             return c.json({ error: 'not found' }, 404);
+        if (!isGithubAutomation(automation))
+            return c.json({ error: 'a schedule has nothing to preview; use run' }, 409);
         const parsed = { data: c.req.valid('json') };
         // `string`, not `randomUUID`'s template-literal type: the wire carries an opaque id, and
         // leaking `${string}-${string}-…` into the route type would make the contract describe the
@@ -3114,10 +3306,9 @@ export function createApp(deps) {
                     throw new Error('No GitHub remote is configured');
                 const scheduler = new ProjectAutomationScheduler({
                     projectId: project.id,
-                    owner: remote.owner,
-                    repo: remote.repo,
                     store,
-                    poller: new GithubPoller(),
+                    timeZone: localTimeZone(),
+                    github: { owner: remote.owner, repo: remote.repo, poller: new GithubPoller() },
                     launch: parsed.data.mode === 'execute'
                         ? (definition, candidate, receiptId) => launchAutomationRun({ root: project.root, manager: project.manager, store: project.store, definition, candidate, receiptId })
                         : undefined,
@@ -3143,11 +3334,32 @@ export function createApp(deps) {
             return c.json({ error: 'not found' }, 404);
         if (receipt.status !== 'launch-error' || receipt.runId)
             return c.json({ error: 'receipt is not retryable' }, 409);
+        const scheduled = store.get(receipt.automationId);
+        // A schedule receipt carries its occurrence instead of a GitHub candidate; it is fired
+        // again by hand through the runner, under the lease, as the same receipt.
+        if (scheduled && isScheduleAutomation(scheduled) && receipt.occurrenceAt) {
+            const outcome = await new ScheduleRunner(scheduleHandle(project)).retry(scheduled, receipt);
+            // Gone, or no longer a schedule, once re-read under the lease: nothing was launched.
+            if (outcome.result === 'skipped')
+                return c.json({ error: 'not found' }, 404);
+            if (outcome.result === 'manual') {
+                emitAutomationChange(project, scheduled.id, store.get(scheduled.id)?.revision ?? scheduled.revision);
+                return c.json({ receiptId: receipt.receiptId, runId: outcome.runId }, 202);
+            }
+            if (outcome.result === 'lease-held')
+                return c.json({ error: SCHEDULE_LEASE_HELD_REASON }, 409);
+            if (outcome.result === 'duplicate')
+                return c.json({ error: 'receipt is not retryable' }, 409);
+            const latest = store.latestReceipts().get(receipt.receiptKey);
+            return c.json({ error: latest?.error ?? 'the run could not be launched' }, 409);
+        }
         if (!receipt.candidate)
             return c.json({ error: 'receipt predates retry context and cannot be retried safely' }, 409);
-        const definition = store.get(receipt.automationId);
+        const definition = scheduled;
         if (!definition)
             return c.json({ error: 'automation not found' }, 404);
+        if (!isGithubAutomation(definition))
+            return c.json({ error: 'receipt is not retryable' }, 409);
         const lease = store.acquireLease();
         if (!lease)
             return c.json({ error: 'automation polling lease is held by another process' }, 409);
@@ -3186,10 +3398,18 @@ export function createApp(deps) {
         const sessionStep = [...run.steps].reverse().find(step => step.sessionId);
         const sessionId = sessionStep?.sessionId;
         const backend = sessionStep?.backend ?? run.runner ?? 'claude';
-        const command = backend === 'cursor' && sessionId ? resumeCommand(backend, sessionId) : null;
+        // Runners whose take-over command depends on a server-side binary override (CEZ_*_BIN).
+        const command = (backend === 'cursor' || backend === 'omp') && sessionId ? resumeCommand(backend, sessionId) : null;
         return { ...run, ...(usage ? { usage } : {}), ...(command ? { cliResumeCommand: command } : {}),
             ...(finishBlocked !== undefined ? { finishBlocked } : {}) };
     };
+    // A list row (#817) with the same live `usage` sample `withUsage` attaches. The sampler is
+    // process-wide, so a workspace-level answer can carry it for every project's runs at once — a
+    // cold project's stored summaries included. Appended last, exactly where `toRunSummary` puts it.
+    const withLiveUsage = (summary) => {
+        const usage = currentUsage(summary.id);
+        return usage ? { ...summary, usage } : summary;
+    };
     // The inbox half of a composer launch (#374). Since the cockpit's "▶ Run"
     // prefills `/new` instead of calling POST /api/todos/:id/start (never launch
     // blind — #355), the todo id rides along on the composer's POST /api/runs and
@@ -3210,11 +3430,68 @@ export function createApp(deps) {
             console.warn(`[cezar] could not mark inbox entry ${todoId} started: ${String(err)}`);
         }
     };
+    /**
+     * Every control on one run (any `/runs/:id` request that is not a read) first asks who owns it
+     * (#779, plan step 3): a `serve` and a headless `cez run` can share a project's runs.
+     * - Another live cezar process's run answers `409 { error }`, the shape these routes already
+     *   use for a run that exists but cannot be acted on now. Reads are never refused.
+     * - A run whose owner is proven dead is adopted first — claimed, loaded and settled as
+     *   interrupted, never resumed (`settleOrphanedRun`) — and the control then applies. Otherwise
+     *   Stop on a crashed `cez run` would be a dead end until this cockpit restarted. Stop is the one
+     *   control the adoption carries out itself: its run settles as cancelled, and Stop answers that
+     *   it stopped it (`stoppedOnAdoption`).
+     * - A run this process stopped writing after a conflicting write answers 409 too.
+     *
+     * Registered against explicit paths, like `requireAutomations`: `route()` re-registers it under
+     * the mount prefix, and it gates every family's `/runs/:id` routes registered after it.
+     */
+    const requireRunControl = async (c, next) => {
+        const id = c.req.param('id');
+        if (c.req.method === 'GET' || c.req.method === 'HEAD' || id === undefined)
+            return next();
+        const { store, manager } = c.get('project');
+        if (store.runOwnership(id) === 'orphaned') {
+            const stop = c.req.method === 'POST' && c.req.path.endsWith('/cancel');
+            if (await manager.adoptOrphanedRun(id, { stop }) && stop && store.getRun(id)?.status === 'cancelled')
+                c.set('stoppedOnAdoption', true);
+        }
+        const refusal = store.writeRefusal(id);
+        if (!refusal)
+            return next();
+        // The delegation route in this family answers in the delegation error shape it always uses.
+        return c.req.path.endsWith('/worker-destroy')
+            ? c.json({ code: 'incompatible_state', error: refusal }, 409)
+            : c.json({ error: refusal }, 409);
+    };
     // ---- chained family: runs lifecycle + artifacts (project-scoped) ----
     const delegationService = deps.delegation?.service ?? new DelegationService();
     delegationService.setDiscovery({ models: modelCatalog, providers: providerStatus });
     const runsRoutes = new Hono()
-        .get('/runs', (c) => c.json(c.get('project').store.listRuns().map(run => withUsage(run))))
+        .use('/runs/:id', requireRunControl)
+        .use('/runs/:id/*', requireRunControl)
+        // Legacy (older clients): every full record. The cockpit and `cez task` read `/run-summaries`.
+        .get('/runs', (c) => c.json(c.get('project').store.listAllRunsForLegacyRoute().map(run => withUsage(run))))
+        // The slim list (#817): the same runs in the same order as `GET /runs`, from the stored
+        // `toRunSummary` column with memory laid over it (#779), so the list decodes no record.
+        // `?archived=recent` (#864) is the window the cockpit reads: every unarchived run plus the newest
+        // `ARCHIVED_WINDOW` archived roots. The default stays every run, for clients that list them all.
+        .get('/run-summaries', queryZodValidator(runSummariesQuerySchema), (c) => {
+        const archivedWindow = c.req.valid('query').archived === 'recent' ? ARCHIVED_WINDOW : undefined;
+        return c.json(c.get('project').store.listRunSummaries({ archivedWindow }).runs.map(withLiveUsage));
+    })
+        // The archived roots past that window, a page at a time, newest first (#864).
+        .get('/run-summaries/archived', queryZodValidator(archivedRunsQuerySchema), (c) => {
+        const { before, limit, q } = c.req.valid('query');
+        const page = c.get('project').store.listArchivedRuns({
+            limit: limit ?? ARCHIVED_RUNS_PAGE_DEFAULT,
+            ...(before !== undefined ? { before } : {}),
+            ...(q !== undefined ? { q } : {}),
+        });
+        if ('error' in page)
+            return c.json({ error: page.error }, 400);
+        const body = { ...page, runs: page.runs.map(withLiveUsage) };
+        return c.json(body);
+    })
         .get('/runs/:id/relationships', paramZodValidator(runIdParamSchema), queryZodValidator(workerEmptyRequestSchema), (c) => {
         const { store } = c.get('project');
         const run = store.getRun(c.req.valid('param').id);
@@ -3225,18 +3502,31 @@ export function createApp(deps) {
         // read has to cost O(workers) whatever the store holds — and nothing at all for the
         // ordinary run that owns none, delegation on or off.
         // Human reads use the bound project, never agent credentials or private evidence.
-        const workers = store.listOwnedWorkers(run.id).flatMap(worker => {
+        const ownedWorkers = store.listOwnedWorkers(run.id);
+        const workers = ownedWorkers.flatMap(worker => {
             const owned = worker.delegation;
             if (owned?.role !== 'worker')
                 return [];
             return [{ workerId: worker.id, parentRunId: run.id, status: worker.status, workspace: owned.workspace,
                     ...(worker.currentStepId === undefined ? {} : { currentStepId: worker.currentStepId }),
                     ...(worker.activity === undefined ? {} : { activity: worker.activity }),
-                    ...(owned.destroy ? { destroy: owned.destroy } : {}),
+                    ...(owned.destroy ? { destroy: workerDestroyView(worker) } : {}),
                 }];
-        }).slice(0, 32);
+        });
+        // #864: the titles of the runs this answer names, since the cockpit's run list no longer
+        // carries archived workers (or a parent past its archived window).
+        const parent = run.delegation?.role === 'worker' ? store.getRun(run.delegation.parentRunId) : undefined;
+        const titles = [...(parent ? [parent] : []), ...ownedWorkers].map((related) => ({
+            id: related.id, title: related.title,
+            ...(related.titleSummary === undefined ? {} : { titleSummary: related.titleSummary }),
+            ...(related.titleOrigin === undefined ? {} : { titleOrigin: related.titleOrigin }),
+        }));
+        // #816: every owned worker, bounded by the 1,024 creation ceiling rather than sliced, and
+        // the root's capacity from the same derivation the spawn policy enforces.
         return c.json(runRelationshipsSchema.parse({
             ...(run.delegation?.role === 'worker' ? { parentRunId: run.delegation.parentRunId } : {}), workers,
+            ...(titles.length > 0 ? { titles } : {}),
+            ...(run.delegation?.role === 'root' ? { capacity: workerCapacity(run, id => store.getRun(id)) } : {}),
         }));
     })
         .post('/runs/:id/worker-destroy', queryZodValidator(workerEmptyRequestSchema, { code: 'invalid_input', message: 'Invalid cleanup query' }), paramZodValidator(runIdParamSchema, { code: 'invalid_input', message: 'Invalid worker ID' }), jsonZodValidator(workerEmptyRequestSchema, { absent: {}, malformed: null, code: 'invalid_input', message: 'Invalid cleanup input' }), async (c) => {
@@ -3253,7 +3543,7 @@ export function createApp(deps) {
     })
         // Registered before the `/:id/...` routes so "archive-finished" and "read-all"
         // never match as a run id.
-        .post('/runs/archive-finished', (c) => c.json({ archived: c.get('project').store.archiveFinished() }))
+        .post('/runs/archive-finished', jsonZodValidator(archiveFinishedRequestSchema, { absent: {}, malformed: null }), (c) => c.json(c.get('project').store.archiveFinished(c.req.valid('json').scope)))
         // The read-receipt sweep (#unread-done-items) — the mark-read twin of the archive
         // sweep above, and under the same registration-order guard.
         .post('/runs/read-all', (c) => c.json({ read: c.get('project').store.markAllRead() }))
@@ -3356,11 +3646,7 @@ export function createApp(deps) {
             const issue = stepsIssue(parsed.data.steps);
             if (issue)
                 return c.json({ error: issue }, 400);
-            workflow = {
-                name: '(planned)',
-                source: 'built-in',
-                steps: parsed.data.steps,
-            };
+            workflow = plannedWorkflow(parsed.data.steps);
         }
         else {
             const { workflows } = await loadWorkflows(repoRoot);
@@ -3442,8 +3728,12 @@ export function createApp(deps) {
     })
         .get('/runs/:id', (c) => {
         const { store, manager } = c.get('project');
-        const run = store.getRun(c.req.param('id'));
-        return run ? c.json(withUsage(run, manager.finishBlockedReason(run.id) ?? null)) : c.json({ error: 'not found' }, 404);
+        const id = c.req.param('id');
+        const run = store.getRun(id);
+        if (run)
+            return c.json(withUsage(run, manager.finishBlockedReason(run.id) ?? null));
+        // A row in runs.db this version cannot decode (#779): listed until read, so say why it will not open.
+        return c.json({ error: store.isUnreadable(id) ? UNREADABLE_RUN_ERROR : 'not found' }, 404);
     })
         .get('/runs/:id/history', paramZodValidator(runIdParamSchema), queryZodValidator(runHistoryQuerySchema), async (c) => {
         const { store, dataDir } = c.get('project');
@@ -3451,7 +3741,7 @@ export function createApp(deps) {
         if (!store.getRun(id))
             return c.json({ error: 'not found' }, 404);
         try {
-            return c.json(await readRunHistoryPage(join(dataDir, 'runs', `${id}.ndjson`), c.req.valid('query').cursor));
+            return c.json(await readRunHistoryPage(dataDir, id, c.req.valid('query').cursor));
         }
         catch (error) {
             if (error instanceof HistoryCursorError)
@@ -3464,7 +3754,7 @@ export function createApp(deps) {
         const { id } = c.req.valid('param');
         if (!store.getRun(id))
             return c.json({ error: 'not found' }, 404);
-        return c.json(await deriveRunContextEvents(join(dataDir, 'runs', `${id}.ndjson`)));
+        return c.json(await deriveRunContextEvents(dataDir, id));
     })
         // Editable titles (#389). The UI displays `titleSummary ?? title`, so a
         // user edit sets BOTH: `title` (the record's own name — the raw task stops
@@ -3508,7 +3798,8 @@ export function createApp(deps) {
         const id = c.req.param('id');
         if (!store.getRun(id))
             return c.json({ error: 'not found' }, 404);
-        const cancelled = manager.cancel(id);
+        // Still asked of the manager after an adoption stopped the run: a worker's stop bookkeeping is its.
+        const cancelled = manager.cancel(id) || c.get('stoppedOnAdoption') === true;
         return c.json({ cancelled });
     })
         // Live-session participation (spec 002): deliver a user message (text +
@@ -3809,9 +4100,13 @@ export function createApp(deps) {
             // An id resumeCommand refuses (#431) degrades to a fresh CLI in the worktree,
             // exactly like a run that never recorded a session.
             const resume = sessionId && cliRunner === (sessionStep?.backend ?? run.runner ?? 'claude') ? resumeCommand(cliRunner, sessionId) : null;
-            const command = resume ?? (cliRunner === 'cursor' ? quoteExecutable(resolveCursorExecutable(), process.platform) : cliRunner);
-            if (command === null)
-                return c.json({ error: 'the configured Cursor executable cannot be used in a terminal command' }, 409);
+            // Runners with a CEZ_*_BIN override launch the configured binary, not the PATH name.
+            const command = resume ?? (cliRunner === 'cursor'
+                ? quoteExecutable(resolveCursorExecutable(), process.platform)
+                : cliRunner === 'omp' ? quoteExecutable(resolveOmpExecutable(), process.platform) : cliRunner);
+            if (command === null) {
+                return c.json({ error: `the configured ${cliRunner === 'omp' ? 'OMP' : 'Cursor'} executable cannot be used in a terminal command` }, 409);
+            }
             // BOTH branches carry the account (spec 2026-07-29-agent-profiles): a resume needs the
             // config dir that holds its session, and a FRESH CLI in this worktree should still open
             // on the account the project works under — otherwise "Open in → Claude CLI" quietly
@@ -4175,7 +4470,7 @@ export function createApp(deps) {
         if (run.delegation?.role === 'worker' || !store.canDeleteRun(id))
             return c.json({ error: 'owned resources require verified worker cleanup' }, 409);
         if (run.worktreePath)
-            await removeWorktree(repoRoot, run.worktreePath, run.branch);
+            await releaseThenRemoveWorktree({ previewHost: deps.previewHost }, id, repoRoot, run.worktreePath, run.branch);
         store.updateRun(id, { worktreePath: undefined, branch: undefined });
         return c.json({ removed: true });
     })
@@ -4191,13 +4486,12 @@ export function createApp(deps) {
         if (!store.canDeleteRun(id))
             return c.json({ error: 'owned resources require verified worker cleanup and explicit child history deletion first' }, 409);
         if (run.delegation?.role !== 'worker' && run.worktreePath)
-            await removeWorktree(repoRoot, run.worktreePath, run.branch);
+            await releaseThenRemoveWorktree({ previewHost: deps.previewHost }, id, repoRoot, run.worktreePath, run.branch);
         return store.deleteRun(id) ? c.json({ deleted: true }) : c.json({ error: 'history cleanup incomplete — retry deletion' }, 409);
     });
     // ---- parallel variants (spec 010) -----------------------------------------
     const groupRuns = (store, groupId) => store
-        .listRuns()
-        .filter((r) => r.groupId === groupId)
+        .listGroupRuns(groupId)
         .sort((a, b) => (a.variant ?? '').localeCompare(b.variant ?? ''));
     // ---- chained family: variant groups (project-scoped) ----
     const groupsRoutes = new Hono()
@@ -4269,7 +4563,7 @@ export function createApp(deps) {
             if (loser.delegation?.role === 'worker' || !store.canDeleteRun(loser.id))
                 continue;
             if (loser.worktreePath)
-                await removeWorktree(repoRoot, loser.worktreePath, loser.branch);
+                await releaseThenRemoveWorktree({ previewHost: deps.previewHost }, loser.id, repoRoot, loser.worktreePath, loser.branch);
             store.updateRun(loser.id, { worktreePath: undefined, branch: undefined });
             store.setArchived(loser.id, true);
             store.appendEvent(loser.id, {
@@ -4360,12 +4654,12 @@ export function createApp(deps) {
         // The keep-limit the panel reports is the one the enforcer will actually
         // apply — inherited from the workspace default when this repo sets none.
         const keep = await resolveWorktreeRetention(repoRoot);
-        const allRuns = store.listRuns();
-        // Listing is on-disk dirs only; parent liveness for #575 uses the full store
+        const withWorktree = store.listRunsWithWorktree();
+        // Listing is on-disk dirs only; parent liveness for #575 reads the store by id
         // so a live `worktree: false` parent is not treated as gone (#570 honesty).
-        const runs = allRuns.filter((r) => r.worktreePath && existsSync(r.worktreePath));
+        const runs = withWorktree.filter((r) => r.worktreePath && existsSync(r.worktreePath));
         // The rows the enforcer would reclaim right now: reclaimable AND past the newest `keep`.
-        const pastKeep = new Set(selectReclaimableWorktrees(allRuns, keep));
+        const pastKeep = new Set(selectReclaimableWorktrees(withWorktree, keep, (id) => store.getRun(id)));
         const worktrees = await Promise.all(runs.map(async (r) => ({
             runId: r.id,
             title: r.title ?? r.id,
@@ -4374,7 +4668,7 @@ export function createApp(deps) {
             // POSIX `du` — degrades to null (Windows / du missing / error); never blocks.
             sizeBytes: await worktreeSizeBytes(r.worktreePath),
             finishedAt: r.finishedAt ?? null,
-            reclaimable: isReclaimable(r, allRuns),
+            reclaimable: isReclaimable(r, (id) => store.getRun(id)),
             pastKeep: pastKeep.has(r.id),
         })));
         // Total is null when any size degraded, so the panel never shows a wrong sum.
@@ -4390,6 +4684,7 @@ export function createApp(deps) {
         const { manager } = c.get('project');
         const reclaimed = await reclaimWorktrees(repoRoot, store, await resolveWorktreeRetention(repoRoot), {
             claim: (run) => manager.claimWorktreeReclaim(run.id),
+            previewHost: deps.previewHost,
         });
         if (reclaimed.length > 0)
             forgetRepoBranches(repoRoot);
@@ -4408,7 +4703,7 @@ export function createApp(deps) {
         if (!release) {
             return c.json({ error: 'this worktree is in use or already reclaimed — only a finished task\'s worktree can be reclaimed' }, 409);
         }
-        const worktreeReclaimedAt = await reclaimWorktree(repoRoot, store, run, { requireClean: true }).finally(release);
+        const worktreeReclaimedAt = await reclaimWorktree(repoRoot, store, run, { requireClean: true, previewHost: deps.previewHost }).finally(release);
         if (!worktreeReclaimedAt) {
             // Reclaim keeps only what is committed, so it leaves a dirty checkout alone; say which case this was.
             const dirty = run.worktreePath && existsSync(run.worktreePath) ? (await getStatus(run.worktreePath).catch(() => [])).length : 0;
@@ -4526,10 +4821,9 @@ export function createApp(deps) {
         if (!store.getRun(id))
             return c.json({ error: 'not found' }, 404);
         const query = c.req.valid('query');
-        const eventsPath = join(dataDir, 'runs', `${id}.ndjson`);
         if (query.cursor) {
             try {
-                await validateLiveCursor(eventsPath, query.cursor);
+                await validateLiveCursor(dataDir, id, query.cursor);
             }
             catch (error) {
                 if (error instanceof HistoryCursorError)
@@ -4575,7 +4869,7 @@ export function createApp(deps) {
                 store.off('run', onRun);
             });
             const replay = query.cursor
-                ? await readEventsAfterLiveCursor(eventsPath, query.cursor)
+                ? await readEventsAfterLiveCursor(dataDir, id, query.cursor)
                 : { events: store.readEvents(id), boundarySeq: 0 };
             maxSeq = Math.max(maxSeq, replay.boundarySeq);
             for (const event of replay.events) {
@@ -4924,7 +5218,7 @@ export function createApp(deps) {
         const config = await loadConfig(project.root);
         return {
             root: info.root,
-            runs: project.store.listRuns(),
+            runs: project.store.listBranchOwners(),
             isActive: (id) => project.manager.isActive(id),
             configuredBase: config.baseBranch,
             currentBranch: info.branch,
@@ -4955,7 +5249,7 @@ export function createApp(deps) {
         ]);
         const [tracking, sources] = await Promise.all([
             getTracking(info.root, config.baseBranch ?? info.branch),
-            attributeLog(info.root, rawLog, c.get('project').store.listRuns()),
+            attributeLog(info.root, rawLog, c.get('project').store.listBranchOwners()),
         ]);
         // `source` is spread conditionally: absent, never `null`, when no task is known.
         const log = rawLog.map(({ parents: _parents, ...entry }, i) => {
@@ -5070,7 +5364,10 @@ export function createApp(deps) {
         if (!info)
             return c.json({ error: 'not a git repository' }, 409);
         const config = await loadConfig(root);
-        const result = await pullRepoCheckout(info.root, c.req.valid('json'), config.baseBranch, () => store.listRuns().some((run) => manager.isActive(run.id)));
+        const result = await pullRepoCheckout(info.root, c.req.valid('json'), config.baseBranch, 
+        // Every id, not the live set: the manager may still hold a run whose record already
+        // settled (a worker's execution winding down). Ids only, nothing decoded.
+        () => store.listRunIds().some((id) => manager.isActive(id)));
         if (!result.ok)
             return c.json(result.value, 409);
         return c.json(result.value, 200);
@@ -5095,10 +5392,13 @@ export function createApp(deps) {
             release();
         }
     });
+    /** #917: setup commands run on the host before every task, so only a local cockpit edits them. */
+    const WORKTREE_SETUP_HOSTED_ERROR = 'Worktree setup commands can be edited only on the machine running cezar.';
     // The Settings → Agents knobs in one read (R6 Step 1.5) — an ADDITIVE
     // sibling of PUT /api/config below; /api/health keeps its protected shape.
     const configAnswer = async (repoRoot, config) => {
         const nativeModels = await readAgentModelDefaults(repoRoot);
+        const setup = resolveWorktreeSetup(config.worktreeSetup);
         const modelsLocked = agentModelsLocked(repoRoot);
         return {
             baseBranch: config.baseBranch ?? null,
@@ -5121,6 +5421,9 @@ export function createApp(deps) {
             // Optional review gate (#489): tri-state — null means "no config key, the
             // CEZ_REVIEW_GATE env default (OFF) decides".
             reviewGate: config.reviewGate ?? null,
+            // Worktree setup (#917): an invalid value is reported, never shown as "no setup".
+            worktreeSetup: setup.kind === 'commands' ? { commands: setup.commands, timeoutSeconds: setup.timeoutSeconds } : null,
+            worktreeSetupIssue: setup.kind === 'invalid' ? setup.issue : null,
         };
     };
     // ---- chained family: per-repo config (project-scoped) ----
@@ -5135,6 +5438,11 @@ export function createApp(deps) {
         if (agentModelsLocked(repoRoot) && parsed.data.defaultModels !== undefined) {
             return c.json({ error: AGENT_MODELS_LOCKED_ERROR }, 409);
         }
+        // Setup commands run on the host before every task (#917): a local-machine capability, like
+        // Agent config writes. Checked before any write, so a refused body changes nothing.
+        if (parsed.data.worktreeSetup !== undefined && !capabilities().localHandoff) {
+            return c.json({ error: WORKTREE_SETUP_HOSTED_ERROR }, 409);
+        }
         const configPath = join(dataDir, 'config.json');
         let raw = {};
         try {
@@ -5193,6 +5501,17 @@ export function createApp(deps) {
                 raw.memoryLimitMb = parsed.data.memoryLimitMb;
             }
         }
+        if (parsed.data.worktreeSetup !== undefined) {
+            // null or no commands = no setup: delete the key rather than store an empty list.
+            const setup = parsed.data.worktreeSetup;
+            if (setup === null || setup.commands.length === 0)
+                delete raw.worktreeSetup;
+            else
+                raw.worktreeSetup = {
+                    commands: setup.commands,
+                    ...(setup.timeoutSeconds !== undefined ? { timeoutSeconds: setup.timeoutSeconds } : {}),
+                };
+        }
         if (parsed.data.defaultModels !== undefined) {
             // Per-runner merge, so setting codex's preset never clobbers claude's.
             const current = raw.defaultModels && typeof raw.defaultModels === 'object'
@@ -5237,6 +5556,7 @@ export function createApp(deps) {
             codex: modelPresetSchema,
             opencode: modelPresetSchema,
             pi: modelPresetSchema,
+            omp: modelPresetSchema,
             cursor: modelPresetSchema,
         })
             .optional(),
@@ -5254,6 +5574,8 @@ export function createApp(deps) {
         // Optional review gate toggle (Settings → Agents, #489): null clears the key
         // back to the env-default behavior (OFF).
         reviewGate: z.boolean().nullable().optional(),
+        // Worktree setup (Settings → Worktrees, #917): null or [] deletes the key.
+        worktreeSetup: worktreeSetupConfigSchema.nullable().optional(),
     });
     const setAgentConfigSchema = z.object({
         content: z.string().max(2_000_000),
@@ -5338,15 +5660,18 @@ export function createApp(deps) {
         .route('/', repoRoutes)
         .route('/', configRoutes)
         .route('/', agentConfigRoutes);
+    projectRoutePaths = new Set(v1.routes.filter((route) => route.method !== 'ALL')
+        .flatMap((route) => [V1_PREFIX, V1_SCOPED_PREFIX].map((prefix) => `${route.method} ${prefix}${route.path}`)));
     // ---- chained family: the cross-project run index (workspace-level) -------
     /**
-     * How many runs each project may contribute, newest first. The index is a FINDER, not a
-     * listing: past the newest couple of hundred per project you are looking for something the
-     * project's own Tasks table answers better, and every extra row is a DOM node the palette's
-     * filter walks on each keystroke. `truncated` names the projects this bit, so a consumer never
+     * How many ARCHIVED root runs each project may contribute, newest first (#864). The index is a
+     * FINDER, not a listing: every unarchived ROOT run is in it (so a project's pills miss nothing
+     * live or unread), and older archived runs are reached through `GET /workspace/runs-search` and
+     * the project's own archived pages. Owned workers are never in it: the pills, ⌘K and the global
+     * Tasks page list no workers, and a parent's wait label comes from its own delegation. `truncated` names the projects this bit, so a consumer never
      * has to pretend the list is complete.
      */
-    const RUNS_INDEX_PER_PROJECT = 200;
+    const RUNS_INDEX_PER_PROJECT = ARCHIVED_WINDOW;
     /** `RunRecord` → the wire row. Optional keys are spread CONDITIONALLY: writing
      *  `titleSummary: run.titleSummary` types a key as always-present that `JSON.stringify` then
      *  drops when it is undefined, which is exactly the drift the parity guard fails on. */
@@ -5371,44 +5696,6 @@ export function createApp(deps) {
         }
         return numbers;
     };
-    const runIndexEntry = (projectId, run) => {
-        const usage = currentUsage(run.id);
-        return {
-            projectId,
-            id: run.id,
-            title: run.title,
-            ...(run.titleSummary !== undefined ? { titleSummary: run.titleSummary } : {}),
-            ...(run.titleOrigin !== undefined ? { titleOrigin: run.titleOrigin } : {}),
-            status: run.status,
-            ...(run.delegation ? { delegation: runDelegationSummarySchema.parse(run.delegation) } : {}),
-            ...(run.activity !== undefined ? { activity: run.activity } : {}),
-            ...(run.hasPendingHumanAsk !== undefined ? { hasPendingHumanAsk: run.hasPendingHumanAsk } : {}),
-            createdAt: run.createdAt,
-            ...(run.finishedAt !== undefined ? { finishedAt: run.finishedAt } : {}),
-            ...(run.seenAt !== undefined ? { seenAt: run.seenAt } : {}),
-            archived: run.archived,
-            ...(run.autoResumeAt !== undefined ? { autoResumeAt: run.autoResumeAt } : {}),
-            workflow: run.workflow,
-            ...(run.branch !== undefined ? { branch: run.branch } : {}),
-            ...(run.startedAt !== undefined ? { startedAt: run.startedAt } : {}),
-            // The tracker-reference inputs, verbatim — the cockpit's `taskReference()` owns the rule
-            // that picks between them (see the schema's note).
-            ...(run.pullRequestUrl !== undefined ? { pullRequestUrl: run.pullRequestUrl } : {}),
-            ...(run.referencedPullRequestUrl !== undefined
-                ? { referencedPullRequestUrl: run.referencedPullRequestUrl }
-                : {}),
-            ...(run.prNumber !== undefined ? { prNumber: run.prNumber } : {}),
-            ...(run.issueNumber !== undefined ? { issueNumber: run.issueNumber } : {}),
-            ...(run.referencedIssueUrl !== undefined ? { referencedIssueUrl: run.referencedIssueUrl } : {}),
-            ...(run.markerRefs !== undefined ? { markerRefs: run.markerRefs } : {}),
-            ...(run.costUsd !== undefined ? { costUsd: run.costUsd } : {}),
-            ...(run.peakRssBytes !== undefined ? { peakRssBytes: run.peakRssBytes } : {}),
-            ...(run.peakProcCount !== undefined ? { peakProcCount: run.peakProcCount } : {}),
-            // The live sample, on the same terms as `GET /runs`: process-wide sampler, so a
-            // workspace-level answer can carry it for every project's runs at once.
-            ...(usage ? { usage } : {}),
-        };
-    };
     /**
      * `GET /workspace/runs-index` — every registered project's recent tasks in one slim answer, so
      * ⌘K can find a task without knowing which project it lives in.
@@ -5421,8 +5708,13 @@ export function createApp(deps) {
      * search box must not resume work; see `runs/run-index.ts`.
      */
     const coldRepoHandles = new ColdRepoHandles();
-    const runsIndexRoutes = new Hono()
-        .get('/workspace/runs-index', async (c) => {
+    /**
+     * Every registered project whose runs can be read, and its owned store when this process holds
+     * one (`bootContext` for the boot project, `contexts.peek` otherwise) — never a built context.
+     * Without a store, the caller reads the project cold from `dataDir` with `handle`. The source
+     * rule both workspace run routes share, so the index and the search can never disagree on it.
+     */
+    const projectRunSources = async () => {
         let projects = [];
         try {
             const selector = capabilities().singleProject
@@ -5431,13 +5723,37 @@ export function createApp(deps) {
             projects = await listProjects(selector);
         }
         catch {
-            // unreadable workspace — an empty index, never a 500. The palette degrades to the
-            // active project's own run list, which it holds either way.
+            // unreadable workspace — no rows, never a 500. The palette degrades to the active
+            // project's own run list, which it holds either way.
         }
         const bootId = await resolveBootProject(projects);
         coldRepoHandles.retainRoots(new Set(projects
             .filter((project) => project.status !== 'missing' && project.id !== bootId && !contexts.peek(project.id))
             .map((project) => project.root)));
+        // No folder, no runs to read. `not-git` still has an `.ai/cezar` worth indexing.
+        return projects.filter((project) => project.status !== 'missing').map((project) => {
+            const owned = project.id === bootId ? bootContext : contexts.peek(project.id);
+            // A cold project's repository identity only: asking for an owned one starts a discovery
+            // nothing reads.
+            return { project, store: owned?.store, dataDir: join(project.root, '.ai/cezar'), handle: owned ? undefined : coldRepoHandles.get(project.root) };
+        });
+    };
+    /**
+     * One project's contribution to a workspace run route. An owned store throws what its database
+     * throws (busy, damaged); like a cold project that cannot be read, it then contributes nothing,
+     * so one project never fails every project's index or search (#864).
+     */
+    const readProjectRuns = (projectId, read) => {
+        try {
+            return read();
+        }
+        catch (error) {
+            console.warn(`[cez] runs of project ${projectId} could not be read for the workspace run index: ${error instanceof Error ? error.message : String(error)}`);
+            return { runs: [], truncated: false };
+        }
+    };
+    const runsIndexRoutes = new Hono()
+        .get('/workspace/runs-index', async (c) => {
         const runs = [];
         const truncated = [];
         // Statuses the server already holds, shipped WITH the rows that carry the references. The
@@ -5446,24 +5762,24 @@ export function createApp(deps) {
         // never touches `gh` and never slows the index down; anything cold stays absent and the
         // lazy `/github/ref-status` route fills it in.
         const referenceStatuses = {};
-        for (const project of projects) {
-            // No folder, no runs to read. `not-git` still has an `.ai/cezar` worth indexing.
-            if (project.status === 'missing')
-                continue;
-            const owned = project.id === bootId ? bootContext : contexts.peek(project.id);
-            // `listRuns()` already sorts newest-first; the disk reader returns file order, so both
-            // paths get sorted below rather than trusting either.
+        for (const { project, store: owned, dataDir, handle } of await projectRunSources()) {
+            // Both sources answer the same window, newest first: every unarchived run, plus the
+            // newest archived roots (#864). An owned project lays its held records over its rows; a
+            // cold one reads its stored summaries, at most one archived root past the window.
             //
             // Archived runs are INCLUDED. The active project's rows reach the palette through
-            // `GET /runs`, which has always carried them, and excluding them here would mean a task
+            // `GET /run-summaries`, which carries them too, and excluding them here would mean a task
             // is findable while you stand in its project and vanishes the moment you leave — the
             // exact asymmetry a cross-project finder exists to remove.
-            const recent = (owned ? owned.store.listRuns() : readRunIndexFromDisk(join(project.root, '.ai/cezar'), coldRepoHandles.get(project.root))).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
-            if (recent.length > RUNS_INDEX_PER_PROJECT)
+            const window = readProjectRuns(project.id, () => owned
+                ? owned.listRunSummaries({ archivedWindow: RUNS_INDEX_PER_PROJECT, roots: true })
+                : readRunIndexFromDisk(dataDir, { handle, archivedWindow: RUNS_INDEX_PER_PROJECT, roots: true }));
+            if (window.truncated)
                 truncated.push(project.id);
+            const recent = window.runs.map(withLiveUsage);
             const mentioned = [];
-            for (const run of recent.slice(0, RUNS_INDEX_PER_PROJECT)) {
-                runs.push(runIndexEntry(project.id, run));
+            for (const run of recent) {
+                runs.push({ projectId: project.id, ...run });
                 mentioned.push(...mentionedReferenceNumbers(run));
             }
             if (mentioned.length > 0) {
@@ -5484,6 +5800,35 @@ export function createApp(deps) {
             referenceStatuses,
         };
         return c.json(body);
+    })
+        /**
+         * `GET /workspace/runs-search` (#864) — every registered project's ROOT runs, archived or not,
+         * that match `q`, newest first: what lets ⌘K find a run past a project's window. Same source
+         * rule and the same side-effect-free contract as the index above.
+         */
+        .get('/workspace/runs-search', queryZodValidator(runsSearchQuerySchema), async (c) => {
+        const { q, limit = RUNS_SEARCH_PER_PROJECT_MAX } = c.req.valid('query');
+        const runs = [];
+        const truncated = [];
+        const tokens = searchTokens(q);
+        for (const { project, store: owned, dataDir, handle } of await projectRunSources()) {
+            // The palette filters its rows by project name too, so a token naming this project is
+            // already satisfied here: `shop database` searches shop for `database` (#864 review). A
+            // query that only names the project adds nothing past the index's rows for it.
+            const name = project.name.toLowerCase();
+            const rest = tokens.filter((token) => !name.includes(token));
+            if (rest.length === 0)
+                continue;
+            const scoped = rest.join(' ');
+            const found = readProjectRuns(project.id, () => owned ? owned.searchRunSummaries(scoped, limit) : searchRunIndexFromDisk(dataDir, scoped, { handle, limit }));
+            if (found.truncated)
+                truncated.push(project.id);
+            for (const run of found.runs)
+                runs.push({ projectId: project.id, ...withLiveUsage(run) });
+        }
+        runs.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+        const body = { runs, truncated };
+        return c.json(body);
     });
     // Workspace-level families answer for the whole workspace, so they are single-mount: never a
     // project-scoped spelling, which would be a second surface to protect with no consumer.
@@ -5532,12 +5877,16 @@ function taskWebhookHost(bindHost) {
     return bindHost.includes(':') ? `[${bindHost}]` : bindHost;
 }
 const NO_WEBHOOK_ERROR = 'this project has no task webhook — set one in Settings → General → Task webhook, or start without notify';
-export function startServer(deps, port) {
+export function startServer(deps, port, listener) {
     const workspaceEvents = deps.workspaceEvents ?? new WorkspaceEventBus();
     const skillsUpdate = deps.skillsUpdate ?? new SkillsUpdateService({ invalidateCatalog: refreshTeamSkills });
     // The subscription hub rides the same HTTP server (one port, zero config):
     // createApp registers the topics, the `upgrade` hook below owns the socket.
     const socketHub = deps.socketHub ?? createSocketHub();
+    // `cezar_preview_serve` refuses the cockpit's own port: the one the listener BOUND (`--port 0`).
+    let listeningPort;
+    const cezarPort = deps.cezarPort ?? (() => listeningPort);
+    const projectLookup = {};
     const automationCoordinator = new AutomationCoordinator({ listProjects });
     const bootProjectId = deps.bootProjectId ?? 'default';
     const bootAutomationStore = automationCoordinator.store(bootProjectId, deps.repoRoot);
@@ -5546,6 +5895,8 @@ export function startServer(deps, port) {
         ownership: deps.ownership,
         listProjects,
         semaphore: deps.semaphore,
+        preview: deps.previewHost,
+        cezarPort,
         automationStore: (projectId, root) => automationCoordinator.store(projectId, root),
         prepareManager: (project) => {
             taskWebhooks.attach(project);
@@ -5567,14 +5918,16 @@ export function startServer(deps, port) {
         workspaceEvents,
         skillsUpdate,
         socketHub,
+        cezarPort,
+        projectLookup,
         automationsChanged: () => rescheduleAutomations(),
     });
     // SECURITY: default to loopback. This server executes agents locally and its endpoints are
     // same-origin-trusted (only /api/health is CORS-open); binding to a non-loopback host would
     // expose an agent-executing box to the network. `bindHost` exists only for a deliberate
     // hosted/VPS deployment (which also flips CEZ_REMOTE to gate the local-handoff endpoints) —
-    // src/index.ts never passes it, so the loopback guarantee holds for the normal CLI.
-    const server = serve({
+    // The CLI passes it only when explicitly requested; normal startup stays on loopback.
+    const serverOptions = {
         fetch: async (request, env) => {
             const result = await app.fetch(request, env);
             if (request.method === 'POST' && new URL(request.url).pathname === '/api/v1/workspace/application-update/restart'
@@ -5599,27 +5952,85 @@ export function startServer(deps, port) {
         },
         port,
         hostname: deps.bindHost ?? '127.0.0.1',
-    });
+    };
+    // The CLI already owns this listener before recovery. Replace its temporary 503
+    // handler without closing/rebinding; direct server callers retain normal startup.
+    if (listener) {
+        listener.removeAllListeners('request');
+        listener.on('request', getRequestListener(serverOptions.fetch, { hostname: serverOptions.hostname }));
+    }
+    const server = listener ?? serve(serverOptions);
     const coordinator = new SkillsUpdateCoordinator(skillsUpdate, async () => effectiveSkillsAutoUpdate(await loadWorkspaceConfig()));
+    // EVERY registered project, remote or not: a schedule needs none. `github` is present only for
+    // a github.com remote, and only then does the project's handle poll.
     const automationProjects = new Map();
+    const rememberAutomationProject = async (id, root) => {
+        const parsed = parseRemote((await getRepoInfo(root))?.remote ?? '');
+        automationProjects.set(id, {
+            root,
+            ...(parsed?.host === 'github.com' ? { github: { owner: parsed.owner, repo: parsed.repo } } : {}),
+        });
+    };
+    const emitWorkspaceAutomationChange = (projectId) => (automationId, revision) => workspaceEvents.emit('automation-change', { project: projectId, automationId, revision });
+    /**
+     * The boot brake for one project, at boot and for a project registered after it: an enabled
+     * poll idle past its lookback is re-baselined rather than resumed from a stale cursor. Only a
+     * project with a github.com remote: its polls are the only ones the timer arms, so a poll
+     * without one never succeeds and would be re-baselined on every boot, forever.
+     */
+    const brakeIdleAutomations = (id, automationStore) => {
+        if (!automationStore || !automationProjects.get(id)?.github)
+            return;
+        rebaselineIdleAutomations(automationStore, emitWorkspaceAutomationChange(id));
+    };
     const automationScheduler = new WorkspaceAutomationScheduler({
         coordinator: automationCoordinator,
         handle: (projectId, store) => {
             const project = automationProjects.get(projectId);
             if (!project)
                 return undefined;
+            const timeZone = localTimeZone();
+            const launchContext = async () => projectId === (deps.bootProjectId ?? 'default')
+                ? { root: deps.repoRoot, manager: deps.manager, store: deps.store }
+                : await sharedContexts.context(projectId);
             return {
                 projectId,
-                owner: project.owner,
-                repo: project.repo,
                 store,
-                poller: new GithubPoller(),
-                onChange: (automationId, revision) => workspaceEvents.emit('automation-change', { project: projectId, automationId, revision }),
+                timeZone,
+                ...(project.github ? { github: { ...project.github, poller: new GithubPoller() } } : {}),
+                onChange: emitWorkspaceAutomationChange(projectId),
+                // Building a lazy project's context reconciles on its own; the explicit call covers the
+                // boot project and a context built before another process left the reservation.
+                reconcileReceipts: async () => { reconcileAutomationReceipts(store, (await launchContext()).store); },
+                // A run store that cannot open (#779) launches nothing. Firing anyway would count every
+                // refusal towards the auto-pause, and the pause would outlive the restart that fixed it.
+                ready: async () => {
+                    try {
+                        const { store: runs } = await launchContext();
+                        if (runs.unavailable)
+                            throw runs.unavailable;
+                    }
+                    catch (error) {
+                        if (error instanceof RunStoreOpenError)
+                            throw new AutomationProjectUnavailableError(error.message, { cause: error });
+                        throw error;
+                    }
+                },
+                launchSchedule: async (definition, occurrence, receiptId) => {
+                    const context = await launchContext();
+                    return launchScheduledRun({
+                        root: context.root,
+                        manager: context.manager,
+                        store: context.store,
+                        definition,
+                        occurrence,
+                        receiptId,
+                        projectName: basename(context.root),
+                        timeZone,
+                    });
+                },
                 launch: async (definition, candidate, receiptId) => {
-                    const bootId = deps.bootProjectId ?? 'default';
-                    const context = projectId === bootId
-                        ? { root: deps.repoRoot, manager: deps.manager, store: deps.store }
-                        : await sharedContexts.context(projectId);
+                    const context = await launchContext();
                     return launchAutomationRun({
                         root: context.root,
                         manager: context.manager,
@@ -5645,12 +6056,13 @@ export function startServer(deps, port) {
             const project = data.project;
             if (project && typeof project.id === 'string' && typeof project.root === 'string' && project.status !== 'missing') {
                 coordinator.add(project.id, project.root);
-                void getRepoInfo(project.root).then((info) => {
-                    const parsed = parseRemote(info?.remote ?? '');
-                    if (parsed?.host === 'github.com')
-                        automationProjects.set(project.id, { root: project.root, owner: parsed.owner, repo: parsed.repo });
+                const { id, root } = project;
+                void rememberAutomationProject(id, root).then(() => {
+                    if (!automationsEnabled())
+                        return;
+                    brakeIdleAutomations(id, automationCoordinator.store(id, root));
                     return rescheduleAutomations();
-                });
+                }).catch(() => undefined);
             }
         }
         else if (event === 'project-removed') {
@@ -5664,41 +6076,72 @@ export function startServer(deps, port) {
             }
         }
     });
-    server.once('listening', () => {
+    const startBackgroundServices = () => {
         void listProjects().then((projects) => {
             const all = projects.some((project) => project.root === deps.repoRoot)
                 ? projects : [{ id: deps.bootProjectId ?? 'default', root: deps.repoRoot, status: 'ok' }, ...projects];
             coordinator.start(all);
+            // #781: every registered project's preview leftovers, not only the boot project's.
+            void sweepRegisteredPreviewLeftovers(all, deps.previewHost).catch(() => 0);
             // #801: with automations off there is nothing to warm — no remote to resolve, no receipts
             // to reconcile, and above all no scheduler to start. The skills-update coordinator above is
             // a separate feature and starts either way.
             if (!automationsEnabled())
                 return;
             void Promise.all(all.map(async (project) => {
-                const parsed = parseRemote((await getRepoInfo(project.root))?.remote ?? '');
-                if (parsed?.host === 'github.com')
-                    automationProjects.set(project.id, { root: project.root, owner: parsed.owner, repo: parsed.repo });
+                await rememberAutomationProject(project.id, project.root);
                 const automationStore = automationCoordinator.store(project.id, project.root);
                 const runStore = project.id === (deps.bootProjectId ?? 'default')
                     ? deps.store
                     : sharedContexts.peek(project.id)?.store;
-                if (automationStore && runStore)
+                // A run store that could not open (#779) cannot say which receipts launched a run.
+                if (automationStore && runStore && !runStore.unavailable)
                     reconcileAutomationReceipts(automationStore, runStore);
+                // After reconciliation and before the timer arms.
+                brakeIdleAutomations(project.id, automationStore);
             })).then(() => automationScheduler.start()).catch(() => undefined);
         }).catch(() => undefined);
+    };
+    if (server.listening)
+        startBackgroundServices();
+    else
+        server.once('listening', startBackgroundServices);
+    // The boot store's preview leftovers and run deletions; lazy projects arm theirs at build.
+    armPreview(deps.store, join(deps.repoRoot, '.ai/cezar'), deps.previewHost);
+    const previewSocket = createPreviewSocket({
+        host: deps.previewHost,
+        verify: (req) => verifyWsUpgrade(req, deps.bindHost),
+        resolveProject: async (projectId) => projectLookup.resolve?.(projectId),
+    });
+    server.once('close', () => {
+        unsubscribe();
+        coordinator.stop();
+        automationScheduler.stop();
+        sharedContexts.disposeAll();
+        void deps.delegation?.close();
+        socketHub.close();
+        previewSocket.close();
+        void deps.previewHost?.close().catch(() => undefined);
     });
-    server.once('close', () => { unsubscribe(); coordinator.stop(); automationScheduler.stop(); sharedContexts.disposeAll(); void deps.delegation?.close(); });
-    socketHub.attach(server, (req) => verifyWsUpgrade(req, deps.bindHost));
+    // The one `upgrade` listener: the subscription bus and the preview pane's socket (#781).
+    attachUpgradeRouter(server, [socketHubRoute(socketHub, (req) => verifyWsUpgrade(req, deps.bindHost)), previewSocket.route]);
     const shutdownForRestart = async () => {
-        sharedContexts.disposeAll(); // flush every built secondary project before old process exits
+        sharedContexts.disposeAll(); // close every built secondary project before old process exits
         deps.store.flush();
         socketHub.close();
+        // Dev servers run in their own process groups: they outlive cezar unless stopped here.
+        // A failed release must not abort the restart halfway, with the store flushed and the port still bound.
+        await deps.previewHost?.close().catch(() => undefined);
+        previewSocket.close();
         await deps.delegation?.close();
         await new Promise((resolve) => {
             server.close(() => resolve());
             if ('closeAllConnections' in server)
                 server.closeAllConnections();
         });
+        // Last, with no request left to serve: write what is still pending and release every claim,
+        // so the replacement process finds the live runs nobody's, as a clean stop leaves them (#779).
+        deps.store.close();
     };
     // The task webhook's thread links name the port the listener BOUND (#594 review): `--port 0`
     // asks for an ephemeral one, so the requested number is not an address. Deliveries queue
@@ -5706,6 +6149,7 @@ export function startServer(deps, port) {
     const setTaskWebhookOrigin = () => {
         const address = server.address();
         const bound = address && typeof address === 'object' ? address.port : port;
+        listeningPort = bound;
         taskWebhooks.setOrigin(`http://${taskWebhookHost(deps.bindHost)}:${bound}`);
     };
     if (server.listening)
@@ -5872,6 +6316,11 @@ export function resumeCommand(runner, sessionId) {
         }
         case 'pi':
             return `pi --session ${sessionId}`;
+        case 'omp': {
+            // CEZ_OMP_BIN may name a different install than `omp` on PATH; resume with the configured one.
+            const executable = quoteExecutable(resolveOmpExecutable(), process.platform);
+            return executable === null ? null : `${executable} --resume ${sessionId}`;
+        }
         default:
             return `claude --resume ${sessionId}`;
     }